Release v0.6.43: fix forwarded input and verify snippet pastes

CMakeLists.txt

@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.24)
-project(KSwitcher VERSION 0.6.34 LANGUAGES CXX RC)
+project(KSwitcher VERSION 0.6.43 LANGUAGES CXX RC)
 if(NOT WIN32)
   message(FATAL_ERROR "KSwitcher uses native Windows APIs")
 endif()
@@ -48,6 +48,7 @@ else()
 endif()
 add_executable(KSwitcherOcrTests tests/ocr.cpp src/screenshot_launcher.cpp src/screenshot_activation.cpp src/app.cpp src/screenshot_notifications.cpp src/screenshot.cpp src/configuration.cpp src/ui.cpp resources/app.rc)
 target_link_libraries(KSwitcherOcrTests PRIVATE kscore)
+add_dependencies(KSwitcherOcrTests KSwitcherScreenshot)
 if(MSVC)
   set_property(TARGET kscore KSwitcher KSwitcherConfig KSwitcherScreenshot KSwitcherTests KSwitcherScrollTests KSwitcherIntegration KSwitcherInputTests KSwitcherOcrTests PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
   target_compile_options(kscore PRIVATE /W4 /utf-8)
@@ -65,6 +66,49 @@ else()
   target_link_options(KSwitcherOcrTests PRIVATE -static -static-libgcc -static-libstdc++)
 endif()
 enable_testing()
+add_executable(KSwitcherHistoryHostTests tests/history_host.cpp)
+target_link_libraries(KSwitcherHistoryHostTests PRIVATE kscore psapi)
+set_target_properties(KSwitcherHistoryHostTests PROPERTIES RUNTIME_OUTPUT_DIRECTORY "${CMAKE_CURRENT_BINARY_DIR}/history-host-fixture-$<CONFIG>")
+add_dependencies(KSwitcherHistoryHostTests KSwitcher KSwitcherScreenshot)
+add_custom_command(TARGET KSwitcherHistoryHostTests POST_BUILD
+  COMMAND ${CMAKE_COMMAND} -E copy "$<TARGET_FILE:KSwitcher>" "$<TARGET_FILE_DIR:KSwitcherHistoryHostTests>/KSwitcher.exe"
+  COMMAND ${CMAKE_COMMAND} -E copy "$<TARGET_FILE:KSwitcherScreenshot>" "$<TARGET_FILE_DIR:KSwitcherHistoryHostTests>/KSwitcher.Screenshot.exe"
+  COMMAND ${CMAKE_COMMAND} -E touch "$<TARGET_FILE_DIR:KSwitcherHistoryHostTests>/.local-dev")
+if(MSVC)
+  target_compile_options(KSwitcherHistoryHostTests PRIVATE /utf-8)
+  set_property(TARGET KSwitcherHistoryHostTests PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
+else()
+  target_link_options(KSwitcherHistoryHostTests PRIVATE -static -static-libgcc -static-libstdc++)
+endif()
+add_executable(KSwitcherClipboardSnapshotTests tests/clipboard_snapshot.cpp)
+target_link_libraries(KSwitcherClipboardSnapshotTests PRIVATE kscore psapi)
+add_dependencies(KSwitcherClipboardSnapshotTests KSwitcherScreenshot)
+if(MSVC)
+  target_compile_options(KSwitcherClipboardSnapshotTests PRIVATE /utf-8)
+  set_property(TARGET KSwitcherClipboardSnapshotTests PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
+else()
+  target_link_options(KSwitcherClipboardSnapshotTests PRIVATE -static -static-libgcc -static-libstdc++)
+endif()
+add_executable(KSwitcherImageCaptureTests tests/image_capture.cpp)
+target_link_libraries(KSwitcherImageCaptureTests PRIVATE kscore)
+add_dependencies(KSwitcherImageCaptureTests KSwitcherScreenshot)
+if(MSVC)
+  target_compile_options(KSwitcherImageCaptureTests PRIVATE /utf-8)
+  set_property(TARGET KSwitcherImageCaptureTests PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
+else()
+  target_link_options(KSwitcherImageCaptureTests PRIVATE -static -static-libgcc -static-libstdc++)
+endif()
+# Explicit interactive test: stop the resident first so its clipboard listener
+# does not capture the test fixtures. Like KSwitcherIntegration, not part of ctest.
+add_executable(KSwitcherDictionaryTests tests/dictionary.cpp)
+target_link_libraries(KSwitcherDictionaryTests PRIVATE kscore psapi)
+if(MSVC)
+  set_property(TARGET KSwitcherDictionaryTests PROPERTY MSVC_RUNTIME_LIBRARY "MultiThreaded$<$<CONFIG:Debug>:Debug>")
+else()
+  target_link_options(KSwitcherDictionaryTests PRIVATE -static -static-libgcc -static-libstdc++)
+endif()
+add_test(NAME dictionary-regressions COMMAND KSwitcherDictionaryTests)
+set_tests_properties(dictionary-regressions PROPERTIES WORKING_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}")
 add_test(NAME sync-regressions COMMAND KSwitcherSyncTests)
 add_test(NAME native-regressions COMMAND KSwitcherTests)
 add_test(NAME scroll-regressions COMMAND KSwitcherScrollTests)

README.md

@@ -75,6 +75,9 @@ Ctrl+Alt+Delete and Win+L; these cannot be assigned.
 
 Keyboard and mouse input forwarded by Microsoft Mouse Without Borders follows the same input
 path as a local keyboard/mouse, including shortcuts, recent-word conversion and snippets.
+On the sending computer, KSwitcher ignores keyboard events consumed by another keyboard hook
+(including Mouse Without Borders forwarding). The receiving computer still processes delivered
+input normally, so both computers can run KSwitcher without starting duplicate snippet operations.
 KSwitcher marks its own generated input so copy/paste, selection, modifier releases and shell-mask
 keys cannot trigger recursive commands or overwrite the recorded typing run. Other injected input
 is accepted, including key-up events and VK-only keyboard events. Unicode packets do not provide
@@ -274,10 +277,18 @@ thumbnails and source labels aligned with the scaled fonts and spacing.
   of the complete expected text. Browser/editor compatibility depends on its handling of simulated input.
 - Selection conversion and verified recent input (physical scan codes, 2-second typing-run boundary).
 - Same-process clipboard ownership plus verified WebView2 descendants, including the Teams fix.
+  Clipboard synchronizers such as Mouse Without Borders may republish a copy only when
+  KSwitcher first observed it owned by the target application and the selection text and
+  editor selection metadata remain identical. Unobserved or altered foreign copies are rejected.
+  Snippets require accessibility verification of their selected trigger and pasted text,
+  even with logging disabled. If verification is unavailable or the paste differs, expansion
+  stops without running cursor or Enter actions. Clipboard changes during paste also cancel actions.
 - Teams recent-word conversion uses a single word-selection command and validates the copied range.
   If the editor's word boundary differs from the recorded typing, it falls back to paced character
   selection: Teams can coalesce a burst of Shift+Left events into just one character.
 - Clipboard snapshot/restoration with concurrent-copy, foreground and input-version checks.
+  A snapshot interrupted by a concurrent clipboard publication is retried up to three total
+  attempts before selection starts, provided the foreground and input context remain unchanged.
   A silently dropped copy is retried up to three total attempts while the clipboard and input
   context remain unchanged. Temporary transaction contents are excluded from Windows clipboard
   history and cloud synchronization. Paste is not blindly retried: with manual paste readback
@@ -627,7 +638,12 @@ support automatic correction. Dictionary recognition is heuristic, not an unders
 subtitle vocabulary is incomplete, and uncommon names or jargon can need personal exceptions.
 
 No network service or language model is used. The three dictionary files occupy about 2.6 MB on disk;
-the English/Ukrainian lookup data uses less than 3 MiB of RAM and is loaded on first automatic check.
+the bundled EN/UK/RU lookup payload uses about 0.90 MiB of RAM. When automatic correction is enabled,
+selected dictionaries are loaded before typing and shared by the input predictor and worker.
+Words are stored in compact indexed blocks; all words and frequency ranks are retained, and editable
+UTF-8 dictionary files keep the same format. Custom dictionaries can use more memory.
+`build.ps1 -Test` checks every bundled word/rank and measures lookup speed; CMake exposes the same
+check as `dictionary-regressions`. The payload figure excludes the rest of the process and allocator overhead.
 Keep `dictionaries/` beside the executable when copying the app. These word lists derive from
 [FrequencyWords](https://github.com/hermitdave/FrequencyWords) and are separately licensed under
 CC BY-SA 4.0; attribution, pinned source revision and license are in `dictionaries/`.
@@ -702,3 +718,27 @@ supporting old clients; their immutable update code only reads that page.
 ### Editors that omit copied trailing spaces
 
 From v0.6.31, KSwitcher recovers trailing ordinary spaces omitted by Ctrl+C only when Windows accessibility proves the complete selection. The same focused control and range are rechecked before paste, and the result is read back even without Write log. Recent-text conversion, automatic correction, repeat conversion and Undo retain exact verification. Missing letters, tabs, line breaks and unavailable or ambiguous selections are not reconstructed. No setting or shortcut has changed.
+
+### Notification registration and Viber — v0.6.36
+
+Notification registration runs in KSwitcher.Screenshot.exe; keep all three executables together. Startup registration is asynchronous. Viber pastes allow 75 ms for clipboard notifications before Ctrl+V, retaining focus, ownership and selection checks. This mitigates an intermittent clipboard timing issue; it does not guarantee all Viber failures are resolved. UI Automation is unchanged.
+
+### Image history, OCR and duplicate fingerprints — v0.6.37
+
+Image clipboard capture and automatic/uncached manual history OCR run in short-lived KSwitcher.Screenshot.exe processes. Keep all three executables together. Original clipboard formats, image limits, privacy exclusions, Windows OCR, optional Tesseract and searchable encrypted OCR results are preserved. Background OCR is cancelled on shutdown or an OCR-profile change; late results do not recreate deleted entries.
+
+Consecutive duplicates use SHA-256 fingerprints inside the encrypted history index, including pixel fingerprints for equivalent image encodings. Older entries acquire fingerprints on first comparison without a bulk migration. Pins and OCR caches survive duplicate detection; non-consecutive copies still create separate entries. New text no longer loads the preceding image to rule out a duplicate. No shortcut, setting or default changed.
+
+Moving OCR isolates its temporary memory rather than reducing the combined processing peak. A controlled three-run comparison retained about 0.8 MiB less private RAM in the caller after recognition; combined peak RAM was about 55.6 MiB before and 56.6 MiB with the helper. Results depend on the image, OCR engine and system.
+
+### Pinned history checkbox — v0.6.42
+
+Check **★ Pinned only** beside the history search box to show only pinned entries; uncheck it to show all entries. The checkbox sits on the left, immediately followed by the search box; its right edge stays aligned with the history list when resizing. The text search applies within that filter. Unpinning an item removes it from the pinned view immediately. The checkbox state and search are remembered after closing and reopening history. **Clear history…** still deletes the entire history after confirmation, including entries hidden by the filter.
+
+### History process and clipboard memory — v0.6.40
+
+History opens in a separate, short-lived instance of **KSwitcher.exe**. **Esc** closes it even when focus is on the window or an action button, releasing Windows UI allocations with the process. The resident keeps keyboard hooks, clipboard capture and history storage. Search, selection and the top entry are preserved in encrypted view state. If a full-text item viewer is still open, the helper stays alive until the last viewer closes. Pin/delete, formatted/plain paste and OCR remain available; settings and default shortcuts are unchanged.
+
+Image thumbnails are decoded in **KSwitcher.Screenshot.exe**, returning only bounded preview pixels. Image clipboard backup/restore also uses that helper and encrypted temporary files, with clipboard-sequence checks before restoring. Selection reads avoid loading image formats. Keep all three executables together; no fourth executable is required. Paste allows a brief foreground handoff after history closes while preserving cancellation checks. UI Automation remains in the resident.
+
+A live development-build test measured **4.37 MiB before history and 4.35 MiB after two open/Esc cycles**, compared with an earlier roughly 8–9 MiB plateau. A same-image clipboard-backup benchmark retained **12.78 MiB before versus 0.05 MiB after**. These measure private working set, not a guaranteed total footprint. Include all helpers when measuring active use: combined memory can be higher while history is open. No forced working-set trimming is used. Existing screenshots and shortcuts remain applicable. The v0.6.38 approach of retaining a hidden history window/RichEdit control is superseded by process termination.

Release/README.md

@@ -1,19 +1,23 @@
 # Latest Windows release
 
-## v0.6.34 — 2026-11-04
+## v0.6.43 — 2026-11-04
 
 ## Changes
-- Screenshot editing now uses the four-direction move cursor for both endpoints of lines/arrows, bounding-box shape handles and number-radius handles. The cursor no longer suggests that a horizontal or vertical line endpoint is restricted to one axis.
+- Respect downstream keyboard-hook suppression before tracking input or starting snippets. This prevents source-side expansion of keys forwarded by Mouse Without Borders. Update KSwitcher on both computers, especially the keyboard-sharing source.
-- Object bodies, arrow labels and triangle vertices continue to use the same four-direction cursor. Thickness handles retain directional resize cursors perpendicular to the line; rotation handles retain the hand cursor.
+- Verify snippet selection and pasted text through accessibility even with logging disabled. Unavailable verification, incorrect text or clipboard changes cancel further cursor/Enter actions. No snippet syntax, shortcut or default changed.
-- This changes cursor feedback only. Dragging, snapping, circle proportions, undo/redo, shortcuts, defaults and dialog access-key behavior are unchanged. The v0.6.33 unsaved-settings warning and visible menu access letters remain included.
+- Accept identical clipboard relays only after observing target-owned content, preserving text and editor selection metadata checks. Unicode allocation padding and format order do not cause false mismatches; changed content remains rejected.
+- Retry clipboard snapshots interrupted by concurrent publication up to three times before selection, while input context remains unchanged.
+- Clicking a warning notification opens Logs. Copy rejection diagnostics include observed/current text, clipboard sequences and the sentinel for troubleshooting.
 
 ## Validation
-The full `build.ps1 -Stage -Test` run passed: 105 sync checks, shared wheel batching, 483 native regressions, 551 input/UI checks at 96 DPI, screenshot editor UI checks (including free-movement cursor feedback across drawing tools and horizontal/vertical thickness cursors), PNG saving, isolated screenshot registration, 48 updater regressions and updater progress UI checks. All three executable versions and all 12 package manifest file sizes/SHA-256 hashes were verified; the package contains no personal data.
+Release regression checks cover dictionary equivalence (140,939 words), 105 sync checks, 319 native checks, 569 input checks, screenshot UI/save/registration, 48 updater checks and updater progress UI. The isolated snippet suite exercises an actual downstream forwarding hook, verifies no source-side copy or text changes, and checks normal expansion, Enter, buffered typing, copy retries and suppression of Enter after incorrect pasted text.
+
+Live two-computer validation with both instances updated remains outstanding. An older instance on either computer can still interfere; the fix does not accept unrelated clipboard contents.
 
 ## Upgrade
-Choose **Update** in the tray menu. Legacy v0.3.0–v0.4.1 clients first receive the v0.4.2 compatibility bridge, then the current full release. v0.2.3 and earlier require manual installation.
+Choose **Update** in the tray menu on both computers. Legacy v0.3.0–v0.4.1 clients first receive the v0.4.2 compatibility bridge, then the current full release. v0.2.3 and earlier require manual installation.
-For manual installation, exit KSwitcher, close screenshot editors and extract the entire ZIP into its installation folder. Keep personal `data/` and customized dictionaries.
+For manual installation, exit KSwitcher, close its configurator and screenshot editors, and extract the entire ZIP into its installation folder. Keep personal `data/` and customized dictionaries.
 
-Download **KSwitcher-win-x64.zip** with **SHA256SUMS.txt**. Keep all three executables together. The package contains no personal settings, credentials or clipboard history.
+Download **KSwitcher-win-x64.zip** with **SHA256SUMS.txt**. Keep all three executables together; history uses another instance of KSwitcher.exe. The package contains no personal settings, credentials or clipboard history.
 
 Publish stable `release-vX.Y.Z` tags matching the executable version. Keep `v0.4.2` as the last legacy tag.

Release/SHA256SUMS.txt

@@ -1 +1 @@
-c7f004ecd9d0f1032356060191ca3ca9fca458df434d3e5908c5d9b038f95acc  KSwitcher-win-x64.zip
+008f34a2a4a875acb07d21a39c0fad3a0cb63371edbcb91d393edf72543aea5e  KSwitcher-win-x64.zip

build.ps1

@@ -37,10 +37,14 @@ try {
     if ($LASTEXITCODE) { throw 'Configurator link failed' }
     Copy-Item -LiteralPath $configPath -Destination build/release/KSwitcher.Config.exe -Force
     $screenshotPath = Join-Path (Split-Path $executablePath) 'KSwitcher.Screenshot.exe'
-    & $compiler -mwindows -municode -static -s '-Wl,--gc-sections' build/core.o build/platform.o build/ocr.o build/screenshot.o build/screenshot_notifications.o build/screenshot_activation.o build/screenshot_main.o build/screenshot-res.o @libs -o $screenshotPath
+    & $compiler -mwindows -municode -static -s '-Wl,--gc-sections' build/core.o build/platform.o build/storage.o build/ocr.o build/screenshot.o build/screenshot_notifications.o build/screenshot_activation.o build/screenshot_main.o build/screenshot-res.o @libs -o $screenshotPath
     if ($LASTEXITCODE) { throw 'Screenshot link failed' }
     Copy-Item -LiteralPath $screenshotPath -Destination build/release/KSwitcher.Screenshot.exe -Force
     if ($Test) {
+        & $compiler @common tests/dictionary.cpp build/core.o build/platform.o build/autocorrect.o @libs -lpsapi -static -s -o build/KSwitcherDictionaryTests.exe
+        if ($LASTEXITCODE) { throw 'Dictionary test build failed' }
+        & .\build\KSwitcherDictionaryTests.exe
+        if ($LASTEXITCODE) { throw 'Dictionary tests failed' }
         & $compiler @common tests/sync.cpp build/core.o build/platform.o build/storage.o build/sync.o build/ocr.o @libs -static -s -o build/KSwitcherSyncTests.exe
         if ($LASTEXITCODE) { throw 'Sync test build failed' }
         & .\build\KSwitcherSyncTests.exe
@@ -77,15 +81,35 @@ try {
         if ($LASTEXITCODE) { throw 'Updater progress UI tests failed' }
     }
     if ($Integration) {
+        $historyFixture = Join-Path (Resolve-Path build) ('history-host-fixture-' + [guid]::NewGuid().ToString('N'))
+        New-Item -ItemType Directory $historyFixture | Out-Null
+        Copy-Item $executablePath,(Join-Path (Split-Path $executablePath) 'KSwitcher.Screenshot.exe') -Destination $historyFixture
+        Set-Content (Join-Path $historyFixture '.local-dev') 'Isolated history integration test'
+        $historyTest = Join-Path $historyFixture 'KSwitcherHistoryHostTests.exe'
+        & $compiler @common tests/history_host.cpp build/core.o build/platform.o build/storage.o build/ocr.o @libs -lpsapi -static -s -o $historyTest
+        if ($LASTEXITCODE) { throw 'History host test build failed' }
+        & $historyTest
+        if ($LASTEXITCODE) { throw 'History host tests failed' }
+        $snapshotTest = Join-Path (Split-Path $executablePath) 'KSwitcherClipboardSnapshotTests.exe'
+        & $compiler @common tests/clipboard_snapshot.cpp build/core.o build/platform.o build/storage.o build/ocr.o @libs -lpsapi -static -s -o $snapshotTest
+        if ($LASTEXITCODE) { throw 'Clipboard snapshot test build failed' }
+        & $snapshotTest
+        if ($LASTEXITCODE) { throw 'Clipboard snapshot tests failed' }
+        $captureTest = Join-Path (Split-Path $executablePath) 'KSwitcherImageCaptureTests.exe'
+        & $compiler @common tests/image_capture.cpp build/core.o build/platform.o build/storage.o build/ocr.o @libs -static -s -o $captureTest
+        if ($LASTEXITCODE) { throw 'Image capture test build failed' }
+        & $captureTest
+        if ($LASTEXITCODE) { throw 'Image capture tests failed' }
         & $compiler @common tests/integration.cpp build/core.o build/platform.o build/autostart.o build/autocorrect.o build/storage.o build/sync.o build/ocr.o build/richtext.o build/update.o build/screenshot.o build/screenshot_launcher.o build/screenshot_activation.o build/screenshot_notifications.o build/app.o build/configuration.o build/ui.o build/screenshot-res.o @libs -static -s -o build/KSwitcherIntegration.exe
         if ($LASTEXITCODE) { throw 'Integration test build failed' }
         & .\build\KSwitcherIntegration.exe
         if ($LASTEXITCODE) { throw 'Integration tests failed' }
     }
     if ($Ocr) {
-        & $compiler @common tests/ocr.cpp build/core.o build/platform.o build/autostart.o build/autocorrect.o build/storage.o build/sync.o build/ocr.o build/richtext.o build/update.o build/screenshot.o build/screenshot_launcher.o build/screenshot_activation.o build/screenshot_notifications.o build/app.o build/configuration.o build/ui.o build/screenshot-res.o @libs -static -s -o build/KSwitcherOcrTests.exe
+        $ocrTest = Join-Path (Split-Path $executablePath) 'KSwitcherOcrTests.exe'
+        & $compiler @common tests/ocr.cpp build/core.o build/platform.o build/autostart.o build/autocorrect.o build/storage.o build/sync.o build/ocr.o build/richtext.o build/update.o build/screenshot.o build/screenshot_launcher.o build/screenshot_activation.o build/screenshot_notifications.o build/app.o build/configuration.o build/ui.o build/screenshot-res.o @libs -static -s -o $ocrTest
         if ($LASTEXITCODE) { throw 'OCR test build failed' }
-        & .\build\KSwitcherOcrTests.exe
+        & $ocrTest
         if ($LASTEXITCODE) { throw 'OCR tests failed' }
     }
     foreach ($folder in @('build/dictionaries','build/release/dictionaries','build/staged/dictionaries')) {

resources/app.rc

@@ -9,8 +9,8 @@ IDC_SCREENSHOT_PENCIL CURSOR "icons/lucide/pencil.cur"
 1 RT_MANIFEST "app.manifest"
 201 RCDATA "update.ps1"
 1 VERSIONINFO
- FILEVERSION 0,6,34,0
+ FILEVERSION 0,6,43,0
- PRODUCTVERSION 0,6,34,0
+ PRODUCTVERSION 0,6,43,0
  FILEOS VOS_NT_WINDOWS32
  FILETYPE VFT_APP
 BEGIN
@@ -20,7 +20,7 @@ BEGIN
   BEGIN
    VALUE "FileDescription", "KSwitcher — native keyboard and clipboard utility"
    VALUE "ProductName", "KSwitcher"
-   VALUE "FileVersion", "0.6.34"
+   VALUE "FileVersion", "0.6.43"
   END
  END
  BLOCK "VarFileInfo"

src/app.cpp

@@ -1,4 +1,5 @@
 #include "app.h"
+#include <utility>
 #include "../vendor/json.hpp"
 #include "../resources/resource.h"
 #include "ocr.h"
@@ -14,6 +15,7 @@ namespace ks
 {
 #include "app_sync.inl"
 App *App::current = nullptr;
+#include "app_history.inl"
 namespace
 {
 const char *transformCommandName(int command)
@@ -70,12 +72,14 @@ class Transaction
     App &app;
     HWND target;
     uint64_t version;
-    Clip snapshot;
+    ClipboardSnapshot snapshot;
     DWORD expected{};
     bool captured{};
     mutable bool invalidLogged{};
     unsigned copyNumber{};
     std::wstring adopted;
+    Bytes adoptedFormats;
+    bool trustedContentsObserved{};
     std::unique_ptr<PasteProbe> selectionProof;
     std::wstring provenSelection;
 
