craft-native 0.0.122 → 0.0.124

package/dist/ios/templates/CraftApp.swift

@@ -30,10 +30,92 @@ import WidgetKit
 import Intents
 import WatchConnectivity
 import ActivityKit
+import SafariServices
 
 extension Notification.Name {
     static let craftPushToken = Notification.Name("craftPushToken")
     static let craftPushRegistrationError = Notification.Name("craftPushRegistrationError")
+    /// The screen's Light or Dark appearance changed (SwiftUI sees it first).
+    static let craftColorSchemeChanged = Notification.Name("craftColorSchemeChanged")
+}
+
+/// The reading and motion settings the page should match: text size, Reduce
+/// Motion, Reduce Transparency, Light or Dark.
+///
+/// A web page sees Dark Mode through `prefers-color-scheme` and Reduce Motion
+/// through `prefers-reduced-motion`, but not the Dynamic Type size a native
+/// app's text follows, so a page could not grow its text with everything else
+/// on the phone. The shell tells it, from the first byte of every document
+/// (`--craft-font-scale` and `data-craft-*` on the root element) and with a
+/// `craftAppearance` event when any of it changes.
+enum CraftPageAppearance {
+    static func snapshot(style: UIUserInterfaceStyle) -> [String: Any] {
+        let category = UIApplication.shared.preferredContentSizeCategory
+        let traits = UITraitCollection(preferredContentSizeCategory: category)
+        // How much body text has grown or shrunk from its default 17 points.
+        let scale = UIFontMetrics(forTextStyle: .body).scaledValue(for: 17, compatibleWith: traits) / 17
+        return [
+            "contentSizeCategory": name(category),
+            "fontScale": (Double(scale) * 1000).rounded() / 1000,
+            "reduceMotion": UIAccessibility.isReduceMotionEnabled,
+            "reduceTransparency": UIAccessibility.isReduceTransparencyEnabled,
+            "colorScheme": style == .dark ? "dark" : "light",
+        ]
+    }
+
+    /// The script that applies a snapshot to the page, announcing it as
+    /// `craftAppearance` when `announce` is true.
+    static func script(_ snapshot: [String: Any], announce: Bool) -> String {
+        guard let data = try? JSONSerialization.data(withJSONObject: snapshot),
+              let json = String(data: data, encoding: .utf8) else { return "" }
+        return """
+        (function(a) {
+            var root = document.documentElement;
+            if (root) {
+                root.style.setProperty('--craft-font-scale', String(a.fontScale));
+                root.setAttribute('data-craft-reduce-motion', a.reduceMotion ? 'true' : 'false');
+                root.setAttribute('data-craft-reduce-transparency', a.reduceTransparency ? 'true' : 'false');
+                root.setAttribute('data-craft-content-size', a.contentSizeCategory);
+            }
+            window.__craftAppearance = a;
+            \(announce ? "window.dispatchEvent(new CustomEvent('craftAppearance', {detail: a}));" : "")
+        })(\(json));
+        """
+    }
+
+    private static func name(_ category: UIContentSizeCategory) -> String {
+        switch category {
+        case .extraSmall: return "extraSmall"
+        case .small: return "small"
+        case .medium: return "medium"
+        case .large: return "large"
+        case .extraLarge: return "extraLarge"
+        case .extraExtraLarge: return "extraExtraLarge"
+        case .extraExtraExtraLarge: return "extraExtraExtraLarge"
+        case .accessibilityMedium: return "accessibilityMedium"
+        case .accessibilityLarge: return "accessibilityLarge"
+        case .accessibilityExtraLarge: return "accessibilityExtraLarge"
+        case .accessibilityExtraExtraLarge: return "accessibilityExtraExtraLarge"
+        case .accessibilityExtraExtraExtraLarge: return "accessibilityExtraExtraExtraLarge"
+        default: return "large"
+        }
+    }
+}
+
+/// Tells the shell when SwiftUI's colour scheme changes: the one appearance
+/// setting with no notification of its own.
+struct CraftColorSchemeObserver: View {
+    @Environment(\.colorScheme) private var colorScheme
+
+    var body: some View {
+        Color.clear
+            .frame(width: 0, height: 0)
+            .allowsHitTesting(false)
+            .accessibilityHidden(true)
+            .onChange(of: colorScheme) { _ in
+                NotificationCenter.default.post(name: .craftColorSchemeChanged, object: nil)
+            }
+    }
 }
 
 /// Which failed page loads mean the remote origin is out of reach (#252).
@@ -72,9 +154,49 @@ enum CraftLoadFailure {
     }
 }
 
+/// How many times a dead web content process is brought back before the
+/// shell stops and shows the offline page instead.
+///
+/// The port of `webview_recovery.zig`'s budget. Reloading on every crash is
+/// the whole fix for a white screen, and reloading unconditionally is the
+/// whole problem: a page that reliably kills its renderer (out of memory, a
+/// bad WebGL context) would be reloaded into the same crash forever. The
+/// budget is a rate, not a lifetime count: an app that loses its renderer
+/// once a day is healthy, so a crash more than `resetAfter` after the last
+/// one starts a new burst with its budget back.
+///
+/// Foundation only, and given the clock, so `scripts/recovery-budget.ts`
+/// can compile and run it on its own.
+struct CraftRecoveryBudget {
+    enum Action: Equatable {
+        case reload
+        case giveUp
+    }
+
+    var maxAttempts = 3
+    var resetAfter: TimeInterval = 60
+    private(set) var attempts = 0
+    private(set) var lastCrash: TimeInterval?
+
+    mutating func onCrash(at now: TimeInterval) -> Action {
+        let sameBurst = lastCrash.map { now - $0 < resetAfter } ?? false
+        attempts = sameBurst ? attempts + 1 : 1
+        lastCrash = now
+        return attempts <= maxAttempts ? .reload : .giveUp
+    }
+
+    /// Someone asked for the page again (Retry): a fresh budget.
+    mutating func reset() {
+        attempts = 0
+        lastCrash = nil
+    }
+}
+
 final class CraftAppDelegate: NSObject, UIApplicationDelegate, UNUserNotificationCenterDelegate {
     func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]? = nil) -> Bool {
         UNUserNotificationCenter.current().delegate = self
+        // Before launch finishes, which is the only time iOS accepts it.
+        CraftBackgroundWork.shared.registerRefresh(CraftConfig.bundled())
         if let shortcut = launchOptions?[.shortcutItem] as? UIApplicationShortcutItem {
             CraftEventManager.shared.handleShortcut(shortcut)
             // Returning false tells UIKit the launch-time item was handled and
@@ -90,7 +212,28 @@ final class CraftAppDelegate: NSObject, UIApplicationDelegate, UNUserNotificatio
     }
 
     func application(_ application: UIApplication, continue userActivity: NSUserActivity, restorationHandler: @escaping ([UIUserActivityRestoring]?) -> Void) -> Bool {
-        CraftEventManager.shared.handleSiriActivity(userActivity)
+        // A universal link takes the same road as a custom-scheme link. The
+        // scene's onContinueUserActivity is where they normally arrive; this
+        // is the road for a launch that does not go through a scene.
+        if userActivity.activityType == NSUserActivityTypeBrowsingWeb, let url = userActivity.webpageURL {
+            DeepLinkManager.shared.handleURL(url)
+            return true
+        }
+        return CraftEventManager.shared.handleSiriActivity(userActivity)
+    }
+
+    /// A push with `content-available`: the page gets `craftSilentPush` with
+    /// the payload, and iOS gets its answer when the page calls
+    /// `craft.background.complete(ok)`, or after 25 seconds, inside the 30 iOS
+    /// allows.
+    func application(_ application: UIApplication, didReceiveRemoteNotification userInfo: [AnyHashable: Any], fetchCompletionHandler completionHandler: @escaping (UIBackgroundFetchResult) -> Void) {
+        CraftBackgroundWork.shared.begin("craftSilentPush", detail: ["payload": CraftEventManager.pageData(userInfo)]) { ok in
+            switch ok {
+            case true?: completionHandler(.newData)
+            case false?: completionHandler(.failed)
+            case nil: completionHandler(.noData)
+            }
+        }
     }
 
     func application(_ application: UIApplication, didRegisterForRemoteNotificationsWithDeviceToken deviceToken: Data) {
@@ -170,7 +313,7 @@ class CraftEventManager {
         sendToWeb("craftNotificationReceived", data: Self.pageData(userInfo))
     }
 
-    private static func pageData(_ userInfo: [AnyHashable: Any]) -> [String: Any] {
+    static func pageData(_ userInfo: [AnyHashable: Any]) -> [String: Any] {
         var data: [String: Any] = [:]
         for (key, value) in userInfo {
             guard let key = key as? String else { continue }
@@ -194,7 +337,8 @@ class CraftEventManager {
         return true
     }
 
-    private func sendToWeb(_ event: String, data: [String: Any]) {
+    /// Dispatch now if the page can hear it, or hold it until it can.
+    func sendToWeb(_ event: String, data: [String: Any]) {
         guard isReady, webView != nil else {
             pendingEvents.append((event, data))
             return
@@ -213,6 +357,99 @@ class CraftEventManager {
     }
 }
 
