Reduce TLS memory requirements for KOReader sync

Split heap gate into separate free-memory (50KB) and largest-block (20KB) thresholds based on field measurements. Enable wolfSSL single-precision ECC to use fixed 256-bit arrays instead of heap-allocated fast-math bignums, reducing TLS handshake memory footprint. Reclaim ~7KB by right-sizing ESP timer task stacks and move WiFi code out of IRAM to free ~25-30KB for heap. Add memory audit landmarks for font and EPUB allocations.

.claude/skills/README.md

@@ -0,0 +1,33 @@
+# CrossPoint Reader: Claude Code skills
+
+Project skills for Claude Code. Claude auto-discovers them and loads one when the
+task matches its `description`; you do not invoke them by hand. They encode how
+this project wants C/C++ written: the judgment calls and self-review gates that
+keep the firmware small, stable, and reviewable.
+
+These are written for capable agents, not beginners. They are principle- and
+decision-focused on purpose. They deliberately avoid line-number citations,
+which drift; they anchor on durable names (APIs, types, macros, files).
+
+This is separate from `.skills/SKILL.md`, the GitHub coding-agent guide that
+mirrors CLAUDE.md. CLAUDE.md stays the always-loaded rule set; these skills are
+the applied decision procedures that load on demand and add the judgment layer
+CLAUDE.md does not carry.
+
+| Skill | Loads when you are... |
+|---|---|
+| `heap-discipline` | allocating memory: new/malloc/vector/string, buffers, caches |
+| `control-flow-clarity` | writing branching logic, state flags, modes, if/else ladders |
+| `hal-and-abstractions` | touching storage, input, display, settings, i18n, rendering |
+| `scope-discipline` | adding a feature, activity, lib, setting, or dependency |
+| `refactor-for-review` | refactoring, cleaning up, or preparing a change for PR |
+
+Each skill ends with a self-review checklist Claude runs against its own diff
+before handing it back. Reviewing a PR? Those checklists double as a fast rubric.
+
+## Maintaining these
+
+Edit the `SKILL.md` under each directory. Keep them tight. Do not restate
+CLAUDE.md; add the judgment CLAUDE.md cannot afford to carry. Trigger quality
+lives in the `description` field: it must name the situations that should pull
+the skill in, in the words a contributor's task would use.

.claude/skills/control-flow-clarity/SKILL.md

@@ -0,0 +1,56 @@
+---
+name: control-flow-clarity
+description: Branching and state-modeling clarity in C/C++. Use when writing or refactoring logic that branches on discrete values: if/else-if ladders, status flags, mode or state ints, or anything that should be an enum plus an exhaustive switch. Covers enum class over magic ints, exhaustive switch over nested if, early-return guard clauses, table dispatch, and when each is the right call.
+---
+
+# Control-Flow Clarity
+
+The goal: a reviewer verifies correctness by reading, not by tracing. Branching
+that mirrors the problem's shape is self-evident; branching that encodes it in
+ad-hoc ints and nesting forces the reader to reconstruct intent.
+
+## Core moves
+
+- **Model a closed set of states/modes as an `enum class`, not ints or bools.**
+  A variable kept honest by a comment ("0 = hidden, 1 = showing, 2 = confirm")
+  is a latent bug. Make it an enum and the comment becomes the type.
+- **Dispatch on an enum with an exhaustive `switch`, no `default`.** This
+  codebase relies on it: omitting `default` lets the compiler flag the
+  unhandled case when someone adds an enum value. A `default:` that swallows the
+  unknown case throws that safety away. Add `default` only when "every other
+  value does nothing" is a deliberate, documented decision.
+- **Replace nested `if/else-if` ladders that branch on one discriminant with a
+  `switch`.** If each branch only maps input to a value, prefer a lookup table
+  (`static constexpr` array) over both.
+- **Prefer early-return guard clauses over nested success bodies.** Handle the
+  error/empty/skip cases first and return; keep the main path at the left
+  margin.
+
+## When NOT to switch
+
+- Branches test unrelated conditions, not one discriminant: a guarded `if`
+  sequence is honest; a switch would be forced.
+- Two outcomes on a genuine boolean: keep the `if`.
+- The discriminant is an open or unbounded set (arbitrary ints, strings): table
+  or map, not a switch.
+
+## Enum hygiene
+
+- `enum class` by default for type safety. Plain `enum` only when values must
+  implicitly convert (e.g. a value that doubles as a UI dropdown index), and
+  then give it a trailing `_COUNT` sentinel for safe bounds/iteration, matching
+  the existing settings enums.
+- Name the discriminant after what it selects, not its storage:
+  `Orientation orientation`, not `uint8_t mode`.
+- No magic numeric codes for states. If you write a comment mapping numbers to
+  meanings, you owe an enum.
+
+## Self-review
+
+- [ ] No int/bool standing in for a closed set of modes; it is an `enum class`.
+- [ ] Enum dispatch is an exhaustive `switch` with no catch-all `default` (or
+      the `default` is a documented deliberate choice).
+- [ ] No nested if/else-if ladder on a single discriminant that should be a
+      switch or a table.
+- [ ] Error/skip cases are early-return guards; the happy path is not buried.
+- [ ] No magic numbers where a named enum or `constexpr` would state the intent.

.claude/skills/hal-and-abstractions/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: hal-and-abstractions
+description: Layering and abstraction discipline for the firmware. Use when touching storage, input, display, settings, i18n, or rendering, or any code that could reach into the SDK. Covers routing through the HAL (HalStorage / HalGPIO / HalDisplay) instead of raw SDK classes, MappedInputManager logical buttons instead of raw GPIO indices, UITheme/GUI for all rendering, the singleton macros, tr() for user-facing text, and where a new abstraction boundary belongs.
+---
+
+# HAL and Abstractions
+
+CLAUDE.md lists the HAL classes and the SdFat-concurrency reason they exist.
+This is when and how to route through them, and where to draw a new boundary.
+
+## Route through the layer, always
+
+- **SD card I/O:** `Storage` (HalStorage) and `HalFile`. Never `SdFat`,
+  `FsFile`, `SdSpiCard`, `FsBaseFile`, or `SDCardManager` directly. The HAL
+  serializes every SD access through one mutex; bypassing it races the SPI state
+  machine and panics FreeRTOS (CLAUDE.md has the failure mode). This is a
+  correctness boundary, not a style preference.
+- **Display:** `HalDisplay` over `EInkDisplay`. **Input:** `HalGPIO` over
+  `InputManager`.
+- **Rendering:** everything through the `GUI` macro (UITheme) and the renderer's
+  oriented metrics. No hardcoded fonts, colors, coordinates, or 800/480
+  literals; ask the renderer for width/height and use the oriented viewable
+  area.
+- **Input in activities:** `MappedInputManager::Button` logical enums
+  (`Button::Confirm`, `Button::PageForward`, ...). Never raw `HalGPIO::BTN_*`
+  indices outside `ButtonRemapActivity`. Logical buttons survive user remapping
+  and orientation; raw indices do not.
+- **Shared state:** the singleton macros (`SETTINGS`, `APP_STATE`, `GUI`,
+  `Storage`, `I18N`), not threaded pointers.
+
+## User-facing text
+
+Every string a user reads goes through `tr(STR_*)`. Add the key to the English
+YAML, regenerate with `scripts/gen_i18n.py`, then use the `StrId`. Log lines
+(`LOG_*`) stay hardcoded.
+
+## Drawing a new boundary
+
+When you need an SDK capability the HAL does not expose yet, **add the method to
+the HAL; do not reach around it.** The new method inherits the mutex, logging,
+and error contract the rest of the HAL carries. A one-off direct SDK call in an
+activity is exactly the layering violation the mutex discipline cannot tolerate.
+
+Keep abstractions thin. A wrapper that only renames an SDK call without adding
+the mutex, logging, or an error contract is dead weight. Add a layer only when
+it carries one of those contracts or hides a real implementation choice.
+
+## Self-review
+
+- [ ] No direct SdFat / FsFile / SDCardManager / EInkDisplay / InputManager use
+      outside `lib/hal`.
+- [ ] File access uses `HalFile`; no `.close()` on a local handle
+      (DESTRUCTOR_CLOSES_FILE); members closed in `onExit`.
+- [ ] Input uses `MappedInputManager::Button`, not raw `BTN_*` indices.
+- [ ] Rendering goes through GUI/UITheme and oriented metrics; no 800/480 or
+      hardcoded fonts/coords.
+- [ ] User-facing strings use `tr(STR_*)`; new keys added to YAML and
+      regenerated.
+- [ ] Any new SDK capability is exposed as a HAL method, not called inline.

.claude/skills/heap-discipline/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: heap-discipline
+description: Memory allocation discipline for the ESP32-C3 (~380KB RAM, no PSRAM, single 48KB framebuffer). Use whenever writing or reviewing code that allocates: new / malloc / std::vector / std::string, buffers, caches, or anything held across a loop or an activity lifecycle. Covers makeUniqueNoThrow vs raw new/malloc, fragmentation avoidance, reserve-before-push_back, alloc-once-reuse, stack vs heap sizing, and the chunked grayscale buffer pattern.
+---
+
+# Heap Discipline (ESP32-C3)
+
+CLAUDE.md states the allocation rules. This is the procedure you run while
+writing the code and the gate you run before handing it back.
+
+The constraint that makes every call matter: ~380KB RAM, no PSRAM, one 48KB
+framebuffer. **Fragmentation, not total usage, is what kills this device.**
+Free-heap can read fine while the largest free block is too small for the next
+allocation. Optimize for not leaving holes, not just for using fewer bytes.
+
+## Allocation decision procedure
+
+Ask in order; stop at the first yes.
+
+1. **Stack?** Local, bounded, under ~256 bytes total: plain array/struct. No
+   heap, no fragmentation. Keep frames lean; the task stack is small.
+2. **Compile-time constant?** `static constexpr` lives in flash, costs zero DRAM.
+3. **Allocated once and reused for an activity's lifetime?** Allocate in
+   `onEnter`, hold in a member, release in `onExit`. Never per-frame, never
+   per-iteration.
+4. **Dynamic and fallible?** `makeUniqueNoThrow<T>(...)` /
+   `makeUniqueNoThrow<T[]>(n)` from `lib/Memory/Memory.h`. Null-check, `LOG_ERR`
+   with the size, return false. It frees on every exit path.
+5. **A C/SDK API takes ownership and frees it itself?** Only then raw
+   `new (std::nothrow)` / `malloc`, with a comment naming who frees it.
+
+Bare `new` / `new[]` is never correct here: under `-fno-exceptions` it calls
+`abort()` on OOM instead of returning null.
+
+## Fragmentation rules
+
+- `std::vector`: `reserve(n)` before any `push_back` loop. Each growth is
+  alloc-copy-free (three heap ops) and leaves a hole. Unknown n: estimate high.
+- No repeated `new`/`delete` or growing containers inside a loop or render path.
+  Hoist the allocation out of the loop.
+- Large contiguous blocks fragment worst. Full-screen-class buffers use the
+  chunked `storeBwBuffer` / `restoreBwBuffer` path in `GfxRenderer` so they
+  never demand one contiguous 48KB block. Reuse that path. Do not malloc a
+  second full-screen buffer.
+- `std::string` / Arduino `String`: acceptable on cold paths (file I/O, one-shot
+  setup). Banned on hot/render paths. Build text with a stack `char[]` +
+  `snprintf`; if a `std::string` is unavoidable, `reserve` it first.
+
+## Justify every allocation
+
+Per CLAUDE.md's evidence rule: when you add a heap allocation, state in one line
+why stack/static/reuse was rejected and the worst-case size. If you cannot name
+the size, you cannot budget it, and you should not allocate it.
+
+## Self-review before handoff
+
+- [ ] No bare `new`/`new[]`. Every fallible alloc is `makeUniqueNoThrow`, or a
+      raw alloc with an explicit owner comment.
+- [ ] Every allocation is null-checked with `LOG_ERR` before the error return.
+- [ ] No allocation inside a loop or render path that could be hoisted.
+- [ ] Every `push_back` loop has a preceding `reserve`.
+- [ ] Anything allocated in `onEnter` is released in `onExit`; member `HalFile`
+      closed there too.
+- [ ] No second full-screen buffer; grayscale uses store/restoreBwBuffer.
+- [ ] Each new allocation carries a one-line size + why-not-stack/static note.

.claude/skills/refactor-for-review/SKILL.md

@@ -0,0 +1,59 @@
+---
+name: refactor-for-review
+description: Producing small, single-concern, reviewable changes. Use when refactoring, cleaning up, restructuring, decomposing, or preparing a change for PR, especially in this multi-contributor AI-assisted codebase that is prone to sprawl diffs. Covers one-concern-per-commit, extracting helpers without widening scope, not bundling unrelated edits, decomposing oversized activities, comment hygiene, and a pre-handoff self-review checklist.
+---
+
+# Refactor for Review
+
+This is a multi-contributor, AI-assisted codebase, and the dominant failure mode
+is the sprawl diff: a one-line intent that touches thirty files. The goal is a
+change a reviewer can verify in one sitting. Cleaner structure that makes the
+next change easier is the win, not lines added.
+
+## One concern per change
+
+- A commit/PR does one thing. A bug fix is not also a rename is not also a
+  reformat. If you spot an unrelated improvement mid-change, leave it or capture
+  it separately; do not fold it in.
+- When the working tree has bundled two changes, separate them with the
+  copy-affected-files-aside, reset, re-apply one concern, restore the rest
+  pattern, not by committing the tangle.
+- Refactor and behavior change do not ride together. A pure refactor must not
+  alter behavior; a behavior change should not drag a refactor along. If both
+  are needed: two commits, refactor first.
+
+## Keep the diff narrow
+
+- Extract a helper to remove real duplication or to name a concept, not to chase
+  abstraction. Three-plus copies, or a block that needs a name to be understood:
+  extract. Two similar lines: leave them.
+- No "while I'm here" scope creep. A signature or type change that ripples to
+  many call sites is its own PR: map every caller first, update them in one
+  topological pass, and land it separately, not as a rider on a feature.
+- Match the surrounding code: comment density, naming, idiom. The diff should
+  read like the file, not like a different author.
+
+## Decompose oversized units
+
+An activity or function that has outgrown one screen of responsibility (multiple
+unrelated state machines, or a file far larger than its siblings) is a
+decomposition candidate. Extract a cohesive sub-responsibility into its own
+unit, as a standalone behavior-preserving refactor, verified on its own, never
+mixed into a feature change.
+
+## Comments earn their place
+
+Comments explain why: an invariant, a defense, a past incident, a non-obvious
+constraint. Never what the next line already says. Delete narration, phase-marker
+comments ("now we loop over..."), and restated function names. If a comment and
+the code it sits on say the same thing, the comment is the thing to cut.
+
+## Self-review before handoff
+
+- [ ] The change does exactly one thing; nothing unrelated rode along.
+- [ ] Refactor and behavior change are not mixed in one commit.
+- [ ] No "while I'm here" creep; rename/signature ripples are split out.
+- [ ] Extractions remove real duplication or name a real concept, not
+      speculative abstraction.
+- [ ] New comments say why, not what; no narration or phase markers.
+- [ ] A reviewer can understand the diff without running it.

.claude/skills/scope-discipline/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: scope-discipline
+description: Feature-scope discipline for a dedicated e-reader (not a Swiss Army knife). Use when adding a feature, a new activity, a new lib, a setting, or a dependency, or when a request would grow the firmware's surface. Covers the SCOPE.md test, the RAM-cost vs reading-benefit gate, preferring no-code or existing-mechanism solutions, awareness of the existing activity surface, and how to push back on out-of-scope asks.
+---
+
+# Scope Discipline
+
+The mission: do one thing exceptionally well, focused reading on constrained
+hardware. `SCOPE.md` is the source of truth for what is in and out. Read it
+before adding surface. This is the gate to run before writing a new feature.
+
+## The gate
+
+Before adding a feature, activity, lib, setting, or dependency, answer in order:
+
+1. **Is it in `SCOPE.md`?** Explicitly out: interactive apps (notepad,
+   calculator, games), active connectivity (RSS, news, browser), media/audio
+   playback. If it is out, say so and stop.
+2. **Does it materially improve focused reading?** If the benefit is
+   "nice to have" or serves a different use case, it is out. This is not a PDA.
+3. **What does it cost in RAM and in the largest-free-block budget?** A feature
+   that adds steady-state RAM or a large transient allocation needs a reading
+   benefit that clearly outweighs it. Quantify with `firmware_size_history.py`
+   and `script_profile_mem.sh` rather than guessing.
+4. **Can it be done with no new code?** Prefer an existing activity, an existing
+   setting, or a doc over a new code path. The cheapest feature is the one
+   already built.
+
+If a request fails the gate, push back with the specific reason and the
+`SCOPE.md` basis, and offer the in-scope alternative. Make the call and say why;
+do not just hand over a menu.
+
+## Surface awareness
+
+The firmware already carries dozens of activities. Each new one is permanent
+RAM, permanent maintenance, and another thing every future refactor must not
+break. Default to extending an existing activity or setting before adding a new
+screen. New top-level surface needs a real justification, not "it would be
+convenient."
+
+## Settings are not free
+
+A new setting is a field to persist, migrate, validate, translate, and render,
+plus combinatorial test burden. Add one only when users genuinely need the
+choice; otherwise pick a sensible fixed default.
+
+## Self-review
+
+- [ ] Checked against `SCOPE.md`; not on the out-of-scope list.
+- [ ] Stated the concrete reading benefit, not a generic "useful."
+- [ ] Named the RAM/size cost (measured, not guessed) and why the benefit wins.
+- [ ] Checked whether an existing activity/setting/doc already covers it.
+- [ ] New setting (if any) is justified by a real user need, not added
+      "just in case."

.github/workflows/ci.yml

@@ -53,6 +53,13 @@ jobs:
       - name: Install PlatformIO Core
         run: uv pip install --system -U https://github.com/pioarduino/platformio-core/archive/refs/tags/v6.1.19.zip
 
+      - name: Cache PlatformIO packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.platformio
+          key: pio-${{ runner.os }}-${{ hashFiles('platformio.ini') }}
+          restore-keys: pio-${{ runner.os }}-
+
       - name: Run cppcheck
         run: pio check --fail-on-defect low --fail-on-defect medium --fail-on-defect high
 
@@ -76,6 +83,13 @@ jobs:
       - name: Install PlatformIO Core
         run: uv pip install --system -U https://github.com/pioarduino/platformio-core/archive/refs/tags/v6.1.19.zip
 
+      - name: Cache PlatformIO packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.platformio
+          key: pio-${{ runner.os }}-${{ hashFiles('platformio.ini') }}
+          restore-keys: pio-${{ runner.os }}-
+
       - name: Build CrossPoint
         run: |
           set -euo pipefail
@@ -102,6 +116,33 @@ jobs:
           path: .pio/build/default/firmware.bin
           if-no-files-found: error
 
+  unit-tests:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Install build tools
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y cmake ninja-build
+
+      - name: Cache googletest source
+        uses: actions/cache@v4
+        with:
+          path: build/test/_deps/googletest-src
+          key: ${{ runner.os }}-googletest-${{ hashFiles('test/CMakeLists.txt') }}
+
+      - name: Configure
+        run: cmake -S test -B build/test -G Ninja -DCMAKE_BUILD_TYPE=Release
+
+      - name: Build
+        run: cmake --build build/test
+
+      - name: Run tests
+        run: ctest --test-dir build/test --output-on-failure -j
+
   # This job is used as the PR required actions check, allows for changes to other steps in the future without breaking
   # PR requirements.
   test-status:
@@ -110,6 +151,7 @@ jobs:
       - build
       - clang-format
       - cppcheck
+      - unit-tests
     if: always()
     runs-on: ubuntu-latest
     steps:

.github/workflows/release.yml

@@ -25,6 +25,13 @@ jobs:
       - name: Install PlatformIO Core
         run: uv pip install --system -U https://github.com/pioarduino/platformio-core/archive/refs/tags/v6.1.19.zip
 
+      - name: Cache PlatformIO packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.platformio
+          key: pio-${{ runner.os }}-${{ hashFiles('platformio.ini') }}
+          restore-keys: pio-${{ runner.os }}-
+
       - name: Build CrossPoint
         run: pio run -e gh_release
 

.github/workflows/release_candidate.yml

@@ -25,6 +25,13 @@ jobs:
       - name: Install PlatformIO Core
         run: uv pip install --system -U https://github.com/pioarduino/platformio-core/archive/refs/tags/v6.1.19.zip
 
+      - name: Cache PlatformIO packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.platformio
+          key: pio-${{ runner.os }}-${{ hashFiles('platformio.ini') }}
+          restore-keys: pio-${{ runner.os }}-
+
       - name: Extract env
         run: |
           echo "SHORT_SHA=${GITHUB_SHA::7}" >> $GITHUB_ENV

.gitignore

@@ -19,3 +19,13 @@ build
 lib/EpdFont/scripts/downloaded_fonts/
 lib/EpdFont/scripts/instanced_fonts/
 lib/EpdFont/scripts/output/
+# Claude Code: share project skills with the team, keep local agent state
+# (worktrees, scheduled-task locks, settings.local, scout CLEANUP.md) out.
+.claude/*
+!.claude/skills/
+/managed_components
+/.dummy
+dependencies.lock
+sdkconfig.default
+sdkconfig.defaults
+CMakeLists.txt

.gitmodules

@@ -1,3 +1,4 @@
-[submodule "open-x4-sdk"]
-	path = open-x4-sdk
-	url = https://github.com/crosspoint-reader/community-sdk.git
+[submodule "freeink-sdk"]
+	path = freeink-sdk
+	url = https://github.com/Free-Ink/freeink-sdk.git
+	branch = main

.skills/SKILL.md

@@ -7,7 +7,7 @@ Mission: Provide a lightweight, high-performance reading experience focused on E
 * Role: Senior Embedded Systems Engineer (ESP-IDF/Arduino-ESP32 specialized).
 * Primary Constraint: 380KB RAM is the hard ceiling. Stability is non-negotiable.
 * Evidence-Based Reasoning: Before proposing a change, you MUST cite the specific file path and line numbers that justify the modification.
-* Anti-Hallucination: Do not assume the existence of libraries or ESP-IDF functions. If you are unsure of an API's availability for the ESP32-C3 RISC-V target, check the open-x4-sdk or official docs first.
+* Anti-Hallucination: Do not assume the existence of libraries or ESP-IDF functions. If you are unsure of an API's availability for the ESP32-C3 RISC-V target, check the freeink-sdk source or the FreeInk SDK docs (https://freeink.org/llms.txt for an LLM-readable index) first.
 * No Unfounded Claims: Do not claim performance gains or memory savings without explaining the technical mechanism (e.g., DRAM vs IRAM usage).
 * Resource Justification: You must justify any new heap allocation (new, malloc, std::vector) or explain why a stack/static alternative was rejected.
 * Verification: After suggesting a fix, instruct the user on how to verify it (e.g., monitoring heap via Serial or checking a specific cache file).
@@ -127,7 +127,7 @@ These flags in `platformio.ini` fundamentally affect firmware behavior:
   * lib/hal/: Hardware Abstraction Layer (HalDisplay, HalGPIO, HalStorage)
   * lib/I18n/: Internationalization (translations in `translations/*.yaml`, generated string tables)
 * src/activities/: UI logic using the Activity Lifecycle (onEnter, loop, onExit)
-* open-x4-sdk/: Low-level SDK (EInkDisplay, InputManager, BatteryMonitor, SDCardManager)
+* freeink-sdk/: Low-level SDK (EInkDisplay, InputManager, BatteryMonitor, SDCardManager)
 * .crosspoint/: SD-based binary cache for EPUB metadata and pre-rendered layout sections
 
 ### Hardware Abstraction Layer (HAL)
@@ -152,20 +152,19 @@ These flags in `platformio.ini` fundamentally affect firmware behavior:
 #include <HalStorage.h>
 
 // Use Storage singleton (defined via macro)
-FsFile file;
+HalFile file;
 if (Storage.openFileForRead("MODULE", "/path/to/file.bin", file)) {
   // Read from file
   // No file.close() needed — DESTRUCTOR_CLOSES_FILE=1 handles it at scope exit
 }
 ```
 
-**Usage**: See example above. Uses `FsFile` (SdFat), NOT Arduino `File`. Do NOT add `file.close()` for local variables (see DESTRUCTOR_CLOSES_FILE above).
+**Usage**: Use `HalFile` (the mutex-wrapping handle), NOT raw SdFat `FsFile` or Arduino `File`. Do NOT add `file.close()` for local variables (see DESTRUCTOR_CLOSES_FILE above).
 
 **SdFat is not thread-safe; all SD access MUST go through HalStorage**:
 - SdFat's `SdSpiCard` tracks SPI bus state with an unsynchronized `m_spiActive` bool. Two tasks calling SdFat concurrently can confuse that state machine and end with one task calling `SPIClass::endTransaction()` against a paramLock the *other* task is holding. That trips FreeRTOS's `xTaskPriorityDisinherit` assert (`tasks.c:5156, pxTCB == pxCurrentTCBs[0]`) and panics the system. See SdFat issue #518.
-- `HalStorage` serializes everything via `storageMutex`. Downstream code includes `<HalStorage.h>`, which transparently `using FsFile = HalFile;`; every method call (read, write, seek, close) takes the mutex. `HalFile`'s destructor also takes the mutex before letting the underlying SdFat `FsFile` close.
-- **Never** call into `SdFat` / `SdSpiCard` / `FsBaseFile` / `SDCardManager` directly. **Never** define `HAL_STORAGE_IMPL` outside `HalStorage.cpp`; that disables the `FsFile -> HalFile` typedef and you'll get a raw SdFat handle that bypasses the mutex.
-- If you're storing a raw `FsFile` in a place that won't transitively include `<HalStorage.h>` (rare), include the header explicitly so the typedef applies.
+- `HalStorage` serializes everything via `storageMutex`. Downstream code uses `HalFile` (declared in `<HalStorage.h>`); every method call (read, write, seek, close) takes the mutex. `HalFile`'s destructor also takes the mutex before letting the underlying SdFat `FsFile` close.
+- **Never** call into `SdFat` / `SdSpiCard` / `FsBaseFile` / `SDCardManager` / raw `FsFile` directly — that bypasses the mutex.
 
 ---
 
@@ -458,7 +457,6 @@ void onExit()   { /* free: vTaskDelete, free buffer, close member FsFiles */ Act
 **All fonts are loaded as global static objects** at firmware startup:
 - Noto Serif: 12, 14, 16, 18pt (4 styles each: regular, bold, italic, bold-italic)
 - Noto Sans: 12, 14, 16, 18pt (4 styles each)
-- OpenDyslexic: 8, 10, 12, 14pt (4 styles each)
 - Ubuntu UI fonts: 10, 12pt (2 styles)
 
 **Total**: ~80+ global `EpdFont` and `EpdFontFamily` objects
@@ -898,8 +896,8 @@ rm -rf /path/to/sd/.crosspoint/epub_<hash>/sections/
 **Source**: `lib/Epub/Epub/Section.cpp`, `lib/Epub/Epub/BookMetadataCache.cpp`
 
 **Current Versions** (as of docs/file-formats.md):
-- `book.bin`: **Version 5** (metadata structure)
-- `section.bin`: **Version 12** (layout structure)
+- `book.bin`: **Version 7** (metadata structure)
+- `section.bin`: **Version 25** (layout structure)
 
 **Version Increment Rules**:
 1. **ALWAYS increment version** BEFORE changing binary structure
@@ -909,7 +907,7 @@ rm -rf /path/to/sd/.crosspoint/epub_<hash>/sections/
 **Example** (incrementing section format version):
 ```cpp
 // lib/Epub/Epub/Section.cpp
-static constexpr uint8_t SECTION_FILE_VERSION = 13;  // Was 12, now 13
+static constexpr uint8_t SECTION_FILE_VERSION = 26;  // Was 25, now 26
 
 // Add new field to structure
 struct PageLine {
@@ -920,4 +918,4 @@ struct PageLine {
 
 ---
 
-Philosophy: We are building a dedicated e-reader, not a Swiss Army knife. If a feature adds RAM pressure without significantly improving the reading experience, it is Out of Scope.
+Philosophy: We are building a dedicated e-reader, not a Swiss Army knife. If a feature adds RAM pressure without significantly improving the reading experience, it is Out of Scope.

README.md

@@ -8,9 +8,11 @@ CrossPoint is open-source e-reader firmware - community-built, fully hackable, f
 
 ![CrossPoint Reader running on Xteink device](./docs/images/cover.jpg)
 
+> If you're planning to buy an Xteink device, consider purchasing an **X3/X4 Developer Edition** through https://crosspointreader.com. CrossPoint receives a small share of each sale, helping fund development costs.
+
 ## What can CrossPoint do?
 
-- **Reader engine**: EPUB 2/3 rendering with embedded-style option, image handling, hyphenation, kerning, chapter navigation, footnotes, go-to-percent, auto page turn, orientation control, focus reading, KOReader progress sync and more. 
+- **Reader engine**: EPUB 2/3 rendering with embedded-style option, image handling, hyphenation, kerning, chapter navigation, footnotes, bookmarks, go-to-percent, auto page turn, orientation control, focus reading, KOReader progress sync and more. 
 
 - **Various formats**: native handling for `.epub`, `.xtc/.xtch`, `.txt`, and `.bmp`.
 
@@ -29,21 +31,17 @@ CrossPoint is open-source e-reader firmware - community-built, fully hackable, f
   - Web settings UI/API (edit many device settings from browser)
   - WebSocket fast uploads
   - WebDAV handler
-  - AP mode (hotspot) and STA mode (join existing WiFi), both with QR helpers
+  - AP mode (hotspot) and STA mode (join existing Wi-Fi), both with QR helpers
   - Calibre wireless connect flow
   - OPDS browser with saved servers (up to 8), search, pagination, and direct download
   - OTA update checks and installs from GitHub releases
 
 - **Customization**: multiple themes (Classic, Lyra, Lyra Extended, RoundedRaff), sleep screen modes, front/side button remapping, status bar controls, power-button behavior, refresh cadence, and more.
 
-- **Localization**: 22 UI languages and counting.
+- **Localization**: 24 UI languages and counting. RTL support.
 
 ### Coming soon:
 
-- RTL support — Arabic, Hebrew, and Farsi.
-
-- Bookmarks.
-
 - Dictionary lookup — inline word lookup without leaving the reader.
 
 - More themes.
@@ -71,10 +69,6 @@ USB port or browser before assuming the device is locked. Only reach for the unl
 > Flashing any other firmware on a USB-locked device may **permanently brick the device** or leave it **permanently
 > stuck on that firmware with no recovery path**. Once USB flashing is re-locked, your only way back is via OTA, and if
 > the firmware you flashed doesn't support OTA, **there is no way out**.
-> 
-> **The Papyrix fork has removed OTA update support from its code.** If you flash Papyrix onto a
-> USB-locked unit, you will have **zero update or recovery path** and will be stuck on it forever. **Do not flash
-> Papyrix (or any other unsupported firmware) on a locked device.**
 
 ## Install firmware
 
@@ -211,7 +205,7 @@ CrossPoint Reader is pretty aggressive about caching data down to the SD card to
 
 ### Data caching
 
-The first time chapters of a book are loaded, they are cached to the SD card. Subsequent loads are served from the 
+The first time chapters of a book are loaded, they are cached to the SD card. Subsequent loads are served from the
 cache. This cache directory exists at `.crosspoint` on the SD card. The structure is as follows:
 
 ```text
@@ -220,13 +214,18 @@ cache. This cache directory exists at `.crosspoint` on the SD card. The structur
 │   ├── progress.bin     # reading position (chapter, page, etc.)
 │   ├── cover.bmp        # generated cover image
 │   ├── book.bin         # metadata: title, author, spine, TOC
+│   ├── css_rules.cache  # parsed CSS rule cache
+│   ├── img_*            # rendered image cache files
 │   └── sections/        # per-chapter layout cache
 │       ├── 0.bin
 │       ├── 1.bin
 │       └── ...
+├── settings.json        # device settings
+├── state.json           # resume/runtime state
+└── recent.json          # recent books list
 ```
 
-Removing `/.crosspoint` clears all cached metadata and forces a full regeneration on next open. Note: the cache isn't cleared automatically when you delete a book, and moving a file to a new path resets its reading progress.
+Removing `/.crosspoint` clears all cached metadata and forces a full regeneration on next open. Book deletes, overwrites, and moves done through the firmware or web UI clear or re-key matching caches; manual SD-card edits may leave stale cache directories behind.
 
 For more details on the internal file structures, see the [file formats document](./docs/file-formats.md).
 
@@ -248,9 +247,7 @@ One of the best things about open source is that anyone can take the code in a d
 
 - [papyrix-reader](https://github.com/bigbag/papyrix-reader) — Adds FB2 and MD format support. Actively maintained with Arabic script support. Custom themes via SD card.
 
-- [crosspet](https://github.com/trilwu/crosspet) — A Vietnamese fork that adds a Tamagotchi-style virtual chicken that grows based on your reading milestones (pages read, streaks, care). Also: Flashcards, Weather, Pomodoro timer, and mini-games.
-
-- [crosspoint-reader (jpirnay)](https://github.com/jpirnay/crosspoint-reader) — Faster integration of functionality. Tracks upstream PRs and integrates the good ones ahead of the official merge.
+- ~~[crosspet](https://github.com/trilwu/crosspet) — A Vietnamese fork that adds a Tamagotchi-style virtual chicken that grows based on your reading milestones (pages read, streaks, care). Also: Flashcards, Weather, Pomodoro timer, and mini-games.~~ (Unmaintained)
 
 - [crosspoint-reader-cjk](https://github.com/aBER0724/crosspoint-reader-cjk) — Purpose-built for Chinese, Japanese, and Korean reading.
 
@@ -260,6 +257,8 @@ One of the best things about open source is that anyone can take the code in a d
 
 - [crosspoint-reader-papers3](https://github.com/juicecultus/crosspoint-reader-papers3) — Crosspoint port for M5Stack Paper S3. 
 
+- [t5s3-reader](https://github.com/ShallowGreen123/t5s3-reader) — Crosspoint port for LilyGo T5 ePaper S3 / T5S3 4.7-inch e-paper device.
+
 **Note:** Many of these features will make their way into CrossPoint over time. We maintain a slower pace to ensure rock-solid stability and squash bugs before they reach your device.
 
 Want to build your own device? Be sure to check out the [de-link](https://github.com/iandchasse/de-link) project.

USER_GUIDE.md

@@ -5,6 +5,7 @@ Welcome to the **CrossPoint** firmware. This guide outlines the hardware control
 - [CrossPoint User Guide](#crosspoint-user-guide)
   - [1. Hardware Overview](#1-hardware-overview)
     - [Button Layout](#button-layout)
+    - [Taking a Screenshot](#taking-a-screenshot)
   - [2. Power \& Startup](#2-power--startup)
     - [Power On / Off](#power-on--off)
     - [First Launch](#first-launch)
@@ -14,31 +15,45 @@ Welcome to the **CrossPoint** firmware. This guide outlines the hardware control
     - [3.3 Browse Files Screen](#33-browse-files-screen)
     - [3.4 Recent Books Screen](#34-recent-books-screen)
     - [3.5 File Transfer Screen](#35-file-transfer-screen)
-      - [3.5.1 Calibre Wireless Transfers](#351-calibre-wireless-transfers)
+    - [3.5.1 Calibre Wireless Transfers](#351-calibre-wireless-transfers)
+      - [Installing the Plugin in Calibre](#installing-the-plugin-in-calibre)
+      - [Configuring the CrossPoint Plugin in Calibre](#configuring-the-crosspoint-plugin-in-calibre)
+      - [Uploading Books](#uploading-books)
+      - [Removing a Book](#removing-a-book)
     - [3.6 Settings](#36-settings)
       - [3.6.1 Display](#361-display)
       - [3.6.2 Reader](#362-reader)
       - [3.6.3 Controls](#363-controls)
       - [3.6.4 System](#364-system)
       - [3.6.5 OPDS Servers (Multiple Libraries)](#365-opds-servers-multiple-libraries)
-      - [3.6.6 Web Settings (WiFi + OPDS)](#366-web-settings-wifi--opds)
+      - [3.6.6 Web Settings (Wi-Fi + OPDS)](#366-web-settings-wi-fi--opds)
       - [3.6.7 KOReader Sync Quick Setup](#367-koreader-sync-quick-setup)
+        - [Option A: Free Public Server (`sync.koreader.rocks`)](#option-a-free-public-server-synckoreaderrocks)
+        - [Option B: Self-Hosted Server (Docker Compose)](#option-b-self-hosted-server-docker-compose)
     - [3.7 Sleep Screen](#37-sleep-screen)
+      - [Cover settings](#cover-settings)
+      - [Custom images](#custom-images)
+    - [3.8 Custom Fonts (SD Card)](#38-custom-fonts-sd-card)
   - [4. Reading Mode](#4-reading-mode)
     - [Page Turning](#page-turning)
     - [Chapter Navigation](#chapter-navigation)
+    - [Auto Page Turn](#auto-page-turn)
+    - [Tilt Page Turn (X3 only)](#tilt-page-turn-x3-only)
+    - [Footnote Navigation](#footnote-navigation)
     - [System Navigation](#system-navigation)
     - [Supported Languages](#supported-languages)
-  - [5. Chapter Selection Screen](#5-chapter-selection-screen)
+  - [5. Reader Menu](#5-reader-menu)
+    - [5.1 Chapter Selection](#51-chapter-selection)
+    - [5.2 Bookmarks](#52-bookmarks)
   - [6. Current Limitations \& Roadmap](#6-current-limitations--roadmap)
   - [7. Troubleshooting Issues \& Escaping Bootloop](#7-troubleshooting-issues--escaping-bootloop)
 
-
 ## 1. Hardware Overview
 
 The device utilises the standard buttons on the Xteink X4 (in the same layout as the manufacturer firmware, by default):
 
 ### Button Layout
+
 | Location        | Buttons                                              |
 | --------------- | ---------------------------------------------------- |
 | **Bottom Edge** | **Back**, **Confirm**, **Left**, **Right**           |
@@ -47,6 +62,7 @@ The device utilises the standard buttons on the Xteink X4 (in the same layout as
 Button layout can be customized in the **[Controls Settings](#363-controls)**.
 
 ### Taking a Screenshot
+
 When the Power Button and Volume Down button are pressed at the same time, it will take a screenshot and save it in the folder `screenshots/`.
 
 Alternatively, while reading a book, press the **Confirm** button to open the reader menu and select **Take screenshot**.
@@ -83,11 +99,12 @@ See [Reading Mode](#4-reading-mode) below for more information.
 
 ### 3.3 Browse Files Screen
 
-The Browse Files screen acts as a file and folder browser.
+The Browse Files screen acts as a file and folder browser. The full path to the current directory is shown at the top of the screen. File extensions are displayed alongside each filename, and directories are shown with brackets (e.g. `[folder-name]`). Hidden directories (those beginning with `.`) are also visible.
 
 * **Navigate List:** Use **Left** (or **Volume Up**), or **Right** (or **Volume Down**) to move the selection cursor up and down through folders and books. You can also long-press these buttons to scroll a full page up or down.
-* **Open Selection:** Press **Confirm** to open a folder or read a selected book. 
-* **Delete Files:** Hold and release **Confirm** to delete the selected file. You will be given an option to either confirm or cancel deletion. Folder deletion is not supported.
+* **Open Selection:** Press **Confirm** to open a folder or start reading a selected book. Selecting a `.bmp` file will open the image viewer.
+* **Delete Files or Folders:** Hold and release **Confirm** to delete the selected file or folder. You will be given an option to either confirm or cancel. Multiple files can be selected for deletion in a single operation.
+* **Rename or Move:** Files can be renamed or moved to a different folder from within the browse screen.
 
 ### 3.4 Recent Books Screen
 
@@ -95,24 +112,62 @@ The Recent Books screen lists the most recently opened books in a chronological
 
 ### 3.5 File Transfer Screen
 
-The File Transfer screen allows you to upload new e-books to the device. When you enter the screen, you'll be prompted with a WiFi selection dialog and then your X4 will start hosting a web server.
+The File Transfer screen allows you to upload and manage files on the device. When you enter the screen, choose **Join a Network**, **Calibre Wireless**, or **Create Hotspot**. The reader then starts the web server for the selected mode.
 
-See the [webserver docs](./docs/webserver.md) for more information on how to connect to the web server and upload files.
+See the [web server docs](./docs/webserver.md) for more information on how to connect to the web server and upload files.
+
+The web interface also supports **WebDAV**, allowing you to mount the device as a network drive and manage files directly from your computer's file manager.
+
+Download links for files already on the device are available in the web interface, so you can retrieve books or screenshots over Wi-Fi without connecting a cable.
+
+A **Wi-Fi signal strength indicator** (dBm) is displayed on-screen during joined-network web server sessions.
 
 > [!TIP]
-> Advanced users can also manage files programmatically or via the command line using `curl`. See the [webserver docs](./docs/webserver.md) for details.
+> Advanced users can also manage files programmatically or via the command line using `curl`. See the [web server docs](./docs/webserver.md) for details.
+> [!TIP]
+> If your EPUBs have compatibility issues, you can run the built-in **EPUB Optimizer** directly from the device to clean up and reprocess books for better rendering.
 
 ### 3.5.1 Calibre Wireless Transfers
 
 CrossPoint supports sending books from Calibre using the CrossPoint Reader device plugin.
 
-1. Install the plugin in Calibre:
-   - Head to https://github.com/crosspoint-reader/calibre-plugins/releases to download the latest version of the crosspoint_reader plugin.
-   - Download the zip file.
-   - Open Calibre → Preferences → Plugins → Load plugin from file → Select the zip file.
-2. On the device: File Transfer → Connect to Calibre → Join a network.
-3. Make sure your computer is on the same WiFi network.
-4. In Calibre, click "Send to device" to transfer books.
+#### Installing the Plugin in Calibre
+
+If you don't already have the plugin installed:
+
+1. Head to https://github.com/crosspoint-reader/calibre-plugins/releases to download the latest version of the crosspoint_reader plugin.
+2. Download the zip file.
+3. Open Calibre → Preferences → Plugins → Load plugin from file → Select the zip file.
+4. Restart Calibre.
+
+#### Configuring the CrossPoint Plugin in Calibre
+1. In Calibre select Preferences.
+2. In the Preferences dialog select Plugins.
+3. In Plugins search for "crosspoint".
+4. Click on "Customize plugin".
+5. Update the value for "Host" to match the IP for your device.
+6. Leave the other settings as they are.
+7. [optional] Modify the "Upload path" to point to a subfolder other than the root "/" folder. Enter this as a path relative to the root folder. Example: `/mybooks`
+8. Restart Calibre.
+
+<img width="420" height="385" alt="Image" src="https://github.com/user-attachments/assets/01fc7e33-a9a7-48ba-9e26-2e68d1f9daec" />
+
+#### Uploading Books
+
+To upload a book using the CrossPoint plugin in Calibre:
+
+1. On the device: File Transfer -> Calibre Wireless, then join a network.
+2. Select one or more books.
+3. Right-click on that selection.
+4. Select "Send to Device" > "Send to main memory"
+
+The CrossPoint plugin will connect to your device, create a folder for the book's author in the root folder (or the folder you configured for the plugin), then copy the book into that folder.
+
+<img width="783" height="310" alt="Image" src="https://github.com/user-attachments/assets/741b0909-2e1d-4f16-8af0-2c43fbda5ce6" />
+
+#### Removing a Book
+
+Books cannot be removed from your device through Calibre. Use the web interface instead.
 
 ### 3.6 Settings
 
@@ -121,96 +176,155 @@ The Settings screen allows you to configure the device's behavior. There are a f
 #### 3.6.1 Display
 
 - **Sleep Screen**: Which sleep screen to display when the device sleeps:
+  
   - "Dark" (default) - The default dark Crosspoint logo sleep screen
   - "Light" - The same default sleep screen, on a white background
   - "Custom" - Custom images from the SD card; see [Sleep Screen](#37-sleep-screen) below for more information
   - "Cover" - The book cover image (Note: this is experimental and may not work as expected)
   - "None" - A blank screen
-  - "Cover + Custom" - The book cover image, falls back to "Custom" behavior
+  - "Cover + Custom" - The book cover image while actively reading, falls back to "Custom" behavior otherwise
+  - "Quick resume" - The text of the last page read will be displayed on the sleep screen and a moon icon is shown on the edge of the screen. Waking up the device will return to the same page of the opened book. This is useful for quickly resuming reading without waiting for the device to fully wake up and load the book.
+
 - **Sleep Screen Cover Mode**: How to display the book cover when "Cover" sleep screen is selected:
+  
   - "Fit" (default) - Scale the image down to fit centered on the screen, padding with white borders as necessary
   - "Crop" - Scale the image down and crop as necessary to try to fill the screen (Note: this is experimental and may not work as expected)
+
 - **Sleep Screen Cover Filter**: What filter will be applied to the book cover when "Cover" sleep screen is selected:
+  
   - "None" (default) - The cover image will be converted to a grayscale image and displayed as it is
   - "Contrast" - The image will be displayed as a black & white image without grayscale conversion
   - "Inverted" - The image will be inverted as in white & black and will be displayed without grayscale conversion
+
+- **Quick Resume on Timeout**: Whether to enable the "Quick Resume" sleep screen when the device goes to sleep due to inactivity (System > Time to Sleep). This is useful for quickly resuming reading without waiting for the device to fully wake up and load the book. This overwrites the Sleep Screen Cover Mode when enabled.
+
 - **Status Bar**: Configure the status bar displayed while reading:
+  
   - "None" - No status bar
   - "No Progress" - Show status bar without reading progress
   - "Full w/ Percentage" - Show status bar with book progress (as percentage)
   - "Full w/ Book Bar" - Show status bar with book progress (as bar)
   - "Book Bar Only" - Show book progress (as bar)
   - "Full w/ Chapter Bar" - Show status bar with chapter progress (as bar)
+
 - **Hide Battery %**: Configure where to suppress the battery percentage display in the status bar; the battery icon will still be shown:
+  
   - "Never" (default) - Always show battery percentage
   - "In Reader" - Show battery percentage everywhere except in reading mode
   - "Always" - Always hide battery percentage
+
 - **Refresh Frequency**: Set how often the screen does a full refresh while reading to reduce ghosting; options are every 1, 5, 10, 15, or 30 pages.
 
 - **UI Theme**: Set which UI theme to use:
+  
   - "Classic" - The original Crosspoint theme
   - "Lyra" - The new theme for Crosspoint featuring rounded elements and menu icons
   - "Lyra Extended" - Lyra, but displays 3 books instead of 1 on the **[Home Screen](#31-home-screen)**
+  - "RoundedRaff" - A rounded theme with additional visual styling
+
 - **Sunlight Fading Fix**: Configure whether to enable a software-fix for the issue where white X4 models may fade when used in direct sunlight:
+  
   - "OFF" (default) - Disable the fix
   - "ON" - Enable the fix
 
+> [!NOTE]
+> A battery charging indicator is shown on the battery icon whenever the device is actively charging.
+
 #### 3.6.2 Reader
+
 - **Reader Font Family**: Choose the font used for reading:
+  
   - "Noto Serif" (default) - Google's serif font
   - "Noto Sans" - Google's sans-serif font
-  - "Open Dyslexic" - Font designed for readers with dyslexia
+
 - **Reader Font Size**: Adjust the text size for reading; options are "Small", "Medium" (default), "Large", or "X Large".
 
 - **Reader Line Spacing**: Adjust the spacing between lines; options are "Tight", "Normal" (default), or "Wide".
+
 - **Reader Screen Margin**: Controls the screen margins in Reading Mode between 5 and 40 pixels in 5-pixel increments.
+
 - **Reader Paragraph Alignment**: Set the alignment of paragraphs; options are "Justified" (default), "Left", "Center", or "Right".
+
 - **Embedded Style**: Whether to use the EPUB file's embedded HTML and CSS stylisation and formatting; options are "ON" or "OFF".
+
 - **Hyphenation**: Whether to hyphenate text in Reading Mode; options are "ON" or "OFF".
+
 - **Reading Orientation**: Set the screen orientation for reading EPUB files:
+  
   - "Portrait" (default) - Standard portrait orientation
   - "Landscape CW" - Landscape, rotated clockwise
   - "Inverted" - Portrait, upside down
   - "Landscape CCW" - Landscape, rotated counter-clockwise
+
 - **Extra Paragraph Spacing**: Set how to handle paragraph breaks:
+  
   - "ON" - Vertical space will be added between paragraphs in Reading Mode
   - "OFF" - Paragraphs will not have vertical space added, but will have first-line indentation
+
 - **Text Anti-Aliasing**: Whether to show smooth grey edges (anti-aliasing) on text in reading mode. Note this slows down page turns slightly.
 
+- **Images**: Whether to display embedded images (JPG/PNG) found in EPUB files; options are "ON" (default) or "OFF".
+
+- **Focus Reading**: Bolds the first part of each word to create visual fixation points, similar to Bionic Reading. This can help improve reading speed and focus; options are "ON" or "OFF" (default).
+
 #### 3.6.3 Controls
 
 - **Remap Front Buttons**: A menu for customising the function of each bottom edge button.
-- **Side Button Layout (reader)**: Swap the order of the up and down volume buttons from "Prev/Next" (default) to "Next/Prev". This change is only in effect when reading.
+
+- **Side Button Layout (reader)**: Swap the order of the up and down volume buttons from "Prev/Next" (default) to "Next/Prev". You can also disable them entirely. This change is only in effect when reading.
 
 - **Long-press Chapter Skip**: Set whether long-pressing page turn buttons skips to the next/previous chapter:
+  
   - "Chapter Skip" (default) - Long-pressing skips to next/previous chapter
   - "Page Scroll" - Long-pressing scrolls a page up/down
+- **Long-press Menu**: Selects the function bound to holding the menu button (Confirm) while reading an EPUB. **Cycles through the available functions** each time the setting is selected — additional functions may be added in future releases, so this is not a binary on/off toggle. A short press of Confirm always opens the reader menu as normal:
+  - "Bookmark" (default) - Hold Confirm (~0.4 second) to drop a bookmark at the current page.
+  - "KOSync" - Hold Confirm (~1 second) to launch KOReader sync directly.
+  - "Disabled" - Long-press is ignored; only short-press opens the reader menu.
+
 - **Short Power Button Click**: Controls the effect of a short click of the power button:
+  
   - "Ignore" (default) - Require a long press to turn off the device
   - "Sleep" - A short press puts the device into sleep mode
   - "Page Turn" - A short press in reading mode turns to the next page; a long press turns the device off
+  - "Footnotes" - A short press in reading mode opens the footnotes submenu; if only one footnote is present on the page, the referenced page is opened directly. The short press on the power button can be used to select the footnote in the submenu, and to go back to the original page after finish reading the footnote (like the back button).
+  - "Refresh" - A short press triggers a manual full-screen refresh, useful for clearing ghosting
+- **Quick-return from footnotes**: Toggles on and off the quick return functionality from the footnotes. When the functionality it's active, a short press of the power button will act as the back button from the footnotes page.
 
 #### 3.6.4 System
 
-- **Time to Sleep**: Set the duration of inactivity before the device automatically goes to sleep; options are 1, 5, 10 (default), 15 or 30 minutes.
+- **Time to Sleep**: Set the duration of inactivity before the device automatically goes to sleep; options are 1, 3, 5, 10 (default), 15 or 30 minutes.
+
+- **Wi-Fi Networks**: Connect to Wi-Fi networks for file transfers and firmware updates.
 
-- **WiFi Networks**: Connect to WiFi networks for file transfers and firmware updates.
 - **KOReader Sync**: Options for setting up KOReader for syncing book progress.
+
 - **OPDS Servers**: Manage one or more OPDS [(Open Publication Distribution System)](https://en.wikipedia.org/wiki/Open_Publication_Distribution_System) libraries for browsing and downloading books. See [OPDS Servers (Multiple Libraries)](#365-opds-servers-multiple-libraries) below.
+
 - **Clear Reading Cache**: Clear the internal SD card cache.
-- **Check for updates**: Check for Crosspoint firmware updates over WiFi.
-- **Language**: Set the system language (see **[Supported Languages](#supported-languages)** for more information).
+
+- **Check for updates**: Check for Crosspoint firmware updates over Wi-Fi. Firmware can also be updated without a USB connection by placing a `firmware.bin` file on the SD card.
+
+- **Language**: Set the UI language. CrossPoint supports 24 languages: English, Spanish, French, German, Czech, Brazilian Portuguese, Russian, Swedish, Romanian, Catalan, Ukrainian, Belarusian, Italian, Polish, Finnish, Danish, Dutch, Turkish, Kazakh, Hungarian, Lithuanian, Slovenian, Valencian, and Hebrew.
+
+- **Manage Fonts**: Browse, download, and manage custom font families installed from the SD card. See [Custom Fonts (SD Card)](#38-custom-fonts-sd-card) for more information.
 
 #### 3.6.5 OPDS Servers (Multiple Libraries)
 
 CrossPoint supports saving multiple OPDS servers and switching between them when browsing catalogs.
 
 1. Open **Settings -> System -> OPDS Servers**.
+
 2. Select **Add Server** to create a new entry, or select an existing server to edit it.
+
 3. Configure these fields:
-  - **Server Name**: Optional display name (for example, "Home Calibre" or "Public Catalog").
-  - **OPDS Server URL**: Full catalog root URL (for Calibre Content Server, usually ends with `/opds`).
-  - **Username / Password**: Optional credentials for authenticated servers.
+   
+   - **Server Name**: Optional display name (for example, "Home Calibre" or "Public Catalog").
+   
+   - **OPDS Server URL**: Full catalog root URL (for Calibre Content Server, usually ends with `/opds`).
+   
+   - **Username / Password**: Optional credentials for authenticated servers.
+
 4. Use **Delete Server** inside a server entry to remove it.
 
 Behavior notes:
@@ -224,22 +338,22 @@ You can also manage OPDS servers from the web interface while in File Transfer m
 2. Open `http://<device-ip>/settings`.
 3. Use the **OPDS Servers** card to add, edit, or delete entries.
 
-For web-based WiFi network management, see [Web Settings (WiFi + OPDS)](#366-web-settings-wifi--opds).
+For web-based Wi-Fi network management, see [Web Settings (Wi-Fi + OPDS)](#366-web-settings-wi-fi--opds).
 
-#### 3.6.6 Web Settings (WiFi + OPDS)
+#### 3.6.6 Web Settings (Wi-Fi + OPDS)
 
-While in **File Transfer** mode, the web settings page includes management cards for both **WiFi Networks** and **OPDS Servers**.
+While in **File Transfer** mode, the web settings page includes management cards for both **Wi-Fi Networks** and **OPDS Servers**.
 
-1. On device: open **File Transfer** and connect to WiFi.
-1. In a browser, open `http://<device-ip>/settings` or `http://crosspoint.local`.
-1. In **WiFi Networks**, add, edit, or delete saved network entries (SSID + optional password).
-1. In **OPDS Servers**, add, edit, or delete OPDS catalogs.
+1. On device: open **File Transfer** and connect through **Join a Network** or **Create Hotspot**.
+2. In a browser, open `http://<device-ip>/settings` or `http://crosspoint.local`.
+3. In **Wi-Fi Networks**, add, edit, or delete saved network entries (SSID + optional password).
+4. In **OPDS Servers**, add, edit, or delete OPDS catalogs.
 
 Behavior notes:
 
 - Passwords are never shown back in the web UI after saving.
 - Leaving Password blank while editing keeps the existing saved password unchanged.
-- The web UI can save hidden-network SSIDs, but connecting to hidden networks still depends on device-side WiFi connection flow.
+- The web UI can save hidden-network SSIDs, but connecting to hidden networks still depends on the device-side Wi-Fi connection flow.
 
 #### 3.6.7 KOReader Sync Quick Setup
 
@@ -266,13 +380,19 @@ Already have KOReader Sync credentials? Skip registration; basic sync only requi
 When this returns `HTTP 402` with `{"code":2002,"message":"Username is already registered."}`, pick a different username or use that existing account.
 
 2. On each CrossPoint device:
+   
    - Go to **Settings -> System -> KOReader Sync**.
+   
    - Set **Username** and **Password** (enter the plain password; CrossPoint computes MD5 internally, and use the same values on all devices).
+   
    - Set **Sync Server URL** to `https://sync.koreader.rocks`, or leave it empty (both use the same default KOReader sync server).
+   
    - Run **Authenticate**.
 
 3. While reading, press **Confirm** to open the reader menu, then select **Sync Progress**.
+   
    - Choose **Apply Remote** to jump to remote progress.
+   
    - Choose **Upload Local** to push current progress.
 