@@ -84,11 +88,27 @@ class Transaction
     {
         app.suspended = true;
         try
+        {
+            for (unsigned attempt = 0; ; ++attempt)
             {
                 expected = GetClipboardSequenceNumber();
-            snapshot = readClipboard(app.window, 64 * 1024 * 1024);
+                try
+                {
+                    snapshot.capture(app.window, expected);
                     if (expected != GetClipboardSequenceNumber())
                         throw std::runtime_error("Clipboard changed while taking snapshot");
+                    break;
+                }
+                catch (...)
+                {
+                    // No selection or clipboard write has happened yet. Recapture
+                    // the latest clipboard after a concurrent publisher settles.
+                    if (attempt >= 2 || !valid() || expected == GetClipboardSequenceNumber())
+                        throw;
+                    diagnosticEvent(L"Snapshot retry: clipboard changed during capture");
+                    Sleep(20);
+                }
+            }
             captured = true;
         }
         catch (...)
@@ -102,7 +122,7 @@ class Transaction
         if (captured && GetClipboardSequenceNumber() == expected)
             try
             {
-                app.ownSequence = writeClipboard(app.window, snapshot);
+                app.ownSequence = snapshot.restore(app.window, expected);
             }
             catch (...)
             {
@@ -130,9 +150,19 @@ class Transaction
         if (GetClipboardSequenceNumber() != expected)
         {
             auto now = GetClipboardSequenceNumber();
-            if (adopted.empty() || !ownsClipboard(target) || readClipboard(app.window).text() != adopted ||
+            auto current = readClipboard(app.window, 32 * 1024 * 1024, ClipboardRead::Selection);
-                GetClipboardSequenceNumber() != now)
+            const bool sameContents = selectionClipboardIdentity(current) == adoptedFormats;
+            if (adopted.empty() || (!trustedContentsObserved && !ownsClipboard(target)) ||
+                !sameContents || GetClipboardSequenceNumber() != now)
+            {
+                diagnosticEvent(L"Clipboard check rejected: expectedSequence=" + std::to_wstring(expected) +
+                    L" readSequence=" + std::to_wstring(now) + L" currentSequence=" +
+                    std::to_wstring(GetClipboardSequenceNumber()) + L" owner=" +
+                    std::to_wstring((uintptr_t)GetClipboardOwner()) + L" sameContents=" +
+                    std::to_wstring(sameContents) + L" expectedText=" + diagnosticText(adopted) +
+                    L" currentText=" + diagnosticText(current.text()));
                 throw std::runtime_error("Operation cancelled: another application changed the clipboard");
+            }
             expected = now;
         }
     }
@@ -140,6 +170,8 @@ class Transaction
     {
         check();
         adopted.clear();
+        adoptedFormats.clear();
+        trustedContentsObserved = false;
         // These are temporary transaction contents, not a user's clipboard entry.
         // In particular, do not invite the Windows history service to read our
         // sentinel while the target editor is trying to open the clipboard.
@@ -152,7 +184,7 @@ class Transaction
         if (GetClipboardOwner() != app.window)
             throw std::runtime_error("Clipboard changed immediately after writing");
         auto text = c.text();
-        if ((!text.empty() && readClipboard(app.window).text() != text) ||
+        if ((!text.empty() && readClipboard(app.window, 32 * 1024 * 1024, ClipboardRead::Selection).text() != text) ||
             GetClipboardSequenceNumber() != expected)
             throw std::runtime_error("Clipboard changed while verifying our write");
     }
@@ -162,10 +194,12 @@ class Transaction
         const auto number = ++copyNumber;
         if (!valid())
             return {};
-        write(textClip(L"\x2063KSwitcher-" + std::to_wstring(GetTickCount64())));
+        const auto sentinel = L"\x2063KSwitcher-" + std::to_wstring(GetTickCount64());
+        write(textClip(sentinel));
         DWORD before = expected;
         diagnosticEvent(L"Copy begin number=" + std::to_wstring(number) + L" sentinelSequence=" +
-            std::to_wstring(before) + L" target=" + std::to_wstring((uintptr_t)target));
+            std::to_wstring(before) + L" target=" + std::to_wstring((uintptr_t)target) +
+            L" sentinel=" + diagnosticText(sentinel));
         if (!valid() || !chord(L'C', MOD_CONTROL))
         {
             diagnosticEvent(L"Copy failed: context changed or simulated Ctrl+C blocked");
@@ -177,6 +211,7 @@ class Transaction
         DWORD changed = before;
         ULONGLONG stable = 0;
         bool changedAgain = false;
+        std::optional<Bytes> observedTargetCopy;
         while (GetTickCount64() < deadline)
         {
             if (!valid())
@@ -191,6 +226,18 @@ class Transaction
                 changedAgain |= changed != before;
                 changed = now;
                 stable = GetTickCount64();
+                // Clipboard synchronizers can republish a legitimate copy under
+                // their own HWND. Record provenance before that handoff; an
+                // unobserved or altered foreign copy must still be rejected.
+                if (ownsClipboard(target))
+                {
+                    auto candidate = readClipboard(app.window, 32 * 1024 * 1024, ClipboardRead::Selection);
+                    if (GetClipboardSequenceNumber() == now && ownsClipboard(target) && !candidate.text().empty())
+                    {
+                        observedTargetCopy = selectionClipboardIdentity(candidate);
+                        diagnosticEvent(L"Copy: target-owned selection observed number=" + std::to_wstring(number));
+                    }
+                }
             }
             if (changed != before && GetTickCount64() - stable >= 60)
                 break;
@@ -222,16 +269,31 @@ class Transaction
                                     L"Copy failed: context changed");
             return {};
         }
-        if ((GetClipboardOwner() ? !ownsClipboard(target) : changedAgain) ||
+        const bool targetOwned = ownsClipboard(target);
+        auto clip = readClipboard(app.window, 32 * 1024 * 1024, ClipboardRead::Selection);
+        const auto formats = selectionClipboardIdentity(clip);
+        const bool verifiedRelay = observedTargetCopy && *observedTargetCopy == formats;
+        if (((GetClipboardOwner() ? !targetOwned : changedAgain) && !verifiedRelay) ||
             changed != GetClipboardSequenceNumber())
+        {
+            diagnosticEvent(L"Copy rejected: observedTarget=" + std::to_wstring(observedTargetCopy.has_value()) +
+                L" verifiedRelay=" + std::to_wstring(verifiedRelay) + L" expectedSequence=" +
+                std::to_wstring(changed) + L" currentSequence=" + std::to_wstring(GetClipboardSequenceNumber()) +
+                L" owner=" + std::to_wstring((uintptr_t)GetClipboardOwner()) + L" targetText=" +
+                diagnosticText(observedTargetCopy ? decodeClip(*observedTargetCopy).text() : L"") +
+                L" currentText=" + diagnosticText(clip.text()));
             throw std::runtime_error("Operation cancelled: copy did not belong to the target application");
+        }
+        if (!targetOwned && verifiedRelay)
+            diagnosticEvent(L"Copy: identical target selection republished by clipboard synchronizer");
         expected = changed;
-        auto clip = readClipboard(app.window);
         auto text = clip.text();
         diagnosticEvent(L"Copy result number=" + std::to_wstring(number) + L" attempts=" +
             std::to_wstring(attempts) + L" elapsedMs=" + std::to_wstring(GetTickCount64() - started) +
             L" text=" + diagnosticText(text));
         adopted = text;
+        adoptedFormats = formats;
+        trustedContentsObserved = targetOwned || verifiedRelay;
         check();
         for (auto &f : clip.formats)
         {
@@ -357,6 +419,22 @@ class Transaction
         if (!valid())
             return false;
         write(clip);
+        // Our verified payload is also trusted across an identical relay. The
+        // sentinel written by copy() deliberately does not get this allowance.
+        if (clip.formats.size() == 1 && clip.formats.front().id == CF_UNICODETEXT)
+        {
+            adopted = clip.text();
+            adoptedFormats = selectionClipboardIdentity(clip);
+            trustedContentsObserved = true;
+        }
+        // Viber's Qt editor observes clipboard changes asynchronously. Give it
+        // a chance to discard the data object from Ctrl+C before requesting paste.
+        // Recheck ownership and input below; never retry a possibly applied paste.
+        if (lower(processName(target)) == L"viber")
+        {
+            Sleep(75);
+            diagnosticEvent(L"Paste: Viber clipboard notification settling interval completed");
+        }
         for (int i = 0; i < 2; ++i)
         {
             check();
@@ -366,6 +444,10 @@ class Transaction
         if (!chord(L'V', MOD_CONTROL))
             throw std::runtime_error("Windows blocked simulated input; check application privilege levels");
         Sleep(300);
+        // A clipboard synchronizer may replace our payload after Ctrl+V is
+        // queued but before the editor consumes it. Do not run snippet actions
+        // (especially Enter) after such a race.
+        check();
         return true;
     }
     bool nativeSelectionIs(const std::wstring &original) const
@@ -396,7 +478,8 @@ class Transaction
     }
 };
 } // namespace
-App::App(HINSTANCE h, bool test, const std::filesystem::path &dataRoot) : instance(h), smoke(test)
+App::App(HINSTANCE h, bool test, const std::filesystem::path &dataRoot, HWND service)
+    : historyService(service), instance(h), smoke(test)
 {
     updateNotifier = notifyUpdateAvailable;
     current = this;
@@ -413,7 +496,7 @@ App::App(HINSTANCE h, bool test, const std::filesystem::path &dataRoot) : instan
         registrationWarning = L"Settings were not loaded: " + wide(e.what());
     }
     setLoggingEnabled(settings.writeLog);
-    if (settings.autoCorrect)
+    if (settings.autoCorrect && !historyService)
         try { autoPredictor.configure(std::filesystem::path(executable()).parent_path() / L"dictionaries", settings.autoLanguages); }
         catch (const std::exception &e)
         {
@@ -432,6 +515,9 @@ App::App(HINSTANCE h, bool test, const std::filesystem::path &dataRoot) : instan
 }
 App::~App()
 {
+    if (auto host = historyController(historyProcess)) PostMessageW(host, WM_CLOSE, 0, 0);
+    if (historyProcess) CloseHandle(historyProcess);
+    if (notificationRegistration) CloseHandle(notificationRegistration);
     if (syncWorker.joinable()) syncWorker.join();
     if (updateWorker.joinable())
         updateWorker.join();
@@ -526,7 +612,10 @@ void App::scheduleHistoryOcr(const Settings &config)
                         if (!entry.image || (entry.ocrState != 1 && entry.ocrProfile == profile)) continue;
                         try
                         {
-                            auto text = recognizeText(history->load(entry.id), config);
+                            auto text = history->recognizeImage(entry.id, config, [this, &profile] {
+                                std::lock_guard lock(jobsMutex);
+                                return stop || ocrProfile(historyOcrSettings) != profile;
+                            });
                             std::lock_guard lock(jobsMutex);
                             if (stop || ocrProfile(historyOcrSettings) != profile) continue;
                             if (history->saveOcr(entry.id, text, config))
@@ -642,7 +731,7 @@ void App::applySettings(const Settings &requested)
         ++inputVersion;
         if (busy) diagnosticEvent(L"Input context changed: settings applied version=" + std::to_wstring(inputVersion.load()));
     }
-    // Clear on the worker so the next check reloads edits to dictionary files.
+    // Release the worker's old snapshot; the next check shares the freshly loaded predictor.
     enqueue([this] { autoCorrector.configure({}, {}); });
     scheduleHistoryOcr(s);
     nextSync = std::max(GetTickCount64() + 2000, syncRetryAfter);
@@ -675,6 +764,7 @@ void App::reloadLayouts()
 }
 void App::clearHistory()
 {
+    if (historyService) { remoteHistory("clear"); history->reload(); return; }
     if (busy) throw std::runtime_error("Wait for the current operation to finish.");
     if (history) history->clear();
     if (historyWindow) refreshHistory(*this);
@@ -703,6 +793,13 @@ void App::resetInput()
     run.reset();
     last.reset();
 }
+void App::releaseIdleMemory(ULONGLONG now)
+{
+    expireDiagnostics(now);
+    std::lock_guard lock(stateMutex);
+    // Match the Undo eligibility deadline; never discard an available operation.
+    if (!busy && last && now - last->at > 120000) last.reset();
+}
 void App::clearLog(bool previous) { clearDiagnosticLog(previous); }
 void App::keyboard(const KBDLLHOOKSTRUCT &k, UINT mods)
 {
@@ -930,6 +1027,15 @@ void App::replayTyping()
 }
 LRESULT CALLBACK App::keyProc(int code, WPARAM wp, LPARAM lp)
 {
+    // MWB suppresses source-machine events that it forwards elsewhere. Let
+    // downstream hooks route the event before tracking it or starting a snippet.
+    // Call the chain exactly once; a local event can still be consumed below.
+    const auto routed = CallNextHookEx(nullptr, code, wp, lp);
+    return keyboardAfterHooks(code, wp, lp, routed);
+}
+LRESULT App::keyboardAfterHooks(int code, WPARAM wp, LPARAM lp, LRESULT routed)
+{
+    if (routed) return routed;
     if (code == HC_ACTION && current &&
         (wp == WM_KEYDOWN || wp == WM_SYSKEYDOWN || wp == WM_KEYUP || wp == WM_SYSKEYUP))
     {
@@ -944,7 +1050,7 @@ LRESULT CALLBACK App::keyProc(int code, WPARAM wp, LPARAM lp)
                                     wp == WM_KEYDOWN || wp == WM_SYSKEYDOWN, mods))
             return 1;
     }
-    return CallNextHookEx(nullptr, code, wp, lp);
+    return routed;
 }
 LRESULT CALLBACK App::mouseProc(int code, WPARAM wp, LPARAM lp)
 {
@@ -1166,9 +1272,11 @@ void App::transform(int command, int snippet)
                     if (!config.autoCorrect || recent.window != target || recent.overflow ||
                         recent.keys.empty() || recent.keys.back() != L' ' || hint < 0)
                         return;
-                    autoCorrector.configure(std::filesystem::path(executable()).parent_path() /
+                    {
-                                                L"dictionaries",
+                        std::lock_guard lock(stateMutex);
-                                            config.autoLanguages);
+                        if (inputVersion.load() != version) return;
+                        autoCorrector.shareDictionaries(autoPredictor);
+                    }
                     std::wstring predicted;
                     for (wchar_t key : recent.keys)
                         predicted += key == L' ' ? L' ' : available[hint].at(physicalLayout().code(key));
@@ -1371,11 +1479,11 @@ void App::transform(int command, int snippet)
                     }
                 }
                 bool sent = false;
-                const bool requireReadback = tx.recoveredSelection();
+                const bool requireReadback = tx.recoveredSelection() || snippet >= 0;
                 PasteProbe probe(((config.writeLog && manual) || requireReadback) && result != text, text, target);
                 if (requireReadback && result != text && probe.status != L"ready")
                 {
-                    reason = L"recovered-selection-unavailable";
+                    reason = snippet >= 0 ? L"snippet-verification-unavailable" : L"recovered-selection-unavailable";
                     std::lock_guard lock(stateMutex);
                     last.reset();
                     run.reset();
@@ -1389,7 +1497,7 @@ void App::transform(int command, int snippet)
                     chord(VK_RIGHT);
                 if (requireReadback && result != text && !sent)
                 {
-                    reason = L"recovered-selection-paste-cancelled";
+                    reason = snippet >= 0 ? L"snippet-paste-cancelled" : L"recovered-selection-paste-cancelled";
                     std::lock_guard lock(stateMutex);
                     last.reset();
                     run.reset();
@@ -1501,6 +1609,7 @@ void App::transform(int command, int snippet)
 }
 void App::pasteEntry(std::wstring id, bool plain)
 {
+    if (historyService) { remoteHistory("paste", id, plain); return; }
     if (installingUpdate) return;
     if (!history || busy.exchange(true))
         return;
@@ -1522,10 +1631,20 @@ void App::pasteEntry(std::wstring id, bool plain)
             } reset{busy};
             try
             {
-                for (int i = 0; i < 20 && !modifiersReleased(); ++i)
+                // Foreground activation crosses a process boundary when the
+                // history UI closes. Let the destination finish activation,
+                // while retaining the same input-version cancellation guard.
+                for (int i = 0; i < 20 && inputVersion == version &&
+                     (!modifiersReleased() || GetForegroundWindow() != target); ++i)
                     Sleep(10);
                 if (!modifiersReleased() || GetForegroundWindow() != target || inputVersion != version)
+                {
+                    log(L"History paste cancelled before transaction: foreground=" +
+                        std::to_wstring(GetForegroundWindow() == target) + L" modifiers=" +
+                        std::to_wstring(modifiersReleased()) + L" expectedVersion=" + std::to_wstring(version) +
+                        L" actualVersion=" + std::to_wstring(inputVersion.load()));
                     return;
+                }
                 auto clip = history->load(id);
                 if (plain)
                 {
@@ -1535,7 +1654,7 @@ void App::pasteEntry(std::wstring id, bool plain)
                     clip = textClip(text);
                 }
                 Transaction tx(*this, target, version);
-                tx.paste(clip);
+                log(tx.paste(clip) ? L"History paste: simulated paste completed" : L"History paste cancelled before simulated paste");
             }
             catch (const std::exception &e)
             {
@@ -1566,7 +1685,19 @@ void App::captureHistory()
                 for (auto &name : config.excluded)
                     if (lower(name) == lower(app))
                         return;
-                auto clip = readClipboard(window, (size_t)config.maxImageMiB * 1024 * 1024);
+                if (IsClipboardFormatAvailable(CF_DIB) || IsClipboardFormatAvailable(CF_DIBV5) ||
+                    IsClipboardFormatAvailable(CF_BITMAP) ||
+                    IsClipboardFormatAvailable(RegisterClipboardFormatW(L"PNG")))
+                {
+                    if (history->captureImage(sequence, app, config))
+                    {
+                        scheduleHistoryOcr(config);
+                        PostMessageW(window, HistoryMessage, 0, 0);
+                    }
+                    return;
+                }
+                auto clip = readClipboard(window, (size_t)config.maxImageMiB * 1024 * 1024,
+                                          ClipboardRead::WithoutImages, sequence);
                 if (sequence != GetClipboardSequenceNumber())
                     return;
                 for (auto &f : clip.formats)
@@ -1585,6 +1716,7 @@ void App::captureHistory()
 }
 void App::recognizeEntry(std::wstring id)
 {
+    if (historyService) { remoteHistory("ocr", id); return; }
     if (!history || busy.exchange(true))
         return;
     auto sequence = GetClipboardSequenceNumber();
@@ -1603,7 +1735,9 @@ void App::recognizeEntry(std::wstring id)
             try
             {
                 auto cached = history->ocrText(id, ocrProfile(config));
-                auto text = cached ? *cached : recognizeText(history->load(id), config);
+                auto text = cached ? *cached : history->recognizeImage(id, config, [this] {
+                    std::lock_guard lock(jobsMutex); return stop;
+                });
                 if (!cached) history->saveOcr(id, text, config);
                 if (text.empty())
                 {
@@ -1753,7 +1887,37 @@ LRESULT CALLBACK App::windowProc(HWND hwnd, UINT msg, WPARAM wp, LPARAM lp)
     auto *app = current;
     if (!app)
         return DefWindowProcW(hwnd, msg, wp, lp);
-    if (msg == app->taskbarCreated && app->taskbarCreated)
+    if (app->historyService) {
+        if (msg == HistoryHostShow || msg == HistoryHostRefresh) {
+            try {
+                app->history->reload();
+                if (msg == HistoryHostShow) showHistory(*app);
+                else if (IsWindowVisible(app->historyWindow)) refreshHistory(*app);
+            } catch (const std::exception &e) { app->report(wide(e.what())); }
+            return 0;
+        }
+        if (msg == WM_TIMER) {
+            if (!IsWindow(app->historyService)) PostMessageW(hwnd, WM_CLOSE, 0, 0);
+            return 0;
+        }
+        if (msg == WM_CLOSE) {
+            EnumThreadWindows(GetCurrentThreadId(), [](HWND child, LPARAM) -> BOOL {
+                wchar_t name[64]{}; GetClassNameW(child, name, 64);
+                if (std::wstring(name) == L"KSwitcher.Entry" || std::wstring(name) == L"KSwitcher.History")
+                    DestroyWindow(child);
+                return TRUE;
+            }, 0);
+            DestroyWindow(hwnd);
+            return 0;
+        }
+        if (msg == WM_DESTROY) { PostQuitMessage(0); return 0; }
+        if (msg == ErrorMessage) {
+            std::unique_ptr<std::wstring> text(reinterpret_cast<std::wstring *>(lp));
+            MessageBoxW(app->historyWindow, text->c_str(), L"Clipboard history", MB_OK | MB_ICONWARNING);
+            return 0;
+        }
+    }
+    if (!app->historyService && msg == app->taskbarCreated && app->taskbarCreated)
     {
         app->addTray();
         return 0;
@@ -1817,7 +1981,9 @@ LRESULT CALLBACK App::windowProc(HWND hwnd, UINT msg, WPARAM wp, LPARAM lp)
         app->replayTyping();
         return 0;
     case TrayMessage:
-        if (LOWORD(lp) == WM_CONTEXTMENU)
+        if (LOWORD(lp) == NIN_BALLOONUSERCLICK)
+            showLogs(*app);
+        else if (LOWORD(lp) == WM_CONTEXTMENU)
             app->trayMenu();
         else if (LOWORD(lp) == WM_LBUTTONDBLCLK)
             // The shell still owns the mouse gesture on the second button-down.
@@ -1867,6 +2033,7 @@ LRESULT CALLBACK App::windowProc(HWND hwnd, UINT msg, WPARAM wp, LPARAM lp)
     case WM_COPYDATA:
     {
         auto *data = (COPYDATASTRUCT *)lp;
+        if (data && data->dwData == HistoryRequest) return app->historyRequest((HWND)wp, *data);
         if (data && data->dwData >= ConfigRead && data->dwData < ConfigEnd)
         {
             if (app->installingUpdate) return FALSE;
@@ -1883,6 +2050,15 @@ LRESULT CALLBACK App::windowProc(HWND hwnd, UINT msg, WPARAM wp, LPARAM lp)
     case WM_TIMER:
         if (wp == 6)
         {
+            if (app->notificationRegistration && WaitForSingleObject(app->notificationRegistration, 0) == WAIT_OBJECT_0)
+            {
+                DWORD code = ERROR_GEN_FAILURE;
+                GetExitCodeProcess(app->notificationRegistration, &code);
+                if (code) log(L"Screenshot notification registration helper failed: " + std::to_wstring(code));
+                CloseHandle(app->notificationRegistration);
+                app->notificationRegistration = nullptr;
+            }
+            app->releaseIdleMemory(GetTickCount64());
             app->pollSync();
             return 0;
         }
@@ -1944,7 +2120,7 @@ int App::execute()
     WNDCLASSW cls{};
     cls.hInstance = instance;
     cls.lpfnWndProc = windowProc;
-    cls.lpszClassName = L"KSwitcher.Main";
+    cls.lpszClassName = historyService ? HistoryHostClass : L"KSwitcher.Main";
     cls.hIcon = LoadIconW(instance, MAKEINTRESOURCEW(IDI_KSWITCHER));
     RegisterClassW(&cls);
     window = CreateWindowExW(WS_EX_TOOLWINDOW, cls.lpszClassName, L"KSwitcher", WS_POPUP, 0, 0, 0, 0, nullptr,
@@ -1978,6 +2154,30 @@ int App::execute()
             }
             CoUninitialize();
         });
+    if (historyService) {
+        try {
+            auto bytes = unprotect(readFile(data / L"history-view.bin", 4 * 1024 * 1024));
+            auto state = HistoryJson::parse(bytes);
+            historySelection = wide(state.value("selection", std::string{}));
+            historyTop = wide(state.value("top", std::string{}));
+            historyQuery = wide(state.value("query", std::string{}));
+            historyPinnedOnly = state.value("pinnedOnly", false);
+        } catch (...) {}
+        showHistory(*this);
+        remoteHistory("ready", std::to_wstring(reinterpret_cast<uintptr_t>(historyWindow)));
+        SetTimer(window, 1, 1000, nullptr);
+        MSG message{};
+        while (GetMessageW(&message, nullptr, 0, 0) > 0) {
+            if (message.message == WM_KEYDOWN && message.wParam == VK_ESCAPE && historyWindow &&
+                (message.hwnd == historyWindow || IsChild(historyWindow, message.hwnd))) {
+                SendMessageW(historyWindow, WM_CLOSE, 0, 0);
+                continue;
+            }
+            if (historyWindow && message.message == WM_SYSCHAR && IsDialogMessageW(historyWindow, &message)) continue;
+            TranslateMessage(&message); DispatchMessageW(&message);
+        }
+        return int(message.wParam);
+    }
     keyboardHook = SetWindowsHookExW(WH_KEYBOARD_LL, keyProc, instance, 0);
     mouseHook = SetWindowsHookExW(WH_MOUSE_LL, mouseProc, instance, 0);
     registerHotkeys(settings);
@@ -2001,7 +2201,7 @@ int App::execute()
         log(std::wstring(L"Update completed; running version ") + AppVersion);
     if (startCommand)
         PostMessageW(window, WM_HOTKEY, startCommand, 0);
-    try { registerScreenshotNotifications(); }
+    try { notificationRegistration = startScreenshotNotificationRegistration(); }
     catch(const std::exception &e) { log(L"Screenshot notification registration: "+wide(e.what())); }
     auto screenshotActivation=startScreenshotActivationListener();
     MSG msg;
@@ -2014,7 +2214,7 @@ int App::execute()
                 continue;
         }
         // Preserve history-specific Enter/Shift+Enter and Ctrl+digit handling.
-        if (historyWindow && msg.message == WM_SYSCHAR && IsDialogMessageW(historyWindow, &msg))
+        if (!isolateHistory && historyWindow && msg.message == WM_SYSCHAR && IsDialogMessageW(historyWindow, &msg))
             continue;
         if (settingsWindow && IsDialogMessageW(settingsWindow, &msg))
             continue;