+// MARK: - Background work
+
+/// The page's share of background time: a silent push (`craftSilentPush`) and
+/// iOS's scheduled app refresh (`craftBackgroundRefresh`). Each holds iOS's
+/// completion until the page calls `craft.background.complete(ok)` (with the
+/// event's `id`, or with none for everything pending), or for 25 seconds.
+///
+/// The page has to be alive to do the work: when iOS wakes an app it had
+/// suspended, it is; when it launches one it had ended, the event waits for
+/// the page like any other and the deadline answers iOS.
+final class CraftBackgroundWork {
+    static let shared = CraftBackgroundWork()
+    static let deadline: TimeInterval = 25
+
+    private var pending: [String: (Bool?) -> Void] = [:]
+    private var refreshIdentifier: String?
+    private var refreshInterval: TimeInterval = 15 * 60
+
+    private init() {}
+
+    /// Tell the page, and hold `finish` until it answers: true or false from
+    /// the page, nil when the deadline passed first.
+    @discardableResult
+    func begin(_ event: String, detail: [String: Any], finish: @escaping (Bool?) -> Void) -> String {
+        let id = UUID().uuidString
+        pending[id] = finish
+        var detail = detail
+        detail["id"] = id
+        CraftEventManager.shared.sendToWeb(event, data: detail)
+        DispatchQueue.main.asyncAfter(deadline: .now() + Self.deadline) { [weak self] in self?.end(id, ok: nil) }
+        return id
+    }
+
+    /// `craft.background.complete(ok, id?)`.
+    func complete(id: String?, ok: Bool) {
+        if let id {
+            end(id, ok: ok)
+        } else {
+            for id in Array(pending.keys) { end(id, ok: ok) }
+        }
+    }
+
+    private func end(_ id: String, ok: Bool?) {
+        guard let finish = pending.removeValue(forKey: id) else { return }
+        finish(ok)
+    }
+
+    /// BGAppRefreshTask, when `backgroundRefresh.enabled`: registered at
+    /// launch, asked for again each time the app goes to the background and
+    /// after each run, no sooner than `minimumIntervalMinutes` (15 by
+    /// default). iOS decides when it actually runs.
+    func registerRefresh(_ config: CraftConfig) {
+        guard let refresh = config.backgroundRefresh, refresh.enabled else { return }
+        let identifier = refresh.identifier.flatMap { $0.isEmpty ? nil : $0 }
+            ?? "\(Bundle.main.bundleIdentifier ?? config.bundleId).refresh"
+        refreshIdentifier = identifier
+        refreshInterval = max(1, refresh.minimumIntervalMinutes ?? 15) * 60
+        let registered = BGTaskScheduler.shared.register(forTaskWithIdentifier: identifier, using: nil) { task in
+            DispatchQueue.main.async { CraftBackgroundWork.shared.run(task) }
+        }
+        guard registered else {
+            print("Craft: background refresh \(identifier) could not be registered; is it in BGTaskSchedulerPermittedIdentifiers?")
+            return
+        }
+        NotificationCenter.default.addObserver(forName: UIApplication.didEnterBackgroundNotification, object: nil, queue: .main) { _ in
+            CraftBackgroundWork.shared.scheduleRefresh()
+        }
+    }
+
+    func scheduleRefresh() {
+        guard let refreshIdentifier else { return }
+        let request = BGAppRefreshTaskRequest(identifier: refreshIdentifier)
+        request.earliestBeginDate = Date(timeIntervalSinceNow: refreshInterval)
+        do {
+            try BGTaskScheduler.shared.submit(request)
+        } catch {
+            // The simulator refuses every request; a device refuses one
+            // with Background App Refresh off.
+            print("Craft: background refresh not scheduled: \(error)")
+        }
+    }
+
+    private func run(_ task: BGTask) {
+        scheduleRefresh()
+        let id = begin("craftBackgroundRefresh", detail: [:]) { ok in
+            task.setTaskCompleted(success: ok ?? false)
+        }
+        task.expirationHandler = {
+            DispatchQueue.main.async { CraftBackgroundWork.shared.end(id, ok: false) }
+        }
+    }
+}
+
 // MARK: - App Entry Point
 @main
 struct CraftApp: App {
@@ -225,8 +462,15 @@ struct CraftApp: App {
                 if appState.config.renderer == "native" {
                     CraftNativeScreen(config: appState.config)
                 } else {
-                    CraftWebView(config: appState.config)
-                        .ignoresSafeArea()
+                    // The page's own chrome, drawn natively over it: the tab
+                    // bar the page asks for, and the splash until it is ready.
+                    ZStack(alignment: .bottom) {
+                        CraftColorSchemeObserver()
+                        CraftWebView(config: appState.config)
+                            .ignoresSafeArea()
+                        CraftTabBarView()
+                        CraftSplashView(background: appState.config.resolvedBackgroundColor)
+                    }
                 }
             }
                 .preferredColorScheme(appState.config.colorScheme)
@@ -244,6 +488,329 @@ struct CraftApp: App {
     }
 }
 