 ##### Option B: Self-Hosted Server (Docker Compose)
@@ -315,7 +435,7 @@ curl -H "Accept: application/vnd.koreader.v1+json" "http://<server-ip>:17200/hea
 ```
 
 3. Register a user once.
-CrossPoint authenticates against KOReader Sync (`koreader/kosync`) using an MD5 key, so register using the MD5 of your password:
+   CrossPoint authenticates against KOReader Sync (`koreader/kosync`) using an MD5 key, so register using the MD5 of your password:
 
 > [!WARNING]
 > Sending a reusable MD5-derived password over plain HTTP is insecure.
@@ -337,29 +457,35 @@ curl -i "http://<server-ip>:17200/users/create" \
 If this returns `HTTP 402` with `{"code":2002,"message":"Username is already registered."}`, the account already exists.
 
 4. On each CrossPoint device:
+   
    - Go to **Settings -> System -> KOReader Sync**.
+   
    - Set **Username** and **Password** (enter the plain password; CrossPoint computes MD5 internally, and use the same values on all devices).
+   
    - Set **Sync Server URL** to `http://<server-ip>:17200`.
+   
    - Run **Authenticate**.
 
 If you use the HTTPS listener, use `https://<server-ip>:7200` (`curl -k` only for self-signed certificate testing).
 
 5. While reading, press **Confirm** to open the reader menu, then select **Sync Progress**.
+   
    - Choose **Apply Remote** to jump to remote progress.
+   
    - Choose **Upload Local** to push current progress.
 
 ### 3.7 Sleep Screen
 
 The **Sleep Screen** setting controls what is displayed when the device goes to sleep:
 
-| Mode | Behavior |
-|------|----------|
-| **Dark** (default) | The CrossPoint logo on a dark background. |
-| **Light** | The CrossPoint logo on a white background. |
-| **Custom** | A custom image from the SD card (see below). Falls back to **Dark** if no custom image is found. |
-| **Cover** | The cover of the currently open book. Falls back to **Dark** if no book is open. |
-| **Cover + Custom** | The cover of the currently open book. Falls back to **Custom** behavior if no book is open. |
-| **None** | A blank screen. |
+| Mode               | Behavior                                                                                                                     |
+| ------------------ | ---------------------------------------------------------------------------------------------------------------------------- |
+| **Dark** (default) | The CrossPoint logo on a dark background.                                                                                    |
+| **Light**          | The CrossPoint logo on a white background.                                                                                   |
+| **Custom**         | A custom image from the SD card (see below). Falls back to **Dark** if no custom image is found.                             |
+| **Cover**          | The cover of the currently open book. Falls back to **Dark** if no book is open.                                             |
+| **Cover + Custom** | The cover of the currently open book, shown only while actively reading. Falls back to **Custom** behavior when not reading. |
+| **None**           | A blank screen.                                                                                                              |
 
 #### Cover settings
 
@@ -377,10 +503,30 @@ To use custom sleep images, set the sleep screen mode to **Custom** or **Cover +
 
 > [!TIP]
 > For best results:
+> 
 > - Use uncompressed BMP files with 24-bit color depth
 > - X4: Use a resolution of 480x800 pixels to match the device's screen resolution.
 > - X3: Use a resolution of 528x792 pixels to match the device's screen resolution.
 
+> [!TIP]
+> You can set an image as the sleep screen cover directly from the BMP image viewer in the **[Browse Files](#33-browse-files-screen)** screen.
+
+---
+
+### 3.8 Custom Fonts (SD Card)
+
+CrossPoint supports loading additional fonts from the SD card, extending beyond the two built-in families (Noto Serif, Noto Sans). Custom fonts can include extended Unicode coverage, enabling CJK (Chinese, Japanese, Korean) and other scripts.
+
+There are three ways to install fonts:
+
+1. **Download from device (recommended):** Go to **Settings -> System -> Manage Fonts**, browse the available font families, and select one to download over Wi-Fi.
+2. **Upload via web interface:** While in **File Transfer** mode, open the web UI in a browser and navigate to the **Fonts** tab to upload `.cpfont` files.
+3. **Manual SD card copy:** Download font files from the [crosspoint-fonts repository](https://github.com/crosspoint-reader/crosspoint-fonts) and copy them to `/.fonts/` (preferred) or `/fonts/` on your SD card.
+
+Once installed, custom fonts appear in **Settings → Reader → Font Family** alongside the built-in fonts.
+
+See [docs/sd-card-fonts.md](./docs/sd-card-fonts.md) for full installation details and SD card folder structure.
+
 ---
 
 ## 4. Reading Mode
@@ -388,6 +534,7 @@ To use custom sleep images, set the sleep screen mode to **Custom** or **Cover +
 Once you have opened a book, the button layout changes to facilitate reading.
 
 ### Page Turning
+
 | Action            | Buttons                              |
 | ----------------- | ------------------------------------ |
 | **Previous Page** | Press **Left** _or_ **Volume Up**    |
@@ -398,55 +545,142 @@ The role of the volume (side) buttons can be swapped in the **[Controls Settings
 If the **Short Power Button Click** setting is set to "Page Turn", you can also turn to the next page by briefly pressing the Power button.
 
 ### Chapter Navigation
+
 * **Next Chapter:** Press and **hold** the **Right** (or **Volume Down**) button briefly, then release.
 * **Previous Chapter:** Press and **hold** the **Left** (or **Volume Up**) button briefly, then release.
 
 This feature can be disabled in the **[Controls Settings](#363-controls)** to help avoid changing chapters by mistake.
 
+### Auto Page Turn
+
+Auto Page Turn automatically advances pages at a set interval, useful for hands-free reading. This feature can be enabled and configured from the **[Reader Menu](#5-reader-menu)** while reading an EPUB.
+
+### Tilt Page Turn (X3 only)
+
+On the **Xteink X3**, the gyroscope can be used to turn pages by tilting the device. This feature is available in the Controls settings.
+
+### Footnote Navigation
+
+When reading an EPUB that contains footnotes, you can navigate to the footnote text by selecting the footnote reference in the book. From the footnote, you can return to your original reading position.
+
+If the device goes to sleep or you close the book while viewing a footnote, the book reopens to your original reading position, not the footnote.
 
 ### System Navigation
+
 * **Return to Home:** Press the **Back** button to close the book and return to the **[Home](#31-home-screen)** screen.
 * **Return to Browse Files:** Press and hold the **Back** button to close the book and return to the **[Browse Files](#33-browse-files-screen)** screen.
-* **Chapter Menu:** Press **Confirm** to open the **[Table of Contents/Chapter Selection](#5-chapter-selection-screen)** screen.
+* **Reader Menu:** Press **Confirm** to open the **[Reader Menu](#5-reader-menu)**, which includes chapter navigation, reading options, and more.
+* **Long-press Confirm (configurable):** Holding **Confirm** runs the function chosen by the **Long-press Menu** setting in **[Controls Settings](#363-controls)** — "Bookmark" (default) drops a bookmark, "KOSync" launches KOReader Sync, "Disabled" does nothing. A short press always opens the Reader Menu.
 
 ### Supported Languages
 
 CrossPoint renders text using the following Unicode character blocks, enabling support for a wide range of languages:
 
-*   **Latin Script (Basic, Supplement, Extended-A):** Covers English, German, French, Spanish, Portuguese, Italian, Dutch, Swedish, Norwegian, Danish, Finnish, Polish, Czech, Hungarian, Romanian, Slovak, Slovenian, Turkish, and others.
-*   **Cyrillic Script (Standard and Extended):** Covers Russian, Ukrainian, Belarusian, Bulgarian, Serbian, Macedonian, Kazakh, Kyrgyz, Mongolian, and others.
+* **Latin Script (Basic, Supplement, Extended-A/B):** Covers English, German, French, Spanish, Portuguese, Italian, Dutch, Swedish, Norwegian, Danish, Finnish, Polish, Czech, Hungarian, Romanian, Slovak, Slovenian, Turkish, Catalan, and others.
+* **Cyrillic Script (Standard and Extended):** Covers Russian, Ukrainian, Belarusian, Bulgarian, Serbian, Macedonian, Kazakh, Kyrgyz, Mongolian, and others.
+* **Vietnamese:** Supported via extended Latin glyph coverage in the built-in reader fonts.
 
-What is not supported: Chinese, Japanese, Korean, Vietnamese, Hebrew, Arabic, Greek and Farsi.
+What is not supported with built-in reader fonts: Chinese, Japanese, Korean, Arabic, Greek, Hebrew, and Farsi. However, **CJK, Hebrew, Greek, and other extended scripts can be enabled by installing custom SD card fonts** — see [Custom Fonts (SD Card)](#38-custom-fonts-sd-card).
 
 ---
 
-## 5. Chapter Selection Screen
+## 5. Reader Menu
 
-Accessible by pressing **Confirm** while inside a book.
+Press **Confirm** while reading to open the Reader Menu. From here you can access reading utilities and navigation options without leaving the book.
 
-1.  Use **Left** (or **Volume Up**), or **Right** (or **Volume Down**) to highlight the desired chapter.
-2.  Press **Confirm** to jump to that chapter.
-3.  *Alternatively, press **Back** to cancel and return to your current page.*
+Available options include:
+
+- **Select Chapter** – Open the table of contents to jump to a specific chapter (see [Chapter Selection](#51-chapter-selection) below).
+- **Footnotes** – Navigate to the footnotes for the current section *(only shown in books that contain footnotes)*.
+- **Reading Orientation** – Cycle through screen orientations without leaving the reader.
+- **Auto Turn (Pages Per Minute)** – Cycle through automatic page turn speed options for hands-free reading.
+- **Go to %** – Jump to a specific position in the book by percentage.
+- **Take screenshot** – Save a screenshot of the current page to the `screenshots/` folder.
+- **Show page as QR** – Display a QR code encoding the current reading position.
+- **Go Home** – Close the book and return to the Home screen.
+- **Sync Progress** – Push or pull reading progress with a KOReader sync server (see [KOReader Sync Quick Setup](#367-koreader-sync-quick-setup)).
+- **Delete Book Cache** – Clear the cached layout data for the current book, forcing a re-index on next open.
+
+Press **Back** at any time to close the menu and return to your current page.
+
+### 5.1 Chapter Selection
+
+Accessible by selecting **Chapters** from the Reader Menu.
+
+1. Use **Left** (or **Volume Up**), or **Right** (or **Volume Down**) to highlight the desired chapter.
+2. Press **Confirm** to jump to that chapter.
+3. *Alternatively, press **Back** to cancel and return to your current page.*
 
 ---
 
+### 5.2 Bookmarks
+
+Bookmarks can be created to quickly save and restore your place in a book.
+
+To create a bookmark, hold **Confirm** for about half a second while inside a book. A popup will appear letting you know a bookmark was created. The popup message will automatically disappear in a couple of seconds.
+
+To open bookmarks, press **Confirm** while inside a book. Then navigate to the **Bookmarks** menu. Bookmarks can be opened by navigating to them and pressing **Confirm**, which will redirect you to that place in the book. You can delete bookmarks by holding **Confirm** for about 0.7 seconds, and then pressing **Confirm** again to confirm deletion, or **Back** to cancel.
+
+Bookmarks are stored in the `.crosspoint/bookmarks` folder in the JSON format.
+
 ## 6. Current Limitations & Roadmap
 
 Please note that this firmware is currently in active development. The following features are **not yet supported** but are planned for future updates:
 
-* **Images:** Embedded images in e-books will not render.
 * **Cover Images:** Large cover images embedded into EPUB require several seconds (~10s for ~2000 pixel tall image) to convert for sleep screen and home screen thumbnail. Consider optimizing the EPUB with e.g. https://github.com/bigbag/epub-to-xtc-converter to speed this up.
+* **Unsupported Image Formats:** Most JPG and PNG images in EPUBs render correctly. GIFs and progressive JPEGs are not supported and will fall back to an `[Image]` placeholder.
+* 
+* **Dictionary Lookup:** Inline word lookup is not yet implemented.
 
 ---
 
 ## 7. Troubleshooting Issues & Escaping Bootloop
 
-If an issue or crash is encountered while using Crosspoint, feel free to raise an issue ticket and attach the serial monitor logs. The logs can be obtained by connecting the device to a computer and starting a serial monitor. Either [Serial Monitor](https://www.serialmonitor.org/) or the following command can be used:
+If an issue or crash is encountered while using Crosspoint, feel free to raise an issue ticket and attach the logs.
+
+**Crash reports on SD card:** After a crash, CrossPoint automatically saves a crash report to the SD card (no USB connection needed). Check the root of the SD card for a crash log file and include it with any bug report.
+
+**Serial monitor logs:** For more detailed debugging, connect the device to a computer and run the custom debugging monitor script (requires Python 3 with `pyserial`, `colorama`, and `matplotlib`; install via `pip3 install pyserial colorama matplotlib`):
 
 ```
-pio device monitor
+python3 scripts/debugging_monitor.py
 ```
 
+The script auto-detects the serial port. You can also specify one explicitly:
+
+```
+python3 scripts/debugging_monitor.py /dev/ttyACM0        # Linux
+python3 scripts/debugging_monitor.py /dev/tty.usbmodem1  # macOS
+python3 scripts/debugging_monitor.py COM7                # Windows
+```
+
+**Features:**
+
+- Color-coded log output by category (errors, memory, display, EPUB parsing, etc.)
+- Live memory usage graph (free RAM, total RAM, max contiguous allocation) updated every second
+- Interactive command prompt — type a command and press Enter to send it to the device
+- Screenshot capture — saves the current display to `screenshot.bmp` when triggered by the device
+
+**Options:**
+
+| Option               | Description                                               |
+| -------------------- | --------------------------------------------------------- |
+| `--baud RATE`        | Baud rate (default: 115200)                               |
+| `--filter KEYWORD`   | Show only lines containing the keyword (case-insensitive) |
+| `--suppress KEYWORD` | Hide lines containing the keyword (case-insensitive)      |
+
+**Examples:**
+
+```
+# Show only memory-related log lines
+python3 scripts/debugging_monitor.py --filter MEM
+
+# Hide noisy SD card log lines
+python3 scripts/debugging_monitor.py --suppress "[SD]"
+```
+
+Press **Ctrl-C** or close the graph window to exit.
+
 If the device is stuck in a bootloop, press and release the Reset button. Then, press and hold on to the configured Back button and the Power Button to boot to the Home Screen.
 
-There can be issues with broken cache or config. In this case, delete the `.crosspoint` directory on your SD card (or consider deleting only `settings.bin`, `state.bin`, or `epub_*` cache directories in the `.crosspoint/` folder).
+There can be issues with broken cache or config. In this case, delete the `.crosspoint` directory on your SD card (or consider deleting only `settings.json`, `state.json`, or `epub_*` cache directories in the `.crosspoint/` folder).

bin/clang-format-fix

@@ -47,6 +47,7 @@ git ls-files  --exclude-standard ${GIT_LS_FILES_FLAGS} \
     | grep -v -E '^lib/EpdFont/builtinFonts/' \
     | grep -v -E '^lib/Epub/Epub/hyphenation/generated/' \
     | grep -v -E '^lib/uzlib/' \
+    | grep -v -E '^lib/miniz/third_party/' \
     | xargs -r "${CLANG_FORMAT_BIN}" -style=file -i
 # Restore strict pipeline failure handling for the rest of the script.
 set -o pipefail

bin/clang-format-fix.ps1

@@ -4,7 +4,7 @@
 
 .DESCRIPTION
     Formats all C/C++ source and header files in the repository, excluding
-    generated, vendored, and build directories (open-x4-sdk, builtinFonts,
+    generated, vendored, and build directories (freeink-sdk, builtinFonts,
     hyphenation tries, uzlib, .pio, *.generated.h).
 
     The clang-format binary path is resolved once and cached in
@@ -92,7 +92,7 @@ function Resolve-ClangFormat {
 $clangFormat = Resolve-ClangFormat
 
 $exclude = @(
-    'open-x4-sdk'
+    'freeink-sdk'
     'lib\EpdFont\builtinFonts'
     'lib\Epub\Epub\hyphenation\generated'
     'lib\uzlib'

docs/contributing/architecture.md

@@ -8,17 +8,18 @@ At a high level, it is firmware that uses an activity-driven application archite
 
 ```mermaid
 graph TD
-    A[Hardware: ESP32-C3 + SD + E-ink + Buttons] --> B[open-x4-sdk HAL]
-    B --> C[src/main.cpp runtime loop]
-    C --> D[Activities layer]
-    C --> E[State and settings]
-    D --> F[Reader flows]
-    D --> G[Home/Library/Settings flows]
-    D --> H[Network/Web server flows]
-    F --> I[lib/Epub parsing + layout + hyphenation]
-    I --> J[SD cache in .crosspoint]
-    D --> K[GfxRenderer]
-    K --> L[E-ink display buffer]
+    A[Hardware: ESP32-C3 + SD + E-ink + Buttons] --> B[freeink-sdk]
+    B --> C[lib/hal wrappers]
+    C --> D[src/main.cpp runtime loop]
+    D --> E[Activities layer]
+    D --> F[State and settings]
+    E --> G[Reader flows]
+    E --> H[Home/Library/Settings flows]
+    E --> I[Network/Web server flows]
+    G --> J[lib/Epub parsing + layout + hyphenation]
+    J --> K[SD cache in .crosspoint]
+    E --> L[GfxRenderer]
+    L --> M[E-ink display buffer]
 ```
 
 ## Runtime lifecycle
@@ -58,7 +59,7 @@ Top-level activity groups:
 - `src/activities/home/`: home and library navigation
 - `src/activities/reader/`: EPUB/XTC/TXT reading flows
 - `src/activities/settings/`: settings menus and configuration
-- `src/activities/network/`: WiFi selection, AP/STA mode, file transfer server
+- `src/activities/network/`: Wi-Fi selection, AP/STA mode, file transfer server
 - `src/activities/boot_sleep/`: boot and sleep transitions
 
 ## Reader and content pipeline
@@ -73,10 +74,11 @@ flowchart LR
     C -->|EPUB| D[lib/Epub/Epub]
     C -->|XTC| E[lib/Xtc reader]
     C -->|TXT| F[lib/Txt reader]
-    D --> G[Parse OPF/TOC/CSS]
-    G --> H[Layout pages/sections]
-    H --> I[Write section and metadata caches]
-    I --> J[Render current page via GfxRenderer]
+    D --> G[Parse OPF/TOC and collect CSS refs]
+    G --> H[Build/load book.bin and css_rules.cache]
+    H --> I[Layout pages/sections]
+    I --> J[Write section cache]
+    J --> K[Render current page via GfxRenderer]
 ```
 
 Why caching matters:
@@ -98,7 +100,7 @@ flowchart TD
     D --> E[Locate container and OPF]
     E --> F[Build or load BookMetadataCache]
     F --> G[Load TOC and spine]
-    G --> H[Load or parse CSS rules]
+    G --> H[Load CSS cache or parse manifest/base-dir CSS]
 
     H --> I[EpubReaderActivity]
     I --> J{Section cache exists for current settings?}
@@ -121,7 +123,12 @@ flowchart TD
 
 Notes:
 
-- "section cache exists" depends on cache-busting parameters such as font and layout-related settings
+- CSS files are collected from the OPF manifest and, when needed, discovered by
+  streaming ZIP paths under the OPF content base directory; the firmware avoids
+  preloading the full ZIP central directory for large books.
+- "section cache exists" depends on cache-busting parameters such as font,
+  viewport size, paragraph alignment, hyphenation, embedded CSS, image rendering,
+  and Focus Reading settings
 - rendering favors reusing precomputed layout data to keep page turns responsive on constrained hardware
 - progress/session state is persisted so the reader can reopen at the last position after reboot/sleep
 
@@ -138,14 +145,18 @@ Typical persisted areas on SD:
 /.crosspoint/
   epub_<hash>/
     book.bin
+    css_rules.cache
     progress.bin
     cover.bmp
     sections/*.bin
-  settings.bin
-  state.bin
+    img_* cache files
+  settings.json
+  state.json
 ```
 
-For binary cache formats, see `docs/file-formats.md`.
+`sections/*.bin` contains rendered pages plus anchor, paragraph, and list-item
+lookup tables used for TOC/footnote jumps and KOReader sync refinement. For
+binary cache formats, see `docs/file-formats.md`.
 
 ## Networking architecture
 
@@ -153,14 +164,18 @@ Network file transfer is controlled by `src/activities/network/CrossPointWebServ
 
 Modes:
 
-- STA: join existing WiFi network
+- STA: join existing Wi-Fi network
 - AP: create hotspot
+- Calibre Wireless: STA flow specialized for Calibre plugin uploads
 
 Server behavior:
 
 - HTTP server on port 80
 - WebSocket upload server on port 81
+- WebDAV handler on the HTTP server
+- UDP discovery listener for upload clients
 - file operations backed by SD storage
+- browser APIs for file management, settings, fonts, OPDS servers, and saved Wi-Fi networks
 - activity requests faster loop responsiveness while server is running
 
 Endpoint reference: `docs/webserver-endpoints.md`.
@@ -170,6 +185,7 @@ Endpoint reference: `docs/webserver-endpoints.md`.
 Some sources are generated and should not be edited manually.
 
 - `scripts/build_html.py` generates `src/network/html/*.generated.h` from HTML files
+- `scripts/gen_i18n.py` generates `lib/I18n/I18nKeys.h`, `I18nStrings.h`, and `I18nStrings.cpp`
 - `scripts/generate_hyphenation_trie.py` generates hyphenation headers under `lib/Epub/Epub/hyphenation/generated/`
 
 When editing related source assets, regenerate via normal build steps/scripts.
@@ -179,9 +195,10 @@ When editing related source assets, regenerate via normal build steps/scripts.
 - `src/`: app orchestration, settings/state, and activity implementations
 - `src/network/`: web server and OTA/update networking
 - `src/components/`: theming and shared UI components
+- `lib/hal/`: hardware abstraction wrappers around freeink-sdk
 - `lib/Epub/`: EPUB parser, layout, CSS handling, and hyphenation
 - `lib/`: supporting libraries (fonts, text, filesystem helpers, etc.)
-- `open-x4-sdk/`: hardware SDK submodule (display, input, storage, battery)
+- `freeink-sdk/`: hardware SDK submodule (display, input, storage, battery). Docs: https://freeink.org/docs
 - `docs/`: user and technical documentation
 
 ## Embedded constraints that shape design

docs/file-formats.md

@@ -1,22 +1,26 @@
 # File Formats
 
+These formats describe the SD-card cache files under `/.crosspoint/epub_<hash>/`.
+All POD fields are written in the ESP32 little-endian representation used by
+`Serialization.h`; strings are length-prefixed UTF-8.
+
 ## `book.bin`
 
-### Version 3
+### Version 7
 
-ImHex Pattern:
+`book.bin` stores EPUB metadata plus lookup tables for spine and TOC entries.
+The current firmware writes this version from `BookMetadataCache`.
+
+ImHex pattern:
 
 ```c++
 import std.mem;
 import std.string;
 import std.core;
 
-// === Configuration ===
-#define EXPECTED_VERSION 3
+#define EXPECTED_VERSION 7
 #define MAX_STRING_LENGTH 65535
 
-// === String Structure ===
-
 struct String {
     u32 length [[hidden, comment("String byte length")]];
     if (length > MAX_STRING_LENGTH) {
@@ -29,74 +33,56 @@ fn format_string(String s) {
     return s.data;
 };
 
-// === Metadata Structure ===
-
 struct Metadata {
     String title [[comment("Book title")]];
     String author [[comment("Book author")]];
+    String language [[comment("Book language code")]];
     String coverItemHref [[comment("Path to cover image")]];
     String textReferenceHref [[comment("Path to guided first text reference")]];
-} [[comment("Book metadata information")]];
-
-// === Spine Entry Structure ===
+};
 
 struct SpineEntry {
     String href [[comment("Resource path")]];
-    u32 cumulativeSize [[comment("Cumulative size in bytes"), color("FF6B6B")]];
-    s16 tocIndex [[comment("Index into TOC (-1 if none)"), color("4ECDC4")]];
-} [[comment("Spine entry defining reading order")]];
-
-// === TOC Entry Structure ===
+    u32 cumulativeSize [[comment("Cumulative uncompressed spine size through this entry")]];
+    s16 tocIndex [[comment("Index into TOC, or inherited/previous TOC index when no direct entry exists")]];
+};
 
 struct TocEntry {
     String title [[comment("Chapter/section title")]];
     String href [[comment("Resource path")]];
     String anchor [[comment("Fragment identifier")]];
-    u8 level [[comment("Nesting level (0-255)"), color("95E1D3")]];
-    s16 spineIndex [[comment("Index into spine (-1 if none)"), color("F38181")]];
-} [[comment("Table of contents entry")]];
-
-// === Book Bin Structure ===
+    u8 level [[comment("Nesting level")]];
+    s16 spineIndex [[comment("Index into spine (-1 if none)")]];
+};
 
 struct BookBin {
-    // Header
-    u8 version [[comment("Format version"), color("FFD93D")]];
-
-    // Version validation
+    u8 version;
     if (version != EXPECTED_VERSION) {
         std::error(std::format("Unsupported version: {} (expected {})", version, EXPECTED_VERSION));
     }
 
-    u32 lutOffset [[comment("Offset to lookup tables"), color("6BCB77")]];
-    u16 spineCount [[comment("Number of spine entries"), color("4D96FF")]];
-    u16 tocCount [[comment("Number of TOC entries"), color("FF6B9D")]];
+    u32 lutOffset [[comment("Offset to lookup tables")]];
+    u16 spineCount;
+    u16 tocCount;
 
-    // Metadata section
-    Metadata metadata [[comment("Book metadata")]];
+    Metadata metadata;
 
-    // Validate LUT offset alignment
     u32 currentOffset = $;
     if (currentOffset != lutOffset) {
         std::warning(std::format("LUT offset mismatch: expected 0x{:X}, got 0x{:X}", lutOffset, currentOffset));
     }
 
-    // Lookup Tables
-    u32 spineLut[spineCount] [[comment("Spine entry offsets"), color("4D96FF")]];
-    u32 tocLut[tocCount] [[comment("TOC entry offsets"), color("FF6B9D")]];
+    u32 spineLut[spineCount] [[comment("Spine entry offsets")]];
+    u32 tocLut[tocCount] [[comment("TOC entry offsets")]];
 
-    // Data Entries
-    SpineEntry spines[spineCount] [[comment("Spine entries (reading order)")]];
-    TocEntry toc[tocCount] [[comment("Table of contents entries")]];
+    SpineEntry spines[spineCount];
+    TocEntry toc[tocCount];
 };
 
-// === File Parsing ===
-
 BookBin book @ 0x00;
 
-// Validate we've consumed the entire file
 u32 fileSize = std::mem::size();
 u32 parsedSize = $;
-
 if (parsedSize != fileSize) {
     std::warning(std::format("Unparsed data detected: {} bytes remaining at offset 0x{:X}", fileSize - parsedSize, parsedSize));
 }
@@ -104,20 +90,45 @@ if (parsedSize != fileSize) {
 
 ## `section.bin`
 
-### Version 24
+### Version 30
 
-ImHex Pattern:
+Each file in `sections/*.bin` stores one laid-out spine section. The header is
+also the cache-busting key: if any layout-affecting setting differs from the
+current reader settings, the section is discarded and rebuilt.
+
+Version 30 is binary-identical to version 29. The version was bumped because
+Arabic contextual shaping changed text measurement (`getTextAdvanceX` now
+measures the shaped visual text), so word positions cached by v29 no longer
+match what `drawText` renders.
+
+Version 28 introduced serialized word style bits for underline, strikethrough,
+superscript, and subscript. The format also includes:
+
+- cache-busting fields for paragraph alignment, hyphenation, embedded CSS,
+  image rendering mode, and Focus Reading
+- page offset LUT
+- anchor-to-page map for fragment and footnote navigation
+- paragraph and list-item LUTs used by KOReader sync page refinement
+- optional per-word Focus Reading split metadata
+- per-page footnote entries
+- serialized word style bits for underline, strikethrough, superscript, and
+  subscript
+- flat TextBlock word storage (v29): per-word arrays plus one shared
+  NUL-terminated text blob, replacing v28's length-prefixed word strings. The
+  on-disk order mirrors the in-RAM arena so the firmware reads a whole block
+  payload with a single allocation and a single SD read
+
+ImHex pattern:
 
 ```c++
 import std.mem;
 import std.string;
 import std.core;
 
-// === Configuration ===
-#define EXPECTED_VERSION 24
+#define EXPECTED_VERSION 30
 #define MAX_STRING_LENGTH 65535
-
-// === String Structure ===
+#define FOOTNOTE_NUMBER_LEN 32
+#define FOOTNOTE_HREF_LEN 96
 
 struct String {
     u32 length [[hidden, comment("String byte length")]];
@@ -131,44 +142,85 @@ fn format_string(String s) {
     return s.data;
 };
 
-// === Page Structure ===
-
 enum PageElementTag : u8 {
-    PageLine = 1,
-    PageImage = 2,
-    PageHorizontalRule = 3
+    TAG_PageLine = 1,
+    TAG_PageImage = 2,
+    TAG_PageHorizontalRule = 3
 };
 
 enum WordStyle : u8 {
     REGULAR = 0,
     BOLD = 1,
     ITALIC = 2,
-    BOLD_ITALIC = 3
+    BOLD_ITALIC = 3,
+    UNDERLINE = 4,
+    STRIKETHROUGH = 8,
+    SUP = 16,
+    SUB = 32
 };
 
-enum BlockStyle : u8 {
+enum TextAlign : u8 {
     JUSTIFIED = 0,
     LEFT_ALIGN = 1,
     CENTER_ALIGN = 2,
     RIGHT_ALIGN = 3,
+    NONE = 4
+};
+
+struct BlockStyle {
+    TextAlign alignment;
+    bool textAlignDefined;
+    s16 marginTop;
+    s16 marginBottom;
+    s16 marginLeft;
+    s16 marginRight;
+    s16 paddingTop;
+    s16 paddingBottom;
+    s16 paddingLeft;
+    s16 paddingRight;
+    s16 textIndent;
+    bool textIndentDefined;
+    bool isRtl;
+    bool directionDefined;
+};
+
+struct TextBlock {
+    u16 wordCount;
+    u8 hasFocus;
+    u16 textBytes [[comment("Total size of text[], including one NUL per word")]];
+
+    if (wordCount > 0) {
+        u16 textOff[wordCount] [[comment("Byte offset of word i's text within text[]")]];
+        s16 wordXPos[wordCount];
+        if (hasFocus != 0) {
+            u16 wordFocusSuffixX[wordCount] [[comment("Suffix x offset from word start")]];
+        }
+        WordStyle wordStyle[wordCount];
+        if (hasFocus != 0) {
+            u8 wordFocusBoundary[wordCount] [[comment("UTF-8 byte boundary between bold prefix and suffix")]];
+        }
+        char text[textBytes] [[comment("All words back to back, each NUL-terminated")]];
+    }
+
+    BlockStyle blockStyle;
+};
+
+struct ImageBlock {
+    String imagePath;
+    s16 width;
+    s16 height;
 };
 
 struct PageLine {
-  s16 xPos;
-  s16 yPos;
-  u16 wordCount;
-  String words[wordCount];
-  u16 wordXPos[wordCount];
-  WordStyle wordStyle[wordCount];
-  BlockStyle blockStyle;
+    s16 xPos;
+    s16 yPos;
+    TextBlock block;
 };
 
 struct PageImage {
     s16 xPos;
     s16 yPos;
-    String imagePath;
-    s16 width;
-    s16 height;
+    ImageBlock image;
 };
 
 struct PageHorizontalRule {
@@ -179,63 +231,95 @@ struct PageHorizontalRule {
 };
 
 struct PageElement {
-    u8 pageElementType;
-    if (pageElementType == 1) {
+    PageElementTag pageElementType;
+    if (pageElementType == TAG_PageLine) {
         PageLine pageLine [[inline]];
-    } else if (pageElementType == 2) {
+    } else if (pageElementType == TAG_PageImage) {
         PageImage pageImage [[inline]];
-    } else if (pageElementType == 3) {
+    } else if (pageElementType == TAG_PageHorizontalRule) {
         PageHorizontalRule horizontalRule [[inline]];
     } else {
         std::error(std::format("Unknown page element type: {}", pageElementType));
     }
 };
 
+struct FootnoteEntry {
+    char number[FOOTNOTE_NUMBER_LEN];
+    char href[FOOTNOTE_HREF_LEN];
+};
+
 struct Page {
     u16 elementCount;
     PageElement elements[elementCount] [[inline]];
+
+    u16 footnoteCount;
+    FootnoteEntry footnotes[footnoteCount];
 };
 
-// === Section Bin Structure ===
+struct AnchorEntry {
+    String anchor;
+    u16 page;
+};
+
+struct AnchorMap {
+    u16 count;
+    AnchorEntry entries[count];
+};
+
+struct ParagraphLut {
+    u16 count;
+    u16 paragraphIndex[count];
+};
 
 struct SectionBin {
-    // Header
-    u8 version [[comment("Format version"), color("FFD93D")]];
-
-    // Version validation
+    u8 version;
     if (version != EXPECTED_VERSION) {
         std::error(std::format("Unsupported version: {} (expected {})", version, EXPECTED_VERSION));
     }
 
-    // Cache busting parameters
     s32 fontId;
     float lineCompression;
     bool extraParagraphSpacing;
+    u8 paragraphAlignment;
     u16 viewportWidth;
-    u16 vieportHeight;
+    u16 viewportHeight;
+    bool hyphenationEnabled;
+    bool embeddedStyle;
+    u8 imageRendering;
+    bool focusReadingEnabled;
+
     u16 pageCount;
-    u32 lutOffset;
+    u32 pageLutOffset;
+    u32 anchorMapOffset;
+    u32 paragraphLutOffset;
+    u32 listItemLutOffset;
 
-    Page page[pageCount];
+    Page pages[pageCount];
 
-    // Validate LUT offset alignment
     u32 currentOffset = $;
-    if (currentOffset != lutOffset) {
-        std::warning(std::format("LUT offset mismatch: expected 0x{:X}, got 0x{:X}", lutOffset, currentOffset));
+    if (currentOffset != pageLutOffset) {
+        std::warning(std::format("Page LUT offset mismatch: expected 0x{:X}, got 0x{:X}", pageLutOffset, currentOffset));
     }
 
-    // Lookup Tables
-    u32 lut[pageCount];
+    u32 pageLut[pageCount] [[comment("Page data offsets")]];
+
+    if (anchorMapOffset != 0) {
+        AnchorMap anchorMap @ anchorMapOffset;
+    }
+
+    if (paragraphLutOffset != 0) {
+        ParagraphLut paragraphLut @ paragraphLutOffset;
+    }
+
+    if (listItemLutOffset != 0 && paragraphLutOffset != 0) {
+        u16 listItemIndex[paragraphLut.count] @ listItemLutOffset;
+    }
 };
 
-// === File Parsing ===
+SectionBin section @ 0x00;
 
-SectionBin book @ 0x00;
-
-// Validate we've consumed the entire file
 u32 fileSize = std::mem::size();
 u32 parsedSize = $;
-
 if (parsedSize != fileSize) {
     std::warning(std::format("Unparsed data detected: {} bytes remaining at offset 0x{:X}", fileSize - parsedSize, parsedSize));
 }

docs/focus-reading.md

@@ -11,7 +11,7 @@ Focus Reading is a reading aid that bolds the first portion of each word, guidin
 1. Open **Settings > Reader**
 2. Toggle **Focus Reading** on
 
-Toggling the setting will trigger a re-index of your current book, the same as when changing font settings. Once indexing is complete, page turns proceed as normal. No changes are made to your EPUB files.
+Toggling the setting invalidates affected EPUB section caches for the current layout, the same as changing font settings. Sections are rebuilt on demand, then page turns proceed as normal. No changes are made to your EPUB files.
 
 ## Examples
 

docs/i18n.md

@@ -5,17 +5,29 @@ This guide explains the multi-language support system in CrossPoint Reader.
 ## Supported Languages
 
 - English
-- French
-- German
-- Portuguese
-- Spanish
-- Swedish
-- Czech
-- Russian
-- Ukrainian
-- Polish
-- Danish
-- Turkish
+- Español
+- Français
+- Deutsch
+- Čeština
+- Português (Brasil)
+- Русский
+- Svenska
+- Română
+- Català
+- Українська
+- Беларуская
+- Italiano
+- Polski
+- Suomi
+- Dansk
+- Nederlands
+- Türkçe
+- Қазақша
+- Magyar
+- Lietuvių
+- Slovenščina
+- Valencià
+- עברית
 
 ---
 
@@ -108,7 +120,9 @@ This automatically:
 #### 3. Use in code
 
 ```cpp
+#include <CrossPointSettings.h>
 #include <I18n.h>
+#include <Logging.h>
 
 // Using the tr() macro (recommended)
 renderer.drawText(font, x, y, tr(STR_MY_NEW_STRING));
@@ -175,7 +189,7 @@ The YAML files use UTF-8 encoding. Special characters are automatically converte
 // tr(id) - Get translated string without StrId:: prefix
 const char* text = tr(STR_SETTINGS_TITLE);
 renderer.drawText(font, x, y, tr(STR_BROWSE_FILES));
-Serial.printf("Status: %s\n", tr(STR_CONNECTED));
+LOG_INF("I18N", "Status: %s", tr(STR_CONNECTED));
 
 // I18N - Shorthand for I18n::getInstance()
 I18N.setLanguage(Language::ES);
@@ -191,34 +205,39 @@ const char* text = tr(STR_SETTINGS_TITLE);              // Macro (recommended)
 const char* text = I18N.get(StrId::STR_SETTINGS_TITLE);   // Direct call
 const char* text = I18N[StrId::STR_SETTINGS_TITLE];       // Operator overload
 
-// Set language
+// Set runtime language
 I18N.setLanguage(Language::ES);
 
 // Get current language
 Language lang = I18N.getLanguage();
 
-// Save language setting to file
-I18N.saveSettings();
-
-// Load language setting from file
-I18N.loadSettings();
-
 // Get character set for font subsetting (static method)
 const char* chars = I18n::getCharacterSet(Language::FR);
+
+// Persist a user language choice
+SETTINGS.language = static_cast<uint8_t>(Language::ES);
+SETTINGS.saveToFile();
 ```
 
 ---
 
 ## File Storage
 
-Language settings are stored in:
+The selected language is stored with the rest of the device settings in:
+```text
+/.crosspoint/settings.json
 ```
+
+The JSON field is `language`, stored as a stable language code string such as
+`"EN"`, `"DE"`, or `"HE"` rather than a raw enum value.
+
+Older firmware versions used:
+```text
 /.crosspoint/language.bin
 ```
 
-This file contains:
-- Version byte
-- Current language selection (1 byte)
+On load, current firmware migrates that legacy file into `settings.json` and
+renames it to `language.bin.bak`.
 
 ---
 

docs/sd-card-fonts.md

@@ -9,15 +9,15 @@ There are three ways to install fonts:
 
 ### Option 1: Download from device (recommended)
 
-1. Connect your CrossPoint reader to WiFi
+1. Connect your CrossPoint reader to Wi-Fi
 2. Go to **Settings > System > Manage Fonts**
 3. Browse available font families and tap to download
 4. Downloaded fonts appear immediately in **Settings > Reader > Font Family**
 
 ### Option 2: Upload via web browser
 
-1. Connect your CrossPoint reader to WiFi
-2. Open the web interface in your browser (shown on the WiFi screen)
+1. Start **File Transfer** and connect through **Join Network** or **Create Hotspot**
+2. Open the web interface URL shown on the reader
 3. Navigate to the **Fonts** tab
 4. Upload `.cpfont` files using the upload form
 
@@ -91,15 +91,36 @@ To convert your own TrueType/OpenType fonts:
 
 | Preset | Coverage |
 |--------|----------|
-| `ascii` | U+0020-U+007E (Basic Latin) |
-| `latin-ext` | European languages (Latin + Extended-A/B) |
+| `ascii` | U+0020–U+007E (Basic Latin) |
+| `latin1` | U+0080–U+00FF (Latin-1 Supplement) |
+| `latin-ext` | European languages (Latin + Extended-A/B + punctuation + ligatures) |
 | `greek` | Greek + Extended Greek |
 | `cyrillic` | Cyrillic + Supplement |
+| `hebrew` | Hebrew + Alphabetic Presentation Forms |
+| `georgian` | Georgian + Georgian Supplement |
+| `armenian` | Armenian |
+| `ethiopic` | Ethiopic + Extended |
+| `vietnamese` | Vietnamese subset (ơ/ư and combining marks) |
+| `punctuation` | General punctuation (U+2000–U+206F) |
 | `cjk` | CJK Unified Ideographs + Hiragana + Katakana + Fullwidth |
-| `hangul` | Korean Hangul syllables |
+| `hangul` | Korean Hangul syllables + Jamo + Compatibility Jamo |
+| `cherokee` | Cherokee (historic + supplement block) |
+| `tifinagh` | Tifinagh |
+| `symbols` | Math, currency, arrows, box-drawing, misc symbols, dingbats |
 | `reading` | Literary fiction coverage: Latin, Greek, Cyrillic, math/symbol blocks, supplemental punctuation, and CJK quote marks |
-| `builtin` | Matches built-in Bookerly coverage exactly |
+| `builtin` | Matches the firmware's built-in font conversion intervals |
 
 Combine presets with commas: `--intervals latin-ext,greek,cyrillic`
 
-Install custom fonts via WiFi upload or manual SD card copy.
+You can also specify arbitrary Unicode ranges directly:
+`--intervals latin-ext,(0x2100-0x214F)`
+
+To list all presets with codepoint counts:
+
+    python3 lib/EpdFont/scripts/fontconvert_sdcard.py --list-presets
+
+### Additional options
+
+`--force-autohint` — force FreeType's auto-hinter instead of the font's native hinting (useful when a font's built-in hints produce poor results at small sizes).
+
+Install custom fonts via the web interface or manual SD card copy.

docs/translators.md

@@ -1,7 +1,9 @@
 # Translators
 
-Below is a list of users and languages CrossPoint may support in the future.
-Note because a language is below does not mean there is official support for the language at this time.
+Below is a list of translator credits for languages with known contributors.
+Official UI language support is determined by the YAML files in
+`lib/I18n/translations/`; see [i18n.md](./i18n.md) for the current supported
+language list.
 
 ## Contributing
 
@@ -37,6 +39,7 @@ If you'd like to add your name to this list, please open a PR adding yourself an
 - [Skrzakk](https://github.com/Skrzakk)
 - [pablohc](https://github.com/pablohc)
 - [DaniPhii](https://github.com/DaniPhii)
+- [lpla](https://github.com/lpla)
 
 ## Swedish
 - [dawiik](https://github.com/dawiik)
@@ -47,6 +50,7 @@ If you'd like to add your name to this list, please open a PR adding yourself an
 
 ## Catalan
 - [angeldenom](https://github.com/angeldenom)
+- [lpla](https://github.com/lpla)
 
 ## Finnish
 - [plahteenlahti](https://github.com/plahteenlahti)

docs/troubleshooting.md

@@ -1,6 +1,6 @@
 # Troubleshooting
 
-This document show most common issues and possible solutions while using the device features.
+This document shows common issues and possible solutions while using the device features.
 
 - [Troubleshooting](#troubleshooting)
     - [Cannot See the Device on the Network](#cannot-see-the-device-on-the-network)
@@ -14,25 +14,27 @@ This document show most common issues and possible solutions while using the dev
 
 **Solutions:**
 
-1. Verify both devices are on the **same WiFi network**
-   - Check your computer/phone WiFi settings
-   - Confirm the CrossPoint Reader shows "Connected" status
+1. Verify both devices are on the correct network
+   - Check your computer/phone Wi-Fi settings
+   - In **Join Network** mode, your computer/phone and CrossPoint Reader must be on the same Wi-Fi network
+   - In **Create Hotspot** mode, your computer/phone must be connected to the `CrossPoint-Reader` hotspot
 2. Double-check the IP address
    - Make sure you typed it correctly
    - Include `http://` at the beginning
+   - Try the displayed IP address if `http://crosspoint.local/` does not resolve
 3. Try disabling VPN if you're using one
-4. Some networks have "client isolation" enabled - check with your network administrator
+4. Some networks have "client isolation" enabled - use Create Hotspot mode or check with your network administrator
 
 ### Connection Drops or Times Out
 
-**Problem:** WiFi connection is unstable
+**Problem:** Wi-Fi connection is unstable
 
 **Solutions:**
 
-1. Move closer to the WiFi router
+1. Move closer to the Wi-Fi router, or use Create Hotspot mode for a direct connection
 2. Check signal strength on the device (should be at least `||` or better)
 3. Avoid interference from other devices
-4. Try a different WiFi network if available
+4. Try a different Wi-Fi network if available
 
 ### Upload Fails
 
@@ -40,10 +42,11 @@ This document show most common issues and possible solutions while using the dev
 
 **Solutions:**
 
-1. Ensure the file is a valid `.epub` file
-2. Check that the SD card has enough free space
+1. Check that the SD card has enough free space
+2. Check that the filename is valid for the SD card filesystem
 3. Try uploading a smaller file first to test
 4. Refresh the browser page and try again
+5. If WebSocket upload fails repeatedly, refresh the page and retry with the HTTP fallback path
 
 ### Saved Password Not Working
 

docs/webserver-endpoints.md

@@ -1,72 +1,36 @@
 # Webserver Endpoints
 
-This document describes all HTTP and WebSocket endpoints available on the CrossPoint Reader webserver.
+This document describes the HTTP, WebSocket, WebDAV, and discovery endpoints
+available while CrossPoint Reader is in File Transfer or Calibre Wireless mode.
 
-- [Webserver Endpoints](#webserver-endpoints)
-  - [Overview](#overview)
-  - [HTTP Endpoints](#http-endpoints)
-    - [GET `/` - Home Page](#get----home-page)
-    - [GET `/files` - File Browser Page](#get-files---file-browser-page)
-    - [GET `/api/status` - Device Status](#get-apistatus---device-status)
-    - [GET `/api/files` - List Files](#get-apifiles---list-files)
-    - [POST `/upload` - Upload File](#post-upload---upload-file)
-    - [POST `/mkdir` - Create Folder](#post-mkdir---create-folder)
-    - [POST `/delete` - Delete File or Folder](#post-delete---delete-file-or-folder)
-  - [WebSocket Endpoint](#websocket-endpoint)
-    - [Port 81 - Fast Binary Upload](#port-81---fast-binary-upload)
-  - [Network Modes](#network-modes)
-    - [Station Mode (STA)](#station-mode-sta)
-    - [Access Point Mode (AP)](#access-point-mode-ap)
-  - [Notes](#notes)
+- HTTP server: port 80
+- WebSocket upload server: port 81
+- UDP discovery listener: port 8134
+- WebDAV: port 80, handled by the same HTTP server
 
+Examples use `crosspoint.local`. If mDNS does not resolve on your network, use
+the IP address shown on the device screen.
 
-## Overview
+## HTTP Pages
 
-The CrossPoint Reader exposes a webserver for file management and device monitoring:
+| Method | Path | Purpose |
+|--------|------|---------|
+| `GET` | `/` | Home/status page |
+| `GET` | `/files` | File manager page |
+| `GET` | `/settings` | Web settings page |
+| `GET` | `/fonts` | SD-card font manager page |
+| `GET` | `/js/jszip.min.js` | JavaScript asset used by the file manager |
 
-- **HTTP Server**: Port 80
-- **WebSocket Server**: Port 81 (for fast binary uploads)
+## Device Status
 
----
+### `GET /api/status`
 
-## HTTP Endpoints
-
-### GET `/` - Home Page
-
-Serves the home page HTML interface.
-
-**Request:**
-```bash
-curl http://crosspoint.local/
-```
-
-**Response:** HTML page (200 OK)
-
----
-
-### GET `/files` - File Browser Page
-
-Serves the file browser HTML interface.
-
-**Request:**
-```bash
-curl http://crosspoint.local/files
-```
-
-**Response:** HTML page (200 OK)
-
----
-
-### GET `/api/status` - Device Status
-
-Returns JSON with device status information.
-
-**Request:**
 ```bash
 curl http://crosspoint.local/api/status
 ```
 
-**Response (200 OK):**
+Response:
+
 ```json
 {
   "version": "1.0.0",
@@ -74,259 +38,463 @@ curl http://crosspoint.local/api/status
   "mode": "STA",
   "rssi": -45,
   "freeHeap": 123456,
-  "uptime": 3600
+  "uptime": 3600,
+  "device": "X4"
 }
 ```
 
-| Field      | Type   | Description                                               |
-| ---------- | ------ | --------------------------------------------------------- |
-| `version`  | string | CrossPoint firmware version                               |
-| `ip`       | string | Device IP address                                         |
-| `mode`     | string | `"STA"` (connected to WiFi) or `"AP"` (access point mode) |
-| `rssi`     | number | WiFi signal strength in dBm (0 in AP mode)                |
-| `freeHeap` | number | Free heap memory in bytes                                 |
-| `uptime`   | number | Seconds since device boot                                 |
+| Field | Type | Description |
+|-------|------|-------------|
+| `version` | string | Firmware version |
+| `ip` | string | Device IP address |
+| `mode` | string | `"STA"` for joined Wi-Fi or `"AP"` for hotspot mode |
+| `rssi` | number | Wi-Fi RSSI in dBm; `0` in AP mode |
+| `freeHeap` | number | Free heap in bytes |
+| `uptime` | number | Seconds since boot |
+| `device` | string | `"X3"` or `"X4"` hardware detection |
 
----
+## File Management
 
-### GET `/api/files` - List Files
+### `GET /api/files`
 
-Returns a JSON array of files and folders in the specified directory.
+Lists files and folders under a directory.
 
-**Request:**
 ```bash
-# List root directory
-curl http://crosspoint.local/api/files
-
-# List specific directory
 curl "http://crosspoint.local/api/files?path=/Books"
 ```
 
-**Query Parameters:**
+Query parameters:
 
-| Parameter | Required | Default | Description            |
-| --------- | -------- | ------- | ---------------------- |
-| `path`    | No       | `/`     | Directory path to list |
+| Parameter | Required | Default | Description |
+|-----------|----------|---------|-------------|
+| `path` | No | `/` | Directory to list |
+
+Response:
 
-**Response (200 OK):**
 ```json
 [
-  {"name": "MyBook.epub", "size": 1234567, "isDirectory": false, "isEpub": true},
-  {"name": "Notes", "size": 0, "isDirectory": true, "isEpub": false},
-  {"name": "document.pdf", "size": 54321, "isDirectory": false, "isEpub": false}
+  {"name":"MyBook.epub","size":1234567,"isDirectory":false,"isEpub":true},
+  {"name":"Notes","size":0,"isDirectory":true,"isEpub":false}
 ]
 ```
 
-| Field         | Type    | Description                              |
-| ------------- | ------- | ---------------------------------------- |
-| `name`        | string  | File or folder name                      |
-| `size`        | number  | Size in bytes (0 for directories)        |
-| `isDirectory` | boolean | `true` if the item is a folder           |
-| `isEpub`      | boolean | `true` if the file has `.epub` extension |
+Hidden dotfiles are omitted unless the device setting `showHiddenFiles` is
+enabled. `System Volume Information` and `XTCache` are always hidden/protected.
 
-**Notes:**
-- Hidden files (starting with `.`) are automatically filtered out
-- System folders (`System Volume Information`, `XTCache`) are hidden
+### `GET /download`
 
----
+Downloads a file from the SD card.
 
-### POST `/upload` - Upload File
-
-Uploads a file to the SD card via multipart form data.
-
-**Request:**
 ```bash
-# Upload to root directory
-curl -X POST -F "file=@mybook.epub" http://crosspoint.local/upload
+curl -OJ "http://crosspoint.local/download?path=/Books/MyBook.epub"
+```
 
-# Upload to specific directory
+Query parameters:
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `path` | Yes | File path to download |
+
+Protected dotfiles, `System Volume Information`, and `XTCache` cannot be
+downloaded. EPUB files are served as `application/epub+zip`; other files use
+`application/octet-stream`.
+
+### `POST /upload`
+
+Uploads a file with HTTP multipart form data.
+
+```bash
 curl -X POST -F "file=@mybook.epub" "http://crosspoint.local/upload?path=/Books"
 ```
 
-**Query Parameters:**
+Query parameters:
 
-| Parameter | Required | Default | Description                     |
-| --------- | -------- | ------- | ------------------------------- |
-| `path`    | No       | `/`     | Target directory for the upload |
+| Parameter | Required | Default | Description |
+|-----------|----------|---------|-------------|
+| `path` | No | `/` | Destination directory |
 
-**Response (200 OK):**
-```
+Successful response:
+
+```text
 File uploaded successfully: mybook.epub
 ```
 
-**Error Responses:**
+Notes:
 
-| Status | Body                                            | Cause                       |
-| ------ | ----------------------------------------------- | --------------------------- |
-| 400    | `Failed to create file on SD card`              | Cannot create file          |
-| 400    | `Failed to write to SD card - disk may be full` | Write error during upload   |
-| 400    | `Failed to write final data to SD card`         | Error flushing final buffer |
-| 400    | `Upload aborted`                                | Client aborted the upload   |
-| 400    | `Unknown error during upload`                   | Unspecified error           |
+- Existing files with the same name are overwritten.
+- EPUB cache data for the uploaded path is cleared after a successful upload.
+- HTTP upload uses a 4 KB write buffer before flushing to the SD card.
 
-**Notes:**
-- Existing files with the same name will be overwritten
-- Uses a 4KB buffer for efficient SD card writes
+### `POST /mkdir`
 
----
+Creates a folder.
 
-### POST `/mkdir` - Create Folder
-
-Creates a new folder on the SD card.
-
-**Request:**
 ```bash
 curl -X POST -d "name=NewFolder&path=/" http://crosspoint.local/mkdir
 ```
 
-**Form Parameters:**
+Form parameters:
 
-| Parameter | Required | Default | Description                  |
-| --------- | -------- | ------- | ---------------------------- |
-| `name`    | Yes      | -       | Name of the folder to create |
-| `path`    | No       | `/`     | Parent directory path        |
+| Parameter | Required | Default | Description |
+|-----------|----------|---------|-------------|
+| `name` | Yes | - | New folder name |
+| `path` | No | `/` | Parent folder |
 
-**Response (200 OK):**
-```
-Folder created: NewFolder
-```
+### `POST /rename`
 
-**Error Responses:**
+Renames a file.
+
+```bash
+curl -X POST -d "path=/Books/old.epub&name=new.epub" http://crosspoint.local/rename
+```
+
+Form parameters:
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `path` | Yes | Existing file path |
+| `name` | Yes | New file name, not a path |
+
+Only files can be renamed through this endpoint. The old EPUB cache path is
+cleared before the rename.
+
+### `POST /move`
+
+Moves a file into an existing folder.
+
+```bash
+curl -X POST -d "path=/Books/mybook.epub&dest=/Read" http://crosspoint.local/move
+```
+
+Form parameters:
+
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `path` | Yes | Existing file path |
+| `dest` | Yes | Existing destination folder |
+
+Only files can be moved through this endpoint. The old EPUB cache path is
+cleared before the move.
+
+### `POST /delete`
+
+Deletes one or more files or empty folders.
 
-| Status | Body                          | Cause                         |
-| ------ | ----------------------------- | ----------------------------- |
-| 400    | `Missing folder name`         | `name` parameter not provided |
-| 400    | `Folder name cannot be empty` | Empty folder name             |
-| 400    | `Folder already exists`       | Folder with same name exists  |
-| 500    | `Failed to create folder`     | SD card error                 |
-
----
-
-### POST `/delete` - Delete File or Folder
-
-Deletes one or more files or empty folders from the SD card.
-
-**Request:**
 ```bash
-# Delete a file
 curl -X POST -d "path=/Books/mybook.epub" http://crosspoint.local/delete
-
-# Delete an empty folder
-curl -X POST -d "path=/OldFolder" http://crosspoint.local/delete
-
-# Delete multiple items
 curl -X POST -d 'paths=["/Books/old.epub","/OldFolder"]' http://crosspoint.local/delete
 ```
 
-**Form Parameters:**
+Form parameters:
 
-| Parameter | Required | Default | Description |
-| --------- | -------- | ------- | ----------- |
-| `path`    | Yes, unless `paths` is provided | - | Path to one item to delete |
-| `paths`   | Yes, unless `path` is provided | - | JSON array of paths to delete |
+| Parameter | Required | Description |
+|-----------|----------|-------------|
+| `path` | Yes, unless `paths` is provided | Single path to delete |
+| `paths` | Yes, unless `path` is provided | JSON array of paths to delete |
+
+Protected items cannot be deleted. Non-empty folders are rejected. EPUB cache
+data for deleted files is cleared.
+
+## Settings API
+
+### `GET /api/settings`
+
+Returns a streamed JSON array of editable settings. Each item contains common
+fields plus type-specific fields.
+
+```bash
+curl http://crosspoint.local/api/settings
+```
+
+Example item:
+
+```json
+{
+  "key": "fontSize",
+  "name": "Font Size",
+  "category": "Reader",
+  "type": "enum",
+  "value": 1,
+  "options": ["Small", "Medium", "Large"]
+}
+```
+
+Types:
+
+| Type | Extra fields |
+|------|--------------|
+| `toggle` | `value` (`0` or `1`) |
+| `enum` | `value`, `options` |
+| `value` | `value`, `min`, `max`, `step` |
+| `string` | `value` |
+
+The font-family setting includes SD-card font families when they are installed.
+
+### `POST /api/settings`
+
+Applies a partial settings update from a JSON object.
+
+```bash
+curl -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"fontSize":2,"showHiddenFiles":1}' \
+  http://crosspoint.local/api/settings
+```
+
+Successful response:
 
-**Response (200 OK):**
 ```text
-All items deleted successfully
+Applied 2 setting(s)
 ```
 
-**Error Responses:**
+## Font Management API
 
-| Status | Body                                        | Cause                              |
-| ------ | ------------------------------------------- | ---------------------------------- |
-| 400    | `Missing "path" or "paths" argument`        | Neither parameter was provided     |
-| 400    | `Provide either 'path' or 'paths', not both` | Both delete parameters were sent   |
-| 400    | `Invalid paths format`                      | `paths` was not valid JSON         |
-| 400    | `No paths provided`                         | `paths` was an empty JSON array    |
-| 500    | `Failed to delete some items: ...`          | One or more paths could not be deleted |
+### `GET /api/fonts`
 
-**Protected Items:**
-- Files/folders starting with `.`
-- `System Volume Information`
-- `XTCache`
+Lists installed SD-card font families.
 
----
-
-## WebSocket Endpoint
-
-### Port 81 - Fast Binary Upload
-
-A WebSocket endpoint for high-speed binary file uploads. More efficient than HTTP multipart for large files.
-
-**Connection:**
+```bash
+curl http://crosspoint.local/api/fonts
 ```
+
+Response:
+
+```json
+{
+  "maxFamilies": 128,
+  "families": [
+    {
+      "name": "Literata",
+      "sizes": [12, 14, 16, 18],
+      "files": [
+        {"name": "Literata_12.cpfont", "size": 123456}
+      ]
+    }
+  ]
+}
+```
+
+### `POST /api/fonts/upload`
+
+Uploads one `.cpfont` file into a family folder.
+
+```bash
+curl -X POST \
+  -F "family=Literata" \
+  -F "file=@Literata_12.cpfont" \
+  http://crosspoint.local/api/fonts/upload
+```
+
+The handler validates the family name, `.cpfont` filename, and `CPFONT` magic
+bytes before accepting the file.
+
+Successful response:
+
+```json
+{"ok":true}
+```
+
+### `POST /api/fonts/delete`
+
+Deletes an installed font family.
+
+```bash
+curl -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"family":"Literata"}' \
+  http://crosspoint.local/api/fonts/delete
+```
+
+Successful response:
+
+```json
+{"ok":true}
+```
+
+## OPDS Server API
+
+### `GET /api/opds`
+
+Lists saved OPDS servers. Passwords are never returned.
+
+```bash
+curl http://crosspoint.local/api/opds
+```
+
+Response:
+
+```json
+[
+  {
+    "index": 0,
+    "name": "My Catalog",
+    "url": "http://calibre.local:8080/opds",
+    "username": "reader",
+    "hasPassword": true
+  }
+]
+```
+
+### `POST /api/opds`
+
+Adds or updates an OPDS server. Include `index` to update an existing entry.
+If `password` is omitted during an update, the existing password is preserved.
+
+```bash
+curl -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"name":"My Catalog","url":"http://calibre.local:8080/opds","username":"reader","password":"secret"}' \
+  http://crosspoint.local/api/opds
+```
+
+### `POST /api/opds/delete`
+
+Deletes an OPDS server by index.
+
+```bash
+curl -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"index":0}' \
+  http://crosspoint.local/api/opds/delete
+```
+
+## Wi-Fi Credential API
+
+### `GET /api/wifi`
+
+Lists saved Wi-Fi networks. Passwords are never returned.
+
+```bash
+curl http://crosspoint.local/api/wifi
+```
+
+Response:
+
+```json
+[
+  {
+    "index": 0,
+    "ssid": "HomeWiFi",
+    "hasPassword": true,
+    "isLastConnected": true
+  }
+]
+```
+
+### `POST /api/wifi`
+
+Adds or updates a saved Wi-Fi network. Include `index` to update an existing
+entry. If `password` is omitted during an update, the existing password is
+preserved.
+
+```bash
+curl -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"ssid":"HomeWiFi","password":"secret"}' \
+  http://crosspoint.local/api/wifi
+```
+
+### `POST /api/wifi/delete`
+
+Deletes a saved Wi-Fi network by index.
+
+```bash
+curl -X POST \
+  -H "Content-Type: application/json" \
+  -d '{"index":0}' \
+  http://crosspoint.local/api/wifi/delete
+```
+
+## WebSocket Upload
+
+### Port 81
+
+The WebSocket path is used for fast binary uploads from the file manager and
+Calibre plugin workflows.
+
+Connection:
+
+```text
 ws://crosspoint.local:81/
 ```
 
-**Protocol:**
+Protocol:
 
-1. **Client** sends TEXT message: `START:<filename>:<size>:<path>`
-2. **Server** responds with TEXT: `READY`
-3. **Client** sends BINARY messages with file data chunks
-4. **Server** sends TEXT progress updates: `PROGRESS:<received>:<total>`
-5. **Server** sends TEXT when complete: `DONE` or `ERROR:<message>`
+1. Client sends text: `START:<filename>:<size>:<path>`
+2. Server replies `READY`
+3. Client sends binary chunks
+4. Server sends `PROGRESS:<received>:<total>` every 64 KB or at completion
+5. Server sends `DONE` when complete or `ERROR:<message>` on failure
 
-**Example Session:**
+Example session:
 
-```
-Client -> "START:mybook.epub:1234567:/Books"
-Server -> "READY"
-Client -> [binary chunk 1]
-Client -> [binary chunk 2]
-Server -> "PROGRESS:65536:1234567"
-Client -> [binary chunk 3]
+```text
+Client -> START:mybook.epub:1234567:/Books
+Server -> READY
+Client -> [binary chunk]
+Server -> PROGRESS:65536:1234567
 ...
-Server -> "PROGRESS:1234567:1234567"
-Server -> "DONE"
+Server -> DONE
 ```
 
-**Error Messages:**
+Error messages include:
 
-| Message                           | Cause                              |
-| --------------------------------- | ---------------------------------- |
-| `ERROR:Failed to create file`     | Cannot create file on SD card      |
-| `ERROR:Invalid START format`      | Malformed START message            |
-| `ERROR:No upload in progress`     | Binary data received without START |
-| `ERROR:Write failed - disk full?` | SD card write error                |
+| Message | Cause |
+|---------|-------|
+| `ERROR:Upload already in progress` | A second upload was started before the first completed |
+| `ERROR:Invalid START format` | Malformed START message or invalid size token |
+| `ERROR:Failed to create file` | Destination file could not be opened |
+| `ERROR:No upload in progress` | Binary data arrived without a matching START |
+| `ERROR:Upload overflow` | Client sent more bytes than declared |
+| `ERROR:Write failed - disk full?` | SD write failed |
 
-**Example with `websocat`:**
-```bash
-# Interactive session
-websocat ws://crosspoint.local:81
+Incomplete WebSocket uploads are deleted on disconnect or error.
 
-# Then type:
-START:mybook.epub:1234567:/Books
-# Wait for READY, then send binary data
+## WebDAV
+
+The same HTTP server registers a WebDAV-compatible handler for file manager clients.
+
+Supported methods:
+
+```text
+OPTIONS, GET, HEAD, PUT, DELETE, PROPFIND, MKCOL, MOVE, COPY, LOCK, UNLOCK
 ```
 
-**Notes:**
-- Progress updates are sent every 64KB or at completion
-- Disconnection during upload will delete the incomplete file
-- Existing files with the same name will be overwritten
+Notes:
 
----
+- `PUT` writes to a temporary `.davtmp` file first, then renames it into place.
+- Protected paths are rejected.
+- `LOCK` and `UNLOCK` are accepted for client compatibility only. The server
+  does not implement full WebDAV Class 2 locking semantics such as persistent
+  locks or lock discovery.
+
+## UDP Discovery
+
+The server listens on UDP port `8134`. When it receives the text payload
+`hello`, it replies to the sender with:
+
+```text
+crosspoint (on <hostname>);81
+```
+
+The final field is the WebSocket upload port.
 
 ## Network Modes
 
-The device can operate in two network modes:
-
 ### Station Mode (STA)
-- Device connects to an existing WiFi network
-- IP address assigned by router/DHCP
-- `mode` field in `/api/status` returns `"STA"`
-- `rssi` field shows signal strength
+
+- Device joins an existing 2.4 GHz Wi-Fi network.
+- `crosspoint.local` is advertised with mDNS when available.
+- `/api/status` returns `"mode": "STA"` and RSSI in dBm.
 
 ### Access Point Mode (AP)
-- Device creates its own WiFi hotspot
-- Default IP is typically `192.168.4.1`
-- `mode` field in `/api/status` returns `"AP"`
-- `rssi` field returns `0`
 
----
+- Device creates an open hotspot named `CrossPoint-Reader`.
+- The device shows a Wi-Fi QR code and URL QR code.
+- The fallback IP is typically `192.168.4.1`.
+- `/api/status` returns `"mode": "AP"` and `"rssi": 0`.
 
-## Notes
+### Calibre Wireless
 
-- These examples use `crosspoint.local`. If your network does not support mDNS or the address does not resolve, replace it with the specific **IP Address** displayed on your device screen (e.g., `http://192.168.1.102/`).
-- All paths on the SD card start with `/`
-- Trailing slashes are automatically stripped (except for root `/`)
-- The webserver uses chunked transfer encoding for file listings
+Calibre Wireless starts the same web server in STA mode and displays setup
+instructions plus WebSocket upload progress on the device screen.

docs/webserver.md

@@ -1,235 +1,153 @@
 # Web Server Guide
 
-This guide explains how to connect your CrossPoint Reader to WiFi and use the built-in web server to upload files from your computer or phone.
+This guide explains how to use CrossPoint Reader's built-in web server for file
+transfer, device settings, Wi-Fi/OPDS management, and SD-card font management.
 
 ## Overview
 
-CrossPoint Reader includes a built-in web server that allows you to:
+The web server is available while the device is in **File Transfer** or
+**Calibre Wireless** mode. It can:
 
-- Upload files wirelessly from any device on the same WiFi network
-- Browse and manage files on your device's SD card
-- Create folders to organize your library
-- Delete files and folders
+- Upload, download, rename, move, and delete files on the SD card
+- Create folders
+- Edit many device settings from a browser
+- Manage saved Wi-Fi networks and OPDS servers
+- Upload and delete `.cpfont` SD-card font families
+- Accept WebDAV clients and Calibre wireless uploads
 
-## Prerequisites
+The server does not require authentication. Use it only on trusted private
+networks or in hotspot mode when you control who is connected.
 
-- Your CrossPoint Reader device
-- A WiFi network
-- A computer, phone, or tablet connected to the **same WiFi network**
+## Starting File Transfer
 
----
+1. From the Home screen, select **File Transfer**.
+2. Choose one of the available modes:
 
-## Step 1: Accessing the WiFi Screen
+| Mode | Use when |
+|------|----------|
+| **Join Network** | You want the reader to join an existing Wi-Fi network. |
+| **Calibre Wireless** | You want to receive books from the CrossPoint Calibre plugin workflow. |
+| **Create Hotspot** | You want the reader to create its own open Wi-Fi network. |
 
-1. From the main menu or file browser, navigate to the **Settings** screen
-2. Select the **WiFi** option
-3. The device will automatically start scanning for available networks
+## Join Network Mode
 
----
+1. Select **Join Network**.
+2. If you have saved Wi-Fi credentials, CrossPoint first tries the last
+   connected network, then other visible saved networks in signal-strength
+   order. Press **Back** to cancel or **Confirm** to stop auto-connect and show
+   the network list.
+3. If the network list is shown, pick a 2.4 GHz Wi-Fi network from the scan
+   results.
+4. Enter the password if prompted.
+5. Save credentials if you want the reader to reconnect automatically next time.
 
-## Step 2: Connecting to WiFi
+After connection, the reader shows:
 
-### Viewing Available Networks
+- The connected SSID
+- A QR code for the web URL
+- The direct IP URL, for example `http://192.168.1.102/`
+- The mDNS fallback URL, usually `http://crosspoint.local/`
 
-Once the scan completes, you'll see a list of available WiFi networks with the following indicators:
+Use either URL from a phone, tablet, or computer on the same network.
 
-- **Signal strength bars** (`||||`, `|||`, `||`, `|`) - Shows connection quality
-- **`*` symbol** - Indicates the network is password-protected (encrypted)
-- **`+` symbol** - Indicates you have previously saved credentials for this network
+## Create Hotspot Mode
 
-<img src="./images/wifi/wifi_networks.jpeg" height="500">
+1. Select **Create Hotspot**.
+2. Connect your phone or computer to the open Wi-Fi network:
 
-### Selecting a Network
+```text
+CrossPoint-Reader
+```
 
-1. Use the **Left/Right** (or **Volume Up/Down**) buttons to navigate through the network list
-2. Press **Confirm** to select the highlighted network
+3. Open the URL shown on the reader. `http://crosspoint.local/` is preferred
+   when supported; the fallback IP is typically `http://192.168.4.1/`.
 
-### Entering Password (for encrypted networks)
+The reader displays one QR code for joining the hotspot and another QR code for
+opening the web interface.
 
-If the network requires a password:
+## Calibre Wireless Mode
 
-1. An on-screen keyboard will appear
-2. Use the navigation buttons to select characters
-3. Press **Confirm** to enter each character
-4. When complete, select the **Done** option on the keyboard
+Calibre Wireless starts the same web server in station mode, then displays setup
+instructions and upload progress on the reader. Use this mode with the
+CrossPoint Calibre plugin or other clients that speak the documented WebSocket
+upload protocol.
 
-<img src="./images/wifi/wifi_password.jpeg" height="500">
+For Calibre OPDS browsing, add `/opds` to the catalog URL when configuring an
+OPDS server.
 
-**Note:** If you've previously connected to this network, the saved password will be used automatically.
+## Web Interface
 
-### Connection Process
+The browser UI has four primary pages.
 
-The device will display "Connecting..." while establishing the connection. This typically takes 5-10 seconds.
+### Home
 
-### Saving Credentials
-
-If this is a new network, you'll be prompted to save the password:
-
-- Select **Yes** to save credentials for automatic connection next time (NOTE: These are stored in plaintext on the device's SD card. Do not use this for sensitive networks.)
-- Select **No** to connect without saving
-
----
-
-## Step 3: Connection Success
-
-Once connected, the screen will display:
-
-- **Network name** (SSID)
-- **IP Address** (e.g., `192.168.1.102`)
-- **Web server URL** (e.g., `http://192.168.1.102/`)
-
-<img src="./images/wifi/wifi_connected.jpeg" height="500">
-
-**Important:** Make note of the IP address - you'll need this to access the web interface from your computer or phone.
-
----
-
-## Step 4: Accessing the Web Interface
-
-### From a Computer
-
-1. Ensure your computer is connected to the **same WiFi network** as your CrossPoint Reader
-2. Open any web browser (Chrome is recommended)
-3. Type the IP address shown on your device into the browser's address bar
-   - Example: `http://192.168.1.102/`
-4. Press Enter
-
-### From a Phone or Tablet
-
-1. Ensure your phone/tablet is connected to the **same WiFi network** as your CrossPoint Reader
-2. Open your mobile browser (Safari, Chrome, etc.)
-3. Type the IP address into the address bar
-   - Example: `http://192.168.1.102/`
-4. Tap Go
-
----
-
-## Step 5: Using the Web Interface
-
-### Home Page
-
-The home page displays:
-
-- Device status and version information
-- WiFi connection status
-- Current IP address
-- Available memory
-
-Navigation links:
-
-- **Home** - Returns to the status page
-- **File Manager** - Access file management features
-
-<img src="./images/wifi/webserver_homepage.png" width="600">
+The Home page shows firmware status, network mode, IP address, device type,
+uptime, and free heap.
 