src/app.h

@@ -33,6 +33,11 @@ class App
 {
   public:
     HWND window{}, historyWindow{}, settingsWindow{}, snippetsWindow{};
+    HWND historyService{}; // Non-null only in the short-lived history UI process.
+    bool isolateHistory{};
+    unsigned historyEntryWindows{};
+    std::wstring historySelection, historyTop, historyQuery;
+    bool historyPinnedOnly{};
     HINSTANCE instance{};
     std::filesystem::path data;
     std::vector<Layout> layouts;
@@ -55,7 +60,7 @@ class App
     bool smoke{};
     int startCommand{};
     std::wstring updateStartupEvent;
-    App(HINSTANCE, bool = false, const std::filesystem::path &dataRoot = {});
+    App(HINSTANCE, bool = false, const std::filesystem::path &dataRoot = {}, HWND historyService = nullptr);
     ~App();
     int execute();
     void dispatch(int);
@@ -72,6 +77,11 @@ class App
     void applySettings(const Settings &);
     void reloadLayouts();
     void clearHistory();
+    void openHistoryProcess();
+    void refreshHistoryProcess();
+    void remoteHistory(const char *action, const std::wstring &id = {}, bool plain = false);
+    LRESULT historyRequest(HWND, const COPYDATASTRUCT &);
+    void saveHistoryView(const std::wstring &, const std::wstring &, const std::wstring &, bool);
     void clearLog(bool previous);
     void setHotkeyCapture(HWND);
     bool isHotkey(DWORD, UINT);
@@ -86,11 +96,14 @@ class App
 
   private:
     friend struct InputRegressionAccess;
+    void releaseIdleMemory(ULONGLONG now);
     HHOOK keyboardHook{}, mouseHook{};
+    HANDLE historyProcess{};
     std::mutex jobsMutex;
     std::condition_variable jobsReady;
     std::deque<std::function<void()>> jobs;
     std::thread worker;
+    HANDLE notificationRegistration{};
     std::thread historySearchWorker;
     std::condition_variable historySearchReady;
     std::function<void()> pendingHistorySearch;
@@ -130,6 +143,7 @@ class App
     void replayTyping();
     static LRESULT CALLBACK windowProc(HWND, UINT, WPARAM, LPARAM);
     static LRESULT CALLBACK keyProc(int, WPARAM, LPARAM);
+    static LRESULT keyboardAfterHooks(int, WPARAM, LPARAM, LRESULT);
     static LRESULT CALLBACK mouseProc(int, WPARAM, LPARAM);
 };
 void showHistory(App &, bool visible = true);

src/app_history.inl

@@ -0,0 +1,100 @@
+// History UI has no clipboard listener or hooks. The resident remains the only writer.
+namespace {
+constexpr ULONG_PTR HistoryRequest = 0x4b530200;
+constexpr UINT HistoryHostShow = WM_APP + 71, HistoryHostRefresh = WM_APP + 72;
+constexpr wchar_t HistoryHostClass[] = L"KSwitcher.HistoryHost";
+using HistoryJson = nlohmann::json;
+HWND historyController(HANDLE process)
+{
+    if (!process || WaitForSingleObject(process, 0) == WAIT_OBJECT_0) return nullptr;
+    auto window = FindWindowW(HistoryHostClass, nullptr);
+    DWORD pid{}; GetWindowThreadProcessId(window, &pid);
+    return pid == GetProcessId(process) ? window : nullptr;
+}
+}
+void App::openHistoryProcess()
+{
+    auto foreground = GetForegroundWindow();
+    if (foreground != window && foreground != historyWindow) pasteTarget = foreground;
+    if (historyProcess && WaitForSingleObject(historyProcess, 0) == WAIT_OBJECT_0) {
+        CloseHandle(historyProcess); historyProcess = nullptr; historyWindow = nullptr;
+    }
+    if (historyProcess) {
+        if (auto host = historyController(historyProcess)) {
+            AllowSetForegroundWindow(GetProcessId(historyProcess));
+            PostMessageW(host, HistoryHostShow, 0, 0);
+        }
+        return;
+    }
+    auto path = executable();
+    auto command = L"\"" + path + L"\" --history-host=" + std::to_wstring(reinterpret_cast<uintptr_t>(window));
+    STARTUPINFOW startup{sizeof(startup)};
+    startup.dwFlags = STARTF_USESHOWWINDOW; startup.wShowWindow = SW_HIDE;
+    PROCESS_INFORMATION child{};
+    if (!CreateProcessW(path.c_str(), command.data(), nullptr, nullptr, FALSE, CREATE_NO_WINDOW,
+                        nullptr, std::filesystem::path(path).parent_path().c_str(), &startup, &child))
+        throw std::runtime_error("Cannot start clipboard history window");
+    CloseHandle(child.hThread);
+    historyProcess = child.hProcess;
+    AllowSetForegroundWindow(child.dwProcessId);
+}
+void App::refreshHistoryProcess()
+{
+    if (auto host = historyController(historyProcess)) PostMessageW(host, HistoryHostRefresh, 0, 0);
+}
+void App::remoteHistory(const char *action, const std::wstring &id, bool plain)
+{
+    if (!historyService || !configurationPeer(historyService, L"KSwitcher.exe"))
+        throw std::runtime_error("KSwitcher has stopped. Reopen clipboard history.");
+    auto text = HistoryJson{{"action", action}, {"id", utf8(id)}, {"plain", plain}}.dump();
+    if (std::string_view(action) == "paste") {
+        DWORD residentPid{}; GetWindowThreadProcessId(historyService, &residentPid);
+        AllowSetForegroundWindow(residentPid);
+    }
+    COPYDATASTRUCT message{HistoryRequest, DWORD(text.size()), text.data()};
+    DWORD_PTR result{};
+    if (!SendMessageTimeoutW(historyService, WM_COPYDATA, reinterpret_cast<WPARAM>(window),
+                             reinterpret_cast<LPARAM>(&message), SMTO_ABORTIFHUNG | SMTO_ERRORONEXIT,
+                             15000, &result) || result != 1)
+        throw std::runtime_error("KSwitcher could not complete the history request. Reopen history and retry.");
+}
+LRESULT App::historyRequest(HWND sender, const COPYDATASTRUCT &message)
+{
+    DWORD pid{}; GetWindowThreadProcessId(sender, &pid);
+    if (!historyProcess || pid != GetProcessId(historyProcess) ||
+        !configurationPeer(sender, L"KSwitcher.exe") || message.cbData > 4096 ||
+        !message.cbData || !message.lpData || installingUpdate) return FALSE;
+    try {
+        const auto *first = static_cast<const char *>(message.lpData);
+        auto job = HistoryJson::parse(first, first + message.cbData);
+        auto action = job.at("action").get<std::string>();
+        auto id = wide(job.at("id").get<std::string>());
+        if (id.size() > 128) return FALSE;
+        if (action == "ready") {
+            auto ui = reinterpret_cast<HWND>(uintptr_t(std::stoull(id)));
+            DWORD uiPid{}; GetWindowThreadProcessId(ui, &uiPid);
+            wchar_t name[64]{}; GetClassNameW(ui, name, 64);
+            if (uiPid != pid || std::wstring(name) != L"KSwitcher.History") return FALSE;
+            historyWindow = ui;
+        } else if (action == "paste") {
+            if (busy || !history) return FALSE;
+            pasteEntry(id, job.at("plain").get<bool>());
+        } else if (action == "ocr") {
+            if (busy || !history) return FALSE;
+            recognizeEntry(id);
+        } else if (action == "clear") clearHistory();
+        else if (action == "pin" || action == "remove") {
+            if (busy || !history) return FALSE;
+            if (action == "pin") history->pin(id); else history->remove(id);
+        } else return FALSE;
+        return TRUE;
+    } catch (...) { return FALSE; }
+}
+void App::saveHistoryView(const std::wstring &selection, const std::wstring &top, const std::wstring &query, bool pinnedOnly)
+{
+    if (!historyService) return;
+    try {
+        auto text = HistoryJson{{"selection", utf8(selection)}, {"top", utf8(top)}, {"query", utf8(query)}, {"pinnedOnly", pinnedOnly}}.dump();
+        atomicWrite(data / L"history-view.bin", protect(Bytes(text.begin(), text.end())));
+    } catch (...) {} // Closing the UI must still release its process if state cannot be saved.
+}

src/app_sync.inl

@@ -46,7 +46,7 @@ std::wstring App::syncCommand(int action, const std::vector<SyncChoice> &choices
             syncDone.store(true);
         });
     }
-    catch (...) { syncRunning = false; throw; }
+    catch (...) { syncRunning = false; Bytes().swap(syncSnapshot); syncResult = {}; throw; }
     return syncStatus;
 }
 void App::pollSync()
@@ -57,25 +57,28 @@ void App::pollSync()
         {
             if (busy) return;
             syncWorker.join();
+            // Own completed payloads locally so every return/exception releases them.
+            auto result = std::exchange(syncResult, SyncResult{});
+            auto snapshot = std::exchange(syncSnapshot, Bytes{});
             syncRunning = false;
             syncDone = false;
-            syncStatus = syncResult.status;
+            syncStatus = result.status;
-            if (syncResult.success)
+            if (result.success)
             {
-                if (loadSyncConfig(data) != syncConnection || encodeSettings(settings) != syncSnapshot)
+                if (loadSyncConfig(data) != syncConnection || encodeSettings(settings) != snapshot)
                 {
                     syncStatus = L"Local settings or connection changed during sync. Checking again shortly.";
                     nextSync = GetTickCount64() + 2000;
                     return;
                 }
-                auto next = restoreSyncSettings(syncResult.settings, settings, layouts, syncConnection.keepLocalLayouts);
+                auto next = restoreSyncSettings(result.settings, settings, layouts, syncConnection.keepLocalLayouts);
-                if (encodeSettings(next) != syncSnapshot)
+                if (encodeSettings(next) != snapshot)
                 {
-                    atomicWrite(data / L"settings-before-sync.bin", protect(syncSnapshot));
+                    atomicWrite(data / L"settings-before-sync.bin", protect(snapshot));
                     applySettings(next);
                 }
-                saveSyncBase(data, syncConnection, syncResult.base.empty() ? syncResult.settings : syncResult.base);
+                saveSyncBase(data, syncConnection, result.base.empty() ? result.settings : result.base);
-                pendingSyncConflicts = syncResult.conflicts;
+                pendingSyncConflicts = std::move(result.conflicts);
                 conflictConnection = syncConnection;
                 SYSTEMTIME time{}; GetLocalTime(&time);
                 wchar_t stamp[32]{};
@@ -84,8 +87,8 @@ void App::pollSync()
             }
             // Back off after errors (including bad credentials) instead of repeatedly
             // hitting userpass lockout. The explicit Sync button remains available.
-            syncRetryAfter = syncResult.success ? 0 : GetTickCount64() + 15 * 60000;
+            syncRetryAfter = result.success ? 0 : GetTickCount64() + 15 * 60000;
-            nextSync = syncResult.success ? GetTickCount64() + SyncIntervalMs : syncRetryAfter;
+            nextSync = result.success ? GetTickCount64() + SyncIntervalMs : syncRetryAfter;
         }
         if (!syncRunning && GetTickCount64() >= nextSync)
         {

src/autocorrect.cpp

@@ -42,82 +42,160 @@ bool safeAutoWord(const std::wstring &word, int minimumLength)
     auto small = lower(word);
     return word == small || (word.substr(1) == small.substr(1) && word != upper(word));
 }
-std::string_view AutoCorrector::Dictionary::word(size_t index) const
+namespace {
+constexpr size_t DictionaryBlockWords = 32;
+}
+std::string_view AutoCorrector::Dictionary::word(size_t block) const
 {
-    auto start = offsets[index];
+    size_t start = offsets[block];
-    auto end = bytes.find('\t', start);
+    // Every block starts with a complete word (zero shared prefix).
-    return std::string_view(bytes).substr(start, end - start);
+    size_t length = static_cast<unsigned char>(bytes[start++]) & 15;
+    if (length == 15) length = static_cast<unsigned char>(bytes[start++]);
+    return std::string_view(bytes).substr(start, length);
 }
 AutoCorrector::Dictionary::Dictionary(const std::filesystem::path &path)
 {
-    auto raw = readFile(path, 2 * 1024 * 1024);
+    const auto raw = readFile(path, 2 * 1024 * 1024);
-    bytes.assign(raw.begin(), raw.end());
+    const std::string_view source(reinterpret_cast<const char *>(raw.data()), raw.size());
-    for (size_t start = 0; start < bytes.size();)
+    std::vector<uint32_t> lines;
+    lines.reserve(std::count(source.begin(), source.end(), '\n') + 1);
+    for (size_t start = 0; start < source.size();)
     {
-        auto end = bytes.find('\n', start);
+        auto end = source.find('\n', start);
-        if (end == bytes.npos)
+        if (end == source.npos) end = source.size();
-            end = bytes.size();
+        auto tab = source.find('\t', start);
-        auto tab = bytes.find('\t', start);
+        if (tab == source.npos || tab >= end || tab == start || tab - start > 160)
-        if (tab == bytes.npos || tab >= end || tab == start || tab - start > 160)
             throw std::runtime_error("Invalid auto-correction dictionary");
         int rank{};
-        auto rankEnd = end > tab + 1 && bytes[end - 1] == '\r' ? end - 1 : end;
+        auto rankEnd = end > tab + 1 && source[end - 1] == '\r' ? end - 1 : end;
-        auto parse = std::from_chars(bytes.data() + tab + 1, bytes.data() + rankEnd, rank);
+        auto parse = std::from_chars(source.data() + tab + 1, source.data() + rankEnd, rank);
-        if (parse.ec != std::errc() || parse.ptr != bytes.data() + rankEnd || rank <= 0)
+        if (parse.ec != std::errc() || parse.ptr != source.data() + rankEnd || rank <= 0)
             throw std::runtime_error("Invalid dictionary rank");
-        offsets.push_back((uint32_t)start);
+        lines.push_back(static_cast<uint32_t>(start));
         start = end + 1;
     }
-    if (offsets.empty())
+    if (lines.empty()) throw std::runtime_error("Empty auto-correction dictionary");
-        throw std::runtime_error("Empty auto-correction dictionary");
+    auto entry = [&](uint32_t offset) { return source.substr(offset, source.find('\t', offset) - offset); };
-    auto entry = [&](uint32_t offset) { return std::string_view(bytes).substr(offset, bytes.find('\t', offset) - offset); };
+    auto frequency = [&](uint32_t offset) {
-    auto frequency = [&](uint32_t offset)
-    {
         int rank{};
         auto start = offset + entry(offset).size() + 1;
-        std::from_chars(bytes.data() + start, bytes.data() + bytes.size(), rank);
+        std::from_chars(source.data() + start, source.data() + source.size(), rank);
         return rank;
     };
-    std::sort(offsets.begin(), offsets.end(), [&](uint32_t a, uint32_t b)
+    std::sort(lines.begin(), lines.end(), [&](uint32_t a, uint32_t b) {
-              { return entry(a) == entry(b) ? frequency(a) < frequency(b) : entry(a) < entry(b); });
+        return entry(a) == entry(b) ? frequency(a) < frequency(b) : entry(a) < entry(b);
-    offsets.erase(std::unique(offsets.begin(), offsets.end(), [&](uint32_t a, uint32_t b)
+    });
-                              { return entry(a) == entry(b); }), offsets.end());
+    lines.erase(std::unique(lines.begin(), lines.end(), [&](uint32_t a, uint32_t b) {
-    offsets.shrink_to_fit();
+        return entry(a) == entry(b);
-    bytes.shrink_to_fit();
+    }), lines.end());
+    offsets.reserve((lines.size() + DictionaryBlockWords - 1) / DictionaryBlockWords);
+    std::string_view previous;
+    // Allocate the packed payload exactly once. Geometric growth and a final
+    // shrink otherwise leave discarded buffers in the resident process heap.
+    size_t packedSize = 0;
+    for (size_t i = 0; i < lines.size(); ++i)
+    {
+        auto current = entry(lines[i]);
+        size_t prefix = 0;
+        if (i % DictionaryBlockWords != 0)
+            while (prefix < std::min(previous.size(), current.size()) && previous[prefix] == current[prefix]) ++prefix;
+        auto suffix = current.size() - prefix;
+        packedSize += 1 + (prefix >= 15) + (suffix >= 15) + suffix + 2;
+        auto rank = static_cast<uint32_t>(frequency(lines[i]));
+        if (rank >= 65535)
+            do { ++packedSize; rank >>= 7; } while (rank);
+        previous = current;
+    }
+    bytes.reserve(packedSize);
+    previous = {};
+    for (size_t i = 0; i < lines.size(); ++i)
+    {
+        auto current = entry(lines[i]);
+        size_t prefix = 0;
+        if (i % DictionaryBlockWords == 0)
+            offsets.push_back(static_cast<uint32_t>(bytes.size()));
+        else
+            while (prefix < std::min(previous.size(), current.size()) && previous[prefix] == current[prefix]) ++prefix;
+        size_t suffix = current.size() - prefix;
+        bytes.push_back(static_cast<char>((std::min(prefix, size_t(15)) << 4) | std::min(suffix, size_t(15))));
+        if (prefix >= 15) bytes.push_back(static_cast<char>(prefix));
+        if (suffix >= 15) bytes.push_back(static_cast<char>(suffix));
+        bytes.append(current.substr(prefix));
+        auto rank = static_cast<uint32_t>(frequency(lines[i]));
+        auto shortRank = std::min(rank, uint32_t(65535));
+        bytes.push_back(static_cast<char>(shortRank & 255));
+        bytes.push_back(static_cast<char>(shortRank >> 8));
+        if (rank >= 65535)
+            do {
+                auto next = rank & 127;
+                rank >>= 7;
+                bytes.push_back(static_cast<char>(next | (rank ? 128 : 0)));
+            } while (rank);
+        previous = current;
+    }
 }
 int AutoCorrector::Dictionary::rank(const std::wstring &text) const
 {
     auto key = utf8(lower(text));
     size_t begin = 0, end = offsets.size();
+    // Find the last block whose first word is <= the search key.
     while (begin < end)
     {
         auto mid = begin + (end - begin) / 2;
-        if (word(mid) < key)
+        if (word(mid) <= key) begin = mid + 1;
-            begin = mid + 1;
+        else end = mid;
-        else
+    }
-            end = mid;
+    if (!begin) return 0;
+    size_t block = begin - 1;
+    size_t at = offsets[block];
+    const size_t limit = begin < offsets.size() ? offsets[begin] : bytes.size();
+    char decoded[160]; // The loader validates lengths; lookup never allocates a decoded word.
+    while (at < limit)
+    {
+        auto lengths = static_cast<unsigned char>(bytes[at++]);
+        size_t prefix = lengths >> 4, suffix = lengths & 15;
+        if (prefix == 15) prefix = static_cast<unsigned char>(bytes[at++]);
+        if (suffix == 15) suffix = static_cast<unsigned char>(bytes[at++]);
+        memcpy(decoded + prefix, bytes.data() + at, suffix);
+        at += suffix;
+        uint32_t rank = static_cast<unsigned char>(bytes[at]) |
+                        (uint32_t(static_cast<unsigned char>(bytes[at + 1])) << 8);
+        at += 2;
+        if (rank == 65535) {
+            rank = 0;
+            uint32_t shift = 0;
+            unsigned char part;
+            do {
+                part = static_cast<unsigned char>(bytes[at++]);
+                rank |= uint32_t(part & 127) << shift;
+                shift += 7;
+            } while (part & 128);
+        }
+        auto compared = std::string_view(decoded, size_t(prefix) + suffix).compare(key);
+        if (compared == 0) return static_cast<int>(rank);
+        if (compared > 0) return 0;
     }
-    if (begin == offsets.size() || word(begin) != key)
     return 0;
-    auto start = offsets[begin] + word(begin).size() + 1;
-    int rank{};
-    std::from_chars(bytes.data() + start, bytes.data() + bytes.size(), rank);
-    return rank;
 }
 void AutoCorrector::configure(const std::filesystem::path &folder, const std::vector<std::wstring> &wanted)
 {
     if (languages == wanted)
         return;
-    std::map<std::wstring, Dictionary> next;
+    std::map<std::wstring, std::shared_ptr<const Dictionary>> next;
     for (auto &lang : wanted)
     {
         if (lang != L"en" && lang != L"uk" && lang != L"ru")
             throw std::runtime_error("Unsupported dictionary language");
-        next.emplace(lang, Dictionary(folder / (lang + L".txt")));
+        next.emplace(lang, std::make_shared<const Dictionary>(folder / (lang + L".txt")));
     }
     dictionaries = std::move(next);
     languages = wanted;
 }
+void AutoCorrector::shareDictionaries(const AutoCorrector &source)
+{
+    dictionaries = source.dictionaries;
+    languages = source.languages;
+}
 void AutoCorrector::reject(std::wstring word, const Settings &settings)
 {
     while (!word.empty() && openingDelimiter(word.front(), settings))
@@ -132,7 +210,7 @@ size_t AutoCorrector::memoryBytes() const
 {
     size_t bytes = 0;
     for (auto &[language, d] : dictionaries)
-        bytes += d.bytes.capacity() + d.offsets.capacity() * sizeof(uint32_t);
+        bytes += d->bytes.capacity() + d->offsets.capacity() * sizeof(uint32_t);
     return bytes;
 }
 std::optional<AutoSuggestion> AutoCorrector::suggest(const std::wstring &typed, int source,
@@ -191,7 +269,7 @@ std::optional<AutoSuggestion> AutoCorrector::suggest(const std::wstring &typed,
     };
     // Valid words from either selected language are never changed.
     for (auto &[language, d] : dictionaries)
-        if (d.rank(word) || personal(language, word))
+        if (d->rank(word) || personal(language, word))
             return {};
     std::optional<AutoSuggestion> candidate;
     std::optional<std::wstring> matchedText;
@@ -211,7 +289,7 @@ std::optional<AutoSuggestion> AutoCorrector::suggest(const std::wstring &typed,
         auto converted = convert(word, layouts[source], layouts[i], true);
         if (converted == word || !safeAutoWord(converted, settings.autoMinLength))
             continue;
-        int rank = personal(dictionary->first, converted) ? 1 : dictionary->second.rank(converted);
+        int rank = personal(dictionary->first, converted) ? 1 : dictionary->second->rank(converted);
         if (!rank)
             continue;
         if (matchedText && *matchedText != converted)
@@ -233,7 +311,7 @@ std::optional<AutoSuggestion> AutoCorrector::suggest(const std::wstring &typed,
     auto consider = [&](const std::wstring &text)
     {
         if (text == small || text == found || text.size() < 4 || text.size() > 32) return true;
-        int rank = personalTargets.contains(text) ? 1 : dictionaries.at(sourceLanguage).rank(text);
+        int rank = personalTargets.contains(text) ? 1 : dictionaries.at(sourceLanguage)->rank(text);
         if (!rank) return true;
         if (!found.empty()) return false;
         found = text;

src/autocorrect.h

@@ -1,6 +1,7 @@
 #pragma once
 #include "platform.h"
 #include <map>
+#include <memory>
 #include <set>
 #include <string_view>
 namespace ks
@@ -18,23 +19,30 @@ int matchAutoInput(const Run &, const std::wstring &, const std::vector<Layout>
 bool autoCorrectionAllowed(HWND, const Settings &);
 class AutoCorrector
 {
+    friend struct AutoCorrectorRegressionAccess;
     struct Dictionary
     {
+        // Front-coded UTF-8 words in independently searchable blocks of 32.
+        // Prefix/suffix lengths share a byte (15 escapes to a full byte length).
+        // Ranks use two bytes; 65535 escapes to a varint for larger custom ranks.
         std::string bytes;
         std::vector<uint32_t> offsets;
         std::string_view word(size_t) const;
         explicit Dictionary(const std::filesystem::path &);
         int rank(const std::wstring &) const;
     };
-    std::map<std::wstring, Dictionary> dictionaries;
+    std::map<std::wstring, std::shared_ptr<const Dictionary>> dictionaries;
     std::vector<std::wstring> languages;
     std::set<std::wstring> rejected;
 
   public:
     void configure(const std::filesystem::path &, const std::vector<std::wstring> &);
+    // Share immutable dictionary storage, keeping each consumer's undo rejections private.
+    void shareDictionaries(const AutoCorrector &);
     std::optional<AutoSuggestion> suggest(const std::wstring &, int source, const std::vector<Layout> &,
                                           const Settings &) const;
     void reject(std::wstring word, const Settings & = {});
+    // Referenced dictionary payload, including shared storage (do not sum across consumers).
     size_t memoryBytes() const;
 };
 } // namespace ks