+// MARK: - Native chrome: the tab bar and the launch splash
+//
+// Both belong to the screen rather than to the page, so they are drawn here in
+// SwiftUI and the page only describes them. The page reaches them through the
+// `craftChrome` message handler, which exists from the first byte of the
+// document; `window.craft` arrives only once the page has finished loading,
+// images and all, and a tab bar or a splash that waited for it would be late
+// on every launch.
+
+final class CraftChrome: ObservableObject {
+    static let shared = CraftChrome()
+
+    struct Tab: Identifiable, Equatable {
+        let id: String
+        let title: String
+        let symbol: String
+        let badge: String?
+    }
+
+    @Published var tabs: [Tab] = []
+    @Published var selected: String?
+    @Published var tabBarVisible = false
+    @Published var splashVisible = true
+    @Published var tint: UIColor?
+
+    weak var webView: WKWebView?
+    /// What the tab bar covers at the bottom of the screen, in points.
+    private var occupied: CGFloat = 0
+    private var pendingHide: DispatchWorkItem?
+    private var splashDeadline: DispatchWorkItem?
+
+    private init() {}
+
+    /// However the page behaves, the splash is gone after `seconds`
+    /// (`splashMaxSeconds`, three by default). It used to be ten: a page that
+    /// never painted held a logo on screen for ten seconds, which reads as a
+    /// hang rather than a launch.
+    func holdSplash(atMost seconds: Double) {
+        splashDeadline?.cancel()
+        let deadline = DispatchWorkItem { [weak self] in self?.hideSplash() }
+        splashDeadline = deadline
+        DispatchQueue.main.asyncAfter(deadline: .now() + max(0.5, seconds), execute: deadline)
+    }
+
+    func handle(_ body: [String: Any]) {
+        switch body["type"] as? String {
+        case "tabBar":
+            pendingHide?.cancel()
+            tabs = (body["tabs"] as? [[String: Any]] ?? []).compactMap { item in
+                guard let id = item["id"] as? String, let title = item["title"] as? String else { return nil }
+                let badge = (item["badge"] as? String).flatMap { $0.isEmpty ? nil : $0 }
+                return Tab(id: id, title: title, symbol: item["symbol"] as? String ?? "circle", badge: badge)
+            }
+            if let selected = body["selected"] as? String { self.selected = selected }
+            if let hex = body["tint"] as? String {
+                let light = UIColor(hex: hex)
+                let dark = (body["tintDark"] as? String).flatMap { UIColor(hex: $0) }
+                tint = light.map { light in dark.map { dark in UIColor { $0.userInterfaceStyle == .dark ? dark : light } } ?? light }
+            }
+            withAnimation(Self.motion(.easeOut(duration: 0.2))) { tabBarVisible = !tabs.isEmpty }
+            publishLayout()
+        case "selectTab":
+            if let id = body["id"] as? String, id != selected {
+                withAnimation(Self.motion(.spring(response: 0.32, dampingFraction: 0.86))) { selected = id }
+            }
+        case "hideTabBar":
+            // Later, and only if no screen asks for the bar meanwhile: moving
+            // between two screens that both have it unmounts one bar and
+            // mounts the next, and the bar must not blink in between.
+            pendingHide?.cancel()
+            let hide = DispatchWorkItem { [weak self] in
+                withAnimation(Self.motion(.easeIn(duration: 0.18))) { self?.tabBarVisible = false }
+                self?.occupied = 0
+                self?.publishLayout()
+            }
+            pendingHide = hide
+            DispatchQueue.main.asyncAfter(deadline: .now() + 0.15, execute: hide)
+        case "ready":
+            hideSplash()
+        case "painted":
+            // The page's first contentful paint, two frames on: something of
+            // the page is on screen, so the launch screen has done its job
+            // even if the page never says `ready`.
+            hideSplash()
+        default:
+            break
+        }
+    }
+
+    /// A tap on a tab: the page navigates, and says which tab is current.
+    ///
+    /// No haptic. UITabBar plays none, and a tab bar that ticks on every tap is
+    /// one of the small things that gives a web shell away.
+    func tap(_ tab: Tab) {
+        if tab.id != selected {
+            withAnimation(Self.motion(.spring(response: 0.32, dampingFraction: 0.86))) { selected = tab.id }
+        }
+        emit("craftTabSelect", ["id": tab.id])
+    }
+
+    /// The animation, or none with Reduce Motion on: the selection jumps to
+    /// its tab rather than springing there, as UIKit's own controls do.
+    static func motion(_ animation: Animation) -> Animation? {
+        UIAccessibility.isReduceMotionEnabled ? nil : animation
+    }
+
+    /// The splash again, over a page that is being rebuilt (the web content
+    /// process died), rather than the white flash of a reload.
+    func showSplash(atMost seconds: Double) {
+        withAnimation(nil) { splashVisible = true }
+        holdSplash(atMost: seconds)
+    }
+
+    func hideSplash() {
+        splashDeadline?.cancel()
+        splashDeadline = nil
+        guard splashVisible else { return }
+        withAnimation(.easeOut(duration: 0.28)) { splashVisible = false }
+    }
+
+    /// The paint half of "until the page is ready or has painted": tells the
+    /// shell once the document's first contentful paint is on screen.
+    static let paintScript = """
+    (function() {
+        try {
+            var handler = window.webkit && window.webkit.messageHandlers && window.webkit.messageHandlers.craftChrome;
+            if (!handler || typeof PerformanceObserver !== 'function') return;
+            var sent = false;
+            var send = function() {
+                if (sent) return;
+                sent = true;
+                requestAnimationFrame(function() { requestAnimationFrame(function() { handler.postMessage({type: 'painted'}); }); });
+            };
+            var observer = new PerformanceObserver(function(list) {
+                list.getEntries().forEach(function(entry) {
+                    if (entry.name === 'first-contentful-paint') { send(); observer.disconnect(); }
+                });
+            });
+            observer.observe({type: 'paint', buffered: true});
+        } catch (e) {}
+    })();
+    """
+
+    /// A page that loaded and never said it was ready still gets shown.
+    func pageFinished() {
+        DispatchQueue.main.asyncAfter(deadline: .now() + 1.2) { [weak self] in self?.hideSplash() }
+    }
+
+    func layoutChanged(_ height: CGFloat) {
+        let rounded = height.rounded()
+        guard rounded != occupied else { return }
+        occupied = rounded
+        publishLayout()
+    }
+
+    /// The bar's height as `--craft-tab-bar-height`, so the page leaves room
+    /// for it, and as an event for anything that measures.
+    func publishLayout() {
+        let height = tabBarVisible ? Int(occupied) : 0
+        let script = "document.documentElement.style.setProperty('--craft-tab-bar-height','\(height)px');window.dispatchEvent(new CustomEvent('craftTabBarLayout',{detail:{height:\(height)}}));"
+        DispatchQueue.main.async { [weak self] in self?.webView?.evaluateJavaScript(script, completionHandler: nil) }
+    }
+
+    private func emit(_ event: String, _ detail: [String: Any]) {
+        guard let data = try? JSONSerialization.data(withJSONObject: detail),
+              let json = String(data: data, encoding: .utf8) else { return }
+        let script = "window.dispatchEvent(new CustomEvent('\(event)',{detail:\(json)}));"
+        DispatchQueue.main.async { [weak self] in self?.webView?.evaluateJavaScript(script, completionHandler: nil) }
+    }
+}
+
+/// Receives the page's chrome messages. Only from a trusted origin, like the bridge.
+final class CraftChromeRelay: NSObject, WKScriptMessageHandler {
+    private let trusts: (WKSecurityOrigin) -> Bool
+
+    init(trusts: @escaping (WKSecurityOrigin) -> Bool) {
+        self.trusts = trusts
+    }
+
+    func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
+        guard message.frameInfo.isMainFrame, trusts(message.frameInfo.securityOrigin),
+              let body = message.body as? [String: Any] else { return }
+        DispatchQueue.main.async { CraftChrome.shared.handle(body) }
+    }
+}
+
+/// The floating tab bar: Liquid Glass on iOS 26 and later, a material capsule before.
+struct CraftTabBarView: View {
+    @ObservedObject private var chrome = CraftChrome.shared
+    @Namespace private var selection
+    @Environment(\.accessibilityReduceMotion) private var reduceMotion
+    // Dynamic Type, relative to the styles UIKit's own bar uses. The bar is
+    // capped at the largest standard size (below), as UITabBar is; past that
+    // a long press shows the large content viewer instead.
+    @ScaledMetric(relativeTo: .title3) private var iconSize: CGFloat = 20
+    @ScaledMetric(relativeTo: .caption2) private var labelSize: CGFloat = 11
+    @ScaledMetric(relativeTo: .caption2) private var badgeSize: CGFloat = 10
+
+    var body: some View {
+        if chrome.tabBarVisible && !chrome.tabs.isEmpty {
+            bar
+                .padding(.horizontal, 16)
+                .padding(.bottom, 4)
+                .background(GeometryReader { proxy in
+                    Color.clear
+                        .onAppear { report(proxy) }
+                        .onChange(of: proxy.frame(in: .global)) { _ in report(proxy) }
+                })
+                .transition(reduceMotion ? .opacity : .move(edge: .bottom).combined(with: .opacity))
+                .ignoresSafeArea(.keyboard)
+                .dynamicTypeSize(...DynamicTypeSize.xxxLarge)
+        }
+    }
+
+    private func report(_ proxy: GeometryProxy) {
+        let screen = UIScreen.main.bounds.height
+        chrome.layoutChanged(max(0, screen - proxy.frame(in: .global).minY))
+    }
+
+    @ViewBuilder private var bar: some View {
+#if compiler(>=6.2)
+        if #available(iOS 26.0, *) {
+            GlassEffectContainer {
+                items
+                    .padding(4)
+                    .glassEffect(.regular.interactive(), in: .capsule)
+            }
+        } else {
+            items
+                .padding(4)
+                .background(.ultraThinMaterial, in: Capsule())
+                .overlay(Capsule().strokeBorder(Color.white.opacity(0.35), lineWidth: 0.5))
+                .shadow(color: .black.opacity(0.12), radius: 18, y: 6)
+        }
+#else
+        items
+            .padding(4)
+            .background(.ultraThinMaterial, in: Capsule())
+            .overlay(Capsule().strokeBorder(Color.white.opacity(0.35), lineWidth: 0.5))
+            .shadow(color: .black.opacity(0.12), radius: 18, y: 6)
+#endif
+    }
+
+    private var items: some View {
+        HStack(spacing: 0) {
+            ForEach(chrome.tabs) { tab in
+                let isSelected = tab.id == chrome.selected
+                Button { chrome.tap(tab) } label: {
+                    VStack(spacing: 3) {
+                        ZStack(alignment: .topTrailing) {
+                            Image(systemName: symbol(tab.symbol, selected: isSelected))
+                                .font(.system(size: iconSize, weight: isSelected ? .semibold : .regular))
+                                .frame(height: iconSize + 6)
+                            if let badge = tab.badge {
+                                Text(badge)
+                                    .font(.system(size: badgeSize, weight: .bold))
+                                    .foregroundStyle(.white)
+                                    .padding(.horizontal, 4)
+                                    .frame(minWidth: 16, minHeight: 16)
+                                    .background(Capsule().fill(Color.red))
+                                    .offset(x: 10, y: -4)
+                            }
+                        }
+                        Text(tab.title)
+                            .font(.system(size: labelSize, weight: isSelected ? .semibold : .medium))
+                            .lineLimit(1)
+                            .minimumScaleFactor(0.8)
+                    }
+                    .foregroundStyle(isSelected ? selectedColor : Color.primary)
+                    .frame(maxWidth: .infinity, minHeight: 54)
+                    .background {
+                        if isSelected {
+                            Capsule()
+                                .fill(Color.primary.opacity(0.09))
+                                .matchedGeometryEffect(id: "selection", in: selection)
+                        }
+                    }
+                    .contentShape(Capsule())
+                }
+                .buttonStyle(.plain)
+                .accessibilityShowsLargeContentViewer {
+                    Image(systemName: symbol(tab.symbol, selected: isSelected))
+                    Text(tab.title)
+                }
+                .accessibilityLabel(tab.badge.map { "\(tab.title), \($0)" } ?? tab.title)
+                .accessibilityAddTraits(isSelected ? [.isSelected, .isButton] : .isButton)
+            }
+        }
+    }
+
+    private var selectedColor: Color {
+        chrome.tint.map { Color($0) } ?? Color.primary
+    }
+
+    /// The filled variant for the current tab, when the symbol has one.
+    private func symbol(_ name: String, selected: Bool) -> String {
+        guard selected, !name.hasSuffix(".fill"), UIImage(systemName: "\(name).fill") != nil else { return name }
+        return "\(name).fill"
+    }
+}
+
+/// The launch screen, held until the page is ready: the same colour and the
+/// same logo at the same place, so the hand-over from the system's launch
+/// screen cannot be seen.
+struct CraftSplashView: View {
+    @ObservedObject private var chrome = CraftChrome.shared
+    let background: UIColor
+
+    var body: some View {
+        if chrome.splashVisible {
+            ZStack {
+                Color(background)
+                if let logo = UIImage(named: "LaunchLogo") {
+                    Image(uiImage: logo)
+                }
+            }
+            .ignoresSafeArea()
+            .allowsHitTesting(true)
+            .transition(.opacity)
+        }
+    }
+}
+
 // MARK: - Deep Link Manager
 class DeepLinkManager {
     static let shared = DeepLinkManager()
@@ -378,6 +945,14 @@ class AppState: ObservableObject {
 }
 
 extension CraftConfig {
+    /// craft.config.json from the app bundle, for code that runs before the
+    /// app's state exists (the app delegate at launch).
+    static func bundled() -> CraftConfig {
+        guard let url = Bundle.main.url(forResource: "craft.config", withExtension: "json"),
+              let data = try? Data(contentsOf: url) else { return CraftConfig() }
+        return CraftConfig.load(from: data)
+    }
+
     /// The bundled config laid over the defaults, key by key.
     ///
     /// Decoded whole, one missing or mistyped key failed the entire file and
@@ -456,6 +1031,31 @@ struct CraftConfig: Codable {
     var enableMLKit: Bool = false
     var devServerURL: String? = nil
     var trustedOrigins: [String] = []
+    /// The longest the launch splash stays up when the page neither says it is
+    /// ready nor paints.
+    var splashMaxSeconds: Double = 3
+    /// How long the app's own page may take to answer before the load counts
+    /// as unreachable and the bundled copy stands in.
+    var requestTimeoutSeconds: Double = 10
+    /// Press-and-hold on a link shows its preview, as in Safari. Off unless
+    /// asked for: no native app previews its own buttons.
+    var allowsLinkPreview: Bool? = nil
+    /// WebKit's bar above the keyboard (previous, next, Done). Hidden unless
+    /// asked for; `craft.chrome.setKeyboardAccessory` changes it at runtime.
+    var keyboardAccessory: Bool? = nil
+    /// Pinch and double-tap zoom. Off unless set to false: an app's screens
+    /// are laid out for the phone, and zooming one is a web page's tell.
+    var disableZoom: Bool? = nil
+    /// iOS's scheduled app refresh, which fires `craftBackgroundRefresh`.
+    var backgroundRefresh: BackgroundRefresh? = nil
+
+    struct BackgroundRefresh: Codable {
+        var enabled: Bool = false
+        /// The BGTaskScheduler identifier; `<bundleId>.refresh` if unset.
+        var identifier: String? = nil
+        /// The soonest iOS may run it again, in minutes (15 if unset).
+        var minimumIntervalMinutes: Double? = nil
+    }
 }
 
 extension CraftConfig {
@@ -469,6 +1069,49 @@ extension CraftConfig {
         }
     }
 