 ### File Manager
 
-Click **File Manager** to access file management features.
+The File Manager page can:
 
-#### Browsing Files
+- Browse SD-card folders
+- Upload files, using WebSocket upload when available and HTTP upload as a fallback
+- Create folders
+- Download files
+- Rename files
+- Move files into existing folders
+- Delete one or more selected files or empty folders
 
-- The file manager displays all files and folders on your SD card
-- **Folders** are highlighted in yellow and indicated with a 📁 icon
-- **EPUB Files** are highlighted in green and indicated with a 📗 icon
-- **All Other Files** are not highlighted and indicated with a 📄 icon
-- Click on a folder name to navigate into it
-- Use the breadcrumb navigation at the top to go back to parent folders
+Existing files with the same name are overwritten by uploads. When EPUB files
+are overwritten, moved, renamed, or deleted through the web server, the matching
+book cache is cleared so stale metadata is not reused.
 
-<img src="./images/wifi/webserver_files.png" width="600">
+### Settings
 
-#### Uploading Files
+The Settings page exposes many firmware settings in the browser. It also has
+cards for:
 
-1. Click the **📤 Upload** button in the top-right corner
-2. Click **Choose File** and select a file from your device
-3. Click **Upload**
-4. A progress bar will show the upload status
-5. The page will automatically refresh when the upload is complete
+- Saved Wi-Fi networks
+- OPDS servers
 
-<img src="./images/wifi/webserver_upload.png" width="600">
+Passwords are accepted when adding or editing entries, but saved passwords are
+not returned by the API.
 
-#### Creating Folders
+### Fonts
 
-1. Click the **📁 New Folder** button in the top-right corner
-2. Enter a folder name (must not contain characters \" * : < > ? / \\ | and must not be . or ..)
-3. Click **Create Folder**
+The Fonts page lists installed SD-card font families and lets you upload
+`.cpfont` files. Upload files from one font family at a time. The server validates
+the font family name, filename, and `.cpfont` magic bytes before accepting the
+upload.
 
-This is useful for organizing your library by genre, author, series or file type.
+Installed fonts appear in **Settings > Reader > Font Family** after the font
+registry refreshes.
 
-#### Deleting Files and Folders
+## Command Line Use
 
-1. Click the **🗑️** (trash) icon next to any file or folder
-2. Confirm the deletion in the popup dialog
-3. Click **Delete** to permanently remove the item
+Power users can use `curl`, WebDAV clients, or WebSocket clients while the web
+server is running.
 
-**Warning:** Deletion is permanent and cannot be undone!
-
-**Note:** Folders must be empty before they can be deleted.
-
-#### Moving Files
-
-1. Click the **📂** (folder) icon next to any file
-2. Enter a folder name or select one from the dropdown
-3. Click **Move** to relocate the file
-
-**Note:** Typing in a nonexistent folder name will result in the following error: "Failed to move: Destination not found"
-
-#### Renaming Files
-
-1. Click the **✏️** (pencil) icon next to any file
-2. Enter a file name (must not contain characters \" * : < > ? / \\ | and must not be . or ..)
-3. Click **Rename** to permanently rename the file
-
----
-
-## Command Line File Management
-
-For power users, you can manage files directly from your terminal using `curl` while the device is in File Upload mode. Detailed documentation can be found [here](./webserver-endpoints.md). 
+Endpoint details are documented in [webserver-endpoints.md](./webserver-endpoints.md).
 
 ## Security Notes
 
-- The web server runs on port 80 (standard HTTP)
-- **No authentication is required** - anyone on the same network can access the interface
-- The web server is only accessible while the WiFi screen shows "Connected"
-- The web server automatically stops when you exit the WiFi screen
-- For security, only use on trusted private networks
+- The HTTP server runs on port 80.
+- The WebSocket upload server runs on port 81.
+- There is no authentication.
+- Anyone on the same network can access the web interface while it is running.
+- The server stops when you exit File Transfer or Calibre Wireless mode.
+- Hotspot mode creates an open network for connectivity fallback; disconnect when done.
 
----
+## Tips
 
-## Technical Details
-
-- **Supported WiFi:** 2.4GHz networks (802.11 b/g/n)
-- **Web Server Port:** 80 (HTTP)
-- **Maximum Upload Size:** Limited by available SD card space
-- **Browser Compatibility:** All modern browsers (Chrome, Firefox, Safari, Edge)
-
----
-
-## Tips and Best Practices
-
-1. **Organize with folders** - Create folders before uploading to keep your library organized
-2. **Check signal strength** - Stronger signals (`|||` or `||||`) provide faster, more reliable uploads
-3. **Upload multiple files** - You can select and upload multiple files at once; the manager will queue them and refresh when the batch is finished
-4. **Use descriptive names** - Name your folders clearly (e.g., "SciFi", "Mystery", "Non-Fiction")
-5. **Keep credentials saved** - Save your WiFi password for quick reconnection in the future
-6. **Exit when done** - Press **Back** to exit the WiFi screen and save battery
-
----
-
-## Exiting WiFi Mode
-
-When you're finished uploading files:
-
-1. Press the **Back** button on your CrossPoint Reader
-2. The web server will automatically stop
-3. WiFi will disconnect to conserve battery
-4. You'll return to the previous screen
-
-Your uploaded files will be immediately available in the file browser!
-
----
+1. Use **Create Hotspot** when no trusted network is available.
+2. Prefer `crosspoint.local` when available, but keep the displayed IP address as a fallback.
+3. Move closer to the router if upload progress stalls in Join Network mode.
+4. Upload custom fonts through the Fonts page or copy them to `/.fonts/` or `/fonts/` on the SD card.
+5. Exit File Transfer mode when finished to conserve battery.
 
 ## Related Documentation
 
-- [User Guide](../USER_GUIDE.md) - General device operation
-- [Troubleshooting](./troubleshooting.md) - Troubleshooting
-- [README](../README.md) - Project overview and features
+- [User Guide](../USER_GUIDE.md)
+- [Webserver Endpoints](./webserver-endpoints.md)
+- [SD Card Fonts](./sd-card-fonts.md)
+- [Troubleshooting](./troubleshooting.md)

lib/EpdFont/EpdFont.cpp

@@ -44,16 +44,17 @@ void EpdFont::getTextBounds(const char* string, const int startX, const int star
       continue;
     }
 
-    const int raiseBy = isCombining ? combiningMark::raiseAboveBase(glyph->top, glyph->height, lastBaseTop) : 0;
+    const combiningMark::Anchor anchor = combiningMark::anchorFor(cp);
+    const int raiseBy = isCombining ? combiningMark::raiseAboveBase(anchor, glyph->top, glyph->height, lastBaseTop) : 0;
 
     if (!isCombining && prevCp != 0) {
       const auto kernFP = getKerning(prevCp, cp);  // 4.4 fixed-point kern
       lastBaseX += fp4::toPixel(prevAdvanceFP + kernFP);
     }
 
-    const int glyphBaseX =
-        isCombining ? combiningMark::centerOver(lastBaseX, lastBaseLeft, lastBaseWidth, glyph->left, glyph->width)
-                    : lastBaseX;
+    const int glyphBaseX = isCombining ? combiningMark::anchorOver(anchor, lastBaseX, lastBaseLeft, lastBaseWidth,
+                                                                   glyph->left, glyph->width)
+                                       : lastBaseX;
     const int glyphBaseY = startY - raiseBy;
 
     *minX = std::min(*minX, glyphBaseX + glyph->left);
@@ -101,6 +102,9 @@ static uint8_t lookupKernClass(const EpdKernClassEntry* entries, const uint16_t
 }
 
 int8_t EpdFont::getKerning(const uint32_t leftCp, const uint32_t rightCp) const {
+  if (utf8IsCjkBreakable(leftCp) || utf8IsCjkBreakable(rightCp)) {
+    return 0;
+  }
   if (!data->kernMatrix) {
     return 0;
   }

lib/EpdFont/EpdFontData.h

@@ -36,24 +36,71 @@ namespace combiningMark {
 
 constexpr int MIN_GAP_PX = 1;
 
-/// Compute the cursor-X at which to render a combining mark so its bitmap
-/// is visually centered over the base glyph's bitmap.
-constexpr int centerOver(int baseCursorPos, int baseLeft, int baseWidth, int markLeft, int markWidth) {
-  return baseCursorPos + baseLeft + baseWidth / 2 - markWidth / 2 - markLeft;
+/// Placement of a mark relative to its base glyph.  The default heuristic —
+/// centered over the base, raised clear of its top — suits Latin diacritics
+/// and Arabic harakat, but misplaces the Hebrew niqqud whose identity depends
+/// on position: dagesh sits inside the letter body, the shin/sin dots
+/// distinguish the letter by sitting over its right/left arm, and holam hangs
+/// over the left corner.  "Native" anchors keep the glyph's font-designed
+/// height (which may overlap the base) instead of raising it.
+enum class Anchor : uint8_t {
+  CenterRaised,  ///< centered over the base, lifted above its top (default)
+  CenterNative,  ///< centered over the base at font-native height
+  RightNative,   ///< right edges aligned, font-native height
+  LeftNative,    ///< left edges aligned, font-native height
+};
+
+constexpr Anchor anchorFor(const uint32_t cp) {
+  switch (cp) {
+    case 0x05BC:  // dagesh / mapiq / shuruk dot: inside the letter body
+    case 0x05BA:  // holam haser for vav: straight above the vav stem
+      return Anchor::CenterNative;
+    case 0x05C1:  // shin dot: over the letter's right arm
+      return Anchor::RightNative;
+    case 0x05B9:  // holam: above the letter's left corner
+    case 0x05C2:  // sin dot: over the letter's left arm
+      return Anchor::LeftNative;
+    default:
+      return Anchor::CenterRaised;
+  }
 }
 
-/// Rotated-90CW variant of centerOver.  In the rotated coordinate system
+/// Horizontal offset from the base bitmap's left edge to the mark bitmap's
+/// left edge for a given anchor.
+constexpr int anchorShift(const Anchor anchor, const int baseWidth, const int markWidth) {
+  switch (anchor) {
+    case Anchor::LeftNative:
+      return 0;
+    case Anchor::RightNative:
+      return baseWidth - markWidth;
+    default:
+      return baseWidth / 2 - markWidth / 2;
+  }
+}
+
+/// Compute the cursor-X at which to render a combining mark so its bitmap
+/// lands at its anchor position over the base glyph's bitmap.
+constexpr int anchorOver(const Anchor anchor, const int baseCursorPos, const int baseLeft, const int baseWidth,
+                         const int markLeft, const int markWidth) {
+  return baseCursorPos + baseLeft + anchorShift(anchor, baseWidth, markWidth) - markLeft;
+}
+
+/// Rotated-90CW variant of anchorOver.  In the rotated coordinate system
 /// renderCharImpl uses (cursorY - left) instead of (cursorX + left), so
 /// every left/width term inverts sign.
-constexpr int centerOverRotated90CW(int baseCursorPos, int baseLeft, int baseWidth, int markLeft, int markWidth) {
-  return baseCursorPos - baseLeft - baseWidth / 2 + markWidth / 2 + markLeft;
+constexpr int anchorOverRotated90CW(const Anchor anchor, const int baseCursorPos, const int baseLeft,
+                                    const int baseWidth, const int markLeft, const int markWidth) {
+  return baseCursorPos - baseLeft - anchorShift(anchor, baseWidth, markWidth) + markLeft;
 }
 
 /// For combining marks that sit entirely above the baseline, compute how many
 /// pixels to raise the mark so there is at least MIN_GAP_PX between its bottom
 /// edge and the top of the base glyph.  Returns 0 for marks that extend to or
-/// below the baseline (e.g. cedilla, dot-below, ogonek).
-constexpr int raiseAboveBase(int markTop, int markHeight, int baseTop) {
+/// below the baseline (e.g. cedilla, dot-below, ogonek) and for anchors that
+/// keep the font-native height (dagesh must stay inside the letter, the
+/// shin/sin dots touch its arms).
+constexpr int raiseAboveBase(const Anchor anchor, const int markTop, const int markHeight, const int baseTop) {
+  if (anchor != Anchor::CenterRaised) return 0;
   if (markTop - markHeight <= 0) return 0;
   const int gap = markTop - markHeight - baseTop;
   return (gap < MIN_GAP_PX) ? (MIN_GAP_PX - gap) : 0;
@@ -61,6 +108,20 @@ constexpr int raiseAboveBase(int markTop, int markHeight, int baseTop) {
 
 }  // namespace combiningMark
 
+/// GCC/Clang (the ESP32 firmware toolchain) pack structs with __attribute__((packed)).
+/// MSVC (host unit tests) has no equivalent attribute and instead needs a #pragma pack
+/// region achieving the same 1-byte alignment. These macros keep the on-disk font layout
+/// identical across both toolchains.
+#if defined(_MSC_VER)
+#define EPD_PACKED_BEGIN __pragma(pack(push, 1))
+#define EPD_PACKED_END __pragma(pack(pop))
+#define EPD_PACKED_ATTR
+#else
+#define EPD_PACKED_BEGIN
+#define EPD_PACKED_END
+#define EPD_PACKED_ATTR __attribute__((packed))
+#endif
+
 /// Fixed-point conventions used by EpdGlyph and EpdFontData:
 ///   advanceX:   12.4 unsigned fixed-point in uint16_t  (use fp4::toPixel)
 ///   kernMatrix:  4.4 signed fixed-point in int8_t      (use fp4::toPixel)
@@ -95,17 +156,21 @@ typedef struct {
 
 /// Maps a codepoint to a kerning class ID, sorted by codepoint for binary search.
 /// Class IDs are 1-based; codepoints not in the table have implicit class 0 (no kerning).
+EPD_PACKED_BEGIN
 typedef struct {
   uint16_t codepoint;  ///< Unicode codepoint
   uint8_t classId;     ///< 1-based kerning class ID
-} __attribute__((packed)) EpdKernClassEntry;
+} EPD_PACKED_ATTR EpdKernClassEntry;
+EPD_PACKED_END
 
 /// Ligature substitution for a specific glyph pair, sorted by `pair` for binary search.
 /// `pair` encodes (leftCodepoint << 16 | rightCodepoint) for single-key lookup.
+EPD_PACKED_BEGIN
 typedef struct {
   uint32_t pair;        ///< Packed codepoint pair (left << 16 | right)
   uint32_t ligatureCp;  ///< Codepoint of the replacement ligature glyph
-} __attribute__((packed)) EpdLigaturePair;
+} EPD_PACKED_ATTR EpdLigaturePair;
+EPD_PACKED_END
 
 /// Data stored for FONT AS A WHOLE
 typedef struct {

lib/EpdFont/EpdFontFamily.cpp

@@ -1,7 +1,7 @@
 #include "EpdFontFamily.h"
 
 const EpdFont* EpdFontFamily::getFont(const Style style) const {
-  // Extract font style bits (ignore UNDERLINE bit for font selection)
+  // Extract font style bits; render-time overlay bits do not affect font selection.
   const bool hasBold = (style & BOLD) != 0;
   const bool hasItalic = (style & ITALIC) != 0;
 

lib/EpdFont/EpdFontFamily.h

@@ -3,7 +3,21 @@
 
 class EpdFontFamily {
  public:
-  enum Style : uint8_t { REGULAR = 0, BOLD = 1, ITALIC = 2, BOLD_ITALIC = 3, UNDERLINE = 4 };
+  // Bitmask of text style flags carried per-word through layout and serialized in page cache.
+  // Bits 0-1 select the font variant (BOLD/ITALIC); bits 2-5 are decoration/positioning overlays
+  // applied at render time without changing the underlying font. getFont() ignores all bits
+  // above bit 1 so decorations compose freely with bold/italic (e.g. BOLD | UNDERLINE | SUP).
+  enum Style : uint8_t {
+    REGULAR = 0,
+    BOLD = 1,
+    ITALIC = 2,
+    BOLD_ITALIC = 3,
+    UNDERLINE = 4,      // drawn as a line below baseline by TextBlock::render()
+    STRIKETHROUGH = 8,  // drawn as a line through midline by TextBlock::render()
+    SUP = 16,           // superscript: glyph scaled 50%, raised ~40% of ascender
+    SUB = 32,           // subscript: glyph scaled 50%, lowered ~25% of ascender
+  };
+  static constexpr uint8_t TEXT_DECORATION_MASK = static_cast<uint8_t>(UNDERLINE | STRIKETHROUGH);
 
   explicit EpdFontFamily(const EpdFont* regular, const EpdFont* bold = nullptr, const EpdFont* italic = nullptr,
                          const EpdFont* boldItalic = nullptr)
@@ -14,6 +28,9 @@ class EpdFontFamily {
   const EpdGlyph* getGlyph(uint32_t cp, Style style = REGULAR) const;
   int8_t getKerning(uint32_t leftCp, uint32_t rightCp, Style style = REGULAR) const;
   uint32_t applyLigatures(uint32_t cp, const char*& text, Style style = REGULAR) const;
+  static constexpr bool hasTextDecoration(const Style style) {
+    return (static_cast<uint8_t>(style) & TEXT_DECORATION_MASK) != 0;
+  }
 
  private:
   const EpdFont* regular;

lib/EpdFont/FontDecompressor.cpp

@@ -33,12 +33,24 @@ void FontDecompressor::freePageBuffer() {
 }
 
 void FontDecompressor::freeHotGroup() {
-  hotGroup.clear();
-  hotGroup.shrink_to_fit();
+  free(hotGroup);
+  hotGroup = nullptr;
+  hotGroupCapacity = 0;
   hotGroupFont = nullptr;
   hotGroupIndex = UINT16_MAX;
-  hotGlyphBuf.clear();
-  hotGlyphBuf.shrink_to_fit();
+  free(hotGlyphBuf);
+  hotGlyphBuf = nullptr;
+  hotGlyphBufCapacity = 0;
+}
+
+bool FontDecompressor::ensureCapacity(uint8_t*& buf, uint32_t& capacity, uint32_t needed) {
+  if (capacity >= needed) return true;
+  // Grow-only, free-then-malloc: every caller fully rewrites the buffer after a grow, so the
+  // old contents are dead -- freeing first gives the allocator its best shot on a tight heap.
+  free(buf);
+  buf = static_cast<uint8_t*>(malloc(needed));  // owned by FontDecompressor, freed in freeHotGroup()
+  capacity = buf ? needed : 0;
+  return buf != nullptr;
 }
 
 uint16_t FontDecompressor::getGroupIndex(const EpdFontData* fontData, uint32_t glyphIndex) {
@@ -170,24 +182,20 @@ const uint8_t* FontDecompressor::getBitmap(const EpdFontData* fontData, const Ep
   }
 
   // Check if hot group already has this group decompressed — if not, decompress it
-  if (!(!hotGroup.empty() && hotGroupFont == fontData && hotGroupIndex == groupIndex)) {
+  if (!(hotGroup != nullptr && hotGroupFont == fontData && hotGroupIndex == groupIndex)) {
     stats.cacheMisses++;
     const EpdFontGroup& group = fontData->groups[groupIndex];
 
-    hotGroup.resize(group.uncompressedSize);
-    if (hotGroup.empty()) {
+    // ensureCapacity may free the buffer, so the cached-group identity dies with it either way.
+    hotGroupFont = nullptr;
+    hotGroupIndex = UINT16_MAX;
+    if (!ensureCapacity(hotGroup, hotGroupCapacity, group.uncompressedSize)) {
       LOG_ERR("FDC", "Failed to allocate %u bytes for hot group %u", group.uncompressedSize, groupIndex);
-      hotGroupFont = nullptr;
-      hotGroupIndex = UINT16_MAX;
       stats.getBitmapTimeUs += micros() - tStart;
       return nullptr;
     }
 
-    if (!decompressGroup(fontData, groupIndex, hotGroup.data(), group.uncompressedSize)) {
-      hotGroup.clear();
-      hotGroup.shrink_to_fit();
-      hotGroupFont = nullptr;
-      hotGroupIndex = UINT16_MAX;
+    if (!decompressGroup(fontData, groupIndex, hotGroup, group.uncompressedSize)) {
       stats.getBitmapTimeUs += micros() - tStart;
       return nullptr;
     }
@@ -200,18 +208,16 @@ const uint8_t* FontDecompressor::getBitmap(const EpdFontData* fontData, const Ep
   }
 
   // Compact just the requested glyph from byte-aligned data into scratch buffer
-  if (glyph->dataLength > hotGlyphBuf.size()) {
-    hotGlyphBuf.resize(glyph->dataLength);
-  }
-  if (hotGlyphBuf.empty()) {
+  if (!ensureCapacity(hotGlyphBuf, hotGlyphBufCapacity, glyph->dataLength)) {
+    LOG_ERR("FDC", "Failed to allocate %u bytes for glyph scratch", (unsigned)glyph->dataLength);
     stats.getBitmapTimeUs += micros() - tStart;
     return nullptr;
   }
 
   uint32_t alignedOff = getAlignedOffset(fontData, groupIndex, glyphIndex);
-  compactSingleGlyph(&hotGroup[alignedOff], hotGlyphBuf.data(), glyph->width, glyph->height);
+  compactSingleGlyph(&hotGroup[alignedOff], hotGlyphBuf, glyph->width, glyph->height);
   stats.getBitmapTimeUs += micros() - tStart;
-  return hotGlyphBuf.data();
+  return hotGlyphBuf;
 }
 
 // --- Prewarm: pre-decompress glyph bitmaps for a page of text ---
@@ -363,6 +369,11 @@ int FontDecompressor::prewarmCache(const EpdFontData* fontData, const char* utf8
   }
   stats.pageBufferBytes += totalBytes;
   stats.pageGlyphsBytes += glyphCount * sizeof(PageGlyphEntry);
+  // MEMFIX-PORT: page-slot address landmark for the heap map; portable
+  // Landmark for the heap block map: page slots are the largest flash-font
+  // allocations and otherwise show up as anonymous ~4-20 KB used blocks.
+  LOG_DBG("FDC", "page slot buffer=%p bytes=%u glyphs=%u", static_cast<void*>(slot.buffer), (unsigned)totalBytes,
+          (unsigned)glyphCount);
 
   slot.fontData = fontData;
   slot.glyphCount = glyphCount;

lib/EpdFont/FontDecompressor.h

@@ -2,8 +2,6 @@
 
 #include <InflateReader.h>
 
-#include <vector>
-
 #include "EpdFontData.h"
 
 class FontDecompressor {
@@ -67,13 +65,22 @@ class FontDecompressor {
 
   // Hot group: last decompressed group (byte-aligned) for non-prewarmed fallback path.
   // Kept in byte-aligned format; individual glyphs are compacted on demand into hotGlyphBuf.
+  // Nothrow high-water malloc buffers, NOT std::vector: getBitmap() runs on the render path,
+  // and under -fno-exceptions a vector resize that hits OOM abort()s the firmware instead of
+  // failing (field crash: hotGroup.resize() -> std::bad_alloc -> abort with ~11 KB free).
+  // ensureCapacity() returns false on OOM so the caller can skip the glyph gracefully.
   const EpdFontData* hotGroupFont = nullptr;
   uint16_t hotGroupIndex = UINT16_MAX;
-  std::vector<uint8_t> hotGroup;
+  uint8_t* hotGroup = nullptr;  // owned; freed in freeHotGroup()/dtor
+  uint32_t hotGroupCapacity = 0;
 
   // Scratch buffer for compacting a single glyph from the hot group.
-  // Valid until the next getBitmap() call.
-  std::vector<uint8_t> hotGlyphBuf;
+  // Valid until the next getBitmap() call. Same ownership/OOM contract as hotGroup.
+  uint8_t* hotGlyphBuf = nullptr;
+  uint32_t hotGlyphBufCapacity = 0;
+
+  // Grow (never shrink) an owned buffer to at least `needed` bytes; false on OOM, buffer freed.
+  static bool ensureCapacity(uint8_t*& buf, uint32_t& capacity, uint32_t needed);
 
   void freePageBuffer();
   void freeHotGroup();

lib/EpdFont/SdCardFont.cpp

@@ -68,6 +68,22 @@ bool collectUniqueCodepoints(const char* text, uint32_t* codepoints, uint32_t& c
 const char* asCStr(const std::string& s) { return s.c_str(); }
 const char* asCStr(const char* s) { return s; }
 
+// Keep-if-fits buffer reuse: only reallocate when the needed size exceeds the
+// current capacity. Freeing + reallocating slightly different sizes every page
+// turn punches non-coalescing holes in the heap (the freed block rarely fits the
+// next page's need), eroding the largest contiguous block all session. With
+// reuse, capacities converge on the book's max page after a few turns and page
+// turns stop touching the allocator. Only three small instantiations exist
+// (interval/glyph/byte arrays), so template bloat is negligible.
+template <typename T, typename CapT>
+bool ensureArrayCapacity(T*& buf, CapT& capacity, const uint32_t needed) {
+  if (buf && capacity >= needed) return true;
+  delete[] buf;
+  buf = new (std::nothrow) T[needed > 0 ? needed : 1];
+  capacity = buf ? static_cast<CapT>(needed) : 0;
+  return buf != nullptr;
+}
+
 }  // namespace
 
 SdCardFont::~SdCardFont() { freeAll(); }
@@ -83,6 +99,9 @@ void SdCardFont::freeStyleMiniData(PerStyle& s) {
   s.miniBitmap = nullptr;
   s.miniIntervalCount = 0;
   s.miniGlyphCount = 0;
+  s.miniIntervalCapacity = 0;
+  s.miniGlyphCapacity = 0;
+  s.miniBitmapCapacity = 0;
   freeStyleMiniKern(s);
   memset(&s.miniData, 0, sizeof(s.miniData));
   s.epdFont.data = &s.stubData;
@@ -109,12 +128,18 @@ void SdCardFont::freeStyleMiniKern(PerStyle& s) {
   s.miniKernRightEntryCount = 0;
   s.miniKernLeftClassCount = 0;
   s.miniKernRightClassCount = 0;
+  s.miniKernLeftCapacity = 0;
+  s.miniKernRightCapacity = 0;
+  s.miniKernMatrixCapacity = 0;
 }
 
 void SdCardFont::freeStyleAll(PerStyle& s) {
   freeStyleMiniData(s);
   delete[] s.fullIntervals;
   s.fullIntervals = nullptr;
+  delete[] s.bmpIntervals;
+  s.bmpIntervals = nullptr;
+  s.intervalsAreBmp16 = false;
   freeStyleKernLigatureData(s);
   s.present = false;
 }
@@ -168,7 +193,7 @@ bool SdCardFont::loadStyleKernLigatureData(PerStyle& s) {
     return true;
   }
 
-  FsFile file;
+  HalFile file;
   if (!Storage.openFileForRead("SDCF", filePath_, file)) {
     LOG_ERR("SDCF", "Failed to open .cpfont for kern/lig: %s", filePath_);
     return false;
@@ -308,13 +333,13 @@ bool SdCardFont::buildMiniKernMatrix(PerStyle& s, const uint32_t* codepoints, ui
     if (miniLookupKernClass(s.kernRightClasses, s.header.kernRightEntryCount, codepoints[i]) != 0) miniRightCount++;
   }
 
-  // Step 4: allocate the three mini buffers. The matrix is <1KB in practice
-  // (<30 × <30 × 1 byte) so fragmentation is a non-issue.
+  // Step 4: size the three mini buffers (reused across pages when they fit; the
+  // per-page sizes vary by a few entries, which as free+realloc churn was punching
+  // non-coalescing holes in the heap every page turn).
   const uint32_t matrixBytes = static_cast<uint32_t>(numLeft) * numRight;
-  s.miniKernLeftClasses = new (std::nothrow) EpdKernClassEntry[miniLeftCount];
-  s.miniKernRightClasses = new (std::nothrow) EpdKernClassEntry[miniRightCount];
-  s.miniKernMatrix = new (std::nothrow) int8_t[matrixBytes];
-  if (!s.miniKernLeftClasses || !s.miniKernRightClasses || !s.miniKernMatrix) {
+  if (!ensureArrayCapacity(s.miniKernLeftClasses, s.miniKernLeftCapacity, miniLeftCount) ||
+      !ensureArrayCapacity(s.miniKernRightClasses, s.miniKernRightCapacity, miniRightCount) ||
+      !ensureArrayCapacity(s.miniKernMatrix, s.miniKernMatrixCapacity, matrixBytes)) {
     LOG_ERR("SDCF", "Failed to allocate mini kern (%u+%u+%u bytes)", miniLeftCount * 3u, miniRightCount * 3u,
             matrixBytes);
     freeStyleMiniKern(s);
@@ -345,7 +370,7 @@ bool SdCardFont::buildMiniKernMatrix(PerStyle& s, const uint32_t* codepoints, ui
   // Step 6: read the full matrix's rows for each used left class, keep only
   // columns for used right classes. One SD seek + one read per used left class;
   // a row is kernRightClassCount bytes (~200 for Literata).
-  FsFile file;
+  HalFile file;
   if (!Storage.openFileForRead("SDCF", filePath_, file)) {
     LOG_ERR("SDCF", "Failed to open .cpfont for mini kern: %s", filePath_);
     freeStyleMiniKern(s);
@@ -425,7 +450,7 @@ bool SdCardFont::load(const char* path) {
   strncpy(filePath_, path, sizeof(filePath_) - 1);
   filePath_[sizeof(filePath_) - 1] = '\0';
 
-  FsFile file;
+  HalFile file;
   if (!Storage.openFileForRead("SDCF", path, file)) {
     LOG_ERR("SDCF", "Failed to open .cpfont: %s", path);
     return false;
@@ -516,59 +541,94 @@ bool SdCardFont::load(const char* path) {
   styleCount_ = styleCount;
   contentHash_ = hash;
 
-  // Load full intervals into RAM for each present style
+  // Load full intervals into RAM for each present style. BMP-only fonts with
+  // fewer than 65536 glyphs use a compact 6-byte interval table instead of the
+  // on-disk 12-byte table; large sparse CJK subsets otherwise keep tens of KB
+  // of always-resident heap just for lookup metadata.
   for (uint8_t i = 0; i < MAX_STYLES; i++) {
     auto& s = styles_[i];
     if (!s.present) continue;
 
-    s.fullIntervals = new (std::nothrow) EpdUnicodeInterval[s.header.intervalCount];
-    if (!s.fullIntervals) {
-      LOG_ERR("SDCF", "Failed to allocate %u intervals for style %u", s.header.intervalCount, i);
-      freeAll();
-      return false;
-    }
-
     if (!file.seekSet(s.intervalsFileOffset)) {
       LOG_ERR("SDCF", "Failed to seek to intervals for style %u", i);
       freeAll();
       return false;
     }
-    size_t intervalsBytes = s.header.intervalCount * sizeof(EpdUnicodeInterval);
-    if (file.read(reinterpret_cast<uint8_t*>(s.fullIntervals), intervalsBytes) != static_cast<int>(intervalsBytes)) {
-      LOG_ERR("SDCF", "Failed to read intervals for style %u", i);
-      freeAll();
-      return false;
-    }
 
     // Validate interval contents before any later code (findGlobalGlyphIndex,
     // glyph reads) trusts them. A malformed file could otherwise drive
     // out-of-range glyph indices into bogus on-disk reads.
-    {
-      uint32_t expectedOffset = 0;
-      uint32_t prevLast = 0;
+    bool canUseBmp16 = s.header.glyphCount <= UINT16_MAX;
+    uint32_t expectedOffset = 0;
+    uint32_t prevLast = 0;
+    EpdUnicodeInterval iv{};
+    for (uint32_t j = 0; j < s.header.intervalCount; ++j) {
+      if (file.read(reinterpret_cast<uint8_t*>(&iv), sizeof(iv)) != sizeof(iv)) {
+        LOG_ERR("SDCF", "Failed to read interval %u for style %u", j, i);
+        freeAll();
+        return false;
+      }
+      if (iv.first > iv.last) {
+        LOG_ERR("SDCF", "Style %u: invalid interval %u (first 0x%lX > last 0x%lX)", i, j,
+                static_cast<unsigned long>(iv.first), static_cast<unsigned long>(iv.last));
+        file.close();
+        freeAll();
+        return false;
+      }
+      const uint32_t span = iv.last - iv.first + 1;
+      const bool overlapsPrev = (j > 0 && iv.first <= prevLast);
+      const bool spanTooBig = (span > s.header.glyphCount);
+      const bool offsetMismatch = (iv.offset != expectedOffset);
+      const bool offsetOverruns = (iv.offset > s.header.glyphCount - span);
+      if (overlapsPrev || spanTooBig || offsetMismatch || offsetOverruns) {
+        LOG_ERR("SDCF", "Style %u: invalid interval layout at %u (overlap=%d span=%u offMis=%d offOver=%d)", i, j,
+                overlapsPrev, span, offsetMismatch, offsetOverruns);
+        file.close();
+        freeAll();
+        return false;
+      }
+      if (iv.first > UINT16_MAX || iv.last > UINT16_MAX || iv.offset > UINT16_MAX) {
+        canUseBmp16 = false;
+      }
+      expectedOffset += span;
+      prevLast = iv.last;
+    }
+
+    if (!file.seekSet(s.intervalsFileOffset)) {
+      LOG_ERR("SDCF", "Failed to seek back to intervals for style %u", i);
+      freeAll();
+      return false;
+    }
+
+    if (canUseBmp16) {
+      s.bmpIntervals = new (std::nothrow) PerStyle::BmpInterval16[s.header.intervalCount];
+      if (!s.bmpIntervals) {
+        LOG_ERR("SDCF", "Failed to allocate compact intervals for style %u", i);
+        freeAll();
+        return false;
+      }
       for (uint32_t j = 0; j < s.header.intervalCount; ++j) {
-        const auto& iv = s.fullIntervals[j];
-        if (iv.first > iv.last) {
-          LOG_ERR("SDCF", "Style %u: invalid interval %u (first 0x%lX > last 0x%lX)", i, j,
-                  static_cast<unsigned long>(iv.first), static_cast<unsigned long>(iv.last));
-          file.close();
+        if (file.read(reinterpret_cast<uint8_t*>(&iv), sizeof(iv)) != sizeof(iv)) {
+          LOG_ERR("SDCF", "Failed to read compact interval %u for style %u", j, i);
           freeAll();
           return false;
         }
-        const uint32_t span = iv.last - iv.first + 1;
-        const bool overlapsPrev = (j > 0 && iv.first <= prevLast);
-        const bool spanTooBig = (span > s.header.glyphCount);
-        const bool offsetMismatch = (iv.offset != expectedOffset);
-        const bool offsetOverruns = (iv.offset > s.header.glyphCount - span);
-        if (overlapsPrev || spanTooBig || offsetMismatch || offsetOverruns) {
-          LOG_ERR("SDCF", "Style %u: invalid interval layout at %u (overlap=%d span=%u offMis=%d offOver=%d)", i, j,
-                  overlapsPrev, span, offsetMismatch, offsetOverruns);
-          file.close();
-          freeAll();
-          return false;
-        }
-        expectedOffset += span;
-        prevLast = iv.last;
+        s.bmpIntervals[j] = {static_cast<uint16_t>(iv.first), static_cast<uint16_t>(iv.last),
+                             static_cast<uint16_t>(iv.offset)};
+      }
+      s.intervalsAreBmp16 = true;
+    } else {
+      s.fullIntervals = new (std::nothrow) EpdUnicodeInterval[s.header.intervalCount];
+      if (!s.fullIntervals) {
+        LOG_ERR("SDCF", "Failed to allocate %u intervals for style %u", s.header.intervalCount, i);
+        freeAll();
+        return false;
+      }
+      size_t intervalsBytes = s.header.intervalCount * sizeof(EpdUnicodeInterval);
+      if (file.read(reinterpret_cast<uint8_t*>(s.fullIntervals), intervalsBytes) != static_cast<int>(intervalsBytes)) {
+        LOG_ERR("SDCF", "Failed to read intervals for style %u", i);
+        freeAll();
+        return false;
       }
     }
 
@@ -603,13 +663,15 @@ int32_t SdCardFont::findGlobalGlyphIndex(const PerStyle& s, uint32_t codepoint)
   int right = static_cast<int>(s.header.intervalCount) - 1;
   while (left <= right) {
     int mid = left + (right - left) / 2;
-    const auto& interval = s.fullIntervals[mid];
-    if (codepoint < interval.first) {
+    const uint32_t first = s.intervalsAreBmp16 ? s.bmpIntervals[mid].first : s.fullIntervals[mid].first;
+    const uint32_t last = s.intervalsAreBmp16 ? s.bmpIntervals[mid].last : s.fullIntervals[mid].last;
+    if (codepoint < first) {
       right = mid - 1;
-    } else if (codepoint > interval.last) {
+    } else if (codepoint > last) {
       left = mid + 1;
     } else {
-      return static_cast<int32_t>(interval.offset + (codepoint - interval.first));
+      const uint32_t offset = s.intervalsAreBmp16 ? s.bmpIntervals[mid].offset : s.fullIntervals[mid].offset;
+      return static_cast<int32_t>(offset + (codepoint - first));
     }
   }
   return -1;
@@ -753,12 +815,19 @@ int SdCardFont::prewarmStyle(uint8_t styleIdx, const uint32_t* codepoints, uint3
     return missed;
   }
 
-  // Build mini intervals from sorted codepoints
-  freeStyleMiniData(s);
+  // Build mini intervals from sorted codepoints. Reset counts and fall back to the
+  // stub until the rebuild completes, but KEEP the existing buffers (keep-if-fits
+  // reuse) — the free-and-realloc-per-page pattern here was a primary fragmenter.
+  s.miniIntervalCount = 0;
+  s.miniGlyphCount = 0;
+  s.miniKernLeftEntryCount = 0;
+  s.miniKernRightEntryCount = 0;
+  s.miniKernLeftClassCount = 0;
+  s.miniKernRightClassCount = 0;
+  memset(&s.miniData, 0, sizeof(s.miniData));
+  s.epdFont.data = &s.stubData;
 
-  uint32_t intervalCapacity = validCount;
-  s.miniIntervals = new (std::nothrow) EpdUnicodeInterval[intervalCapacity];
-  if (!s.miniIntervals) {
+  if (!ensureArrayCapacity(s.miniIntervals, s.miniIntervalCapacity, validCount)) {
     LOG_ERR("SDCF", "Failed to allocate mini intervals for style %u", styleIdx);
     delete[] mappings;
     return static_cast<int>(cpCount);
@@ -776,15 +845,14 @@ int SdCardFont::prewarmStyle(uint8_t styleIdx, const uint32_t* codepoints, uint3
     }
   }
 
-  // Allocate mini glyph array
-  s.miniGlyphCount = validCount;
-  s.miniGlyphs = new (std::nothrow) EpdGlyph[s.miniGlyphCount];
-  if (!s.miniGlyphs) {
+  // Mini glyph array (reused across pages when it fits)
+  if (!ensureArrayCapacity(s.miniGlyphs, s.miniGlyphCapacity, validCount)) {
     LOG_ERR("SDCF", "Failed to allocate mini glyphs for style %u", styleIdx);
     delete[] mappings;
     freeStyleMiniData(s);
     return static_cast<int>(cpCount);
   }
+  s.miniGlyphCount = validCount;
 
   // Build sorted read order for sequential I/O
   uint32_t* readOrder = new (std::nothrow) uint32_t[validCount];
@@ -798,7 +866,7 @@ int SdCardFont::prewarmStyle(uint8_t styleIdx, const uint32_t* codepoints, uint3
   std::sort(readOrder, readOrder + validCount,
             [&](uint32_t a, uint32_t b) { return mappings[a].globalIndex < mappings[b].globalIndex; });
 
-  FsFile file;
+  HalFile file;
   if (!Storage.openFileForRead("SDCF", filePath_, file)) {
     LOG_ERR("SDCF", "Failed to reopen .cpfont for prewarm (style %u)", styleIdx);
     delete[] readOrder;
@@ -851,8 +919,7 @@ int SdCardFont::prewarmStyle(uint8_t styleIdx, const uint32_t* codepoints, uint3
       totalBitmapSize += s.miniGlyphs[i].dataLength;
     }
 
-    s.miniBitmap = new (std::nothrow) uint8_t[totalBitmapSize > 0 ? totalBitmapSize : 1];
-    if (!s.miniBitmap) {
+    if (!ensureArrayCapacity(s.miniBitmap, s.miniBitmapCapacity, totalBitmapSize)) {
       LOG_ERR("SDCF", "Failed to allocate mini bitmap (%u bytes) for style %u", totalBitmapSize, styleIdx);
       delete[] readOrder;
       delete[] mappings;
@@ -1104,7 +1171,7 @@ int SdCardFont::fetchAdvancesForCodepoints(uint32_t* codepoints, uint32_t cpCoun
               [](const CpIdx& a, const CpIdx& b) { return a.glyphIndex < b.glyphIndex; });
 
     // Open file once and read advanceX for each needed glyph.
-    FsFile file;
+    HalFile file;
     if (!Storage.openFileForRead("SDCF", filePath_, file)) {
       LOG_ERR("SDCF", "buildAdvanceTable: failed to open .cpfont for style %u", si);
       continue;
@@ -1155,7 +1222,8 @@ int SdCardFont::fetchAdvancesForCodepoints(uint32_t* codepoints, uint32_t cpCoun
 }
 
 template <typename Iter>
-int SdCardFont::buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace, bool includeHyphen, uint8_t styleMask) {
+int SdCardFont::buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace, bool includeHyphen, uint8_t styleMask,
+                                       const char* extraText) {
   if (!loaded_) return -1;
   styleMask = resolveStyleMask(styleMask);
   if (styleMask == 0) return 0;
@@ -1175,6 +1243,9 @@ int SdCardFont::buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace,
   for (auto it = begin; it != end && !hitCap; ++it) {
     hitCap = collectUniqueCodepoints(asCStr(*it), codepoints, cpCount, MAX_UNIQUE_CODEPOINTS);
   }
+  if (extraText && !hitCap) {
+    hitCap = collectUniqueCodepoints(extraText, codepoints, cpCount, MAX_UNIQUE_CODEPOINTS);
+  }
 
   if (includeSpace && std::none_of(codepoints, codepoints + cpCount, [](uint32_t c) { return c == ' '; }))
     codepoints[cpCount++] = ' ';
@@ -1192,12 +1263,13 @@ int SdCardFont::buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace,
   return totalMissed;
 }
 
-int SdCardFont::buildAdvanceTable(const char* utf8Text, uint8_t styleMask) {
-  return buildAdvanceTableRange(&utf8Text, &utf8Text + 1, false, false, styleMask);
+int SdCardFont::buildAdvanceTable(const char* utf8Text, uint8_t styleMask, const char* extraText) {
+  return buildAdvanceTableRange(&utf8Text, &utf8Text + 1, false, false, styleMask, extraText);
 }
 
-int SdCardFont::buildAdvanceTable(const std::vector<std::string>& words, bool includeHyphen, uint8_t styleMask) {
-  return buildAdvanceTableRange(words.begin(), words.end(), words.size() > 1, includeHyphen, styleMask);
+int SdCardFont::buildAdvanceTable(const std::vector<std::string>& words, bool includeHyphen, uint8_t styleMask,
+                                  const char* extraText) {
+  return buildAdvanceTableRange(words.begin(), words.end(), words.size() > 1, includeHyphen, styleMask, extraText);
 }
 
 // --- Stats ---
@@ -1257,7 +1329,7 @@ const EpdGlyph* SdCardFont::onGlyphMiss(void* ctx, uint32_t codepoint) {
 
   if (!self->loaded_ || styleIdx >= MAX_STYLES || !self->styles_[styleIdx].present) return nullptr;
   const auto& s = self->styles_[styleIdx];
-  if (!s.fullIntervals) return nullptr;
+  if (!s.fullIntervals && !s.bmpIntervals) return nullptr;
 
   // Check overflow cache first (matching both codepoint and style)
   for (uint32_t i = 0; i < self->overflowCount_; i++) {
@@ -1277,7 +1349,7 @@ const EpdGlyph* SdCardFont::onGlyphMiss(void* ctx, uint32_t codepoint) {
   bool wasAtCapacity = (self->overflowCount_ == OVERFLOW_CAPACITY);
 
   // Read glyph metadata into temporary
-  FsFile file;
+  HalFile file;
   if (!Storage.openFileForRead("SDCF", self->filePath_, file)) {
     LOG_ERR("SDCF", "Overflow: failed to open .cpfont");
     return nullptr;
@@ -1334,6 +1406,33 @@ const EpdGlyph* SdCardFont::onGlyphMiss(void* ctx, uint32_t codepoint) {
   return &self->overflow_[slot].glyph;
 }
 
+size_t SdCardFont::reportMemory() const {
+  size_t total = 0;
+  for (uint8_t si = 0; si < MAX_STYLES; ++si) {
+    const auto& s = styles_[si];
+    if (!s.present) continue;
+    size_t fixed = 0;  // loaded once per family: interval/kern/lig tables
+    if (s.fullIntervals) fixed += s.header.intervalCount * sizeof(EpdUnicodeInterval);
+    if (s.bmpIntervals) fixed += s.header.intervalCount * sizeof(PerStyle::BmpInterval16);
+    if (s.kernLeftClasses) fixed += s.header.kernLeftEntryCount * sizeof(EpdKernClassEntry);
+    if (s.kernRightClasses) fixed += s.header.kernRightEntryCount * sizeof(EpdKernClassEntry);
+    if (s.ligaturePairs) fixed += s.header.ligaturePairCount * sizeof(EpdLigaturePair);
+    // kept-if-fits mini arenas: capacity (not count) is what stays resident
+    size_t mini = s.miniIntervalCapacity * sizeof(EpdUnicodeInterval) + s.miniGlyphCapacity * sizeof(EpdGlyph) +
+                  s.miniBitmapCapacity + s.miniKernLeftCapacity * sizeof(EpdKernClassEntry) +
+                  s.miniKernRightCapacity * sizeof(EpdKernClassEntry) + s.miniKernMatrixCapacity;
+    const size_t adv = advanceTableSize_[si] * sizeof(AdvanceEntry);
+    LOG_DBG("SDCF", "mem style%u: fixed=%u mini=%u adv=%u", si, (unsigned)fixed, (unsigned)mini, (unsigned)adv);
+    total += fixed + mini + adv;
+  }
+  size_t overflowBytes = 0;
+  for (uint32_t i = 0; i < overflowCount_; ++i) {
+    if (overflow_[i].bitmap) overflowBytes += overflow_[i].glyph.dataLength;
+  }
+  total += overflowBytes + overflowCount_ * sizeof(OverflowEntry);
+  return total;
+}
+
 bool SdCardFont::isOverflowGlyph(const EpdGlyph* glyph) const {
   for (uint32_t i = 0; i < overflowCount_; i++) {
     if (&overflow_[i].glyph == glyph) return true;

lib/EpdFont/SdCardFont.h

@@ -47,9 +47,12 @@ class SdCardFont {
   // Build a compact advance-only table for layout measurement.
   // Extracts ALL unique codepoints from words (no MAX_PAGE_GLYPHS cap),
   // batch-reads advanceX from SD, stores in a sorted per-style table.
+  // extraText: optional additional codepoints to warm in the same SD pass
+  // (e.g. shaped Arabic presentation forms the measurement path will look up).
   // Returns number of codepoints not found in font coverage.
-  int buildAdvanceTable(const char* utf8Text, uint8_t styleMask = 0x0F);
-  int buildAdvanceTable(const std::vector<std::string>& words, bool includeHyphen, uint8_t styleMask = 0x0F);
+  int buildAdvanceTable(const char* utf8Text, uint8_t styleMask = 0x0F, const char* extraText = nullptr);
+  int buildAdvanceTable(const std::vector<std::string>& words, bool includeHyphen, uint8_t styleMask = 0x0F,
+                        const char* extraText = nullptr);
 
   // Look up advanceX for a codepoint from the advance table.
   // Returns the 12.4 fixed-point advance, or 0 if not found.
@@ -58,9 +61,9 @@ class SdCardFont {
   // Returns true if advance table is populated for at least one style.
   bool hasAdvanceTable() const;
 
-  // Free mini data for all styles, restore stub EpdFontData.
-  // Also clears the temporary advance table (built per layout pass) but
-  // preserves the persistent advance cache (reused across passes).
+  // Free mini data for all styles and restore stub EpdFontData.
+  // Preserves the persistent advance cache so repeated layout passes can reuse
+  // previously fetched metrics.
   void clearCache();
 
   // Drop the persistent advance cache. Call when unloading the SD font or
@@ -101,6 +104,11 @@ class SdCardFont {
     uint32_t uniqueGlyphs = 0;
     uint32_t bitmapBytes = 0;
   };
+  // MEMFIX-PORT: SD font resident-bytes audit; portable
+  // Log per-style resident heap (full tables + kept-if-fits mini arenas +
+  // advance tables + overflow bitmaps) and return the total in bytes. Pure
+  // accounting — no allocation, no state change.
+  size_t reportMemory() const;
   void logStats(const char* label = "SDCF");
   void resetStats();
   const Stats& getStats() const { return stats_; }
@@ -140,6 +148,16 @@ class SdCardFont {
 
     // Full intervals loaded from file (kept in RAM for codepoint lookup)
     EpdUnicodeInterval* fullIntervals = nullptr;
+    EPD_PACKED_BEGIN
+    struct BmpInterval16 {
+      uint16_t first;
+      uint16_t last;
+      uint16_t offset;
+    } EPD_PACKED_ATTR;
+    EPD_PACKED_END
+    static_assert(sizeof(BmpInterval16) == 6, "BmpInterval16 must remain compact");
+    BmpInterval16* bmpIntervals = nullptr;
+    bool intervalsAreBmp16 = false;
 
     // Persistent kern-class + ligature tables (lazy-loaded on first prewarm).
     // The full kern MATRIX is NOT resident — on Literata-class fonts a single
@@ -155,13 +173,22 @@ class SdCardFont {
     // Stub EpdFontData returned when not prewarmed
     EpdFontData stubData{};
 
-    // Mini EpdFontData built during prewarm
+    // Mini EpdFontData built during prewarm. Buffers are kept-if-fits across pages
+    // (capacities below track allocated sizes): freeing and reallocating slightly
+    // different sizes on every page turn was a primary heap fragmenter — each page's
+    // freed hole rarely fit the next page's need, so maxAlloc eroded all session.
+    // After a few pages the capacities converge on the book's max and page turns
+    // stop allocating entirely. freeStyleMiniData() still releases everything (and
+    // zeroes capacities) for style eviction / font unload.
     EpdFontData miniData{};
     EpdUnicodeInterval* miniIntervals = nullptr;
     EpdGlyph* miniGlyphs = nullptr;
     uint8_t* miniBitmap = nullptr;
     uint32_t miniIntervalCount = 0;
     uint32_t miniGlyphCount = 0;
+    uint32_t miniIntervalCapacity = 0;
+    uint32_t miniGlyphCapacity = 0;
+    uint32_t miniBitmapCapacity = 0;
 
     // Per-page mini kern matrix (built by buildMiniKernMatrix on each full
     // prewarm). miniKernLeftClasses/miniKernRightClasses map ONLY the codepoints
@@ -176,6 +203,10 @@ class SdCardFont {
     uint8_t miniKernLeftClassCount = 0;
     uint8_t miniKernRightClassCount = 0;
     int8_t* miniKernMatrix = nullptr;
+    // Kept-if-fits capacities, same rationale as the mini glyph buffers above.
+    uint16_t miniKernLeftCapacity = 0;
+    uint16_t miniKernRightCapacity = 0;
+    uint32_t miniKernMatrixCapacity = 0;
 
     // The EpdFont whose data pointer we manage
     EpdFont epdFont{&stubData};
@@ -241,7 +272,8 @@ class SdCardFont {
   int32_t findGlobalGlyphIndex(const PerStyle& s, uint32_t codepoint) const;
   int fetchAdvancesForCodepoints(uint32_t* codepoints, uint32_t cpCount, uint8_t styleMask);
   template <typename Iter>
-  int buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace, bool includeHyphen, uint8_t styleMask);
+  int buildAdvanceTableRange(Iter begin, Iter end, bool includeSpace, bool includeHyphen, uint8_t styleMask,
+                             const char* extraText = nullptr);
   int prewarmStyle(uint8_t styleIdx, const uint32_t* codepoints, uint32_t cpCount, bool metadataOnly);
 
   // Global helpers

lib/EpdFont/SdCardFontManager.cpp

@@ -34,19 +34,15 @@ bool SdCardFontManager::loadFamily(const SdCardFontFamilyInfo& family, GfxRender
     unloadAll(renderer);
   }
 
-  // Select by ordinal position: sort available sizes, then map the font size
-  // enum (SMALL=0 .. EXTRA_LARGE=3) to the corresponding slot. When the
-  // family has fewer sizes than 4, clamp to the last available size.
-  auto sizes = family.availableSizes();
-  if (sizes.empty()) {
+  // Select the physical point size closest to the built-in reader sizes. Some
+  // CJK font packs only ship larger sizes, so ordinal selection can make
+  // MEDIUM load 18pt+ and produce oversized pages on small devices.
+  const SdCardFontFileInfo* selected = family.findClosestReaderSize(fontSizeEnum);
+  if (!selected) {
     LOG_ERR("SDMGR", "Family %s has no files to load", family.name.c_str());
     return false;
   }
 
-  uint8_t idx = fontSizeEnum;
-  if (idx >= sizes.size()) idx = sizes.size() - 1;
-  const SdCardFontFileInfo* selected = family.findFile(sizes[idx]);
-
   auto* font = new (std::nothrow) SdCardFont();
   if (!font) {
     LOG_ERR("SDMGR", "Failed to allocate SdCardFont for %s", selected->path.c_str());
@@ -92,6 +88,14 @@ void SdCardFontManager::unloadAll(GfxRenderer& renderer) {
   loadedPointSize_ = 0;
 }
 
+size_t SdCardFontManager::reportMemory() const {
+  size_t total = 0;
+  for (const auto& lf : loaded_) {
+    if (lf.font) total += lf.font->reportMemory();
+  }
+  return total;
+}
+
 int SdCardFontManager::getFontId(const std::string& familyName) const {
   if (familyName != loadedFamilyName_ || loaded_.empty()) return 0;
   return loaded_.front().fontId;

lib/EpdFont/SdCardFontManager.h

@@ -15,10 +15,10 @@ class SdCardFontManager {
   SdCardFontManager(const SdCardFontManager&) = delete;
   SdCardFontManager& operator=(const SdCardFontManager&) = delete;
 
-  // Load the font file matching fontSizeEnum (SMALL=0 .. EXTRA_LARGE=3) by
-  // ordinal position in the family's sorted size list. Only one .cpfont file
-  // is loaded; other sizes remain on disk. This keeps resident interval +
-  // kern/ligature tables to one size's worth of memory.
+  // Load the font file whose physical point size is closest to the reader
+  // fontSizeEnum (SMALL=12, MEDIUM=14, LARGE=16, EXTRA_LARGE=18). Only one
+  // .cpfont file is loaded; other sizes remain on disk. This keeps resident
+  // interval + kern/ligature tables to one size's worth of memory.
   // Returns true on success.
   bool loadFamily(const SdCardFontFamilyInfo& family, GfxRenderer& renderer, uint8_t fontSizeEnum);
 
@@ -32,7 +32,11 @@ class SdCardFontManager {
   // Get name of currently loaded family (empty if none).
   const std::string& currentFamilyName() const { return loadedFamilyName_; };
 
-  // Point size that was actually loaded (closest match to targetPtSize).
+  // MEMFIX-PORT: font manager audit passthrough; portable
+  // Sum of loaded fonts' resident heap (see SdCardFont::reportMemory).
+  size_t reportMemory() const;
+
+  // Point size that was actually loaded.
   // 0 if nothing loaded.
   uint8_t currentPointSize() const { return loadedPointSize_; };
 

lib/EpdFont/SdCardFontRegistry.cpp

@@ -15,6 +15,60 @@ const SdCardFontFileInfo* SdCardFontFamilyInfo::findFile(uint8_t size, uint8_t s
   return nullptr;
 }
 
+const SdCardFontFileInfo* SdCardFontFamilyInfo::findClosestReaderSize(const uint8_t fontSizeEnum,
+                                                                      const uint8_t style) const {
+  if (files.empty()) return nullptr;
+
+  // Collect sizes matching the requested style, sorted ascending.
+  std::vector<uint8_t> sizes;
+  for (const auto& f : files) {
+    if (f.style != style) continue;
+    sizes.push_back(f.pointSize);
+  }
+  if (sizes.empty()) return nullptr;
+  std::sort(sizes.begin(), sizes.end());
+
+  // When the family provides at least 4 sizes, use ordinal (index-based)
+  // selection so custom-built font sets (e.g. 10/12/14/16) map SMALL to
+  // the smallest file, not to a hardcoded 12pt target.
+  if (sizes.size() >= 4) {
+    uint8_t idx = fontSizeEnum;
+    if (idx >= sizes.size()) idx = sizes.size() - 1;
+    return findFile(sizes[idx], style);
+  }
+
+  // Fewer sizes than enum slots (e.g. CJK packs with only 2-3 sizes):
+  // fall back to closest-match against the built-in reader targets.
+  uint8_t target = 14;
+  switch (fontSizeEnum) {
+    case 0:
+      target = 12;
+      break;
+    case 2:
+      target = 16;
+      break;
+    case 3:
+      target = 18;
+      break;
+    case 1:
+    default:
+      target = 14;
+      break;
+  }
+
+  const SdCardFontFileInfo* best = nullptr;
+  uint8_t bestDelta = 255;
+  for (const auto& f : files) {
+    if (f.style != style) continue;
+    const uint8_t delta = f.pointSize > target ? f.pointSize - target : target - f.pointSize;
+    if (!best || delta < bestDelta || (delta == bestDelta && f.pointSize < best->pointSize)) {
+      best = &f;
+      bestDelta = delta;
+    }
+  }
+  return best;
+}
+
 bool SdCardFontFamilyInfo::hasSize(uint8_t size) const {
   for (const auto& f : files) {
     if (f.pointSize == size) return true;
@@ -77,12 +131,12 @@ bool SdCardFontRegistry::parseFilename(const char* filename, uint8_t& size, uint
 }
 
 void SdCardFontRegistry::scanDirectory(const char* dirPath, SdCardFontFamilyInfo& family) {
-  FsFile dir = Storage.open(dirPath);
+  HalFile dir = Storage.open(dirPath);
   if (!dir || !dir.isDirectory()) return;
 
   char nameBuffer[128];
   while (true) {
-    FsFile entry = dir.openNextFile();
+    HalFile entry = dir.openNextFile();
     if (!entry) break;
     if (entry.isDirectory()) {
       entry.close();
@@ -126,7 +180,7 @@ void SdCardFontRegistry::scanDirectory(const char* dirPath, SdCardFontFamilyInfo
 // Skips families whose names already exist in `out` (de-duplicates between
 // the hidden and visible roots — first scan wins).
 void SdCardFontRegistry::scanRoot(const char* rootPath, std::vector<SdCardFontFamilyInfo>& out) {
-  FsFile root = Storage.open(rootPath);
+  HalFile root = Storage.open(rootPath);
   if (!root) {
     LOG_DBG("SDREG", "Fonts directory not found: %s", rootPath);
     return;
@@ -138,7 +192,7 @@ void SdCardFontRegistry::scanRoot(const char* rootPath, std::vector<SdCardFontFa
 
   char nameBuffer[128];
   while (true) {
-    FsFile entry = root.openNextFile();
+    HalFile entry = root.openNextFile();
     if (!entry) break;
     if (entry.isDirectory()) {
       entry.getName(nameBuffer, sizeof(nameBuffer));

lib/EpdFont/SdCardFontRegistry.h

@@ -18,6 +18,7 @@ struct SdCardFontFamilyInfo {
   std::vector<SdCardFontFileInfo> files;
 
   const SdCardFontFileInfo* findFile(uint8_t size, uint8_t style = 0) const;
+  const SdCardFontFileInfo* findClosestReaderSize(uint8_t fontSizeEnum, uint8_t style = 0) const;
   bool hasSize(uint8_t size) const;
   std::vector<uint8_t> availableSizes() const;
 };

lib/EpdFont/builtinFonts/all.h

@@ -33,22 +33,6 @@
 #include <builtinFonts/notosans_18_bolditalic.h>
 #include <builtinFonts/notosans_18_italic.h>
 #include <builtinFonts/notosans_18_regular.h>
-#include <builtinFonts/opendyslexic_10_bold.h>
-#include <builtinFonts/opendyslexic_10_bolditalic.h>
-#include <builtinFonts/opendyslexic_10_italic.h>
-#include <builtinFonts/opendyslexic_10_regular.h>
-#include <builtinFonts/opendyslexic_12_bold.h>
-#include <builtinFonts/opendyslexic_12_bolditalic.h>
-#include <builtinFonts/opendyslexic_12_italic.h>
-#include <builtinFonts/opendyslexic_12_regular.h>
-#include <builtinFonts/opendyslexic_14_bold.h>
-#include <builtinFonts/opendyslexic_14_bolditalic.h>
-#include <builtinFonts/opendyslexic_14_italic.h>
-#include <builtinFonts/opendyslexic_14_regular.h>
-#include <builtinFonts/opendyslexic_8_bold.h>
-#include <builtinFonts/opendyslexic_8_bolditalic.h>
-#include <builtinFonts/opendyslexic_8_italic.h>
-#include <builtinFonts/opendyslexic_8_regular.h>
 #include <builtinFonts/ubuntu_10_bold.h>
 #include <builtinFonts/ubuntu_10_regular.h>
 #include <builtinFonts/ubuntu_12_bold.h>

lib/EpdFont/builtinFonts/source/.gitignore

@@ -6,6 +6,10 @@
 !NotoSerif/**
 !NotoSans/
 !NotoSans/**
+!NotoSansArabic/
+!NotoSansArabic/**
+!NotoSansHebrew/
+!NotoSansHebrew/**
 !OpenDyslexic/
 !OpenDyslexic/**
 !Ubuntu/

lib/EpdFont/builtinFonts/source/NotoSansArabic/OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/arabic)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://openfontlicense.org
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

lib/EpdFont/builtinFonts/source/NotoSansHebrew/OFL.txt

@@ -0,0 +1,93 @@
+Copyright 2022 The Noto Project Authors (https://github.com/notofonts/hebrew)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://openfontlicense.org
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

lib/EpdFont/scripts/build-font-ids.sh

@@ -80,42 +80,6 @@ ruby -rdigest -e 'puts [
 ].map{|f| Digest::SHA256.hexdigest(File.read(f)).to_i(16) }.sum % (2 ** 32) - (2 ** 31)'
 ))"
 
-echo "#define OPENDYSLEXIC_8_FONT_ID ($(
-ruby -rdigest -e 'puts [
-  "./opendyslexic_8_regular.h",
-  "./opendyslexic_8_bold.h",
-  "./opendyslexic_8_bolditalic.h",
-  "./opendyslexic_8_italic.h",
-].map{|f| Digest::SHA256.hexdigest(File.read(f)).to_i(16) }.sum % (2 ** 32) - (2 ** 31)'
-))"
-
-echo "#define OPENDYSLEXIC_10_FONT_ID ($(
-ruby -rdigest -e 'puts [
-  "./opendyslexic_10_regular.h",
-  "./opendyslexic_10_bold.h",
-  "./opendyslexic_10_bolditalic.h",
-  "./opendyslexic_10_italic.h",
-].map{|f| Digest::SHA256.hexdigest(File.read(f)).to_i(16) }.sum % (2 ** 32) - (2 ** 31)'
-))"
-
-echo "#define OPENDYSLEXIC_12_FONT_ID ($(
-ruby -rdigest -e 'puts [
-  "./opendyslexic_12_regular.h",
-  "./opendyslexic_12_bold.h",
-  "./opendyslexic_12_bolditalic.h",
-  "./opendyslexic_12_italic.h",
-].map{|f| Digest::SHA256.hexdigest(File.read(f)).to_i(16) }.sum % (2 ** 32) - (2 ** 31)'
-))"
-
-echo "#define OPENDYSLEXIC_14_FONT_ID ($(
-ruby -rdigest -e 'puts [
-  "./opendyslexic_14_regular.h",
-  "./opendyslexic_14_bold.h",
-  "./opendyslexic_14_bolditalic.h",
-  "./opendyslexic_14_italic.h",
-].map{|f| Digest::SHA256.hexdigest(File.read(f)).to_i(16) }.sum % (2 ** 32) - (2 ** 31)'
-))"
-
 echo "#define UI_10_FONT_ID ($(
 ruby -rdigest -e 'puts [
   "./ubuntu_10_regular.h",

lib/EpdFont/scripts/build-sd-fonts.py

@@ -33,6 +33,7 @@ import sys
 import tempfile
 import threading
 import time
+import socket
 import urllib.request
 from concurrent.futures import ProcessPoolExecutor, as_completed
 from pathlib import Path
@@ -46,19 +47,47 @@ DEFAULT_CONFIG = SCRIPT_DIR / "sd-fonts.yaml"
 DEFAULT_OUTPUT = SCRIPT_DIR / "output"
 DOWNLOAD_DIR = SCRIPT_DIR / "downloaded_fonts"
 INSTANCE_DIR = SCRIPT_DIR / "instanced_fonts"
+DEFAULT_FALLBACK_FONT = EPDFONTS_DIR / "builtinFonts/source/NotoSans/NotoSans-Regular.ttf"
 