src/config_main.cpp

@@ -79,7 +79,7 @@ LRESULT CALLBACK controller(HWND window, UINT message, WPARAM wp, LPARAM lp)
 }
 // The configurator owns no history store, dictionaries, worker or input hooks.
 // All mutations are validated and committed by the resident process.
-App::App(HINSTANCE h, bool, const std::filesystem::path &) : instance(h)
+App::App(HINSTANCE h, bool, const std::filesystem::path &, HWND) : instance(h)
 {
     current = this;
     data = dataDirectory();

src/history_preview.h

@@ -4,14 +4,28 @@
 #include <string>
 
 namespace ks {
+inline constexpr size_t HistoryThumbnailBudget = 1024 * 1024;
+inline constexpr size_t HistoryRichTextBudget = 256 * 1024;
 // Keep the visible working set even in unusually tall windows. Never evict a
 // visible preview to admit another visible preview: that creates a paint loop.
+template<class T, class Weight>
+void trimHistoryPreviews(std::map<std::wstring,T> &cache,
+                         const std::set<std::wstring> &visible, size_t limit,
+                         size_t byteLimit, Weight weight)
+{
+    size_t bytes = 0;
+    for (const auto &[id, value] : cache) bytes += weight(value);
+    for(auto it=cache.begin(); (cache.size()>limit || bytes>byteLimit) && it!=cache.end();)
+        if(!visible.contains(it->first)) {
+            bytes -= weight(it->second);
+            it=cache.erase(it);
+        }
+        else ++it;
+}
 template<class T>
 void trimHistoryPreviews(std::map<std::wstring,T> &cache,
                          const std::set<std::wstring> &visible, size_t limit=32)
 {
-    for(auto it=cache.begin(); cache.size()>limit && it!=cache.end();)
+    trimHistoryPreviews(cache, visible, limit, 0, [](const T &) { return size_t{}; });
-        if(!visible.contains(it->first)) it=cache.erase(it);
-        else ++it;
 }
 }

src/main.cpp

@@ -1,12 +1,27 @@
 #include "app.h"
 #include <shellapi.h>
 #include <shlobj.h>
+#include "configuration.h"
 int WINAPI wWinMain(HINSTANCE instance, HINSTANCE, PWSTR, int)
 {
     CoInitializeEx(nullptr, COINIT_APARTMENTTHREADED);
     int argc{};
     auto argv = CommandLineToArgvW(GetCommandLineW(), &argc);
     std::wstring arg = argc > 1 ? argv[1] : L"";
+    if (argc == 2 && arg.starts_with(L"--history-host=")) {
+        LocalFree(argv);
+        int result = 1;
+        try {
+            auto service = reinterpret_cast<HWND>(uintptr_t(std::stoull(arg.substr(15))));
+            wchar_t name[64]{}; GetClassNameW(service, name, 64);
+            if (std::wstring(name) != L"KSwitcher.Main" || !ks::configurationPeer(service, L"KSwitcher.exe"))
+                throw std::runtime_error("Invalid history service");
+            ks::App app(instance, true, {}, service);
+            result = app.execute();
+        } catch (...) {}
+        CoUninitialize();
+        return result;
+    }
     if (arg.starts_with(L"--configure-autostart="))
     {
         int result = 1;
@@ -72,6 +87,7 @@ int WINAPI wWinMain(HINSTANCE instance, HINSTANCE, PWSTR, int)
     try
     {
         ks::App app(instance, arg == L"--smoke-test");
+        app.isolateHistory = !app.smoke;
         if (arg.starts_with(L"--update-ready-event="))
             app.updateStartupEvent = arg.substr(std::wstring(L"--update-ready-event=").size());
         else if (!arg.empty() && arg != L"--smoke-test")

src/ocr.cpp

@@ -123,13 +123,16 @@ struct OcrStatics : IInspectable
 Pixels decodeImage(const Clip &clip, UINT maxWidth, UINT maxHeight)
 {
     Bytes encoded;
+    const Bytes *input = &encoded;
     for (const auto &f : clip.formats)
         if (f.name == L"PNG")
         {
-            encoded = f.data;
+            input = &f.data;
             break;
         }
-    if (encoded.empty())
+    if (input->empty())
+    {
+        input = &encoded;
         for (const auto &f : clip.formats)
             if ((f.id == CF_DIB || f.id == CF_DIBV5) && f.data.size() >= 40)
             {
@@ -146,19 +149,21 @@ Pixels decodeImage(const Clip &clip, UINT maxWidth, UINT maxHeight)
                 file.bfType = 0x4d42;
                 file.bfSize = (DWORD)(sizeof(file) + f.data.size());
                 file.bfOffBits = (DWORD)offset;
-                encoded.resize(sizeof(file));
+                encoded.resize(sizeof(file) + f.data.size());
                 memcpy(encoded.data(), &file, sizeof(file));
-                encoded.insert(encoded.end(), f.data.begin(), f.data.end());
+                memcpy(encoded.data() + sizeof(file), f.data.data(), f.data.size());
                 break;
             }
-    if (encoded.empty())
+    }
+    if (input->empty())
         throw std::runtime_error("This clipboard item has no supported image");
     Com<IWICImagingFactory> wic;
     check(CoCreateInstance(CLSID_WICImagingFactory, nullptr, CLSCTX_INPROC_SERVER, IID_IWICImagingFactory,
                            (void **)wic.out()));
     Com<IWICStream> stream;
     check(wic->CreateStream(stream.out()));
-    check(stream->InitializeFromMemory(encoded.data(), (DWORD)encoded.size()));
+    // WIC decoding only reads the stream. The clip outlives every WIC object here.
+    check(stream->InitializeFromMemory(const_cast<BYTE *>(input->data()), (DWORD)input->size()));
     Com<IWICBitmapDecoder> decoder;
     check(wic->CreateDecoderFromStream(stream.p, nullptr, WICDecodeMetadataCacheOnLoad, decoder.out()));
     Com<IWICBitmapFrameDecode> frame;

src/platform.cpp

@@ -265,15 +265,27 @@ std::wstring processName(HWND window)
     CloseHandle(h);
     return ok ? std::filesystem::path(std::wstring(path, n)).stem().wstring() : L"";
 }
-Clip readClipboard(HWND window, size_t limit)
+Clip readClipboard(HWND window, size_t limit, ClipboardRead mode, std::optional<DWORD> expected)
 {
     ClipboardLock lock(window);
+    if (expected && *expected != GetClipboardSequenceNumber())
+        throw std::runtime_error("Clipboard changed while taking snapshot");
+    if (mode == ClipboardRead::WithoutImages &&
+        (IsClipboardFormatAvailable(CF_DIB) || IsClipboardFormatAvailable(CF_DIBV5) ||
+         IsClipboardFormatAvailable(CF_BITMAP) || IsClipboardFormatAvailable(RegisterClipboardFormatW(L"PNG"))))
+        throw std::runtime_error("Clipboard changed to an image");
     Clip c;
     size_t total = 0;
     for (UINT f = EnumClipboardFormats(0); f; f = EnumClipboardFormats(f))
     {
         if (!globalFormat(f))
             continue;
+        wchar_t name[256]{};
+        if (f >= 0xc000) GetClipboardFormatNameW(f, name, 256);
+        if (mode == ClipboardRead::Selection && f != CF_UNICODETEXT &&
+            std::wstring_view(name) != L"VisualStudioEditorOperationsLineCutCopyClipboardTag" &&
+            std::wstring_view(name) != L"MSDEVLineSelect" && std::wstring_view(name) != L"vscode-editor-data")
+            continue;
         HANDLE handle = GetClipboardData(f);
         if (!handle)
             continue;
@@ -291,8 +303,6 @@ Clip readClipboard(HWND window, size_t limit)
         GlobalUnlock(handle);
         if (f >= 0xc000)
         {
-            wchar_t name[256]{};
-            GetClipboardFormatNameW(f, name, 256);
             format.name = name;
         }
         total += size;
@@ -300,7 +310,8 @@ Clip readClipboard(HWND window, size_t limit)
     }
     return c;
 }
-DWORD writeClipboard(HWND window, const Clip &c)
+DWORD writeClipboard(HWND window, const Clip &c) { return writeClipboardGuarded(window, c, {}); }
+DWORD writeClipboardGuarded(HWND window, const Clip &c, std::optional<DWORD> expected)
 {
     // Allocate all blocks before replacing any existing data.
     std::vector<std::pair<UINT, HGLOBAL>> blocks;
@@ -327,6 +338,8 @@ DWORD writeClipboard(HWND window, const Clip &c)
             blocks.emplace_back(id, h);
         }
         ClipboardLock lock(window);
+        if (expected && *expected != GetClipboardSequenceNumber())
+            throw std::runtime_error("Clipboard changed before restoring snapshot");
         if (!EmptyClipboard())
             throw std::runtime_error("Cannot replace clipboard");
         for (auto &[id, h] : blocks)
@@ -604,10 +617,25 @@ std::recursive_mutex logGate;
 bool loggingEnabled = false;
 DiagnosticBuffer diagnosticBuffer;
 }
+size_t DiagnosticBuffer::expire(ULONGLONG now)
+{
+    size_t removed = 0;
+    while (!entries.empty() && now - entries.front().first > 30000)
+    {
+        entries.pop_front();
+        ++removed;
+    }
+    return removed;
+}
+void expireDiagnostics(ULONGLONG now)
+{
+    std::lock_guard lock(logGate);
+    diagnosticBuffer.expire(now);
+}
 std::wstring DiagnosticBuffer::record(const std::wstring &message, bool problem, ULONGLONG now)
 {
-    while (!entries.empty() && (entries.size() >= 128 || now - entries.front().first > 30000))
+    expire(now);
-        entries.pop_front();
+    while (entries.size() >= 128) entries.pop_front();
     entries.emplace_back(now, message);
     if (!problem)
         return {};

src/platform.h

@@ -43,8 +43,11 @@ bool ownsClipboard(HWND);
 bool webViewDescendant(DWORD owner, DWORD host,
                        const std::function<std::optional<std::pair<DWORD, std::wstring>>(DWORD)> &read);
 std::wstring processName(HWND);
-Clip readClipboard(HWND, size_t limit = 32 * 1024 * 1024);
+enum class ClipboardRead { All, Selection, WithoutImages };
+Clip readClipboard(HWND, size_t limit = 32 * 1024 * 1024,
+                   ClipboardRead = ClipboardRead::All, std::optional<DWORD> expected = {});
 DWORD writeClipboard(HWND, const Clip &);
+DWORD writeClipboardGuarded(HWND, const Clip &, std::optional<DWORD> expected);
 Clip textClip(const std::wstring &);
 bool chord(WORD key, UINT modifiers = 0);
 // Process-local marker, shared by every KSwitcher input producer (not an authentication token).
@@ -72,10 +75,12 @@ class DiagnosticBuffer
 {
     std::deque<std::pair<ULONGLONG, std::wstring>> entries;
   public:
+    size_t expire(ULONGLONG now);
     std::wstring record(const std::wstring &message, bool problem, ULONGLONG now);
     void clear() { entries.clear(); }
 };
 void setLoggingEnabled(bool enabled);
+void expireDiagnostics(ULONGLONG now);
 void diagnosticEvent(const std::wstring &message, bool problem = false);
 void diagnosticOperation(const std::string &json);
 std::wstring readDiagnosticLog(bool previous);

src/richtext.cpp

@@ -252,7 +252,7 @@ DWORD CALLBACK readStream(DWORD_PTR cookie, LPBYTE buffer, LONG size, LONG *read
     return 0;
 }
 } // namespace
-std::string richPreview(const Clip &clip)
+std::string richPreview(const Clip &clip, bool plainFallback)
 {
     for (const auto &f : clip.formats)
         if (f.name == L"Rich Text Format" && f.data.size() <= 65536)
@@ -276,6 +276,7 @@ std::string richPreview(const Clip &clip)
             {
             }
         }
+    if (!plainFallback) return {};
     auto text = clip.text();
     if (text.size() > 4096)
         text.resize(4096);

src/richtext.h

@@ -2,7 +2,7 @@
 #include "platform.h"
 namespace ks
 {
-std::string richPreview(const Clip &);
+std::string richPreview(const Clip &, bool plainFallback = true);
 HWND createRichText(HWND parent, int id, bool visible);
 bool setRichText(HWND, const std::string &);
 } // namespace ks

src/screenshot_activation.cpp

@@ -50,6 +50,30 @@ void registerScreenshotNotifications()
     // Notify the shell that notification identity/activation registration changed.
     SHChangeNotify(SHCNE_ASSOCCHANGED,SHCNF_IDLIST,nullptr,nullptr);
 }
+HANDLE startScreenshotNotificationRegistration()
+{
+    auto path=std::filesystem::path(executable()).parent_path()/L"KSwitcher.Screenshot.exe";
+    auto command=L"\""+path.wstring()+L"\" --register-notifications";
+    STARTUPINFOW startup{sizeof(startup)};
+    startup.dwFlags=STARTF_USESHOWWINDOW; startup.wShowWindow=SW_HIDE;
+    PROCESS_INFORMATION process{};
+    if(!CreateProcessW(path.c_str(),command.data(),nullptr,nullptr,FALSE,CREATE_NO_WINDOW,
+                       nullptr,path.parent_path().c_str(),&startup,&process))
+        throw std::runtime_error(utf8(lastError(L"Cannot start notification registration helper")));
+    CloseHandle(process.hThread);
+    return process.hProcess;
+}
+void registerScreenshotNotificationsInHelper()
+{
+    auto process=startScreenshotNotificationRegistration();
+    auto wait=WaitForSingleObject(process,10000);
+    DWORD code=ERROR_GEN_FAILURE;
+    bool completed=wait==WAIT_OBJECT_0 && GetExitCodeProcess(process,&code);
+    CloseHandle(process);
+    if(!completed || code)
+        throw std::runtime_error(completed ? "Notification registration helper failed: "+std::to_string(code)
+                                          : "Notification registration helper did not complete within 10 seconds");
+}
 bool validScreenshotToken(const std::wstring &id)
 {
     if(id.size()!=36) return false;

src/screenshot_main.cpp

@@ -1,5 +1,6 @@
 #include "screenshot.h"
 #include "screenshot_notifications.h"
+#include "storage.h"
 #include <commctrl.h>
 #include <shellapi.h>
 #include <roapi.h>
@@ -49,6 +50,18 @@ int WINAPI wWinMain(HINSTANCE instance,HINSTANCE,PWSTR,int)
     std::wstring token;
     bool autoOpenEditor=false, writeLog=false;
     int argc{}; auto argv=CommandLineToArgvW(GetCommandLineW(),&argc);
+    if(argc==3 && std::wstring(argv[1])==L"--clipboard-snapshot") {
+        std::filesystem::path request=argv[2]; LocalFree(argv);
+        return ks::runClipboardSnapshot(request);
+    }
+    if(argc==3 && (std::wstring(argv[1])==L"--capture-history" || std::wstring(argv[1])==L"--history-ocr")) {
+        bool ocr=std::wstring(argv[1])==L"--history-ocr";
+        std::filesystem::path request=argv[2]; LocalFree(argv);
+        auto initialized=CoInitializeEx(nullptr,COINIT_MULTITHREADED);
+        if(FAILED(initialized)) return 1;
+        int result=ocr ? ks::runHistoryOcr(request) : ks::runImageHistoryCapture(request);
+        CoUninitialize(); return result;
+    }
     if(argc>1 && std::wstring(argv[argc-1])==L"--write-log") {
         writeLog=true; --argc;
         ks::setLoggingEnabled(true);

src/screenshot_notifications.cpp

@@ -206,7 +206,7 @@ bool notifyUpdateAvailable(const std::wstring &version)
 {
     try {
         // Reuse the screenshot notification identity, Windows settings and COM activator.
-        registerScreenshotNotifications();
+        registerScreenshotNotificationsInHelper();
         ComPtr<Notifications::IToastNotificationManagerStatics> manager;
         String managerClass(L"Windows.UI.Notifications.ToastNotificationManager");
         check(RoGetActivationFactory(managerClass.value,IID_PPV_ARGS(&manager)));

src/screenshot_notifications.h

@@ -4,6 +4,10 @@ namespace ks {
 bool notifyScreenshot(const Clip &);
 std::string screenshotNotificationError();
 void registerScreenshotNotifications();
+// Caller owns the returned process handle; the helper exits after registration.
+HANDLE startScreenshotNotificationRegistration();
+// For background notification workers only; bounded wait, never on the UI thread.
+void registerScreenshotNotificationsInHelper();
 int runScreenshotToastActivator();
 DWORD startScreenshotActivationListener();
 bool validScreenshotToken(const std::wstring &);

src/storage.cpp

@@ -4,6 +4,7 @@
 #include <algorithm>
 #include <set>
 #include <sstream>
+#include <wincrypt.h>
 