+    /// What the web view adds to its user agent: WebKit's own token, then
+    /// `Craft/<version>` and `<AppName>/<version>`, so the app's server can
+    /// tell the app from Safari, and which build is asking.
+    func applicationNameForUserAgent(after base: String?) -> String {
+        let name = String(appName.unicodeScalars.filter { $0.isASCII && (CharacterSet.alphanumerics.contains($0) || "._-".unicodeScalars.contains($0)) })
+        let version = Bundle.main.infoDictionary?["CFBundleShortVersionString"] as? String ?? "1.0"
+        return [base ?? "", "Craft/{{CRAFT_VERSION}}", "\(name.isEmpty ? "App" : name)/\(version)"]
+            .filter { !$0.isEmpty }
+            .joined(separator: " ")
+    }
+
+    /// Pins the page's viewport at its own width: no pinch, no double-tap
+    /// zoom. Installed at document start, so its DOMContentLoaded listener is
+    /// the first: the tag is rewritten once the page's own is parsed, before
+    /// any of the page's handlers read it.
+    static let viewportScript = """
+    (function() {
+        function pin() {
+            var meta = document.querySelector('meta[name="viewport"]');
+            var content = meta ? (meta.getAttribute('content') || '') : 'width=device-width, initial-scale=1';
+            content = content.split(',').map(function(part) { return part.trim(); }).filter(function(part) {
+                return part && !/^(maximum-scale|minimum-scale|user-scalable)\\s*=/i.test(part);
+            }).concat(['minimum-scale=1', 'maximum-scale=1', 'user-scalable=no']).join(', ');
+            if (!meta) {
+                meta = document.createElement('meta');
+                meta.setAttribute('name', 'viewport');
+                (document.head || document.documentElement).appendChild(meta);
+            }
+            meta.setAttribute('content', content);
+        }
+        if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', pin);
+        else pin();
+    })();
+    """
+
+    /// A request for the app's own page, given up on after
+    /// `requestTimeoutSeconds`. URLRequest's default is sixty seconds, and a
+    /// first launch on a dead connection sat on the splash and then a blank
+    /// page for that long before the offline page could show.
+    func request(for url: URL) -> URLRequest {
+        URLRequest(url: url, cachePolicy: .useProtocolCachePolicy, timeoutInterval: max(1, requestTimeoutSeconds))
+    }
+
     /// The webview's background, resolved per trait so a Dark Mode switch
     /// repaints it without a reload.
     var resolvedBackgroundColor: UIColor {
@@ -487,6 +1130,13 @@ final class BundledAssetSchemeHandler: NSObject, WKURLSchemeHandler {
         super.init()
     }
 
+    /// The bundled `index.html` as text, for a web view that cannot navigate
+    /// to `craft://app` (see `loadBundledPage`).
+    static func bundledIndexHTML() -> String? {
+        guard let root = findBundledRoot() else { return nil }
+        return try? String(contentsOf: root.appendingPathComponent("index.html"), encoding: .utf8)
+    }
+
     private static func findBundledRoot() -> URL? {
         let bundle = Bundle.main
         let directCandidates = [
@@ -621,7 +1271,9 @@ struct CraftWebView: UIViewRepresentable {
         let webConfig = WKWebViewConfiguration()
         webConfig.defaultWebpagePreferences.allowsContentJavaScript = true
         webConfig.allowsInlineMediaPlayback = true
+        webConfig.allowsPictureInPictureMediaPlayback = true
         webConfig.mediaTypesRequiringUserActionForPlayback = []
+        webConfig.applicationNameForUserAgent = config.applicationNameForUserAgent(after: webConfig.applicationNameForUserAgent)
         webConfig.setURLSchemeHandler(BundledAssetSchemeHandler(), forURLScheme: "craft")
         // The app's own domains (WKAppBoundDomains in Info.plist) get what an
         // iOS web view reserves for them, service workers among them, so a
@@ -634,19 +1286,43 @@ struct CraftWebView: UIViewRepresentable {
         // Add native bridge
         let contentController = WKUserContentController()
         contentController.add(context.coordinator, name: "craft")
-        webConfig.userContentController = contentController
+        // The tab bar and the splash, outside the bridge's action dispatch:
+        // they are the screen's, not a device API.
+        let coordinator = context.coordinator
+        contentController.add(CraftChromeRelay(trusts: { [weak coordinator] origin in coordinator?.trusts(origin) ?? false }), name: "craftChrome")
         #if DEBUG
         // The page's errors and console, in the device log, so a debug build
         // can be diagnosed from `log stream` or `simctl spawn … log show`
         // without attaching Safari. A separate handler, outside the bridge's
         // action dispatch. Never in a release build.
         contentController.add(PageConsoleRelay(), name: "craftLog")
-        contentController.addUserScript(WKUserScript(source: PageConsoleRelay.script, injectionTime: .atDocumentStart, forMainFrameOnly: true))
         #endif
+        // The bridge and everything else the page gets from the first byte.
+        coordinator.installUserScripts(into: contentController)
+        webConfig.userContentController = contentController
 
         let webView = WKWebView(frame: .zero, configuration: webConfig)
         webView.navigationDelegate = context.coordinator
+        // alert(), confirm() and prompt() as the system's own alerts, and
+        // target=_blank and window.open somewhere they can actually open.
+        // Without a UI delegate WebKit drops all of them silently.
+        webView.uiDelegate = context.coordinator
+        // Now, not when the first page finishes loading. Everything the
+        // coordinator sends the page goes through this reference, and a
+        // network change, a push token or a location fix that arrived before
+        // the first didFinish used to be dropped on a nil.
+        coordinator.attach(webView)
         webView.isOpaque = false
+        // The feel of an app rather than a page: no link previews on
+        // press-and-hold, the keyboard follows a drag down as it does in
+        // Messages, and the page stays at its own scale.
+        webView.allowsLinkPreview = config.allowsLinkPreview ?? false
+        webView.scrollView.keyboardDismissMode = .interactive
+        if config.disableZoom != false {
+            webView.scrollView.minimumZoomScale = 1
+            webView.scrollView.maximumZoomScale = 1
+            webView.scrollView.pinchGestureRecognizer?.isEnabled = false
+        }
         // An edge swipe goes back (and forward) through the page's history,
         // pushState entries included, the way every iOS app's stack does.
         webView.allowsBackForwardNavigationGestures = config.swipeNavigation ?? false
@@ -664,17 +1340,23 @@ struct CraftWebView: UIViewRepresentable {
         // Register with DeepLinkManager
         DeepLinkManager.shared.setWebView(webView)
         CraftEventManager.shared.setWebView(webView)
+        CraftChrome.shared.webView = webView
+        CraftChrome.shared.holdSplash(atMost: config.splashMaxSeconds)
 
         // Parse background color
         let bgColor = config.resolvedBackgroundColor
         webView.backgroundColor = bgColor
         webView.scrollView.backgroundColor = bgColor
 
-        // Load content
-        if let devURL = config.devServerURL, !devURL.isEmpty {
+        // Load content: where the person was when the app was last put away,
+        // if iOS has since ended it, or the app's start page.
+        if coordinator.restoreInteractionState(into: webView) {
+            // Restored: WebKit loads the page that was on screen, with its
+            // history behind it for the back gesture.
+        } else if let devURL = config.devServerURL, !devURL.isEmpty {
             // Development mode - connect to server
             if let url = URL(string: devURL) {
-                webView.load(URLRequest(url: url))
+                webView.load(config.request(for: url))
             }
         } else if let bundledURL = URL(string: "craft://app/index.html") {
             // A route-aware local origin keeps root-relative STX assets and
@@ -714,6 +1396,25 @@ struct CraftWebView: UIViewRepresentable {
         private var pendingCallbackId: String?
         private var pendingPushCallbackId: String?
         private var loadedBundledFallback = false
+        /// Whether the current document's bridge has announced itself.
+        private var documentReady = false
+        /// Reloads after the content process dies, budgeted per burst.
+        private var recoveryBudget = CraftRecoveryBudget()
+        /// The content process died in the background; bring it back when the
+        /// app is on screen again rather than spending the work unseen.
+        private var recoverOnForeground = false
+        /// The last page the app's own origin finished, for a recovery that
+        /// finds the web view with no URL.
+        private var lastPageURL: URL?
+        /// When the app last went to the background, for `craftResume`.
+        private var backgroundedAt: Date?
+        /// Whether WebKit's bar above the keyboard shows (`keyboardAccessory`,
+        /// then `craft.chrome.setKeyboardAccessory`).
+        private lazy var keyboardAccessoryVisible = config.keyboardAccessory ?? false
+        /// The native pull-to-refresh, when the page has asked for it.
+        private lazy var refreshControl = CraftRefreshControl { [weak self] in
+            self?.sendToWeb("craftRefresh", data: [:])
+        }
 
         /// The highest `cb_<n>` this process has seen the page hand out.
         ///
@@ -838,6 +1539,11 @@ struct CraftWebView: UIViewRepresentable {
             NotificationCenter.default.addObserver(self, selector: #selector(receivePushToken(_:)), name: .craftPushToken, object: nil)
             NotificationCenter.default.addObserver(self, selector: #selector(receivePushRegistrationError(_:)), name: .craftPushRegistrationError, object: nil)
             NotificationCenter.default.addObserver(self, selector: #selector(appWillEnterForeground(_:)), name: UIApplication.willEnterForegroundNotification, object: nil)
+            NotificationCenter.default.addObserver(self, selector: #selector(appDidEnterBackground(_:)), name: UIApplication.didEnterBackgroundNotification, object: nil)
+            NotificationCenter.default.addObserver(self, selector: #selector(appDidReceiveMemoryWarning(_:)), name: UIApplication.didReceiveMemoryWarningNotification, object: nil)
+            for name in [UIContentSizeCategory.didChangeNotification, UIAccessibility.reduceMotionStatusDidChangeNotification, UIAccessibility.reduceTransparencyStatusDidChangeNotification, .craftColorSchemeChanged] {
+                NotificationCenter.default.addObserver(self, selector: #selector(appearanceChanged(_:)), name: name, object: nil)
+            }
             setupNetworkMonitoring()
         }
 
@@ -891,6 +1597,7 @@ struct CraftWebView: UIViewRepresentable {
             networkMonitor?.start(queue: DispatchQueue.global())
         }
 
+        // CRAFT_IOS_PAGE_BRIDGE_DISPATCHER
         func userContentController(_ userContentController: WKUserContentController, didReceive message: WKScriptMessage) {
             let securityOrigin = message.frameInfo.securityOrigin
             guard isTrustedOrigin(scheme: securityOrigin.protocol, host: securityOrigin.host, port: securityOrigin.port) else {
@@ -900,6 +1607,13 @@ struct CraftWebView: UIViewRepresentable {
             guard let body = message.body as? [String: Any],
                   let action = body["action"] as? String else { return }
 