 
-def download_font(url: str, dest: Path) -> Path:
-    """Download a font file if not already cached. Returns the local path."""
+_orig_getaddrinfo = socket.getaddrinfo
+
+
+def _ipv4_only_getaddrinfo(*args, **kwargs):
+    """getaddrinfo variant that drops AAAA records (IPv4 only)."""
+    return [ai for ai in _orig_getaddrinfo(*args, **kwargs) if ai[0] == socket.AF_INET]
+
+
+def download_font(url: str, dest: Path, retries: int = 3) -> Path:
+    """Download a font file if not already cached. Returns the local path.
+
+    Some sources (e.g. mirrors.ctan.org) are round-robin redirectors that land
+    on a different mirror each request; a mirror may advertise an IPv6 address a
+    host without an IPv6 route cannot reach ([Errno 101] Network is unreachable).
+    Retry on failure, forcing IPv4 resolution after the first attempt.
+    """
     if dest.exists():
         return dest
     dest.parent.mkdir(parents=True, exist_ok=True)
     print(f"  Downloading {dest.name}...")
-    try:
-        urllib.request.urlretrieve(url, dest)
-    except Exception as e:
-        dest.unlink(missing_ok=True)
-        raise RuntimeError(f"Failed to download {url}: {e}") from e
+    last_err = None
+    for attempt in range(1, retries + 1):
+        force_ipv4 = attempt > 1
+        if force_ipv4:
+            socket.getaddrinfo = _ipv4_only_getaddrinfo
+        try:
+            urllib.request.urlretrieve(url, dest)
+            break
+        except Exception as e:  # noqa: BLE001 - reported via RuntimeError below
+            last_err = e
+            dest.unlink(missing_ok=True)
+            if attempt < retries:
+                print(f"  Attempt {attempt} failed ({e}); retrying (IPv4-only)...")
+        finally:
+            if force_ipv4:
+                socket.getaddrinfo = _orig_getaddrinfo
+    else:
+        raise RuntimeError(f"Failed to download {url}: {last_err}") from last_err
     size_kb = dest.stat().st_size / 1024
     print(f"  Downloaded {dest.name} ({size_kb:.0f} KB)")
     return dest
@@ -186,12 +215,14 @@ def build_family(
         # Multi-style mode
         for style_name, font_path in resolved_styles.items():
             cmd.extend([f"--{style_name}", str(font_path)])
+            cmd.extend([f"--fallback-{style_name}", str(DEFAULT_FALLBACK_FONT)])
     else:
         # Single-style mode
         style_name = next(iter(resolved_styles))
         font_path = resolved_styles[style_name]
         cmd.append(str(font_path))
         cmd.extend(["--style", style_name])
+        cmd.extend([f"--fallback-{style_name}", str(DEFAULT_FALLBACK_FONT)])
 
     cmd.extend(["--intervals", intervals])
     cmd.extend(["--sizes", sizes])
@@ -330,6 +361,15 @@ def main():
         print("ERROR: No families defined in config", file=sys.stderr)
         sys.exit(1)
 
+    if not DEFAULT_FALLBACK_FONT.exists() or not DEFAULT_FALLBACK_FONT.is_file():
+        print(
+            "ERROR: Missing default fallback font: "
+            f"{DEFAULT_FALLBACK_FONT}\n"
+            "This font is required for fallback glyphs in SD font builds.",
+            file=sys.stderr,
+        )
+        sys.exit(1)
+
     # Filter if --only specified
     if args.only:
         only_names = set(args.only.split(","))

lib/EpdFont/scripts/convert-builtin-fonts.sh

@@ -7,7 +7,6 @@ cd "$(dirname "$0")"
 READER_FONT_STYLES=("Regular" "Italic" "Bold" "BoldItalic")
 NOTOSERIF_FONT_SIZES=(12 14 16 18)
 NOTOSANS_FONT_SIZES=(12 14 16 18)
-OPENDYSLEXIC_FONT_SIZES=(8 10 12 14)
 
 for size in ${NOTOSERIF_FONT_SIZES[@]}; do
   for style in ${READER_FONT_STYLES[@]}; do
@@ -29,30 +28,60 @@ for size in ${NOTOSANS_FONT_SIZES[@]}; do
   done
 done
 
-for size in ${OPENDYSLEXIC_FONT_SIZES[@]}; do
-  for style in ${READER_FONT_STYLES[@]}; do
-    font_name="opendyslexic_${size}_$(echo $style | tr '[:upper:]' '[:lower:]')"
-    font_path="../builtinFonts/source/OpenDyslexic/OpenDyslexic-${style}.otf"
-    output_path="../builtinFonts/${font_name}.h"
-    python fontconvert.py $font_name $size $font_path --2bit --compress > $output_path
-    echo "Generated $output_path"
-  done
-done
-
 UI_FONT_SIZES=(10 12)
 UI_FONT_STYLES=("Regular" "Bold")
 
+# Arabic glyphs for UI text (menus, file browser titles). The built-in fonts
+# must cover the *output* of MiniBidi's do_shape() — contextual presentation
+# forms — not base letters, or shaped UI text silently drops glyphs.
+# Curated for firmware-size budget: core Arabic (Presentation Forms-B,
+# incl. the Lam-Alef ligature forms) plus the Farsi/Urdu extra letters'
+# Presentation Forms-A blocks, the few characters shaping leaves at their
+# base codepoint, Arabic punctuation, and both digit sets. No harakat and
+# no Sindhi/Pashto/Kurdish forms — book text gets those from SD-card fonts.
+ARABIC_INTERVALS=(
+  --additional-intervals 0x060C,0x060C  # Arabic comma
+  --additional-intervals 0x061B,0x061B  # Arabic semicolon
+  --additional-intervals 0x061F,0x061F  # Arabic question mark
+  --additional-intervals 0x0621,0x0621  # hamza (non-joining, never shaped)
+  --additional-intervals 0x0640,0x0640  # tatweel
+  --additional-intervals 0x0660,0x0669  # Arabic-Indic digits
+  --additional-intervals 0x06BA,0x06BA  # noon ghunna base (initial/medial keep base cp)
+  --additional-intervals 0x06D4,0x06D4  # Urdu full stop
+  --additional-intervals 0x06F0,0x06F9  # extended Arabic-Indic digits (Farsi/Urdu)
+  --additional-intervals 0xFB56,0xFB59  # peh (Farsi)
+  --additional-intervals 0xFB66,0xFB69  # tteh (Urdu)
+  --additional-intervals 0xFB7A,0xFB7D  # tcheh (Farsi)
+  --additional-intervals 0xFB88,0xFB95  # ddal, jeh, rreh (Urdu), keheh, gaf (Farsi/Urdu)
+  --additional-intervals 0xFB9E,0xFB9F  # noon ghunna isolated/final (Urdu)
+  --additional-intervals 0xFBA6,0xFBB1  # heh goal, heh doachashmee, yeh barree(+hamza) (Urdu)
+  --additional-intervals 0xFBFC,0xFBFF  # farsi yeh (Farsi/Urdu)
+  --additional-intervals 0xFE80,0xFEFC  # Presentation Forms-B: core Arabic + Lam-Alef
+)
+
 for size in ${UI_FONT_SIZES[@]}; do
   for style in ${UI_FONT_STYLES[@]}; do
     font_name="ubuntu_${size}_$(echo $style | tr '[:upper:]' '[:lower:]')"
     font_path="../builtinFonts/source/Ubuntu/Ubuntu-${style}.ttf"
+    hebrew_path="../builtinFonts/source/NotoSansHebrew/NotoSansHebrew-${style}.ttf"
+    arabic_path="../builtinFonts/source/NotoSansArabic/NotoSansArabic-${style}.ttf"
+    # Ubuntu lacks the Latin Extended Additional block (U+1EA0-U+1EF9) used for
+    # Vietnamese tone marks. Append a Vietnamese-only Ubuntu cut so those glyphs
+    # are filled from it while every glyph Ubuntu already has stays unchanged
+    # (fontstack is ordered by descending priority).
+    viet_path="../builtinFonts/source/Ubuntu/Ubuntu-Vietnamese-${style}.ttf"
     output_path="../builtinFonts/${font_name}.h"
-    python fontconvert.py $font_name $size $font_path > $output_path
+    python fontconvert.py $font_name $size $font_path $hebrew_path $arabic_path $viet_path \
+      --additional-intervals 0x05D0,0x05EA "${ARABIC_INTERVALS[@]}" > $output_path
     echo "Generated $output_path"
   done
 done
 
-python fontconvert.py notosans_8_regular 8 ../builtinFonts/source/NotoSans/NotoSans-Regular.ttf > ../builtinFonts/notosans_8_regular.h
+python fontconvert.py notosans_8_regular 8 \
+  ../builtinFonts/source/NotoSans/NotoSans-Regular.ttf \
+  ../builtinFonts/source/NotoSansHebrew/NotoSansHebrew-Regular.ttf \
+  ../builtinFonts/source/NotoSansArabic/NotoSansArabic-Regular.ttf \
+  --additional-intervals 0x05D0,0x05EA "${ARABIC_INTERVALS[@]}" > ../builtinFonts/notosans_8_regular.h
 
 echo ""
 echo "Running compression verification..."

lib/EpdFont/scripts/fontconvert.py

@@ -248,7 +248,7 @@ unmerged_intervals = sorted(intervals + add_ints)
 intervals = []
 unvalidated_intervals = []
 for i_start, i_end in unmerged_intervals:
-    if len(unvalidated_intervals) > 0 and i_start + 1 <= unvalidated_intervals[-1][1]:
+    if len(unvalidated_intervals) > 0 and i_start <= unvalidated_intervals[-1][1] + 1:
         unvalidated_intervals[-1] = (unvalidated_intervals[-1][0], max(unvalidated_intervals[-1][1], i_end))
         continue
     unvalidated_intervals.append((i_start, i_end))

lib/EpdFont/scripts/fontconvert_sdcard.py

@@ -40,9 +40,11 @@ INTERVAL_PRESETS = {
     "ascii":       [(0x0020, 0x007E)],
     "latin1":      [(0x0080, 0x00FF)],
     "latin-ext":   [(0x0020, 0x007E), (0x0080, 0x00FF), (0x0100, 0x024F),
-                    (0x1E00, 0x1EFF), (0x2000, 0x206F), (0xFB00, 0xFB06)],
+                    (0x02B0, 0x02FF), (0x1E00, 0x1EFF), (0x2000, 0x206F),
+                    (0xFB00, 0xFB06)],
     "greek":       [(0x0370, 0x03FF), (0x1F00, 0x1FFF)],
     "cyrillic":    [(0x0400, 0x04FF), (0x0500, 0x052F)],
+    "hebrew":      [(0x0590, 0x05FF), (0xFB1D, 0xFB4F)],
     "georgian":    [(0x10A0, 0x10FF), (0x2D00, 0x2D2F)],
     "armenian":    [(0x0530, 0x058F)],
     "ethiopic":    [(0x1200, 0x137F), (0x1380, 0x139F), (0x2D80, 0x2DDF)],
@@ -61,7 +63,7 @@ INTERVAL_PRESETS = {
     # Composite preset for English-language literary fiction including scifi/popsci.
     # Greek for physics terms, math operators, geometric shapes, uncommon
     # dialogue punctuation, CJK quote marks, miscellaneous symbols (♪♫♬), dingbats.
-    "reading":     [(0x0020, 0x024F), (0x0300, 0x036F), (0x0370, 0x03FF),
+    "reading":     [(0x0020, 0x024F), (0x02B0, 0x02FF), (0x0300, 0x036F), (0x0370, 0x03FF),
                     (0x0400, 0x04FF), (0x1E00, 0x1EFF), (0x2000, 0x206F),
                     (0x2070, 0x209F), (0x20A0, 0x20CF), (0x2150, 0x218F),
                     (0x2190, 0x21FF), (0x2200, 0x22FF), (0x2500, 0x257F),
@@ -517,7 +519,8 @@ def extract_ligatures_fonttools(font_path, codepoints):
     return pairs
 
 
-def rasterize_font_style(fontfile, size, intervals, style_id=0, force_autohint=False):
+def rasterize_font_style(fontfile, size, intervals, style_id=0, force_autohint=False,
+                         fallback_fontfile=None):
     """Rasterize all glyphs for one font style. Returns StyleRasterData."""
     import freetype
 
@@ -530,6 +533,10 @@ def rasterize_font_style(fontfile, size, intervals, style_id=0, force_autohint=F
     # it before set_char_size() would waste work at the default size and risk
     # Invalid_Size_Handle on some fonts.
     face.set_char_size(size << 6, size << 6, 150, 150)
+    fallback_face = None
+    if fallback_fontfile:
+        fallback_face = freetype.Face(fallback_fontfile)
+        fallback_face.set_char_size(size << 6, size << 6, 150, 150)
 
     load_flags = freetype.FT_LOAD_RENDER
     if force_autohint:
@@ -540,6 +547,11 @@ def rasterize_font_style(fontfile, size, intervals, style_id=0, force_autohint=F
         if glyph_index > 0:
             face.load_glyph(glyph_index, load_flags)
             return face
+        if fallback_face:
+            fallback_glyph_index = fallback_face.get_char_index(code_point)
+            if fallback_glyph_index > 0:
+                fallback_face.load_glyph(fallback_glyph_index, load_flags)
+                return fallback_face
         return None
 
     # Validate intervals: remove codepoints not present in the font.
@@ -551,7 +563,9 @@ def rasterize_font_style(fontfile, size, intervals, style_id=0, force_autohint=F
     for i_start, i_end in intervals:
         start = i_start
         for code_point in range(i_start, i_end + 1):
-            if face.get_char_index(code_point) == 0:
+            has_primary = face.get_char_index(code_point) != 0
+            has_fallback = fallback_face and fallback_face.get_char_index(code_point) != 0
+            if not has_primary and not has_fallback:
                 if start < code_point:
                     validated_intervals.append((start, code_point - 1))
                 start = code_point + 1
@@ -762,10 +776,11 @@ def style_sections_total_size(sections):
 # --- File writers ---
 
 def generate_cpfont_multistyle(style_fonts, size, intervals, output_path,
-                               force_autohint=False):
+                               force_autohint=False, fallback_style_fonts=None):
     """Generate a multi-style v4 .cpfont file.
 
     style_fonts: dict of {style_id: fontfile_path} e.g. {0: "Regular.ttf", 2: "Italic.ttf"}
+    fallback_style_fonts: optional dict of {style_id: fallback_fontfile_path}
     """
     MAGIC = b"CPFONT\x00\x00"
     HEADER_SIZE = 32
@@ -775,12 +790,15 @@ def generate_cpfont_multistyle(style_fonts, size, intervals, output_path,
 
     # Rasterize each style
     raster_data = {}  # style_id -> StyleRasterData
+    fallback_style_fonts = fallback_style_fonts or {}
     for style_id in sorted(style_fonts.keys()):
         fontfile = style_fonts[style_id]
+        fallback_fontfile = fallback_style_fonts.get(style_id)
         print(f"  Rasterizing style {style_id}...", file=sys.stderr)
         raster_data[style_id] = rasterize_font_style(
             fontfile, size, intervals, style_id=style_id,
-            force_autohint=force_autohint)
+            force_autohint=force_autohint,
+            fallback_fontfile=fallback_fontfile)
 
     # Pack binary sections for each style
     packed_sections = {}  # style_id -> tuple of section bytearrays
@@ -891,6 +909,14 @@ def main():
                         help="Font file for italic style.")
     parser.add_argument("--bolditalic", dest="font_bolditalic",
                         help="Font file for bold-italic style.")
+    parser.add_argument("--fallback-regular", dest="fallback_regular",
+                        help="Fallback font file for regular style.")
+    parser.add_argument("--fallback-bold", dest="fallback_bold",
+                        help="Fallback font file for bold style.")
+    parser.add_argument("--fallback-italic", dest="fallback_italic",
+                        help="Fallback font file for italic style.")
+    parser.add_argument("--fallback-bolditalic", dest="fallback_bolditalic",
+                        help="Fallback font file for bold-italic style.")
 
     args = parser.parse_args()
 
@@ -912,6 +938,16 @@ def main():
     if args.font_bolditalic:
         style_fonts[3] = args.font_bolditalic
 
+    fallback_style_fonts = {}
+    if args.fallback_regular:
+        fallback_style_fonts[0] = args.fallback_regular
+    if args.fallback_bold:
+        fallback_style_fonts[1] = args.fallback_bold
+    if args.fallback_italic:
+        fallback_style_fonts[2] = args.fallback_italic
+    if args.fallback_bolditalic:
+        fallback_style_fonts[3] = args.fallback_bolditalic
+
     is_multistyle = len(style_fonts) > 0
     fontfile = args.fontfile
 
@@ -979,7 +1015,8 @@ def main():
         print(f"Generating {output_path} (size {sz}, {len(style_fonts)} style(s), v4)...", file=sys.stderr)
         total_size += generate_cpfont_multistyle(
             style_fonts, sz, intervals, output_path,
-            force_autohint=args.force_autohint)
+            force_autohint=args.force_autohint,
+            fallback_style_fonts=fallback_style_fonts)
     print(f"\nTotal: {len(sizes)} files, {total_size / 1024 / 1024:.2f} MB", file=sys.stderr)
 
 

lib/EpdFont/scripts/sd-fonts.yaml

@@ -122,7 +122,26 @@ families:
       bold:       {url: "https://mirrors.ctan.org/fonts/domitian/opentype/Domitian-Bold.otf"}
       italic:     {url: "https://mirrors.ctan.org/fonts/domitian/opentype/Domitian-Italic.otf"}
       bolditalic: {url: "https://mirrors.ctan.org/fonts/domitian/opentype/Domitian-BoldItalic.otf"}
-    
+
+  - name: LibreBaskerville
+    description: "A serif reimplementing the classic Baskerville (Latin)"
+    intervals: latin-ext
+    sizes: [12, 14, 16, 18]
+    styles:
+      regular:    {url: "https://raw.githubusercontent.com/impallari/Libre-Baskerville/master/fonts/ttf/LibreBaskerville-Regular.ttf"}
+      bold:       {url: "https://raw.githubusercontent.com/impallari/Libre-Baskerville/master/fonts/ttf/LibreBaskerville-Bold.ttf"}
+      italic:     {url: "https://raw.githubusercontent.com/impallari/Libre-Baskerville/master/fonts/ttf/LibreBaskerville-Italic.ttf"}
+      bolditalic: {url: "https://raw.githubusercontent.com/impallari/Libre-Baskerville/master/fonts/ttf/LibreBaskerville-BoldItalic.ttf"}
+
+  - name: Vollkorn
+    description: "A serif for bread and butter use by Friedrich Althausen (Latin, Greek, Cyrillic)"
+    intervals: latin-ext,greek,cyrillic
+    sizes: [12, 14, 16, 18]
+    styles:
+      regular:    {url: "https://raw.githubusercontent.com/google/fonts/main/ofl/vollkorn/Vollkorn%5Bwght%5D.ttf", variable: {wght: 400}}
+      bold:       {url: "https://raw.githubusercontent.com/google/fonts/main/ofl/vollkorn/Vollkorn%5Bwght%5D.ttf", variable: {wght: 700}}
+      italic:     {url: "https://raw.githubusercontent.com/google/fonts/main/ofl/vollkorn/Vollkorn-Italic%5Bwght%5D.ttf", variable: {wght: 400}}
+      bolditalic: {url: "https://raw.githubusercontent.com/google/fonts/main/ofl/vollkorn/Vollkorn-Italic%5Bwght%5D.ttf", variable: {wght: 700}}
 
   # ── Sans-serif ─────────────────────────────────────────────────────────
 
@@ -198,6 +217,18 @@ families:
       italic:     {url: "https://raw.githubusercontent.com/adobe-fonts/source-code-pro/release/TTF/SourceCodePro-It.ttf"}
       bolditalic: {url: "https://raw.githubusercontent.com/adobe-fonts/source-code-pro/release/TTF/SourceCodePro-BoldIt.ttf"}
 
+  # ── Dyslexia ───────────────────────────────────────────────────────────────
+
+  - name: OpenDyslexic
+    description: "Dyslexia-friendly font (Latin)"
+    intervals: latin-ext
+    sizes: [8, 10, 12, 14]
+    styles:
+      regular:    {path: "builtinFonts/source/OpenDyslexic/OpenDyslexic-Regular.otf"}
+      bold:       {path: "builtinFonts/source/OpenDyslexic/OpenDyslexic-Bold.otf"}
+      italic:     {path: "builtinFonts/source/OpenDyslexic/OpenDyslexic-Italic.otf"}
+      bolditalic: {path: "builtinFonts/source/OpenDyslexic/OpenDyslexic-BoldItalic.otf"}
+
   # ── Accessibility ──────────────────────────────────────────────────────
 
   - name: AtkinsonHyperlegibleNext

lib/Epub/Epub.cpp

@@ -5,6 +5,7 @@
 #include <JpegToBmpConverter.h>
 #include <Logging.h>
 #include <PngToBmpConverter.h>
+#include <Utf8.h>
 #include <ZipFile.h>
 
 #include "Epub/parsers/ContainerParser.h"
@@ -44,7 +45,7 @@ bool Epub::findContentOpfFile(std::string* contentOpfFile) const {
   return true;
 }
 
-bool Epub::parseContentOpf(BookMetadataCache::BookMetadata& bookMetadata) {
+bool Epub::parseContentOpf(BookMetadataCache::BookMetadata& bookMetadata, const bool writeSpineEntries) {
   std::string contentOpfFilePath;
   if (!findContentOpfFile(&contentOpfFilePath)) {
     LOG_ERR("EBP", "Could not find content.opf in zip");
@@ -61,7 +62,8 @@ bool Epub::parseContentOpf(BookMetadataCache::BookMetadata& bookMetadata) {
     return false;
   }
 
-  ContentOpfParser opfParser(getCachePath(), getBasePath(), contentOpfSize, bookMetadataCache.get());
+  ContentOpfParser opfParser(getCachePath(), getBasePath(), contentOpfSize,
+                             writeSpineEntries ? bookMetadataCache.get() : nullptr);
   if (!opfParser.setup()) {
     LOG_ERR("EBP", "Could not setup content.opf parser");
     return false;
@@ -72,8 +74,9 @@ bool Epub::parseContentOpf(BookMetadataCache::BookMetadata& bookMetadata) {
     return false;
   }
 
-  // Grab data from opfParser into epub
-  bookMetadata.title = opfParser.title;
+  // Grab data from opfParser into epub. Normalize titles to NFC so NFD (combining
+  // mark) text renders correctly — the device fonts have no mark positioning.
+  bookMetadata.title = utf8ComposeNfc(opfParser.title);
   bookMetadata.author = opfParser.author;
   bookMetadata.language = opfParser.language;
   bookMetadata.coverItemHref = opfParser.coverItemHref;
@@ -104,8 +107,9 @@ bool Epub::parseContentOpf(BookMetadataCache::BookMetadata& bookMetadata) {
           const auto endPos = coverPageHtml.find('"', pos);
           if (endPos != std::string::npos) {
             const auto ref = std::string_view{coverPageHtml}.substr(pos, endPos - pos);
-            // Check if it's an image file
-            if (FsHelpers::hasPngExtension(ref) || FsHelpers::hasJpgExtension(ref) || FsHelpers::hasGifExtension(ref)) {
+            // Cover BMP generation supports JPG/PNG only; skip GIF so an unsupported wrapper image
+            // does not block a later supported cover reference.
+            if (FsHelpers::hasPngExtension(ref) || FsHelpers::hasJpgExtension(ref)) {
               imageRef = ref;
               break;
             }
@@ -116,7 +120,7 @@ bool Epub::parseContentOpf(BookMetadataCache::BookMetadata& bookMetadata) {
       }
 
       if (!imageRef.empty()) {
-        bookMetadata.coverItemHref = FsHelpers::normalisePath(coverPageBase + imageRef);
+        bookMetadata.coverItemHref = FsHelpers::normalisePath(FsHelpers::decodeUriEscapes(coverPageBase + imageRef));
         LOG_DBG("EBP", "Found cover image from guide: %s", bookMetadata.coverItemHref.c_str());
       }
     }
@@ -149,18 +153,11 @@ bool Epub::parseTocNcxFile() const {
 
   LOG_DBG("EBP", "Parsing toc ncx file: %s", tocNcxItem.c_str());
 
-  const auto tmpNcxPath = getCachePath() + "/toc.ncx";
-  FsFile tempNcxFile;
-  if (!Storage.openFileForWrite("EBP", tmpNcxPath, tempNcxFile)) {
+  size_t ncxSize;
+  if (!getItemSize(tocNcxItem, &ncxSize)) {
+    LOG_ERR("EBP", "Could not get size of toc ncx file");
     return false;
   }
-  readItemContentsToStream(tocNcxItem, tempNcxFile, 1024);
-  // Explicitly close() file before reopening for reading
-  tempNcxFile.close();
-  if (!Storage.openFileForRead("EBP", tmpNcxPath, tempNcxFile)) {
-    return false;
-  }
-  const auto ncxSize = tempNcxFile.size();
 
   TocNcxParser ncxParser(contentBasePath, ncxSize, bookMetadataCache.get());
 
@@ -169,29 +166,13 @@ bool Epub::parseTocNcxFile() const {
     return false;
   }
 
-  const auto ncxBuffer = static_cast<uint8_t*>(malloc(1024));
-  if (!ncxBuffer) {
-    LOG_ERR("EBP", "Could not allocate memory for toc ncx parser");
+  // Stream the decompressed NCX straight into the parser instead of round-tripping
+  // through a temp file on the SD card (decompress -> write -> reopen -> reread -> delete).
+  if (!readItemContentsToStream(tocNcxItem, ncxParser, 1024)) {
+    LOG_ERR("EBP", "Could not read toc ncx file");
     return false;
   }
 
-  while (tempNcxFile.available()) {
-    const auto readSize = tempNcxFile.read(ncxBuffer, 1024);
-    if (readSize == 0) break;
-    const auto processedSize = ncxParser.write(ncxBuffer, readSize);
-
-    if (processedSize != readSize) {
-      LOG_ERR("EBP", "Could not process all toc ncx data");
-      free(ncxBuffer);
-      return false;
-    }
-  }
-
-  free(ncxBuffer);
-  // Explicitly close() file before calling Storage.remove()
-  tempNcxFile.close();
-  Storage.remove(tmpNcxPath.c_str());
-
   LOG_DBG("EBP", "Parsed TOC items");
   return true;
 }
@@ -205,18 +186,11 @@ bool Epub::parseTocNavFile() const {
 
   LOG_DBG("EBP", "Parsing toc nav file: %s", tocNavItem.c_str());
 
-  const auto tmpNavPath = getCachePath() + "/toc.nav";
-  FsFile tempNavFile;
-  if (!Storage.openFileForWrite("EBP", tmpNavPath, tempNavFile)) {
+  size_t navSize;
+  if (!getItemSize(tocNavItem, &navSize)) {
+    LOG_ERR("EBP", "Could not get size of toc nav file");
     return false;
   }
-  readItemContentsToStream(tocNavItem, tempNavFile, 1024);
-  // Explicitly close() file before reopening for reading
-  tempNavFile.close();
-  if (!Storage.openFileForRead("EBP", tmpNavPath, tempNavFile)) {
-    return false;
-  }
-  const auto navSize = tempNavFile.size();
 
   // Note: We can't use `contentBasePath` here as the nav file may be in a different folder to the content.opf
   // and the HTMLX nav file will have hrefs relative to itself
@@ -228,32 +202,41 @@ bool Epub::parseTocNavFile() const {
     return false;
   }
 
-  const auto navBuffer = static_cast<uint8_t*>(malloc(1024));
-  if (!navBuffer) {
-    LOG_ERR("EBP", "Could not allocate memory for toc nav parser");
+  // Stream the decompressed nav document straight into the parser instead of round-tripping
+  // through a temp file on the SD card (decompress -> write -> reopen -> reread -> delete).
+  if (!readItemContentsToStream(tocNavItem, navParser, 1024)) {
+    LOG_ERR("EBP", "Could not read toc nav file");
     return false;
   }
 
-  while (tempNavFile.available()) {
-    const auto readSize = tempNavFile.read(navBuffer, 1024);
-    const auto processedSize = navParser.write(navBuffer, readSize);
-
-    if (processedSize != readSize) {
-      LOG_ERR("EBP", "Could not process all toc nav data");
-      free(navBuffer);
-      return false;
-    }
-  }
-
-  free(navBuffer);
-  // Explicitly close() file before calling Storage.remove()
-  tempNavFile.close();
-  Storage.remove(tmpNavPath.c_str());
-
   LOG_DBG("EBP", "Parsed TOC nav items");
   return true;
 }
 
+void Epub::discoverCssFilesFromZip() {
+  const std::string& opfDir = contentBasePath;
+  ZipFile zf(filepath);
+
+  if (!zf.enumerateFilePaths([&](std::string_view filePath) {
+        if (!opfDir.empty() && filePath.find(opfDir) != 0) {
+          return;
+        }
+
+        if (!FsHelpers::hasCssExtension(filePath)) {
+          return;
+        }
+
+        if (std::find(cssFiles.begin(), cssFiles.end(), filePath) != cssFiles.end()) {
+          return;
+        }
+
+        LOG_DBG("EBP", "Discovered CSS file via ZIP enumeration: %.*s", (int)filePath.size(), filePath.data());
+        cssFiles.push_back(std::string{filePath});
+      })) {
+    LOG_ERR("EBP", "Failed to enumerate ZIP file paths for CSS discovery");
+  }
+}
+
 void Epub::parseCssFiles() const {
   // Maximum CSS file size we'll attempt to parse (uncompressed)
   // Larger files risk memory exhaustion on ESP32
@@ -297,7 +280,7 @@ void Epub::parseCssFiles() const {
 
     // Extract CSS file to temp location
     const auto tmpCssPath = getCachePath() + "/.tmp.css";
-    FsFile tempCssFile;
+    HalFile tempCssFile;
     if (!Storage.openFileForWrite("EBP", tmpCssPath, tempCssFile)) {
       LOG_ERR("EBP", "Could not create temp CSS file");
       continue;
@@ -328,9 +311,9 @@ void Epub::parseCssFiles() const {
   if (!cssParser->saveToCache()) {
     LOG_ERR("EBP", "Failed to save CSS rules to cache");
   }
-  cssParser->clear();
 
   LOG_DBG("EBP", "Loaded %zu CSS style rules from %zu files", cssParser->ruleCount(), cssFiles.size());
+  cssParser->clear();
 }
 
 // load in the meta data for the epub file
@@ -350,15 +333,29 @@ bool Epub::load(const bool buildIfMissing, const bool skipLoadingCss) {
         LOG_DBG("EBP", "CSS rules cache missing or stale, attempting to parse CSS files");
         cssParser->deleteCache();
 
-        if (!parseContentOpf(bookMetadataCache->coreMetadata)) {
+        BookMetadataCache::BookMetadata cachedMetadata = bookMetadataCache->coreMetadata;
+        if (!parseContentOpf(cachedMetadata, /*writeSpineEntries=*/false)) {
           LOG_ERR("EBP", "Could not parse content.opf from cached bookMetadata for CSS files");
           // continue anyway - book will work without CSS and we'll still load any inline style CSS
+        } else {
+          discoverCssFilesFromZip();
         }
+        bookMetadataCache.reset();
         parseCssFiles();
+        bookMetadataCache.reset(new BookMetadataCache(cachePath));
+        if (!bookMetadataCache->load()) {
+          LOG_ERR("EBP", "Failed to reload cache after CSS rebuild");
+          return false;
+        }
         // Invalidate section caches so they are rebuilt with the new CSS
         Storage.removeDir((cachePath + "/sections").c_str());
       }
     }
+    // Release the resolved CSS rule map: it is only needed transiently while building
+    // section caches, and createSectionFile reloads it from cache on demand. Holding it
+    // resident pins tens of KB for the whole reading session (more on warm resume into
+    // an already-cached chapter, where createSectionFile never runs to clear it).
+    cssParser->clear();
     LOG_DBG("EBP", "Loaded ePub: %s", filepath.c_str());
     return true;
   }
@@ -391,6 +388,7 @@ bool Epub::load(const bool buildIfMissing, const bool skipLoadingCss) {
     LOG_ERR("EBP", "Could not parse content.opf");
     return false;
   }
+  discoverCssFilesFromZip();
   if (!bookMetadataCache->endContentOpfPass()) {
     LOG_ERR("EBP", "Could not end writing content.opf pass");
     return false;
@@ -448,6 +446,13 @@ bool Epub::load(const bool buildIfMissing, const bool skipLoadingCss) {
     LOG_DBG("EBP", "Could not cleanup tmp files - ignoring");
   }
 
+  if (!skipLoadingCss) {
+    // Parse CSS before reloading book.bin to leave more heap for CSS rule-table growth.
+    bookMetadataCache.reset();
+    parseCssFiles();
+    Storage.removeDir((cachePath + "/sections").c_str());
+  }
+
   // Reload the cache from disk so it's in the correct state
   bookMetadataCache.reset(new BookMetadataCache(cachePath));
   if (!bookMetadataCache->load()) {
@@ -455,12 +460,6 @@ bool Epub::load(const bool buildIfMissing, const bool skipLoadingCss) {
     return false;
   }
 
-  if (!skipLoadingCss) {
-    // Parse CSS files after cache reload
-    parseCssFiles();
-    Storage.removeDir((cachePath + "/sections").c_str());
-  }
-
   LOG_DBG("EBP", "Loaded ePub: %s", filepath.c_str());
   return true;
 }
@@ -545,7 +544,7 @@ bool Epub::generateCoverBmp(bool cropped) const {
     LOG_DBG("EBP", "Generating BMP from JPG cover image (%s mode)", cropped ? "cropped" : "fit");
     const auto coverJpgTempPath = getCachePath() + "/.cover.jpg";
 
-    FsFile coverJpg;
+    HalFile coverJpg;
     if (!Storage.openFileForWrite("EBP", coverJpgTempPath, coverJpg)) {
       return false;
     }
@@ -557,7 +556,7 @@ bool Epub::generateCoverBmp(bool cropped) const {
       return false;
     }
 
-    FsFile coverBmp;
+    HalFile coverBmp;
     if (!Storage.openFileForWrite("EBP", getCoverBmpPath(cropped), coverBmp)) {
       return false;
     }
@@ -579,7 +578,7 @@ bool Epub::generateCoverBmp(bool cropped) const {
     LOG_DBG("EBP", "Generating BMP from PNG cover image (%s mode)", cropped ? "cropped" : "fit");
     const auto coverPngTempPath = getCachePath() + "/.cover.png";
 
-    FsFile coverPng;
+    HalFile coverPng;
     if (!Storage.openFileForWrite("EBP", coverPngTempPath, coverPng)) {
       return false;
     }
@@ -591,7 +590,7 @@ bool Epub::generateCoverBmp(bool cropped) const {
       return false;
     }
 
-    FsFile coverBmp;
+    HalFile coverBmp;
     if (!Storage.openFileForWrite("EBP", getCoverBmpPath(cropped), coverBmp)) {
       return false;
     }
@@ -634,7 +633,7 @@ bool Epub::generateThumbBmp(int height) const {
     LOG_DBG("EBP", "Generating thumb BMP from JPG cover image");
     const auto coverJpgTempPath = getCachePath() + "/.cover.jpg";
 
-    FsFile coverJpg;
+    HalFile coverJpg;
     if (!Storage.openFileForWrite("EBP", coverJpgTempPath, coverJpg)) {
       return false;
     }
@@ -646,7 +645,7 @@ bool Epub::generateThumbBmp(int height) const {
       return false;
     }
 
-    FsFile thumbBmp;
+    HalFile thumbBmp;
     if (!Storage.openFileForWrite("EBP", getThumbBmpPath(height), thumbBmp)) {
       return false;
     }
@@ -671,7 +670,7 @@ bool Epub::generateThumbBmp(int height) const {
     LOG_DBG("EBP", "Generating thumb BMP from PNG cover image");
     const auto coverPngTempPath = getCachePath() + "/.cover.png";
 
-    FsFile coverPng;
+    HalFile coverPng;
     if (!Storage.openFileForWrite("EBP", coverPngTempPath, coverPng)) {
       return false;
     }
@@ -683,7 +682,7 @@ bool Epub::generateThumbBmp(int height) const {
       return false;
     }
 
-    FsFile thumbBmp;
+    HalFile thumbBmp;
     if (!Storage.openFileForWrite("EBP", getThumbBmpPath(height), thumbBmp)) {
       return false;
     }
@@ -707,7 +706,7 @@ bool Epub::generateThumbBmp(int height) const {
   }
 
   // Write an empty bmp file to avoid generation attempts in the future
-  FsFile thumbBmp;
+  HalFile thumbBmp;
   Storage.openFileForWrite("EBP", getThumbBmpPath(height), thumbBmp);
   return false;
 }
@@ -863,10 +862,10 @@ float Epub::calculateProgress(const int currentSpineIndex, const float currentSp
 int Epub::resolveHrefToSpineIndex(const std::string& href) const {
   if (!bookMetadataCache || !bookMetadataCache->isLoaded()) return -1;
 
-  // Extract filename (remove #anchor)
-  std::string target = href;
-  size_t hashPos = target.find('#');
-  if (hashPos != std::string::npos) target = target.substr(0, hashPos);
+  // Split before decoding so escaped '#' characters in filenames stay part of the path.
+  const size_t hashPos = href.find('#');
+  const std::string rawTarget = hashPos != std::string::npos ? href.substr(0, hashPos) : href;
+  const std::string target = FsHelpers::normalisePath(FsHelpers::decodeUriEscapes(rawTarget));
 
   // Same-file reference (anchor-only)
   if (target.empty()) return -1;

lib/Epub/Epub.h

@@ -31,9 +31,10 @@ class Epub {
   std::vector<std::string> cssFiles;
 
   bool findContentOpfFile(std::string* contentOpfFile) const;
-  bool parseContentOpf(BookMetadataCache::BookMetadata& bookMetadata);
+  bool parseContentOpf(BookMetadataCache::BookMetadata& bookMetadata, bool writeSpineEntries = true);
   bool parseTocNcxFile() const;
   bool parseTocNavFile() const;
+  void discoverCssFilesFromZip();
   void parseCssFiles() const;
 
  public:
@@ -43,6 +44,18 @@ class Epub {
   }
   ~Epub() = default;
   std::string& getBasePath() { return contentBasePath; }
+  // MEMFIX-PORT: epub resident-bytes audit accessor; portable
+  // Approximate resident heap of the open book (audit): path strings, the CSS
+  // file list, and the parsed stylesheet. BookMetadataCache is file-backed
+  // (counts + HalFile handles) and contributes little.
+  size_t residentBytes() const {
+    size_t total = sizeof(Epub) + tocNcxItem.capacity() + tocNavItem.capacity() + filepath.capacity() +
+                   contentBasePath.capacity() + cachePath.capacity();
+    for (const auto& f : cssFiles) total += sizeof(f) + (f.capacity() > 15 ? f.capacity() : 0);
+    if (cssParser) total += cssParser->residentBytes();
+    return total;
+  }
+  size_t cssRuleCount() const { return cssParser ? cssParser->ruleCount() : 0; }
   bool load(bool buildIfMissing = true, bool skipLoadingCss = false);
   bool clearCache() const;
   void setupCacheDir() const;

lib/Epub/Epub/BookMetadataCache.cpp

@@ -1,7 +1,9 @@
 #include "BookMetadataCache.h"
 
+#include <BufferedFile.h>
 #include <Logging.h>
 #include <Serialization.h>
+#include <Utf8.h>
 #include <ZipFile.h>
 
 #include <deque>
@@ -9,10 +11,56 @@
 #include "FsHelpers.h"
 
 namespace {
-constexpr uint8_t BOOK_CACHE_VERSION = 5;
+constexpr uint8_t BOOK_CACHE_VERSION = 8;  // v8: TOC/book titles stored NFC-composed
 constexpr char bookBinFile[] = "/book.bin";
 constexpr char tmpSpineBinFile[] = "/spine.bin.tmp";
 constexpr char tmpTocBinFile[] = "/toc.bin.tmp";
+// Buffer size for the buildBookBin streams. 3 buffers x 4KB, transient (freed on
+// return); 4KB = 8 SD sectors per transfer, enough to stop the sector-cache thrash.
+constexpr size_t BUILD_IO_BUFFER_SIZE = 4096;
+
+// Entry (de)serializers, templated so they run over HalFile and the Buffered*
+// wrappers alike (two instantiations each -- a few hundred bytes of flash, in
+// exchange for the build path streaming at SD speed instead of per-pod).
+template <typename F>
+uint32_t writeSpineEntryTo(F& file, const BookMetadataCache::SpineEntry& entry) {
+  const uint32_t pos = file.position();
+  serialization::writeString(file, entry.href);
+  serialization::writePod(file, entry.cumulativeSize);
+  serialization::writePod(file, entry.tocIndex);
+  return pos;
+}
+
+template <typename F>
+uint32_t writeTocEntryTo(F& file, const BookMetadataCache::TocEntry& entry) {
+  const uint32_t pos = file.position();
+  serialization::writeString(file, entry.title);
+  serialization::writeString(file, entry.href);
+  serialization::writeString(file, entry.anchor);
+  serialization::writePod(file, entry.level);
+  serialization::writePod(file, entry.spineIndex);
+  return pos;
+}
+
+template <typename F>
+BookMetadataCache::SpineEntry readSpineEntryFrom(F& file) {
+  BookMetadataCache::SpineEntry entry;
+  serialization::readString(file, entry.href);
+  serialization::readPod(file, entry.cumulativeSize);
+  serialization::readPod(file, entry.tocIndex);
+  return entry;
+}
+
+template <typename F>
+BookMetadataCache::TocEntry readTocEntryFrom(F& file) {
+  BookMetadataCache::TocEntry entry;
+  serialization::readString(file, entry.title);
+  serialization::readString(file, entry.href);
+  serialization::readString(file, entry.anchor);
+  serialization::readPod(file, entry.level);
+  serialization::readPod(file, entry.spineIndex);
+  return entry;
+}
 }  // namespace
 
 /* ============= WRITING / BUILDING FUNCTIONS ================ */
@@ -29,13 +77,23 @@ bool BookMetadataCache::beginContentOpfPass() {
   LOG_DBG("BMC", "Beginning content opf pass");
 
   // Open spine file for writing
-  return Storage.openFileForWrite("BMC", cachePath + tmpSpineBinFile, spineFile);
+  if (!Storage.openFileForWrite("BMC", cachePath + tmpSpineBinFile, spineFile)) {
+    return false;
+  }
+  // Wrapper OOM is fine: createSpineEntry falls back to unbuffered writes.
+  passOut = makeUniqueNoThrow<serialization::BufferedFileWriter>(spineFile, BUILD_IO_BUFFER_SIZE);
+  return true;
 }
 
 bool BookMetadataCache::endContentOpfPass() {
+  const bool flushed = !passOut || passOut->flush();
+  passOut.reset();
   // Explicit close() required: member variable persists beyond function scope
   spineFile.close();
-  return true;
+  if (!flushed) {
+    LOG_ERR("BMC", "Failed writing spine tmp file");
+  }
+  return flushed;
 }
 
 bool BookMetadataCache::beginTocPass() {
@@ -73,10 +131,17 @@ bool BookMetadataCache::beginTocPass() {
     useSpineHrefIndex = false;
   }
 
+  // Wrapper OOM is fine: createTocEntry falls back to unbuffered writes.
+  passOut = makeUniqueNoThrow<serialization::BufferedFileWriter>(tocFile, BUILD_IO_BUFFER_SIZE);
   return true;
 }
 
 bool BookMetadataCache::endTocPass() {
+  const bool flushed = !passOut || passOut->flush();
+  passOut.reset();
+  if (!flushed) {
+    LOG_ERR("BMC", "Failed writing toc tmp file");
+  }
   // Explicit close() required: member variables persist beyond function scope
   tocFile.close();
   spineFile.close();
@@ -85,7 +150,7 @@ bool BookMetadataCache::endTocPass() {
   spineHrefIndex.shrink_to_fit();
   useSpineHrefIndex = false;
 
-  return true;
+  return flushed;
 }
 
 bool BookMetadataCache::endWrite() {
@@ -118,6 +183,14 @@ bool BookMetadataCache::buildBookBin(const std::string& epubPath, const BookMeta
     return false;
   }
 
+  // Buffered streams for the whole build: every access below is sequential per
+  // file, but interleaved ACROSS files, which thrashes SdFat's single shared
+  // sector cache when unbuffered (one 512B SD transaction per 4-byte pod --
+  // measured 31s for a 1,732-spine omnibus). Three 4KB buffers, freed on return.
+  serialization::BufferedFileWriter bookOut(bookFile, BUILD_IO_BUFFER_SIZE);
+  serialization::BufferedFileReader spineIn(spineFile, BUILD_IO_BUFFER_SIZE);
+  serialization::BufferedFileReader tocIn(tocFile, BUILD_IO_BUFFER_SIZE);
+
   constexpr uint32_t headerASize =
       sizeof(BOOK_CACHE_VERSION) + /* LUT Offset */ sizeof(uint32_t) + sizeof(spineCount) + sizeof(tocCount);
   const uint32_t metadataSize = metadata.title.size() + metadata.author.size() + metadata.language.size() +
@@ -127,31 +200,34 @@ bool BookMetadataCache::buildBookBin(const std::string& epubPath, const BookMeta
   const uint32_t lutOffset = headerASize + metadataSize;
 
   // Header A
-  serialization::writePod(bookFile, BOOK_CACHE_VERSION);
-  serialization::writePod(bookFile, lutOffset);
-  serialization::writePod(bookFile, spineCount);
-  serialization::writePod(bookFile, tocCount);
+  serialization::writePod(bookOut, BOOK_CACHE_VERSION);
+  serialization::writePod(bookOut, lutOffset);
+  serialization::writePod(bookOut, spineCount);
+  serialization::writePod(bookOut, tocCount);
   // Metadata
-  serialization::writeString(bookFile, metadata.title);
-  serialization::writeString(bookFile, metadata.author);
-  serialization::writeString(bookFile, metadata.language);
-  serialization::writeString(bookFile, metadata.coverItemHref);
-  serialization::writeString(bookFile, metadata.textReferenceHref);
+  serialization::writeString(bookOut, metadata.title);
+  serialization::writeString(bookOut, metadata.author);
+  serialization::writeString(bookOut, metadata.language);
+  serialization::writeString(bookOut, metadata.coverItemHref);
+  serialization::writeString(bookOut, metadata.textReferenceHref);
 
   // Loop through spine entries, writing LUT positions
-  spineFile.seek(0);
+  spineIn.seek(0);
   for (int i = 0; i < spineCount; i++) {
-    uint32_t pos = spineFile.position();
-    auto spineEntry = readSpineEntry(spineFile);
-    serialization::writePod(bookFile, pos + lutOffset + lutSize);
+    const uint32_t pos = spineIn.position();
+    readSpineEntryFrom(spineIn);
+    serialization::writePod(bookOut, pos + lutOffset + lutSize);
   }
+  // Total size of the spine tmp file: entries land in book.bin after the toc LUT
+  // and the full spine block, so toc LUT positions are offset by it.
+  const auto spineBytes = static_cast<uint32_t>(spineIn.position());
 
   // Loop through toc entries, writing LUT positions
-  tocFile.seek(0);
+  tocIn.seek(0);
   for (int i = 0; i < tocCount; i++) {
-    uint32_t pos = tocFile.position();
-    auto tocEntry = readTocEntry(tocFile);
-    serialization::writePod(bookFile, pos + lutOffset + lutSize + static_cast<uint32_t>(spineFile.position()));
+    const uint32_t pos = tocIn.position();
+    readTocEntryFrom(tocIn);
+    serialization::writePod(bookOut, pos + lutOffset + lutSize + spineBytes);
   }
 
   // LUTs complete
@@ -159,9 +235,9 @@ bool BookMetadataCache::buildBookBin(const std::string& epubPath, const BookMeta
 
   // Build spineIndex->tocIndex mapping in one pass (O(n) instead of O(n*m))
   std::deque<int16_t> spineToTocIndex(spineCount, -1);
-  tocFile.seek(0);
+  tocIn.seek(0);
   for (int j = 0; j < tocCount; j++) {
-    auto tocEntry = readTocEntry(tocFile);
+    auto tocEntry = readTocEntryFrom(tocIn);
     if (tocEntry.spineIndex >= 0 && tocEntry.spineIndex < spineCount) {
       if (spineToTocIndex[tocEntry.spineIndex] == -1) {
         spineToTocIndex[tocEntry.spineIndex] = static_cast<int16_t>(j);
@@ -196,9 +272,9 @@ bool BookMetadataCache::buildBookBin(const std::string& epubPath, const BookMeta
     std::deque<ZipFile::SizeTarget> targets;
     targets.resize(spineCount);
 
-    spineFile.seek(0);
+    spineIn.seek(0);
     for (int i = 0; i < spineCount; i++) {
-      auto entry = readSpineEntry(spineFile);
+      auto entry = readSpineEntryFrom(spineIn);
       std::string path = FsHelpers::normalisePath(entry.href);
 
       ZipFile::SizeTarget t;
@@ -223,10 +299,10 @@ bool BookMetadataCache::buildBookBin(const std::string& epubPath, const BookMeta
   }
 
   uint32_t cumSize = 0;
-  spineFile.seek(0);
+  spineIn.seek(0);
   int lastSpineTocIndex = -1;
   for (int i = 0; i < spineCount; i++) {
-    auto spineEntry = readSpineEntry(spineFile);
+    auto spineEntry = readSpineEntryFrom(spineIn);
 
     spineEntry.tocIndex = spineToTocIndex[i];
 
@@ -259,23 +335,33 @@ bool BookMetadataCache::buildBookBin(const std::string& epubPath, const BookMeta
     spineEntry.cumulativeSize = cumSize;
 
     // Write out spine data to book.bin
-    writeSpineEntry(bookFile, spineEntry);
+    writeSpineEntryTo(bookOut, spineEntry);
   }
   // Close opened zip file
   zip.close();
 
   // Loop through toc entries from toc file writing to book.bin
-  tocFile.seek(0);
+  tocIn.seek(0);
   for (int i = 0; i < tocCount; i++) {
-    auto tocEntry = readTocEntry(tocFile);
-    writeTocEntry(bookFile, tocEntry);
+    auto tocEntry = readTocEntryFrom(tocIn);
+    writeTocEntryTo(bookOut, tocEntry);
   }
 
+  const bool written = bookOut.flush();
+
   // Explicit close() required: member variables persist beyond function scope
   bookFile.close();
   spineFile.close();
   tocFile.close();
 
+  if (!written) {
+    // A short write (card full/removed) would leave a truncated book.bin that
+    // still passes the version check on load; remove it so the next open rebuilds.
+    LOG_ERR("BMC", "Failed writing book.bin, removing truncated file");
+    Storage.remove((cachePath + bookBinFile).c_str());
+    return false;
+  }
+
   LOG_DBG("BMC", "Successfully built book.bin");
   return true;
 }
@@ -292,22 +378,12 @@ bool BookMetadataCache::cleanupTmpFiles() const {
   return true;
 }
 
-uint32_t BookMetadataCache::writeSpineEntry(FsFile& file, const SpineEntry& entry) const {
-  const uint32_t pos = file.position();
-  serialization::writeString(file, entry.href);
-  serialization::writePod(file, entry.cumulativeSize);
-  serialization::writePod(file, entry.tocIndex);
-  return pos;
+uint32_t BookMetadataCache::writeSpineEntry(HalFile& file, const SpineEntry& entry) const {
+  return writeSpineEntryTo(file, entry);
 }
 
-uint32_t BookMetadataCache::writeTocEntry(FsFile& file, const TocEntry& entry) const {
-  const uint32_t pos = file.position();
-  serialization::writeString(file, entry.title);
-  serialization::writeString(file, entry.href);
-  serialization::writeString(file, entry.anchor);
-  serialization::writePod(file, entry.level);
-  serialization::writePod(file, entry.spineIndex);
-  return pos;
+uint32_t BookMetadataCache::writeTocEntry(HalFile& file, const TocEntry& entry) const {
+  return writeTocEntryTo(file, entry);
 }
 
 // Note: for the LUT to be accurate, this **MUST** be called for all spine items before `addTocEntry` is ever called
@@ -319,7 +395,11 @@ void BookMetadataCache::createSpineEntry(const std::string& href) {
   }
 
   const SpineEntry entry(href, 0, -1);
-  writeSpineEntry(spineFile, entry);
+  if (passOut) {
+    writeSpineEntryTo(*passOut, entry);
+  } else {
+    writeSpineEntry(spineFile, entry);
+  }
   spineCount++;
 }
 
@@ -364,8 +444,14 @@ void BookMetadataCache::createTocEntry(const std::string& title, const std::stri
     }
   }
 
-  const TocEntry entry(title, href, anchor, level, spineIndex);
-  writeTocEntry(tocFile, entry);
+  // Compose the title to NFC at index time so the cache stores precomposed glyphs;
+  // device fonts have no combining-mark positioning, so NFD titles render broken.
+  const TocEntry entry(utf8ComposeNfc(title), href, anchor, level, spineIndex);
+  if (passOut) {
+    writeTocEntryTo(*passOut, entry);
+  } else {
+    writeTocEntry(tocFile, entry);
+  }
   tocCount++;
 }
 
@@ -438,20 +524,8 @@ BookMetadataCache::TocEntry BookMetadataCache::getTocEntry(const int index) {
   return readTocEntry(bookFile);
 }
 
-BookMetadataCache::SpineEntry BookMetadataCache::readSpineEntry(FsFile& file) const {
-  SpineEntry entry;
-  serialization::readString(file, entry.href);
-  serialization::readPod(file, entry.cumulativeSize);
-  serialization::readPod(file, entry.tocIndex);
-  return entry;
+BookMetadataCache::SpineEntry BookMetadataCache::readSpineEntry(HalFile& file) const {
+  return readSpineEntryFrom(file);
 }
 
-BookMetadataCache::TocEntry BookMetadataCache::readTocEntry(FsFile& file) const {
-  TocEntry entry;
-  serialization::readString(file, entry.title);
-  serialization::readString(file, entry.href);
-  serialization::readString(file, entry.anchor);
-  serialization::readPod(file, entry.level);
-  serialization::readPod(file, entry.spineIndex);
-  return entry;
-}
+BookMetadataCache::TocEntry BookMetadataCache::readTocEntry(HalFile& file) const { return readTocEntryFrom(file); }

lib/Epub/Epub/BookMetadataCache.h

@@ -1,9 +1,11 @@
 #pragma once
 
+#include <BufferedFile.h>
 #include <HalStorage.h>
 
 #include <algorithm>
 #include <deque>
+#include <memory>
 #include <string>
 
 class BookMetadataCache {
@@ -50,10 +52,15 @@ class BookMetadataCache {
   bool loaded;
   bool buildMode;
 
-  FsFile bookFile;
+  HalFile bookFile;
   // Temp file handles during build
-  FsFile spineFile;
-  FsFile tocFile;
+  HalFile spineFile;
+  HalFile tocFile;
+  // Buffers the per-entry tmp-file writes during the OPF/TOC passes: those
+  // writes interleave with zip-inflate SD reads, and unbuffered they thrash
+  // SdFat's shared sector cache (one 512B transaction per 4-byte pod). One
+  // wrapper serves whichever pass is active (spine, then toc).
+  std::unique_ptr<serialization::BufferedFileWriter> passOut;
 
   // Index for fast href→spineIndex lookup (used only for large EPUBs)
   struct SpineHrefIndexEntry {
@@ -76,10 +83,10 @@ class BookMetadataCache {
     return hash;
   }
 
-  uint32_t writeSpineEntry(FsFile& file, const SpineEntry& entry) const;
-  uint32_t writeTocEntry(FsFile& file, const TocEntry& entry) const;
-  SpineEntry readSpineEntry(FsFile& file) const;
-  TocEntry readTocEntry(FsFile& file) const;
+  uint32_t writeSpineEntry(HalFile& file, const SpineEntry& entry) const;
+  uint32_t writeTocEntry(HalFile& file, const TocEntry& entry) const;
+  SpineEntry readSpineEntry(HalFile& file) const;
+  TocEntry readTocEntry(HalFile& file) const;
 
  public:
   BookMetadata coreMetadata;

lib/Epub/Epub/Page.cpp

@@ -6,11 +6,25 @@
 
 #include <new>
 
+namespace {
+
+template <typename Predicate>
+void renderFilteredPageElements(const std::vector<std::shared_ptr<PageElement>>& elements, GfxRenderer& renderer,
+                                const int fontId, const int xOffset, const int yOffset, Predicate&& predicate) {
+  for (const auto& element : elements) {
+    if (predicate(*element)) {
+      element->render(renderer, fontId, xOffset, yOffset);
+    }
+  }
+}
+
+}  // namespace
+
 void PageLine::render(GfxRenderer& renderer, const int fontId, const int xOffset, const int yOffset) {
   block->render(renderer, fontId, xPos + xOffset, yPos + yOffset);
 }
 
-bool PageLine::serialize(FsFile& file) {
+bool PageLine::serialize(HalFile& file) {
   serialization::writePod(file, xPos);
   serialization::writePod(file, yPos);
 
@@ -18,14 +32,24 @@ bool PageLine::serialize(FsFile& file) {
   return block->serialize(file);
 }
 
-std::unique_ptr<PageLine> PageLine::deserialize(FsFile& file) {
+std::unique_ptr<PageLine> PageLine::deserialize(HalFile& file) {
   int16_t xPos;
   int16_t yPos;
   serialization::readPod(file, xPos);
   serialization::readPod(file, yPos);
 
   auto tb = TextBlock::deserialize(file);
-  return std::unique_ptr<PageLine>(new PageLine(std::move(tb), xPos, yPos));
+  if (!tb) {
+    LOG_ERR("PGE", "Deserialization failed: null TextBlock");
+    return nullptr;
+  }
+
+  auto* line = new (std::nothrow) PageLine(std::move(tb), xPos, yPos);
+  if (!line) {
+    LOG_ERR("PGE", "Deserialization failed: could not allocate PageLine");
+    return nullptr;
+  }
+  return std::unique_ptr<PageLine>(line);
 }
 
 void PageImage::render(GfxRenderer& renderer, const int fontId, const int xOffset, const int yOffset) {
@@ -33,7 +57,11 @@ void PageImage::render(GfxRenderer& renderer, const int fontId, const int xOffse
   imageBlock->render(renderer, xPos + xOffset, yPos + yOffset);
 }
 
-bool PageImage::serialize(FsFile& file) {
+void PageImage::renderPlaceholder(GfxRenderer& renderer, const int xOffset, const int yOffset) const {
+  imageBlock->renderPlaceholder(renderer, xPos + xOffset, yPos + yOffset);
+}
+
+bool PageImage::serialize(HalFile& file) {
   serialization::writePod(file, xPos);
   serialization::writePod(file, yPos);
 
@@ -41,7 +69,7 @@ bool PageImage::serialize(FsFile& file) {
   return imageBlock->serialize(file);
 }
 
-std::unique_ptr<PageImage> PageImage::deserialize(FsFile& file) {
+std::unique_ptr<PageImage> PageImage::deserialize(HalFile& file) {
   int16_t xPos;
   int16_t yPos;
   serialization::readPod(file, xPos);
@@ -60,7 +88,7 @@ void PageHorizontalRule::render(GfxRenderer& renderer, const int fontId, const i
   renderer.drawLine(xPos + xOffset, yPos + yOffset, xPos + xOffset + width - 1, yPos + yOffset, thickness, true);
 }
 
-bool PageHorizontalRule::serialize(FsFile& file) {
+bool PageHorizontalRule::serialize(HalFile& file) {
   serialization::writePod(file, xPos);
   serialization::writePod(file, yPos);
   serialization::writePod(file, width);
@@ -68,7 +96,7 @@ bool PageHorizontalRule::serialize(FsFile& file) {
   return true;
 }
 
-std::unique_ptr<PageHorizontalRule> PageHorizontalRule::deserialize(FsFile& file) {
+std::unique_ptr<PageHorizontalRule> PageHorizontalRule::deserialize(HalFile& file) {
   int16_t xPos = 0;
   int16_t yPos = 0;
   uint16_t width = 0;
@@ -93,12 +121,26 @@ std::unique_ptr<PageHorizontalRule> PageHorizontalRule::deserialize(FsFile& file
 }
 
 void Page::render(GfxRenderer& renderer, const int fontId, const int xOffset, const int yOffset) const {
-  for (auto& element : elements) {
-    element->render(renderer, fontId, xOffset, yOffset);
+  renderFilteredPageElements(elements, renderer, fontId, xOffset, yOffset, [](const PageElement&) { return true; });
+}
+
+void Page::renderImages(GfxRenderer& renderer, const int fontId, const int xOffset, const int yOffset) const {
+  renderFilteredPageElements(elements, renderer, fontId, xOffset, yOffset,
+                             [](const PageElement& element) { return element.getTag() == TAG_PageImage; });
+}
+
+void Page::renderWithImagePlaceholders(GfxRenderer& renderer, const int fontId, const int xOffset,
+                                       const int yOffset) const {
+  for (const auto& element : elements) {
+    if (element->getTag() == TAG_PageImage) {
+      static_cast<const PageImage&>(*element).renderPlaceholder(renderer, xOffset, yOffset);
+    } else {
+      element->render(renderer, fontId, xOffset, yOffset);
+    }
   }
 }
 
-bool Page::serialize(FsFile& file) const {
+bool Page::serialize(HalFile& file) const {
   const uint16_t count = elements.size();
   serialization::writePod(file, count);
 
@@ -126,11 +168,15 @@ bool Page::serialize(FsFile& file) const {
   return true;
 }
 
-std::unique_ptr<Page> Page::deserialize(FsFile& file) {
+std::unique_ptr<Page> Page::deserialize(HalFile& file) {
   auto page = std::unique_ptr<Page>(new Page());
 
   uint16_t count;
   serialization::readPod(file, count);
+  // Reserve up front: growth-by-doubling needs old + new capacity live at once and
+  // reallocates repeatedly — a field crash (bad_alloc -> abort under -fno-exceptions)
+  // hit exactly this append path on a heavily fragmented heap.
+  page->elements.reserve(count);
 
   for (uint16_t i = 0; i < count; i++) {
     uint8_t tag;
@@ -138,9 +184,15 @@ std::unique_ptr<Page> Page::deserialize(FsFile& file) {
 
     if (tag == TAG_PageLine) {
       auto pl = PageLine::deserialize(file);
+      if (!pl) {
+        return nullptr;
+      }
       page->elements.push_back(std::move(pl));
     } else if (tag == TAG_PageImage) {
       auto pi = PageImage::deserialize(file);
+      if (!pi) {
+        return nullptr;
+      }
       page->elements.push_back(std::move(pi));
     } else if (tag == TAG_PageHorizontalRule) {
       auto rule = PageHorizontalRule::deserialize(file);

lib/Epub/Epub/Page.h

@@ -24,7 +24,7 @@ class PageElement {
   explicit PageElement(const int16_t xPos, const int16_t yPos) : xPos(xPos), yPos(yPos) {}
   virtual ~PageElement() = default;
   virtual void render(GfxRenderer& renderer, int fontId, int xOffset, int yOffset) = 0;
-  virtual bool serialize(FsFile& file) = 0;
+  virtual bool serialize(HalFile& file) = 0;
   virtual PageElementTag getTag() const = 0;  // Add type identification
 };
 
@@ -37,9 +37,9 @@ class PageLine final : public PageElement {
       : PageElement(xPos, yPos), block(std::move(block)) {}
   const std::shared_ptr<TextBlock>& getBlock() const { return block; }
   void render(GfxRenderer& renderer, int fontId, int xOffset, int yOffset) override;
-  bool serialize(FsFile& file) override;
+  bool serialize(HalFile& file) override;
   PageElementTag getTag() const override { return TAG_PageLine; }
-  static std::unique_ptr<PageLine> deserialize(FsFile& file);
+  static std::unique_ptr<PageLine> deserialize(HalFile& file);
 };
 
 // New PageImage class
@@ -50,9 +50,10 @@ class PageImage final : public PageElement {
   PageImage(std::shared_ptr<ImageBlock> block, const int16_t xPos, const int16_t yPos)
       : PageElement(xPos, yPos), imageBlock(std::move(block)) {}
   void render(GfxRenderer& renderer, int fontId, int xOffset, int yOffset) override;
-  bool serialize(FsFile& file) override;
+  void renderPlaceholder(GfxRenderer& renderer, int xOffset, int yOffset) const;
+  bool serialize(HalFile& file) override;
   PageElementTag getTag() const override { return TAG_PageImage; }
-  static std::unique_ptr<PageImage> deserialize(FsFile& file);
+  static std::unique_ptr<PageImage> deserialize(HalFile& file);
   const ImageBlock& getImageBlock() const { return *imageBlock; }
 };
 