 namespace ks
 {
@@ -343,6 +344,20 @@ Bytes encodeClip(const Clip &clip)
     }
     return b;
 }
+Bytes selectionClipboardIdentity(const Clip &clip)
+{
+    auto normalized = clip;
+    // GlobalSize includes allocation slack. A clipboard relay may allocate a
+    // different-sized block for the same NUL-terminated Unicode string.
+    for (auto &format : normalized.formats)
+        if (format.id == CF_UNICODETEXT)
+            format = textClip(clip.text()).formats.front();
+    std::sort(normalized.formats.begin(), normalized.formats.end(), [](const Format &a, const Format &b)
+    {
+        return std::tie(a.name, a.id) < std::tie(b.name, b.id);
+    });
+    return encodeClip(normalized);
+}
 Clip decodeClip(const Bytes &b)
 {
     size_t p = 0;
@@ -374,9 +389,17 @@ Clip decodeClip(const Bytes &b)
 History::History(const std::filesystem::path &folder) : folder_(folder)
 {
     std::filesystem::create_directories(folder_);
+    loadIndex();
+}
+void History::loadIndex()
+{
+    std::vector<Entry> loaded;
     auto index = folder_ / L"index.dat";
     if (!std::filesystem::exists(index))
+    {
+        entries_.clear();
         return;
+    }
     auto j = parse(unprotect(readFile(index, 16 * 1024 * 1024)));
     if (!j.is_array() || j.size() > 10000)
         throw std::runtime_error("Invalid history index");
@@ -391,8 +414,169 @@ History::History(const std::filesystem::path &folder) : folder_(folder)
                    e.value("image", false),
                    e.value("files", false), e.value("ocrState", e.value("image", false) ? 1 : 0),
                    str(e, "ocrProfile", L"windows")};
+        if (e.value("fingerprintVersion", 0) == 1) {
+            item.contentHash = e.value("contentHash", std::string{});
+            item.imageHash = e.value("imageHash", std::string{});
+            item.pixelHash = e.value("pixelHash", std::string{});
+        }
         if (validId(item.id) && std::filesystem::exists(folder_ / (item.id + L".dat")))
-            entries_.push_back(std::move(item));
+            loaded.push_back(std::move(item));
+    }
+    entries_ = std::move(loaded);
+}
+void History::reload() { std::lock_guard lock(mutex_); loadIndex(); }
+void ClipboardSnapshot::cleanup() noexcept
+{
+    if (request_.empty()) return;
+    std::error_code ignored;
+    for (const auto *suffix : {L"", L".snapshot", L".result"})
+        std::filesystem::remove(std::filesystem::path(request_.wstring() + suffix), ignored);
+    request_.clear();
+}
+ClipboardSnapshot::~ClipboardSnapshot() { cleanup(); }
+DWORD ClipboardSnapshot::run(bool restore, DWORD sequence)
+{
+    atomicWrite(request_, protect(jsonBytes(Json{{"schema", 1}, {"restore", restore}, {"sequence", sequence}})));
+    auto helper = std::filesystem::path(executable()).parent_path() / L"KSwitcher.Screenshot.exe";
+    auto command = L"\"" + helper.wstring() + L"\" --clipboard-snapshot \"" + request_.wstring() + L"\"";
+    STARTUPINFOW startup{sizeof(startup)};
+    startup.dwFlags = STARTF_USESHOWWINDOW; startup.wShowWindow = SW_HIDE;
+    PROCESS_INFORMATION process{};
+    if (!CreateProcessW(helper.c_str(), command.data(), nullptr, nullptr, FALSE, CREATE_NO_WINDOW,
+                        nullptr, helper.parent_path().c_str(), &startup, &process))
+        throw std::runtime_error("Cannot start clipboard snapshot helper");
+    CloseHandle(process.hThread);
+    auto wait = WaitForSingleObject(process.hProcess, 10000);
+    DWORD result = ERROR_GEN_FAILURE;
+    if (wait != WAIT_OBJECT_0)
+    {
+        TerminateProcess(process.hProcess, ERROR_TIMEOUT);
+        WaitForSingleObject(process.hProcess, INFINITE);
+    }
+    GetExitCodeProcess(process.hProcess, &result);
+    CloseHandle(process.hProcess);
+    if (wait != WAIT_OBJECT_0 || result) throw std::runtime_error("Clipboard snapshot helper failed");
+    return parse(unprotect(readFile(request_.wstring() + L".result", 4096))).at("sequence").get<DWORD>();
+}
+void ClipboardSnapshot::capture(HWND window, DWORD sequence)
+{
+    cleanup();
+    clip_ = {};
+    if (!IsClipboardFormatAvailable(CF_DIB) && !IsClipboardFormatAvailable(CF_DIBV5) &&
+        !IsClipboardFormatAvailable(CF_BITMAP) && !IsClipboardFormatAvailable(RegisterClipboardFormatW(L"PNG")))
+    {
+        clip_ = readClipboard(window, 64 * 1024 * 1024, ClipboardRead::WithoutImages, sequence);
+        return;
+    }
+    request_ = std::filesystem::temp_directory_path() / (L"ks-clipboard-" + newSnippetId() + L".request");
+    try { run(false, sequence); }
+    catch (...) { cleanup(); throw; }
+}
+DWORD ClipboardSnapshot::restore(HWND window, DWORD sequence)
+{
+    return request_.empty() ? writeClipboardGuarded(window, clip_, sequence) : run(true, sequence);
+}
+int runClipboardSnapshot(const std::filesystem::path &request)
+{
+    try
+    {
+        if (!request.is_absolute() || !request.filename().wstring().starts_with(L"ks-clipboard-") ||
+            request.extension() != L".request") return 1;
+        auto job = parse(unprotect(readFile(request, 4096)));
+        if (job.at("schema") != 1) return 1;
+        auto sequence = job.at("sequence").get<DWORD>();
+        const auto snapshot = request.wstring() + L".snapshot";
+        if (job.at("restore").get<bool>())
+        {
+            auto clip = decodeClip(unprotect(readFile(snapshot, 70 * 1024 * 1024)));
+            HWND window = CreateWindowExW(0, L"STATIC", L"", 0, 0, 0, 0, 0, HWND_MESSAGE, nullptr, nullptr, nullptr);
+            if (!window) return 1;
+            struct WindowCleanup { HWND window; ~WindowCleanup() { DestroyWindow(window); } } cleanup{window};
+            sequence = writeClipboardGuarded(window, clip, sequence);
+        }
+        else
+        {
+            auto clip = readClipboard(nullptr, 64 * 1024 * 1024, ClipboardRead::All, sequence);
+            if (sequence != GetClipboardSequenceNumber()) return 2;
+            atomicWrite(snapshot, protect(encodeClip(clip)));
+        }
+        atomicWrite(request.wstring() + L".result", protect(jsonBytes(Json{{"sequence", sequence}})));
+        return 0;
+    }
+    catch (...) { return 1; }
+}
+bool History::captureImage(DWORD sequence, const std::wstring &app, const Settings &settings)
+{
+    // Serialize helper index changes with all resident history mutations. Only
+    // metadata is reloaded: GetClipboardData's image allocations die with the child.
+    std::lock_guard lock(mutex_);
+    if (sequence != GetClipboardSequenceNumber()) return false;
+    auto request = std::filesystem::absolute(folder_) / (L"capture-" + newSnippetId() + L".request");
+    struct Cleanup {
+        std::filesystem::path path;
+        ~Cleanup() { std::error_code ignored; std::filesystem::remove(path, ignored); }
+    } cleanup{request};
+    Json job{{"schema", 1}, {"sequence", sequence}, {"app", utf8(app)},
+             {"settings", Json::parse(encodeSettings(settings))}};
+    atomicWrite(request, protect(jsonBytes(job)));
+    auto helper = std::filesystem::path(executable()).parent_path() / L"KSwitcher.Screenshot.exe";
+    auto command = L"\"" + helper.wstring() + L"\" --capture-history \"" + request.wstring() + L"\"";
+    STARTUPINFOW startup{sizeof(startup)};
+    startup.dwFlags = STARTF_USESHOWWINDOW; startup.wShowWindow = SW_HIDE;
+    PROCESS_INFORMATION process{};
+    if (!CreateProcessW(helper.c_str(), command.data(), nullptr, nullptr, FALSE, CREATE_NO_WINDOW,
+                        nullptr, helper.parent_path().c_str(), &startup, &process))
+        throw std::runtime_error(utf8(lastError(L"Cannot start image history helper")));
+    CloseHandle(process.hThread);
+    auto wait = WaitForSingleObject(process.hProcess, 30000);
+    DWORD result = ERROR_GEN_FAILURE;
+    if (wait != WAIT_OBJECT_0)
+    {
+        // Never release the index lock while a timed-out child can still write it.
+        TerminateProcess(process.hProcess, ERROR_TIMEOUT);
+        WaitForSingleObject(process.hProcess, INFINITE);
+    }
+    GetExitCodeProcess(process.hProcess, &result);
+    CloseHandle(process.hProcess);
+    loadIndex(); // Also reconcile any completed atomic save before a child failure.
+    if (wait != WAIT_OBJECT_0) throw std::runtime_error("Image history helper timed out");
+    if (result == 2) return false;
+    if (result == 3) throw std::runtime_error("Clipboard exceeds the configured size limit");
+    if (result) throw std::runtime_error("Image history helper failed: " + std::to_string(result));
+    return true;
+}
+int runImageHistoryCapture(const std::filesystem::path &request)
+{
+    try
+    {
+        if (!request.is_absolute() || !request.filename().wstring().starts_with(L"capture-") ||
+            request.extension() != L".request") return 1;
+        auto job = parse(unprotect(readFile(request, 4 * 1024 * 1024)));
+        if (job.at("schema") != 1) return 1;
+        auto sequence = job.at("sequence").get<DWORD>();
+        auto settings = decodeSettings(jsonBytes(job.at("settings")), readLayouts());
+        auto valid = [&] {
+            return settings.history && sequence == GetClipboardSequenceNumber() &&
+                !IsClipboardFormatAvailable(RegisterClipboardFormatW(L"ExcludeClipboardContentFromMonitorProcessing")) &&
+                !IsClipboardFormatAvailable(RegisterClipboardFormatW(L"Clipboard Viewer Ignore"));
+        };
+        if (!valid()) return 2;
+        if (!IsClipboardFormatAvailable(CF_DIB) && !IsClipboardFormatAvailable(CF_DIBV5) &&
+            !IsClipboardFormatAvailable(CF_BITMAP) &&
+            !IsClipboardFormatAvailable(RegisterClipboardFormatW(L"PNG"))) return 2;
+        auto clip = readClipboard(nullptr, size_t(settings.maxImageMiB) * 1024 * 1024);
+        if (!valid()) return 2;
+        for (const auto &format : clip.formats)
+            if (format.name == L"CanIncludeInClipboardHistory" && format.data.size() >= 4 &&
+                !format.data[0] && !format.data[1] && !format.data[2] && !format.data[3]) return 2;
+        History history(request.parent_path());
+        if (!valid()) return 2;
+        history.add(clip, str(job, "app"), settings);
+        return 0;
+    }
+    catch (const std::exception &e)
+    {
+        return std::string(e.what()) == "Clipboard exceeds the configured size limit" ? 3 : 1;
     }
 }
 void History::saveIndex()
@@ -406,7 +590,9 @@ void History::saveIndex()
                      {"at", e.at},
                      {"pinned", e.pinned},
                      {"image", e.image},
-                     {"files", e.files}, {"ocrState", e.ocrState}, {"ocrProfile", utf8(e.ocrProfile)}});
+                     {"files", e.files}, {"ocrState", e.ocrState}, {"ocrProfile", utf8(e.ocrProfile)},
+                     {"fingerprintVersion", 1}, {"contentHash", e.contentHash},
+                     {"imageHash", e.imageHash}, {"pixelHash", e.pixelHash}});
     atomicWrite(folder_ / L"index.dat", protect(jsonBytes(j)));
 }
 std::vector<Entry> History::entries() const
@@ -439,12 +625,10 @@ void History::prune(const Settings &s)
         entries_.erase(entries_.begin() + i);
     }
 }
-bool sameClipboardImage(const Clip &a, const Clip &b)
+static const Format *clipboardImageFormat(const Clip &c)
 {
     // OLE DataObject / Ole Private Data change when Snipping Tool republishes
     // the same capture. They are transport metadata, not image identity.
-    auto image = [](const Clip &c) -> const Format *
-    {
         if (!c.text().empty())
             return nullptr;
         for (const auto &f : c.formats)
@@ -458,8 +642,42 @@ bool sameClipboardImage(const Clip &a, const Clip &b)
                 if (f.id == id && !f.data.empty())
                     return &f;
         return nullptr;
-    };
+}
-    const auto *left = image(a), *right = image(b);
+static std::string clipboardHash(const Bytes &bytes)
+{
+    struct Hash {
+        HCRYPTPROV provider{}; HCRYPTHASH hash{};
+        ~Hash() { if (hash) CryptDestroyHash(hash); if (provider) CryptReleaseContext(provider, 0); }
+    } state;
+    if (!CryptAcquireContextW(&state.provider, nullptr, nullptr, PROV_RSA_AES, CRYPT_VERIFYCONTEXT) ||
+        !CryptCreateHash(state.provider, CALG_SHA_256, 0, 0, &state.hash) ||
+        !CryptHashData(state.hash, bytes.data(), static_cast<DWORD>(bytes.size()), 0))
+        throw std::runtime_error("Cannot hash clipboard data");
+    BYTE digest[32]{}; DWORD size = sizeof(digest);
+    if (!CryptGetHashParam(state.hash, HP_HASHVAL, digest, &size, 0) || size != sizeof(digest))
+        throw std::runtime_error("Cannot read clipboard hash");
+    static constexpr char hex[] = "0123456789abcdef";
+    std::string result; result.reserve(64);
+    for (auto b : digest) { result += hex[b >> 4]; result += hex[b & 15]; }
+    return result;
+}
+static void imageFingerprints(Entry &entry, const Clip &clip, bool decodePixels = true)
+{
+    const auto *image = clipboardImageFormat(clip);
+    if (!image) return;
+    if (entry.imageHash.empty())
+        entry.imageHash = std::to_string(image->id) + ":" + utf8(image->name) + ":" + clipboardHash(image->data);
+    if (!decodePixels) return;
+    try {
+        auto pixels = decodeImage(clip);
+        entry.pixelHash = std::to_string(pixels.width) + "x" + std::to_string(pixels.height) + ":" + clipboardHash(pixels.bgra);
+    } catch (const std::exception &) {
+        // Undecodable images can still be compared by their original bytes.
+    }
+}
+bool sameClipboardImage(const Clip &a, const Clip &b)
+{
+    const auto *left = clipboardImageFormat(a), *right = clipboardImageFormat(b);
     if (!left || !right)
         return false;
     if (left->id == right->id && left->name == right->name && left->data == right->data)
@@ -483,16 +701,41 @@ void History::add(const Clip &clip, const std::wstring &app, const Settings &s)
     auto data = encodeClip(clip);
     if (data.size() > uint64_t(s.maxImageMiB) * 1024 * 1024)
         return;
+    bool image = false, files = false;
+    for (const auto &f : clip.formats)
+    {
+        image |= f.id == CF_DIB || f.id == CF_DIBV5 || f.name == L"PNG";
+        files |= f.id == CF_HDROP;
+    }
     std::lock_guard lock(mutex_);
-    // Compare only the newest record; never keep image payloads in the resident index.
+    Entry fingerprints;
-    if (!entries_.empty())
+    fingerprints.contentHash = clipboardHash(data);
+    if (!entries_.empty() && entries_.front().contentHash == fingerprints.contentHash)
+        return;
+    imageFingerprints(fingerprints, clip, false);
+    if (!entries_.empty() && !fingerprints.imageHash.empty() && entries_.front().imageHash == fingerprints.imageHash)
+        return;
+    imageFingerprints(fingerprints, clip);
+    // Different payload kinds cannot be duplicates. Consult the index first so
+    // copying text after a screenshot never loads/decrypts the previous image.
+    if (!entries_.empty() && entries_.front().image == image && entries_.front().files == files)
     {
         try
         {
-            auto previous = load(entries_.front().id);
+            auto &previous = entries_.front();
-            if (encodeClip(previous) == data || sameClipboardImage(previous, clip))
+            bool migrated = previous.contentHash.empty();
+            if (migrated) {
+                auto oldClip = load(previous.id);
+                previous.contentHash = clipboardHash(encodeClip(oldClip));
+                imageFingerprints(previous, oldClip);
+            }
+            if (previous.contentHash == fingerprints.contentHash ||
+                (!fingerprints.imageHash.empty() && previous.imageHash == fingerprints.imageHash) ||
+                (!fingerprints.pixelHash.empty() && previous.pixelHash == fingerprints.pixelHash)) {
+                if (migrated) saveIndex();
                 return;
             }
+        }
         catch (...)
         {
         }
@@ -506,12 +749,6 @@ void History::add(const Clip &clip, const std::wstring &app, const Settings &s)
     auto encrypted = protect(data);
     atomicWrite(folder_ / (id + L".dat"), encrypted);
     auto text = clip.text();
-    bool image = false, files = false;
-    for (auto &f : clip.formats)
-    {
-        image |= f.id == CF_DIB || f.id == CF_DIBV5 || f.name == L"PNG";
-        files |= f.id == CF_HDROP;
-    }
     if (text.empty())
         text = files ? L"[Files]" : image ? L"[Image]" : L"[Clipboard data]";
     for (auto &c : text)
@@ -524,7 +761,8 @@ void History::add(const Clip &clip, const std::wstring &app, const Settings &s)
     entries_.insert(entries_.begin(),
                     Entry{id, text, app, encrypted.size(),
                           (uint64_t(now.dwHighDateTime) << 32) | now.dwLowDateTime, false, image, files,
-                          image ? 1 : 0, ocrProfile(s)});
+                          image ? 1 : 0, ocrProfile(s), std::move(fingerprints.contentHash),
+                          std::move(fingerprints.imageHash), std::move(fingerprints.pixelHash)});
     prune(s);
     saveIndex();
 }
@@ -563,6 +801,103 @@ void History::clear()
         std::filesystem::remove(folder_ / (e.id + L".ocr"), ec);
     }
 }
+static Bytes historyImageJob(const std::filesystem::path &folder, const std::wstring &id,
+                             const Json &job, const std::function<bool()> &cancelled)
+{
+    if (!validId(id)) throw std::runtime_error("Invalid history ID");
+    if (cancelled && cancelled()) throw std::runtime_error("History OCR cancelled");
+    auto request = std::filesystem::absolute(folder) / (L"ocr-" + newSnippetId() + L".request");
+    auto response = request; response += L".result";
+    struct Cleanup {
+        std::filesystem::path request, response;
+        ~Cleanup() {
+            std::error_code ignored;
+            std::filesystem::remove(request, ignored);
+            std::filesystem::remove(response, ignored);
+        }
+    } cleanup{request, response};
+    atomicWrite(request, protect(jsonBytes(job)));
+    auto helper = std::filesystem::path(executable()).parent_path() / L"KSwitcher.Screenshot.exe";
+    auto command = L"\"" + helper.wstring() + L"\" --history-ocr \"" + request.wstring() + L"\"";
+    STARTUPINFOW startup{sizeof(startup)};
+    startup.dwFlags = STARTF_USESHOWWINDOW; startup.wShowWindow = SW_HIDE;
+    PROCESS_INFORMATION process{};
+    if (!CreateProcessW(helper.c_str(), command.data(), nullptr, nullptr, FALSE, CREATE_NO_WINDOW,
+                        nullptr, helper.parent_path().c_str(), &startup, &process))
+        throw std::runtime_error(utf8(lastError(L"Cannot start history OCR helper")));
+    CloseHandle(process.hThread);
+    struct Child {
+        HANDLE handle;
+        ~Child() {
+            if (WaitForSingleObject(handle, 0) != WAIT_OBJECT_0) {
+                TerminateProcess(handle, ERROR_CANCELLED);
+                WaitForSingleObject(handle, INFINITE);
+            }
+            CloseHandle(handle);
+        }
+    } child{process.hProcess};
+    auto deadline = GetTickCount64() + 60000;
+    for (;;) {
+        auto wait = WaitForSingleObject(child.handle, 100);
+        if (wait == WAIT_OBJECT_0) break;
+        if (wait != WAIT_TIMEOUT) throw std::runtime_error("Cannot wait for history OCR helper");
+        if (cancelled && cancelled()) throw std::runtime_error("History OCR cancelled");
+        if (GetTickCount64() >= deadline) throw std::runtime_error("History OCR helper timed out");
+    }
+    DWORD result{};
+    if (!GetExitCodeProcess(child.handle, &result) || result)
+        throw std::runtime_error("History OCR helper failed: " + std::to_string(result));
+    return unprotect(readFile(response, 8 * 1024 * 1024));
+}
+std::wstring History::recognizeImage(const std::wstring &id, const Settings &settings,
+                                    const std::function<bool()> &cancelled) const
+{
+    Json job{{"schema", 1}, {"id", utf8(id)}, {"tesseract", settings.useTesseract},
+             {"path", utf8(settings.tesseractPath)}, {"languages", utf8(settings.tesseractLanguages)}};
+    auto reply = parse(historyImageJob(folder_, id, job, cancelled));
+    if (reply.at("schema") != 1 || str(reply, "id") != id)
+        throw std::runtime_error("Invalid history OCR response");
+    return str(reply, "text");
+}
+Pixels History::thumbnail(const std::wstring &id, const std::function<bool()> &cancelled) const
+{
+    auto bytes = historyImageJob(folder_, id, Json{{"schema", 1}, {"id", utf8(id)}, {"thumbnail", true}}, cancelled);
+    size_t at = 0;
+    auto width = get32(bytes, at), height = get32(bytes, at);
+    if (!width || !height || width > 208 || height > 128 || bytes.size() - at != width * height * 4)
+        throw std::runtime_error("Invalid history thumbnail response");
+    bytes.erase(bytes.begin(), bytes.begin() + at);
+    return Pixels{width, height, std::move(bytes)};
+}
+int runHistoryOcr(const std::filesystem::path &request)
+{
+    try {
+        if (!request.is_absolute() || !request.filename().wstring().starts_with(L"ocr-") ||
+            request.extension() != L".request") return 1;
+        auto job = parse(unprotect(readFile(request, 1024 * 1024)));
+        auto id = str(job, "id");
+        if (job.at("schema") != 1 || !validId(id)) return 1;
+        auto clip = decodeClip(unprotect(readFile(request.parent_path() / (id + L".dat"), 80 * 1024 * 1024)));
+        if (job.value("thumbnail", false)) {
+            auto pixels = decodeImage(clip, 208, 128);
+            if (!pixels.width || !pixels.height) return 1;
+            Bytes reply;
+            put32(reply, pixels.width); put32(reply, pixels.height);
+            reply.insert(reply.end(), pixels.bgra.begin(), pixels.bgra.end());
+            atomicWrite(request.wstring() + L".result", protect(reply));
+            return 0;
+        }
+        Settings settings;
+        settings.useTesseract = job.at("tesseract").get<bool>();
+        settings.tesseractPath = str(job, "path");
+        settings.tesseractLanguages = str(job, "languages");
+        auto text = utf8(recognizeText(clip, settings));
+        if (text.size() > 1024 * 1024) return 1;
+        auto response = request; response += L".result";
+        atomicWrite(response, protect(jsonBytes(Json{{"schema", 1}, {"id", utf8(id)}, {"text", text}})));
+        return 0;
+    } catch (...) { return 1; }
+}
 bool History::saveOcr(const std::wstring &id, const std::optional<std::wstring> &text, const Settings &settings)
 {
     std::lock_guard lock(mutex_);
@@ -603,9 +938,10 @@ std::optional<std::wstring> History::ocrText(const std::wstring &id, const std::
     if (bytes.empty() || bytes.front() != 1) throw std::runtime_error("Invalid OCR text format");
     return wide(std::string(bytes.begin() + 1, bytes.end()));
 }
-std::vector<Entry> History::search(const std::wstring &query) const
+std::vector<Entry> History::search(const std::wstring &query, bool pinnedOnly) const
 {
     auto items = entries();
+    if (pinnedOnly) std::erase_if(items, [](const Entry &entry) { return !entry.pinned; });
     if (query.empty())
         return items;
     auto q = lower(query);

src/storage.h

@@ -1,8 +1,10 @@
 #pragma once
 #include "platform.h"
 #include <mutex>
+#include <functional>
 namespace ks
 {
+struct Pixels;
 Settings loadSettings(const std::filesystem::path &, const std::vector<Layout> &);
 Settings decodeSettings(const Bytes &, const std::vector<Layout> &);
 Bytes encodeSettings(const Settings &);
@@ -15,6 +17,7 @@ struct Entry
     bool pinned{}, image{}, files{};
     int ocrState{}; // 0: legacy/not applicable, 1: pending, 2: saved, 3: failed
     std::wstring ocrProfile = L"windows";
+    std::string contentHash, imageHash, pixelHash;
 };
 class History
 {
@@ -22,21 +25,46 @@ class History
     std::vector<Entry> entries_;
     mutable std::mutex mutex_;
     void saveIndex();
+    void loadIndex();
     void prune(const Settings &);
 
   public:
     explicit History(const std::filesystem::path &);
+    void reload();
     std::vector<Entry> entries() const;
     Clip load(const std::wstring &id) const;
     void add(const Clip &, const std::wstring &app, const Settings &);
+    bool captureImage(DWORD sequence, const std::wstring &app, const Settings &);
+    std::wstring recognizeImage(const std::wstring &id, const Settings &,
+                                const std::function<bool()> &cancelled = {}) const;
+    Pixels thumbnail(const std::wstring &id, const std::function<bool()> &cancelled = {}) const;
     bool saveOcr(const std::wstring &id, const std::optional<std::wstring> &, const Settings &);
     std::optional<std::wstring> ocrText(const std::wstring &id, const std::wstring &profile = L"") const;
     void remove(const std::wstring &);
     void pin(const std::wstring &);
     void clear();
-    std::vector<Entry> search(const std::wstring &) const;
+    std::vector<Entry> search(const std::wstring &, bool pinnedOnly = false) const;
 };
 Bytes encodeClip(const Clip &);
+Bytes selectionClipboardIdentity(const Clip &);
 Clip decodeClip(const Bytes &);
 bool sameClipboardImage(const Clip &, const Clip &);
+int runImageHistoryCapture(const std::filesystem::path &request);
+int runHistoryOcr(const std::filesystem::path &request);
+// Image backups stay encrypted on disk and are read/written only by a short-lived helper.
+class ClipboardSnapshot
+{
+    Clip clip_;
+    std::filesystem::path request_;
+    void cleanup() noexcept;
+    DWORD run(bool restore, DWORD sequence);
+  public:
+    ClipboardSnapshot() = default;
+    ClipboardSnapshot(const ClipboardSnapshot &) = delete;
+    ClipboardSnapshot &operator=(const ClipboardSnapshot &) = delete;
+    ~ClipboardSnapshot();
+    void capture(HWND, DWORD sequence);
+    DWORD restore(HWND, DWORD sequence);
+};
+int runClipboardSnapshot(const std::filesystem::path &request);
 } // namespace ks