+            // The page's own signal that the bridge has announced itself, not
+            // a device API: it is never offered to Zig and nothing answers it.
+            if action == "__craftReady" {
+                pageBecameReady()
+                return
+            }
+
             let callbackId = body["callbackId"] as? String
             // Before Zig is offered the call, because the seed has to cover
             // every id the page drew, not only the ones Swift went on to serve.
@@ -1046,6 +1760,62 @@ struct CraftWebView: UIViewRepresentable {
                 } else {
                     rejectCallback(callbackId, error: "Settings URL is unavailable")
                 }
+            // MARK: Native UI: dialogs, menus, the in-app browser, chrome.
+            // None of these is gated: they are the system's own UI, and need
+            // no permission or entitlement.
+            case "dialogAlert":
+                CraftDialogs.alert(body, from: webView) { [weak self] in self?.resolveCallback(callbackId, result: NSNull()) }
+            case "dialogConfirm":
+                CraftDialogs.confirm(body, from: webView) { [weak self] confirmed in self?.resolveCallback(callbackId, result: confirmed) }
+            case "dialogActionSheet":
+                CraftDialogs.actionSheet(body, from: webView) { [weak self] id in self?.resolveCallback(callbackId, result: id ?? NSNull()) }
+            case "contextMenuShow":
+                guard let webView else { resolveCallback(callbackId, result: NSNull()); return }
+                CraftContextMenu.show(body, in: webView) { [weak self] id in self?.resolveCallback(callbackId, result: id ?? NSNull()) }
+            case "browserOpen":
+                guard let address = body["url"] as? String, let url = URL(string: address) else {
+                    rejectCallback(callbackId, error: "browser.open needs a URL it can parse", code: "INVALID_ARGUMENT")
+                    return
+                }
+                CraftBrowser.shared.open(url, mode: body["mode"] as? String ?? "safari", callbackScheme: body["callbackScheme"] as? String, from: webView) { [weak self] answer in
+                    self?.resolveCallback(callbackId, result: answer)
+                }
+            case "symbolImage":
+                resolveCallback(callbackId, result: CraftSymbols.image(named: body["name"] as? String ?? "", options: body) ?? NSNull())
+            case "statusBarSetStyle":
+                resolveCallback(callbackId, result: CraftStatusBar.setStyle(body["style"] as? String ?? "default"))
+            case "chromeSetUnderPageColor":
+                // What shows past the page's edges when it rubber-bands.
+                if #available(iOS 15.0, *), let webView, let css = body["color"] as? String, let color = UIColor(css: css) {
+                    webView.underPageBackgroundColor = color
+                    resolveCallback(callbackId, result: true)
+                } else {
+                    resolveCallback(callbackId, result: false)
+                }
+            case "chromeSetKeyboardAccessory":
+                let visible = body["visible"] as? Bool ?? true
+                keyboardAccessoryVisible = visible
+                resolveCallback(callbackId, result: webView.map { CraftKeyboardAccessory.setVisible(visible, in: $0) } ?? false)
+            case "refreshEnable":
+                guard let webView else { resolveCallback(callbackId, result: false); return }
+                refreshControl.enable(on: webView.scrollView, tint: (body["tintColor"] as? String).flatMap { UIColor(css: $0) })
+                resolveCallback(callbackId, result: true)
+            case "refreshDisable":
+                refreshControl.disable()
+                resolveCallback(callbackId, result: true)
+            case "refreshEnd":
+                refreshControl.end()
+                resolveCallback(callbackId, result: true)
+            // The page has finished the work a craftSilentPush or
+            // craftBackgroundRefresh asked for.
+            case "backgroundComplete":
+                CraftBackgroundWork.shared.complete(id: body["id"] as? String, ok: body["ok"] as? Bool ?? true)
+                resolveCallback(callbackId, result: true)
+            // The offline page's Retry button, and anything else that wants
+            // the app's own page back after the bundled copy stood in.
+            case "retryRemote":
+                retryRemote()
+                resolveCallback(callbackId, result: true)
             case "log":
                 if let msg = body["message"] as? String {
                     print("[Craft Web] \(msg)")
@@ -1735,10 +2505,30 @@ struct CraftWebView: UIViewRepresentable {
             DeepLinkManager.shared.setLoading()
         }
 
+        func webView(_ webView: WKWebView, didCommit navigation: WKNavigation!) {
+            // A new document: the old one's ready no longer counts, and the
+            // pull-to-refresh it asked for goes with it, or a pull would spin
+            // waiting on a page that does not know it has one.
+            documentReady = false
+            refreshControl.disable()
+            // Kept across documents and after the content process restarts.
+            if !keyboardAccessoryVisible { CraftKeyboardAccessory.setVisible(false, in: webView) }
+            if config.disableZoom != false { webView.scrollView.pinchGestureRecognizer?.isEnabled = false }
+        }
+
         func webView(_ webView: WKWebView, didFinish navigation: WKNavigation!) {
-            self.webView = webView
+            CraftChrome.shared.pageFinished()
+            CraftChrome.shared.publishLayout()
             guard isTrustedURL(webView.url) else { return }
-            injectNativeBridge()
+            if !loadedBundledFallback { lastPageURL = webView.url }
+            // The bridge is a document-start user script, so it is normally
+            // here long before this. A document that came without it is given
+            // it now, the way every page used to be, so no page is ever worse
+            // off than before the user script.
+            webView.evaluateJavaScript("!!(window.craft && window.craft._callbacks && window.craft.platform === 'ios')") { [weak self, weak webView] installed, _ in
+                guard let self, let webView, (installed as? Bool) != true else { return }
+                webView.evaluateJavaScript(self.bridgeScript(), completionHandler: nil)
+            }
         }
 
         func webView(_ webView: WKWebView, decidePolicyFor navigationAction: WKNavigationAction, decisionHandler: @escaping (WKNavigationActionPolicy) -> Void) {
@@ -1746,7 +2536,20 @@ struct CraftWebView: UIViewRepresentable {
                 decisionHandler(.cancel)
                 return
             }
+            // A link that opens a new window (target=_blank) has no frame to
+            // load into. It is allowed on, so WebKit asks the UI delegate's
+            // `createWebViewWith`, which decides where it goes.
+            if navigationAction.targetFrame == nil {
+                decisionHandler(.allow)
+                return
+            }
             if isTrustedURL(url) {
+                // A new main-frame document gets the bridge seeded from the
+                // ids handed out so far (#226), so the user scripts are
+                // rebuilt before it exists rather than once per web view.
+                if navigationAction.targetFrame?.isMainFrame == true {
+                    installUserScripts(into: webView.configuration.userContentController)
+                }
                 decisionHandler(.allow)
                 return
             }
@@ -1776,11 +2579,150 @@ struct CraftWebView: UIViewRepresentable {
             }
         }
 
+        /// WebKit's content process died: out of memory, usually, often while
+        /// the app was in the background. The view does not error; it goes
+        /// white and stays white. It used to be reloaded on the spot, every
+        /// time, into whatever crash killed it.
+        ///
+        /// Now the reload waits until the app is on screen, shows the splash
+        /// rather than a white page while the page rebuilds, comes back on
+        /// the page that was showing, and is budgeted: past three crashes a
+        /// minute (`CraftRecoveryBudget`) the offline page shows instead,
+        /// whose Retry starts afresh.
         func webViewWebContentProcessDidTerminate(_ webView: WKWebView) {
-            webView.reload()
+            documentReady = false
+            CraftEventManager.shared.setLoading()
+            DeepLinkManager.shared.setLoading()
+            guard UIApplication.shared.applicationState != .background else {
+                recoverOnForeground = true
+                return
+            }
+            recoverFromTerminatedContent(webView)
+        }
+
+        private func recoverFromTerminatedContent(_ webView: WKWebView) {
+            recoverOnForeground = false
+            switch recoveryBudget.onCrash(at: ProcessInfo.processInfo.systemUptime) {
+            case .reload:
+                CraftChrome.shared.showSplash(atMost: config.splashMaxSeconds)
+                installUserScripts(into: webView.configuration.userContentController)
+                if webView.url == nil, let lastURL = lastPageURL {
+                    webView.load(config.request(for: lastURL))
+                } else {
+                    // The current history item, pushState entries included,
+                    // with the back stack still behind it.
+                    webView.reload()
+                }
+            case .giveUp:
+                print("Craft: the page's content process died \(recoveryBudget.attempts) times in a minute; showing the offline page")
+                CraftChrome.shared.hideSplash()
+                showOfflinePage(in: webView)
+            }
+        }
+
+        /// The bundled page (`dist/index.html`), which for an app whose page
+        /// is remote is the offline page with its Retry.
+        private func showOfflinePage(in webView: WKWebView) {
+            if config.devServerURL != nil { loadedBundledFallback = true }
+            loadBundledPage(in: webView)
+        }
+
+        /// Whether Info.plist declares WKAppBoundDomains.
+        private static let declaresAppBoundDomains: Bool = {
+            (Bundle.main.object(forInfoDictionaryKey: "WKAppBoundDomains") as? [String])?.isEmpty == false
+        }()
+
+        /// The bundled page, in place of the app's remote one.
+        ///
+        /// An app that declares app-bound domains cannot navigate from one of
+        /// them to `craft://app`: WebKit ignores the load ("attempting to
+        /// navigate away from an app-bound domain or navigate after using
+        /// restricted APIs"), whether or not navigations are limited to them,
+        /// because the bridge's scripts and message handlers count as those
+        /// APIs. The fallback then left a blank page where the offline page
+        /// should have been. So such an app gets the bundled index as a page
+        /// of the remote origin itself (`loadHTMLString` with the remote as
+        /// its base URL): an app-bound navigation, with the bridge, and a
+        /// Retry the message handlers trust. It must be self-contained, as the
+        /// generated offline page is; an app that bundles a whole site as its
+        /// fallback and declares app-bound domains gets only its index.
+        private func loadBundledPage(in webView: WKWebView) {
+            if Self.declaresAppBoundDomains,
+               let remote = config.devServerURL.flatMap(URL.init(string:)),
+               let html = BundledAssetSchemeHandler.bundledIndexHTML() {
+                webView.loadHTMLString(html, baseURL: remote)
+                return
+            }
+            guard let bundledURL = URL(string: "craft://app/index.html") else { return }
+            webView.load(URLRequest(url: bundledURL))
+        }
+
+        // MARK: - Lifecycle
+
+        @objc private func appDidEnterBackground(_ notification: Notification) {
+            backgroundedAt = Date()
+            saveInteractionState()
+        }
+
+        @objc private func appDidReceiveMemoryWarning(_ notification: Notification) {
+            sendToWeb("craftMemoryWarning", data: [:])
+        }
+
+        /// Where the person was, kept so a launch after iOS ended the app in
+        /// the background comes back to the same screen, as native apps do.
+        /// WKWebView's `interactionState` (iOS 15) is its back-forward list
+        /// with the current page and scroll position, as opaque data.
+        ///
+        /// Not saved for the offline page or anything outside the app's own
+        /// origins, and only restored into the same build: a new build may
+        /// have moved the screen it pointed at.
+        private static var interactionStateFile: URL? {
+            FileManager.default.urls(for: .applicationSupportDirectory, in: .userDomainMask).first?
+                .appendingPathComponent("craft-interaction-state.data")
+        }
+        private static let interactionStateBuildKey = "craft.interactionState.build"
+
+        private static var currentBuild: String {
+            let info = Bundle.main.infoDictionary
+            return "\(info?["CFBundleShortVersionString"] as? String ?? "")+\(info?["CFBundleVersion"] as? String ?? "")"
+        }
+
+        private func saveInteractionState() {
+            guard #available(iOS 15.0, *), let webView, let file = Self.interactionStateFile else { return }
+            guard isTrustedURL(webView.url), !loadedBundledFallback,
+                  let state = webView.interactionState as? Data else {
+                try? FileManager.default.removeItem(at: file)
+                return
+            }
+            do {
+                try FileManager.default.createDirectory(at: file.deletingLastPathComponent(), withIntermediateDirectories: true)
+                try state.write(to: file, options: [.atomic, .completeFileProtectionUntilFirstUserAuthentication])
+                UserDefaults.standard.set(Self.currentBuild, forKey: Self.interactionStateBuildKey)
+            } catch {
+                print("Craft: could not keep the page's place: \(error)")
+            }
+        }
+
+        /// True when a saved place was handed to the web view to load.
+        func restoreInteractionState(into webView: WKWebView) -> Bool {
+            guard #available(iOS 15.0, *), let file = Self.interactionStateFile,
+                  UserDefaults.standard.string(forKey: Self.interactionStateBuildKey) == Self.currentBuild,
+                  let state = try? Data(contentsOf: file) else { return false }
+            // Used once: if the restored page is what brings the app down,
+            // the next launch starts clean rather than looping on it.
+            try? FileManager.default.removeItem(at: file)
+            webView.interactionState = state
+            return true
         }
 