@@ -65,9 +66,9 @@ class PageHorizontalRule final : public PageElement {
       : PageElement(xPos, yPos), width(width), thickness(thickness) {}
 
   void render(GfxRenderer& renderer, int fontId, int xOffset, int yOffset) override;
-  bool serialize(FsFile& file) override;
+  bool serialize(HalFile& file) override;
   PageElementTag getTag() const override { return TAG_PageHorizontalRule; }
-  static std::unique_ptr<PageHorizontalRule> deserialize(FsFile& file);
+  static std::unique_ptr<PageHorizontalRule> deserialize(HalFile& file);
 };
 
 class Page {
@@ -88,8 +89,10 @@ class Page {
   }
 
   void render(GfxRenderer& renderer, int fontId, int xOffset, int yOffset) const;
-  bool serialize(FsFile& file) const;
-  static std::unique_ptr<Page> deserialize(FsFile& file);
+  void renderImages(GfxRenderer& renderer, int fontId, int xOffset, int yOffset) const;
+  void renderWithImagePlaceholders(GfxRenderer& renderer, int fontId, int xOffset, int yOffset) const;
+  bool serialize(HalFile& file) const;
+  static std::unique_ptr<Page> deserialize(HalFile& file);
 
   // Check if page contains any images (used to force full refresh)
   bool hasImages() const {
@@ -97,6 +100,13 @@ class Page {
                        [](const std::shared_ptr<PageElement>& el) { return el->getTag() == TAG_PageImage; });
   }
 
+  bool hasImagesNeedingDecode() const {
+    return std::any_of(elements.begin(), elements.end(), [](const std::shared_ptr<PageElement>& element) {
+      return element->getTag() == TAG_PageImage &&
+             static_cast<const PageImage&>(*element).getImageBlock().needsDecode();
+    });
+  }
+
   // Get bounding box of all images on the page (union of image rects)
   // Returns false if no images. Coordinates are relative to page origin.
   bool getImageBoundingBox(int16_t& outX, int16_t& outY, int16_t& outW, int16_t& outH) const {

lib/Epub/Epub/ParsedText.cpp

@@ -1,6 +1,8 @@
 #include "ParsedText.h"
 
+#include <BidiUtils.h>
 #include <GfxRenderer.h>
+#include <Logging.h>
 #include <Utf8.h>
 
 #include <algorithm>
@@ -18,6 +20,20 @@ namespace {
 // Soft hyphen byte pattern used throughout EPUBs (UTF-8 for U+00AD).
 constexpr char SOFT_HYPHEN_UTF8[] = "\xC2\xAD";
 constexpr size_t SOFT_HYPHEN_BYTES = 2;
+// Paragraph-level direction: scan the first N words to find base direction.
+constexpr size_t RTL_PARAGRAPH_PROBE_WORDS = 3;
+// Per-word: scan enough chars to see through leading neutrals (quotes, numbers)
+// before giving up. 64 is a hedge for pathological cases like long numeric tokens.
+constexpr int RTL_PER_WORD_PROBE_DEPTH = 64;
+constexpr size_t MIN_JUSTIFY_GAPS = 1;
+
+// Byte-level pre-check: Hebrew UTF-8 lead bytes 0xD6-0xD7, Arabic/Syriac 0xD8-0xDB.
+bool mayContainRtlBytes(const char* str) {
+  for (const auto* p = reinterpret_cast<const unsigned char*>(str); *p; ++p) {
+    if (*p >= 0xD6 && *p <= 0xDB) return true;
+  }
+  return false;
+}
 
 // Returns the first rendered codepoint of a word (skipping leading soft hyphens).
 uint32_t firstCodepoint(const std::string& word) {
@@ -43,6 +59,134 @@ uint32_t lastCodepoint(const std::string& word) {
 
 bool containsSoftHyphen(const std::string& word) { return word.find(SOFT_HYPHEN_UTF8) != std::string::npos; }
 
+bool isNoBreakBeforeCjkPunctuation(const uint32_t cp) {
+  switch (cp) {
+    case '.':
+    case ',':
+    case ':':
+    case ';':
+    case '!':
+    case '?':
+    case ')':
+    case ']':
+    case '}':
+    case 0x00BB:  // »
+    case 0x2019:  // ’
+    case 0x201D:  // ”
+    case 0x3001:  // 、
+    case 0x3002:  // 。
+    case 0x3009:  // 〉
+    case 0x300B:  // 》
+    case 0x300D:  // 」
+    case 0x300F:  // 』
+    case 0x3011:  // 】
+    case 0x3015:  // 〕
+    case 0x3017:  // 〗
+    case 0x3019:  // 〙
+    case 0x301B:  // 〛
+    case 0xFF01:  // ！
+    case 0xFF09:  // ）
+    case 0xFF0C:  // ，
+    case 0xFF0E:  // ．
+    case 0xFF1A:  // ：
+    case 0xFF1B:  // ；
+    case 0xFF1F:  // ？
+    case 0xFF3D:  // ］
+    case 0xFF5D:  // ｝
+      return true;
+    default:
+      return false;
+  }
+}
+
+bool isNoBreakAfterCjkPunctuation(const uint32_t cp) {
+  switch (cp) {
+    case '(':
+    case '[':
+    case '{':
+    case 0x00AB:  // «
+    case 0x2018:  // ‘
+    case 0x201C:  // “
+    case 0x3008:  // 〈
+    case 0x300A:  // 《
+    case 0x300C:  // 「
+    case 0x300E:  // 『
+    case 0x3010:  // 【
+    case 0x3014:  // 〔
+    case 0x3016:  // 〖
+    case 0x3018:  // 〘
+    case 0x301A:  // 〚
+    case 0xFF08:  // （
+    case 0xFF3B:  // ［
+    case 0xFF5B:  // ｛
+      return true;
+    default:
+      return false;
+  }
+}
+
+bool containsCjkBreakableCodepoint(const std::string& text) {
+  const auto* ptr = reinterpret_cast<const unsigned char*>(text.c_str());
+  while (*ptr) {
+    const uint32_t cp = utf8NextCodepoint(&ptr);
+    if (utf8IsCjkBreakable(cp)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+bool hasCjkBreakOpportunityBetween(const uint32_t leftCp, const uint32_t rightCp) {
+  if (!utf8IsCjkBreakable(leftCp) && !utf8IsCjkBreakable(rightCp)) return false;
+  if (isNoBreakAfterCjkPunctuation(leftCp) || isNoBreakBeforeCjkPunctuation(rightCp)) return false;
+  if (utf8IsCombiningMark(rightCp)) return false;
+  return true;
+}
+
+std::vector<size_t> cjkCharacterBreakByteOffsets(const std::string& text) {
+  struct CodepointBoundary {
+    uint32_t cp;
+    size_t endOffset;
+  };
+
+  std::vector<CodepointBoundary> codepoints;
+  codepoints.reserve(text.size());
+  bool hasCjkBreakable = false;
+
+  const auto* ptr = reinterpret_cast<const unsigned char*>(text.c_str());
+  const auto* const start = ptr;
+  while (*ptr) {
+    const uint32_t cp = utf8NextCodepoint(&ptr);
+    if (cp == 0) break;
+    if (utf8IsCjkBreakable(cp)) {
+      hasCjkBreakable = true;
+    }
+    codepoints.push_back({cp, static_cast<size_t>(ptr - start)});
+  }
+
+  if (!hasCjkBreakable || codepoints.size() < 2) return {};
+
+  std::vector<size_t> allowedOffsets;
+  allowedOffsets.reserve(codepoints.size() - 1);
+  for (size_t i = 0; i + 1 < codepoints.size(); ++i) {
+    const uint32_t current = codepoints[i].cp;
+    const uint32_t next = codepoints[i + 1].cp;
+    if (!hasCjkBreakOpportunityBetween(current, next)) continue;
+    allowedOffsets.push_back(codepoints[i].endOffset);
+  }
+  return allowedOffsets;
+}
+
+int computeJustifyExtra(const int spareSpace, const size_t gapCount) {
+  if (gapCount < MIN_JUSTIFY_GAPS || spareSpace <= 0) return 0;
+  // Distribute the spare space evenly across gaps. Do NOT bail out to 0 when the
+  // per-gap stretch is large: a sparse line (few words on a wide page) legitimately
+  // needs big gaps to reach the margin. Returning 0 there disables justification for
+  // that line, leaving it right-aligned (RTL) / left-aligned (LTR) — the mismatched
+  // alignment bug. Match the un-capped behavior of the old code.
+  return spareSpace / static_cast<int>(gapCount);
+}
+
 // Removes every soft hyphen in-place so rendered glyphs match measured widths.
 void stripSoftHyphensInPlace(std::string& word) {
   size_t pos = 0;
@@ -111,17 +255,72 @@ void ParsedText::addWord(std::string word, const EpdFontFamily::Style fontStyle,
                          const bool attachToPrevious) {
   if (word.empty()) return;
 
+  // The device fonts carry no combining-mark positioning, so EPUB text stored in NFD
+  // (a base letter followed by separate combining accents -- common for Vietnamese,
+  // and used for many EPUB <h1> chapter headings) renders with the marks detached or
+  // misplaced. Compose to NFC here, the single funnel every word passes through, so a
+  // precomposed glyph is used instead. This runs once per word at layout time (the
+  // result is cached in the section file) and is a cheap no-op for mark-free text.
+  word = utf8ComposeNfc(word);
+
   EpdFontFamily::Style baseStyle = fontStyle;
   if (underline) {
     baseStyle = static_cast<EpdFontFamily::Style>(baseStyle | EpdFontFamily::UNDERLINE);
   }
+  const bool wordStartsRtl = !hasRtlWord && mayContainRtlBytes(word.c_str()) &&
+                             BidiUtils::startsWithRtl(word.c_str(), RTL_PER_WORD_PROBE_DEPTH);
+
+  const auto pushToken = [&](std::string token, const bool continues, const bool noSpaceBefore,
+                             const bool isFocusSuffix) {
+    words.push_back(std::move(token));
+    wordStyles.push_back(baseStyle);
+    wordContinues.push_back(continues);
+    wordNoSpaceBefore.push_back(noSpaceBefore);
+    wordIsFocusSuffix.push_back(isFocusSuffix);
+  };
+
+  bool effectiveAttachToPrevious = attachToPrevious;
+  bool effectiveNoSpaceBefore = false;
+  if (attachToPrevious && !words.empty() &&
+      hasCjkBreakOpportunityBetween(lastCodepoint(words.back()), firstCodepoint(word))) {
+    effectiveAttachToPrevious = false;
+    effectiveNoSpaceBefore = true;
+  }
+
+  if (auto breakOffsets = cjkCharacterBreakByteOffsets(word); !breakOffsets.empty()) {
+    bool firstToken = true;
+    size_t tokenStart = 0;
+    for (const size_t breakOffset : breakOffsets) {
+      if (breakOffset <= tokenStart || breakOffset > word.size()) continue;
+      pushToken(word.substr(tokenStart, breakOffset - tokenStart), firstToken ? effectiveAttachToPrevious : false,
+                firstToken ? effectiveNoSpaceBefore : true, false);
+      firstToken = false;
+      tokenStart = breakOffset;
+    }
+    if (tokenStart < word.size()) {
+      pushToken(word.substr(tokenStart), firstToken ? effectiveAttachToPrevious : false,
+                firstToken ? effectiveNoSpaceBefore : true, false);
+    }
+    if (wordStartsRtl) {
+      hasRtlWord = true;
+    }
+    return;
+  }
+
+  if (containsCjkBreakableCodepoint(word)) {
+    pushToken(std::move(word), effectiveAttachToPrevious, effectiveNoSpaceBefore, false);
+    if (wordStartsRtl) {
+      hasRtlWord = true;
+    }
+    return;
+  }
 
   // Already-bold text should stay fully bold; focus splitting would make its suffix regular later.
   if (!this->focusReadingEnabled || (baseStyle & EpdFontFamily::BOLD) != 0) {
-    words.push_back(std::move(word));
-    wordStyles.push_back(baseStyle);
-    wordContinues.push_back(attachToPrevious);
-    wordIsFocusSuffix.push_back(false);
+    pushToken(std::move(word), effectiveAttachToPrevious, effectiveNoSpaceBefore, false);
+    if (wordStartsRtl) {
+      hasRtlWord = true;
+    }
     return;
   }
 
@@ -147,17 +346,19 @@ void ParsedText::addWord(std::string word, const EpdFontFamily::Style fontStyle,
     words.reserve(newCapacity);
     wordStyles.reserve(newCapacity);
     wordContinues.reserve(newCapacity);
+    wordNoSpaceBefore.reserve(newCapacity);
     wordIsFocusSuffix.reserve(newCapacity);
   }
 
   // Lambda helper to process and push individual sub-segments of the string
   // Use std::string_view to avoid heap allocations when slicing
-  auto processSegment = [&](std::string_view segment, bool isWord, bool attach) {
+  auto processSegment = [&](std::string_view segment, bool isWord, bool attach, bool noSpaceBefore) {
     if (!isWord) {
       // Punctuation and Numbers stay regular
       words.emplace_back(segment);
       wordStyles.push_back(baseStyle);
       wordContinues.push_back(attach);
+      wordNoSpaceBefore.push_back(noSpaceBefore);
       wordIsFocusSuffix.push_back(false);
     } else {
       size_t charCount = 0;
@@ -179,6 +380,7 @@ void ParsedText::addWord(std::string word, const EpdFontFamily::Style fontStyle,
         words.emplace_back(segment);
         wordStyles.push_back(static_cast<EpdFontFamily::Style>(baseStyle | EpdFontFamily::BOLD));
         wordContinues.push_back(attach);
+        wordNoSpaceBefore.push_back(noSpaceBefore);
         wordIsFocusSuffix.push_back(false);
       } else {
         countPtr = reinterpret_cast<const unsigned char*>(segment.data());
@@ -191,12 +393,14 @@ void ParsedText::addWord(std::string word, const EpdFontFamily::Style fontStyle,
         words.emplace_back(segment.substr(0, splitByteOffset));
         wordStyles.push_back(static_cast<EpdFontFamily::Style>(baseStyle | EpdFontFamily::BOLD));
         wordContinues.push_back(attach);
+        wordNoSpaceBefore.push_back(noSpaceBefore);
         wordIsFocusSuffix.push_back(false);
 
         // Regular suffix - marked so extractLine can merge it back into single TextBlock entry
         words.emplace_back(segment.substr(splitByteOffset));
         wordStyles.push_back(baseStyle);
         wordContinues.push_back(true);
+        wordNoSpaceBefore.push_back(false);
         wordIsFocusSuffix.push_back(true);
       }
     }
@@ -224,7 +428,8 @@ void ParsedText::addWord(std::string word, const EpdFontFamily::Style fontStyle,
 
       // Only the very first segment inherits the original attachToPrevious flag.
       // Every subsequent segment MUST attach=true so it glues seamlessly to the prefix.
-      processSegment(segment, inWordSegment, isFirstSegment ? attachToPrevious : true);
+      processSegment(segment, inWordSegment, isFirstSegment ? effectiveAttachToPrevious : true,
+                     isFirstSegment ? effectiveNoSpaceBefore : false);
 
       // Setup for the next segment
       segmentStart = currentCpStart;
@@ -236,7 +441,27 @@ void ParsedText::addWord(std::string word, const EpdFontFamily::Style fontStyle,
   // Process the final remaining segment
   size_t segmentLen = end - segmentStart;
   std::string_view segment(reinterpret_cast<const char*>(segmentStart), segmentLen);
-  processSegment(segment, inWordSegment, isFirstSegment ? attachToPrevious : true);
+  processSegment(segment, inWordSegment, isFirstSegment ? effectiveAttachToPrevious : true,
+                 isFirstSegment ? effectiveNoSpaceBefore : false);
+  if (wordStartsRtl) {
+    hasRtlWord = true;
+  }
+}
+
+int ParsedText::resolveFirstLineIndent(const bool isFirstLine, const GfxRenderer& renderer, const int fontId) const {
+  if (!isFirstLine || !isNaturalAlign) {
+    return 0;
+  }
+  if (blockStyle.textIndentDefined) {
+    if (blockStyle.textIndent < 0 || !extraParagraphSpacing) {
+      return blockStyle.textIndent;
+    }
+    return 0;
+  }
+  if (!extraParagraphSpacing) {
+    return renderer.getSpaceWidth(fontId, EpdFontFamily::REGULAR) * 3;
+  }
+  return 0;
 }
 // Consumes data to minimize memory usage
 void ParsedText::layoutAndExtractLines(const GfxRenderer& renderer, const int fontId, const uint16_t viewportWidth,
@@ -246,8 +471,22 @@ void ParsedText::layoutAndExtractLines(const GfxRenderer& renderer, const int fo
     return;
   }
 
-  // Apply fixed transforms before any per-line layout work.
-  applyParagraphIndent();
+  // Per-paragraph RTL auto-detection: only when CSS/HTML didn't explicitly set direction.
+  // Explicit dir="ltr" must be respected and not overridden by content heuristic.
+  if (!blockStyle.directionDefined && hasRtlWord) {
+    // Check the first few words for RTL letter codepoints (no heap allocation).
+    const size_t wordsToScan = std::min(words.size(), RTL_PARAGRAPH_PROBE_WORDS);
+    for (size_t i = 0; i < wordsToScan; ++i) {
+      if (BidiUtils::startsWithRtl(words[i].c_str(), BidiUtils::RTL_PARAGRAPH_PROBE_DEPTH)) {
+        blockStyle.isRtl = true;
+        break;
+      }
+    }
+  }
+
+  isNaturalAlign =
+      blockStyle.alignment == CssTextAlign::Justify ||
+      (blockStyle.isRtl ? blockStyle.alignment == CssTextAlign::Right : blockStyle.alignment == CssTextAlign::Left);
 
   // Ensure SD card font glyph metrics are loaded before measuring word widths.
   // For flash-based fonts isSdCardFont() returns false and this block is skipped
@@ -272,14 +511,16 @@ void ParsedText::layoutAndExtractLines(const GfxRenderer& renderer, const int fo
   std::vector<size_t> lineBreakIndices;
   if (hyphenationEnabled) {
     // Use greedy layout that can split words mid-loop when a hyphenated prefix fits.
-    lineBreakIndices = computeHyphenatedLineBreaks(renderer, fontId, pageWidth, wordWidths, wordContinues);
+    lineBreakIndices =
+        computeHyphenatedLineBreaks(renderer, fontId, pageWidth, wordWidths, wordContinues, wordNoSpaceBefore);
   } else {
-    lineBreakIndices = computeLineBreaks(renderer, fontId, pageWidth, wordWidths, wordContinues);
+    lineBreakIndices = computeLineBreaks(renderer, fontId, pageWidth, wordWidths, wordContinues, wordNoSpaceBefore);
   }
   const size_t lineCount = includeLastLine ? lineBreakIndices.size() : lineBreakIndices.size() - 1;
 
   for (size_t i = 0; i < lineCount; ++i) {
-    extractLine(i, pageWidth, wordWidths, wordContinues, lineBreakIndices, processLine, renderer, fontId);
+    extractLine(i, pageWidth, wordWidths, wordContinues, wordNoSpaceBefore, lineBreakIndices, processLine, renderer,
+                fontId);
   }
 
   // Remove consumed words so size() reflects only remaining words
@@ -288,6 +529,7 @@ void ParsedText::layoutAndExtractLines(const GfxRenderer& renderer, const int fo
     words.erase(words.begin(), words.begin() + consumed);
     wordStyles.erase(wordStyles.begin(), wordStyles.begin() + consumed);
     wordContinues.erase(wordContinues.begin(), wordContinues.begin() + consumed);
+    wordNoSpaceBefore.erase(wordNoSpaceBefore.begin(), wordNoSpaceBefore.begin() + consumed);
     wordIsFocusSuffix.erase(wordIsFocusSuffix.begin(), wordIsFocusSuffix.begin() + consumed);
   }
 }
@@ -304,20 +546,13 @@ std::vector<uint16_t> ParsedText::calculateWordWidths(const GfxRenderer& rendere
 }
 
 std::vector<size_t> ParsedText::computeLineBreaks(const GfxRenderer& renderer, const int fontId, const int pageWidth,
-                                                  std::vector<uint16_t>& wordWidths, std::vector<bool>& continuesVec) {
+                                                  std::vector<uint16_t>& wordWidths, std::vector<bool>& continuesVec,
+                                                  std::vector<bool>& noSpaceBeforeVec) {
   if (words.empty()) {
     return {};
   }
 
-  // Calculate first line indent (only for left/justified text).
-  // Positive text-indent (paragraph indent) is suppressed when extraParagraphSpacing is on.
-  // Negative text-indent (hanging indent, e.g. margin-left:3em; text-indent:-1em) always applies —
-  // it is structural (positions the bullet/marker), not decorative.
-  const int firstLineIndent =
-      blockStyle.textIndentDefined && (blockStyle.textIndent < 0 || !extraParagraphSpacing) &&
-              (blockStyle.alignment == CssTextAlign::Justify || blockStyle.alignment == CssTextAlign::Left)
-          ? blockStyle.textIndent
-          : 0;
+  const int firstLineIndent = resolveFirstLineIndent(true, renderer, fontId);
 
   // Ensure any word that would overflow even as the first entry on a line is split using fallback hyphenation.
   for (size_t i = 0; i < wordWidths.size(); ++i) {
@@ -351,7 +586,9 @@ std::vector<size_t> ParsedText::computeLineBreaks(const GfxRenderer& renderer, c
     for (size_t j = i; j < totalWordCount; ++j) {
       // Add space before word j, unless it's the first word on the line or a continuation
       int gap = 0;
-      if (j > static_cast<size_t>(i) && !continuesVec[j]) {
+      if (j > static_cast<size_t>(i) && noSpaceBeforeVec[j]) {
+        gap = 0;
+      } else if (j > static_cast<size_t>(i) && !continuesVec[j]) {
         gap =
             renderer.getSpaceAdvance(fontId, lastCodepoint(words[j - 1]), firstCodepoint(words[j]), wordStyles[j - 1]);
       } else if (j > static_cast<size_t>(i) && continuesVec[j]) {
@@ -423,33 +660,12 @@ std::vector<size_t> ParsedText::computeLineBreaks(const GfxRenderer& renderer, c
   return lineBreakIndices;
 }
 
-void ParsedText::applyParagraphIndent() {
-  if (extraParagraphSpacing || words.empty()) {
-    return;
-  }
-
-  if (blockStyle.textIndentDefined) {
-    // CSS text-indent is explicitly set (even if 0) - don't use fallback EmSpace
-    // The actual indent positioning is handled in extractLine()
-  } else if (blockStyle.alignment == CssTextAlign::Justify || blockStyle.alignment == CssTextAlign::Left) {
-    // No CSS text-indent defined - use EmSpace fallback for visual indent
-    words.front().insert(0, "\xe2\x80\x83");
-  }
-}
-
 // Builds break indices while opportunistically splitting the word that would overflow the current line.
 std::vector<size_t> ParsedText::computeHyphenatedLineBreaks(const GfxRenderer& renderer, const int fontId,
                                                             const int pageWidth, std::vector<uint16_t>& wordWidths,
-                                                            std::vector<bool>& continuesVec) {
-  // Calculate first line indent (only for left/justified text).
-  // Positive text-indent (paragraph indent) is suppressed when extraParagraphSpacing is on.
-  // Negative text-indent (hanging indent, e.g. margin-left:3em; text-indent:-1em) always applies —
-  // it is structural (positions the bullet/marker), not decorative.
-  const int firstLineIndent =
-      blockStyle.textIndentDefined && (blockStyle.textIndent < 0 || !extraParagraphSpacing) &&
-              (blockStyle.alignment == CssTextAlign::Justify || blockStyle.alignment == CssTextAlign::Left)
-          ? blockStyle.textIndent
-          : 0;
+                                                            std::vector<bool>& continuesVec,
+                                                            std::vector<bool>& noSpaceBeforeVec) {
+  const int firstLineIndent = resolveFirstLineIndent(true, renderer, fontId);
 
   std::vector<size_t> lineBreakIndices;
   size_t currentIndex = 0;
@@ -466,7 +682,9 @@ std::vector<size_t> ParsedText::computeHyphenatedLineBreaks(const GfxRenderer& r
     while (currentIndex < wordWidths.size()) {
       const bool isFirstWord = currentIndex == lineStart;
       int spacing = 0;
-      if (!isFirstWord && !continuesVec[currentIndex]) {
+      if (!isFirstWord && noSpaceBeforeVec[currentIndex]) {
+        spacing = 0;
+      } else if (!isFirstWord && !continuesVec[currentIndex]) {
         spacing = renderer.getSpaceAdvance(fontId, lastCodepoint(words[currentIndex - 1]),
                                            firstCodepoint(words[currentIndex]), wordStyles[currentIndex - 1]);
       } else if (!isFirstWord && continuesVec[currentIndex]) {
@@ -596,6 +814,7 @@ bool ParsedText::hyphenateWordAtIndex(const size_t wordIndex, const int availabl
   // line, while "kilometer" moves to the next line.
   // wordContinues[wordIndex] is intentionally left unchanged — the prefix keeps its original attachment.
   wordContinues.insert(wordContinues.begin() + wordIndex + 1, false);
+  wordNoSpaceBefore.insert(wordNoSpaceBefore.begin() + wordIndex + 1, false);
 
   // Update cached widths to reflect the new prefix/remainder pairing.
   wordWidths[wordIndex] = static_cast<uint16_t>(chosenWidth);
@@ -605,23 +824,30 @@ bool ParsedText::hyphenateWordAtIndex(const size_t wordIndex, const int availabl
 }
 
 void ParsedText::extractLine(const size_t breakIndex, const int pageWidth, const std::vector<uint16_t>& wordWidths,
-                             const std::vector<bool>& continuesVec, const std::vector<size_t>& lineBreakIndices,
+                             const std::vector<bool>& continuesVec, const std::vector<bool>& noSpaceBeforeVec,
+                             const std::vector<size_t>& lineBreakIndices,
                              const std::function<void(std::shared_ptr<TextBlock>)>& processLine,
                              const GfxRenderer& renderer, const int fontId) {
   const size_t lineBreak = lineBreakIndices[breakIndex];
   const size_t lastBreakAt = breakIndex > 0 ? lineBreakIndices[breakIndex - 1] : 0;
   const size_t lineWordCount = lineBreak - lastBreakAt;
 
-  // Calculate first line indent (only for left/justified text).
-  // Positive text-indent (paragraph indent) is suppressed when extraParagraphSpacing is on.
-  // Negative text-indent (hanging indent, e.g. margin-left:3em; text-indent:-1em) always applies —
-  // it is structural (positions the bullet/marker), not decorative.
-  const bool isFirstLine = breakIndex == 0;
-  const int firstLineIndent =
-      isFirstLine && blockStyle.textIndentDefined && (blockStyle.textIndent < 0 || !extraParagraphSpacing) &&
-              (blockStyle.alignment == CssTextAlign::Justify || blockStyle.alignment == CssTextAlign::Left)
-          ? blockStyle.textIndent
-          : 0;
+  const int firstLineIndent = resolveFirstLineIndent(breakIndex == 0, renderer, fontId);
+
+  // Build line data by moving from the original vectors using index range
+  std::vector<std::string> lineWords;
+  lineWords.reserve(lineWordCount);
+  std::vector<EpdFontFamily::Style> lineWordStyles;
+  lineWordStyles.reserve(lineWordCount);
+
+  for (size_t i = 0; i < lineWordCount; ++i) {
+    std::string word = std::move(words[lastBreakAt + i]);
+    if (containsSoftHyphen(word)) {
+      stripSoftHyphensInPlace(word);
+    }
+    lineWords.push_back(std::move(word));
+    lineWordStyles.push_back(wordStyles[lastBreakAt + i]);
+  }
 
   // Calculate total word width for this line, count actual word gaps,
   // and accumulate total natural gap widths (including space kerning adjustments).
@@ -632,21 +858,23 @@ void ParsedText::extractLine(const size_t breakIndex, const int pageWidth, const
   for (size_t wordIdx = 0; wordIdx < lineWordCount; wordIdx++) {
     lineWordWidthSum += wordWidths[lastBreakAt + wordIdx];
     // Count gaps: each word after the first creates a gap, unless it's a continuation
-    if (wordIdx > 0 && !continuesVec[lastBreakAt + wordIdx]) {
+    if (wordIdx > 0 && noSpaceBeforeVec[lastBreakAt + wordIdx]) {
+      // Unicode break opportunity with no inserted Latin-style space. It is still
+      // a stretchable gap for justified CJK/Korean text.
       actualGapCount++;
-      totalNaturalGaps +=
-          renderer.getSpaceAdvance(fontId, lastCodepoint(words[lastBreakAt + wordIdx - 1]),
-                                   firstCodepoint(words[lastBreakAt + wordIdx]), wordStyles[lastBreakAt + wordIdx - 1]);
+    } else if (wordIdx > 0 && !continuesVec[lastBreakAt + wordIdx]) {
+      actualGapCount++;
+      totalNaturalGaps += renderer.getSpaceAdvance(fontId, lastCodepoint(lineWords[wordIdx - 1]),
+                                                   firstCodepoint(lineWords[wordIdx]), lineWordStyles[wordIdx - 1]);
     } else if (wordIdx > 0 && continuesVec[lastBreakAt + wordIdx]) {
       // Non-breaking space tokens (" " with continues=true) are visible, stretchable spaces —
       // count them as justifiable gaps so justifyExtra is distributed to them too.
-      if (words[lastBreakAt + wordIdx] == " ") {
+      if (lineWords[wordIdx] == " ") {
         actualGapCount++;
       }
       // Cross-boundary kerning for continuation words (e.g. nonbreaking spaces, attached punctuation)
-      totalNaturalGaps +=
-          renderer.getKerning(fontId, lastCodepoint(words[lastBreakAt + wordIdx - 1]),
-                              firstCodepoint(words[lastBreakAt + wordIdx]), wordStyles[lastBreakAt + wordIdx - 1]);
+      totalNaturalGaps += renderer.getKerning(fontId, lastCodepoint(lineWords[wordIdx - 1]),
+                                              firstCodepoint(lineWords[wordIdx]), lineWordStyles[wordIdx - 1]);
     }
   }
 
@@ -654,81 +882,266 @@ void ParsedText::extractLine(const size_t breakIndex, const int pageWidth, const
   const int effectivePageWidth = pageWidth - firstLineIndent;
   const bool isLastLine = breakIndex == lineBreakIndices.size() - 1;
 
+  // For RTL, implicit/default Left alignment becomes Right alignment.
+  // Explicit text-align:left must remain left for CSS correctness.
+  const CssTextAlign effectiveAlignment =
+      (blockStyle.isRtl && !blockStyle.textAlignDefined && blockStyle.alignment == CssTextAlign::Left)
+          ? CssTextAlign::Right
+          : blockStyle.alignment;
+
   // For justified text, compute per-gap extra to distribute remaining space evenly
   const int spareSpace = effectivePageWidth - lineWordWidthSum - totalNaturalGaps;
-  const int justifyExtra = (blockStyle.alignment == CssTextAlign::Justify && !isLastLine && actualGapCount >= 1)
-                               ? spareSpace / static_cast<int>(actualGapCount)
+  const int justifyExtra = (effectiveAlignment == CssTextAlign::Justify && !isLastLine)
+                               ? computeJustifyExtra(spareSpace, actualGapCount)
                                : 0;
 
-  // Calculate initial x position (first line starts at indent for left/justified text;
-  // may be negative for hanging indents, e.g. margin-left:3em; text-indent:-1em).
-  auto xpos = static_cast<int16_t>(firstLineIndent);
-  if (blockStyle.alignment == CssTextAlign::Right) {
-    xpos = effectivePageWidth - lineWordWidthSum - totalNaturalGaps;
-  } else if (blockStyle.alignment == CssTextAlign::Center) {
-    xpos = (effectivePageWidth - lineWordWidthSum - totalNaturalGaps) / 2;
-  }
+  // BiDi processing: reorder words with UAX#9 in full-line context.
+  visualOrderScratch.clear();
+  visualOrderScratch.reserve(lineWordCount);
+  // Skip expensive visual-order resolution for pure LTR paragraphs that have no RTL words.
+  const bool shouldResolveVisualOrder = blockStyle.isRtl || hasRtlWord;
+  const bool willReorder =
+      shouldResolveVisualOrder && BidiUtils::computeVisualWordOrder(lineWords, blockStyle.isRtl, visualOrderScratch);
 
-  // Pre-calculate X positions for words
-  // Continuation words attach to the previous word with no space before them
   std::vector<int16_t> lineXPos;
   lineXPos.reserve(lineWordCount);
 
-  for (size_t wordIdx = 0; wordIdx < lineWordCount; wordIdx++) {
-    lineXPos.push_back(xpos);
+  if (willReorder) {
+    reorderedWordsScratch.clear();
+    reorderedStylesScratch.clear();
+    reorderedWidthsScratch.clear();
+    reorderedContinuesScratch.clear();
+    reorderedNoSpaceBeforeScratch.clear();
+    reorderedFocusSuffixScratch.clear();
+    reorderedWordsScratch.reserve(visualOrderScratch.size());
+    reorderedStylesScratch.reserve(visualOrderScratch.size());
+    reorderedWidthsScratch.reserve(visualOrderScratch.size());
+    reorderedContinuesScratch.reserve(visualOrderScratch.size());
+    reorderedNoSpaceBeforeScratch.reserve(visualOrderScratch.size());
+    reorderedFocusSuffixScratch.reserve(visualOrderScratch.size());
 
-    const bool nextIsContinuation = wordIdx + 1 < lineWordCount && continuesVec[lastBreakAt + wordIdx + 1];
-    if (nextIsContinuation) {
-      int advance = wordWidths[lastBreakAt + wordIdx];
-      // Cross-boundary kerning for continuation words (e.g. nonbreaking spaces, attached punctuation)
-      advance +=
-          renderer.getKerning(fontId, lastCodepoint(words[lastBreakAt + wordIdx]),
-                              firstCodepoint(words[lastBreakAt + wordIdx + 1]), wordStyles[lastBreakAt + wordIdx]);
-      // Non-breaking space tokens are stretchable — expand them during justification like normal spaces.
-      if (words[lastBreakAt + wordIdx] == " " && continuesVec[lastBreakAt + wordIdx] &&
-          blockStyle.alignment == CssTextAlign::Justify && !isLastLine) {
-        advance += justifyExtra;
+    for (size_t i = 0; i < visualOrderScratch.size(); ++i) {
+      const uint16_t src = visualOrderScratch[i];
+      reorderedWordsScratch.push_back(std::move(lineWords[src]));
+      reorderedStylesScratch.push_back(lineWordStyles[src]);
+      reorderedWidthsScratch.push_back(wordWidths[lastBreakAt + src]);
+      reorderedFocusSuffixScratch.push_back(wordIsFocusSuffix[lastBreakAt + src]);
+
+      // Continuation means "no break/gap between two adjacent logical tokens".
+      // After visual reordering (common in RTL), an adjacent logical pair can appear
+      // as either (prev -> curr) or (curr -> prev) in visual order; preserve both.
+      bool continues = false;
+      if (i > 0) {
+        const size_t prevSrc = visualOrderScratch[i - 1];
+        const size_t currSrc = src;
+        const bool forwardAdjacent = currSrc == prevSrc + 1;
+        const bool reverseAdjacent = prevSrc == currSrc + 1;
+
+        if (forwardAdjacent && continuesVec[lastBreakAt + currSrc]) {
+          continues = true;
+        } else if (reverseAdjacent && continuesVec[lastBreakAt + prevSrc]) {
+          continues = true;
+        }
+      }
+      reorderedContinuesScratch.push_back(continues);
+      reorderedNoSpaceBeforeScratch.push_back(!continues && noSpaceBeforeVec[lastBreakAt + src]);
+    }
+
+    int reorderedWordWidthSum = 0;
+    size_t reorderedGapCount = 0;
+    int reorderedNaturalGaps = 0;
+    for (size_t wordIdx = 0; wordIdx < reorderedWidthsScratch.size(); wordIdx++) {
+      reorderedWordWidthSum += reorderedWidthsScratch[wordIdx];
+      if (wordIdx > 0 && reorderedNoSpaceBeforeScratch[wordIdx]) {
+        // Unicode break opportunity with no inserted Latin-style space. It is still
+        // a stretchable gap for justified CJK/Korean text.
+        reorderedGapCount++;
+      } else if (wordIdx > 0 && !reorderedContinuesScratch[wordIdx]) {
+        reorderedGapCount++;
+        reorderedNaturalGaps += renderer.getSpaceAdvance(fontId, lastCodepoint(reorderedWordsScratch[wordIdx - 1]),
+                                                         firstCodepoint(reorderedWordsScratch[wordIdx]),
+                                                         reorderedStylesScratch[wordIdx - 1]);
+      } else if (wordIdx > 0 && reorderedContinuesScratch[wordIdx]) {
+        if (reorderedWordsScratch[wordIdx] == " ") {
+          reorderedGapCount++;
+        }
+        reorderedNaturalGaps +=
+            renderer.getKerning(fontId, lastCodepoint(reorderedWordsScratch[wordIdx - 1]),
+                                firstCodepoint(reorderedWordsScratch[wordIdx]), reorderedStylesScratch[wordIdx - 1]);
+      }
+    }
+
+    const int reorderedSpare = effectivePageWidth - reorderedWordWidthSum - reorderedNaturalGaps;
+    const int reorderedJustifyExtra = (effectiveAlignment == CssTextAlign::Justify && !isLastLine)
+                                          ? computeJustifyExtra(reorderedSpare, reorderedGapCount)
+                                          : 0;
+
+    const int justifyContribution = (effectiveAlignment == CssTextAlign::Justify && !isLastLine)
+                                        ? reorderedJustifyExtra * static_cast<int>(reorderedGapCount)
+                                        : 0;
+    const int contentWidth = reorderedWordWidthSum + reorderedNaturalGaps + justifyContribution;
+
+    int xpos = 0;
+    if (blockStyle.isRtl) {
+      if (effectiveAlignment == CssTextAlign::Right || effectiveAlignment == CssTextAlign::Justify) {
+        xpos = effectivePageWidth - contentWidth;
+      } else if (effectiveAlignment == CssTextAlign::Center) {
+        xpos = (effectivePageWidth - contentWidth) / 2;
       }
-      xpos += advance;
     } else {
-      int gap = 0;
-      if (wordIdx + 1 < lineWordCount) {
-        gap = renderer.getSpaceAdvance(fontId, lastCodepoint(words[lastBreakAt + wordIdx]),
-                                       firstCodepoint(words[lastBreakAt + wordIdx + 1]),
-                                       wordStyles[lastBreakAt + wordIdx]);
+      xpos = firstLineIndent;
+      if (effectiveAlignment == CssTextAlign::Right) {
+        xpos = effectivePageWidth - contentWidth;
+      } else if (effectiveAlignment == CssTextAlign::Center) {
+        xpos = (effectivePageWidth - contentWidth) / 2;
       }
-      if (blockStyle.alignment == CssTextAlign::Justify && !isLastLine) {
-        gap += justifyExtra;
+    }
+
+    for (size_t wordIdx = 0; wordIdx < reorderedWidthsScratch.size(); wordIdx++) {
+      lineXPos.push_back(static_cast<int16_t>(xpos));
+      xpos += reorderedWidthsScratch[wordIdx];
+
+      const bool nextIsContinuation =
+          wordIdx + 1 < reorderedWidthsScratch.size() && reorderedContinuesScratch[wordIdx + 1];
+      if (nextIsContinuation) {
+        int advance =
+            renderer.getKerning(fontId, lastCodepoint(reorderedWordsScratch[wordIdx]),
+                                firstCodepoint(reorderedWordsScratch[wordIdx + 1]), reorderedStylesScratch[wordIdx]);
+        // wordIdx > 0 mirrors the gap accounting above (which skips index 0): a leading
+        // no-break space must not receive justifyExtra, or the line over-stretches by one
+        // gap and the last word is pushed past the right margin (issue #2185).
+        if (wordIdx > 0 && reorderedWordsScratch[wordIdx] == " " && reorderedContinuesScratch[wordIdx] &&
+            effectiveAlignment == CssTextAlign::Justify && !isLastLine) {
+          advance += reorderedJustifyExtra;
+        }
+        xpos += advance;
+      } else if (wordIdx + 1 < reorderedWidthsScratch.size()) {
+        const bool nextNoSpace = reorderedNoSpaceBeforeScratch[wordIdx + 1];
+        int gap = nextNoSpace ? 0
+                              : renderer.getSpaceAdvance(fontId, lastCodepoint(reorderedWordsScratch[wordIdx]),
+                                                         firstCodepoint(reorderedWordsScratch[wordIdx + 1]),
+                                                         reorderedStylesScratch[wordIdx]);
+        if (effectiveAlignment == CssTextAlign::Justify && !isLastLine) {
+          gap += reorderedJustifyExtra;
+        }
+        xpos += gap;
+      }
+    }
+
+    lineWords.swap(reorderedWordsScratch);
+    lineWordStyles.swap(reorderedStylesScratch);
+  } else {
+    // Standard LTR/RTL positioning loop when no visual reordering is needed
+    if (blockStyle.isRtl) {
+      // RTL: position words from right to left
+      int xpos = effectivePageWidth;
+      if (effectiveAlignment == CssTextAlign::Left) {
+        // Explicit left alignment in RTL context
+        xpos = lineWordWidthSum + totalNaturalGaps;
+      } else if (effectiveAlignment == CssTextAlign::Center) {
+        xpos = (effectivePageWidth + lineWordWidthSum + totalNaturalGaps) / 2;
+      }
+      // For Right and Justify, start from right edge (xpos = effectivePageWidth)
+
+      for (size_t wordIdx = 0; wordIdx < lineWordCount; wordIdx++) {
+        xpos -= wordWidths[lastBreakAt + wordIdx];
+        lineXPos.push_back(static_cast<int16_t>(xpos));
+
+        const bool nextIsContinuation = wordIdx + 1 < lineWordCount && continuesVec[lastBreakAt + wordIdx + 1];
+        if (nextIsContinuation) {
+          // Cross-boundary kerning for continuation words
+          int advance = renderer.getKerning(fontId, lastCodepoint(lineWords[wordIdx]),
+                                            firstCodepoint(lineWords[wordIdx + 1]), lineWordStyles[wordIdx]);
+          // wordIdx > 0: see the LTR branch — a leading no-break space is not a justifiable gap.
+          if (wordIdx > 0 && lineWords[wordIdx] == " " && continuesVec[lastBreakAt + wordIdx] &&
+              effectiveAlignment == CssTextAlign::Justify && !isLastLine) {
+            advance += justifyExtra;
+          }
+          xpos -= advance;
+        } else {
+          int gap = 0;
+          bool nextNoSpace = false;
+          if (wordIdx + 1 < lineWordCount) {
+            nextNoSpace = noSpaceBeforeVec[lastBreakAt + wordIdx + 1];
+            gap = nextNoSpace
+                      ? 0
+                      : renderer.getSpaceAdvance(fontId, lastCodepoint(lineWords[wordIdx]),
+                                                 firstCodepoint(lineWords[wordIdx + 1]), lineWordStyles[wordIdx]);
+          }
+          if (wordIdx + 1 < lineWordCount && effectiveAlignment == CssTextAlign::Justify && !isLastLine) {
+            gap += justifyExtra;
+          }
+          xpos -= gap;
+        }
+      }
+    } else {
+      // LTR: position words from left to right
+      int xpos = firstLineIndent;
+      if (effectiveAlignment == CssTextAlign::Right) {
+        xpos = effectivePageWidth - lineWordWidthSum - totalNaturalGaps;
+      } else if (effectiveAlignment == CssTextAlign::Center) {
+        xpos = (effectivePageWidth - lineWordWidthSum - totalNaturalGaps) / 2;
+      }
+
+      for (size_t wordIdx = 0; wordIdx < lineWordCount; wordIdx++) {
+        lineXPos.push_back(static_cast<int16_t>(xpos));
+
+        const bool nextIsContinuation = wordIdx + 1 < lineWordCount && continuesVec[lastBreakAt + wordIdx + 1];
+        if (nextIsContinuation) {
+          int advance = wordWidths[lastBreakAt + wordIdx];
+          advance += renderer.getKerning(fontId, lastCodepoint(lineWords[wordIdx]),
+                                         firstCodepoint(lineWords[wordIdx + 1]), lineWordStyles[wordIdx]);
+          // wordIdx > 0 mirrors the gap accounting above (which skips index 0): a leading
+          // no-break space must not receive justifyExtra, or the line over-stretches by one
+          // gap and the last word is pushed past the right margin (issue #2185).
+          if (wordIdx > 0 && lineWords[wordIdx] == " " && continuesVec[lastBreakAt + wordIdx] &&
+              effectiveAlignment == CssTextAlign::Justify && !isLastLine) {
+            advance += justifyExtra;
+          }
+          xpos += advance;
+        } else {
+          int gap = 0;
+          bool nextNoSpace = false;
+          if (wordIdx + 1 < lineWordCount) {
+            nextNoSpace = noSpaceBeforeVec[lastBreakAt + wordIdx + 1];
+            gap = nextNoSpace
+                      ? 0
+                      : renderer.getSpaceAdvance(fontId, lastCodepoint(lineWords[wordIdx]),
+                                                 firstCodepoint(lineWords[wordIdx + 1]), lineWordStyles[wordIdx]);
+          }
+          if (wordIdx + 1 < lineWordCount && effectiveAlignment == CssTextAlign::Justify && !isLastLine) {
+            gap += justifyExtra;
+          }
+          xpos += wordWidths[lastBreakAt + wordIdx] + gap;
+        }
       }
-      xpos += wordWidths[lastBreakAt + wordIdx] + gap;
     }
   }
 
-  // Build line data by moving from the original vectors using index range
-  std::vector<std::string> lineWords(std::make_move_iterator(words.begin() + lastBreakAt),
-                                     std::make_move_iterator(words.begin() + lineBreak));
-  std::vector<EpdFontFamily::Style> lineWordStyles(wordStyles.begin() + lastBreakAt, wordStyles.begin() + lineBreak);
-
-  for (auto& word : lineWords) {
-    if (containsSoftHyphen(word)) {
-      stripSoftHyphensInPlace(word);
-    }
-  }
+  const auto isFocusSuffixAt = [&](const size_t idx) {
+    return willReorder ? reorderedFocusSuffixScratch[idx] : wordIsFocusSuffix[lastBreakAt + idx];
+  };
 
   // Fast path: when no word on this line was split for focus reading, skip the merge work
   // entirely and pass empty boundary/suffixX vectors. TextBlock pays zero per-word RAM cost
   // for these annotations when the vectors are empty.
   bool lineHasFocusSplit = false;
   for (size_t i = 0; i < lineWordCount; i++) {
-    if (wordIsFocusSuffix[lastBreakAt + i]) {
+    if (isFocusSuffixAt(i)) {
       lineHasFocusSplit = true;
       break;
     }
   }
 
   if (!lineHasFocusSplit) {
-    processLine(std::make_shared<TextBlock>(std::move(lineWords), std::move(lineXPos), std::move(lineWordStyles),
-                                            std::vector<uint8_t>{}, std::vector<uint16_t>{}, blockStyle));
+    // TextBlock flattens the vectors into its arena; they stay owned here and die at return.
+    auto block = std::make_shared<TextBlock>(lineWords, lineXPos, lineWordStyles, std::vector<uint8_t>{},
+                                             std::vector<uint16_t>{}, blockStyle);
+    if (!block->valid()) {
+      LOG_ERR("PTX", "Dropping line: TextBlock arena allocation failed");
+      return;
+    }
+    processLine(std::move(block));
     return;
   }
 
@@ -747,17 +1160,18 @@ void ParsedText::extractLine(const size_t breakIndex, const int pageWidth, const
   outSuffixX.reserve(lineWordCount);
 
   for (size_t i = 0; i < lineWordCount; i++) {
-    if (wordIsFocusSuffix[lastBreakAt + i] && !outWords.empty()) {
+    if (isFocusSuffixAt(i) && !outWords.empty()) {
       // Focus suffix: merge string into the preceding bold-prefix entry.
       outWords.back() += lineWords[i];
     } else {
       // Normal word: check for a following focus suffix to record the byte boundary.
       uint8_t boundary = 0;
       uint16_t suffixX = 0;
-      if (i + 1 < lineWordCount && wordIsFocusSuffix[lastBreakAt + i + 1]) {
+      if (i + 1 < lineWordCount && isFocusSuffixAt(i + 1)) {
         boundary = static_cast<uint8_t>(std::min(lineWords[i].size(), size_t{255}));
         // Suffix x offset = layout-time advance of the bold prefix, already known from xpos table.
-        suffixX = static_cast<uint16_t>(lineXPos[i + 1] - lineXPos[i]);
+        const int suffixDelta = static_cast<int>(lineXPos[i + 1]) - static_cast<int>(lineXPos[i]);
+        suffixX = static_cast<uint16_t>(suffixDelta > 0 ? suffixDelta : 0);
       }
       outWords.push_back(std::move(lineWords[i]));
       outXPos.push_back(lineXPos[i]);
@@ -772,6 +1186,10 @@ void ParsedText::extractLine(const size_t breakIndex, const int pageWidth, const
     }
   }
 
-  processLine(std::make_shared<TextBlock>(std::move(outWords), std::move(outXPos), std::move(outStyles),
-                                          std::move(outBoundaries), std::move(outSuffixX), blockStyle));
+  auto block = std::make_shared<TextBlock>(outWords, outXPos, outStyles, outBoundaries, outSuffixX, blockStyle);
+  if (!block->valid()) {
+    LOG_ERR("PTX", "Dropping line: TextBlock arena allocation failed");
+    return;
+  }
+  processLine(std::move(block));
 }

lib/Epub/Epub/ParsedText.h

@@ -15,22 +15,35 @@ class GfxRenderer;
 class ParsedText {
   std::vector<std::string> words;
   std::vector<EpdFontFamily::Style> wordStyles;
-  std::vector<bool> wordContinues;      // true = word attaches to previous (no space before it)
+  std::vector<bool> wordContinues;      // true = word attaches to previous with no break
+  std::vector<bool> wordNoSpaceBefore;  // true = may break before token, but no synthetic space when joined
   std::vector<bool> wordIsFocusSuffix;  // true = token is the regular tail of a focus bold-prefix split
   BlockStyle blockStyle;
   bool extraParagraphSpacing;
   bool hyphenationEnabled;
   bool focusReadingEnabled;
+  bool isNaturalAlign;
+  bool hasRtlWord;
+  std::vector<std::string> reorderedWordsScratch;
+  std::vector<EpdFontFamily::Style> reorderedStylesScratch;
+  std::vector<uint16_t> reorderedWidthsScratch;
+  std::vector<bool> reorderedContinuesScratch;
+  std::vector<bool> reorderedNoSpaceBeforeScratch;
+  std::vector<bool> reorderedFocusSuffixScratch;
+  std::vector<uint16_t> visualOrderScratch;
 
-  void applyParagraphIndent();
+  int resolveFirstLineIndent(bool isFirstLine, const GfxRenderer& renderer, int fontId) const;
   std::vector<size_t> computeLineBreaks(const GfxRenderer& renderer, int fontId, int pageWidth,
-                                        std::vector<uint16_t>& wordWidths, std::vector<bool>& continuesVec);
+                                        std::vector<uint16_t>& wordWidths, std::vector<bool>& continuesVec,
+                                        std::vector<bool>& noSpaceBeforeVec);
   std::vector<size_t> computeHyphenatedLineBreaks(const GfxRenderer& renderer, int fontId, int pageWidth,
-                                                  std::vector<uint16_t>& wordWidths, std::vector<bool>& continuesVec);
+                                                  std::vector<uint16_t>& wordWidths, std::vector<bool>& continuesVec,
+                                                  std::vector<bool>& noSpaceBeforeVec);
   bool hyphenateWordAtIndex(size_t wordIndex, int availableWidth, const GfxRenderer& renderer, int fontId,
                             std::vector<uint16_t>& wordWidths, bool allowFallbackBreaks);
   void extractLine(size_t breakIndex, int pageWidth, const std::vector<uint16_t>& wordWidths,
-                   const std::vector<bool>& continuesVec, const std::vector<size_t>& lineBreakIndices,
+                   const std::vector<bool>& continuesVec, const std::vector<bool>& noSpaceBeforeVec,
+                   const std::vector<size_t>& lineBreakIndices,
                    const std::function<void(std::shared_ptr<TextBlock>)>& processLine, const GfxRenderer& renderer,
                    int fontId);
   std::vector<uint16_t> calculateWordWidths(const GfxRenderer& renderer, int fontId);
@@ -41,7 +54,9 @@ class ParsedText {
       : blockStyle(blockStyle),
         extraParagraphSpacing(extraParagraphSpacing),
         hyphenationEnabled(hyphenationEnabled),
-        focusReadingEnabled(focusReadingEnabled) {}
+        focusReadingEnabled(focusReadingEnabled),
+        isNaturalAlign(false),
+        hasRtlWord(false) {}
   ~ParsedText() = default;
 
   void addWord(std::string word, EpdFontFamily::Style fontStyle, bool underline = false, bool attachToPrevious = false);
@@ -52,4 +67,4 @@ class ParsedText {
   void layoutAndExtractLines(const GfxRenderer& renderer, int fontId, uint16_t viewportWidth,
                              const std::function<void(std::shared_ptr<TextBlock>)>& processLine,
                              bool includeLastLine = true);
-};
+};

lib/Epub/Epub/Section.cpp

@@ -2,6 +2,7 @@
 
 #include <HalStorage.h>
 #include <Logging.h>
+#include <Memory.h>
 #include <Serialization.h>
 
 #include "Epub/css/CssParser.h"
@@ -10,33 +11,68 @@
 #include "parsers/ChapterHtmlSlimParser.h"
 
 namespace {
-constexpr uint8_t SECTION_FILE_VERSION = 24;
+// v28: text decoration bits now include line-through in serialized wordStyles.
+// v29: TextBlock word data stored as one flat arena (offset table + NUL-terminated
+// text blob) instead of length-prefixed strings and per-field arrays.
+// v30: Arabic shaping changed both drawing and measurement (getTextAdvanceX now
+//      measures the shaped visual text); cached word positions from v29 no longer
+//      match what drawText renders.
+constexpr uint8_t SECTION_FILE_VERSION = 30;
+// Written into the version field while a build is in progress; patched to
+// SECTION_FILE_VERSION only when the build is finalized. An abandoned /
+// crash-interrupted .bin therefore carries version 0, which loadSectionFile rejects
+// as unknown and clears -- so an incomplete file is never mistaken for a valid one.
+constexpr uint8_t SECTION_FILE_INCOMPLETE_VERSION = 0;
+// Written when a build is suspended partway (reader exited or device slept mid-build).
+// The file carries valid pages 0..pageCount-1, all LUTs, and a trailer with the parse
+// watermark (bytesConsumed, totalBytes) appended after the li LUT. loadSectionFile
+// accepts it so a resume shows those pages instantly; the reader extends it by
+// rebuilding in the background. Uses the same header layout as SECTION_FILE_VERSION,
+// so finalized files are untouched by this feature; older firmware treats the sentinel
+// as an unknown version and rebuilds, which is a safe downgrade.
+// MUST change in lockstep with SECTION_FILE_VERSION: the sentinel IS the partial's
+// format version, so a stale-format partial otherwise passes the header check and
+// only fails (noisily, via the block-decode error path) when a page is loaded.
+// Derived so the pairing can't be forgotten: 0xFE for v28, 0xFD for v29, ...
+constexpr uint8_t SECTION_FILE_PARTIAL_VERSION = 0xFE - (SECTION_FILE_VERSION - 28);
 constexpr uint32_t HEADER_SIZE = sizeof(uint8_t) + sizeof(int) + sizeof(float) + sizeof(bool) + sizeof(uint8_t) +
                                  sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint16_t) + sizeof(bool) + sizeof(bool) +
                                  sizeof(uint8_t) + sizeof(bool) + sizeof(uint32_t) + sizeof(uint32_t) +
                                  sizeof(uint32_t) + sizeof(uint32_t);
-
-struct PageLutEntry {
-  uint32_t fileOffset;
-  uint16_t paragraphIndex;
-  uint16_t listItemIndex;
-};
 }  // namespace
 
+// Out-of-line so the unique_ptr<ChapterHtmlSlimParser> in BuildContext can be
+// constructed/destroyed where the parser's full definition is visible.
+Section::Section(const std::shared_ptr<Epub>& epub, const int spineIndex, GfxRenderer& renderer)
+    : epub(epub),
+      spineIndex(spineIndex),
+      renderer(renderer),
+      filePath(epub->getCachePath() + "/sections/" + std::to_string(spineIndex) + ".bin") {}
+
+// Suspend any in-progress build so every section.reset() / navigation / sleep path
+// persists the pages already laid out as a partial .bin instead of discarding them
+// (no-op once a build has completed or never started).
+Section::~Section() { suspendBuild(); }
+
 uint32_t Section::onPageComplete(std::unique_ptr<Page> page) {
   if (!file) {
-    LOG_ERR("SCT", "File not open for writing page %d", pageCount);
+    LOG_ERR("SCT", "File not open for writing page %d", builtPageCount_);
     return 0;
   }
 
   const uint32_t position = file.position();
   if (!page->serialize(file)) {
-    LOG_ERR("SCT", "Failed to serialize page %d", pageCount);
+    LOG_ERR("SCT", "Failed to serialize page %d", builtPageCount_);
     return 0;
   }
-  LOG_DBG("SCT", "Page %d processed", pageCount);
+  LOG_DBG("SCT", "Page %d processed", builtPageCount_);
 
-  pageCount++;
+  builtPageCount_++;
+  // pageCount is the pages available to read: a rebuild over a partial only raises it
+  // once it has laid out more pages than the partial already covers.
+  if (builtPageCount_ > pageCount) {
+    pageCount = builtPageCount_;
+  }
   return position;
 }
 
@@ -55,7 +91,9 @@ void Section::writeSectionFileHeader(const int fontId, const float lineCompressi
                                    sizeof(embeddedStyle) + sizeof(imageRendering) + sizeof(focusReadingEnabled) +
                                    sizeof(uint32_t) + sizeof(uint32_t) + sizeof(uint32_t) + sizeof(uint32_t),
                 "Header size mismatch");
-  serialization::writePod(file, SECTION_FILE_VERSION);
+  // Written as the incomplete sentinel; finalizeBuild() patches it to
+  // SECTION_FILE_VERSION as the last step, committing the file.
+  serialization::writePod(file, SECTION_FILE_INCOMPLETE_VERSION);
   serialization::writePod(file, fontId);
   serialization::writePod(file, lineCompression);
   serialization::writePod(file, extraParagraphSpacing);
@@ -82,16 +120,18 @@ bool Section::loadSectionFile(const int fontId, const float lineCompression, con
   }
 
   // Match parameters
+  bool filePartial = false;
   {
     uint8_t version;
     serialization::readPod(file, version);
-    if (version != SECTION_FILE_VERSION) {
+    if (version != SECTION_FILE_VERSION && version != SECTION_FILE_PARTIAL_VERSION) {
       // Explicit close() required: member variable persists beyond function scope
       file.close();
       LOG_ERR("SCT", "Deserialization failed: Unknown version %u", version);
       clearCache();
       return false;
     }
+    filePartial = (version == SECTION_FILE_PARTIAL_VERSION);
 
     int fileFontId;
     uint16_t fileViewportWidth, fileViewportHeight;
@@ -126,14 +166,42 @@ bool Section::loadSectionFile(const int fontId, const float lineCompression, con
   }
 
   serialization::readPod(file, pageCount);
+
+  if (filePartial) {
+    // A partial's pageCount is the watermark of a suspended build. Read the watermark
+    // trailer (appended after the li LUT) so estimatedTotalPages can extrapolate.
+    uint32_t liLutOffset = 0;
+    file.seek(HEADER_SIZE - sizeof(uint32_t));
+    serialization::readPod(file, liLutOffset);
+    const uint32_t trailerOffset = liLutOffset + static_cast<uint32_t>(pageCount) * sizeof(uint16_t);
+    const bool trailerValid =
+        pageCount > 0 && liLutOffset >= HEADER_SIZE && trailerOffset + 2 * sizeof(uint32_t) <= file.size();
+    if (!trailerValid) {
+      file.close();
+      LOG_ERR("SCT", "Deserialization failed: malformed partial section");
+      clearCache();
+      pageCount = 0;
+      return false;
+    }
+    file.seek(trailerOffset);
+    serialization::readPod(file, partialBytesConsumed_);
+    serialization::readPod(file, partialTotalBytes_);
+    partial_ = true;
+    partialPageCount_ = pageCount;
+  }
+
   // Explicit close() required: member variable persists beyond function scope
   file.close();
-  LOG_DBG("SCT", "Deserialization succeeded: %d pages", pageCount);
+  LOG_DBG("SCT", "Deserialization succeeded: %d pages%s", pageCount, filePartial ? " (partial)" : "");
   return true;
 }
 
 // Your updated class method (assuming you are using the 'SD' object, which is a wrapper for a specific filesystem)
 bool Section::clearCache() const {
+  const std::string tmpBin = binTmpPath();
+  if (Storage.exists(tmpBin.c_str())) {
+    Storage.remove(tmpBin.c_str());
+  }
   if (!Storage.exists(filePath.c_str())) {
     LOG_DBG("SCT", "Cache does not exist, no action needed");
     return true;
@@ -153,8 +221,43 @@ bool Section::createSectionFile(const int fontId, const float lineCompression, c
                                 const uint16_t viewportHeight, const bool hyphenationEnabled, const bool embeddedStyle,
                                 const uint8_t imageRendering, const bool focusReadingEnabled,
                                 const std::function<void()>& popupFn) {
+  // One-shot build: start, then lay out the whole section in a single pass.
+  if (!startBuild(fontId, lineCompression, extraParagraphSpacing, paragraphAlignment, viewportWidth, viewportHeight,
+                  hyphenationEnabled, embeddedStyle, imageRendering, focusReadingEnabled, popupFn)) {
+    return false;
+  }
+  if (!buildSomeMore(0)) {  // 0 = build to completion
+    return false;
+  }
+  return buildComplete_;
+}
+
+bool Section::startBuild(const int fontId, const float lineCompression, const bool extraParagraphSpacing,
+                         const uint8_t paragraphAlignment, const uint16_t viewportWidth, const uint16_t viewportHeight,
+                         const bool hyphenationEnabled, const bool embeddedStyle, const uint8_t imageRendering,
+                         const bool focusReadingEnabled, const std::function<void()>& popupFn) {
+  if (build_) {
+    LOG_ERR("SCT", "startBuild called while a build is already active");
+    return false;
+  }
+  buildComplete_ = false;
+  builtPageCount_ = 0;
+  // Pages from a loaded partial stay readable (from filePath) while this build writes
+  // to the tmp .bin, so availability never drops below the partial's watermark.
+  pageCount = partial_ ? partialPageCount_ : 0;
+
+  // Remove a stale tmp .bin from a crash-interrupted build; this build recreates it.
+  {
+    const std::string staleTmp = binTmpPath();
+    if (Storage.exists(staleTmp.c_str())) {
+      Storage.remove(staleTmp.c_str());
+    }
+  }
+
   const auto localPath = epub->getSpineItem(spineIndex).href;
-  const auto tmpHtmlPath = epub->getCachePath() + "/.tmp_" + std::to_string(spineIndex) + ".html";
+  const auto htmlDir = epub->getCachePath() + "/html";
+  const auto htmlPath = htmlDir + "/" + std::to_string(spineIndex) + ".html";
+  const auto tmpHtmlPath = htmlDir + "/.tmp_" + std::to_string(spineIndex) + ".html";
 
   // Create cache directory if it doesn't exist
   {
@@ -162,162 +265,523 @@ bool Section::createSectionFile(const int fontId, const float lineCompression, c
     Storage.mkdir(sectionsDir.c_str());
   }
 
-  // Retry logic for SD card timing issues
-  bool success = false;
-  uint32_t fileSize = 0;
-  for (int attempt = 0; attempt < 3 && !success; attempt++) {
-    if (attempt > 0) {
-      LOG_DBG("SCT", "Retrying stream (attempt %d)...", attempt + 1);
-      delay(50);  // Brief delay before retry
+  // Reuse the previously unzipped HTML if we already have it. The unzipped HTML is keyed only on the
+  // book (it lives in the per-book cache dir), not on render settings, so it survives the invalidation
+  // that wipes the layout (.bin) caches when font/margin/orientation change -- rebuilds then skip zip
+  // inflation entirely. It's promoted by an atomic rename as soon as the inflate succeeds (below), so
+  // even a window-only giant spine -- whose .bin never finalizes -- still caches its HTML, letting a
+  // reopen skip the multi-second inflate. If htmlPath exists it is known-complete.
+  const bool reusedHtml = Storage.exists(htmlPath.c_str());
+  bool htmlCached = reusedHtml;
+  if (reusedHtml) {
+    LOG_DBG("SCT", "Reusing cached HTML %s", htmlPath.c_str());
+  } else {
+    Storage.mkdir(htmlDir.c_str());
+
+    // Retry logic for SD card timing issues
+    bool streamed = false;
+    uint32_t fileSize = 0;
+    for (int attempt = 0; attempt < 3 && !streamed; attempt++) {
+      if (attempt > 0) {
+        LOG_DBG("SCT", "Retrying stream (attempt %d)...", attempt + 1);
+        delay(50);  // Brief delay before retry
+      }
+
+      // Remove any incomplete file from previous attempt before retrying
+      if (Storage.exists(tmpHtmlPath.c_str())) {
+        Storage.remove(tmpHtmlPath.c_str());
+      }
+
+      HalFile tmpHtml;
+      if (!Storage.openFileForWrite("SCT", tmpHtmlPath, tmpHtml)) {
+        continue;
+      }
+      // Larger chunks mean far fewer SD writes inflating the HTML; a 1KB chunk turned a 584KB
+      // single-spine novel into ~570 tiny writes (multi-second). 8KB keeps the transient buffers
+      // small while cutting the write count 8x.
+      streamed = epub->readItemContentsToStream(localPath, tmpHtml, 8192);
+      fileSize = tmpHtml.size();
+      // Explicitly close() file before calling Storage.remove()
+      tmpHtml.close();
+
+      // If streaming failed, remove the incomplete file immediately
+      if (!streamed && Storage.exists(tmpHtmlPath.c_str())) {
+        Storage.remove(tmpHtmlPath.c_str());
+        LOG_DBG("SCT", "Removed incomplete temp file after failed attempt");
+      }
     }
 