src/ui.cpp

@@ -468,23 +468,31 @@ struct SearchResult
     uint64_t generation;
     std::vector<Entry> items;
 };
+struct TextPreview
+{
+    std::string rtf;
+    std::wstring plain;
+};
 struct PreviewResult
 {
     uint64_t generation;
     std::wstring id;
     Pixels pixels;
-    std::string rtf;
+    TextPreview text;
 };
 struct HistoryView
 {
     App *app{};
     std::vector<Entry> items;
+    std::wstring rememberedSelection, rememberedTop;
     uint64_t generation{};
+    std::shared_ptr<std::atomic<bool>> previewActive = std::make_shared<std::atomic<bool>>(true);
     std::map<std::wstring, Pixels> thumbnails;
-    std::map<std::wstring, std::string> richTexts;
+    std::map<std::wstring, TextPreview> richTexts;
     HWND rich{};
     std::set<std::wstring> pending;
     bool scrolling{};
+    bool closed{};
 };
 bool selectedImage(HWND w, HistoryView *v)
 {
@@ -502,16 +510,20 @@ std::wstring selected(HWND w, HistoryView *v)
 }
 void search(HWND w, HistoryView *v)
 {
+    v->previewActive->store(false);
+    v->previewActive = std::make_shared<std::atomic<bool>>(true);
+    v->closed = false;
     auto q = value(w, 101);
+    const bool pinnedOnly = SendDlgItemMessageW(w, 117, BM_GETCHECK, 0, 0) == BST_CHECKED;
     auto generation = ++v->generation;
     v->pending.clear();
     auto *app = v->app;
     app->enqueueHistorySearch(
-        [w, app, q, generation]
+        [w, app, q, generation, pinnedOnly]
         {
             try
             {
-                auto result = new SearchResult{generation, app->history->search(q)};
+                auto result = new SearchResult{generation, app->history->search(q, pinnedOnly)};
                 if (!PostMessageW(w, ResultsMessage, 0, (LPARAM)result))
                     delete result;
             }
@@ -529,23 +541,31 @@ void requestPreview(HWND w, HistoryView *v, const Entry &entry)
     if (v->thumbnails.contains(id) || v->richTexts.contains(id) || !v->pending.insert(id).second)
         return;
     auto generation = v->generation;
+    auto active = v->previewActive;
     auto *app = v->app;
     app->enqueue(
-        [w, app, id, generation, image]
+        [w, app, id, generation, image, active]
         {
+            if (!active->load()) return;
             auto result = new PreviewResult{generation, id, {}, {}};
             try
             {
-                auto clip = app->history->load(id);
                 if (image)
-                    result->pixels = decodeImage(clip, 208, 128);
+                    result->pixels = app->history->thumbnail(id, [active] { return !active->load(); });
-                else
+                else {
-                    result->rtf = richPreview(clip);
+                    auto clip = app->history->load(id);
+                    if (!active->load()) { delete result; return; }
+                    result->text.rtf = richPreview(clip, false);
+                    if (result->text.rtf.empty()) {
+                        result->text.plain = clip.text();
+                        if (result->text.plain.size() > 4096) result->text.plain.resize(4096);
+                    }
+                }
             }
             catch (const std::exception &)
             {
             }
-            if (!PostMessageW(w, PreviewMessage, 0, (LPARAM)result))
+            if (!active->load() || !PostMessageW(w, PreviewMessage, 0, (LPARAM)result))
                 delete result;
         });
 }
@@ -599,9 +619,13 @@ void drawHistoryRow(HWND w, HistoryView *v, const DRAWITEMSTRUCT &draw)
     if (!entry.image && !entry.files)
     {
         auto rich = v->richTexts.find(entry.id);
-        if (rich != v->richTexts.end() && v->rich && !rich->second.empty())
+        if (rich != v->richTexts.end() && rich->second.rtf.empty())
+            text = (entry.pinned ? L"★  " : L"") + rich->second.plain;
+        if (rich != v->richTexts.end() && !rich->second.rtf.empty() && !v->rich)
+            v->rich = createRichText(w, 105, false);
+        if (rich != v->richTexts.end() && v->rich && !rich->second.rtf.empty())
         {
-            setRichText(v->rich, rich->second);
+            setRichText(v->rich, rich->second.rtf);
             CHARFORMAT2W format{};
             format.cbSize = sizeof(format);
             format.dwMask = CFM_COLOR;
@@ -716,6 +740,12 @@ LRESULT CALLBACK historyProc(HWND w, UINT msg, WPARAM wp, LPARAM lp)
         case WM_COMMAND:
         {
             int id = LOWORD(wp);
+            if (id == 117 && HIWORD(wp) == BN_CLICKED)
+            {
+                KillTimer(w, 1);
+                search(w, v);
+                return 0;
+            }
             if (id == 101 && HIWORD(wp) == EN_CHANGE)
             {
                 // Reject an older result even during the debounce interval.
@@ -748,7 +778,10 @@ LRESULT CALLBACK historyProc(HWND w, UINT msg, WPARAM wp, LPARAM lp)
             {
                 if (!entry.empty())
                 {
-                    if (id == 112)
+                    if (v->app->historyService) {
+                        v->app->remoteHistory(id == 112 ? "pin" : "remove", entry);
+                        v->app->history->reload();
+                    } else if (id == 112)
                         v->app->history->pin(entry);
                     else
                         v->app->history->remove(entry);
@@ -770,6 +803,7 @@ LRESULT CALLBACK historyProc(HWND w, UINT msg, WPARAM wp, LPARAM lp)
         }
         case WM_TIMER:
             KillTimer(w, 1);
+            if (v->closed) return 0;
             search(w, v);
             return 0;
         case ResultsMessage:
@@ -778,8 +812,10 @@ LRESULT CALLBACK historyProc(HWND w, UINT msg, WPARAM wp, LPARAM lp)
             if (result->generation != v->generation)
                 return 0;
             auto old = selected(w, v);
+            if (old.empty()) old = v->rememberedSelection;
             int top=(int)SendDlgItemMessageW(w,102,LB_GETTOPINDEX,0,0);
             auto topId=top>=0 && top<(int)v->items.size()?v->items[top].id:L"";
+            if (topId.empty()) topId = v->rememberedTop;
             v->items = std::move(result->items);
             SendDlgItemMessageW(w, 102, WM_SETREDRAW, FALSE, 0);
             SendDlgItemMessageW(w, 102, LB_RESETCONTENT, 0, 0);
@@ -819,12 +855,14 @@ LRESULT CALLBACK historyProc(HWND w, UINT msg, WPARAM wp, LPARAM lp)
                 visible.insert(v->items[i].id);
                 if(v->items[i].id==result->id) { changed=intersection; repaint=true; }
             }
-            if (!result->rtf.empty())
+            if (!result->text.rtf.empty() || !result->text.plain.empty())
-                v->richTexts[result->id] = std::move(result->rtf);
+                v->richTexts[result->id] = std::move(result->text);
             else
                 v->thumbnails[result->id] = std::move(result->pixels);
-            trimHistoryPreviews(v->thumbnails,visible);
+            trimHistoryPreviews(v->thumbnails,visible,32,HistoryThumbnailBudget,
-            trimHistoryPreviews(v->richTexts,visible);
+                                [](const Pixels &p) { return p.bgra.capacity(); });
+            trimHistoryPreviews(v->richTexts,visible,32,HistoryRichTextBudget,
+                                [](const TextPreview &s) { return s.rtf.capacity() + s.plain.capacity() * sizeof(wchar_t); });
             if(repaint) InvalidateRect(list,&changed,FALSE);
             return 0;
         }
@@ -875,15 +913,29 @@ LRESULT CALLBACK historyProc(HWND w, UINT msg, WPARAM wp, LPARAM lp)
             return 0;
         }
         case WM_CLOSE:
+        {
+            v->rememberedSelection = selected(w, v);
+            int top = (int)SendDlgItemMessageW(w,102,LB_GETTOPINDEX,0,0);
+            v->rememberedTop = top >= 0 && top < (int)v->items.size() ? v->items[top].id : L"";
+            v->app->saveHistoryView(v->rememberedSelection, v->rememberedTop, value(w, 101),
+                                   SendDlgItemMessageW(w, 117, BM_GETCHECK, 0, 0) == BST_CHECKED);
+            KillTimer(w, 1);
+            v->closed = true;
+            v->previewActive->store(false);
+            ++v->generation; // Discard search/preview results queued before closing.
             ShowWindow(w, SW_HIDE);
+            SendDlgItemMessageW(w,102,LB_RESETCONTENT,0,0);
+            std::vector<Entry>().swap(v->items);
             v->thumbnails.clear();
             v->richTexts.clear();
-            if (v->rich)
+            if (v->rich) SetWindowTextW(v->rich, L"");
-                SetWindowTextW(v->rich, L"");
             v->pending.clear();
-            ++v->generation;
+            if (v->app->historyService && !v->app->historyEntryWindows)
+                PostMessageW(v->app->window, WM_CLOSE, 0, 0);
             return 0;
+        }
         case WM_NCDESTROY:
+            v->previewActive->store(false);
             disposeFont(w);
             v->app->historyWindow = nullptr;
             delete v;
@@ -1643,13 +1695,19 @@ LRESULT CALLBACK snippetProc(HWND w, UINT msg, WPARAM wp, LPARAM lp)
 #ifndef KS_CONFIG_APP
 LRESULT CALLBACK entryProc(HWND w, UINT msg, WPARAM wp, LPARAM lp)
 {
+    if (msg == WM_NCCREATE)
+        SetWindowLongPtrW(w, GWLP_USERDATA, (LONG_PTR)((CREATESTRUCTW *)lp)->lpCreateParams);
     if (msg == WM_SIZE)
     {
         MoveWindow(GetDlgItem(w, 1), 10, 10, LOWORD(lp) - 20, HIWORD(lp) - 20, TRUE);
         return 0;
     }
-    if (msg == WM_NCDESTROY)
+    if (msg == WM_NCDESTROY) {
         disposeFont(w);
+        auto *app = (App *)GetWindowLongPtrW(w, GWLP_USERDATA);
+        if (app && app->historyService && app->historyEntryWindows && !--app->historyEntryWindows &&
+            !IsWindowVisible(app->historyWindow)) PostMessageW(app->window, WM_CLOSE, 0, 0);
+    }
     return DefWindowProcW(w, msg, wp, lp);
 }
 #endif
@@ -1657,6 +1715,7 @@ LRESULT CALLBACK entryProc(HWND w, UINT msg, WPARAM wp, LPARAM lp)
 #ifndef KS_CONFIG_APP
 void refreshHistory(App &app)
 {
+    if (app.isolateHistory) { app.refreshHistoryProcess(); return; }
     if (app.historyWindow)
     {
         auto *v = (HistoryView *)GetWindowLongPtrW(app.historyWindow, GWLP_USERDATA);
@@ -1665,6 +1724,7 @@ void refreshHistory(App &app)
 }
 void showHistory(App &app, bool visible)
 {
+    if (app.isolateHistory) { if (visible) app.openHistoryProcess(); return; }
     if (!app.history)
     {
         app.report(L"Clipboard history is unavailable. See the log in the data folder.");
@@ -1685,9 +1745,11 @@ void showHistory(App &app, bool visible)
         HWND w = makeWindow(app, L"KSwitcher.History", L"Clipboard history", historyProc, 760, 500);
         app.historyWindow = w;
         windowLayoutState(w)->history = true;
-        ((HistoryView *)GetWindowLongPtrW(w, GWLP_USERDATA))->rich = createRichText(w, 105, false);
+        auto filter = control(w, L"BUTTON", L"★ Pinned only", WS_TABSTOP | BS_AUTOCHECKBOX,
-        label(w, L"&Search clipboard history", 16, 12, 500);
+                              117, 16, 38, 112, 25);
-        edit(w, 101, 16, 38, 728);
+        SendMessageW(filter, BM_SETCHECK, app.historyPinnedOnly ? BST_CHECKED : BST_UNCHECKED, 0);
+        label(w, L"&Search clipboard history", 136, 12, 500);
+        edit(w, 101, 136, 38, 608);
         auto list = control(w, L"LISTBOX", L"",
                             WS_TABSTOP | WS_VSCROLL | LBS_NOTIFY | LBS_NOINTEGRALHEIGHT | WS_BORDER |
                                 LBS_OWNERDRAWFIXED | LBS_HASSTRINGS,
@@ -1701,6 +1763,12 @@ void showHistory(App &app, bool visible)
         button(w, L"Clear &history…", 116, 546, 452, 150);
         SetWindowSubclass(list, historyKey, 1, (DWORD_PTR)w);
         SetWindowSubclass(GetDlgItem(w, 101), historyKey, 1, (DWORD_PTR)w);
+        if (app.historyService) {
+            auto *v = (HistoryView *)GetWindowLongPtrW(w, GWLP_USERDATA);
+            v->rememberedSelection = app.historySelection;
+            v->rememberedTop = app.historyTop;
+            SetDlgItemTextW(w, 101, app.historyQuery.c_str());
+        }
     }
     if (!visible) return;
     POINT cursor;
@@ -1857,6 +1925,7 @@ void showEntry(App &app, const std::wstring &id)
         }
         HWND w = makeWindow(app, L"KSwitcher.Entry", L"Clipboard item", entryProc, 720, 500,
                             WS_THICKFRAME | WS_MAXIMIZEBOX);
+        if (app.historyService) ++app.historyEntryWindows;
         auto field = edit(w, 1, 10, 10, 700, 480, ES_MULTILINE | ES_READONLY | ES_AUTOVSCROLL | WS_VSCROLL);
         SetWindowTextW(field, text.c_str());
         showRequestedWindow(w);

src/update.h

@@ -2,7 +2,7 @@
 #include "platform.h"
 namespace ks
 {
-inline constexpr wchar_t AppVersion[] = L"0.6.34";
+inline constexpr wchar_t AppVersion[] = L"0.6.43";
 inline constexpr UINT UpdateMessage = WM_APP + 7;
 inline constexpr UINT UpdateCheckIntervalMs = 6 * 60 * 60 * 1000;
 inline constexpr UINT UpdateNotificationRetryMs = 5 * 60 * 1000;

tests/clipboard_snapshot.cpp

@@ -0,0 +1,108 @@
+// Run with the resident stopped. The suite restores the original clipboard.
+#include "storage.h"
+#include "ocr.h"
+#include <psapi.h>
+#include <iostream>
+#include <algorithm>
+static void require(bool ok, const char *name) {
+    if (!ok) throw std::runtime_error(name);
+    std::cout << "PASS " << name << '\n';
+}
+static HWND owner() {
+    return CreateWindowExW(0,L"STATIC",L"Snapshot test",0,0,0,0,0,HWND_MESSAGE,nullptr,nullptr,nullptr);
+}
+static void child(const std::wstring &argument) {
+    auto exe=ks::executable(), command=L"\""+exe+L"\" "+argument;
+    STARTUPINFOW startup{sizeof(startup)}; startup.dwFlags=STARTF_USESHOWWINDOW; startup.wShowWindow=SW_HIDE;
+    PROCESS_INFORMATION p{};
+    if(!CreateProcessW(exe.c_str(),command.data(),nullptr,nullptr,FALSE,CREATE_NO_WINDOW,nullptr,nullptr,&startup,&p))
+        throw std::runtime_error("start fixture process");
+    CloseHandle(p.hThread);
+    auto wait=WaitForSingleObject(p.hProcess,30000); DWORD code=1;
+    if(wait!=WAIT_OBJECT_0) {TerminateProcess(p.hProcess,1);WaitForSingleObject(p.hProcess,INFINITE);}
+    GetExitCodeProcess(p.hProcess,&code); CloseHandle(p.hProcess);
+    if(code) throw std::runtime_error("fixture process failed");
+}
+static size_t resident() {
+    ks::Bytes b(1024*1024); auto ws=reinterpret_cast<PSAPI_WORKING_SET_INFORMATION*>(b.data());
+    if(!QueryWorkingSet(GetCurrentProcess(),ws,DWORD(b.size()))) throw std::runtime_error("working set query");
+    size_t pages=0; for(size_t i=0;i<ws->NumberOfEntries;++i) if(!ws->WorkingSetInfo[i].Shared) ++pages;
+    return pages*4096;
+}
+static void verifyImage(HWND w) {
+    auto c=ks::readClipboard(w,64*1024*1024);
+    for(auto id:{CF_DIB,CF_DIBV5}) {
+        auto it=std::find_if(c.formats.begin(),c.formats.end(),[&](const auto &f){return f.id==UINT(id);});
+        require(it!=c.formats.end(),"restores image representation");
+        auto pixels=ks::decodeImage(ks::Clip{{*it}});
+        require(pixels.width==1566 && pixels.height==1068 && pixels.bgra.front()==77,"preserves image pixels");
+    }
+    require(c.text()==L"Snapshot mixed text","preserves accompanying text");
+}
+int main(int argc,char**argv) {
+    CoInitializeEx(nullptr,COINIT_MULTITHREADED);
+    HWND w=owner(); int result=0; ks::Clip original; bool saved=false;
+    try {
+        std::string mode=argc>1?argv[1]:"suite";
+        if(mode=="publish") {
+            ks::Pixels p{1566,1068,ks::Bytes(1566*1068*4,255)}; p.bgra[0]=77;
+            auto dib=ks::imageDib(p); auto v5=dib;
+            BITMAPV5HEADER h{}; h.bV5Size=sizeof(h); h.bV5Width=p.width; h.bV5Height=-p.height;
+            h.bV5Planes=1; h.bV5BitCount=32; h.bV5Compression=BI_BITFIELDS;
+            h.bV5RedMask=0xff0000; h.bV5GreenMask=0xff00; h.bV5BlueMask=0xff; h.bV5AlphaMask=0xff000000;
+            v5.id=CF_DIBV5; v5.data.resize(sizeof(h)+p.bgra.size());
+            memcpy(v5.data.data(),&h,sizeof(h)); memcpy(v5.data.data()+sizeof(h),p.bgra.data(),p.bgra.size());
+            auto clip=ks::textClip(L"Snapshot mixed text"); clip.formats.push_back(dib); clip.formats.push_back(v5);
+            ks::writeClipboard(w,clip);
+        } else if(mode=="old" || mode=="new") {
+            child(L"publish"); auto baseline=resident();
+            if(mode=="old") {
+                auto clip=ks::readClipboard(w,64*1024*1024);
+                ks::writeClipboard(w,ks::textClip(L"temporary")); ks::writeClipboard(w,clip);
+            } else {
+                ks::ClipboardSnapshot snapshot; snapshot.capture(w,GetClipboardSequenceNumber());
+                auto seq=ks::writeClipboard(w,ks::textClip(L"temporary"));
+                require(snapshot.restore(w,seq)==GetClipboardSequenceNumber(),"helper returns current sequence");
+            }
+            auto after=resident();
+            auto report="baseline="+std::to_string(baseline)+" after="+std::to_string(after)+" delta="+std::to_string(int64_t(after)-int64_t(baseline))+"\n";
+            auto path=std::filesystem::path(ks::executable()).parent_path()/(L"snapshot-memory-"+ks::wide(mode)+L".txt");
+            ks::atomicWrite(path,ks::Bytes(report.begin(),report.end()));
+            verifyImage(w); // Only after measuring: verification intentionally reads images.
+        } else {
+            original=ks::readClipboard(w,128*1024*1024); saved=true;
+            child(L"old"); child(L"new"); child(L"publish");
+            auto seq=GetClipboardSequenceNumber();
+            auto selected=ks::readClipboard(w,32*1024*1024,ks::ClipboardRead::Selection);
+            require(selected.formats.size()==1 && selected.text()==L"Snapshot mixed text","selection read excludes image data");
+            bool rejected=false;
+            try {ks::readClipboard(w,32*1024*1024,ks::ClipboardRead::WithoutImages,seq);} catch(...) {rejected=true;}
+            require(rejected,"resident rejects images before reading their data");
+            {
+                ks::ClipboardSnapshot snapshot; snapshot.capture(w,seq);
+                auto stale=ks::writeClipboard(w,ks::textClip(L"temporary"));
+                ks::writeClipboard(w,ks::textClip(L"external copy")); rejected=false;
+                try {snapshot.restore(w,stale);} catch(...) {rejected=true;}
+                require(rejected && ks::readClipboard(w).text()==L"external copy","stale image restore preserves external copy");
+            }
+            {
+                ks::ClipboardSnapshot snapshot; snapshot.capture(w,GetClipboardSequenceNumber());
+                auto temporary=ks::writeClipboard(w,ks::textClip(L"temporary"));
+                snapshot.restore(w,temporary);
+                require(ks::readClipboard(w).text()==L"external copy","text snapshot fast path restores clipboard");
+            }
+            {
+                ks::Clip empty; auto seqEmpty=ks::writeClipboard(w,empty);
+                ks::ClipboardSnapshot snapshot; snapshot.capture(w,seqEmpty);
+                snapshot.restore(w,ks::writeClipboard(w,ks::textClip(L"temporary")));
+                require(ks::readClipboard(w).formats.empty(),"empty clipboard restored");
+            }
+            auto marked=ks::textClip(L"line"); marked.formats.push_back({0,L"MSDEVLineSelect",ks::Bytes{1}});
+            ks::writeClipboard(w,marked);
+            require(ks::readClipboard(w,1024,ks::ClipboardRead::Selection).formats.size()==2,"selection reader preserves editor guard metadata");
+            std::cout<<"PASS clipboard snapshot suite\n";
+        }
+    } catch(const std::exception &e) {std::cerr<<"FAIL "<<e.what()<<'\n';result=1;}
+    if(saved) try {ks::writeClipboard(w,original);} catch(...) {result=1;}
+    DestroyWindow(w); CoUninitialize(); return result;
+}

tests/dictionary.cpp

@@ -0,0 +1,85 @@
+#include "autocorrect.h"
+#include <algorithm>
+#include <chrono>
+#include <fstream>
+#include <iostream>
+#include <psapi.h>
+#include <random>
+namespace ks {
+struct AutoCorrectorRegressionAccess {
+ static int rank(const AutoCorrector &c,const std::wstring &lang,const std::wstring &word) {
+  return c.dictionaries.at(lang)->rank(word);
+ }
+ static std::vector<int> ranks(const std::filesystem::path &path,const std::vector<std::wstring> &words) {
+  AutoCorrector::Dictionary d(path);
+  std::vector<int> values;for(const auto &word:words)values.push_back(d.rank(word));return values;
+ }
+};
+}
+int main(int argc,char **argv) {
+ try {
+  auto start=std::chrono::steady_clock::now();
+  ks::AutoCorrector c;c.configure(L"dictionaries",{L"en",L"uk",L"ru"});
+  PROCESS_MEMORY_COUNTERS_EX m{};
+  GetProcessMemoryInfo(GetCurrentProcess(),reinterpret_cast<PROCESS_MEMORY_COUNTERS*>(&m),sizeof(m));
+  std::cout<<"dictionary_bytes="<<c.memoryBytes()<<" private_bytes="<<m.PrivateUsage
+   <<" load_ms="<<std::chrono::duration<double,std::milli>(std::chrono::steady_clock::now()-start).count()<<'\n';
+  struct Query {std::wstring language,word; int rank;};
+  std::vector<Query> queries;
+  for(const auto *lang:{L"en",L"uk",L"ru"}) {
+   std::ifstream input(std::filesystem::path(L"dictionaries")/(std::wstring(lang)+L".txt"));
+   std::map<std::wstring,int> expected;
+   for(std::string line;std::getline(input,line);) {
+    auto tab=line.find('\t');auto word=ks::wide(line.substr(0,tab));auto rank=std::stoi(line.substr(tab+1));
+    auto [it,added]=expected.emplace(word,rank);if(!added)it->second=std::min(it->second,rank);
+   }
+   if(expected.empty())throw std::runtime_error("Missing benchmark dictionary");
+   for(auto &[word,rank]:expected) {
+    if(ks::AutoCorrectorRegressionAccess::rank(c,lang,word)!=rank)throw std::runtime_error("Dictionary rank differs from source");
+    if(ks::AutoCorrectorRegressionAccess::rank(c,lang,word+L"~")!=0)throw std::runtime_error("False dictionary hit");
+    queries.push_back({lang,word,rank});queries.push_back({lang,word+L"~",0});
+   }
+  }
+  std::mt19937 random(42);std::shuffle(queries.begin(),queries.end(),random);
+  uint64_t checksum=0,expected=0;
+  for(auto &q:queries)expected+=q.rank;
+  start=std::chrono::steady_clock::now();
+  for(int pass=0;pass<5;++pass)for(auto &q:queries)checksum+=ks::AutoCorrectorRegressionAccess::rank(c,q.language,q.word);
+  auto ms=std::chrono::duration<double,std::milli>(std::chrono::steady_clock::now()-start).count();
+  if(checksum!=expected*5)throw std::runtime_error("Lookup checksum mismatch");
+  std::cout<<"verified_words="<<queries.size()/2<<" queries="<<queries.size()*5<<" lookup_ms="<<ms
+   <<" ns_per_lookup="<<ms*1000000/(queries.size()*5)<<" checksum="<<checksum<<'\n';
+  auto fixture=std::filesystem::temp_directory_path()/(L"KSwitcher-dictionary-"+
+      std::to_wstring(GetCurrentProcessId())+L"-"+std::to_wstring(GetTickCount64())+L".txt");
+  struct RemoveFixture { std::filesystem::path path; ~RemoveFixture(){std::error_code ec;std::filesystem::remove(path,ec);} } cleanup{fixture};
+  auto put=[&](const std::string &text){ks::atomicWrite(fixture,ks::Bytes(text.begin(),text.end()));};
+  std::string text="duplicate\t9\r\nduplicate\t2\n";
+  std::vector<std::wstring> words;
+  std::vector<int> expectedRanks;
+  for(int i=129;i>=0;--i) {
+   auto word=L"prefix_"+std::to_wstring(i);
+   text+=ks::utf8(word)+"\t"+std::to_string(i+1)+"\n";
+   words.push_back(word);expectedRanks.push_back(i+1);
+  }
+  text+=std::string(160,'x')+"\t2147483647"; // Maximum length/rank, no final newline.
+  words.insert(words.end(),{std::wstring(160,L'x'),L"DUPLICATE",L"",L"prefix_",L"zzzz"});
+  expectedRanks.insert(expectedRanks.end(),{2147483647,2,0,0,0});
+  for(auto rank:{65534,65535,65536}) {
+   auto word=std::wstring(159,L'x')+wchar_t(L'y'+rank-65534);
+   text+="\n"+ks::utf8(word)+"\t"+std::to_string(rank);
+   words.push_back(word);expectedRanks.push_back(rank);
+  }
+  put(text);
+  if(ks::AutoCorrectorRegressionAccess::ranks(fixture,words)!=expectedRanks)
+   throw std::runtime_error("Block boundaries, duplicate ranks or maximum values failed");
+  for(const auto &invalid:std::vector<std::string>{"","missing-tab","x\t0","x\t-1","x\t2147483648",std::string(161,'x')+"\t1","\t1","x\t1bad"}) {
+   put(invalid);bool rejected=false;
+   try {ks::AutoCorrectorRegressionAccess::ranks(fixture,{L"x"});}catch(const std::runtime_error &){rejected=true;}
+   if(!rejected)throw std::runtime_error("Invalid dictionary was accepted");
+  }
+  const bool baseline=argc==2 && std::string(argv[1])=="--baseline";
+  if(!baseline && c.memoryBytes()>=1536*1024)throw std::runtime_error("Bundled dictionaries exceed compact memory budget");
+  std::cout<<"Passed complete dictionary equivalence and format regressions\n";
+  return 0;
+ }catch(const std::exception&e){std::cerr<<e.what()<<'\n';return 1;}
+}