         func webView(_ webView: WKWebView, didFailProvisionalNavigation navigation: WKNavigation!, withError error: Error) {
+            // The navigation never replaced the page, so the page that was
+            // ready still is. Without this, events stayed queued for the rest
+            // of its life after one cancelled tap.
+            if documentReady {
+                DeepLinkManager.shared.setReady()
+                CraftEventManager.shared.setReady()
+            }
             fallBackIfUnreachable(webView, after: error)
         }
 
@@ -1796,14 +2738,9 @@ struct CraftWebView: UIViewRepresentable {
         }
 
         private func loadBundledFallback(in webView: WKWebView) {
-            guard !loadedBundledFallback,
-                  config.devServerURL != nil,
-                  let bundledURL = URL(string: "craft://app/index.html") else { return }
+            guard !loadedBundledFallback, config.devServerURL != nil else { return }
             loadedBundledFallback = true
-            // Kept for the way back: `returnFromBundledFallback` has no view of
-            // its own to reload.
-            self.webView = webView
-            webView.load(URLRequest(url: bundledURL))
+            loadBundledPage(in: webView)
         }
 
         /// Leave the bundled copy for the remote origin again (#252).
@@ -1822,14 +2759,40 @@ struct CraftWebView: UIViewRepresentable {
                   let remote = config.devServerURL.flatMap(URL.init(string:)) else { return }
             loadedBundledFallback = false
             print("Craft: \(reason); loading \(remote) again instead of the bundled copy")
-            webView.load(URLRequest(url: remote))
+            webView.load(config.request(for: remote))
         }
 
         @objc private func appWillEnterForeground(_ notification: Notification) {
+            if recoverOnForeground, let webView {
+                // The page is about to be rebuilt; there is no one to resume.
+                backgroundedAt = nil
+                recoverFromTerminatedContent(webView)
+                return
+            }
+            if let backgroundedAt {
+                self.backgroundedAt = nil
+                sendToWeb("craftResume", data: ["backgroundedMs": Int(Date().timeIntervalSince(backgroundedAt) * 1000)])
+            }
             returnFromBundledFallback(because: "the app returned to the foreground")
         }
 
-        private func isTrustedURL(_ url: URL?) -> Bool {
+        /// Load the app's own page again, now, because someone asked.
+        ///
+        /// Unlike `returnFromBundledFallback` it does not wait for a trigger
+        /// and works from any page. If the remote is still out of reach the
+        /// load fails as unreachable and the bundled copy comes back.
+        private func retryRemote() {
+            guard let webView else { return }
+            recoveryBudget.reset()
+            guard let remote = config.devServerURL.flatMap(URL.init(string:)) else {
+                webView.reload()
+                return
+            }
+            loadedBundledFallback = false
+            webView.load(config.request(for: remote))
+        }
+
+        fileprivate func isTrustedURL(_ url: URL?) -> Bool {
             guard let url = url else { return false }
             return isTrustedOrigin(scheme: url.scheme ?? "", host: url.host ?? "", port: url.port ?? 0)
         }
@@ -1852,6 +2815,11 @@ struct CraftWebView: UIViewRepresentable {
         /// now, and `scripts/mobile-e2e.ts` runs a real round trip on a booted
         /// simulator so a future hardening pass cannot quietly take the bridge
         /// away again.
+        /// Whether a message from this origin may drive the app's chrome.
+        func trusts(_ origin: WKSecurityOrigin) -> Bool {
+            isTrustedOrigin(scheme: origin.protocol, host: origin.host, port: origin.port)
+        }
+
         private func isTrustedOrigin(scheme: String, host: String, port: Int) -> Bool {
             if scheme == "craft" && host == "app" { return true }
             if scheme == "file" { return true }
@@ -1880,7 +2848,91 @@ struct CraftWebView: UIViewRepresentable {
             if drawn > highestCallbackId { highestCallbackId = drawn }
         }
 
-        private func injectNativeBridge() {
+        /// Hand the coordinator the web view it serves, as soon as it exists.
+        func attach(_ webView: WKWebView) {
+            self.webView = webView
+            if !keyboardAccessoryVisible { CraftKeyboardAccessory.setVisible(false, in: webView) }
+        }
+
+        /// Every script the page gets before its own first byte runs, in order.
+        ///
+        /// The bridge used to be evaluated in `didFinish`: after every image,
+        /// font and script of the page had loaded, on every navigation, as
+        /// some 1800 lines of fresh source each time. A page could not reach
+        /// `window.craft` while it was starting, which is when it most wants
+        /// to, and everything native tried to tell it before then was lost.
+        /// As document-start user scripts it exists before any of the page's
+        /// own code, and WebKit installs it for each document itself.
+        ///
+        /// Called at creation and again before each main-frame navigation,
+        /// because the bridge carries the callback seed (#226) and a seed
+        /// fixed at creation would repeat ids across reloads.
+        func installUserScripts(into controller: WKUserContentController) {
+            controller.removeAllUserScripts()
+            // From the first byte, so the page's CSS knows before it paints
+            // that the shell draws the tab bar, and does not draw its own for
+            // a frame.
+            controller.addUserScript(WKUserScript(source: "document.documentElement.setAttribute('data-craft-chrome','ios')", injectionTime: .atDocumentStart, forMainFrameOnly: true))
+            #if DEBUG
+            controller.addUserScript(WKUserScript(source: PageConsoleRelay.script, injectionTime: .atDocumentStart, forMainFrameOnly: true))
+            #endif
+            controller.addUserScript(WKUserScript(source: CraftChrome.paintScript, injectionTime: .atDocumentStart, forMainFrameOnly: true))
+            controller.addUserScript(WKUserScript(source: CraftPageAppearance.script(appearanceSnapshot(), announce: false), injectionTime: .atDocumentStart, forMainFrameOnly: true))
+            if config.disableZoom != false {
+                controller.addUserScript(WKUserScript(source: CraftConfig.viewportScript, injectionTime: .atDocumentStart, forMainFrameOnly: true))
+            }
+            controller.addUserScript(WKUserScript(source: bridgeScript(), injectionTime: .atDocumentStart, forMainFrameOnly: true))
+        }
+
+        private func appearanceSnapshot() -> [String: Any] {
+            CraftPageAppearance.snapshot(style: webView?.traitCollection.userInterfaceStyle ?? UITraitCollection.current.userInterfaceStyle)
+        }
+
+        /// Text size, Reduce Motion, Reduce Transparency or Light/Dark changed:
+        /// the page gets the new values and a `craftAppearance` event.
+        @objc private func appearanceChanged(_ notification: Notification) {
+            DispatchQueue.main.async { [weak self] in
+                guard let self, let webView = self.webView else { return }
+                webView.evaluateJavaScript(CraftPageAppearance.script(self.appearanceSnapshot(), announce: true), completionHandler: nil)
+            }
+        }
+
+        /// The page announced the bridge (`craftReady`): from here it can be
+        /// told things. Whatever arrived while it could not be is delivered now.
+        private func pageBecameReady() {
+            documentReady = true
+            DeepLinkManager.shared.setReady()
+            CraftEventManager.shared.setReady()
+        }
+
+        /// The origins the bridge script installs itself in, as the page
+        /// spells them (`location.protocol + '//' + location.host`). The same
+        /// set `isTrustedOrigin` answers for; the message handlers still check
+        /// every message, so this only keeps the bridge out of pages that
+        /// could not use it.
+        private func trustedPageOrigins() -> [String] {
+            var origins = config.trustedOrigins
+            if let devServerURL = config.devServerURL,
+               let components = URLComponents(string: devServerURL),
+               let host = components.host,
+               let scheme = components.scheme {
+                let defaultPort = scheme == "https" ? 443 : 80
+                let port = components.port ?? defaultPort
+                origins.append("\(scheme)://\(host)\(port == defaultPort ? "" : ":\(port)")")
+            }
+            return origins.compactMap { origin in
+                guard let url = URL(string: origin), let scheme = url.scheme, let host = url.host else { return nil }
+                guard scheme == "https" || (scheme == "http" && ["localhost", "127.0.0.1", "::1"].contains(host)) else { return nil }
+                let defaultPort = scheme == "https" ? 443 : 80
+                let port = url.port ?? defaultPort
+                let shownHost = host.contains(":") ? "[\(host)]" : host
+                return "\(scheme)://\(shownHost)\(port == defaultPort ? "" : ":\(port)")"
+            }
+        }
+
+        /// The bridge, as the source the page runs. Only in a trusted page:
+        /// the check is the first thing it does.
+        func bridgeScript() -> String {
             let laContext = LAContext()
             var biometricAvailable = false
             if laContext.canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: nil) {
@@ -3427,7 +4479,12 @@ struct CraftWebView: UIViewRepresentable {
                 var personFacing = {
                     requestHealthAuthorization: true,
                     requestPermission: true,
-                    signInWithApple: true
+                    signInWithApple: true,
+                    dialogAlert: true,
+                    dialogConfirm: true,
+                    dialogActionSheet: true,
+                    contextMenuShow: true,
+                    browserOpen: true
                 };
                 craft._invoke = function(action, payload) {
                     var self = craft;
@@ -3462,12 +4519,19 @@ struct CraftWebView: UIViewRepresentable {
                         throw error;
                     });
                 }
+                // Each kind reaches the generator UIKit has for it: a
+                // notification plays the success, warning or error pattern
+                // and a selection the picker's detent. Both used to be
+                // impacts of some weight, which is not what either feels like.
                 craft.haptics = {
                     impact: function(style) { return hapticFeedback(craft.haptic(style || 'medium')); },
                     notification: function(type) {
-                        return hapticFeedback(craft.haptic(type === 'error' ? 'heavy' : type === 'warning' ? 'medium' : 'light'));
+                        return hapticFeedback(craft.haptic(type === 'error' || type === 'warning' ? type : 'success'));
                     },
-                    selection: function() { return hapticFeedback(craft.haptic('soft')); },
+                    selection: function() { return hapticFeedback(craft.haptic('selection')); },
+                    // Wakes the engine ahead of a haptic the page knows is
+                    // coming, so it plays on the frame it is asked for.
+                    prepare: function(kind) { return hapticFeedback(craft._invoke('hapticPrepare', {kind: kind || null})); },
                     vibrate: function(pattern) { return hapticFeedback(craft.vibrate(pattern || [])); }
                 };
                 craft.permissions = {
@@ -3639,6 +4703,146 @@ struct CraftWebView: UIViewRepresentable {
                 }
             })(window.craft);
 