-    // Remove any incomplete file from previous attempt before retrying
-    if (Storage.exists(tmpHtmlPath.c_str())) {
-      Storage.remove(tmpHtmlPath.c_str());
+    if (!streamed) {
+      LOG_ERR("SCT", "Failed to stream item contents to temp file after retries");
+      return false;
     }
 
-    FsFile tmpHtml;
-    if (!Storage.openFileForWrite("SCT", tmpHtmlPath, tmpHtml)) {
-      continue;
-    }
-    success = epub->readItemContentsToStream(localPath, tmpHtml, 1024);
-    fileSize = tmpHtml.size();
-    // Explicitly close() file before calling Storage.remove()
-    tmpHtml.close();
+    LOG_DBG("SCT", "Streamed temp HTML to %s (%d bytes)", tmpHtmlPath.c_str(), fileSize);
 
-    // If streaming failed, remove the incomplete file immediately
-    if (!success && Storage.exists(tmpHtmlPath.c_str())) {
-      Storage.remove(tmpHtmlPath.c_str());
-      LOG_DBG("SCT", "Removed incomplete temp file after failed attempt");
+    // Promote to the persistent HTML cache immediately -- the inflate is complete and the bytes are
+    // valid regardless of whether the layout build finishes, so reopening (even a window-only spine
+    // that never finalizes its .bin) skips re-inflation. If the rename fails we just parse the temp.
+    if (Storage.rename(tmpHtmlPath.c_str(), htmlPath.c_str())) {
+      htmlCached = true;
+    } else {
+      LOG_DBG("SCT", "Failed to promote HTML cache; parsing from temp");
     }
   }
 
-  if (!success) {
-    LOG_ERR("SCT", "Failed to stream item contents to temp file after retries");
-    return false;
-  }
-
-  LOG_DBG("SCT", "Streamed temp HTML to %s (%d bytes)", tmpHtmlPath.c_str(), fileSize);
-
-  if (!Storage.openFileForWrite("SCT", filePath, file)) {
+  if (!Storage.openFileForWrite("SCT", binTmpPath(), file)) {
+    if (!reusedHtml) Storage.remove(tmpHtmlPath.c_str());
     return false;
   }
+  // Header is written with the incomplete-version sentinel; finalizeBuild() commits it.
   writeSectionFileHeader(fontId, lineCompression, extraParagraphSpacing, paragraphAlignment, viewportWidth,
                          viewportHeight, hyphenationEnabled, embeddedStyle, imageRendering, focusReadingEnabled);
-  std::vector<PageLutEntry> lut = {};
+
+  auto ctx = makeUniqueNoThrow<BuildContext>();
+  if (!ctx) {
+    LOG_ERR("SCT", "OOM: BuildContext");
+    file.close();
+    Storage.remove(binTmpPath().c_str());
+    if (!reusedHtml) Storage.remove(tmpHtmlPath.c_str());
+    return false;
+  }
+  // htmlCached == "htmlPath is the live cache" (reused, or just promoted). finalizeBuild/abandonBuild
+  // then leave the cached HTML alone; only an un-promoted temp (rename failed) is theirs to clean up.
+  ctx->reusedHtml = htmlCached;
+  ctx->htmlPath = htmlPath;
+  ctx->tmpHtmlPath = tmpHtmlPath;
+  ctx->parsePath = htmlCached ? htmlPath : tmpHtmlPath;
 
   // Derive the content base directory and image cache path prefix for the parser
-  size_t lastSlash = localPath.find_last_of('/');
-  std::string contentBase = (lastSlash != std::string::npos) ? localPath.substr(0, lastSlash + 1) : "";
-  std::string imageBasePath = epub->getCachePath() + "/img_" + std::to_string(spineIndex) + "_";
+  const size_t lastSlash = localPath.find_last_of('/');
+  ctx->contentBase = (lastSlash != std::string::npos) ? localPath.substr(0, lastSlash + 1) : "";
+  ctx->imageBasePath = epub->getCachePath() + "/img_" + std::to_string(spineIndex) + "_";
 
-  CssParser* cssParser = nullptr;
   if (embeddedStyle) {
-    cssParser = epub->getCssParser();
-    if (cssParser) {
-      if (!cssParser->loadFromCache()) {
-        LOG_ERR("SCT", "Failed to load CSS from cache");
+    ctx->cssParser = epub->getCssParser();
+    if (ctx->cssParser && !ctx->cssParser->loadFromCache()) {
+      LOG_ERR("SCT", "Failed to load CSS from cache");
+    }
+  }
+
+  // Collect TOC anchors for this spine so the parser can insert page breaks at chapter boundaries
+  std::vector<std::string> tocAnchors;
+  const int startTocIndex = epub->getTocIndexForSpineIndex(spineIndex);
+  if (startTocIndex >= 0) {
+    for (int i = startTocIndex; i < epub->getTocItemsCount(); i++) {
+      auto entry = epub->getTocItem(i);
+      if (entry.spineIndex != spineIndex) break;
+      if (!entry.anchor.empty()) {
+        tocAnchors.push_back(std::move(entry.anchor));
       }
     }
   }
 
-  ChapterHtmlSlimParser visitor(
-      epub, tmpHtmlPath, renderer, fontId, lineCompression, extraParagraphSpacing, paragraphAlignment, viewportWidth,
-      viewportHeight, hyphenationEnabled, focusReadingEnabled,
-      [this, &lut](std::unique_ptr<Page> page, const uint16_t paragraphIndex, const uint16_t listItemIndex) {
-        lut.push_back({this->onPageComplete(std::move(page)), paragraphIndex, listItemIndex});
+  // The parser stores the path/contentBase/imageBasePath by reference, so they must
+  // live in the BuildContext (which outlives the parser). The page-complete callback
+  // captures the BuildContext pointer to append to its in-RAM LUT; build_ owns the
+  // context for the parser's whole lifetime.
+  BuildContext* ctxPtr = ctx.get();
+  ctx->parser = makeUniqueNoThrow<ChapterHtmlSlimParser>(
+      epub, ctxPtr->parsePath, renderer, fontId, lineCompression, extraParagraphSpacing, paragraphAlignment,
+      viewportWidth, viewportHeight, hyphenationEnabled, focusReadingEnabled,
+      [this, ctxPtr](std::unique_ptr<Page> page, const uint16_t paragraphIndex, const uint16_t listItemIndex) {
+        ctxPtr->lut.push_back({this->onPageComplete(std::move(page)), paragraphIndex, listItemIndex});
       },
-      embeddedStyle, contentBase, imageBasePath, imageRendering, popupFn, cssParser);
-  Hyphenator::setPreferredLanguage(epub->getLanguage());
-  success = visitor.parseAndBuildPages();
-
-  Storage.remove(tmpHtmlPath.c_str());
-  if (!success) {
-    LOG_ERR("SCT", "Failed to parse XML and build pages");
-    // Explicitly close() file before calling Storage.remove()
+      embeddedStyle, ctxPtr->contentBase, ctxPtr->imageBasePath, imageRendering, std::move(tocAnchors), popupFn,
+      ctxPtr->cssParser);
+  if (!ctx->parser) {
+    LOG_ERR("SCT", "OOM: ChapterHtmlSlimParser");
+    if (ctx->cssParser) ctx->cssParser->clear();
     file.close();
-    Storage.remove(filePath.c_str());
-    if (cssParser) {
-      cssParser->clear();
-    }
+    Storage.remove(binTmpPath().c_str());
+    if (!reusedHtml) Storage.remove(tmpHtmlPath.c_str());
     return false;
   }
 
+  Hyphenator::setPreferredLanguage(epub->getLanguage());
+  build_ = std::move(ctx);
+
+  if (!build_->parser->beginParse()) {
+    LOG_ERR("SCT", "Failed to begin parse");
+    abandonBuild();
+    return false;
+  }
+  build_->totalBytes = build_->parser->parseTotalBytes();
+  return true;
+}
+
+bool Section::buildSomeMore(const int maxPages) {
+  if (!build_ || !build_->parser) {
+    LOG_ERR("SCT", "buildSomeMore with no active build");
+    return false;
+  }
+  // Pace on pages laid out by THIS build, not pageCount: during a rebuild over a partial,
+  // pageCount stays pinned at the partial's watermark until the build passes it, which
+  // would otherwise turn one "small" chunk into a blocking rebuild of the whole watermark.
+  const int startCount = builtPageCount_;
+  for (;;) {
+    const auto status = build_->parser->parseStep();
+    if (status == ChapterHtmlSlimParser::ParseStatus::Error) {
+      LOG_ERR("SCT", "Parse error during incremental build");
+      abandonBuild();
+      return false;
+    }
+    if (status == ChapterHtmlSlimParser::ParseStatus::Done) {
+      return finalizeBuild();
+    }
+    // ParseStatus::More: yield once we've laid out the requested number of pages.
+    if (maxPages > 0 && (builtPageCount_ - startCount) >= maxPages) {
+      build_->bytesConsumed = build_->parser->parseBytesConsumed();
+      return true;
+    }
+  }
+}
+
+bool Section::hasHtmlCache() const {
+  const std::string htmlPath = epub->getCachePath() + "/html/" + std::to_string(spineIndex) + ".html";
+  return Storage.exists(htmlPath.c_str());
+}
+
+std::optional<uint16_t> Section::findAnchorDuringBuild(const std::string& anchor) const {
+  if (!build_ || !build_->parser) return std::nullopt;
+  for (const auto& [key, page] : build_->parser->getAnchors()) {
+    if (key == anchor) return page;
+  }
+  return std::nullopt;
+}
+
+std::optional<uint16_t> Section::findAnchor(const std::string& anchor) const {
+  if (const auto page = findAnchorDuringBuild(anchor)) {
+    return page;
+  }
+  // Fall back to the on-disk anchor map: a finalized section, or a partial whose map
+  // covers everything up to its watermark (nullopt past it -- build further and retry).
+  return getPageForAnchor(anchor);
+}
+
+uint16_t Section::estimatedTotalPages() const {
+  // Extrapolation from a suspended session's watermark trailer. A static snapshot, so no EMA
+  // damping is needed. Also the best guess while a rebuild is running but hasn't laid out
+  // enough pages yet to extrapolate from its own progress.
+  const auto partialEstimate = [this]() -> uint16_t {
+    if (!partial_ || partialBytesConsumed_ == 0 || partialTotalBytes_ <= partialBytesConsumed_) {
+      return pageCount;
+    }
+    const uint64_t est = static_cast<uint64_t>(partialPageCount_) * partialTotalBytes_ / partialBytesConsumed_;
+    if (est <= pageCount) return pageCount;
+    return est > 60000 ? 60000 : static_cast<uint16_t>(est);
+  };
+
+  if (!build_) {
+    return partial_ ? partialEstimate() : pageCount;  // partial -> extrapolate, finalized -> exact
+  }
+  const uint32_t consumed = build_->bytesConsumed;
+  const uint32_t total = build_->totalBytes;
+  if (builtPageCount_ == 0 || consumed == 0 || total <= consumed) return partialEstimate();
+
+  // Raw extrapolation: scale the pages built so far by the fraction of HTML still unparsed. This
+  // re-derives from a growing, non-uniform sample, so it jitters up and down as the build crosses
+  // dense vs sparse regions of the chapter.
+  const uint64_t raw = static_cast<uint64_t>(builtPageCount_) * total / consumed;
+
+  // Damp that jitter with an exponential moving average. Step it once per build advance (keyed on
+  // bytesConsumed) rather than per status-bar redraw, so the smoothing rate doesn't depend on how
+  // often we repaint. As the build nears the end, consumed -> total and raw -> the built count, so
+  // the average settles onto the true count (and finalizeBuild then returns the exact pageCount).
+  constexpr float ALPHA = 0.25f;  // weight of each new sample; lower = steadier but slower to settle
+  if (build_->smoothedEstimate <= 0) {
+    build_->smoothedEstimate = static_cast<float>(raw);  // seed on the first estimate
+  } else if (consumed != build_->smoothedAtConsumed) {
+    build_->smoothedEstimate += ALPHA * (static_cast<float>(raw) - build_->smoothedEstimate);
+  }
+  build_->smoothedAtConsumed = consumed;
+
+  const uint64_t est = static_cast<uint64_t>(build_->smoothedEstimate + 0.5f);
+  if (est <= pageCount) return pageCount;  // never fewer than the pages already available
+  return est > 60000 ? 60000 : static_cast<uint16_t>(est);
+}
+
+// Write the LUTs and anchor map into the open tmp .bin, patch the header with the built
+// page count and table offsets, stamp `version` as the commit point, then swap the tmp
+// file over filePath. For SECTION_FILE_PARTIAL_VERSION a watermark trailer
+// (bytesConsumed, totalBytes) is appended after the li LUT so a later open can estimate
+// the total page count. The parser must still be alive (anchors are read from it).
+// On failure the tmp is removed and any pre-existing file at filePath is left intact.
+bool Section::commitBuildFile(const uint8_t version, const uint32_t bytesConsumed, const uint32_t totalBytes) {
+  const bool asPartial = (version == SECTION_FILE_PARTIAL_VERSION);
+
+  const auto failCommit = [this]() {
+    // Explicit close() required before remove (member variable, O_RDWR handle).
+    file.close();
+    Storage.remove(binTmpPath().c_str());
+    return false;
+  };
+
   const uint32_t lutOffset = file.position();
-  bool hasFailedLutRecords = false;
-  // Write LUT
-  for (const auto& entry : lut) {
+  for (const auto& entry : build_->lut) {
     if (entry.fileOffset == 0) {
-      hasFailedLutRecords = true;
-      break;
+      LOG_ERR("SCT", "Failed to write LUT due to invalid page positions");
+      return failCommit();
     }
     serialization::writePod(file, entry.fileOffset);
   }
 
-  if (hasFailedLutRecords) {
-    LOG_ERR("SCT", "Failed to write LUT due to invalid page positions");
-    // Explicitly close() file before calling Storage.remove()
-    file.close();
-    Storage.remove(filePath.c_str());
-    return false;
-  }
-
-  // Write anchor-to-page map for fragment navigation (e.g. footnote targets)
+  // Write anchor-to-page map for fragment navigation (e.g. footnote targets). For a
+  // partial, skip anchors that landed on the incomplete trailing page the suspend drops.
   const uint32_t anchorMapOffset = file.position();
-  const auto& anchors = visitor.getAnchors();
-  serialization::writePod(file, static_cast<uint16_t>(anchors.size()));
+  const auto& anchors = build_->parser->getAnchors();
+  uint16_t anchorCount = 0;
   for (const auto& [anchor, page] : anchors) {
+    if (!asPartial || page < builtPageCount_) anchorCount++;
+  }
+  serialization::writePod(file, anchorCount);
+  for (const auto& [anchor, page] : anchors) {
+    if (asPartial && page >= builtPageCount_) continue;
     serialization::writeString(file, anchor);
     serialization::writePod(file, page);
   }
 
   const uint32_t paragraphLutOffset = file.position();
-  serialization::writePod(file, static_cast<uint16_t>(lut.size()));
-  for (const auto& entry : lut) {
+  serialization::writePod(file, static_cast<uint16_t>(build_->lut.size()));
+  for (const auto& entry : build_->lut) {
     serialization::writePod(file, entry.paragraphIndex);
   }
 
   const uint32_t liLutFileOffset = static_cast<uint32_t>(file.position());
-  for (const auto& entry : lut) {
+  for (const auto& entry : build_->lut) {
     serialization::writePod(file, entry.listItemIndex);
   }
 
-  // Patch header with final pageCount, lutOffset, anchorMapOffset, paragraphLutOffset, and liLutOffset
-  file.seek(HEADER_SIZE - sizeof(uint32_t) * 4 - sizeof(pageCount));
-  serialization::writePod(file, pageCount);
+  if (asPartial) {
+    // Watermark trailer, located on load as liLutOffset + pageCount * sizeof(uint16_t).
+    serialization::writePod(file, bytesConsumed);
+    serialization::writePod(file, totalBytes);
+  }
+
+  // Patch header with the built page count and section offsets...
+  file.seek(HEADER_SIZE - sizeof(uint32_t) * 4 - sizeof(builtPageCount_));
+  serialization::writePod(file, builtPageCount_);
   serialization::writePod(file, lutOffset);
   serialization::writePod(file, anchorMapOffset);
   serialization::writePod(file, paragraphLutOffset);
   serialization::writePod(file, liLutFileOffset);
+  // ...then commit by overwriting the sentinel version with the real one. Writing the
+  // version last makes it the commit point: a crash before here leaves version 0.
+  file.seek(0);
+  serialization::writePod(file, version);
   // Explicit close() required: member variable persists beyond function scope
   file.close();
-  if (cssParser) {
-    cssParser->clear();
+
+  // Swap into place. A crash between remove and rename loses the old file but keeps a
+  // fully-committed tmp; the next build just removes it and rebuilds.
+  if (Storage.exists(filePath.c_str())) {
+    Storage.remove(filePath.c_str());
+  }
+  if (!Storage.rename(binTmpPath().c_str(), filePath.c_str())) {
+    LOG_ERR("SCT", "Failed to move built section into place");
+    Storage.remove(binTmpPath().c_str());
+    return false;
   }
   return true;
 }
 
-std::unique_ptr<Page> Section::loadPageFromSectionFile() {
-  if (!Storage.openFileForRead("SCT", filePath, file)) {
+bool Section::finalizeBuild() {
+  // Flush the trailing page (emits the last page via the completePageFn into the LUT).
+  build_->parser->finishParse();
+
+  if (!build_->reusedHtml) {
+    // Parse succeeded: promote the freshly unzipped HTML to the persistent cache so future
+    // rebuilds skip zip inflation. If promotion fails, drop the temp -- the build still succeeded.
+    if (!Storage.rename(build_->tmpHtmlPath.c_str(), build_->htmlPath.c_str())) {
+      LOG_DBG("SCT", "Failed to promote HTML cache, removing temp");
+      Storage.remove(build_->tmpHtmlPath.c_str());
+    }
+  }
+
+  const bool committed = commitBuildFile(SECTION_FILE_VERSION, 0, 0);
+  if (build_->cssParser) build_->cssParser->clear();
+  build_.reset();
+  if (!committed) {
+    // commitBuildFile removed filePath before the failed swap, so nothing valid remains.
+    partial_ = false;
+    partialPageCount_ = 0;
+    pageCount = 0;
+    builtPageCount_ = 0;
+    return false;
+  }
+  buildComplete_ = true;
+  partial_ = false;
+  partialPageCount_ = 0;
+  pageCount = builtPageCount_;
+  return true;
+}
+
+void Section::suspendBuild() {
+  if (!build_) return;
+
+  // Only worth persisting if this build produced pages a pre-existing partial doesn't
+  // already cover; otherwise keep the older (bigger) partial and just drop the tmp.
+  const bool worthKeeping = builtPageCount_ > 0 && (!partial_ || builtPageCount_ > partialPageCount_);
+
+  bool committed = false;
+  if (worthKeeping) {
+    // Capture the parse watermark and commit before tearing the parser down (the anchor
+    // map is read from it). The incomplete trailing page is intentionally not flushed:
+    // only fully laid-out pages are persisted, and the rebuild re-derives the rest.
+    const uint32_t consumed = static_cast<uint32_t>(build_->parser->parseBytesConsumed());
+    committed = commitBuildFile(SECTION_FILE_PARTIAL_VERSION, consumed, build_->totalBytes);
+    if (committed) {
+      partial_ = true;
+      partialPageCount_ = builtPageCount_;
+      partialBytesConsumed_ = consumed;
+      partialTotalBytes_ = build_->totalBytes;
+      LOG_INF("SCT", "Suspended build: %u pages persisted", builtPageCount_);
+    }
+  }
+
+  if (build_->parser) build_->parser->abortParse();
+  if (build_->cssParser) build_->cssParser->clear();
+  if (!committed && file) {
+    // Explicit close() required before remove (member variable, O_RDWR handle).
+    file.close();
+    Storage.remove(binTmpPath().c_str());
+  }
+  if (!build_->reusedHtml && Storage.exists(build_->tmpHtmlPath.c_str())) {
+    Storage.remove(build_->tmpHtmlPath.c_str());
+  }
+  build_.reset();
+  buildComplete_ = false;
+  pageCount = partial_ ? partialPageCount_ : 0;
+  builtPageCount_ = 0;
+}
+
+void Section::abandonBuild() {
+  if (!build_) return;
+  if (build_->parser) build_->parser->abortParse();
+  if (build_->cssParser) build_->cssParser->clear();
+  if (file) {
+    // Explicit close() required before remove (member variable, O_RDWR handle).
+    file.close();
+    Storage.remove(binTmpPath().c_str());
+  }
+  // A parse error would recur against the same HTML, so drop any partial too -- resuming
+  // from it would just re-enter the failing build every open.
+  if (Storage.exists(filePath.c_str())) {
+    Storage.remove(filePath.c_str());
+  }
+  if (!build_->reusedHtml && Storage.exists(build_->tmpHtmlPath.c_str())) {
+    Storage.remove(build_->tmpHtmlPath.c_str());
+  }
+  build_.reset();
+  buildComplete_ = false;
+  partial_ = false;
+  partialPageCount_ = 0;
+  pageCount = 0;
+  builtPageCount_ = 0;
+}
+
+std::unique_ptr<Page> Section::loadPageDuringBuild(const int page) {
+  if (!build_ || page < 0 || page >= static_cast<int>(build_->lut.size()) || !file) {
+    return nullptr;
+  }
+  const uint32_t pos = build_->lut[page].fileOffset;
+  if (pos == 0) {
+    return nullptr;
+  }
+  // The .bin is open O_RDWR for the build. Read the already-written page, then restore
+  // the write cursor so the next onPageComplete keeps appending where it left off.
+  const uint32_t writePos = file.position();
+  file.seek(pos);
+  auto p = Page::deserialize(file);
+  file.seek(writePos);
+  return p;
+}
+
+// Read a page from the committed file at filePath (finalized section or partial from a
+// previous session). Uses a local handle so it is safe while a build holds the member
+// `file` open on the tmp .bin.
+std::unique_ptr<Page> Section::loadPageAt(const int page) const {
+  HalFile f;
+  if (!Storage.openFileForRead("SCT", filePath, f)) {
     return nullptr;
   }
 
-  file.seek(HEADER_SIZE - sizeof(uint32_t) * 4);
+  f.seek(HEADER_SIZE - sizeof(uint32_t) * 4);
   uint32_t lutOffset;
-  serialization::readPod(file, lutOffset);
-  file.seek(lutOffset + sizeof(uint32_t) * currentPage);
+  serialization::readPod(f, lutOffset);
+  f.seek(lutOffset + sizeof(uint32_t) * page);
   uint32_t pagePos;
-  serialization::readPod(file, pagePos);
-  file.seek(pagePos);
+  serialization::readPod(f, pagePos);
+  f.seek(pagePos);
 
-  auto page = Page::deserialize(file);
-  // Explicit close() required: member variable persists beyond function scope
-  file.close();
-  return page;
+  return Page::deserialize(f);
+  // No f.close() needed -- DESTRUCTOR_CLOSES_FILE=1 handles it at scope exit
+}
+
+std::unique_ptr<Page> Section::loadPage(const int page) {
+  if (page < 0) {
+    return nullptr;
+  }
+  if (build_ && page < static_cast<int>(build_->lut.size())) {
+    return loadPageDuringBuild(page);
+  }
+  // Not (yet) in the active build: serve from the file on disk -- a finalized section,
+  // or a partial from a previous session whose pages the rebuild hasn't reached again.
+  const int onDisk = partial_ ? partialPageCount_ : (build_ ? 0 : pageCount);
+  if (page >= onDisk) {
+    return nullptr;
+  }
+  return loadPageAt(page);
+}
+
+std::string Section::getTextFromSectionFile() {
+  std::string fullText;
+  auto p = loadPage(currentPage);
+  if (p) {
+    for (const auto& el : p->elements) {
+      if (el->getTag() == TAG_PageLine) {
+        const auto& line = static_cast<const PageLine&>(*el);
+        if (line.getBlock()) {
+          const auto& block = *line.getBlock();
+          for (uint16_t i = 0; i < block.wordCount(); i++) {
+            if (!fullText.empty()) fullText += " ";
+            fullText += block.wordText(i);
+          }
+        }
+      }
+    }
+  }
+  return fullText;
+}
+
+std::optional<uint16_t> Section::getCachedPageCount() const {
+  HalFile f;
+  if (!Storage.openFileForRead("SCT", filePath, f)) {
+    return std::nullopt;
+  }
+
+  const uint32_t fileSize = f.size();
+  if (fileSize < HEADER_SIZE) {
+    return std::nullopt;
+  }
+
+  // Only a finalized section's count is the chapter total; a partial's count is just the
+  // suspended build's watermark, which would skew progress mapping. Callers fall back to
+  // their own estimates.
+  uint8_t version;
+  serialization::readPod(f, version);
+  if (version != SECTION_FILE_VERSION) {
+    return std::nullopt;
+  }
+
+  f.seek(HEADER_SIZE - sizeof(uint32_t) * 4 - sizeof(uint16_t));
+  uint16_t count;
+  serialization::readPod(f, count);
+  return count;
 }
 
 std::optional<uint16_t> Section::getPageForAnchor(const std::string& anchor) const {
-  FsFile f;
+  HalFile f;
   if (!Storage.openFileForRead("SCT", filePath, f)) {
     return std::nullopt;
   }
@@ -347,7 +811,7 @@ std::optional<uint16_t> Section::getPageForAnchor(const std::string& anchor) con
 }
 
 std::optional<uint16_t> Section::getPageForParagraphIndex(const uint16_t pIndex) const {
-  FsFile f;
+  HalFile f;
   if (!Storage.openFileForRead("SCT", filePath, f)) {
     return std::nullopt;
   }
@@ -386,7 +850,7 @@ std::optional<uint16_t> Section::getPageForParagraphIndex(const uint16_t pIndex)
 }
 
 std::optional<uint16_t> Section::getParagraphIndexForPage(const uint16_t page) const {
-  FsFile f;
+  HalFile f;
   if (!Storage.openFileForRead("SCT", filePath, f)) {
     return std::nullopt;
   }
@@ -418,7 +882,7 @@ std::optional<uint16_t> Section::getParagraphIndexForPage(const uint16_t page) c
 }
 
 std::optional<uint16_t> Section::getPageForListItemIndex(const uint16_t liIndex) const {
-  FsFile f;
+  HalFile f;
   if (!Storage.openFileForRead("SCT", filePath, f)) {
     return std::nullopt;
   }

lib/Epub/Epub/Section.h

@@ -3,34 +3,89 @@
 #include <memory>
 #include <optional>
 #include <string>
+#include <vector>
 
 #include "Epub.h"
 
 class Page;
 class GfxRenderer;
+class ChapterHtmlSlimParser;
+class CssParser;
 
 class Section {
   std::shared_ptr<Epub> epub;
   const int spineIndex;
   GfxRenderer& renderer;
   std::string filePath;
-  FsFile file;
+  HalFile file;
 
   void writeSectionFileHeader(int fontId, float lineCompression, bool extraParagraphSpacing, uint8_t paragraphAlignment,
                               uint16_t viewportWidth, uint16_t viewportHeight, bool hyphenationEnabled,
                               bool embeddedStyle, uint8_t imageRendering, bool focusReadingEnabled);
   uint32_t onPageComplete(std::unique_ptr<Page> page);
 
+  // Page-offset table entry, kept in RAM while an incremental build is running so
+  // already-built pages can be located in the partially-written .bin.
+  struct PageLutEntry {
+    uint32_t fileOffset;
+    uint16_t paragraphIndex;
+    uint16_t listItemIndex;
+  };
+  // Held only while an incremental build is in progress (see startBuild). Carries the
+  // live parser plus the strings it references (the parser stores them by reference)
+  // and the in-RAM page-offset table.
+  struct BuildContext {
+    std::unique_ptr<ChapterHtmlSlimParser> parser;
+    std::vector<PageLutEntry> lut;
+    std::string parsePath;
+    std::string contentBase;
+    std::string imageBasePath;
+    std::string htmlPath;
+    std::string tmpHtmlPath;
+    bool reusedHtml = false;
+    CssParser* cssParser = nullptr;
+    // HTML byte progress, for estimating the section's total page count while it's still building.
+    uint32_t bytesConsumed = 0;
+    uint32_t totalBytes = 0;
+    // Exponentially-smoothed page-count estimate (0 = not yet seeded) and the bytesConsumed at its
+    // last update. The raw byte-ratio estimate jitters as the build crosses dense/sparse regions;
+    // the EMA is stepped once per build advance (not per redraw) to damp that wobble.
+    float smoothedEstimate = 0;
+    uint32_t smoothedAtConsumed = 0;
+  };
+  std::unique_ptr<BuildContext> build_;
+  bool buildComplete_ = false;
+  // Pages laid out by the active build (== build_->lut.size()). Distinct from pageCount,
+  // which is the pages *available to read* and also counts a loaded partial file's pages.
+  uint16_t builtPageCount_ = 0;
+  // A partial section file (suspended build from a previous session) is loaded at filePath.
+  // Its pages 0..partialPageCount_-1 are readable while a rebuild extends past them.
+  bool partial_ = false;
+  uint16_t partialPageCount_ = 0;
+  // Parse watermark from the partial's trailer, for estimating the total page count.
+  uint32_t partialBytesConsumed_ = 0;
+  uint32_t partialTotalBytes_ = 0;
+  bool finalizeBuild();
+  // Write the LUTs/anchor map (and, for a partial, the watermark trailer), patch the
+  // header, stamp the version byte, and swap the tmp .bin over filePath.
+  bool commitBuildFile(uint8_t version, uint32_t bytesConsumed, uint32_t totalBytes);
+  // Builds write here and are swapped over filePath only on commit, so a prior
+  // partial/finalized file stays readable while a rebuild is in progress.
+  std::string binTmpPath() const { return filePath + ".part"; }
+
+  std::unique_ptr<Page> loadPageAt(int page) const;
+  // Read a page already laid out by the in-progress build (page < build LUT size), from
+  // the partially-written tmp .bin without disturbing the build's write cursor.
+  std::unique_ptr<Page> loadPageDuringBuild(int page);
+
  public:
   uint16_t pageCount = 0;
   int currentPage = 0;
 
-  explicit Section(const std::shared_ptr<Epub>& epub, const int spineIndex, GfxRenderer& renderer)
-      : epub(epub),
-        spineIndex(spineIndex),
-        renderer(renderer),
-        filePath(epub->getCachePath() + "/sections/" + std::to_string(spineIndex) + ".bin") {}
-  ~Section() = default;
+  // Constructor and destructor are out-of-line: BuildContext holds a unique_ptr to the
+  // forward-declared ChapterHtmlSlimParser, whose full definition is only visible in the .cpp.
+  explicit Section(const std::shared_ptr<Epub>& epub, int spineIndex, GfxRenderer& renderer);
+  ~Section();
   bool loadSectionFile(int fontId, float lineCompression, bool extraParagraphSpacing, uint8_t paragraphAlignment,
                        uint16_t viewportWidth, uint16_t viewportHeight, bool hyphenationEnabled, bool embeddedStyle,
                        uint8_t imageRendering, bool focusReadingEnabled);
@@ -39,11 +94,73 @@ class Section {
                          uint16_t viewportWidth, uint16_t viewportHeight, bool hyphenationEnabled, bool embeddedStyle,
                          uint8_t imageRendering, bool focusReadingEnabled,
                          const std::function<void()>& popupFn = nullptr);
-  std::unique_ptr<Page> loadPageFromSectionFile();
+
+  // Incremental build: lay out the section a few pages at a time so a large chapter
+  // can show its first page immediately and keep the UI responsive while the rest
+  // builds. createSectionFile() above is the one-shot wrapper over these.
+  //   if (!startBuild(...)) fail;
+  //   each tick: buildSomeMore(N); render up to pageCount; when isBuildComplete() stop.
+  bool startBuild(int fontId, float lineCompression, bool extraParagraphSpacing, uint8_t paragraphAlignment,
+                  uint16_t viewportWidth, uint16_t viewportHeight, bool hyphenationEnabled, bool embeddedStyle,
+                  uint8_t imageRendering, bool focusReadingEnabled, const std::function<void()>& popupFn = nullptr);
+  // Lay out up to maxPages more pages (maxPages <= 0 = build to completion). Returns
+  // false on error (the build is abandoned). Sets isBuildComplete() when finished.
+  bool buildSomeMore(int maxPages);
+  bool isBuilding() const { return static_cast<bool>(build_); }
+  bool isBuildComplete() const { return buildComplete_; }
+  // Best-known total page count: the exact pageCount once finalized, or a smoothed byte-based
+  // estimate (pages so far scaled by totalBytes/bytesConsumed, damped by an EMA) while a giant spine
+  // is still building, so "page X of Y" / progress don't read off the small build watermark.
+  uint16_t estimatedTotalPages() const;
+  void abandonBuild();
+  // Persist an in-progress build as a partial section file (version sentinel + LUTs +
+  // watermark trailer) instead of discarding it, so the next open of this spine can show
+  // its pages instantly and only rebuild in the background. Called by the destructor, so
+  // any teardown path (exit, sleep, navigation) keeps the work already done. Keeps a
+  // pre-existing partial when it covers more pages than this build reached.
+  void suspendBuild();
+  // True when a partial file was loaded: pageCount is a watermark, not the chapter total.
+  bool isPartial() const { return partial_; }
+
+  // Unified page read: from the active build if it has reached the page, otherwise from
+  // the on-disk file (finalized section, or a partial the rebuild hasn't caught up to).
+  std::unique_ptr<Page> loadPage(int page);
+
+  std::string getTextFromSectionFile();
+
+  // Resolve an anchor from the in-progress build first, then the on-disk anchor map
+  // (covers finalized sections and partials from a previous session).
+  std::optional<uint16_t> findAnchor(const std::string& anchor) const;
+
+  // MEMFIX-PORT: section resident-bytes audit accessor; portable
+  // Approximate resident heap for the audit log. Steady state (no build) a
+  // Section holds little beyond itself; during a build the page LUT and path
+  // strings dominate (the parser's internal footprint is not walked here).
+  size_t residentBytes() const {
+    size_t total = sizeof(Section) + filePath.capacity();
+    if (build_) {
+      total += sizeof(BuildContext) + build_->lut.capacity() * sizeof(PageLutEntry) +
+               build_->parsePath.capacity() + build_->contentBase.capacity() + build_->imageBasePath.capacity() +
+               build_->htmlPath.capacity() + build_->tmpHtmlPath.capacity();
+    }
+    return total;
+  }
+
+  // True if this spine's unzipped HTML is already cached, so a build won't pay the (multi-second on a
+  // giant spine) zip inflation. Lets the reader skip the indexing popup on a fast reopen/rebuild.
+  bool hasHtmlCache() const;
 
   // Look up the page number for an anchor id from the section cache file.
   std::optional<uint16_t> getPageForAnchor(const std::string& anchor) const;
 
+  // Look up an anchor among the pages built so far by the in-progress build, so an anchor jump
+  // (TOC / chapter select, usually the chapter top = page 0) can resolve without laying out the
+  // whole chapter. Returns nullopt if the anchor hasn't been reached yet (build more) or no build.
+  std::optional<uint16_t> findAnchorDuringBuild(const std::string& anchor) const;
+
+  // Get the page count from the section cache file without fully loading it.
+  std::optional<uint16_t> getCachedPageCount() const;
+
   // Look up the page number for a synthetic paragraph index from XPath p[N].
   std::optional<uint16_t> getPageForParagraphIndex(uint16_t pIndex) const;
 

lib/Epub/Epub/blocks/BlockStyle.h

@@ -29,6 +29,13 @@ struct BlockStyle {
   int16_t textIndent = 0;
   bool textIndentDefined = false;  // true if text-indent was explicitly set in CSS
   bool textAlignDefined = false;   // true if text-align was explicitly set in CSS
+  bool isRtl = false;              // true if resolved direction is RTL
+  bool directionDefined = false;   // true if direction was explicitly set in CSS/HTML
+
+  // Set when this block was created by a <br> element. Used by startNewTextBlock to inject
+  // a full line-height gap when the <br> block stays empty (section-break use case).
+  // NOT propagated through getCombinedBlockStyle so it can't leak into sibling blocks.
+  bool fromBrElement = false;
 
   // Combined insets (margin + padding)
   [[nodiscard]] int16_t leftInset() const { return marginLeft + paddingLeft; }
@@ -84,6 +91,15 @@ struct BlockStyle {
       result.paddingBottom = static_cast<int16_t>(child.paddingBottom + paddingBottom);
     }
 
+    // Direction is not axis-specific. Inherit from parent when child doesn't define it.
+    if (!child.directionDefined && directionDefined) {
+      result.isRtl = isRtl;
+      result.directionDefined = true;
+    }
+
+    // fromBrElement is consumed by startNewTextBlock when an empty <br> block
+    // is merged with the following paragraph; never propagate it further.
+    result.fromBrElement = false;
     return result;
   }
 
@@ -107,7 +123,7 @@ struct BlockStyle {
     blockStyle.paddingRight = std::min(cssStyle.paddingRight.toPixelsInt16(emSize, vw), maxHorizontalInsetPx);
 
     // For textIndent: if it's a percentage we can't resolve (no viewport width),
-    // leave textIndentDefined=false so the EmSpace fallback in applyParagraphIndent() is used
+    // leave textIndentDefined=false so the space-width fallback in resolveFirstLineIndent() is used
     if (cssStyle.hasTextIndent() && cssStyle.textIndent.isResolvable(vw)) {
       blockStyle.textIndent = cssStyle.textIndent.toPixelsInt16(emSize, vw);
       blockStyle.textIndentDefined = true;
@@ -119,6 +135,11 @@ struct BlockStyle {
     } else {
       blockStyle.alignment = paragraphAlignment;
     }
+    // RTL direction from CSS/HTML
+    if (cssStyle.hasDirection()) {
+      blockStyle.isRtl = (cssStyle.direction == CssTextDirection::Rtl);
+      blockStyle.directionDefined = true;
+    }
     return blockStyle;
   }
 };

lib/Epub/Epub/blocks/ImageBlock.cpp

@@ -1,9 +1,12 @@
 #include "ImageBlock.h"
 
+#include <FontCacheManager.h>
 #include <GfxRenderer.h>
 #include <Logging.h>
 #include <Serialization.h>
 
+#include <cstdlib>
+
 #include "Epub/converters/DirectPixelWriter.h"
 #include "Epub/converters/ImageDecoderFactory.h"
 
@@ -28,24 +31,64 @@ std::string getCachePath(const std::string& imagePath) {
   return imagePath + ".pxc";
 }
 
+bool readValidCacheHeader(HalFile& cacheFile, const int expectedWidth, const int expectedHeight, uint16_t& cachedWidth,
+                          uint16_t& cachedHeight) {
+  if (cacheFile.read(&cachedWidth, 2) != 2 || cacheFile.read(&cachedHeight, 2) != 2) {
+    return false;
+  }
+
+  const int widthDiff = abs(cachedWidth - expectedWidth);
+  const int heightDiff = abs(cachedHeight - expectedHeight);
+  if (widthDiff > 1 || heightDiff > 1) {
+    return false;
+  }
+
+  const size_t bytesPerRow = (cachedWidth + 3) / 4;
+  const size_t expectedSize = 4 + bytesPerRow * cachedHeight;
+  return cacheFile.size() >= expectedSize;
+}
+
+// Pages are deserialized afresh on each visit. Keep a bounded, allocation-free
+// record so an image that failed renders its placeholder directly for the rest
+// of the reader session instead of paying another placeholder refresh and
+// decode. The reader clears this on entry so transient memory/storage failures
+// are retried.
+constexpr size_t MAX_SESSION_IMAGE_FAILURES = 16;
+uint64_t failedImageHashes[MAX_SESSION_IMAGE_FAILURES];
+size_t failedImageCount = 0;
+
+uint64_t imagePathHash(const std::string& path) {
+  uint64_t hash = 14695981039346656037ull;
+  for (const char c : path) {
+    hash ^= static_cast<uint8_t>(c);
+    hash *= 1099511628211ull;
+  }
+  return hash;
+}
+
+bool imageFailedThisSession(const std::string& path) {
+  const uint64_t hash = imagePathHash(path);
+  for (size_t i = 0; i < failedImageCount; i++) {
+    if (failedImageHashes[i] == hash) return true;
+  }
+  return false;
+}
+
+void rememberImageFailure(const std::string& path) {
+  if (failedImageCount == MAX_SESSION_IMAGE_FAILURES || imageFailedThisSession(path)) return;
+  failedImageHashes[failedImageCount++] = imagePathHash(path);
+}
+
 bool renderFromCache(GfxRenderer& renderer, const std::string& cachePath, int x, int y, int expectedWidth,
                      int expectedHeight) {
-  FsFile cacheFile;
+  HalFile cacheFile;
   if (!Storage.openFileForRead("IMG", cachePath, cacheFile)) {
     return false;
   }
 
   uint16_t cachedWidth, cachedHeight;
-  if (cacheFile.read(&cachedWidth, 2) != 2 || cacheFile.read(&cachedHeight, 2) != 2) {
-    return false;
-  }
-
-  // Verify dimensions are close (allow 1 pixel tolerance for rounding differences)
-  int widthDiff = abs(cachedWidth - expectedWidth);
-  int heightDiff = abs(cachedHeight - expectedHeight);
-  if (widthDiff > 1 || heightDiff > 1) {
-    LOG_ERR("IMG", "Cache dimension mismatch: %dx%d vs %dx%d", cachedWidth, cachedHeight, expectedWidth,
-            expectedHeight);
+  if (!readValidCacheHeader(cacheFile, expectedWidth, expectedHeight, cachedWidth, cachedHeight)) {
+    LOG_ERR("IMG", "Invalid image cache: %s", cachePath.c_str());
     return false;
   }
 
@@ -55,10 +98,22 @@ bool renderFromCache(GfxRenderer& renderer, const std::string& cachePath, int x,
 
   LOG_DBG("IMG", "Loading from cache: %s (%dx%d)", cachePath.c_str(), cachedWidth, cachedHeight);
 
-  // Read and render row by row to minimize memory usage
+  // Read several rows per SD access. A full-page image is re-rendered on every
+  // grayscale strip pass (~14x per page), and a one-row-per-read loop here means
+  // cachedHeight (~728) tiny reads through the storage mutex + SdFat each time —
+  // the dominant cost of displaying an image page. Batching rows into a ~4KB
+  // buffer cuts that to ~20 reads per pass without holding the whole image.
   const int bytesPerRow = (cachedWidth + 3) / 4;  // 2 bits per pixel, 4 pixels per byte
-  uint8_t* rowBuffer = (uint8_t*)malloc(bytesPerRow);
-  if (!rowBuffer) {
+  int rowsPerRead = 4096 / bytesPerRow;
+  if (rowsPerRead < 1) rowsPerRead = 1;
+  if (rowsPerRead > cachedHeight) rowsPerRead = cachedHeight;
+  uint8_t* readBuffer = (uint8_t*)malloc((size_t)rowsPerRead * bytesPerRow);
+  if (!readBuffer) {
+    // Fall back to a single-row buffer under memory pressure.
+    rowsPerRead = 1;
+    readBuffer = (uint8_t*)malloc(bytesPerRow);
+  }
+  if (!readBuffer) {
     LOG_ERR("IMG", "Failed to allocate row buffer");
     return false;
   }
@@ -66,16 +121,31 @@ bool renderFromCache(GfxRenderer& renderer, const std::string& cachePath, int x,
   DirectPixelWriter pw;
   pw.init(renderer);
 
+  int rowsInBuffer = 0;
+  int bufferRow = 0;
   for (int row = 0; row < cachedHeight; row++) {
-    if (cacheFile.read(rowBuffer, bytesPerRow) != bytesPerRow) {
-      LOG_ERR("IMG", "Cache read error at row %d", row);
-      free(rowBuffer);
-      return false;
+    if (bufferRow >= rowsInBuffer) {
+      const int toRead = (cachedHeight - row < rowsPerRead) ? (cachedHeight - row) : rowsPerRead;
+      const size_t bytes = (size_t)toRead * bytesPerRow;
+      if (cacheFile.read(readBuffer, bytes) != static_cast<int>(bytes)) {
+        LOG_ERR("IMG", "Cache read error at row %d", row);
+        free(readBuffer);
+        return false;
+      }
+      rowsInBuffer = toRead;
+      bufferRow = 0;
     }
 
+    const uint8_t* rowBuffer = readBuffer + (size_t)bufferRow * bytesPerRow;
+    bufferRow++;
+
     const int destY = y + row;
     pw.beginRow(destY);
-    for (int col = 0; col < cachedWidth; col++) {
+    // On a grayscale strip pass only a narrow column window of the image is in
+    // the active band; skip the rest instead of unpacking+clipping every pixel.
+    int colStart, colEnd;
+    pw.bandColRange(x, cachedWidth, colStart, colEnd);
+    for (int col = colStart; col < colEnd; col++) {
       const int byteIdx = col >> 2;            // col / 4
       const int bitShift = 6 - (col & 3) * 2;  // MSB first within byte
       uint8_t pixelValue = (rowBuffer[byteIdx] >> bitShift) & 0x03;
@@ -84,14 +154,44 @@ bool renderFromCache(GfxRenderer& renderer, const std::string& cachePath, int x,
     }
   }
 
-  free(rowBuffer);
+  free(readBuffer);
   LOG_DBG("IMG", "Cache render complete");
   return true;
 }
 
 }  // namespace
 
+bool ImageBlock::hasValidCache() const {
+  const auto cachePath = getCachePath(imagePath);
+  HalFile cacheFile;
+  if (!Storage.openFileForRead("IMG", cachePath, cacheFile)) {
+    return false;
+  }
+
+  uint16_t cachedWidth, cachedHeight;
+  return readValidCacheHeader(cacheFile, width, height, cachedWidth, cachedHeight);
+}
+
+bool ImageBlock::needsDecode() const { return !imageFailedThisSession(imagePath) && !hasValidCache(); }
+
+void ImageBlock::clearSessionRenderFailures() { failedImageCount = 0; }
+
+void ImageBlock::renderPlaceholder(GfxRenderer& renderer, const int x, const int y) const {
+  renderer.fillRect(x, y, width, height, true);
+  if (width > 2 && height > 2) {
+    renderer.fillRect(x + 1, y + 1, width - 2, height - 2, false);
+  }
+}
+
 void ImageBlock::render(GfxRenderer& renderer, const int x, const int y) {
+  // The font-prewarm scan pass only accumulates glyphs; an image contributes
+  // none, and its DirectPixelWriter output bypasses the renderer's scan-mode
+  // suppression, so it would otherwise do a full (discarded) cache render every
+  // page view. Skip it here. The image still draws in the real BW/grayscale
+  // passes; on first view this just moves the one-time decode to the BW pass.
+  FontCacheManager* fcm = renderer.getFontCacheManager();
+  if (fcm && fcm->isScanning()) return;
+
   LOG_DBG("IMG", "Rendering image at %d,%d: %s (%dx%d)", x, y, imagePath.c_str(), width, height);
 
   const int screenWidth = renderer.getScreenWidth();
@@ -104,6 +204,21 @@ void ImageBlock::render(GfxRenderer& renderer, const int x, const int y) {
     return;
   }
 
+  // Tiled grayscale (#2190): skip the whole image when it doesn't touch the
+  // active band. The per-pixel writer already clips off-band pixels, but without
+  // this each of the ~7 bands per plane re-ran the full cache load / pixel walk
+  // and discarded the result — the dominant cost of AA on image pages. The check
+  // is orientation-aware and returns true when no strip is active, so the BW
+  // pass and non-tiled controllers render the image exactly as before.
+  if (!renderer.glyphIntersectsStrip(x, y, x + width - 1, y + height - 1)) {
+    return;
+  }
+
+  if (imageFailedThisSession(imagePath)) {
+    renderPlaceholder(renderer, x, y);
+    return;
+  }
+
   // Try to render from cache first
   std::string cachePath = getCachePath(imagePath);
   if (renderFromCache(renderer, cachePath, x, y, width, height)) {
@@ -112,9 +227,11 @@ void ImageBlock::render(GfxRenderer& renderer, const int x, const int y) {
 
   // No cache - need to decode the image
   // Check if image file exists
-  FsFile file;
+  HalFile file;
   if (!Storage.openFileForRead("IMG", imagePath, file)) {
     LOG_ERR("IMG", "Image file not found: %s", imagePath.c_str());
+    rememberImageFailure(imagePath);
+    renderPlaceholder(renderer, x, y);
     return;
   }
   size_t fileSize = file.size();
@@ -122,6 +239,8 @@ void ImageBlock::render(GfxRenderer& renderer, const int x, const int y) {
 
   if (fileSize == 0) {
     LOG_ERR("IMG", "Image file is empty: %s", imagePath.c_str());
+    rememberImageFailure(imagePath);
+    renderPlaceholder(renderer, x, y);
     return;
   }
 
@@ -141,6 +260,8 @@ void ImageBlock::render(GfxRenderer& renderer, const int x, const int y) {
   ImageToFramebufferDecoder* decoder = ImageDecoderFactory::getDecoder(imagePath);
   if (!decoder) {
     LOG_ERR("IMG", "No decoder found for image: %s", imagePath.c_str());
+    rememberImageFailure(imagePath);
+    renderPlaceholder(renderer, x, y);
     return;
   }
 
@@ -149,20 +270,22 @@ void ImageBlock::render(GfxRenderer& renderer, const int x, const int y) {
   bool success = decoder->decodeToFramebuffer(imagePath, renderer, config);
   if (!success) {
     LOG_ERR("IMG", "Failed to decode image: %s", imagePath.c_str());
+    rememberImageFailure(imagePath);
+    renderPlaceholder(renderer, x, y);
     return;
   }
 
   LOG_DBG("IMG", "Decode successful");
 }
 
-bool ImageBlock::serialize(FsFile& file) {
+bool ImageBlock::serialize(HalFile& file) {
   serialization::writeString(file, imagePath);
   serialization::writePod(file, width);
   serialization::writePod(file, height);
   return true;
 }
 
-std::unique_ptr<ImageBlock> ImageBlock::deserialize(FsFile& file) {
+std::unique_ptr<ImageBlock> ImageBlock::deserialize(HalFile& file) {
   std::string path;
   serialization::readString(file, path);
   int16_t w, h;

lib/Epub/Epub/blocks/ImageBlock.h

@@ -16,13 +16,17 @@ class ImageBlock final : public Block {
   int16_t getHeight() const { return height; }
 
   bool imageExists() const;
+  bool hasValidCache() const;
+  bool needsDecode() const;
+  void renderPlaceholder(GfxRenderer& renderer, int x, int y) const;
+  static void clearSessionRenderFailures();
 
   BlockType getType() override { return IMAGE_BLOCK; }
   bool isEmpty() override { return false; }
 
   void render(GfxRenderer& renderer, const int x, const int y);
-  bool serialize(FsFile& file);
-  static std::unique_ptr<ImageBlock> deserialize(FsFile& file);
+  bool serialize(HalFile& file);
+  static std::unique_ptr<ImageBlock> deserialize(HalFile& file);
 
  private:
   std::string imagePath;

lib/Epub/Epub/blocks/TextBlock.cpp

@@ -1,27 +1,172 @@
 #include "TextBlock.h"
 
+#include <BidiUtils.h>
 #include <GfxRenderer.h>
 #include <Logging.h>
+#include <Memory.h>
 #include <Serialization.h>
 
 #include <cstring>
 
-void TextBlock::render(const GfxRenderer& renderer, const int fontId, const int x, const int y) const {
+size_t TextBlock::arenaSize(const uint16_t wordCount, const bool hasFocus, const uint16_t textBytes) {
+  // Layout documented in TextBlock.h: 16-bit arrays first, then 8-bit arrays, then text.
+  size_t size = static_cast<size_t>(wordCount) * (sizeof(uint16_t) + sizeof(int16_t) + sizeof(uint8_t));
+  if (hasFocus) {
+    size += static_cast<size_t>(wordCount) * (sizeof(uint16_t) + sizeof(uint8_t));
+  }
+  return size + textBytes;
+}
+
+void TextBlock::bindArenaPointers() {
+  uint8_t* base = arena.get();
+  const size_t wc = numWords;
+  textOffArr = reinterpret_cast<const uint16_t*>(base);
+  xposArr = reinterpret_cast<const int16_t*>(base + wc * 2);
+  size_t off = wc * 4;
+  if (focusPresent) {
+    focusSuffixXArr = reinterpret_cast<const uint16_t*>(base + off);
+    off += wc * 2;
+  }
+  stylesArr = base + off;
+  off += wc;
+  if (focusPresent) {
+    focusBoundaryArr = base + off;
+    off += wc;
+  }
+  textArr = reinterpret_cast<const char*>(base + off);
+}
+
+TextBlock::TextBlock(const std::vector<std::string>& words, const std::vector<int16_t>& wordXpos,
+                     const std::vector<EpdFontFamily::Style>& wordStyles, const std::vector<uint8_t>& focusBoundary,
+                     const std::vector<uint16_t>& focusSuffixX, const BlockStyle& blockStyle)
+    : blockStyle(blockStyle) {
   // Focus annotations are optional: empty vectors mean no word in this block has a split.
   // When present, they must be sized in lockstep with words[].
-  const bool hasFocus = !wordFocusBoundary.empty();
-  if (words.size() != wordXpos.size() || words.size() != wordStyles.size() ||
-      (hasFocus && (words.size() != wordFocusBoundary.size() || words.size() != wordFocusSuffixX.size()))) {
-    LOG_ERR("TXB", "Render skipped: size mismatch (words=%u, xpos=%u, styles=%u, boundary=%u, suffixX=%u)\n",
-            (uint32_t)words.size(), (uint32_t)wordXpos.size(), (uint32_t)wordStyles.size(),
-            (uint32_t)wordFocusBoundary.size(), (uint32_t)wordFocusSuffixX.size());
+  const bool hasFocus = !focusBoundary.empty();
+  if (words.size() != wordXpos.size() || words.size() != wordStyles.size() || words.size() > 10000 ||
+      (hasFocus && (words.size() != focusBoundary.size() || words.size() != focusSuffixX.size()))) {
+    LOG_ERR("TXB", "Construction failed: size mismatch (words=%u, xpos=%u, styles=%u, boundary=%u, suffixX=%u)",
+            static_cast<uint32_t>(words.size()), static_cast<uint32_t>(wordXpos.size()),
+            static_cast<uint32_t>(wordStyles.size()), static_cast<uint32_t>(focusBoundary.size()),
+            static_cast<uint32_t>(focusSuffixX.size()));
+    isValid = false;
     return;
   }
 
-  for (size_t i = 0; i < words.size(); i++) {
-    const int wordX = wordXpos[i] + x;
-    const EpdFontFamily::Style currentStyle = wordStyles[i];
-    const uint8_t boundary = hasFocus ? wordFocusBoundary[i] : 0;
+  numWords = static_cast<uint16_t>(words.size());
+  focusPresent = hasFocus;
+  if (numWords == 0) {
+    return;  // valid empty block, no arena
+  }
+
+  // Pass 1: total text size, one NUL per word. A line is at most a physical
+  // row of the page, so uint16_t offsets are ample; reject anything larger.
+  size_t totalText = 0;
+  for (const auto& w : words) totalText += w.size() + 1;
+  if (totalText > UINT16_MAX) {
+    LOG_ERR("TXB", "Construction failed: text size %u exceeds arena limit", static_cast<uint32_t>(totalText));
+    numWords = 0;
+    focusPresent = false;
+    isValid = false;
+    return;
+  }
+  textBytes = static_cast<uint16_t>(totalText);
+
+  const size_t size = arenaSize(numWords, focusPresent, textBytes);
+  arena = makeUniqueNoThrow<uint8_t[]>(size);
+  if (!arena) {
+    LOG_ERR("TXB", "OOM: arena %u bytes", static_cast<uint32_t>(size));
+    numWords = 0;
+    textBytes = 0;
+    focusPresent = false;
+    isValid = false;
+    return;
+  }
+  bindArenaPointers();
+
+  // Pass 2: fill. Mutable aliases of the const views bound above.
+  auto* textOff = const_cast<uint16_t*>(textOffArr);
+  auto* xpos = const_cast<int16_t*>(xposArr);
+  auto* styles = const_cast<uint8_t*>(stylesArr);
+  auto* text = const_cast<char*>(textArr);
+  uint16_t off = 0;
+  for (uint16_t i = 0; i < numWords; i++) {
+    textOff[i] = off;
+    xpos[i] = wordXpos[i];
+    styles[i] = static_cast<uint8_t>(wordStyles[i]);
+    memcpy(text + off, words[i].data(), words[i].size());
+    off += static_cast<uint16_t>(words[i].size());
+    text[off++] = '\0';
+  }
+  if (focusPresent) {
+    auto* suffixX = const_cast<uint16_t*>(focusSuffixXArr);
+    auto* boundary = const_cast<uint8_t*>(focusBoundaryArr);
+    for (uint16_t i = 0; i < numWords; i++) {
+      suffixX[i] = focusSuffixX[i];
+      boundary[i] = focusBoundary[i];
+    }
+  }
+}
+
+void TextBlock::render(const GfxRenderer& renderer, const int fontId, const int x, const int y) const {
+  if (!isValid) {
+    LOG_ERR("TXB", "Render skipped: invalid block");
+    return;
+  }
+
+  const bool scanning = renderer.isFontCacheScanning();
+  const int ascender = renderer.getFontAscenderSize(fontId);
+
+  struct DecorationLineTracker {
+    EpdFontFamily::Style style;
+    int yOffset;
+    int startX = -1;
+    int endX = -1;
+    int yPos = 0;
+
+    bool active() const { return startX != -1; }
+    void reset() {
+      startX = -1;
+      endX = -1;
+      yPos = 0;
+    }
+  };
+
+  DecorationLineTracker decorationLines[] = {
+      {EpdFontFamily::UNDERLINE, ascender + 2},
+      {EpdFontFamily::STRIKETHROUGH, ascender * 4 / 5},
+  };
+
+  const auto flushDecoration = [&](DecorationLineTracker& line) {
+    if (line.active()) {
+      renderer.drawLine(line.startX, line.yPos, line.endX, line.yPos, 2, true);
+      line.reset();
+    }
+  };
+  const auto flushDecorations = [&]() {
+    for (auto& line : decorationLines) {
+      flushDecoration(line);
+    }
+  };
+
+  for (uint16_t i = 0; i < numWords; i++) {
+    const char* word = wordText(i);
+    const int wordX = xposArr[i] + x;
+    const EpdFontFamily::Style currentStyle = wordStyle(i);
+    const auto baseDir =
+        static_cast<BidiUtils::BidiBaseDir>(BidiUtils::detectParagraphLevel(word, blockStyle.isRtl ? 1 : 0));
+    const uint8_t boundary = focusBoundary(i);
+
+    // SUP/SUB shift the baseline passed to drawText; the glyph is also scaled 50% inside
+    // drawText, so these offsets are chosen relative to the full-size ascender:
+    //   SUP: raise by 40% of ascender — sits clearly above the cap-height
+    //   SUB: lower by 25% of ascender — descends below baseline without clashing with ascenders below
+    int wordY = y;
+    if ((currentStyle & EpdFontFamily::SUP) != 0) {
+      wordY -= ascender * 2 / 5;
+    } else if ((currentStyle & EpdFontFamily::SUB) != 0) {
+      wordY += ascender / 4;
+    }
 
     if (boundary > 0) {
       // Focus split: draw bold prefix, then the regular suffix at a pre-computed x offset.
@@ -33,64 +178,81 @@ void TextBlock::render(const GfxRenderer& renderer, const int fontId, const int
       static_assert(sizeof(boldBuf) >= MAX_FOCUS_PREFIX_BYTES,
                     "boldBuf too small for max focus prefix (9 codepoints * 4 UTF-8 bytes + null)");
       const auto boldStyle = static_cast<EpdFontFamily::Style>(currentStyle | EpdFontFamily::BOLD);
-      const size_t boldLen = std::min<size_t>({static_cast<size_t>(boundary), words[i].size(), sizeof(boldBuf) - 1});
-      memcpy(boldBuf, words[i].c_str(), boldLen);
+      const size_t boldLen =
+          std::min<size_t>({static_cast<size_t>(boundary), static_cast<size_t>(wordTextLen(i)), sizeof(boldBuf) - 1});
+      memcpy(boldBuf, word, boldLen);
       boldBuf[boldLen] = '\0';
-      renderer.drawText(fontId, wordX, y, boldBuf, true, boldStyle);
-      const int suffixX = wordX + wordFocusSuffixX[i];
-      renderer.drawText(fontId, suffixX, y, words[i].c_str() + boldLen, true, currentStyle);
+      renderer.drawText(fontId, wordX, wordY, boldBuf, true, boldStyle, baseDir);
+      const int suffixX = wordX + focusSuffixXArr[i];
+      renderer.drawText(fontId, suffixX, wordY, word + boldLen, true, currentStyle, baseDir);
     } else {
-      renderer.drawText(fontId, wordX, y, words[i].c_str(), true, currentStyle);
+      renderer.drawText(fontId, wordX, wordY, word, true, currentStyle, baseDir);
     }
 
-    if ((currentStyle & EpdFontFamily::UNDERLINE) != 0) {
-      const std::string& w = words[i];
-      const int fullWordWidth = renderer.getTextWidth(fontId, w.c_str(), currentStyle);
-      // y is the top of the text line; add ascender to reach baseline, then offset 2px below
-      const int underlineY = y + renderer.getFontAscenderSize(fontId) + 2;
+    if (scanning) {
+      continue;
+    }
 
-      int startX = wordX;
-      int underlineWidth = fullWordWidth;
+    if (EpdFontFamily::hasTextDecoration(currentStyle)) {
+      int lineStartX = wordX;
+      int lineWidth = renderer.getTextWidth(fontId, word, currentStyle, baseDir);
 
-      // if word starts with em-space ("\xe2\x80\x83"), account for the additional indent before drawing the line
-      if (w.size() >= 3 && static_cast<uint8_t>(w[0]) == 0xE2 && static_cast<uint8_t>(w[1]) == 0x80 &&
-          static_cast<uint8_t>(w[2]) == 0x83) {
-        const char* visiblePtr = w.c_str() + 3;
-        const int prefixWidth = renderer.getTextAdvanceX(fontId, "\xe2\x80\x83", currentStyle);
-        const int visibleWidth = renderer.getTextWidth(fontId, visiblePtr, currentStyle);
-        startX = wordX + prefixWidth;
-        underlineWidth = visibleWidth;
+      if ((currentStyle & (EpdFontFamily::SUP | EpdFontFamily::SUB)) != 0) {
+        lineWidth = (lineWidth + 1) / 2;
       }
 
-      renderer.drawLine(startX, underlineY, startX + underlineWidth, underlineY, true);
+      // Do not decorate the synthetic em-space used for paragraph indentation.
+      if (wordTextLen(i) >= 3 && static_cast<uint8_t>(word[0]) == 0xE2 && static_cast<uint8_t>(word[1]) == 0x80 &&
+          static_cast<uint8_t>(word[2]) == 0x83) {
+        const char* visibleText = word + 3;
+        lineStartX += renderer.getTextAdvanceX(fontId, "\xe2\x80\x83", currentStyle);
+        lineWidth = renderer.getTextWidth(fontId, visibleText, currentStyle, baseDir);
+        if ((currentStyle & (EpdFontFamily::SUP | EpdFontFamily::SUB)) != 0) {
+          lineWidth = (lineWidth + 1) / 2;
+        }
+      }
+
+      for (auto& line : decorationLines) {
+        if ((currentStyle & line.style) == 0) {
+          flushDecoration(line);
+          continue;
+        }
+
+        const int lineY = wordY + line.yOffset;
+        if (line.active() && line.yPos != lineY) {
+          flushDecoration(line);
+        }
+        if (!line.active()) {
+          line.startX = lineStartX;
+          line.yPos = lineY;
+        }
+        line.endX = lineStartX + lineWidth;
+      }
+    } else {
+      flushDecorations();
     }
   }
+  flushDecorations();
 }
 