tests/history_host.cpp

@@ -0,0 +1,184 @@
+// Run from an isolated fixture folder containing KSwitcher.exe and Screenshot.exe,
+// with the normal resident stopped. Never points at the installed user's data.
+#include "storage.h"
+#include "ocr.h"
+#include "json.hpp"
+#include <commctrl.h>
+#include <psapi.h>
+#include <iostream>
+static HWND editor{};
+static bool pastedImage{};
+static LRESULT CALLBACK targetProc(HWND w,UINT message,WPARAM wp,LPARAM lp) {
+    if(message==WM_SETFOCUS && editor) {SetFocus(editor);return 0;}
+    return DefWindowProcW(w,message,wp,lp);
+}
+static void require(bool ok,const char *what) {if(!ok)throw std::runtime_error(what);std::cout<<"PASS "<<what<<'\n';}
+static void pump() {MSG m;while(PeekMessageW(&m,nullptr,0,0,PM_REMOVE)){TranslateMessage(&m);DispatchMessageW(&m);}}
+template<class F> static void until(F condition,const char *what,DWORD timeout=10000) {
+    auto end=GetTickCount64()+timeout;
+    while(!condition()){if(GetTickCount64()>=end)throw std::runtime_error(what);pump();Sleep(10);}
+}
+static LRESULT send(HWND w,UINT message,WPARAM wp=0,LPARAM lp=0) {
+    DWORD_PTR result{};
+    if(!SendMessageTimeoutW(w,message,wp,lp,SMTO_ABORTIFHUNG,5000,&result))throw std::runtime_error("window request timed out");
+    return LRESULT(result);
+}
+static void command(HWND resident,int cmd) {
+    COPYDATASTRUCT data{1,sizeof(cmd),&cmd};send(resident,WM_COPYDATA,0,LPARAM(&data));
+}
+static size_t memory(HANDLE process) {
+    ks::Bytes bytes(1024*1024);auto ws=reinterpret_cast<PSAPI_WORKING_SET_INFORMATION*>(bytes.data());
+    if(!QueryWorkingSet(process,ws,DWORD(bytes.size())))throw std::runtime_error("memory query failed");
+    size_t pages=0;for(size_t i=0;i<ws->NumberOfEntries;++i)if(!ws->WorkingSetInfo[i].Shared)++pages;
+    return pages*4096;
+}
+static std::wstring editorText() {wchar_t text[256]{};GetWindowTextW(editor,text,256);return text;}
+static LRESULT CALLBACK editProc(HWND w,UINT message,WPARAM wp,LPARAM lp,UINT_PTR,DWORD_PTR) {
+    if(message==WM_PASTE && IsClipboardFormatAvailable(CF_DIB)) {pastedImage=true;return 0;}
+    return DefSubclassProc(w,message,wp,lp);
+}
+static ks::Clip excluded(ks::Clip clip) {
+    clip.formats.push_back({0,L"ExcludeClipboardContentFromMonitorProcessing",ks::Bytes{0}});return clip;
+}
+int main() {
+    CoInitializeEx(nullptr,COINIT_APARTMENTTHREADED);
+    PROCESS_INFORMATION process{};HWND resident{},target{};ks::Clip saved;bool captured=false;int result=0;
+    try {
+        auto folder=std::filesystem::path(ks::executable()).parent_path();
+        require(folder.filename().wstring().starts_with(L"history-host-fixture-"),"isolated fixture directory");
+        require(!FindWindowW(L"KSwitcher.Main",nullptr),"normal resident is stopped");
+        WNDCLASSW targetClass{};targetClass.lpfnWndProc=targetProc;targetClass.hInstance=GetModuleHandleW(nullptr);
+        targetClass.lpszClassName=L"KSwitcher.HistoryTestDestination";RegisterClassW(&targetClass);
+        target=CreateWindowExW(0,targetClass.lpszClassName,L"KSwitcher history test destination",WS_OVERLAPPEDWINDOW|WS_VISIBLE,
+                               50,50,500,250,nullptr,nullptr,nullptr,nullptr);
+        editor=CreateWindowExW(0,L"EDIT",L"",WS_CHILD|WS_VISIBLE|ES_MULTILINE,10,10,450,180,target,nullptr,nullptr,nullptr);
+        SetWindowSubclass(editor,editProc,1,0);
+        saved=ks::readClipboard(target,128*1024*1024);captured=true;
+        ks::writeClipboard(target,excluded(ks::textClip(L"fixture clipboard")));
+        auto settings=ks::loadSettings(folder/L"missing.json",ks::readLayouts());
+        settings.autoCorrect=false;settings.writeLog=true;settings.history=true;settings.maxItems=500;settings.maxMiB=100;
+        std::filesystem::create_directories(folder/L"data");
+        ks::saveSettings(folder/L"data/settings.json",settings);
+        ks::History history(folder/L"data/history");
+        history.clear(); // This executable only runs in its dedicated fixture directory.
+        ks::Pixels pixels{1566,1068,ks::Bytes(1566*1068*4,255)};
+        auto image=ks::Clip{{ks::imageDib(pixels)}};
+        history.add(image,L"test",settings);
+        auto imageId=history.entries().front().id;
+        // Seed once rather than rewriting the encrypted index 500 times. This
+        // also avoids measuring fixture creation in the resident under test.
+        auto indexPath=folder/L"data/history/index.dat";
+        auto rows=nlohmann::json::parse(ks::unprotect(ks::readFile(indexPath,1024*1024)));
+        for(int i=0;i<499;++i) {
+            auto id=ks::lower(ks::newSnippetId().substr(1,36)),text=L"History fixture "+std::to_wstring(i);
+            auto bytes=ks::protect(ks::encodeClip(ks::textClip(text)));
+            ks::atomicWrite(folder/L"data/history"/(id+L".dat"),bytes);
+            rows.insert(rows.begin(),nlohmann::json{{"id",ks::utf8(id)},{"preview",ks::utf8(text)},
+                {"app","test"},{"bytes",bytes.size()},{"at",i+1},{"pinned",false},{"image",false},{"files",false}});
+        }
+        auto encoded=rows.dump();ks::atomicWrite(indexPath,ks::protect(ks::Bytes(encoded.begin(),encoded.end())));
+        history.reload();
+        auto textId=history.entries().front().id;
+        auto exe=folder/L"KSwitcher.exe";auto line=L"\""+exe.wstring()+L"\"";
+        STARTUPINFOW startup{sizeof(startup)};startup.dwFlags=STARTF_USESHOWWINDOW;startup.wShowWindow=SW_HIDE;
+        require(CreateProcessW(exe.c_str(),line.data(),nullptr,nullptr,FALSE,CREATE_NO_WINDOW,nullptr,folder.c_str(),&startup,&process),"start isolated resident");
+        CloseHandle(process.hThread);process.hThread=nullptr;
+        until([&]{resident=FindWindowW(L"KSwitcher.Main",nullptr);return resident!=nullptr;},"resident startup");
+        auto base=memory(process.hProcess);
+        std::string forged="{\"action\":\"clear\",\"id\":\"\",\"plain\":false}";
+        COPYDATASTRUCT forgedRequest{0x4b530200,DWORD(forged.size()),forged.data()};
+        require(send(resident,WM_COPYDATA,WPARAM(target),LPARAM(&forgedRequest))==0,
+                "history rejects requests from an untrusted process");
+        auto open=[&] {
+            require(ks::activateWindow(target),"destination foreground");SetFocus(editor);command(resident,5);
+            HWND window{};
+            until([&]{window=FindWindowW(L"KSwitcher.History",nullptr);return window&&IsWindowVisible(window);},"history startup");
+            until([&]{return send(GetDlgItem(window,102),LB_GETCOUNT)>0;},"history rows");
+            DWORD pid{};GetWindowThreadProcessId(window,&pid);
+            require(pid!=process.dwProcessId,"history belongs to a separate process");
+            return window;
+        };
+        auto close=[&](HWND window) {
+            DWORD pid{};GetWindowThreadProcessId(window,&pid);HANDLE child=OpenProcess(SYNCHRONIZE,FALSE,pid);
+            PostMessageW(window,WM_KEYDOWN,VK_ESCAPE,0); // Escape also works with focus on the window itself.
+            until([&]{return WaitForSingleObject(child,0)==WAIT_OBJECT_0;},"history helper exits after Escape");
+            CloseHandle(child);
+            require(!FindWindowW(L"KSwitcher.History",nullptr),"Escape destroys history window");
+        };
+        for(int i=0;i<3;++i){auto w=open();until([&]{return send(GetDlgItem(w,102),LB_GETCOUNT)==500;},"all history rows loaded");require(true,"all history entries visible");close(w);}
+        auto idle=memory(process.hProcess);
+        std::cout<<"MEMORY resident_before="<<base<<" after_three_closes="<<idle<<'\n';
+        require(idle<base+2*1024*1024,"repeated history does not retain UI heap in resident");
+        auto w=open();send(w,WM_COMMAND,112);
+        until([&]{history.reload();return history.entries().front().pinned;},"resident pin mutation");
+        require(history.entries().front().id==textId,"pin preserves history identity");
+        auto filter=[&](HWND window,int index) {
+            auto checkbox=GetDlgItem(window,117);
+            if(send(checkbox,BM_GETCHECK)!=(index ? BST_CHECKED : BST_UNCHECKED)) send(checkbox,BM_CLICK);
+        };
+        filter(w,1);
+        until([&]{return send(GetDlgItem(w,102),LB_GETCOUNT)==1;},"pinned filter hides unpinned entries");
+        send(GetDlgItem(w,101),WM_SETTEXT,0,LPARAM(L"History fixture 497"));
+        until([&]{return send(GetDlgItem(w,102),LB_GETCOUNT)==0;},"search cannot match an unpinned item in pinned view");
+        send(GetDlgItem(w,101),WM_SETTEXT,0,LPARAM(L"History fixture 498"));
+        until([&]{return send(GetDlgItem(w,102),LB_GETCOUNT)==1;},"history search");
+        send(w,WM_COMMAND,112);
+        until([&]{return send(GetDlgItem(w,102),LB_GETCOUNT)==0;},"unpin removes the last pinned result");
+        filter(w,0);
+        until([&]{return send(GetDlgItem(w,102),LB_GETCOUNT)==1;},"all items restores the matching unpinned entry");
+        send(w,WM_COMMAND,112);
+        filter(w,1);
+        close(w);w=open();
+        require(send(GetDlgItem(w,117),BM_GETCHECK)==BST_CHECKED,"pinned checkbox survives helper restart");
+        wchar_t query[100]{};send(GetDlgItem(w,101),WM_GETTEXT,100,LPARAM(query));
+        require(std::wstring(query)==L"History fixture 498","search survives helper restart");
+        send(w,WM_COMMAND,114);
+        HWND entry{};until([&]{entry=FindWindowW(L"KSwitcher.Entry",nullptr);return entry!=nullptr;},"full item opens");
+        DWORD childPid{};GetWindowThreadProcessId(w,&childPid);HANDLE child=OpenProcess(SYNCHRONIZE,FALSE,childPid);
+        send(GetDlgItem(w,101),WM_KEYDOWN,VK_ESCAPE);
+        require(WaitForSingleObject(child,0)==WAIT_TIMEOUT && IsWindow(entry),"full item remains usable after closing history");
+        send(entry,WM_CLOSE);
+        until([&]{return WaitForSingleObject(child,0)==WAIT_OBJECT_0;},"helper exits after last full item closes");CloseHandle(child);
+        w=open();filter(w,0);send(GetDlgItem(w,101),WM_SETTEXT,0,LPARAM(L""));
+        until([&]{return send(GetDlgItem(w,102),LB_GETCOUNT)==500;},"clear search");close(w);
+        ks::writeClipboard(target,excluded(image));
+        w=open();send(w,WM_COMMAND,111);
+        until([&]{return editorText()==L"History fixture 498";},"paste plain text into native editor");
+        until([&]{return IsClipboardFormatAvailable(CF_DIB)&&!FindWindowW(L"KSwitcher.HistoryHost",nullptr);},"image clipboard restored after paste");
+        require(ks::decodeImage(ks::readClipboard(target,64*1024*1024)).width==pixels.width,"image clipboard survives history paste");
+        auto afterPaste=memory(process.hProcess);
+        std::cout<<"MEMORY after_paste_with_image_backup="<<afterPaste<<'\n';
+        require(afterPaste<base+2*1024*1024,"image clipboard backup stays outside resident");
+        ks::writeClipboard(target,excluded(ks::textClip(L"keep clipboard")));
+        w=open();send(GetDlgItem(w,101),WM_SETTEXT,0,LPARAM(L"Image"));
+        until([&]{return send(GetDlgItem(w,102),LB_GETCOUNT)==1;},"image search");
+        pastedImage=false;send(w,WM_COMMAND,110);
+        until([&]{return pastedImage;},"image paste reaches destination");
+        until([&]{return ks::readClipboard(target).text()==L"keep clipboard";},"clipboard restored after image paste");
+        std::cout<<"MEMORY after_image_paste="<<memory(process.hProcess)<<'\n';
+        require(memory(process.hProcess)<base+2*1024*1024,"image paste does not retain full bitmap in resident");
+        until([&]{return !FindWindowW(L"KSwitcher.HistoryHost",nullptr);},"image paste helper exits");
+        w=open();send(w,WM_COMMAND,113);
+        until([&]{history.reload();return history.entries().size()==499;},"resident removes selected image");
+        GetWindowThreadProcessId(w,&childPid);child=OpenProcess(SYNCHRONIZE,FALSE,childPid);
+        // Startup update checks temporarily reject exit; retry after that
+        // operation finishes instead of treating its guard as a host leak.
+        ULONGLONG nextExit{};
+        until([&]{
+            if(WaitForSingleObject(process.hProcess,0)==WAIT_OBJECT_0) return true;
+            if(GetTickCount64()>=nextExit) {
+                command(resident,99);nextExit=GetTickCount64()+500;
+            }
+            return false;
+        },"resident accepts exit after startup update check",30000);
+        until([&]{return WaitForSingleObject(child,0)==WAIT_OBJECT_0;},"resident shutdown closes history helper");
+        CloseHandle(child);resident=nullptr;
+        std::cout<<"PASS isolated history host suite\n";
+    } catch(const std::exception &e){std::cerr<<"FAIL "<<e.what()<<" editor="<<ks::utf8(editorText())<<" foreground="<<(GetForegroundWindow()==target)<<'\n';result=1;}
+    if(resident)try{command(resident,99);}catch(...){}
+    if(process.hProcess){if(WaitForSingleObject(process.hProcess,10000)!=WAIT_OBJECT_0){TerminateProcess(process.hProcess,1);WaitForSingleObject(process.hProcess,INFINITE);}CloseHandle(process.hProcess);}
+    if(captured)try{ks::writeClipboard(target,saved);}catch(...){result=1;}
+    if(target) DestroyWindow(target);
+    CoUninitialize();
+    return result;
+}

tests/image_capture.cpp

@@ -0,0 +1,84 @@
+// Interactive clipboard test. Run with the resident stopped; the original
+// clipboard is restored. The helper must be beside this test executable.
+#include "storage.h"
+#include "ocr.h"
+#include <algorithm>
+#include <iostream>
+static void require(bool ok,const char *name) {
+    if(!ok) throw std::runtime_error(name);
+    std::cout << "PASS " << name << '\n';
+}
+int main() {
+    CoInitializeEx(nullptr,COINIT_MULTITHREADED);
+    HWND owner=CreateWindowExW(0,L"STATIC",L"Capture test",0,0,0,0,0,HWND_MESSAGE,nullptr,nullptr,nullptr);
+    ks::Clip saved; bool captured=false; int result=0;
+    auto folder=std::filesystem::temp_directory_path()/(L"KSwitcher-image-capture-"+std::to_wstring(GetCurrentProcessId()));
+    try {
+        saved=ks::readClipboard(owner,128*1024*1024); captured=true;
+        ks::Settings settings; settings.history=true;
+        ks::History history(folder);
+        history.add(ks::textClip(L"keep pinned"),L"test",settings);
+        auto pinned=history.entries().front().id; history.pin(pinned);
+        ks::Pixels pixels{32,16,ks::Bytes(32*16*4,255)};
+        ks::Clip image{{ks::imageDib(pixels),{0,L"PNG",ks::encodePng(pixels)}}};
+        auto sequence=ks::writeClipboard(owner,image);
+        require(history.captureImage(sequence,L"capture test",settings),"helper captures image");
+        auto entries=history.entries();
+        require(entries.size()==2 && entries.front().image && entries.front().ocrState==1,"resident reloads metadata with pending OCR");
+        require(entries.front().contentHash.size()==64 && !entries.front().pixelHash.empty(),
+                "helper persists fingerprints and resident reloads them");
+        require(entries.back().id==pinned && entries.back().pinned,"helper preserves existing pinned entry");
+        auto restored=history.load(entries.front().id);
+        auto thumbnail=history.thumbnail(entries.front().id);
+        require(thumbnail.width==pixels.width && thumbnail.height==pixels.height && thumbnail.bgra==pixels.bgra,
+                "helper thumbnail preserves small image pixels");
+        bool thumbnailCancelled=false;
+        try {history.thumbnail(entries.front().id,[]{return true;});} catch(...) {thumbnailCancelled=true;}
+        require(thumbnailCancelled,"closed history cancels thumbnail work");
+        auto has=[&](const ks::Format &expected) {
+            return std::any_of(restored.formats.begin(),restored.formats.end(),[&](const ks::Format &actual) {
+                return (expected.name.empty()?actual.id==expected.id:actual.name==expected.name) && actual.data==expected.data;
+            });
+        };
+        require(has(image.formats[0]) && has(image.formats[1]),
+                "encrypted history preserves both image representations");
+        require(ks::readFile(folder/(entries.front().id+L".dat"),1024*1024)!=ks::encodeClip(restored),"saved image is encrypted");
+        require(GetClipboardSequenceNumber()==sequence,"capture leaves clipboard unchanged");
+        require(history.captureImage(sequence,L"capture test",settings) && history.entries().size()==2,"duplicate capture is not added");
+        ks::writeClipboard(owner,ks::textClip(L"new clipboard"));
+        require(!history.captureImage(sequence,L"stale",settings) && history.entries().size()==2,"stale request does not save another clipboard");
+        for(auto name : {L"ExcludeClipboardContentFromMonitorProcessing",L"Clipboard Viewer Ignore",L"CanIncludeInClipboardHistory"}) {
+            auto blocked=image; blocked.formats.push_back({0,name,ks::Bytes(4,0)});
+            sequence=ks::writeClipboard(owner,blocked);
+            require(!history.captureImage(sequence,L"excluded",settings) && history.entries().size()==2,"clipboard privacy flag prevents capture");
+        }
+        pixels={1024,512,ks::Bytes(1024*512*4,255)};
+        sequence=ks::writeClipboard(owner,ks::Clip{{ks::imageDib(pixels)}});
+        settings.maxImageMiB=1;
+        bool rejected=false;
+        try {history.captureImage(sequence,L"oversized",settings);} catch(const std::exception &e) {
+            rejected=std::string(e.what())=="Clipboard exceeds the configured size limit";
+        }
+        require(rejected && history.entries().size()==2,"oversized image is rejected without changing index");
+        require(GetClipboardSequenceNumber()==sequence,"rejection leaves clipboard unchanged");
+        settings.maxImageMiB=20;
+        history.add(ks::Clip{{ks::imageDib(pixels)}},L"thumbnail fixture",settings);
+        auto largeId=history.entries().front().id;
+        thumbnail=history.thumbnail(largeId);
+        require(thumbnail.width==208 && thumbnail.height==104 && thumbnail.bgra.size()==208*104*4,
+                "large image returns only bounded thumbnail pixels");
+        history.remove(largeId);
+        bool missingRejected=false;
+        try {history.thumbnail(largeId);} catch(...) {missingRejected=true;}
+        require(missingRejected,"deleted image cannot be previewed or recreated");
+        for(const auto &file:std::filesystem::directory_iterator(folder))
+            require(file.path().extension()!=L".request","encrypted capture request is cleaned up");
+    } catch(const std::exception &e) {std::cerr << "FAIL " << e.what() << '\n';result=1;}
+    if(captured) try {ks::writeClipboard(owner,saved);} catch(...) {result=1;}
+    DestroyWindow(owner); CoUninitialize();
+    // Remove only the exact PID-specific fixture under the system temp directory.
+    std::error_code ignored;
+    if(std::filesystem::weakly_canonical(folder).parent_path()==std::filesystem::weakly_canonical(std::filesystem::temp_directory_path()))
+        std::filesystem::remove_all(folder,ignored);
+    return result;
+}

tests/input.cpp

@@ -25,6 +25,38 @@ LRESULT CALLBACK countControlMoves(HWND w, UINT message, WPARAM wp, LPARAM lp, U
 }
 namespace ks {
 struct InputRegressionAccess {
+    static bool idleUndo(App &a) {
+        a.last=LastTransform{}; a.last->at=100;
+        a.releaseIdleMemory(120100);
+        if (!a.last) return false;
+        a.busy=true;
+        a.releaseIdleMemory(120101);
+        if (!a.last) { a.busy=false; return false; }
+        a.busy=false;
+        a.releaseIdleMemory(120101);
+        return !a.last;
+    }
+    static bool releasedSync(const App &a) {
+        return a.syncSnapshot.capacity()==0 && a.syncResult.settings.capacity()==0 &&
+            a.syncResult.base.capacity()==0 && a.syncResult.conflicts.capacity()==0;
+    }
+    static bool completedSync(App &a, int mode) {
+        sampleConflicts(a);
+        auto conflicts=encodeSyncConflicts(a.pendingSyncConflicts);
+        a.syncConnection=loadSyncConfig(a.data);
+        a.syncSnapshot=encodeSettings(a.settings);
+        a.syncResult={mode!=1,sharedSyncSettings(a.settings),2,L"test"};
+        a.syncResult.base=a.syncResult.settings;
+        a.syncResult.conflicts=a.pendingSyncConflicts;
+        if(mode==2) a.syncResult.settings={1,2,3}; // Decode exception after joining.
+        a.syncWorker=std::thread([]{});
+        a.syncRunning=true; a.syncDone=true; a.busy=true;
+        a.pollSync();
+        bool retained=!a.syncSnapshot.empty() && a.syncRunning;
+        a.busy=false; a.pollSync();
+        return retained && releasedSync(a) && !a.syncRunning &&
+            encodeSyncConflicts(a.pendingSyncConflicts)==conflicts;
+    }
     static inline bool delivery = true;
     static inline int notifications = 0;
     static bool notify(const std::wstring &) { ++notifications; return delivery; }
@@ -44,6 +76,7 @@ struct InputRegressionAccess {
         a.syncRunning=true; a.syncDone=true;
         a.pollSync();
         return encodeSettings(a.settings)==before && !a.syncRunning &&
+            releasedSync(a) &&
             !std::filesystem::exists(a.data/L"sync-base.bin");
     }
     static bool syncBackoff(App &a) {
@@ -61,6 +94,9 @@ struct InputRegressionAccess {
     }
     static void notificationSetup(App &a) { a.updateNotifier = notify; }
     static void setup(App &a) { a.hookBindings = {{Toggle,{MOD_CONTROL,VK_F12}}, {Case,{MOD_CONTROL|MOD_SHIFT,'U'}}}; }
+    static LRESULT routedKey(int code, UINT message, const KBDLLHOOKSTRUCT &key, LRESULT routed) {
+        return App::keyboardAfterHooks(code,message,(LPARAM)&key,routed);
+    }
     static bool updateTimer(App &a) {
         a.updateRunning=true; // Exercise timer scheduling without launching a network request.
         App::windowProc(a.window,WM_TIMER,5,0);
@@ -615,6 +651,22 @@ int main(int argc, char **argv) {
             };
             auto commands=[&] { MSG m{}; int n=0; while(PeekMessageW(&m,app.window,WM_HOTKEY,WM_HOTKEY,PM_REMOVE)) ++n; return n; };
             auto f12=event(VK_F12);
+            {
+                const auto before = app.inputVersion.load();
+                const auto recorded = app.run.keys;
+                for (UINT message : {WM_KEYDOWN, WM_KEYUP, WM_SYSKEYDOWN, WM_SYSKEYUP})
+                    require(ks::InputRegressionAccess::routedKey(HC_ACTION,message,event('A',30),7)==7,
+                            "forwarded keyboard events preserve downstream suppression");
+                require(app.inputVersion==before && app.run.keys==recorded && commands()==0,
+                        "forwarded events never track text, invalidate transactions or dispatch shortcuts");
+                require(ks::InputRegressionAccess::routedKey(-1,WM_KEYDOWN,event('A',30),0)==0 &&
+                        app.inputVersion==before,"negative hook codes do not process keyboard input");
+                require(ks::InputRegressionAccess::routedKey(HC_ACTION,WM_KEYDOWN,event('A',30,true),0)==0 &&
+                        app.inputVersion==before,"own input remains excluded after downstream routing");
+                require(ks::InputRegressionAccess::routedKey(HC_ACTION,WM_KEYDOWN,event('A',30),0)==0 &&
+                        app.inputVersion>before,"delivered remote input is still processed on the receiver");
+                app.run.reset();
+            }
             require(!app.handleKeyboard(event(VK_LCONTROL),true,0),"remote modifier passes through");
             require(app.handleKeyboard(f12,true,MOD_CONTROL),"remote Ctrl+F12 handled");
             require(app.handleKeyboard(f12,true,MOD_CONTROL),"remote repeat suppressed");
@@ -791,6 +843,10 @@ int main(int argc, char **argv) {
             require(IsWindowEnabled(app.settingsWindow),"closing sync restores parent");
             require(ks::InputRegressionAccess::staleSync(app,false),"in-flight sync cannot overwrite newer local edits");
             require(ks::InputRegressionAccess::staleSync(app,true),"disconnect discards in-flight downloaded profile");
+            require(ks::InputRegressionAccess::idleUndo(app),"idle cleanup retains available/busy Undo and frees expired Undo");
+            for(int mode=0;mode<3;++mode)
+                require(ks::InputRegressionAccess::completedSync(app,mode),
+                        "completed, failed and invalid sync release buffers but preserve conflict choices");
             require(ks::InputRegressionAccess::syncBackoff(app),"saving settings preserves authentication error backoff");
             SendMessageW(app.settingsWindow,WM_COMMAND,255,0);
             auto autoOptions=FindWindowW(L"KSwitcher.AutoOptions",nullptr);
@@ -875,6 +931,7 @@ int main(int argc, char **argv) {
             ks::showHistory(app,false);
             auto history=app.historyWindow;
             require(history&&!IsWindowVisible(history),"history layout tested without changing focus");
+            require(!GetDlgItem(history,105),"history creates no RichEdit control before formatted content is displayed");
             {
                 app.history=std::make_unique<ks::History>(temp/L"history-search");
                 app.history->add(ks::textClip(L"згенеруй приклад"),L"test",app.settings);
@@ -902,6 +959,27 @@ int main(int argc, char **argv) {
                 SetDlgItemTextW(history,101,L"");
                 require(pumpUntil(2),"clearing search restores history");
                 require(GetFocus()==originalFocus,"history search preserves focus");
+                SendDlgItemMessageW(history,102,LB_SETCURSEL,1,0);
+                ks::refreshHistory(app); // A result may still be in flight when closing.
+                SendDlgItemMessageW(history,101,WM_KEYDOWN,VK_ESCAPE,0);
+                require(!IsWindowVisible(history) && !GetDlgItem(history,105),
+                        "Escape closes history and leaves no RichEdit control");
+                SendMessageW(history,WM_TIMER,1,0); // KillTimer cannot retract a posted timer message.
+                require(pumpUntil(0),"closing history releases list strings");
+                auto until=GetTickCount64()+250;
+                while(GetTickCount64()<until) {
+                    MSG message{};
+                    while(PeekMessageW(&message,nullptr,0,0,PM_REMOVE)) {
+                        TranslateMessage(&message); DispatchMessageW(&message);
+                    }
+                    Sleep(5);
+                }
+                require(SendDlgItemMessageW(history,102,LB_GETCOUNT,0,0)==0,
+                        "late search results do not refill closed history");
+                ks::refreshHistory(app);
+                require(pumpUntil(2),"history reloads after releasing hidden rows");
+                require(SendDlgItemMessageW(history,102,LB_GETCURSEL,0,0)==1,
+                        "history retains selected record across close and reload");
             }
             auto childRect=[&](int id) { RECT r{}; GetWindowRect(GetDlgItem(history,id),&r); MapWindowPoints(nullptr,history,(POINT*)&r,2); return r; };
             RECT historyFrame{}; GetWindowRect(history,&historyFrame);