+            // The system's own UI, driven by the page: dialogs, a menu at a
+            // point, the in-app browser and web sign-in, SF Symbols, and the
+            // chrome around the page (status bar, under-page colour, keyboard
+            // bar, pull to refresh).
+            //
+            // Every call settles, and none throws: a failure answers with
+            // what "nothing happened" means for that call (null, false, a
+            // cancelled browser), the way the same calls answer in a browser.
+            (function installNativeUI(craft) {
+                function settle(answer, fallback) {
+                    return answer.then(function(value) {
+                        return value === undefined || value === null ? fallback : value;
+                    }, function(error) {
+                        if (craft._debug) console.warn('[Craft]', error && error.message);
+                        return fallback;
+                    });
+                }
+                function options(value) {
+                    return typeof value === 'string' ? {title: value} : Object.assign({}, value || {});
+                }
+                // A rect, or an element (or anything with
+                // getBoundingClientRect), in the viewport's CSS pixels.
+                function rect(anchor) {
+                    if (!anchor) return null;
+                    if (typeof anchor.getBoundingClientRect === 'function') anchor = anchor.getBoundingClientRect();
+                    var x = Number(anchor.x != null ? anchor.x : anchor.left);
+                    var y = Number(anchor.y != null ? anchor.y : anchor.top);
+                    if (!isFinite(x) || !isFinite(y)) return null;
+                    return {x: x, y: y, width: Number(anchor.width) || 0, height: Number(anchor.height) || 0};
+                }
+                craft.dialog = {
+                    alert: function(value) {
+                        return settle(craft._invoke('dialogAlert', options(value)), null).then(function() {});
+                    },
+                    confirm: function(value) {
+                        return settle(craft._invoke('dialogConfirm', options(value)), false).then(function(confirmed) { return confirmed === true; });
+                    },
+                    actionSheet: function(value) {
+                        var payload = options(value);
+                        payload.anchor = rect(payload.anchor);
+                        payload.actions = (payload.actions || []).map(function(action) {
+                            return {id: String(action.id), title: String(action.title), style: action.style || 'default'};
+                        });
+                        return settle(craft._invoke('dialogActionSheet', payload), null);
+                    }
+                };
+                craft.contextMenu = {
+                    show: function(value) {
+                        var payload = Object.assign({}, value || {});
+                        payload.anchor = rect(payload.anchor);
+                        payload.items = (payload.items || []).map(function(item) {
+                            return {id: String(item.id), title: String(item.title), symbol: item.symbol || null, destructive: item.destructive === true, disabled: item.disabled === true};
+                        });
+                        return settle(craft._invoke('contextMenuShow', payload), null);
+                    }
+                };
+                craft.browser = {
+                    open: function(url, value) {
+                        value = value || {};
+                        return settle(craft._invoke('browserOpen', {
+                            url: String(url),
+                            mode: value.mode === 'auth' ? 'auth' : 'safari',
+                            callbackScheme: value.callbackScheme || null
+                        }), {cancelled: true});
+                    }
+                };
+                // The same symbol at the same size is drawn once per page.
+                var symbolCache = {};
+                craft.symbols = {
+                    image: function(name, value) {
+                        value = value || {};
+                        var payload = {name: String(name), pointSize: value.pointSize, weight: value.weight, color: value.color, scale: value.scale};
+                        var key = JSON.stringify(payload);
+                        if (!symbolCache[key]) {
+                            symbolCache[key] = settle(craft._invoke('symbolImage', payload), null).then(function(image) {
+                                if (image === null) delete symbolCache[key];
+                                return image;
+                            });
+                        }
+                        return symbolCache[key];
+                    }
+                };
+                craft.statusBar = {
+                    setStyle: function(style) {
+                        return settle(craft._invoke('statusBarSetStyle', {style: style === 'light' || style === 'dark' ? style : 'default'}), false);
+                    }
+                };
+                craft.chrome = {
+                    setUnderPageColor: function(color) {
+                        return settle(craft._invoke('chromeSetUnderPageColor', {color: String(color)}), false);
+                    },
+                    setKeyboardAccessory: function(visible) {
+                        return settle(craft._invoke('chromeSetKeyboardAccessory', {visible: visible !== false}), false);
+                    }
+                };
+                // Text size, Reduce Motion, Reduce Transparency and Light or
+                // Dark, as the shell last reported them.
+                Object.defineProperty(craft, 'appearance', {
+                    configurable: true,
+                    enumerable: true,
+                    get: function() { return window.__craftAppearance || null; }
+                });
+                // Background time: answer a craftSilentPush or a
+                // craftBackgroundRefresh once its work is done, with the
+                // event's id, or with none for everything pending.
+                craft.background = {
+                    complete: function(ok, id) {
+                        return settle(craft._invoke('backgroundComplete', {ok: ok !== false, id: id || null}), false);
+                    },
+                    onRefresh: function(callback) {
+                        var listener = function(e) { callback(e.detail || {}); };
+                        window.addEventListener('craftBackgroundRefresh', listener);
+                        return function() { window.removeEventListener('craftBackgroundRefresh', listener); };
+                    },
+                    onSilentPush: function(callback) {
+                        var listener = function(e) { callback(e.detail || {}); };
+                        window.addEventListener('craftSilentPush', listener);
+                        return function() { window.removeEventListener('craftSilentPush', listener); };
+                    }
+                };
+                craft.onAppearanceChange = function(callback) {
+                    var listener = function(e) { callback(e.detail); };
+                    window.addEventListener('craftAppearance', listener);
+                    return function() { window.removeEventListener('craftAppearance', listener); };
+                };
+                craft.refresh = {
+                    enable: function(value) {
+                        return settle(craft._invoke('refreshEnable', {tintColor: (value && value.tintColor) || null}), false);
+                    },
+                    disable: function() { return settle(craft._invoke('refreshDisable'), false); },
+                    end: function() { return settle(craft._invoke('refreshEnd'), false); },
+                    // A pull of the native control; returns the unsubscribe.
+                    onRefresh: function(callback) {
+                        var listener = function() { callback(); };
+                        window.addEventListener('craftRefresh', listener);
+                        return function() { window.removeEventListener('craftRefresh', listener); };
+                    }
+                };
+            })(window.craft);
+
             // The reply route for actions the Zig runtime serves.
             //
             // Zig owns one wire format and calls these two functions by name;
@@ -3660,15 +4864,39 @@ struct CraftWebView: UIViewRepresentable {
                 window.craft._rejectCallback('cb_' + ctx.id, ctx.message, ctx.code);
             };
 