-bool TextBlock::serialize(FsFile& file) const {
-  // Focus annotations are optional; vectors are either empty (no splits in this block)
-  // or sized in lockstep with words[].
-  const bool hasFocus = !wordFocusBoundary.empty();
-  if (words.size() != wordXpos.size() || words.size() != wordStyles.size() ||
-      (hasFocus && (words.size() != wordFocusBoundary.size() || words.size() != wordFocusSuffixX.size()))) {
-    LOG_ERR("TXB", "Serialization failed: size mismatch (words=%u, xpos=%u, styles=%u, boundary=%u, suffixX=%u)\n",
-            static_cast<uint32_t>(words.size()), static_cast<uint32_t>(wordXpos.size()),
-            static_cast<uint32_t>(wordStyles.size()), static_cast<uint32_t>(wordFocusBoundary.size()),
-            static_cast<uint32_t>(wordFocusSuffixX.size()));
+bool TextBlock::serialize(HalFile& file) const {
+  if (!isValid) {
+    LOG_ERR("TXB", "Serialization failed: invalid block");
     return false;
   }
 
-  // Word data
-  serialization::writePod(file, static_cast<uint16_t>(words.size()));
-  for (const auto& w : words) serialization::writeString(file, w);
-  for (auto x : wordXpos) serialization::writePod(file, x);
-  for (auto s : wordStyles) serialization::writePod(file, s);
-  // Focus block: 1-byte presence flag, followed by per-word vectors only when present.
-  // Saves 3 bytes/word when focus reading is disabled or no word on this line was split.
-  serialization::writePod(file, static_cast<uint8_t>(hasFocus ? 1 : 0));
-  if (hasFocus) {
-    for (auto b : wordFocusBoundary) serialization::writePod(file, b);
-    for (auto sx : wordFocusSuffixX) serialization::writePod(file, sx);
+  // Word data: scalars, then the arena verbatim -- its in-memory layout is
+  // exactly the on-disk layout (see TextBlock.h), so one write covers all
+  // per-word arrays and the text blob.
+  serialization::writePod(file, numWords);
+  serialization::writePod(file, static_cast<uint8_t>(focusPresent ? 1 : 0));
+  serialization::writePod(file, textBytes);
+  if (numWords > 0) {
+    const size_t size = arenaSize(numWords, focusPresent, textBytes);
+    if (file.write(arena.get(), size) != size) {
+      LOG_ERR("TXB", "Serialization failed: arena write (%u bytes)", static_cast<uint32_t>(size));
+      return false;
+    }
   }
 
   // Style (alignment + margins/padding/indent)
@@ -106,47 +268,72 @@ bool TextBlock::serialize(FsFile& file) const {
   serialization::writePod(file, blockStyle.paddingRight);
   serialization::writePod(file, blockStyle.textIndent);
   serialization::writePod(file, blockStyle.textIndentDefined);
+  serialization::writePod(file, blockStyle.isRtl);
+  serialization::writePod(file, blockStyle.directionDefined);
 
   return true;
 }
 
-std::unique_ptr<TextBlock> TextBlock::deserialize(FsFile& file) {
+std::unique_ptr<TextBlock> TextBlock::deserialize(HalFile& file) {
   uint16_t wc;
-  std::vector<std::string> words;
-  std::vector<int16_t> wordXpos;
-  std::vector<EpdFontFamily::Style> wordStyles;
-  std::vector<uint8_t> wordFocusBoundary;
-  std::vector<uint16_t> wordFocusSuffixX;
-  BlockStyle blockStyle;
-
-  // Word count
+  uint8_t hasFocus;
+  uint16_t textBytes;
   serialization::readPod(file, wc);
+  serialization::readPod(file, hasFocus);
+  serialization::readPod(file, textBytes);
 
-  // Sanity check: prevent allocation of unreasonably large vectors (max 10000 words per block)
+  // Sanity checks: cap the arena allocation and reject impossible geometry
+  // (every word carries at least its NUL terminator).
   if (wc > 10000) {
     LOG_ERR("TXB", "Deserialization failed: word count %u exceeds maximum", wc);
     return nullptr;
   }
+  if ((wc == 0 && textBytes != 0) || (wc > 0 && textBytes < wc)) {
+    LOG_ERR("TXB", "Deserialization failed: bad text size %u for %u words", textBytes, wc);
+    return nullptr;
+  }
 
-  // Word data
-  words.resize(wc);
-  wordXpos.resize(wc);
-  wordStyles.resize(wc);
-  for (auto& w : words) serialization::readString(file, w);
-  for (auto& x : wordXpos) serialization::readPod(file, x);
-  for (auto& s : wordStyles) serialization::readPod(file, s);
-  // Focus block: presence flag, then vectors only if present. Empty vectors when absent
-  // signal "no splits in this block" to render() (zero per-word RAM cost).
-  uint8_t hasFocus;
-  serialization::readPod(file, hasFocus);
-  if (hasFocus) {
-    wordFocusBoundary.resize(wc);
-    wordFocusSuffixX.resize(wc);
-    for (auto& b : wordFocusBoundary) serialization::readPod(file, b);
-    for (auto& sx : wordFocusSuffixX) serialization::readPod(file, sx);
+  std::unique_ptr<TextBlock> block(new (std::nothrow) TextBlock());
+  if (!block) {
+    LOG_ERR("TXB", "OOM: TextBlock");
+    return nullptr;
+  }
+  block->numWords = wc;
+  block->textBytes = textBytes;
+  block->focusPresent = hasFocus != 0;
+
+  if (wc > 0) {
+    const size_t size = arenaSize(wc, block->focusPresent, textBytes);
+    block->arena = makeUniqueNoThrow<uint8_t[]>(size);
+    if (!block->arena) {
+      LOG_ERR("TXB", "OOM: arena %u bytes", static_cast<uint32_t>(size));
+      return nullptr;
+    }
+    if (file.read(block->arena.get(), size) != size) {
+      LOG_ERR("TXB", "Deserialization failed: arena read (%u bytes)", static_cast<uint32_t>(size));
+      return nullptr;
+    }
+    block->bindArenaPointers();
+
+    // Validate offsets before anything dereferences wordText(): offset 0 first,
+    // strictly increasing, in bounds, and every word NUL-terminated (word i ends
+    // at the byte before offset i+1; the last word at the last text byte).
+    const uint16_t* textOff = block->textOffArr;
+    const char* text = block->textArr;
+    if (textOff[0] != 0 || text[textBytes - 1] != '\0') {
+      LOG_ERR("TXB", "Deserialization failed: corrupt text layout");
+      return nullptr;
+    }
+    for (uint16_t i = 1; i < wc; i++) {
+      if (textOff[i] <= textOff[i - 1] || textOff[i] >= textBytes || text[textOff[i] - 1] != '\0') {
+        LOG_ERR("TXB", "Deserialization failed: corrupt word offset %u", i);
+        return nullptr;
+      }
+    }
   }
 
   // Style (alignment + margins/padding/indent)
+  BlockStyle& blockStyle = block->blockStyle;
   serialization::readPod(file, blockStyle.alignment);
   serialization::readPod(file, blockStyle.textAlignDefined);
   serialization::readPod(file, blockStyle.marginTop);
@@ -159,8 +346,8 @@ std::unique_ptr<TextBlock> TextBlock::deserialize(FsFile& file) {
   serialization::readPod(file, blockStyle.paddingRight);
   serialization::readPod(file, blockStyle.textIndent);
   serialization::readPod(file, blockStyle.textIndentDefined);
+  serialization::readPod(file, blockStyle.isRtl);
+  serialization::readPod(file, blockStyle.directionDefined);
 
-  return std::unique_ptr<TextBlock>(new TextBlock(std::move(words), std::move(wordXpos), std::move(wordStyles),
-                                                  std::move(wordFocusBoundary), std::move(wordFocusSuffixX),
-                                                  blockStyle));
+  return block;
 }

lib/Epub/Epub/blocks/TextBlock.h

@@ -9,44 +9,85 @@
 #include "Block.h"
 #include "BlockStyle.h"
 
-// Represents a line of text on a page
+// Represents a line of text on a page.
+//
+// All per-word data lives in ONE flat heap allocation (the arena) instead of
+// six parallel vectors: a resident page holds ~25-30 of these blocks, and the
+// vector-of-string layout cost ~250 throwing allocations per page load, which
+// was the primary driver of heap fragmentation on the ESP32-C3.
+//
+// Arena layout, in order (2-byte alignment holds by construction: all 16-bit
+// arrays come first and the arena base is allocator-aligned; RISC-V faults on
+// unaligned multi-byte access):
+//   uint16_t textOff[wordCount]        byte offset of word i's text in text[]
+//   int16_t  xpos[wordCount]
+//   uint16_t focusSuffixX[wordCount]   present only when focusPresent
+//   uint8_t  styles[wordCount]
+//   uint8_t  focusBoundary[wordCount]  present only when focusPresent
+//   char     text[textBytes]           all words back to back, NUL-terminated
+//
+// Each word is stored NUL-terminated so render() can hand `text + textOff[i]`
+// straight to C APIs (drawText) with no std::string materialization.
+//
+// Focus split semantics (unchanged from the vector layout): boundary N > 0
+// means the first N bytes of word i render bold, the remainder in the base
+// style. N is bounded to 9 codepoints (<= 36 UTF-8 bytes) by the clamp in
+// ParsedText::addWord. focusSuffixX is the pre-computed pixel offset from the
+// word start to the regular suffix. Both arrays are omitted from the arena
+// entirely when no word on the line has a split (zero per-word RAM cost when
+// focus reading is disabled).
 class TextBlock final : public Block {
  private:
-  std::vector<std::string> words;
-  std::vector<int16_t> wordXpos;
-  std::vector<EpdFontFamily::Style> wordStyles;
-  // Per-word focus boundary: N > 0 means the first N bytes of words[i] are rendered bold,
-  // the remainder in the base style. 0 means no split (whole word uses wordStyles[i]).
-  // N encodes the bold PREFIX length only — bounded to 9 codepoints (≤36 UTF-8 bytes) by
-  // FOCUS_READING_PERCENT's 1..9 clamp in ParsedText::addWord, so it always fits in uint8_t.
-  // Vector is empty when no focus splits exist anywhere in the block (zero per-word RAM cost
-  // when focus reading is disabled, or on lines that happen to contain no splittable words).
-  std::vector<uint8_t> wordFocusBoundary;
-  // Pre-computed pixel offset from word start to the regular suffix, stored when boundary > 0.
-  // Eliminates getTextAdvanceX from the render path. 0 when boundary == 0.
-  // Empty in lockstep with wordFocusBoundary.
-  std::vector<uint16_t> wordFocusSuffixX;
   BlockStyle blockStyle;
+  uint16_t numWords = 0;
+  uint16_t textBytes = 0;  // total size of the text region, including NULs
+  bool focusPresent = false;
+  bool isValid = true;
+  // The ONLY allocation: makeUniqueNoThrow, so OOM yields an invalid block
+  // instead of abort() (bare new is not nothrow with -fno-exceptions).
+  std::unique_ptr<uint8_t[]> arena;
+  // Typed views into the arena, bound once after the arena is filled. All
+  // 16-bit bases sit at even offsets, so direct dereference is alignment-safe.
+  const uint16_t* textOffArr = nullptr;
+  const int16_t* xposArr = nullptr;
+  const uint16_t* focusSuffixXArr = nullptr;  // null when !focusPresent
+  const uint8_t* stylesArr = nullptr;
+  const uint8_t* focusBoundaryArr = nullptr;  // null when !focusPresent
+  const char* textArr = nullptr;
+
+  TextBlock() = default;  // deserialize() fills the fields directly
+  static size_t arenaSize(uint16_t wordCount, bool hasFocus, uint16_t textBytes);
+  void bindArenaPointers();
 
  public:
-  explicit TextBlock(std::vector<std::string> words, std::vector<int16_t> word_xpos,
-                     std::vector<EpdFontFamily::Style> word_styles, std::vector<uint8_t> focus_boundary,
-                     std::vector<uint16_t> focus_suffix_x, const BlockStyle& blockStyle = BlockStyle())
-      : words(std::move(words)),
-        wordXpos(std::move(word_xpos)),
-        wordStyles(std::move(word_styles)),
-        wordFocusBoundary(std::move(focus_boundary)),
-        wordFocusSuffixX(std::move(focus_suffix_x)),
-        blockStyle(blockStyle) {}
+  // Flatten-on-construct: copies the layout-time vectors into the arena; the
+  // vectors die with the caller. On arena OOM the block is empty and valid()
+  // is false -- callers must check and fail the line instead of using it.
+  explicit TextBlock(const std::vector<std::string>& words, const std::vector<int16_t>& wordXpos,
+                     const std::vector<EpdFontFamily::Style>& wordStyles, const std::vector<uint8_t>& focusBoundary,
+                     const std::vector<uint16_t>& focusSuffixX, const BlockStyle& blockStyle = BlockStyle());
   ~TextBlock() override = default;
+  TextBlock(const TextBlock&) = delete;
+  TextBlock& operator=(const TextBlock&) = delete;
+
   void setBlockStyle(const BlockStyle& blockStyle) { this->blockStyle = blockStyle; }
   const BlockStyle& getBlockStyle() const { return blockStyle; }
-  const std::vector<std::string>& getWords() const { return words; }
-  bool isEmpty() override { return words.empty(); }
-  size_t wordCount() const { return words.size(); }
-  // given a renderer works out where to break the words into lines
+  bool isEmpty() override { return numWords == 0; }
+  bool valid() const { return isValid; }
+  uint16_t wordCount() const { return numWords; }
+  // NUL-terminated by construction; safe to pass to C APIs directly.
+  const char* wordText(const uint16_t i) const { return textArr + textOffArr[i]; }
+  uint16_t wordTextLen(const uint16_t i) const {
+    const uint16_t end = (i + 1 < numWords) ? textOffArr[i + 1] : textBytes;
+    return end - textOffArr[i] - 1;  // exclude the NUL
+  }
+  int16_t wordXpos(const uint16_t i) const { return xposArr[i]; }
+  EpdFontFamily::Style wordStyle(const uint16_t i) const { return static_cast<EpdFontFamily::Style>(stylesArr[i]); }
+  uint8_t focusBoundary(const uint16_t i) const { return focusPresent ? focusBoundaryArr[i] : 0; }
+  uint16_t focusSuffixX(const uint16_t i) const { return focusPresent ? focusSuffixXArr[i] : 0; }
+
   void render(const GfxRenderer& renderer, int fontId, int x, int y) const;
   BlockType getType() override { return TEXT_BLOCK; }
-  bool serialize(FsFile& file) const;
-  static std::unique_ptr<TextBlock> deserialize(FsFile& file);
+  bool serialize(HalFile& file) const;
+  static std::unique_ptr<TextBlock> deserialize(HalFile& file);
 };

lib/Epub/Epub/converters/DirectPixelWriter.h

@@ -4,6 +4,8 @@
 #include <HalDisplay.h>
 #include <stdint.h>
 
+#include <cassert>
+
 // Direct framebuffer writer that eliminates per-pixel overhead from the image
 // rendering hot path.  Pre-computes orientation transform as linear coefficients
 // and caches render-mode state so the inner loop is: one multiply, one add,
@@ -16,6 +18,12 @@ struct DirectPixelWriter {
   uint8_t* fb;
   GfxRenderer::RenderMode mode;
   uint16_t displayWidthBytes;  // Runtime framebuffer stride (X4: 100, X3: 99)
+  // Active write target: for tiled grayscale, fb is the band scratch, originY is
+  // the band's top physical row, and clipRows is the band height. Off-band
+  // pixels are dropped. With no strip active these collapse to the full frame
+  // (originY 0, clipRows panelHeight) so the clip doubles as a bounds guard.
+  int originY;
+  int clipRows;
 
   // Orientation is collapsed into a linear transform:
   //   phyX = phyXBase + x * phyXStepX + y * phyXStepY
@@ -28,7 +36,9 @@ struct DirectPixelWriter {
   int rowPhyXBase, rowPhyYBase;
 
   void init(GfxRenderer& renderer) {
-    fb = renderer.getFrameBuffer();
+    fb = renderer.getWriteTarget();
+    originY = renderer.getWriteOriginY();
+    clipRows = renderer.getWriteRows();
     mode = renderer.getRenderMode();
     displayWidthBytes = renderer.getDisplayWidthBytes();
 
@@ -91,6 +101,46 @@ struct DirectPixelWriter {
     rowPhyYBase = phyYBase + logicalY * phyYStepY;
   }
 
+  // For the current row (set via beginRow), narrow [colStart, colEnd) to the
+  // columns whose pixels fall inside the active strip band. writePixel() would
+  // clip the rest anyway, but on a strip pass that is most of a full-page image
+  // (only ~one strip-height worth of columns survive in portrait); skipping them
+  // here avoids the per-pixel unpack+transform entirely. For full-frame passes
+  // (clipRows == panel height) the range is unchanged. xBase is the logical X of
+  // column 0; the band test mirrors writePixel(): 0 <= phyY - originY < clipRows.
+  inline void bandColRange(int xBase, int width, int& colStart, int& colEnd) const {
+    // init() only ever sets phyYStepX to 0, +1, or -1; the +1/-1 solve below
+    // relies on that.
+    assert(phyYStepX == 0 || phyYStepX == 1 || phyYStepX == -1);
+    colStart = 0;
+    colEnd = width;
+    if (phyYStepX == 0) {
+      // phyY is constant across the row: the whole row is in-band or out.
+      const int sy = rowPhyYBase - originY;
+      if (static_cast<unsigned>(sy) >= static_cast<unsigned>(clipRows)) colEnd = 0;
+      return;
+    }
+    // phyY = rowPhyYBase + logicalX * phyYStepX (phyYStepX is +1 or -1).
+    // Solve originY <= phyY <= originY + clipRows - 1 for logicalX.
+    const int loY = originY;
+    const int hiY = originY + clipRows - 1;
+    int xLo, xHi;
+    if (phyYStepX > 0) {
+      xLo = loY - rowPhyYBase;
+      xHi = hiY - rowPhyYBase;
+    } else {
+      xLo = rowPhyYBase - hiY;
+      xHi = rowPhyYBase - loY;
+    }
+    const int cs = xLo - xBase;
+    const int ce = xHi - xBase + 1;  // exclusive
+    if (cs > colStart) colStart = cs;
+    if (ce < colEnd) colEnd = ce;
+    if (colStart < 0) colStart = 0;
+    if (colEnd > width) colEnd = width;
+    if (colStart > colEnd) colStart = colEnd;
+  }
+
   // Write a single 2-bit dithered pixel value to the framebuffer.
   // Must be called after beginRow() for the current row.
   // No bounds checking — caller guarantees coordinates are valid.
@@ -120,7 +170,12 @@ struct DirectPixelWriter {
     const int phyX = rowPhyXBase + logicalX * phyXStepX;
     const int phyY = rowPhyYBase + logicalX * phyYStepX;
 
-    const uint16_t byteIndex = phyY * displayWidthBytes + (phyX >> 3);
+    // Band-local row. The unsigned compare drops both off-band pixels (strip
+    // mode) and any out-of-frame row (full-frame mode) in one branch.
+    const int sy = phyY - originY;
+    if (static_cast<unsigned>(sy) >= static_cast<unsigned>(clipRows)) return;
+
+    const uint16_t byteIndex = static_cast<uint16_t>(sy * displayWidthBytes + (phyX >> 3));
     const uint8_t bitMask = 1 << (7 - (phyX & 7));
 
     if (state) {
@@ -134,27 +189,42 @@ struct DirectPixelWriter {
 // Direct cache writer that eliminates per-pixel overhead from PixelCache::setPixel().
 // Pre-computes row pointer so the inner loop is just byte index + bit manipulation.
 //
-// Caller guarantees coordinates are within cache bounds.
+// The cache buffer is a small streaming band (e.g. 16 rows), not the full image,
+// so a band-relative row/column that lands outside it would corrupt adjacent
+// heap. This writer therefore bounds-checks every access: beginRow() invalidates
+// the row when it falls outside the band, and writePixel() drops out-of-range
+// columns. This path only runs during the single decode that populates the
+// cache, never on the screen render hot path, so the checks are cheap.
 struct DirectCacheWriter {
   uint8_t* buffer;
   int bytesPerRow;
+  int bandRows;
   int originX;
-  uint8_t* rowPtr;  // Pre-computed for current row
+  uint8_t* rowPtr;  // Pre-computed for current row; nullptr if row is out of band
 
-  void init(uint8_t* cacheBuffer, int cacheBytesPerRow, int cacheOriginX) {
+  void init(uint8_t* cacheBuffer, int cacheBytesPerRow, int cacheBandRows, int cacheOriginX) {
     buffer = cacheBuffer;
     bytesPerRow = cacheBytesPerRow;
+    bandRows = cacheBandRows;
     originX = cacheOriginX;
     rowPtr = nullptr;
   }
 
-  // Call once per row before the column loop.
-  inline void beginRow(int screenY, int cacheOriginY) { rowPtr = buffer + (screenY - cacheOriginY) * bytesPerRow; }
+  // Call once per row before the column loop. Drops rows outside the band.
+  inline void beginRow(int screenY, int cacheOriginY) {
+    const int localRow = screenY - cacheOriginY;
+    rowPtr = (static_cast<unsigned>(localRow) < static_cast<unsigned>(bandRows))
+                 ? buffer + (size_t)localRow * bytesPerRow
+                 : nullptr;
+  }
 
-  // Write a 2-bit pixel value. No bounds checking.
+  // Write a 2-bit pixel value. Drops the write if the row is out of band or the
+  // column is out of range.
   inline void writePixel(int screenX, uint8_t value) const {
+    if (!rowPtr) return;
     const int localX = screenX - originX;
-    const int byteIdx = localX >> 2;            // localX / 4
+    const int byteIdx = localX >> 2;  // localX / 4
+    if (static_cast<unsigned>(byteIdx) >= static_cast<unsigned>(bytesPerRow)) return;
     const int bitShift = 6 - (localX & 3) * 2;  // MSB first: pixel 0 at bits 6-7
     rowPtr[byteIdx] = (rowPtr[byteIdx] & ~(0x03 << bitShift)) | ((value & 0x03) << bitShift);
   }

lib/Epub/Epub/converters/JpegToFramebufferConverter.cpp

@@ -19,7 +19,7 @@ namespace {
 
 // Context struct passed through JPEGDEC callbacks to avoid global mutable state.
 // The draw callback receives this via pDraw->pUser (set by setUserPointer()).
-// The file I/O callbacks receive the FsFile* via pFile->fHandle (set by jpegOpen()).
+// The file I/O callbacks receive the HalFile* via pFile->fHandle (set by jpegOpen()).
 struct JpegContext {
   GfxRenderer* renderer{nullptr};
   const RenderConfig* config{nullptr};
@@ -48,10 +48,10 @@ struct JpegContext {
   bool caching{false};
 };
 
-// File I/O callbacks use pFile->fHandle to access the FsFile*,
+// File I/O callbacks use pFile->fHandle to access the HalFile*,
 // avoiding the need for global file state.
 void* jpegOpen(const char* filename, int32_t* size) {
-  FsFile* f = new FsFile();
+  HalFile* f = new HalFile();
   if (!Storage.openFileForRead("JPG", std::string(filename), *f)) {
     delete f;
     return nullptr;
@@ -61,7 +61,7 @@ void* jpegOpen(const char* filename, int32_t* size) {
 }
 
 void jpegClose(void* handle) {
-  FsFile* f = reinterpret_cast<FsFile*>(handle);
+  HalFile* f = reinterpret_cast<HalFile*>(handle);
   if (f) {
     f->close();
     delete f;
@@ -73,7 +73,7 @@ void jpegClose(void* handle) {
 // MUST maintain iPos to match the actual file position, otherwise progressive
 // JPEGs with large headers fail during parsing.
 int32_t jpegRead(JPEGFILE* pFile, uint8_t* pBuf, int32_t len) {
-  FsFile* f = reinterpret_cast<FsFile*>(pFile->fHandle);
+  HalFile* f = reinterpret_cast<HalFile*>(pFile->fHandle);
   if (!f) return 0;
   int32_t bytesRead = f->read(pBuf, len);
   if (bytesRead < 0) return 0;
@@ -82,7 +82,7 @@ int32_t jpegRead(JPEGFILE* pFile, uint8_t* pBuf, int32_t len) {
 }
 
 int32_t jpegSeek(JPEGFILE* pFile, int32_t pos) {
-  FsFile* f = reinterpret_cast<FsFile*>(pFile->fHandle);
+  HalFile* f = reinterpret_cast<HalFile*>(pFile->fHandle);
   if (!f) return -1;
   if (!f->seek(pos)) return -1;
   pFile->iPos = pos;
@@ -132,7 +132,7 @@ int jpegDrawCallback(JPEGDRAW* pDraw) {
   if (stride <= 0 || blockH <= 0 || validW <= 0) return 1;
 
   const bool useDithering = ctx->config->useDithering;
-  const bool caching = ctx->caching;
+  bool caching = ctx->caching;
   const int32_t fineScaleFPX = ctx->fineScaleFPX;
   const int32_t invScaleFPX = ctx->invScaleFPX;
   const int32_t fineScaleFPY = ctx->fineScaleFPY;
@@ -169,9 +169,21 @@ int jpegDrawCallback(JPEGDRAW* pDraw) {
   DirectPixelWriter pw;
   pw.init(renderer);
 
+  // The cache streams to disk one MCU-row band at a time. Flushing rows below
+  // this block (raster order guarantees they are final) repositions the band;
+  // cacheOriginY then maps screen rows to the band-local buffer rows. If a flush
+  // write fails, stop caching for the rest of this decode (and let finalize drop
+  // the partial file) rather than writing past the band buffer.
   DirectCacheWriter cw;
+  int cacheOriginY = 0;
   if (caching) {
-    cw.init(ctx->cache.buffer, ctx->cache.bytesPerRow, ctx->cache.originX);
+    if (!ctx->cache.advanceTo(dstYStart)) {
+      caching = false;
+      ctx->caching = false;
+    } else {
+      cw.init(ctx->cache.buffer, ctx->cache.bytesPerRow, ctx->cache.bandRows, ctx->cache.originX);
+      cacheOriginY = ctx->config->y + ctx->cache.bandStart;
+    }
   }
 
   // === 1:1 fast path: no scaling math ===
@@ -179,7 +191,7 @@ int jpegDrawCallback(JPEGDRAW* pDraw) {
     for (int dstY = dstYStart; dstY < dstYEnd; dstY++) {
       const int outY = cfgY + dstY;
       pw.beginRow(outY);
-      if (caching) cw.beginRow(outY, ctx->config->y);
+      if (caching) cw.beginRow(outY, cacheOriginY);
       const uint8_t* row = &pixels[(dstY - blockY) * stride];
       for (int dstX = dstXStart; dstX < dstXEnd; dstX++) {
         const int outX = cfgX + dstX;
@@ -213,7 +225,7 @@ int jpegDrawCallback(JPEGDRAW* pDraw) {
     for (int dstY = dstYStart; dstY < dstYEnd; dstY++) {
       const int outY = cfgY + dstY;
       pw.beginRow(outY);
-      if (caching) cw.beginRow(outY, ctx->config->y);
+      if (caching) cw.beginRow(outY, cacheOriginY);
       const int32_t srcFyFP = dstY * invScaleFPY;
       const int32_t fy = srcFyFP & FP_MASK;
       const int32_t fyInv = FP_ONE - fy;
@@ -310,7 +322,7 @@ int jpegDrawCallback(JPEGDRAW* pDraw) {
   for (int dstY = dstYStart; dstY < dstYEnd; dstY++) {
     const int outY = cfgY + dstY;
     pw.beginRow(outY);
-    if (caching) cw.beginRow(outY, ctx->config->y);
+    if (caching) cw.beginRow(outY, cacheOriginY);
     const int32_t srcFyFP = dstY * invScaleFPY;
     int ly = (srcFyFP >> FP_SHIFT) - blockY;
     if (ly < 0) ly = 0;
@@ -469,11 +481,14 @@ bool JpegToFramebufferConverter::decodeToFramebuffer(const std::string& imagePat
   jpeg->setPixelType(EIGHT_BIT_GRAYSCALE);
   jpeg->setUserPointer(&ctx);
 
-  // Allocate cache buffer using final output dimensions
+  // Start streaming the pixel cache to disk. The band only needs to hold the
+  // tallest single decode block: a JPEGDEC MCU cell is at most 16 scaled-source
+  // rows tall, which our fine scale maps to this many output rows.
   ctx.caching = !config.cachePath.empty();
   if (ctx.caching) {
-    if (!ctx.cache.allocate(destWidth, destHeight, config.x, config.y)) {
-      LOG_ERR("JPG", "Failed to allocate cache buffer, continuing without caching");
+    const int maxBlockDstRows = (int)(((int64_t)16 * ctx.fineScaleFPY) >> FP_SHIFT) + 2;
+    if (!ctx.cache.begin(config.cachePath, destWidth, destHeight, config.x, config.y, maxBlockDstRows)) {
+      LOG_ERR("JPG", "Failed to start cache stream, continuing without caching");
       ctx.caching = false;
     }
   }
@@ -484,14 +499,16 @@ bool JpegToFramebufferConverter::decodeToFramebuffer(const std::string& imagePat
 
   if (rc != 1) {
     LOG_ERR("JPG", "Decode failed (rc=%d, lastError=%d)", rc, jpeg->getLastError());
+    if (ctx.caching) ctx.cache.abort();
     return false;
   }
 
   LOG_DBG("JPG", "JPEG decoding complete - render time: %lu ms", decodeTime);
 
-  // Write cache file if caching was enabled
+  // Finalize the streamed cache file. Note: a flush failure mid-decode clears
+  // ctx.caching (the partial file is dropped), so re-read the flag here.
   if (ctx.caching) {
-    ctx.cache.writeToFile(config.cachePath);
+    ctx.cache.finalize();
   }
 
   return true;

lib/Epub/Epub/converters/PixelCache.h

@@ -4,76 +4,181 @@
 #include <Logging.h>
 #include <stdint.h>
 
+#include <cstdlib>
 #include <cstring>
 #include <string>
 
-// Cache buffer for storing 2-bit pixels (4 levels) during decode.
-// Packs 4 pixels per byte, MSB first.
+// Streaming cache writer for 2-bit pixels (4 levels). Packs 4 pixels per byte,
+// MSB first.
+//
+// The .pxc file is written incrementally in small row bands rather than holding
+// the whole decoded image in one heap buffer. A full-page image (e.g. 482x728)
+// needs ~88KB packed, which will not fit alongside the ~20KB JPEG decoder on a
+// fragmented 380KB heap (free heap is routinely ~55KB on an image page). When
+// the cache cannot be written, every render pass re-decodes the JPEG from
+// scratch; an anti-aliased image page renders ~14 times (BW + AA restore + two
+// grayscale planes x ~6 strips), so a 2s decode becomes a ~30s freeze / watchdog
+// reset. Streaming keeps the working set to a single MCU-row band, so caching
+// succeeds and the image is decoded exactly once.
+//
+// Correctness relies on JPEGDEC delivering blocks in raster MCU order (outer
+// loop over y, inner over x: see jpeg.inl DecodeJPEG). Consecutive MCU rows map
+// to contiguous, non-overlapping destination row ranges, so once a block whose
+// top row is Y arrives, every output row < Y is final and is flushed to disk.
 struct PixelCache {
-  uint8_t* buffer;
+  uint8_t* buffer;   // band buffer: (bandRows + 1) rows; last row kept zeroed
+  uint8_t* zeroRow;  // points at the spare zeroed row, for gap/clip fill
   int width;
   int height;
   int bytesPerRow;
-  int originX;  // config.x - to convert screen coords to cache coords
-  int originY;  // config.y
+  int originX;      // config.x - to convert screen coords to cache coords
+  int originY;      // config.y
+  int bandRows;     // rows held in the band buffer
+  int bandStart;    // image-local row index of band buffer row 0
+  int flushedRows;  // image-local rows already written to file
+  HalFile file;
+  std::string cachePathStr;
+  bool ok;
 
-  PixelCache() : buffer(nullptr), width(0), height(0), bytesPerRow(0), originX(0), originY(0) {}
+  PixelCache()
+      : buffer(nullptr),
+        zeroRow(nullptr),
+        width(0),
+        height(0),
+        bytesPerRow(0),
+        originX(0),
+        originY(0),
+        bandRows(0),
+        bandStart(0),
+        flushedRows(0),
+        ok(false) {}
   PixelCache(const PixelCache&) = delete;
   PixelCache& operator=(const PixelCache&) = delete;
 
-  static constexpr size_t MAX_CACHE_BYTES = 256 * 1024;  // 256KB limit for embedded targets
+  static constexpr int MIN_BAND_ROWS = 16;
+  static constexpr size_t MAX_BAND_BYTES = 24 * 1024;  // band working-set ceiling
 
-  bool allocate(int w, int h, int ox, int oy) {
+  // Open the cache file, write the header, and allocate a band buffer big enough
+  // to hold the tallest single decode block (maxBlockDstRows output rows).
+  bool begin(const std::string& cachePath, int w, int h, int ox, int oy, int maxBlockDstRows) {
     width = w;
     height = h;
     originX = ox;
     originY = oy;
     bytesPerRow = (w + 3) / 4;  // 2 bits per pixel, 4 pixels per byte
-    size_t bufferSize = (size_t)bytesPerRow * h;
-    if (bufferSize > MAX_CACHE_BYTES) {
-      LOG_ERR("IMG", "Cache buffer too large: %d bytes for %dx%d (limit %d)", bufferSize, w, h, MAX_CACHE_BYTES);
+    bandStart = 0;
+    flushedRows = 0;
+    ok = false;
+
+    int wantRows = maxBlockDstRows + 2;
+    if (wantRows < MIN_BAND_ROWS) wantRows = MIN_BAND_ROWS;
+    if (wantRows > h) wantRows = h;
+
+    size_t maxRowsByMem = MAX_BAND_BYTES / (size_t)bytesPerRow;
+    if (maxRowsByMem < 1) maxRowsByMem = 1;
+    if ((size_t)wantRows > maxRowsByMem) wantRows = (int)maxRowsByMem;
+
+    // A single decode block must fit inside the band, otherwise streaming would
+    // drop rows. This only fails for pathological upscales that could not be
+    // cached at all; fall back to the no-cache path.
+    if (wantRows < maxBlockDstRows) {
+      LOG_ERR("IMG", "Cache band too small (%d < %d rows) for %dx%d", wantRows, maxBlockDstRows, w, h);
       return false;
     }
-    buffer = (uint8_t*)malloc(bufferSize);
-    if (buffer) {
-      memset(buffer, 0, bufferSize);
-      LOG_DBG("IMG", "Allocated cache buffer: %d bytes for %dx%d", bufferSize, w, h);
+    bandRows = wantRows;
+
+    const size_t bufSize = (size_t)(bandRows + 1) * bytesPerRow;  // +1 spare zero row
+    buffer = (uint8_t*)malloc(bufSize);
+    if (!buffer) {
+      LOG_ERR("IMG", "OOM cache band: %u bytes", (unsigned)bufSize);
+      return false;
     }
-    return buffer != nullptr;
-  }
+    memset(buffer, 0, bufSize);
+    zeroRow = buffer + (size_t)bandRows * bytesPerRow;
 
-  void setPixel(int screenX, int screenY, uint8_t value) {
-    if (!buffer) return;
-    int localX = screenX - originX;
-    int localY = screenY - originY;
-    if (localX < 0 || localX >= width || localY < 0 || localY >= height) return;
-
-    int byteIdx = localY * bytesPerRow + localX / 4;
-    int bitShift = 6 - (localX % 4) * 2;  // MSB first: pixel 0 at bits 6-7
-    buffer[byteIdx] = (buffer[byteIdx] & ~(0x03 << bitShift)) | ((value & 0x03) << bitShift);
-  }
-
-  bool writeToFile(const std::string& cachePath) {
-    if (!buffer) return false;
-
-    FsFile cacheFile;
-    if (!Storage.openFileForWrite("IMG", cachePath, cacheFile)) {
+    if (!Storage.openFileForWrite("IMG", cachePath, file)) {
       LOG_ERR("IMG", "Failed to open cache file for writing: %s", cachePath.c_str());
+      free(buffer);
+      buffer = nullptr;
+      return false;
+    }
+    cachePathStr = cachePath;
+
+    uint16_t w16 = (uint16_t)w;
+    uint16_t h16 = (uint16_t)h;
+    if (file.write(&w16, 2) != 2 || file.write(&h16, 2) != 2) {
+      LOG_ERR("IMG", "Failed to write cache header: %s", cachePath.c_str());
+      abort();
       return false;
     }
 
-    uint16_t w = width;
-    uint16_t h = height;
-    cacheFile.write(&w, 2);
-    cacheFile.write(&h, 2);
-    cacheFile.write(buffer, bytesPerRow * height);
-    cacheFile.close();
-
-    LOG_DBG("IMG", "Cache written: %s (%dx%d, %d bytes)", cachePath.c_str(), width, height, 4 + bytesPerRow * height);
+    LOG_DBG("IMG", "Cache stream started: %s (%dx%d, band %d rows)", cachePath.c_str(), w, h, bandRows);
+    ok = true;
     return true;
   }
 
+  // Flush every output row below newTopRow (they are final in raster order) and
+  // reposition the band to start at newTopRow. Returns false if a write failed,
+  // in which case the caller must stop caching for the rest of the decode.
+  bool advanceTo(int newTopRow) {
+    if (!ok) return false;
+    if (newTopRow <= bandStart) return true;
+    if (newTopRow > height) newTopRow = height;
+
+    for (int r = bandStart; r < newTopRow; ++r) {
+      const int idx = r - bandStart;
+      const uint8_t* rowPtr = (idx < bandRows) ? (buffer + (size_t)idx * bytesPerRow) : zeroRow;
+      if (file.write(rowPtr, (size_t)bytesPerRow) != (size_t)bytesPerRow) {
+        LOG_ERR("IMG", "Cache write error at row %d", r);
+        ok = false;
+        return false;
+      }
+    }
+    flushedRows = newTopRow;
+    bandStart = newTopRow;
+    memset(buffer, 0, (size_t)bandRows * bytesPerRow);  // fresh band (gaps stay black)
+    return true;
+  }
+
+  // Flush the final band and zero-fill any rows never covered (image clipped by
+  // the screen), then close the file.
+  bool finalize() {
+    if (!ok) {
+      abort();
+      return false;
+    }
+    for (int r = flushedRows; r < height; ++r) {
+      const int idx = r - bandStart;
+      const uint8_t* rowPtr = (idx >= 0 && idx < bandRows) ? (buffer + (size_t)idx * bytesPerRow) : zeroRow;
+      if (file.write(rowPtr, (size_t)bytesPerRow) != (size_t)bytesPerRow) {
+        LOG_ERR("IMG", "Cache write error at row %d", r);
+        abort();
+        return false;
+      }
+    }
+    file.close();
+    LOG_DBG("IMG", "Cache written: %s (%dx%d, %d bytes)", cachePathStr.c_str(), width, height,
+            4 + bytesPerRow * height);
+    ok = false;  // file handed off; nothing left to clean up
+    return true;
+  }
+
+  // Drop a partial/failed cache so a later decode re-creates it cleanly.
+  void abort() {
+    if (file.isOpen()) file.close();
+    if (!cachePathStr.empty()) {
+      Storage.remove(cachePathStr.c_str());
+    }
+    ok = false;
+  }
+
   ~PixelCache() {
+    if (file.isOpen()) {
+      // The file is still open, so neither finalize() nor abort() ran, or a
+      // mid-stream write failed (advanceTo() cleared ok but left the file open).
+      // Drop the partial cache so we leave no corrupt file behind.
+      abort();
+    }
     if (buffer) {
       free(buffer);
       buffer = nullptr;

lib/Epub/Epub/converters/PngToFramebufferConverter.cpp

@@ -19,7 +19,7 @@ namespace {
 
 // Context struct passed through PNGdec callbacks to avoid global mutable state.
 // The draw callback receives this via pDraw->pUser (set by png.decode()).
-// The file I/O callbacks receive the FsFile* via pFile->fHandle (set by pngOpen()).
+// The file I/O callbacks receive the HalFile* via pFile->fHandle (set by pngOpen()).
 struct PngContext {
   GfxRenderer* renderer{nullptr};
   const RenderConfig* config{nullptr};
@@ -40,10 +40,10 @@ struct PngContext {
   uint8_t* grayLineBuffer{nullptr};
 };
 
-// File I/O callbacks use pFile->fHandle to access the FsFile*,
+// File I/O callbacks use pFile->fHandle to access the HalFile*,
 // avoiding the need for global file state.
 void* pngOpenWithHandle(const char* filename, int32_t* size) {
-  FsFile* f = new FsFile();
+  HalFile* f = new HalFile();
   if (!Storage.openFileForRead("PNG", std::string(filename), *f)) {
     delete f;
     return nullptr;
@@ -53,7 +53,7 @@ void* pngOpenWithHandle(const char* filename, int32_t* size) {
 }
 
 void pngCloseWithHandle(void* handle) {
-  FsFile* f = reinterpret_cast<FsFile*>(handle);
+  HalFile* f = reinterpret_cast<HalFile*>(handle);
   if (f) {
     f->close();
     delete f;
@@ -61,13 +61,13 @@ void pngCloseWithHandle(void* handle) {
 }
 
 int32_t pngReadWithHandle(PNGFILE* pFile, uint8_t* pBuf, int32_t len) {
-  FsFile* f = reinterpret_cast<FsFile*>(pFile->fHandle);
+  HalFile* f = reinterpret_cast<HalFile*>(pFile->fHandle);
   if (!f) return 0;
   return f->read(pBuf, len);
 }
 
 int32_t pngSeekWithHandle(PNGFILE* pFile, int32_t pos) {
-  FsFile* f = reinterpret_cast<FsFile*>(pFile->fHandle);
+  HalFile* f = reinterpret_cast<HalFile*>(pFile->fHandle);
   if (!f) return -1;
   return f->seek(pos);
 }
@@ -99,24 +99,58 @@ int bytesPerPixelFromType(int pixelType) {
   }
 }
 
-int requiredPngInternalBufferBytes(int srcWidth, int pixelType) {
+int packedRowBytes(int srcWidth, int bitsPerSample) { return (srcWidth * bitsPerSample + 7) / 8; }
+
+int requiredPngInternalBufferBytes(int srcWidth, int pixelType, int bitsPerSample) {
   // +1 filter byte per scanline, *2 for current+previous lines, +32 for alignment margin.
   int pitch = srcWidth * bytesPerPixelFromType(pixelType);
+  if ((pixelType == PNG_PIXEL_GRAYSCALE || pixelType == PNG_PIXEL_INDEXED) && bitsPerSample < 8) {
+    pitch = packedRowBytes(srcWidth, bitsPerSample);
+  }
   return ((pitch + 1) * 2) + 32;
 }
 
+bool isSupportedBitDepth(int pixelType, int bitsPerSample) {
+  if (bitsPerSample == 8) return true;
+  if (bitsPerSample != 1 && bitsPerSample != 2 && bitsPerSample != 4) return false;
+  return pixelType == PNG_PIXEL_GRAYSCALE || pixelType == PNG_PIXEL_INDEXED;
+}
+
+uint8_t readPackedSample(const uint8_t* pixels, int x, int bitsPerSample) {
+  if (bitsPerSample == 8) return pixels[x];
+
+  const int bitOffset = x * bitsPerSample;
+  const int shift = 8 - bitsPerSample - (bitOffset & 7);
+  const uint8_t mask = (1U << bitsPerSample) - 1;
+  return (pixels[bitOffset >> 3] >> shift) & mask;
+}
+
+uint8_t expandSampleToByte(uint8_t sample, int bitsPerSample) {
+  if (bitsPerSample == 8) return sample;
+  const uint8_t maxSample = (1U << bitsPerSample) - 1;
+  return static_cast<uint8_t>((sample * 255U) / maxSample);
+}
+
 // Convert entire source line to grayscale with alpha blending to white background.
+// Low-bit-depth grayscale/indexed scanlines are packed most-significant sample first.
 // For indexed PNGs with tRNS chunk, alpha values are stored at palette[768] onwards.
 // Processing the whole line at once improves cache locality and reduces per-pixel overhead.
-void convertLineToGray(uint8_t* pPixels, uint8_t* grayLine, int width, int pixelType, uint8_t* palette, int hasAlpha) {
+void convertLineToGray(const uint8_t* pPixels, uint8_t* grayLine, int width, int pixelType, int bitsPerSample,
+                       uint8_t* palette, int hasAlpha) {
   switch (pixelType) {
     case PNG_PIXEL_GRAYSCALE:
-      memcpy(grayLine, pPixels, width);
+      if (bitsPerSample == 8) {
+        memcpy(grayLine, pPixels, width);
+      } else {
+        for (int x = 0; x < width; x++) {
+          grayLine[x] = expandSampleToByte(readPackedSample(pPixels, x, bitsPerSample), bitsPerSample);
+        }
+      }
       break;
 
     case PNG_PIXEL_TRUECOLOR:
       for (int x = 0; x < width; x++) {
-        uint8_t* p = &pPixels[x * 3];
+        const uint8_t* p = &pPixels[x * 3];
         grayLine[x] = (uint8_t)((p[0] * 77 + p[1] * 150 + p[2] * 29) >> 8);
       }
       break;
@@ -125,7 +159,7 @@ void convertLineToGray(uint8_t* pPixels, uint8_t* grayLine, int width, int pixel
       if (palette) {
         if (hasAlpha) {
           for (int x = 0; x < width; x++) {
-            uint8_t idx = pPixels[x];
+            uint8_t idx = readPackedSample(pPixels, x, bitsPerSample);
             uint8_t* p = &palette[idx * 3];
             uint8_t gray = (uint8_t)((p[0] * 77 + p[1] * 150 + p[2] * 29) >> 8);
             uint8_t alpha = palette[768 + idx];
@@ -133,12 +167,15 @@ void convertLineToGray(uint8_t* pPixels, uint8_t* grayLine, int width, int pixel
           }
         } else {
           for (int x = 0; x < width; x++) {
-            uint8_t* p = &palette[pPixels[x] * 3];
+            uint8_t idx = readPackedSample(pPixels, x, bitsPerSample);
+            uint8_t* p = &palette[idx * 3];
             grayLine[x] = (uint8_t)((p[0] * 77 + p[1] * 150 + p[2] * 29) >> 8);
           }
         }
       } else {
-        memcpy(grayLine, pPixels, width);
+        for (int x = 0; x < width; x++) {
+          grayLine[x] = expandSampleToByte(readPackedSample(pPixels, x, bitsPerSample), bitsPerSample);
+        }
       }
       break;
 
@@ -152,7 +189,7 @@ void convertLineToGray(uint8_t* pPixels, uint8_t* grayLine, int width, int pixel
 
     case PNG_PIXEL_TRUECOLOR_ALPHA:
       for (int x = 0; x < width; x++) {
-        uint8_t* p = &pPixels[x * 4];
+        const uint8_t* p = &pPixels[x * 4];
         uint8_t gray = (uint8_t)((p[0] * 77 + p[1] * 150 + p[2] * 29) >> 8);
         uint8_t alpha = p[3];
         grayLine[x] = (uint8_t)((gray * alpha + 255 * (255 - alpha)) / 255);
@@ -172,65 +209,83 @@ int pngDrawCallback(PNGDRAW* pDraw) {
   int srcY = pDraw->y;
   int srcWidth = ctx->srcWidth;
 
-  // Calculate destination Y with scaling
-  int dstY = (int)(srcY * ctx->scale);
+  // Map source rows with the exact output-height ratio. During downscaling,
+  // multiple source rows can select the same output row; during upscaling, one
+  // source row must be repeated across every output row in its range. Emitting
+  // only the first row of an upscale leaves zero-filled (black) gaps in the
+  // streamed pixel cache.
+  int firstDstY = (srcY * ctx->dstHeight) / ctx->srcHeight;
+  int endDstY = firstDstY + 1;
+  if (ctx->dstHeight > ctx->srcHeight) {
+    endDstY = ((srcY + 1) * ctx->dstHeight) / ctx->srcHeight;
+  }
 
-  // Skip if we already rendered this destination row (multiple source rows map to same dest)
-  if (dstY == ctx->lastDstY) return 1;
-  ctx->lastDstY = dstY;
-
-  // Check bounds
-  if (dstY >= ctx->dstHeight) return 1;
-
-  int outY = ctx->config->y + dstY;
-  if (outY >= ctx->screenHeight) return 1;
+  if (firstDstY <= ctx->lastDstY) firstDstY = ctx->lastDstY + 1;
+  if (firstDstY >= endDstY || firstDstY >= ctx->dstHeight) return 1;
+  if (endDstY > ctx->dstHeight) endDstY = ctx->dstHeight;
 
   // Convert entire source line to grayscale (improves cache locality)
-  convertLineToGray(pDraw->pPixels, ctx->grayLineBuffer, srcWidth, pDraw->iPixelType, pDraw->pPalette,
+  convertLineToGray(pDraw->pPixels, ctx->grayLineBuffer, srcWidth, pDraw->iPixelType, pDraw->iBpp, pDraw->pPalette,
                     pDraw->iHasAlpha);
 
-  // Render scaled row using Bresenham-style integer stepping (no floating-point division)
+  // Render scaled rows using Bresenham-style integer stepping (no floating-point division)
   int dstWidth = ctx->dstWidth;
   int outXBase = ctx->config->x;
   int screenWidth = ctx->screenWidth;
   bool useDithering = ctx->config->useDithering;
-  bool caching = ctx->caching;
 
-  // Pre-compute orientation and render-mode state once per row
+  // Pre-compute orientation and render-mode state once per callback.
   DirectPixelWriter pw;
   pw.init(*ctx->renderer);
-  pw.beginRow(outY);
 
-  DirectCacheWriter cw;
-  if (caching) {
-    cw.init(ctx->cache.buffer, ctx->cache.bytesPerRow, ctx->cache.originX);
-    cw.beginRow(outY, ctx->config->y);
-  }
+  for (int dstY = firstDstY; dstY < endDstY; dstY++) {
+    ctx->lastDstY = dstY;
+    int outY = ctx->config->y + dstY;
+    if (outY >= ctx->screenHeight) continue;
 
-  int srcX = 0;
-  int error = 0;
+    pw.beginRow(outY);
 
-  for (int dstX = 0; dstX < dstWidth; dstX++) {
-    int outX = outXBase + dstX;
-    if (outX < screenWidth) {
-      uint8_t gray = ctx->grayLineBuffer[srcX];
-
-      uint8_t ditheredGray;
-      if (useDithering) {
-        ditheredGray = applyBayerDither4Level(gray, outX, outY);
+    // The cache streams to disk one row at a time. Flushing rows below this one
+    // (PNGdec delivers scanlines top to bottom) repositions the single-row band.
+    // A flush failure stops caching for the rest of the decode so we never write
+    // past the band buffer; finalize() then drops the partial file.
+    bool caching = ctx->caching;
+    DirectCacheWriter cw;
+    if (caching) {
+      if (!ctx->cache.advanceTo(dstY)) {
+        caching = false;
+        ctx->caching = false;
       } else {
-        ditheredGray = gray / 85;
-        if (ditheredGray > 3) ditheredGray = 3;
+        cw.init(ctx->cache.buffer, ctx->cache.bytesPerRow, ctx->cache.bandRows, ctx->cache.originX);
+        cw.beginRow(outY, ctx->config->y + ctx->cache.bandStart);
       }
-      pw.writePixel(outX, ditheredGray);
-      if (caching) cw.writePixel(outX, ditheredGray);
     }
 
-    // Bresenham-style stepping: advance srcX based on ratio srcWidth/dstWidth
-    error += srcWidth;
-    while (error >= dstWidth) {
-      error -= dstWidth;
-      srcX++;
+    int srcX = 0;
+    int error = 0;
+
+    for (int dstX = 0; dstX < dstWidth; dstX++) {
+      int outX = outXBase + dstX;
+      if (outX < screenWidth) {
+        uint8_t gray = ctx->grayLineBuffer[srcX];
+
+        uint8_t ditheredGray;
+        if (useDithering) {
+          ditheredGray = applyBayerDither4Level(gray, outX, outY);
+        } else {
+          ditheredGray = gray / 85;
+          if (ditheredGray > 3) ditheredGray = 3;
+        }
+        pw.writePixel(outX, ditheredGray);
+        if (caching) cw.writePixel(outX, ditheredGray);
+      }
+
+      // Bresenham-style stepping: advance srcX based on ratio srcWidth/dstWidth
+      error += srcWidth;
+      while (error >= dstWidth) {
+        error -= dstWidth;
+        srcX++;
+      }
     }
   }
 
@@ -323,44 +378,55 @@ bool PngToFramebufferConverter::decodeToFramebuffer(const std::string& imagePath
   }
   ctx.lastDstY = -1;  // Reset row tracking
 
-  LOG_DBG("PNG", "PNG %dx%d -> %dx%d (scale %.2f), bpp: %d", ctx.srcWidth, ctx.srcHeight, ctx.dstWidth, ctx.dstHeight,
-          ctx.scale, png->getBpp());
-
   const int pixelType = png->getPixelType();
-  const int requiredInternal = requiredPngInternalBufferBytes(ctx.srcWidth, pixelType);
+  const int bitsPerSample = png->getBpp();
+  LOG_DBG("PNG", "PNG %dx%d -> %dx%d (scale %.2f), type: %d, bpp: %d", ctx.srcWidth, ctx.srcHeight, ctx.dstWidth,
+          ctx.dstHeight, ctx.scale, pixelType, bitsPerSample);
+
+  const int requiredInternal = requiredPngInternalBufferBytes(ctx.srcWidth, pixelType, bitsPerSample);
   if (requiredInternal > PNG_MAX_BUFFERED_PIXELS) {
-    LOG_ERR("PNG",
-            "PNG row buffer too small: need %d bytes for width=%d type=%d, configured PNG_MAX_BUFFERED_PIXELS=%d",
-            requiredInternal, ctx.srcWidth, pixelType, PNG_MAX_BUFFERED_PIXELS);
+    LOG_ERR(
+        "PNG",
+        "PNG row buffer too small: need %d bytes for width=%d type=%d bpp=%d, configured PNG_MAX_BUFFERED_PIXELS=%d",
+        requiredInternal, ctx.srcWidth, pixelType, bitsPerSample, PNG_MAX_BUFFERED_PIXELS);
     LOG_ERR("PNG", "Aborting decode to avoid PNGdec internal buffer overflow");
     return false;
   }
 
-  if (png->getBpp() != 8) {
-    warnUnsupportedFeature("bit depth (" + std::to_string(png->getBpp()) + "bpp)", imagePath);
-  }
-
-  // Allocate grayscale line buffer on demand (~3.2 KB) - freed after decode
-  const size_t grayBufSize = PNG_MAX_BUFFERED_PIXELS / 2;
-  ctx.grayLineBuffer = static_cast<uint8_t*>(malloc(grayBufSize));
-  if (!ctx.grayLineBuffer) {
-    LOG_ERR("PNG", "Failed to allocate gray line buffer");
+  if (!isSupportedBitDepth(pixelType, bitsPerSample)) {
+    warnUnsupportedFeature(
+        "bit depth (" + std::to_string(bitsPerSample) + "bpp) for pixel type " + std::to_string(pixelType), imagePath);
     return false;
   }
 
-  // Allocate cache buffer using SCALED dimensions.
-  // PNG decode is fast enough (~135ms for 400x600) that caching provides minimal benefit
-  // for larger images, while the cache buffer competes with the 44KB PNG decoder for heap.
-  // Skip caching when the buffer would exceed the framebuffer size (48KB).
-  static constexpr size_t PNG_MAX_CACHE_BYTES = 48000;
+  // The converter expands each source row to 8-bit grayscale before dithering,
+  // so this scratch buffer is sized by source pixels even when PNGdec reads a
+  // packed 1/2/4-bit row internally.
+  constexpr size_t MAX_GRAY_LINE_BUFFER_BYTES = PNG_MAX_BUFFERED_PIXELS / 2;
+  const size_t grayBufSize = static_cast<size_t>(ctx.srcWidth);
+  if (grayBufSize > MAX_GRAY_LINE_BUFFER_BYTES) {
+    LOG_ERR("PNG", "Expanded gray row too wide: need %u bytes for width=%d, max=%u", static_cast<unsigned>(grayBufSize),
+            ctx.srcWidth, static_cast<unsigned>(MAX_GRAY_LINE_BUFFER_BYTES));
+    return false;
+  }
+
+  auto grayLineBuffer = makeUniqueNoThrow<uint8_t[]>(grayBufSize);
+  if (!grayLineBuffer) {
+    LOG_ERR("PNG", "Failed to allocate gray line buffer");
+    return false;
+  }
+  ctx.grayLineBuffer = grayLineBuffer.get();
+
+  // Stream the pixel cache to disk. PNGdec delivers source scanlines top to
+  // bottom and we emit at most one (downscaled) output row per callback, so the
+  // band only needs a single row. Streaming keeps the working set tiny, so
+  // unlike the old full-image buffer it neither competes with the ~44KB decoder
+  // nor forces larger images to skip caching - which previously meant a full
+  // re-decode on every one of an image page's ~14 render passes.
   ctx.caching = !config.cachePath.empty();
   if (ctx.caching) {
-    size_t cacheSize = (size_t)((ctx.dstWidth + 3) / 4) * ctx.dstHeight;
-    if (cacheSize > PNG_MAX_CACHE_BYTES) {
-      LOG_DBG("PNG", "Skipping cache: %zu bytes exceeds PNG limit (%zu)", cacheSize, PNG_MAX_CACHE_BYTES);
-      ctx.caching = false;
-    } else if (!ctx.cache.allocate(ctx.dstWidth, ctx.dstHeight, config.x, config.y)) {
-      LOG_ERR("PNG", "Failed to allocate cache buffer, continuing without caching");
+    if (!ctx.cache.begin(config.cachePath, ctx.dstWidth, ctx.dstHeight, config.x, config.y, 1)) {
+      LOG_ERR("PNG", "Failed to start cache stream, continuing without caching");
       ctx.caching = false;
     }
   }
@@ -369,19 +435,19 @@ bool PngToFramebufferConverter::decodeToFramebuffer(const std::string& imagePath
   rc = png->decode(&ctx, 0);
   unsigned long decodeTime = millis() - decodeStart;
 
-  free(ctx.grayLineBuffer);
   ctx.grayLineBuffer = nullptr;
 
   if (rc != PNG_SUCCESS) {
     LOG_ERR("PNG", "Decode failed: %d", rc);
+    if (ctx.caching) ctx.cache.abort();
     return false;
   }
 
   LOG_DBG("PNG", "PNG decoding complete - render time: %lu ms", decodeTime);
 
-  // Write cache file if caching was enabled and buffer was allocated
+  // Finalize the streamed cache (caching may have been cleared on a flush error).
   if (ctx.caching) {
-    ctx.cache.writeToFile(config.cachePath);
+    ctx.cache.finalize();
   }
 
   return true;

lib/Epub/Epub/css/CssParser.cpp

@@ -6,6 +6,8 @@
 #include <algorithm>
 #include <array>
 #include <cctype>
+#include <charconv>
+#include <cstring>
 #include <string_view>
 
 namespace {
@@ -29,9 +31,7 @@ struct StackBuffer {
 
   // Get string view of current content (zero-copy)
   std::string_view view() const { return std::string_view(data, len); }
-
-  // Convert to string for passing to functions (single allocation)
-  std::string str() const { return std::string(data, len); }
+  operator std::string_view() const noexcept { return view(); }
 };
 
 // Buffer size for reading CSS files
@@ -50,7 +50,80 @@ constexpr size_t MIN_FREE_HEAP_FOR_CSS = 48 * 1024;
 constexpr size_t MAX_SELECTOR_LENGTH = 256;
 
 // Check if character is CSS whitespace
-bool isCssWhitespace(const char c) { return c == ' ' || c == '\t' || c == '\n' || c == '\r' || c == '\f'; }
+constexpr bool isCssWhitespace(const char c) { return c == ' ' || c == '\t' || c == '\n' || c == '\r' || c == '\f'; }
+
+constexpr std::string_view trimCssWhitespace(std::string_view s) {
+  while (!s.empty() && isCssWhitespace(s.front())) s.remove_prefix(1);
+  while (!s.empty() && isCssWhitespace(s.back())) s.remove_suffix(1);
+  return s;
+}
+
+constexpr char asciiToLower(const char c) { return (c >= 'A' && c <= 'Z') ? static_cast<char>(c + 32) : c; }
+
+// Case-insensitive equality on ASCII. lowercaseKeyword MUST already be
+// lowercase; CSS keywords are ASCII by spec so byte-wise tolower is safe.
+constexpr bool iequalsAscii(std::string_view value, std::string_view lowercaseKeyword) {
+  return std::equal(value.begin(), value.end(), lowercaseKeyword.begin(), lowercaseKeyword.end(),
+                    [](char a, char b) { return asciiToLower(a) == b; });
+}
+
+// Walk s and invoke fn(token) for each non-empty run between delimiters.
+// Tokens are boundary-trimmed and yielded as string_views into s; no
+// allocation. Runs of consecutive delimiters coalesce — no empty tokens are
+// emitted. `isDelimiter` is invoked once per character.
+template <typename Pred, typename F>
+void forEachDelimitedToken(std::string_view s, Pred isDelimiter, F&& fn) {
+  size_t start = 0;
+  for (size_t i = 0; i <= s.size(); ++i) {
+    if (i == s.size() || isDelimiter(s[i])) {
+      const std::string_view trimmed = trimCssWhitespace(s.substr(start, i - start));
+      if (!trimmed.empty()) {
+        fn(trimmed);
+      }
+      start = i + 1;
+    }
+  }
+}
+
+// FNV-1a per Fowler/Noll/Vo, sized to match size_t on the target. The firmware
+// runs on a 32-bit core where size_t is 32 bits, so naively using the 64-bit
+// constants would silently truncate FNV_PRIME to a non-prime and wreck hash
+// distribution. The selection below picks the canonical 32- or 64-bit
+// constants at compile time so the same source works in a 64-bit host
+// simulator. `fnv1aMix` is the per-byte mix step; callers apply any
+// byte-level transform (e.g. asciiToLower) first.
+static_assert(sizeof(size_t) == 4 || sizeof(size_t) == 8, "FNV constants are only defined for 32- or 64-bit size_t");
+constexpr size_t FNV_OFFSET_BASIS =
+    sizeof(size_t) == 8 ? static_cast<size_t>(14695981039346656037ULL) : static_cast<size_t>(2166136261U);
+constexpr size_t FNV_PRIME =
+    sizeof(size_t) == 8 ? static_cast<size_t>(1099511628211ULL) : static_cast<size_t>(16777619U);
+
+constexpr size_t fnv1aMix(size_t hash, unsigned char byte) { return (hash ^ byte) * FNV_PRIME; }
+
+// Parse the entirety of s as a number into `out`. Accepts an optional leading
+// '+' (which std::from_chars rejects by spec) so callers can pass CSS-style
+// signed numbers without manual trimming. Returns false on empty input, a
+// non-numeric suffix, or any from_chars error.
+template <typename T>
+bool tryParseNumber(std::string_view s, T& out) {
+  const char* begin = s.data();
+  const char* end = s.data() + s.size();
+  if (begin < end && *begin == '+') ++begin;
+  const auto r = std::from_chars(begin, end, out);
+  return r.ec == std::errc{} && r.ptr == end;
+}
+
+// Collect up to 4 whitespace-separated tokens for a CSS edge-value shorthand
+// (margin, padding, and the border-* family). Returns the number of tokens
+// written; extras are silently dropped. Callers apply the 1/2/3/4-value
+// fallback rule using the returned count.
+size_t collectEdgeValueTokens(std::string_view s, std::string_view (&out)[4]) {
+  size_t count = 0;
+  forEachDelimitedToken(s, isCssWhitespace, [&](std::string_view tok) {
+    if (count < 4) out[count++] = tok;
+  });
+  return count;
+}
 
 std::string_view stripTrailingImportant(std::string_view value) {
   constexpr std::string_view IMPORTANT = "!important";
@@ -64,7 +137,7 @@ std::string_view stripTrailingImportant(std::string_view value) {
   }
 
   const size_t suffixPos = value.size() - IMPORTANT.size();
-  if (value.substr(suffixPos) != IMPORTANT) {
+  if (!iequalsAscii(value.substr(suffixPos), IMPORTANT)) {
     return value;
   }
 
@@ -77,178 +150,152 @@ std::string_view stripTrailingImportant(std::string_view value) {
 
 }  // anonymous namespace
 
-// String utilities implementation
+// Transparent case-insensitive hash/equal. Bodies live here (rather than
+// inline in the header) so they can share the anonymous-namespace asciiToLower
+// with the other ASCII helpers in this translation unit.
 
-std::string CssParser::normalized(const std::string& s) {
-  std::string result;
-  result.reserve(s.size());
-
-  bool inSpace = true;  // Start true to skip leading space
-  for (const char c : s) {
-    if (isCssWhitespace(c)) {
-      if (!inSpace) {
-        result.push_back(' ');
-        inSpace = true;
-      }
-    } else {
-      result.push_back(static_cast<char>(std::tolower(static_cast<unsigned char>(c))));
-      inSpace = false;
-    }
-  }
-
-  // Remove trailing space
-  while (!result.empty() && (result.back() == ' ' || result.back() == '\n')) {
-    result.pop_back();
-  }
-  return result;
+size_t CssParser::SvHash::operator()(std::string_view sv) const noexcept {
+  size_t h = FNV_OFFSET_BASIS;
+  for (char c : sv) h = fnv1aMix(h, asciiToLower(c));
+  return h;
 }
 
-void CssParser::normalizedInto(const std::string& s, std::string& out) {
-  out.clear();
-  out.reserve(s.size());
+size_t CssParser::SvHash::operator()(const std::string& s) const noexcept { return operator()(std::string_view(s)); }
 
-  bool inSpace = true;  // Start true to skip leading space
-  for (const char c : s) {
-    if (isCssWhitespace(c)) {
-      if (!inSpace) {
-        out.push_back(' ');
-        inSpace = true;
-      }
-    } else {
-      out.push_back(static_cast<char>(std::tolower(static_cast<unsigned char>(c))));
-      inSpace = false;
-    }
-  }
-
-  if (!out.empty() && out.back() == ' ') {
-    out.pop_back();
+size_t CssParser::SvHash::operator()(CompositeKey k) const noexcept {
+  // Hash the case-folded concatenation of every piece without materializing
+  // it — the running hash continues across pieces as if they were one buffer.
+  size_t h = FNV_OFFSET_BASIS;
+  for (std::string_view piece : k.pieces) {
+    for (char c : piece) h = fnv1aMix(h, asciiToLower(c));
   }
+  return h;
 }
 
-std::vector<std::string> CssParser::splitOnChar(const std::string& s, const char delimiter) {
-  std::vector<std::string> parts;
-  size_t start = 0;
-
-  for (size_t i = 0; i <= s.size(); ++i) {
-    if (i == s.size() || s[i] == delimiter) {
-      std::string part = s.substr(start, i - start);
-      std::string trimmed = normalized(part);
-      if (!trimmed.empty()) {
-        parts.push_back(trimmed);
-      }
-      start = i + 1;
-    }
+bool CssParser::SvEqual::operator()(std::string_view a, std::string_view b) const noexcept {
+  if (a.size() != b.size()) return false;
+  for (size_t i = 0; i < a.size(); ++i) {
+    if (asciiToLower(a[i]) != asciiToLower(b[i])) return false;
   }
-  return parts;
+  return true;
 }
 
-std::vector<std::string> CssParser::splitWhitespace(const std::string& s) {
-  std::vector<std::string> parts;
-  size_t start = 0;
-  bool inWord = false;
+bool CssParser::SvEqual::operator()(const std::string& a, std::string_view b) const noexcept {
+  return operator()(std::string_view(a), b);
+}
 
-  for (size_t i = 0; i <= s.size(); ++i) {
-    const bool isSpace = i == s.size() || isCssWhitespace(s[i]);
-    if (isSpace && inWord) {
-      parts.push_back(s.substr(start, i - start));
-      inWord = false;
-    } else if (!isSpace && !inWord) {
-      start = i;
-      inWord = true;
+bool CssParser::SvEqual::operator()(std::string_view a, const std::string& b) const noexcept {
+  return operator()(a, std::string_view(b));
+}
+
+bool CssParser::SvEqual::operator()(const std::string& a, const std::string& b) const noexcept {
+  return operator()(std::string_view(a), std::string_view(b));
+}
+
+bool CssParser::SvEqual::operator()(CompositeKey k, std::string_view sv) const noexcept {
+  size_t total = 0;
+  for (std::string_view piece : k.pieces) total += piece.size();
+  if (total != sv.size()) return false;
+  size_t i = 0;
+  for (std::string_view piece : k.pieces) {
+    for (char c : piece) {
+      if (asciiToLower(c) != asciiToLower(sv[i++])) return false;
     }
   }
-  return parts;
+  return true;
 }
 
+bool CssParser::SvEqual::operator()(std::string_view sv, CompositeKey k) const noexcept { return operator()(k, sv); }
+
 // Property value interpreters
 
-CssTextAlign CssParser::interpretAlignment(const std::string& val) {
-  const std::string v = normalized(val);
+CssTextAlign CssParser::interpretAlignment(std::string_view val) {
+  val = trimCssWhitespace(val);
 
-  if (v == "left" || v == "start") return CssTextAlign::Left;
-  if (v == "right" || v == "end") return CssTextAlign::Right;
-  if (v == "center") return CssTextAlign::Center;
-  if (v == "justify") return CssTextAlign::Justify;
+  if (iequalsAscii(val, "left") || iequalsAscii(val, "start")) return CssTextAlign::Left;
+  if (iequalsAscii(val, "right") || iequalsAscii(val, "end")) return CssTextAlign::Right;
+  if (iequalsAscii(val, "center")) return CssTextAlign::Center;
+  if (iequalsAscii(val, "justify")) return CssTextAlign::Justify;
 
   return CssTextAlign::Left;
 }
 
-CssFontStyle CssParser::interpretFontStyle(const std::string& val) {
-  const std::string v = normalized(val);
+CssFontStyle CssParser::interpretFontStyle(std::string_view val) {
+  val = trimCssWhitespace(val);
 
-  if (v == "italic" || v == "oblique") return CssFontStyle::Italic;
+  if (iequalsAscii(val, "italic") || iequalsAscii(val, "oblique")) return CssFontStyle::Italic;
   return CssFontStyle::Normal;
 }
 
-CssFontWeight CssParser::interpretFontWeight(const std::string& val) {
-  const std::string v = normalized(val);
+CssFontWeight CssParser::interpretFontWeight(std::string_view val) {
+  val = trimCssWhitespace(val);
 
   // Named values
-  if (v == "bold" || v == "bolder") return CssFontWeight::Bold;
-  if (v == "normal" || v == "lighter") return CssFontWeight::Normal;
+  if (iequalsAscii(val, "bold") || iequalsAscii(val, "bolder")) return CssFontWeight::Bold;
+  if (iequalsAscii(val, "normal") || iequalsAscii(val, "lighter")) return CssFontWeight::Normal;
 
   // Numeric values: 100-900
   // CSS spec: 400 = normal, 700 = bold
   // We use: 0-400 = normal, 700+ = bold, 500-600 = normal (conservative)
-  char* endPtr = nullptr;
-  const long numericWeight = std::strtol(v.c_str(), &endPtr, 10);
-
-  // If we parsed a number and consumed the whole string
-  if (endPtr != v.c_str() && *endPtr == '\0') {
+  long numericWeight = 0;
+  if (tryParseNumber(val, numericWeight)) {
     return numericWeight >= 700 ? CssFontWeight::Bold : CssFontWeight::Normal;
   }
-
   return CssFontWeight::Normal;
 }
 
-CssTextDecoration CssParser::interpretDecoration(const std::string& val) {
-  const std::string v = normalized(val);
-
-  // text-decoration can have multiple space-separated values
-  if (v.find("underline") != std::string::npos) {
-    return CssTextDecoration::Underline;
-  }
-  return CssTextDecoration::None;
+CssTextDecoration CssParser::interpretDecoration(std::string_view val) {
+  // text-decoration can have multiple space-separated values. Compare whole tokens
+  // so malformed values like "notunderline" do not accidentally enable a line.
+  CssTextDecoration result = CssTextDecoration::None;
+  bool explicitNone = false;
+  forEachDelimitedToken(val, isCssWhitespace, [&](const std::string_view token) {
+    if (iequalsAscii(token, "none")) {
+      explicitNone = true;
+    } else if (iequalsAscii(token, "underline")) {
+      result = result | CssTextDecoration::Underline;
+    } else if (iequalsAscii(token, "line-through")) {
+      result = result | CssTextDecoration::LineThrough;
+    }
+  });
+  return explicitNone ? CssTextDecoration::None : result;
 }
 
-CssLength CssParser::interpretLength(const std::string& val) {
+CssLength CssParser::interpretLength(std::string_view val) {
   CssLength result;
   tryInterpretLength(val, result);
   return result;
 }
 
-bool CssParser::tryInterpretLength(const std::string& val, CssLength& out) {
-  const std::string v = normalized(val);
-  if (v.empty()) {
+bool CssParser::tryInterpretLength(std::string_view val, CssLength& out) {
+  val = trimCssWhitespace(val);
+  if (val.empty()) {
     out = CssLength{};
     return false;
   }
 
-  size_t unitStart = v.size();
-  for (size_t i = 0; i < v.size(); ++i) {
-    const char c = v[i];
+  size_t unitStart = val.size();
+  for (size_t i = 0; i < val.size(); ++i) {
+    const char c = val[i];
     if (!std::isdigit(c) && c != '.' && c != '-' && c != '+') {
       unitStart = i;
       break;
     }
   }
 
-  const std::string numPart = v.substr(0, unitStart);
-  const std::string unitPart = v.substr(unitStart);
-
-  char* endPtr = nullptr;
-  const float numericValue = std::strtof(numPart.c_str(), &endPtr);
-  if (endPtr == numPart.c_str()) {
+  float numericValue;
+  if (!tryParseNumber(val.substr(0, unitStart), numericValue)) {
     out = CssLength{};
     return false;  // No number parsed (e.g. auto, inherit, initial)
   }
 
+  const std::string_view unitPart = val.substr(unitStart);
   auto unit = CssUnit::Pixels;
-  if (unitPart == "em") {
+  if (iequalsAscii(unitPart, "em")) {
     unit = CssUnit::Em;
-  } else if (unitPart == "rem") {
+  } else if (iequalsAscii(unitPart, "rem")) {
     unit = CssUnit::Rem;
-  } else if (unitPart == "pt") {
+  } else if (iequalsAscii(unitPart, "pt")) {
     unit = CssUnit::Points;
   } else if (unitPart == "%") {
     unit = CssUnit::Percent;
@@ -260,107 +307,119 @@ bool CssParser::tryInterpretLength(const std::string& val, CssLength& out) {
 
 // Declaration parsing
 
-void CssParser::parseDeclarationIntoStyle(const std::string& decl, CssStyle& style, std::string& propNameBuf,
-                                          std::string& propValueBuf) {
+void CssParser::parseDeclarationIntoStyle(std::string_view decl, CssStyle& style) {
   const size_t colonPos = decl.find(':');
-  if (colonPos == std::string::npos || colonPos == 0) return;
+  if (colonPos == std::string_view::npos || colonPos == 0) return;
 
-  normalizedInto(decl.substr(0, colonPos), propNameBuf);
-  normalizedInto(decl.substr(colonPos + 1), propValueBuf);
+  const std::string_view name = trimCssWhitespace(decl.substr(0, colonPos));
+  const std::string_view value = trimCssWhitespace(decl.substr(colonPos + 1));
 
-  if (propNameBuf.empty() || propValueBuf.empty()) return;
+  if (name.empty() || value.empty()) return;
 
-  if (propNameBuf == "text-align") {
-    style.textAlign = interpretAlignment(propValueBuf);
+  if (iequalsAscii(name, "text-align")) {
+    style.textAlign = interpretAlignment(value);
     style.defined.textAlign = 1;
-  } else if (propNameBuf == "font-style") {
-    style.fontStyle = interpretFontStyle(propValueBuf);
+  } else if (iequalsAscii(name, "font-style")) {
+    style.fontStyle = interpretFontStyle(value);
     style.defined.fontStyle = 1;
-  } else if (propNameBuf == "font-weight") {
-    style.fontWeight = interpretFontWeight(propValueBuf);
+  } else if (iequalsAscii(name, "font-weight")) {
+    style.fontWeight = interpretFontWeight(value);
     style.defined.fontWeight = 1;
-  } else if (propNameBuf == "text-decoration" || propNameBuf == "text-decoration-line") {
-    style.textDecoration = interpretDecoration(propValueBuf);
+  } else if (iequalsAscii(name, "text-decoration") || iequalsAscii(name, "text-decoration-line")) {
+    style.textDecoration = interpretDecoration(value);
     style.defined.textDecoration = 1;
-  } else if (propNameBuf == "text-indent") {
-    style.textIndent = interpretLength(propValueBuf);
+  } else if (iequalsAscii(name, "text-indent")) {
+    style.textIndent = interpretLength(value);
     style.defined.textIndent = 1;
-  } else if (propNameBuf == "margin-top") {
-    style.marginTop = interpretLength(propValueBuf);
+  } else if (iequalsAscii(name, "margin-top")) {
+    style.marginTop = interpretLength(value);
     style.defined.marginTop = 1;
-  } else if (propNameBuf == "margin-bottom") {
-    style.marginBottom = interpretLength(propValueBuf);
+  } else if (iequalsAscii(name, "margin-bottom")) {
+    style.marginBottom = interpretLength(value);
     style.defined.marginBottom = 1;
-  } else if (propNameBuf == "margin-left") {
-    style.marginLeft = interpretLength(propValueBuf);
+  } else if (iequalsAscii(name, "margin-left")) {
+    style.marginLeft = interpretLength(value);
     style.defined.marginLeft = 1;
-  } else if (propNameBuf == "margin-right") {
-    style.marginRight = interpretLength(propValueBuf);
+  } else if (iequalsAscii(name, "margin-right")) {
+    style.marginRight = interpretLength(value);
     style.defined.marginRight = 1;
-  } else if (propNameBuf == "margin") {
-    const auto values = splitWhitespace(propValueBuf);
-    if (!values.empty()) {
-      style.marginTop = interpretLength(values[0]);
-      style.marginRight = values.size() >= 2 ? interpretLength(values[1]) : style.marginTop;
-      style.marginBottom = values.size() >= 3 ? interpretLength(values[2]) : style.marginTop;
-      style.marginLeft = values.size() >= 4 ? interpretLength(values[3]) : style.marginRight;
+  } else if (iequalsAscii(name, "margin")) {
+    std::string_view margins[4];
+    const size_t count = collectEdgeValueTokens(value, margins);
+    if (count > 0) {
+      style.marginTop = interpretLength(margins[0]);
+      style.marginRight = count >= 2 ? interpretLength(margins[1]) : style.marginTop;
+      style.marginBottom = count >= 3 ? interpretLength(margins[2]) : style.marginTop;
+      style.marginLeft = count >= 4 ? interpretLength(margins[3]) : style.marginRight;
       style.defined.marginTop = style.defined.marginRight = style.defined.marginBottom = style.defined.marginLeft = 1;
     }
-  } else if (propNameBuf == "padding-top") {
-    style.paddingTop = interpretLength(propValueBuf);
+  } else if (iequalsAscii(name, "padding-top")) {
+    style.paddingTop = interpretLength(value);
     style.defined.paddingTop = 1;
-  } else if (propNameBuf == "padding-bottom") {
-    style.paddingBottom = interpretLength(propValueBuf);
+  } else if (iequalsAscii(name, "padding-bottom")) {
+    style.paddingBottom = interpretLength(value);
     style.defined.paddingBottom = 1;
-  } else if (propNameBuf == "padding-left") {
-    style.paddingLeft = interpretLength(propValueBuf);
+  } else if (iequalsAscii(name, "padding-left")) {
+    style.paddingLeft = interpretLength(value);
     style.defined.paddingLeft = 1;
-  } else if (propNameBuf == "padding-right") {
-    style.paddingRight = interpretLength(propValueBuf);
+  } else if (iequalsAscii(name, "padding-right")) {
+    style.paddingRight = interpretLength(value);
     style.defined.paddingRight = 1;
-  } else if (propNameBuf == "padding") {
-    const auto values = splitWhitespace(propValueBuf);
-    if (!values.empty()) {
-      style.paddingTop = interpretLength(values[0]);
-      style.paddingRight = values.size() >= 2 ? interpretLength(values[1]) : style.paddingTop;
-      style.paddingBottom = values.size() >= 3 ? interpretLength(values[2]) : style.paddingTop;
-      style.paddingLeft = values.size() >= 4 ? interpretLength(values[3]) : style.paddingRight;
+  } else if (iequalsAscii(name, "padding")) {
+    std::string_view paddings[4];
+    const size_t count = collectEdgeValueTokens(value, paddings);
+    if (count > 0) {
+      style.paddingTop = interpretLength(paddings[0]);
+      style.paddingRight = count >= 2 ? interpretLength(paddings[1]) : style.paddingTop;
+      style.paddingBottom = count >= 3 ? interpretLength(paddings[2]) : style.paddingTop;
+      style.paddingLeft = count >= 4 ? interpretLength(paddings[3]) : style.paddingRight;
       style.defined.paddingTop = style.defined.paddingRight = style.defined.paddingBottom = style.defined.paddingLeft =
           1;
     }
-  } else if (propNameBuf == "height") {
+  } else if (iequalsAscii(name, "height")) {
     CssLength len;
-    if (tryInterpretLength(propValueBuf, len)) {
+    if (tryInterpretLength(value, len)) {
       style.imageHeight = len;
       style.defined.imageHeight = 1;
     }
-  } else if (propNameBuf == "width") {
+  } else if (iequalsAscii(name, "width")) {
     CssLength len;
-    if (tryInterpretLength(propValueBuf, len)) {
+    if (tryInterpretLength(value, len)) {
       style.imageWidth = len;
       style.defined.imageWidth = 1;
     }
-  } else if (propNameBuf == "display") {
-    const std::string_view displayValue = stripTrailingImportant(propValueBuf);
-    style.display = (displayValue == "none") ? CssDisplay::None : CssDisplay::Block;
+  } else if (iequalsAscii(name, "display")) {
+    const std::string_view displayValue = stripTrailingImportant(value);
+    style.display = iequalsAscii(displayValue, "none") ? CssDisplay::None : CssDisplay::Block;
     style.defined.display = 1;
+  } else if (iequalsAscii(name, "direction")) {
+    const std::string_view directionValue = stripTrailingImportant(value);
+    if (iequalsAscii(directionValue, "rtl")) {
+      style.direction = CssTextDirection::Rtl;
+      style.defined.direction = 1;
+    } else if (iequalsAscii(directionValue, "ltr")) {
+      style.direction = CssTextDirection::Ltr;
+      style.defined.direction = 1;
+    }
+  } else if (iequalsAscii(name, "vertical-align")) {
+    if (iequalsAscii(value, "super")) {
+      style.verticalAlign = CssVerticalAlign::Super;
+      style.defined.verticalAlign = 1;
+    } else if (iequalsAscii(value, "sub")) {
+      style.verticalAlign = CssVerticalAlign::Sub;
+      style.defined.verticalAlign = 1;
+    }
   }
 }
 
-CssStyle CssParser::parseDeclarations(const std::string& declBlock) {
+CssStyle CssParser::parseDeclarations(std::string_view declBlock) {
   CssStyle style;
-  std::string propNameBuf;
-  std::string propValueBuf;
 
   size_t start = 0;
   for (size_t i = 0; i <= declBlock.size(); ++i) {
     if (i == declBlock.size() || declBlock[i] == ';') {
       if (i > start) {
-        const size_t len = i - start;
-        std::string decl = declBlock.substr(start, len);
-        if (!decl.empty()) {
-          parseDeclarationIntoStyle(decl, style, propNameBuf, propValueBuf);
-        }
+        parseDeclarationIntoStyle(declBlock.substr(start, i - start), style);
       }
       start = i + 1;
     }
@@ -371,96 +430,64 @@ CssStyle CssParser::parseDeclarations(const std::string& declBlock) {
 
 // Rule processing
 
-void CssParser::processRuleBlockWithStyle(const std::string& selectorGroup, const CssStyle& style) {
+void CssParser::processRuleBlockWithStyle(std::string_view selectorGroup, const CssStyle& style) {
   // Check if we've reached the rule limit before processing
   if (rulesBySelector_.size() >= MAX_RULES) {
     LOG_DBG("CSS", "Reached max rules limit (%zu), stopping CSS parsing", MAX_RULES);
     return;
   }
 
-  // Handle comma-separated selectors
-  const auto selectors = splitOnChar(selectorGroup, ',');
+  // Walk comma-separated selectors in place — no vector allocation. Selectors
+  // with unsupported syntax (combinators, attributes, pseudo, etc.) are skipped
+  // silently; the only heap allocation per kept selector is the std::string
+  // map key, which is unavoidable since the map owns its keys.
+  bool limitReached = false;
+  forEachDelimitedToken(
+      selectorGroup, [](char c) { return c == ','; },
+      [&](std::string_view sel) {
+        if (limitReached) return;
 
-  for (const auto& sel : selectors) {
-    // Validate selector length before processing
-    if (sel.size() > MAX_SELECTOR_LENGTH) {
-      LOG_DBG("CSS", "Selector too long (%zu > %zu), skipping", sel.size(), MAX_SELECTOR_LENGTH);
-      continue;
-    }
+        if (sel.size() > MAX_SELECTOR_LENGTH) {
+          LOG_DBG("CSS", "Selector too long (%zu > %zu), skipping", sel.size(), MAX_SELECTOR_LENGTH);
+          return;
+        }
 
-    // Normalize the selector
-    std::string key = normalized(sel);
-    if (key.empty()) continue;
+        // TODO: Support richer CSS selector syntax in the future. For now we only
+        // handle `tag`, `.class`, or `tag.class`. Reject anything containing a
+        // character that introduces unsupported syntax:
+        //   '+'  adjacent sibling combinator
+        //   '>'  child combinator
+        //   '['  attribute selector
+        //   ':'  pseudo class/element
+        //   '#'  ID selector
+        //   '~'  general sibling combinator
+        //   '*'  wildcard
+        //   ' '  descendant combinator
+        // Single-pass scan via find_first_of instead of eight sequential find() calls.
+        constexpr std::string_view kUnsupportedSelectorChars = "+>[:#~* ";
+        if (sel.find_first_of(kUnsupportedSelectorChars) != std::string_view::npos) return;
 
-    // TODO: Consider adding support for sibling css selectors in the future
-    // Ensure no + in selector as we don't support adjacent CSS selectors for now
-    if (key.find('+') != std::string_view::npos) {
-      continue;
-    }
+        // Skip if this would exceed the rule limit
+        if (rulesBySelector_.size() >= MAX_RULES) {
+          LOG_DBG("CSS", "Reached max rules limit, stopping selector processing");
+          limitReached = true;
+          return;
+        }
 
-    // TODO: Consider adding support for direct nested css selectors in the future
-    // Ensure no > in selector as we don't support nested CSS selectors for now
-    if (key.find('>') != std::string_view::npos) {
-      continue;
-    }
-
-    // TODO: Consider adding support for attribute css selectors in the future
-    // Ensure no [ in selector as we don't support attribute CSS selectors for now
-    if (key.find('[') != std::string_view::npos) {
-      continue;
-    }
-
-    // TODO: Consider adding support for pseudo selectors in the future
-    // Ensure no : in selector as we don't support pseudo CSS selectors for now
-    if (key.find(':') != std::string_view::npos) {
-      continue;
-    }
-
-    // TODO: Consider adding support for ID css selectors in the future
-    // Ensure no # in selector as we don't support ID CSS selectors for now
-    if (key.find('#') != std::string_view::npos) {
-      continue;
-    }
-
-    // TODO: Consider adding support for general sibling combinator selectors in the future
-    // Ensure no ~ in selector as we don't support general sibling combinator CSS selectors for now
-    if (key.find('~') != std::string_view::npos) {
-      continue;
-    }
-
-    // TODO: Consider adding support for wildcard css selectors in the future
-    // Ensure no * in selector as we don't support wildcard CSS selectors for now
-    if (key.find('*') != std::string_view::npos) {
-      continue;
-    }
-
-    // TODO: Add support for more complex selectors in the future
-    // At the moment, we only ever check for `tag`, `tag.class1` or `.class1`
-    // If the selector has whitespace in it, then it's either a CSS selector for a descendant element (e.g. `tag1 tag2`)
-    // or some other slightly more advanced CSS selector which we don't support yet
-    if (key.find(' ') != std::string_view::npos) {
-      continue;
-    }
-
-    // Skip if this would exceed the rule limit
-    if (rulesBySelector_.size() >= MAX_RULES) {
-      LOG_DBG("CSS", "Reached max rules limit, stopping selector processing");
-      return;
-    }
-
-    // Store or merge with existing
-    auto it = rulesBySelector_.find(key);
-    if (it != rulesBySelector_.end()) {
-      it->second.applyOver(style);
-    } else {
-      rulesBySelector_[key] = style;
-    }
-  }
+        // Store or merge with existing. Hash/equal are case-insensitive, so two
+        // selectors that differ only in ASCII case collide on insert and merge.
+        auto it = rulesBySelector_.find(sel);
+        if (it != rulesBySelector_.end()) {
+          it->second.applyOver(style);
+        } else {
+          rulesBySelector_.emplace(std::string(sel), style);
+        }
+      });
 }
 
 // Main parsing entry point
 
-bool CssParser::loadFromStream(FsFile& source) {
+bool CssParser::loadFromStream(HalFile& source) {
   if (!source) {
     LOG_ERR("CSS", "Cannot read from invalid file");
     return false;
@@ -471,9 +498,6 @@ bool CssParser::loadFromStream(FsFile& source) {
   // Use stack-allocated buffers for parsing to avoid heap reallocations
   StackBuffer selector;
   StackBuffer declBuffer;
-  // Keep these as std::string since they're passed by reference to parseDeclarationIntoStyle
-  std::string propNameBuf;
-  std::string propValueBuf;
 
   bool inComment = false;
   bool maybeSlash = false;
@@ -530,10 +554,10 @@ bool CssParser::loadFromStream(FsFile& source) {
       --bodyDepth;
       if (bodyDepth == 0) {
         if (!skippingRule && !declBuffer.empty()) {
-          parseDeclarationIntoStyle(declBuffer.str(), currentStyle, propNameBuf, propValueBuf);
+          parseDeclarationIntoStyle(declBuffer, currentStyle);
         }
         if (!skippingRule) {
-          processRuleBlockWithStyle(selector.str(), currentStyle);
+          processRuleBlockWithStyle(selector, currentStyle);
         }
         selector.clear();
         declBuffer.clear();
@@ -548,7 +572,7 @@ bool CssParser::loadFromStream(FsFile& source) {
     if (!skippingRule) {
       if (c == ';') {
         if (!declBuffer.empty()) {
-          parseDeclarationIntoStyle(declBuffer.str(), currentStyle, propNameBuf, propValueBuf);
+          parseDeclarationIntoStyle(declBuffer, currentStyle);
           declBuffer.clear();
         }
       } else {
@@ -608,7 +632,7 @@ bool CssParser::loadFromStream(FsFile& source) {
 
 // Style resolution
 
-CssStyle CssParser::resolveStyle(const std::string& tagName, const std::string& classAttr) const {
+CssStyle CssParser::resolveStyle(std::string_view tagName, std::string_view classAttr) const {
   static bool lowHeapWarningLogged = false;
   if (ESP.getFreeHeap() < MIN_FREE_HEAP_FOR_CSS) {
     if (!lowHeapWarningLogged) {
@@ -618,47 +642,40 @@ CssStyle CssParser::resolveStyle(const std::string& tagName, const std::string&
     }
     return CssStyle{};
   }
-  CssStyle result;
-  const std::string tag = normalized(tagName);
 
-  // 1. Apply element-level style (lowest priority)
-  const auto tagIt = rulesBySelector_.find(tag);
-  if (tagIt != rulesBySelector_.end()) {
-    result.applyOver(tagIt->second);
+  CssStyle result;
+
+  // 1. Apply element-level style (lowest priority). The map's hash/equal are
+  // case-insensitive, so the raw tagName view can be used as the lookup key.
+  if (auto it = rulesBySelector_.find(tagName); it != rulesBySelector_.end()) {
+    result.applyOver(it->second);
   }
 
+  if (classAttr.empty()) return result;
+
   // TODO: Support combinations of classes (e.g. style on .class1.class2)
-  // 2. Apply class styles (medium priority)
-  if (!classAttr.empty()) {
-    const auto classes = splitWhitespace(classAttr);
-
-    for (const auto& cls : classes) {
-      std::string classKey = "." + normalized(cls);
-
-      auto classIt = rulesBySelector_.find(classKey);
-      if (classIt != rulesBySelector_.end()) {
-        result.applyOver(classIt->second);
-      }
+  // 2. Apply class styles (medium priority). The transparent hash/equal accept
+  // a CompositeKey, so we never materialize the concatenation.
+  forEachDelimitedToken(classAttr, isCssWhitespace, [&](std::string_view cls) {
+    if (auto it = rulesBySelector_.find(CompositeKey{".", cls}); it != rulesBySelector_.end()) {
+      result.applyOver(it->second);
     }
+  });
 
-    // TODO: Support combinations of classes (e.g. style on p.class1.class2)
-    // 3. Apply element.class styles (higher priority)
-    for (const auto& cls : classes) {
-      std::string combinedKey = tag + "." + normalized(cls);
-
-      auto combinedIt = rulesBySelector_.find(combinedKey);
-      if (combinedIt != rulesBySelector_.end()) {
-        result.applyOver(combinedIt->second);
-      }
+  // TODO: Support combinations of classes (e.g. style on p.class1.class2)
+  // 3. Apply element.class styles (higher priority).
+  forEachDelimitedToken(classAttr, isCssWhitespace, [&](std::string_view cls) {
+    if (auto it = rulesBySelector_.find(CompositeKey{tagName, ".", cls}); it != rulesBySelector_.end()) {
+      result.applyOver(it->second);
     }
-  }
+  });
 
   return result;
 }
 
 // Inline style parsing (static - doesn't need rule database)
 
-CssStyle CssParser::parseInlineStyle(const std::string& styleValue) { return parseDeclarations(styleValue); }
+CssStyle CssParser::parseInlineStyle(std::string_view styleValue) { return parseDeclarations(styleValue); }
 
 // Cache serialization
 
@@ -676,7 +693,7 @@ bool CssParser::saveToCache() const {
     return false;
   }
 
-  FsFile file;
+  HalFile file;
   if (!Storage.openFileForWrite("CSS", cachePath + rulesCache, file)) {
     return false;
   }
@@ -701,6 +718,7 @@ bool CssParser::saveToCache() const {
     file.write(static_cast<uint8_t>(style.fontStyle));
     file.write(static_cast<uint8_t>(style.fontWeight));
     file.write(static_cast<uint8_t>(style.textDecoration));
+    file.write(static_cast<uint8_t>(style.direction));
 
     // Write CssLength fields (value + unit)
     auto writeLength = [&file](const CssLength& len) {
@@ -720,9 +738,10 @@ bool CssParser::saveToCache() const {
     writeLength(style.imageHeight);
     writeLength(style.imageWidth);
     file.write(static_cast<uint8_t>(style.display));
+    file.write(static_cast<uint8_t>(style.verticalAlign));
 
-    // Write defined flags as uint16_t
-    uint16_t definedBits = 0;
+    // Write defined flags as uint32_t
+    uint32_t definedBits = 0;
     if (style.defined.textAlign) definedBits |= 1 << 0;
     if (style.defined.fontStyle) definedBits |= 1 << 1;
     if (style.defined.fontWeight) definedBits |= 1 << 2;
@@ -739,6 +758,8 @@ bool CssParser::saveToCache() const {
     if (style.defined.imageHeight) definedBits |= 1 << 13;
     if (style.defined.imageWidth) definedBits |= 1 << 14;
     if (style.defined.display) definedBits |= 1 << 15;
+    if (style.defined.direction) definedBits |= 1 << 16;
+    if (style.defined.verticalAlign) definedBits |= 1 << 17;
     file.write(reinterpret_cast<const uint8_t*>(&definedBits), sizeof(definedBits));
   }
 
@@ -751,7 +772,7 @@ bool CssParser::loadFromCache() {
     return false;
   }
 
-  FsFile file;
+  HalFile file;
   if (!Storage.openFileForRead("CSS", cachePath + rulesCache, file)) {
     return false;
   }
@@ -782,6 +803,9 @@ bool CssParser::loadFromCache() {
     return false;
   }
 
+  // Size the bucket array up front to avoid incremental rehashes while loading rules.
+  rulesBySelector_.reserve(ruleCount);
+
   auto hasRemainingBytes = [&file](const size_t neededBytes) -> bool {
     return static_cast<size_t>(file.available()) >= neededBytes;
   };
@@ -789,7 +813,7 @@ bool CssParser::loadFromCache() {
   constexpr size_t CSS_LENGTH_FIELD_COUNT = 11;
   constexpr size_t CSS_LENGTH_BYTES = sizeof(float) + sizeof(uint8_t);
   constexpr size_t CSS_FIXED_STYLE_BYTES =
-      4 * sizeof(uint8_t) + (CSS_LENGTH_FIELD_COUNT * CSS_LENGTH_BYTES) + sizeof(uint8_t) + sizeof(uint16_t);
+      5 * sizeof(uint8_t) + (CSS_LENGTH_FIELD_COUNT * CSS_LENGTH_BYTES) + sizeof(uint8_t) + sizeof(uint32_t);
 
   // Read each rule
   for (uint16_t i = 0; i < ruleCount; ++i) {
@@ -849,7 +873,13 @@ bool CssParser::loadFromCache() {
       rulesBySelector_.clear();
       return false;
     }
-    style.textDecoration = static_cast<CssTextDecoration>(enumVal);
+    style.textDecoration = static_cast<CssTextDecoration>(enumVal & CSS_TEXT_DECORATION_MASK);
+
+    if (file.read(&enumVal, 1) != 1) {
+      rulesBySelector_.clear();
+      return false;
+    }
+    style.direction = static_cast<CssTextDirection>(enumVal);
 
     // Read CssLength fields
     auto readLength = [&file](CssLength& len) -> bool {
@@ -880,8 +910,16 @@ bool CssParser::loadFromCache() {
     }
     style.display = static_cast<CssDisplay>(displayVal);
 
+    // Read verticalAlign value
+    uint8_t verticalAlignVal;
+    if (file.read(&verticalAlignVal, 1) != 1) {
+      rulesBySelector_.clear();
+      return false;
+    }
+    style.verticalAlign = static_cast<CssVerticalAlign>(verticalAlignVal);
+
     // Read defined flags
-    uint16_t definedBits = 0;
+    uint32_t definedBits = 0;
     if (file.read(&definedBits, sizeof(definedBits)) != sizeof(definedBits)) {
       rulesBySelector_.clear();
       return false;
@@ -902,6 +940,8 @@ bool CssParser::loadFromCache() {
     style.defined.imageHeight = (definedBits & 1 << 13) != 0;
     style.defined.imageWidth = (definedBits & 1 << 14) != 0;
     style.defined.display = (definedBits & 1 << 15) != 0;
+    style.defined.direction = (definedBits & 1 << 16) != 0;
+    style.defined.verticalAlign = (definedBits & 1 << 17) != 0;
 
     rulesBySelector_[selector] = style;
   }

lib/Epub/Epub/css/CssParser.h

@@ -2,7 +2,9 @@
 
 #include <HalStorage.h>
 
+#include <initializer_list>
 #include <string>
+#include <string_view>
 #include <unordered_map>
 #include <utility>
 #include <vector>
@@ -31,7 +33,7 @@
 class CssParser {
  public:
   // Bump when CSS cache format or rules change; section caches are invalidated when this changes
-  static constexpr uint8_t CSS_CACHE_VERSION = 4;
+  static constexpr uint8_t CSS_CACHE_VERSION = 7;
 
   explicit CssParser(std::string cachePath) : cachePath(std::move(cachePath)) {}
   ~CssParser() = default;
@@ -46,7 +48,7 @@ class CssParser {
    * @param source Open file handle to read from
    * @return true if parsing completed (even if no rules found)
    */
-  bool loadFromStream(FsFile& source);
+  bool loadFromStream(HalFile& source);
 
   /**
    * Look up the style for an HTML element, considering tag name and class attributes.
@@ -56,14 +58,28 @@ class CssParser {
    * @param classAttr The class attribute value (may contain multiple space-separated classes)
    * @return Combined style with all applicable rules merged
    */
-  [[nodiscard]] CssStyle resolveStyle(const std::string& tagName, const std::string& classAttr) const;
+  [[nodiscard]] CssStyle resolveStyle(std::string_view tagName, std::string_view classAttr) const;
 
   /**
    * Parse an inline style attribute string.
    * @param styleValue The value of a style="" attribute
    * @return Parsed style properties
    */
-  [[nodiscard]] static CssStyle parseInlineStyle(const std::string& styleValue);
+  [[nodiscard]] static CssStyle parseInlineStyle(std::string_view styleValue);
+
+  // MEMFIX-PORT: stylesheet resident-bytes audit accessor; portable
+  // Approximate resident heap of the parsed stylesheet, for the audit log.
+  // unordered_map cost model: bucket array + one node per rule (libstdc++ node
+  // overhead ~= 2 pointers + hash) + key string capacity when it exceeds SSO.
+  size_t residentBytes() const {
+    size_t total = rulesBySelector_.bucket_count() * sizeof(void*);
+    for (const auto& kv : rulesBySelector_) {
+      total += sizeof(void*) * 2 + sizeof(size_t);  // node overhead
+      total += sizeof(kv);
+      if (kv.first.capacity() > 15) total += kv.first.capacity();  // beyond SSO
+    }
+    return total;
+  }
 
   /**
    * Check if any rules have been loaded
@@ -104,29 +120,53 @@ class CssParser {
   bool loadFromCache();
 
  private:
-  // Storage: maps normalized selector -> style properties
-  std::unordered_map<std::string, CssStyle> rulesBySelector_;
+  // Lookup key for a multi-piece selector. The pieces are hashed and compared
+  // as if concatenated, so callers can look up composite keys without
+  // materializing the concatenation in a scratch buffer. Constructed from a
+  // braced list of any arity, e.g. `CompositeKey{tagName, ".", cls}` or
+  // `CompositeKey{".", cls}`. The initializer_list's backing array lives for
+  // the full expression, which covers the lifetime of the find() call.
+  struct CompositeKey {
+    std::initializer_list<std::string_view> pieces;
+    CompositeKey(std::initializer_list<std::string_view> p) noexcept : pieces(p) {}
+  };
+
+  // ASCII-case-insensitive transparent hash/equal. Stored selectors and lookup
+  // keys are compared without regard to case, so callers may insert and look up
+  // using whatever case the CSS source or HTML element name happens to use.
+  // Bodies live in CssParser.cpp so they can share the file-local asciiToLower.
+  struct SvHash {
+    using is_transparent = void;
+    size_t operator()(std::string_view sv) const noexcept;
+    size_t operator()(const std::string& s) const noexcept;
+    size_t operator()(CompositeKey k) const noexcept;
+  };
+  struct SvEqual {
+    using is_transparent = void;
+    bool operator()(std::string_view a, std::string_view b) const noexcept;
+    bool operator()(const std::string& a, std::string_view b) const noexcept;
+    bool operator()(std::string_view a, const std::string& b) const noexcept;
+    bool operator()(const std::string& a, const std::string& b) const noexcept;
+    bool operator()(CompositeKey a, std::string_view b) const noexcept;
+    bool operator()(std::string_view a, CompositeKey b) const noexcept;
+  };
+
+  // Storage: maps selector -> style properties. Hash/equal are case-insensitive.
+  std::unordered_map<std::string, CssStyle, SvHash, SvEqual> rulesBySelector_;
 
   std::string cachePath;
 
   // Internal parsing helpers
-  void processRuleBlockWithStyle(const std::string& selectorGroup, const CssStyle& style);
-  static CssStyle parseDeclarations(const std::string& declBlock);
-  static void parseDeclarationIntoStyle(const std::string& decl, CssStyle& style, std::string& propNameBuf,
-                                        std::string& propValueBuf);
+  void processRuleBlockWithStyle(std::string_view selectorGroup, const CssStyle& style);
+  static CssStyle parseDeclarations(std::string_view declBlock);
+  static void parseDeclarationIntoStyle(std::string_view decl, CssStyle& style);
 
   // Individual property value parsers
-  static CssTextAlign interpretAlignment(const std::string& val);
-  static CssFontStyle interpretFontStyle(const std::string& val);
-  static CssFontWeight interpretFontWeight(const std::string& val);
-  static CssTextDecoration interpretDecoration(const std::string& val);
-  static CssLength interpretLength(const std::string& val);
+  static CssTextAlign interpretAlignment(std::string_view val);
+  static CssFontStyle interpretFontStyle(std::string_view val);
+  static CssFontWeight interpretFontWeight(std::string_view val);
+  static CssTextDecoration interpretDecoration(std::string_view val);
+  static CssLength interpretLength(std::string_view val);
   /** Returns true only when a numeric length was parsed (e.g. 2em, 50%). False for auto/inherit/initial. */
-  static bool tryInterpretLength(const std::string& val, CssLength& out);
-
-  // String utilities
-  static std::string normalized(const std::string& s);
-  static void normalizedInto(const std::string& s, std::string& out);
-  static std::vector<std::string> splitOnChar(const std::string& s, char delimiter);
-  static std::vector<std::string> splitWhitespace(const std::string& s);
+  static bool tryInterpretLength(std::string_view val, CssLength& out);
 };

lib/Epub/Epub/css/CssStyle.h

@@ -5,6 +5,7 @@
 // Matches order of PARAGRAPH_ALIGNMENT in CrossPointSettings
 enum class CssTextAlign : uint8_t { Justify = 0, Left = 1, Center = 2, Right = 3, None = 4 };
 enum class CssUnit : uint8_t { Pixels = 0, Em = 1, Rem = 2, Points = 3, Percent = 4 };
+enum class CssTextDirection : uint8_t { Ltr = 0, Rtl = 1 };
 
 // Represents a CSS length value with its unit, allowing deferred resolution to pixels
 struct CssLength {
@@ -51,12 +52,26 @@ enum class CssFontStyle : uint8_t { Normal = 0, Italic = 1 };
 // Font weight options - CSS supports 100-900, we simplify to normal/bold
 enum class CssFontWeight : uint8_t { Normal = 0, Bold = 1 };
 
-// Text decoration options
-enum class CssTextDecoration : uint8_t { None = 0, Underline = 1 };
+// Text decoration options. Values are bit flags so CSS can combine multiple line decorations.
+enum class CssTextDecoration : uint8_t { None = 0, Underline = 1, LineThrough = 2 };
+
+constexpr CssTextDecoration operator|(const CssTextDecoration a, const CssTextDecoration b) {
+  return static_cast<CssTextDecoration>(static_cast<uint8_t>(a) | static_cast<uint8_t>(b));
+}
+
+constexpr CssTextDecoration operator&(const CssTextDecoration a, const CssTextDecoration b) {
+  return static_cast<CssTextDecoration>(static_cast<uint8_t>(a) & static_cast<uint8_t>(b));
+}
+
+constexpr uint8_t CSS_TEXT_DECORATION_MASK =
+    static_cast<uint8_t>(CssTextDecoration::Underline) | static_cast<uint8_t>(CssTextDecoration::LineThrough);
 
 // Display options - only None and Block are relevant for e-ink rendering
 enum class CssDisplay : uint8_t { Block = 0, None = 1 };
 
+// Vertical alignment options for inline elements (e.g. superscript/subscript)
+enum class CssVerticalAlign : uint8_t { Baseline = 0, Super = 1, Sub = 2 };
+
 // Bitmask for tracking which properties have been explicitly set
 struct CssPropertyFlags {
   uint16_t textAlign : 1;
@@ -75,6 +90,8 @@ struct CssPropertyFlags {
   uint16_t imageHeight : 1;
   uint16_t imageWidth : 1;
   uint16_t display : 1;
+  uint16_t direction : 1;
+  uint16_t verticalAlign : 1;
 
   CssPropertyFlags()
       : textAlign(0),
@@ -92,22 +109,28 @@ struct CssPropertyFlags {
         paddingRight(0),
         imageHeight(0),
         imageWidth(0),
-        display(0) {}
+        display(0),
+        direction(0),
+        verticalAlign(0) {}
 
   [[nodiscard]] bool anySet() const {
     return textAlign || fontStyle || fontWeight || textDecoration || textIndent || marginTop || marginBottom ||
            marginLeft || marginRight || paddingTop || paddingBottom || paddingLeft || paddingRight || imageHeight ||
-           imageWidth || display;
+           imageWidth || display || direction || verticalAlign;
   }
 
   void clearAll() {
     textAlign = fontStyle = fontWeight = textDecoration = textIndent = 0;
     marginTop = marginBottom = marginLeft = marginRight = 0;
     paddingTop = paddingBottom = paddingLeft = paddingRight = 0;
-    imageHeight = imageWidth = display = 0;
+    imageHeight = imageWidth = display = direction = verticalAlign = 0;
   }
 };
 
+// Cache serializes defined flags as uint32_t with bit indices 0..17.
+static_assert(sizeof(CssPropertyFlags) <= sizeof(uint32_t),
+              "CssPropertyFlags exceeds 32 bits; update cache read/write in CssParser.cpp");
+
 // Represents a collection of CSS style properties
 // Only stores properties relevant to e-ink text rendering
 // Length values are stored as CssLength (value + unit) for deferred resolution
@@ -116,6 +139,7 @@ struct CssStyle {
   CssFontStyle fontStyle = CssFontStyle::Normal;
   CssFontWeight fontWeight = CssFontWeight::Normal;
   CssTextDecoration textDecoration = CssTextDecoration::None;
+  CssTextDirection direction = CssTextDirection::Ltr;
 
   CssLength textIndent;     // First-line indent (deferred resolution)
   CssLength marginTop;      // Vertical spacing before block
@@ -128,7 +152,8 @@ struct CssStyle {
   CssLength paddingRight;   // Padding right
   CssLength imageHeight;    // Height for img (e.g. 2em) – width derived from aspect ratio when only height set
   CssLength imageWidth;     // Width for img when both or only width set
-  CssDisplay display = CssDisplay::Block;  // display property (Block or None)
+  CssDisplay display = CssDisplay::Block;                       // display property (Block or None)
+  CssVerticalAlign verticalAlign = CssVerticalAlign::Baseline;  // vertical-align (super/sub positioning)
 
   CssPropertyFlags defined;  // Tracks which properties were explicitly set
 
@@ -199,6 +224,14 @@ struct CssStyle {
       display = base.display;
       defined.display = 1;
     }
+    if (base.hasDirection()) {
+      direction = base.direction;
+      defined.direction = 1;
+    }
+    if (base.hasVerticalAlign()) {
+      verticalAlign = base.verticalAlign;
+      defined.verticalAlign = 1;
+    }
   }
 
   [[nodiscard]] bool hasTextAlign() const { return defined.textAlign; }
@@ -217,17 +250,21 @@ struct CssStyle {
   [[nodiscard]] bool hasImageHeight() const { return defined.imageHeight; }
   [[nodiscard]] bool hasImageWidth() const { return defined.imageWidth; }
   [[nodiscard]] bool hasDisplay() const { return defined.display; }
+  [[nodiscard]] bool hasDirection() const { return defined.direction; }
+  [[nodiscard]] bool hasVerticalAlign() const { return defined.verticalAlign; }
 
   void reset() {
     textAlign = CssTextAlign::Left;
     fontStyle = CssFontStyle::Normal;
     fontWeight = CssFontWeight::Normal;
     textDecoration = CssTextDecoration::None;
+    direction = CssTextDirection::Ltr;
     textIndent = CssLength{};
     marginTop = marginBottom = marginLeft = marginRight = CssLength{};
     paddingTop = paddingBottom = paddingLeft = paddingRight = CssLength{};
     imageHeight = imageWidth = CssLength{};
     display = CssDisplay::Block;
+    verticalAlign = CssVerticalAlign::Baseline;
     defined.clearAll();
   }
 };

lib/Epub/Epub/htmlEntities.cpp

@@ -13,54 +13,57 @@ struct EntityPair {
 
 // Sorted lexicographically by key to allow binary search.
 static constexpr EntityPair ENTITY_LOOKUP[] = {
-    {"Æ", "Æ"},    {"Á", "Á"},     {"Â", "Â"},      {"À", "À"},   {"Α", "Α"},
-    {"Å", "Å"},    {"Ã", "Ã"},     {"Ä", "Ä"},       {"Β", "Β"},     {"Ç", "Ç"},
-    {"Χ", "Χ"},      {"‡", "‡"},     {"Δ", "Δ"},      {"Ð", "Ð"},      {"É", "É"},
-    {"Ê", "Ê"},    {"È", "È"},     {"Ε", "Ε"},    {"Η", "Η"},      {"Ë", "Ë"},
-    {"Γ", "Γ"},    {"Í", "Í"},     {"Î", "Î"},      {"Ì", "Ì"},   {"Ι", "Ι"},
-    {"Ï", "Ï"},     {"Κ", "Κ"},      {"Λ", "Λ"},     {"Μ", "Μ"},       {"Ñ", "Ñ"},
-    {"Ν", "Ν"},       {"Œ", "Œ"},      {"Ó", "Ó"},     {"Ô", "Ô"},    {"Ò", "Ò"},
-    {"Ω", "Ω"},    {"Ο", "Ο"},    {"Ø", "Ø"},     {"Õ", "Õ"},   {"Ö", "Ö"},
-    {"Φ", "Φ"},      {"Π", "Π"},         {"″", "″"},      {"Ψ", "Ψ"},      {"Ρ", "Ρ"},
-    {"Š", "Š"},   {"Σ", "Σ"},      {"Þ", "Þ"},      {"Τ", "Τ"},      {"Θ", "Θ"},
-    {"Ú", "Ú"},   {"Û", "Û"},      {"Ù", "Ù"},     {"Υ", "Υ"},  {"Ü", "Ü"},
-    {"Ξ", "Ξ"},       {"Ý", "Ý"},     {"Ÿ", "Ÿ"},       {"Ζ", "Ζ"},     {"á", "á"},
-    {"â", "â"},    {"´", "´"},      {"æ", "æ"},      {"à", "à"},   {"α", "α"},
-    {"&", "&"},      {"∧", "∧"},        {"∠", "∠"},        {"å", "å"},    {"≈", "≈"},
-    {"ã", "ã"},   {"ä", "ä"},       {"„", "„"},      {"β", "β"},     {"¦", "¦"},
-    {"•", "•"},     {"∩", "∩"},        {"ç", "ç"},     {"¸", "¸"},    {"¢", "¢"},
-    {"χ", "χ"},      {"ˆ", "ˆ"},       {"♣", "♣"},      {"≅", "≅"},     {"©", "©"},
-    {"↵", "↵"},    {"∪", "∪"},        {"¤", "¤"},     {"†", "†"},   {"↓", "↓"},
-    {"°", "°"},      {"δ", "δ"},      {"♦", "♦"},      {"÷", "÷"},   {"é", "é"},
-    {"ê", "ê"},    {"è", "è"},     {"∅", "∅"},      {" ", " "},     {" ", " "},
-    {"ε", "ε"},  {"≡", "≡"},      {"η", "η"},        {"ð", "ð"},      {"ë", "ë"},
-    {"€", "€"},     {"∃", "∃"},      {"ƒ", "ƒ"},       {"∀", "∀"},   {"½", "½"},
-    {"¼", "¼"},   {"¾", "¾"},     {"⁄", "⁄"},      {"γ", "γ"},    {"≥", "≥"},
-    {">", ">"},       {"↔", "↔"},       {"♥", "♥"},     {"…", "…"},   {"í", "í"},
-    {"î", "î"},    {"¡", "¡"},      {"ì", "ì"},     {"∞", "∞"},    {"∫", "∫"},
-    {"ι", "ι"},     {"¿", "¿"},     {"∈", "∈"},       {"ï", "ï"},     {"κ", "κ"},
-    {"λ", "λ"},   {"«", "«"},      {"←", "←"},       {"⌈", "⌈"},    {"“", "\u201C"},
-    {"≤", "≤"},       {"⌊", "⌊"},     {"∗", "∗"},     {"◊", "◊"},      {"‎", "\u200E"},
-    {"&lsaquo;", "‹"},   {"&lsquo;", "\u2018"}, {"&lt;", "<"},         {"&macr;", "¯"},     {"&mdash;", "—"},
-    {"&micro;", "µ"},    {"&minus;", "−"},      {"&mu;", "μ"},         {"&nabla;", "∇"},    {"&nbsp;", "\xC2\xA0"},
-    {"&ndash;", "–"},    {"&ne;", "≠"},         {"&ni;", "∋"},         {"&not;", "¬"},      {"&notin;", "∉"},
-    {"&nsub;", "⊄"},     {"&ntilde;", "ñ"},     {"&nu;", "ν"},         {"&oacute;", "ó"},   {"&ocirc;", "ô"},
-    {"&oelig;", "œ"},    {"&ograve;", "ò"},     {"&oline;", "‾"},      {"&omega;", "ω"},    {"&omicron;", "ο"},
-    {"&oplus;", "⊕"},    {"&or;", "∨"},         {"&ordf;", "ª"},       {"&ordm;", "º"},     {"&oslash;", "ø"},
-    {"&otilde;", "õ"},   {"&otimes;", "⊗"},     {"&ouml;", "ö"},       {"&para;", "¶"},     {"&part;", "∂"},
-    {"&permil;", "‰"},   {"&perp;", "⊥"},       {"&phi;", "φ"},        {"&pi;", "π"},       {"&piv;", "ϖ"},
-    {"&plusmn;", "±"},   {"&pound;", "£"},      {"&prime;", "′"},      {"&prod;", "∏"},     {"&prop;", "∝"},
-    {"&psi;", "ψ"},      {"&quot;", "\""},      {"&radic;", "√"},      {"&raquo;", "»"},    {"&rarr;", "→"},
-    {"&rceil;", "⌉"},    {"&rdquo;", "\u201D"}, {"&reg;", "®"},        {"&rfloor;", "⌋"},   {"&rho;", "ρ"},
-    {"&rlm;", "\u200F"}, {"&rsaquo;", "›"},     {"&rsquo;", "\u2019"}, {"&sbquo;", "‚"},    {"&scaron;", "š"},
-    {"&sdot;", "⋅"},     {"&sect;", "§"},       {"&shy;", "\xC2\xAD"}, {"&sigma;", "σ"},    {"&sigmaf;", "ς"},
-    {"&sim;", "∼"},      {"&spades;", "♠"},     {"&sub;", "⊂"},        {"&sube;", "⊆"},     {"&sum;", "∑"},
-    {"&sup1;", "¹"},     {"&sup2;", "²"},       {"&sup3;", "³"},       {"&sup;", "⊃"},      {"&supe;", "⊇"},
-    {"&szlig;", "ß"},    {"&tau;", "τ"},        {"&there4;", "∴"},     {"&theta;", "θ"},    {"&thetasym;", "ϑ"},
-    {"&thinsp;", " "},   {"&thorn;", "þ"},      {"&tilde;", "˜"},      {"&times;", "×"},    {"&trade;", "™"},
-    {"&uacute;", "ú"},   {"&uarr;", "↑"},       {"&ucirc;", "û"},      {"&ugrave;", "ù"},   {"&uml;", "¨"},
-    {"&upsih;", "ϒ"},    {"&upsilon;", "υ"},    {"&uuml;", "ü"},       {"&xi;", "ξ"},       {"&yacute;", "ý"},
-    {"&yen;", "¥"},      {"&yuml;", "ÿ"},       {"&zeta;", "ζ"},       {"&zwj;", "\u200D"}, {"&zwnj;", "\u200C"},
+    {"&AElig;", "Æ"},      {"&Aacute;", "Á"},      {"&Acirc;", "Â"},      {"&Agrave;", "À"},  {"&Alpha;", "Α"},
+    {"&Aring;", "Å"},      {"&Atilde;", "Ã"},      {"&Auml;", "Ä"},       {"&Beta;", "Β"},    {"&Ccedil;", "Ç"},
+    {"&Chi;", "Χ"},        {"&Dagger;", "‡"},      {"&Delta;", "Δ"},      {"&ETH;", "Ð"},     {"&Eacute;", "É"},
+    {"&Ecirc;", "Ê"},      {"&Egrave;", "È"},      {"&Epsilon;", "Ε"},    {"&Eta;", "Η"},     {"&Euml;", "Ë"},
+    {"&Gamma;", "Γ"},      {"&Iacute;", "Í"},      {"&Icirc;", "Î"},      {"&Igrave;", "Ì"},  {"&Iota;", "Ι"},
+    {"&Iuml;", "Ï"},       {"&Kappa;", "Κ"},       {"&Lambda;", "Λ"},     {"&Mu;", "Μ"},      {"&Ntilde;", "Ñ"},
+    {"&Nu;", "Ν"},         {"&OElig;", "Œ"},       {"&Oacute;", "Ó"},     {"&Ocirc;", "Ô"},   {"&Ograve;", "Ò"},
+    {"&Omega;", "Ω"},      {"&Omicron;", "Ο"},     {"&Oslash;", "Ø"},     {"&Otilde;", "Õ"},  {"&Ouml;", "Ö"},
+    {"&Phi;", "Φ"},        {"&Pi;", "Π"},          {"&Prime;", "″"},      {"&Psi;", "Ψ"},     {"&Rho;", "Ρ"},
+    {"&Scaron;", "Š"},     {"&Sigma;", "Σ"},       {"&THORN;", "Þ"},      {"&Tau;", "Τ"},     {"&Theta;", "Θ"},
+    {"&Uacute;", "Ú"},     {"&Ucirc;", "Û"},       {"&Ugrave;", "Ù"},     {"&Upsilon;", "Υ"}, {"&Uuml;", "Ü"},
+    {"&Xi;", "Ξ"},         {"&Yacute;", "Ý"},      {"&Yuml;", "Ÿ"},       {"&Zeta;", "Ζ"},    {"&aacute;", "á"},
+    {"&acirc;", "â"},      {"&acute;", "´"},       {"&aelig;", "æ"},      {"&agrave;", "à"},  {"&alefsym;", "ℵ"},
+    {"&alpha;", "α"},      {"&amp;", "&"},         {"&and;", "∧"},        {"&ang;", "∠"},     {"&aring;", "å"},
+    {"&asymp;", "≈"},      {"&atilde;", "ã"},      {"&auml;", "ä"},       {"&bdquo;", "„"},   {"&beta;", "β"},
+    {"&brvbar;", "¦"},     {"&bull;", "•"},        {"&cap;", "∩"},        {"&ccedil;", "ç"},  {"&cedil;", "¸"},
+    {"&cent;", "¢"},       {"&chi;", "χ"},         {"&circ;", "ˆ"},       {"&clubs;", "♣"},   {"&cong;", "≅"},
+    {"&copy;", "©"},       {"&crarr;", "↵"},       {"&cup;", "∪"},        {"&curren;", "¤"},  {"&dArr;", "⇓"},
+    {"&dagger;", "†"},     {"&darr;", "↓"},        {"&deg;", "°"},        {"&delta;", "δ"},   {"&diams;", "♦"},
+    {"&divide;", "÷"},     {"&eacute;", "é"},      {"&ecirc;", "ê"},      {"&egrave;", "è"},  {"&empty;", "∅"},
+    {"&emsp;", " "},       {"&ensp;", " "},        {"&epsilon;", "ε"},    {"&equiv;", "≡"},   {"&eta;", "η"},
+    {"&eth;", "ð"},        {"&euml;", "ë"},        {"&euro;", "€"},       {"&exist;", "∃"},   {"&fnof;", "ƒ"},
+    {"&forall;", "∀"},     {"&frac12;", "½"},      {"&frac14;", "¼"},     {"&frac34;", "¾"},  {"&frasl;", "⁄"},
+    {"&gamma;", "γ"},      {"&ge;", "≥"},          {"&gt;", ">"},         {"&hArr;", "⇔"},    {"&harr;", "↔"},
+    {"&hearts;", "♥"},     {"&hellip;", "…"},      {"&iacute;", "í"},     {"&icirc;", "î"},   {"&iexcl;", "¡"},
+    {"&igrave;", "ì"},     {"&image;", "ℑ"},       {"&infin;", "∞"},      {"&int;", "∫"},     {"&iota;", "ι"},
+    {"&iquest;", "¿"},     {"&isin;", "∈"},        {"&iuml;", "ï"},       {"&kappa;", "κ"},   {"&lArr;", "⇐"},
+    {"&lambda;", "λ"},     {"&lang;", "〈"},       {"&laquo;", "«"},      {"&larr;", "←"},    {"&lceil;", "⌈"},
+    {"&ldquo;", "\u201C"}, {"&le;", "≤"},          {"&lfloor;", "⌊"},     {"&lowast;", "∗"},  {"&loz;", "◊"},
+    {"&lrm;", "\u200E"},   {"&lsaquo;", "‹"},      {"&lsquo;", "\u2018"}, {"&lt;", "<"},      {"&macr;", "¯"},
+    {"&mdash;", "—"},      {"&micro;", "µ"},       {"&middot;", "·"},     {"&minus;", "−"},   {"&mu;", "μ"},
+    {"&nabla;", "∇"},      {"&nbsp;", "\xC2\xA0"}, {"&ndash;", "–"},      {"&ne;", "≠"},      {"&ni;", "∋"},
+    {"&not;", "¬"},        {"&notin;", "∉"},       {"&nsub;", "⊄"},       {"&ntilde;", "ñ"},  {"&nu;", "ν"},
+    {"&oacute;", "ó"},     {"&ocirc;", "ô"},       {"&oelig;", "œ"},      {"&ograve;", "ò"},  {"&oline;", "‾"},
+    {"&omega;", "ω"},      {"&omicron;", "ο"},     {"&oplus;", "⊕"},      {"&or;", "∨"},      {"&ordf;", "ª"},
+    {"&ordm;", "º"},       {"&oslash;", "ø"},      {"&otilde;", "õ"},     {"&otimes;", "⊗"},  {"&ouml;", "ö"},
+    {"&para;", "¶"},       {"&part;", "∂"},        {"&permil;", "‰"},     {"&perp;", "⊥"},    {"&phi;", "φ"},
+    {"&pi;", "π"},         {"&piv;", "ϖ"},         {"&plusmn;", "±"},     {"&pound;", "£"},   {"&prime;", "′"},
+    {"&prod;", "∏"},       {"&prop;", "∝"},        {"&psi;", "ψ"},        {"&quot;", "\""},   {"&rArr;", "⇒"},
+    {"&radic;", "√"},      {"&rang;", "〉"},       {"&raquo;", "»"},      {"&rarr;", "→"},    {"&rceil;", "⌉"},
+    {"&rdquo;", "\u201D"}, {"&real;", "\u211C"},   {"&reg;", "®"},        {"&rfloor;", "⌋"},  {"&rho;", "ρ"},
+    {"&rlm;", "\u200F"},   {"&rsaquo;", "›"},      {"&rsquo;", "\u2019"}, {"&sbquo;", "‚"},   {"&scaron;", "š"},
+    {"&sdot;", "⋅"},       {"&sect;", "§"},        {"&shy;", "\xC2\xAD"}, {"&sigma;", "σ"},   {"&sigmaf;", "ς"},
+    {"&sim;", "∼"},        {"&spades;", "♠"},      {"&sub;", "⊂"},        {"&sube;", "⊆"},    {"&sum;", "∑"},
+    {"&sup1;", "¹"},       {"&sup2;", "²"},        {"&sup3;", "³"},       {"&sup;", "⊃"},     {"&supe;", "⊇"},
+    {"&szlig;", "ß"},      {"&tau;", "τ"},         {"&there4;", "∴"},     {"&theta;", "θ"},   {"&thetasym;", "ϑ"},
+    {"&thinsp;", " "},     {"&thorn;", "þ"},       {"&tilde;", "˜"},      {"&times;", "×"},   {"&trade;", "™"},
+    {"&uArr;", "⇑"},       {"&uacute;", "ú"},      {"&uarr;", "↑"},       {"&ucirc;", "û"},   {"&ugrave;", "ù"},
+    {"&uml;", "¨"},        {"&upsih;", "ϒ"},       {"&upsilon;", "υ"},    {"&uuml;", "ü"},    {"&weierp;", "℘"},
+    {"&xi;", "ξ"},         {"&yacute;", "ý"},      {"&yen;", "¥"},        {"&yuml;", "ÿ"},    {"&zeta;", "ζ"},
+    {"&zwj;", "\u200D"},   {"&zwnj;", "\u200C"},
 };
 
 // Verify the table is sorted at compile time.

lib/Epub/Epub/hyphenation/Hyphenator.cpp

@@ -24,7 +24,7 @@ struct Iso639Mapping {
 };
 static constexpr Iso639Mapping kIso639Mappings[] = {{"eng", "en"}, {"fra", "fr"}, {"fre", "fr"}, {"deu", "de"},
                                                     {"ger", "de"}, {"rus", "ru"}, {"spa", "es"}, {"ita", "it"},
-                                                    {"ukr", "uk"}, {"swe", "sv"}};
+                                                    {"ukr", "uk"}, {"swe", "sv"}, {"fin", "fi"}};
 
 // Maps a BCP-47 or ISO 639-2 language tag to a language-specific hyphenator.
 const LanguageHyphenator* hyphenatorForLanguage(const std::string& langTag) {