-            // Dispatch ready event
-            window.dispatchEvent(new CustomEvent('craftReady', {detail: window.craft}));
-            console.log('Craft iOS bridge initialized');
+            // craftReady, once per document, at the first moment a page can
+            // be listening for it.
+            //
+            // The bridge itself exists from the document's first byte, before
+            // any of the page's scripts, so a page that checks window.craft
+            // finds it at once. An event fired then would reach nobody, and
+            // pages written for the old injection only listen. So it fires
+            // when the document has been parsed: every parser-inserted
+            // script, module and deferred script has run by then and could
+            // have subscribed, and it is still well before the load event
+            // (images and all) it used to wait for. Native hears of it here
+            // too, and only then delivers what it was holding.
+            (function announceReady(craft) {
+                function ready() {
+                    if (craft.ready) return;
+                    craft.ready = true;
+                    window.dispatchEvent(new CustomEvent('craftReady', {detail: craft}));
+                    // The appearance the document started with, for a page
+                    // that subscribes rather than reading craft.appearance.
+                    if (window.__craftAppearance) window.dispatchEvent(new CustomEvent('craftAppearance', {detail: window.__craftAppearance}));
+                    try { window.webkit.messageHandlers.craft.postMessage({action: '__craftReady'}); } catch (e) {}
+                }
+                if (document.readyState === 'loading') document.addEventListener('DOMContentLoaded', ready);
+                else ready();
+            })(window.craft);
+            """
+            let trusted = (try? JSONSerialization.data(withJSONObject: trustedPageOrigins()))
+                .flatMap { String(data: $0, encoding: .utf8) } ?? "[]"
+            return """
+            if ((location.protocol === 'craft:' && location.host === 'app') || location.protocol === 'file:' || \(trusted).indexOf(location.protocol + '//' + location.host) !== -1) {
+            \(script)
+            }
             """
-            webView?.evaluateJavaScript(script)
-
-            // Mark DeepLinkManager as ready
-            DeepLinkManager.shared.setReady()
-            CraftEventManager.shared.setReady()
         }
 
         // MARK: - Callback Helpers
@@ -3800,8 +5028,7 @@ struct CraftWebView: UIViewRepresentable {
 
         // MARK: - Share
         private func share(options: [String: Any], callbackId: String?) {
-            guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-                  let rootVC = windowScene.windows.first?.rootViewController else {
+            guard CraftPresenter.topViewController() != nil else {
                 rejectCallback(callbackId, error: "Unable to present the share sheet")
                 return
             }
@@ -3827,7 +5054,11 @@ struct CraftWebView: UIViewRepresentable {
                     self.resolveCallback(callbackId, result: completed)
                 }
             }
-            rootVC.present(activityVC, animated: true)
+            // On iPad the sheet is a popover, and one with no anchor is an
+            // exception rather than a sheet: it points at `anchor` when the
+            // page gives one (the button's rect), the middle of the screen
+            // when it does not.
+            CraftPresenter.present(activityVC, from: webView, anchor: CraftPresenter.rect(options["anchor"]))
         }
 
         // MARK: - Camera & Photo Library
@@ -3837,8 +5068,7 @@ struct CraftWebView: UIViewRepresentable {
                     self.rejectCallback(self.pendingCallbackId, error: "Camera not available")
                     return
                 }
-                guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-                      let rootVC = windowScene.windows.first?.rootViewController else { return }
+                guard let rootVC = CraftPresenter.topViewController() else { return }
 
                 let picker = UIImagePickerController()
                 picker.sourceType = .camera
@@ -3849,8 +5079,7 @@ struct CraftWebView: UIViewRepresentable {
 
         private func pickImage() {
             DispatchQueue.main.async {
-                guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-                      let rootVC = windowScene.windows.first?.rootViewController else { return }
+                guard let rootVC = CraftPresenter.topViewController() else { return }
 
                 let picker = UIImagePickerController()
                 picker.sourceType = .photoLibrary
@@ -5071,8 +6300,7 @@ struct CraftWebView: UIViewRepresentable {
         // MARK: - QR/Barcode Scanner
         private func scanQRCode(callbackId: String?) {
             DispatchQueue.main.async {
-                guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-                      let rootVC = windowScene.windows.first?.rootViewController else { return }
+                guard let rootVC = CraftPresenter.topViewController() else { return }
 
                 if #available(iOS 16.0, *) {
                     let scannerVC = DataScannerViewController(
@@ -5094,8 +6322,7 @@ struct CraftWebView: UIViewRepresentable {
         // MARK: - File Picker
         private func pickFile(types: [String]?, callbackId: String?) {
             DispatchQueue.main.async {
-                guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-                      let rootVC = windowScene.windows.first?.rootViewController else { return }
+                guard let rootVC = CraftPresenter.topViewController() else { return }
 
                 var allowedTypes: [UTType] = [.item]
                 if let types = types {
@@ -5239,8 +6466,7 @@ struct CraftWebView: UIViewRepresentable {
                     return
                 }
 
-                guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-                      let rootVC = windowScene.windows.first?.rootViewController else { return }
+                guard let rootVC = CraftPresenter.topViewController() else { return }
 
                 let picker = UIImagePickerController()
                 picker.sourceType = .camera
@@ -5999,8 +7225,7 @@ struct CraftWebView: UIViewRepresentable {
 
         private func openPDF(source: String, page: Int, callbackId: String?) {
             DispatchQueue.main.async {
-                guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-                      let rootVC = windowScene.windows.first?.rootViewController else {
+                guard let rootVC = CraftPresenter.topViewController() else {
                     self.rejectCallback(callbackId, error: "No root view controller")
                     return
                 }
@@ -6077,8 +7302,7 @@ struct CraftWebView: UIViewRepresentable {
         // MARK: - Contacts Picker
         private func pickContact(multiple: Bool, callbackId: String?) {
             DispatchQueue.main.async {
-                guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-                      let rootVC = windowScene.windows.first?.rootViewController else {
+                guard let rootVC = CraftPresenter.topViewController() else {
                     self.rejectCallback(callbackId, error: "No root view controller")
                     return
                 }
@@ -6947,6 +8171,72 @@ extension URL {
 //
 // The end of an utterance is what `craft.speech.speak()` waits for. Hopped to
 // main because every piece of speech state is touched there and nowhere else.
+// MARK: - The page's own windows and dialogs
+//
+// WebKit hands these to the UI delegate and, with none set, drops them: an
+// alert() that never showed, a confirm() that answered false without asking,
+// a target=_blank link that did nothing when tapped.
+extension CraftWebView.Coordinator: WKUIDelegate {
+    /// A dialog's title: none for the app's own page, which speaks as the app,
+    /// and the origin's host for anything embedded in it, so a frame cannot
+    /// pass its alert off as the app's.
+    private func dialogTitle(for frame: WKFrameInfo) -> String? {
+        trusts(frame.securityOrigin) ? nil : frame.securityOrigin.host
+    }
+
+    func webView(_ webView: WKWebView, runJavaScriptAlertPanelWithMessage message: String, initiatedByFrame frame: WKFrameInfo, completionHandler: @escaping () -> Void) {
+        let alert = UIAlertController(title: dialogTitle(for: frame), message: message, preferredStyle: .alert)
+        alert.addAction(UIAlertAction(title: CraftPresenter.systemString("OK"), style: .default) { _ in completionHandler() })
+        if !CraftPresenter.present(alert, from: webView) { completionHandler() }
+    }
+
+    func webView(_ webView: WKWebView, runJavaScriptConfirmPanelWithMessage message: String, initiatedByFrame frame: WKFrameInfo, completionHandler: @escaping (Bool) -> Void) {
+        let alert = UIAlertController(title: dialogTitle(for: frame), message: message, preferredStyle: .alert)
+        alert.addAction(UIAlertAction(title: CraftPresenter.systemString("Cancel"), style: .cancel) { _ in completionHandler(false) })
+        alert.addAction(UIAlertAction(title: CraftPresenter.systemString("OK"), style: .default) { _ in completionHandler(true) })
+        if !CraftPresenter.present(alert, from: webView) { completionHandler(false) }
+    }
+
+    func webView(_ webView: WKWebView, runJavaScriptTextInputPanelWithPrompt prompt: String, defaultText: String?, initiatedByFrame frame: WKFrameInfo, completionHandler: @escaping (String?) -> Void) {
+        let alert = UIAlertController(title: dialogTitle(for: frame), message: prompt, preferredStyle: .alert)
+        alert.addTextField { field in field.text = defaultText }
+        alert.addAction(UIAlertAction(title: CraftPresenter.systemString("Cancel"), style: .cancel) { _ in completionHandler(nil) })
+        alert.addAction(UIAlertAction(title: CraftPresenter.systemString("OK"), style: .default) { [weak alert] _ in
+            completionHandler(alert?.textFields?.first?.text ?? "")
+        })
+        if !CraftPresenter.present(alert, from: webView) { completionHandler(nil) }
+    }
+
+    /// target=_blank and window.open. The app's own pages open in this web
+    /// view, the way a native app pushes a screen rather than opening a
+    /// second app. Anywhere else opens in Safari's in-app view, over the app
+    /// and dismissed back to it, and a non-web link goes to whatever app
+    /// handles it. A second web view is never made: there would be nothing to
+    /// show it in.
+    func webView(_ webView: WKWebView, createWebViewWith configuration: WKWebViewConfiguration, for navigationAction: WKNavigationAction, windowFeatures: WKWindowFeatures) -> WKWebView? {
+        guard let url = navigationAction.request.url else { return nil }
+        if isTrustedURL(url) {
+            webView.load(navigationAction.request)
+        } else if url.scheme == "https" || url.scheme == "http" {
+            let safari = SFSafariViewController(url: url)
+            safari.dismissButtonStyle = .close
+            if !CraftPresenter.present(safari, from: webView) { UIApplication.shared.open(url) }
+        } else {
+            UIApplication.shared.open(url)
+        }
+        return nil
+    }
+
+    /// getUserMedia from the app's own page is granted without WebKit's own
+    /// per-page prompt: the app already holds (or will ask for) the camera
+    /// and microphone permission iOS itself shows, and asking twice for one
+    /// thing reads as a web page. Anything embedded still gets the prompt.
+    @available(iOS 15.0, *)
+    func webView(_ webView: WKWebView, requestMediaCapturePermissionFor origin: WKSecurityOrigin, initiatedByFrame frame: WKFrameInfo, type: WKMediaCaptureType, decisionHandler: @escaping (WKPermissionDecision) -> Void) {
+        decisionHandler(trusts(origin) && trusts(frame.securityOrigin) ? .grant : .prompt)
+    }
+}
+
 extension CraftWebView.Coordinator: AVSpeechSynthesizerDelegate {
     func speechSynthesizer(_ synthesizer: AVSpeechSynthesizer, didFinish utterance: AVSpeechUtterance) {
         DispatchQueue.main.async { self.speechDidEnd(utterance, spoken: true) }