tests/integration.cpp

@@ -33,6 +33,17 @@ bool trimCopiedSpaces = false;
 int trimmedCopies = 0;
 bool temporaryClipboardExcluded = true;
 bool clipboardAccessTimedOut = false;
+uint64_t forwardedVersion{};
+int forwardedEvents{};
+LRESULT CALLBACK forwardingHook(int code, WPARAM wp, LPARAM lp)
+{
+    if (code == HC_ACTION && reinterpret_cast<KBDLLHOOKSTRUCT *>(lp)->dwExtraInfo == 456)
+    {
+        ++forwardedEvents;
+        return 1; // Model MWB consuming source input routed to another machine.
+    }
+    return CallNextHookEx(nullptr, code, wp, lp);
+}
 LRESULT CALLBACK observeEnter(HWND w, UINT message, WPARAM wp, LPARAM lp, UINT_PTR, DWORD_PTR)
 {
     if (message == WM_KEYDOWN && wp == VK_LEFT && droppedSelectionKeys > 0 &&
@@ -309,6 +320,8 @@ LRESULT CALLBACK procedure(HWND w, UINT msg, WPARAM wp, LPARAM lp)
                 app->settings.autoCorrect = true;
                 app->settings.switchLayout = true;
                 app->settings.autoLanguages = {L"en", L"ru"};
+                // Direct fixture mutations bypass applySettings' dictionary preload.
+                app->autoPredictor.configure(L"dictionaries", app->settings.autoLanguages);
                 app->settings.cycle = {app->layouts[en].id, app->layouts[ru].id};
                 ActivateKeyboardLayout(app->layouts[en].handle, 0);
                 prepare(L"ghbdtn ", false);
@@ -529,6 +542,9 @@ LRESULT CALLBACK procedure(HWND w, UINT msg, WPARAM wp, LPARAM lp)
                 require(text() == L"wrong ", "unrelated selection remains rejected with trimmed clipboard");
                 app->settings.autoCorrect = true;
                 app->settings.autoLanguages = {L"en", L"ru"};
+                // The worker now shares the predictor's immutable dictionaries.
+                // This fixture changes settings directly instead of applySettings.
+                app->autoPredictor.configure(L"dictionaries", app->settings.autoLanguages);
                 app->autoCorrector = ks::AutoCorrector{};
                 ActivateKeyboardLayout(app->layouts[en].handle, 0);
                 prepare(L"ghbdtn ", false);
@@ -556,13 +572,57 @@ LRESULT CALLBACK procedure(HWND w, UINT msg, WPARAM wp, LPARAM lp)
                 require(trimmedCopies >= 7, "fixture actually stripped spaces during recovery scenarios");
                 pasteBehavior = 0;
                 trimCopiedSpaces = false;
-                finish();
+                // User-selected middle range, followed by the same command with
+                // no selection: retain both surrounding text and trailing spaces.
+                prepare(L"OLDghbdtn  NEXT", false);
+                SendMessageW(field, EM_SETSEL, 3, 11);
+                app->transform(ks::Direct + ru);
                 break;
             }
+            case 58:
+                require(text() == L"OLDпривет  NEXT", "explicit middle selection preserves surrounding text");
+                app->transform(ks::Direct + en);
+                break;
+            case 59:
+                require(text() == L"OLDghbdtn  NEXT", "hotkey without selection reconverts only the previous middle range");
+                require(ks::readClipboard(app->window).text() == sentinel, "selected and repeated conversions restore clipboard");
+                finish();
+                break;
+            case 62:
+                saved = ks::readClipboard(app->window, 64 * 1024 * 1024);
+                captured = true;
+                app->ownSequence = ks::writeClipboard(app->window, ks::textClip(sentinel));
+                app->settings.snippets = {{L";r", L"unexpected{enter}"}};
+                ActivateKeyboardLayout(app->layouts[en].handle, 0);
+                prepare(L"prefix ", false);
+                forwardedVersion = app->inputVersion.load();
+                copyRequests = forwardedEvents = 0;
+                {
+                    std::vector<INPUT> inputs;
+                    for (WORD key : {WORD(VK_OEM_1), WORD('R')})
+                        for (DWORD flags : {DWORD(0), DWORD(KEYEVENTF_KEYUP)})
+                        {
+                            auto input = ks::keyboardInput(key, flags);
+                            input.ki.dwExtraInfo = 456;
+                            inputs.push_back(input);
+                        }
+                    require(SendInput((UINT)inputs.size(),inputs.data(),sizeof(INPUT))==inputs.size(),
+                            "forwarded snippet input submitted to real hook chain");
+                }
+                break;
+            case 63:
+                require(forwardedEvents==4,"downstream forwarding hook consumed every key event");
+                require(app->inputVersion==forwardedVersion && copyRequests==0,
+                        "forwarded snippet does not start tracking or clipboard work on source computer");
+                require(text()==L"prefix " && ks::readClipboard(app->window).text()==sentinel,
+                        "forwarded snippet leaves source editor and clipboard untouched");
+                stage = 30;
+                break;
             case 30:
             case 32:
             case 34:
             case 37:
+            case 60:
                 // Earlier password/word tests replace the original multiline
                 // editor with a single-line EDIT. Restore the snippet fixture:
                 // a single-line control cannot insert the tested Enter action.
@@ -591,6 +651,11 @@ LRESULT CALLBACK procedure(HWND w, UINT msg, WPARAM wp, LPARAM lp)
                 enterPresses = 0;
                 copyRequests = 0;
                 copyFailuresRemaining = stage == 38 ? 10 : stage == 33 ? 1 : 0;
+                if (stage == 61)
+                {
+                    pasteBehavior = 2; // Editor inserts unrelated clipboard text.
+                    app->settings.writeLog = false;
+                }
                 temporaryClipboardExcluded = true;
                 ActivateKeyboardLayout(app->layouts[en].handle, 0);
                 prepare(L"prefix ", false);
@@ -654,6 +719,13 @@ LRESULT CALLBACK procedure(HWND w, UINT msg, WPARAM wp, LPARAM lp)
                 require(ks::readClipboard(app->window).text() == sentinel,
                         "exhausted copy retries restore the clipboard");
                 copyFailuresRemaining = 0;
+                stage = 60;
+                break;
+            case 61:
+                require(text() == L"prefix other! x", "incorrect snippet paste preserves following typing");
+                require(enterPresses == 0, "unverified snippet never submits Enter even without logging");
+                require(ks::readClipboard(app->window).text() == sentinel, "rejected snippet restores clipboard");
+                pasteBehavior = 0;
                 finish();
                 break;
             case 20:
@@ -666,6 +738,7 @@ LRESULT CALLBACK procedure(HWND w, UINT msg, WPARAM wp, LPARAM lp)
                 app->settings.autoCorrect = true;
                 app->settings.switchLayout = true;
                 app->settings.autoLanguages = {L"en", L"ru"};
+                app->autoPredictor.configure(L"dictionaries", app->settings.autoLanguages);
                 app->settings.cycle = {app->layouts[en].id, app->layouts[ru].id};
                 app->autoCorrector = ks::AutoCorrector{};
                 ActivateKeyboardLayout(app->layouts[en].handle, 0);
@@ -715,6 +788,7 @@ LRESULT CALLBACK procedure(HWND w, UINT msg, WPARAM wp, LPARAM lp)
                 });
                 require(uk != app->layouts.end(), "Ukrainian layout available for punctuation-key regression");
                 app->settings.autoLanguages = {L"en", L"uk"};
+                app->autoPredictor.configure(L"dictionaries", app->settings.autoLanguages);
                 app->settings.cycle = {app->layouts[en].id, uk->id};
                 app->settings.autoWords[L"uk"] = {L"робить"};
                 app->autoCorrector = ks::AutoCorrector{};
@@ -965,9 +1039,12 @@ int main(int argc, char **argv)
             if (typosOnly || (argc > 1 && std::string(argv[1]) == "--typing-only"))
                 stage = 20;
             if (argc > 1 && std::string(argv[1]) == "--snippets-only")
-                stage = 30;
+                stage = 62;
             SetTimer(host, 1, 100, nullptr);
+            auto forwarding = SetWindowsHookExW(WH_KEYBOARD_LL,forwardingHook,GetModuleHandleW(nullptr),0);
+            require(forwarding!=nullptr,"downstream forwarding fixture installed before application hook");
             app->execute();
+            UnhookWindowsHookEx(forwarding);
         }
         std::filesystem::remove_all(root);
     }

tests/ocr.cpp

@@ -59,6 +59,24 @@ int main(int argc, char **argv)
             app.settings.history = true;
             app.history->add(clip, L"OCR fixture", app.settings);
             auto id = app.history->entries().front().id;
+            auto isolated = app.history->recognizeImage(id, config);
+            if (isolated != text) throw std::runtime_error("Helper and in-process OCR results differ");
+            bool cancelled = false;
+            try { app.history->recognizeImage(id, config, [] { return true; }); }
+            catch (const std::exception &) { cancelled = true; }
+            if (!cancelled) throw std::runtime_error("Cancelled OCR request was executed");
+            auto invalid = config;
+            invalid.useTesseract = true;
+            invalid.tesseractPath = (temp / L"missing-tesseract.exe").wstring();
+            bool failed = false;
+            try { app.history->recognizeImage(id, invalid); }
+            catch (const std::exception &) { failed = true; }
+            if (!failed || app.history->entries().front().ocrState != 1)
+                throw std::runtime_error("Failed helper modified history metadata");
+            for (const auto &file : std::filesystem::directory_iterator(temp / L"history"))
+                if (file.path().filename().wstring().starts_with(L"ocr-"))
+                    throw std::runtime_error("OCR helper left temporary files");
+            std::cout << "PASS isolated OCR equivalence, cancellation, failure and encrypted IPC cleanup\n";
             if (tesseract)
             {
                 app.history->saveOcr(id, L"old Windows result", app.settings);

tests/screenshot_registration.cpp

@@ -5,9 +5,11 @@
 static std::wstring programs;
 static std::wstring activationExecutable, activationCommand;
 static int activationCalls{};
+static DWORD launchFlags{}; static bool inheritsHandles{};
 static BOOL WINAPI testCreateProcess(LPCWSTR path, LPWSTR command, LPSECURITY_ATTRIBUTES,
-    LPSECURITY_ATTRIBUTES, BOOL, DWORD, LPVOID, LPCWSTR, LPSTARTUPINFOW, LPPROCESS_INFORMATION)
+    LPSECURITY_ATTRIBUTES, BOOL inherit, DWORD flags, LPVOID, LPCWSTR, LPSTARTUPINFOW, LPPROCESS_INFORMATION)
 {
+    launchFlags=flags; inheritsHandles=inherit;
     ++activationCalls; activationExecutable=path; activationCommand=command;
     SetLastError(ERROR_CANCELLED); return FALSE; // Inspect activation without starting any program.
 }
@@ -55,6 +57,14 @@ int main()
         valid=id.vt==VT_CLSID && *id.puuid==ks::ActivatorId; PropVariantClear(&id);
         if(!valid) throw std::runtime_error("shortcut activator missing");
         ks::registerScreenshotNotifications(); // Registration is safe to repeat.
+        bool launchFailed=false;
+        try { ks::startScreenshotNotificationRegistration(); }
+        catch(const std::exception &) { launchFailed=true; }
+        if(!launchFailed || activationExecutable!=helper.wstring() ||
+           activationCommand!=L"\""+helper.wstring()+L"\" --register-notifications" ||
+           !(launchFlags&CREATE_NO_WINDOW) || inheritsHandles)
+            throw std::runtime_error("registration must launch the sibling helper and propagate failure");
+        activationCalls=0;
         ks::Activator activator(helper.wstring(),false);
         activator.Activate(L"HrynCo.KSwitcher.Screenshot",L"check-update",nullptr,0);
         auto main=(helper.parent_path()/L"KSwitcher.exe").wstring();

tests/tests.cpp

@@ -4,6 +4,7 @@
 #include "richtext.h"
 #include "storage.h"
 #include "diagnostics.h"
+#include "json.hpp"
 #include <algorithm>
 #include <iostream>
 #include <map>
@@ -23,20 +24,6 @@ void rejects(const std::function<void()> &f, const char *name)
     bool thrown = false;
     try
     {
-        {
-            std::map<std::wstring,int> previews;
-            std::set<std::wstring> visible;
-            for(int i=0;i<40;++i) previews[std::to_wstring(i)]=i;
-            for(int i=0;i<8;++i) visible.insert(std::to_wstring(i));
-            ks::trimHistoryPreviews(previews,visible);
-            require(previews.size()==32,"preview cache stays bounded");
-            for(const auto &id:visible) require(previews.contains(id),"visible preview survives eviction");
-            for(int i=0;i<40;++i) { auto id=std::to_wstring(i); previews[id]=i; visible.insert(id); }
-            ks::trimHistoryPreviews(previews,visible);
-            require(previews.size()==40,"tall viewport does not thrash visible previews");
-            visible.clear(); ks::trimHistoryPreviews(previews,visible);
-            require(previews.size()==32,"cache shrinks after leaving tall viewport");
-        }
         f();
     }
     catch (...)
@@ -60,6 +47,34 @@ int main(int argc, char **argv)
     }
     try
     {
+        // Byte budgets must retain visible entries even when they alone exceed the budget.
+        {
+            std::map<std::wstring, size_t> cache{{L"a", 800}, {L"b", 800}, {L"c", 100}};
+            std::set<std::wstring> visible{L"b"};
+            auto weight=[](size_t bytes) { return bytes; };
+            ks::trimHistoryPreviews(cache, visible, 32, 1000, weight);
+            require(cache.size()==2 && cache.contains(L"b") && cache.contains(L"c"),
+                    "byte budget evicts offscreen previews below count limit");
+            ks::trimHistoryPreviews(cache, visible, 32, 100, weight);
+            require(cache.size()==1 && cache.contains(L"b"), "oversized visible preview never thrashes");
+            visible.clear();
+            ks::trimHistoryPreviews(cache, visible, 32, 100, weight);
+            require(cache.empty(), "oversized preview is freed after leaving viewport");
+        }
+        {
+            std::map<std::wstring,int> previews;
+            std::set<std::wstring> visible;
+            for(int i=0;i<40;++i) previews[std::to_wstring(i)]=i;
+            for(int i=0;i<8;++i) visible.insert(std::to_wstring(i));
+            ks::trimHistoryPreviews(previews,visible);
+            require(previews.size()==32,"preview cache stays bounded");
+            for(const auto &id:visible) require(previews.contains(id),"visible preview survives eviction");
+            for(int i=0;i<40;++i) { auto id=std::to_wstring(i); previews[id]=i; visible.insert(id); }
+            ks::trimHistoryPreviews(previews,visible);
+            require(previews.size()==40,"tall viewport does not thrash visible previews");
+            visible.clear(); ks::trimHistoryPreviews(previews,visible);
+            require(previews.size()==32,"cache shrinks after leaving tall viewport");
+        }
         {
             ks::DiagnosticJson record{{"attempt", "42"}, {"process", "editor.exe"}, {"command", "Convert / cycle"},
                 {"source", "English"}, {"target", "Ukrainian"}, {"outcome", "Original text remained"},
@@ -99,6 +114,10 @@ int main(int argc, char **argv)
                 "large diagnostic selections are explicitly truncated");
         STARTUPINFOW startup{sizeof(startup)};
         ks::DiagnosticBuffer diagnostics;
+        diagnostics.record(L"idle-expiry", false, 0);
+        require(diagnostics.expire(30000)==0,"diagnostics remain available at expiry boundary");
+        require(diagnostics.expire(30001)==1,"idle expiry releases context without another log event");
+        require(diagnostics.expire(60000)==0,"repeated idle expiry is safe");
         require(diagnostics.record(L"successful-attempt", false, 100).empty(),
                 "successful diagnostics stay in memory");
         auto incident = diagnostics.record(L"failed-attempt", true, 200);
@@ -171,6 +190,8 @@ int main(int argc, char **argv)
                 "HTML entities and Unicode survive without script text");
         require((effects(0, 6) & CFE_BOLD) != 0, "inline CSS bold is rendered");
         auto plain = ks::textClip(L"{\\literal} Привіт");
+        require(ks::richPreview(plain, false).empty(), "plain history preview does not require RichEdit");
+        require(!ks::richPreview(styled, false).empty(), "formatted history preview retains HTML rendering");
         ks::setRichText(rich, ks::richPreview(plain));
         GetWindowTextW(rich, rendered, 256);
         require(std::wstring(rendered) == plain.text(), "plain Unicode and RTF metacharacters are escaped");
@@ -217,6 +238,26 @@ int main(int argc, char **argv)
         require(!autoSettings.autoCorrect, "auto-correction defaults off");
         autoSettings.cycle = {L"en", L"uk"};
         corrector.configure(L"dictionaries", autoSettings.autoLanguages);
+        {
+            ks::AutoCorrector consumer;
+            consumer.shareDictionaries(corrector);
+            require(consumer.suggest(L"ghbdsn ", 0, layouts, autoSettings).has_value(),
+                    "shared dictionaries produce the same correction");
+            consumer.reject(L"ghbdsn");
+            consumer.shareDictionaries(corrector);
+            require(!consumer.suggest(L"ghbdsn ", 0, layouts, autoSettings),
+                    "refreshing shared dictionaries preserves consumer undo rejections");
+            require(corrector.suggest(L"ghbdsn ", 0, layouts, autoSettings).has_value(),
+                    "consumer rejections do not affect the predictor");
+            ks::AutoCorrector retained;
+            retained.shareDictionaries(corrector);
+            corrector.configure({}, {});
+            require(retained.suggest(L"ghbdsn ", 0, layouts, autoSettings).has_value(),
+                    "in-flight dictionary snapshot survives source reset");
+            consumer.shareDictionaries(corrector);
+            require(consumer.memoryBytes() == 0, "disabled correction releases consumer dictionaries");
+            corrector.shareDictionaries(retained);
+        }
         {
             auto options = autoSettings;
             options.autoTypos = true;
@@ -476,6 +517,24 @@ int main(int argc, char **argv)
         auto encoded = ks::encodeClip(clip);
         require(ks::decodeClip(encoded).text() == clip.text(), "clipboard Unicode roundtrip");
         require(ks::decodeClip(encoded).formats[1].name == L"HTML Format", "registered format identity");
+        auto selection = ks::textClip(L";pa");
+        selection.formats.push_back({0, L"vscode-editor-data", {1, 2, 3}});
+        auto relayed = selection;
+        relayed.formats.front().data.resize(128, 0xab);
+        std::reverse(relayed.formats.begin(), relayed.formats.end());
+        require(ks::selectionClipboardIdentity(selection) == ks::selectionClipboardIdentity(relayed),
+                "clipboard relay tolerates Unicode allocation slack and format order");
+        relayed.formats.front().data[0] ^= 1;
+        require(ks::selectionClipboardIdentity(selection) != ks::selectionClipboardIdentity(relayed),
+                "clipboard relay rejects changed editor metadata");
+        relayed = selection;
+        relayed.formats.pop_back();
+        require(ks::selectionClipboardIdentity(selection) != ks::selectionClipboardIdentity(relayed),
+                "clipboard relay rejects missing editor metadata");
+        relayed = selection;
+        relayed.formats.front() = ks::textClip(L";pb").formats.front();
+        require(ks::selectionClipboardIdentity(selection) != ks::selectionClipboardIdentity(relayed),
+                "clipboard relay rejects changed Unicode text");
         auto encrypted = ks::protect(encoded);
         require(encrypted != encoded, "history ciphertext differs");
         require(ks::unprotect(encrypted) == encoded, "Windows DPAPI roundtrip");
@@ -545,6 +604,20 @@ int main(int argc, char **argv)
             require(!ambiguous.suggest(L"hell ", 0, layouts, options), "frequency filter does not conceal ambiguous typo targets");
         }
         ks::Pixels pixels{2, 1, {10, 20, 30, 255, 40, 50, 60, 255}};
+        {
+            auto png = ks::encodePng(pixels);
+            ks::Clip encoded{{{0, L"PNG", png}}};
+            for (int i=0; i<3; ++i) {
+                auto decoded=ks::decodeImage(encoded);
+                require(decoded.bgra==pixels.bgra && decoded.width==2 && decoded.height==1,
+                        "borrowed PNG stream preserves decoded pixels on repeated reads");
+                require(encoded.formats[0].data==png,"PNG decoder never modifies the borrowed input");
+            }
+            ks::Clip fallback{{{0,L"PNG",{}},ks::imageDib(pixels)}};
+            require(ks::decodeImage(fallback).bgra==pixels.bgra,"empty PNG falls back to DIB");
+            ks::Clip invalid{{{0,L"PNG",{1,2,3}}}};
+            rejects([&] { ks::decodeImage(invalid); },"invalid borrowed PNG fails safely");
+        }
         ks::Clip firstImage{{ks::imageDib(pixels), {0, L"Ole Private Data", {1, 2, 3}}}};
         auto thumbnail = ks::decodeImage(firstImage, 1, 1);
         require(thumbnail.width == 1 && thumbnail.height == 1 && thumbnail.bgra.size() == 4,
@@ -583,6 +656,55 @@ int main(int argc, char **argv)
                     "Snipping Tool republish retains one pinned history entry");
             history.add(changedImage, L"SnippingTool", defaults);
             require(history.entries().size() == 2, "a new screenshot is retained");
+            auto copiedText = ks::textClip(L"text after screenshot");
+            history.add(copiedText, L"Editor", defaults);
+            history.add(copiedText, L"Editor", defaults);
+            require(history.entries().size() == 3 && !history.entries().front().image,
+                    "text after screenshot is retained and consecutive text duplicates are skipped");
+            history.add(changedImage, L"SnippingTool", defaults);
+            history.add(changedImage, L"SnippingTool", defaults);
+            require(history.entries().size() == 4 && history.entries().front().image,
+                    "image after text is retained and consecutive image duplicates are skipped");
+            history.add(withText, L"Editor", defaults);
+            require(history.entries().size() == 5,
+                    "mixed image and text payload is not discarded by metadata prefilter");
+        }
+        {
+            auto folder = temp / L"fingerprints";
+            ks::Settings defaults;
+            ks::History history(folder);
+            history.add(firstImage, L"test", defaults);
+            auto id = history.entries().front().id;
+            history.pin(id);
+            history.saveOcr(id, L"retained OCR", defaults);
+            ks::History reopened(folder);
+            require(reopened.entries().front().contentHash.size() == 64,
+                    "SHA-256 fingerprint survives encrypted index reload");
+            // Deny payload reads: duplicates must still be detected using only the index.
+            auto handle = CreateFileW((folder / (id + L".dat")).c_str(), GENERIC_READ, 0, nullptr,
+                                      OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
+            require(handle != INVALID_HANDLE_VALUE, "lock image payload for no-read regression");
+            reopened.add(firstImage, L"test", defaults);
+            reopened.add(secondImage, L"test", defaults);
+            reopened.add(recoded, L"test", defaults);
+            CloseHandle(handle);
+            require(reopened.entries().size() == 1 && reopened.entries().front().pinned &&
+                    reopened.ocrText(id) == std::optional<std::wstring>(L"retained OCR"),
+                    "exact, OLE and pixel-equivalent duplicates need no payload read and retain pin/OCR");
+            auto index = nlohmann::json::parse(ks::unprotect(ks::readFile(folder / L"index.dat", 1024*1024)));
+            for (auto &entry : index)
+                for (auto key : {"fingerprintVersion", "contentHash", "imageHash", "pixelHash"}) entry.erase(key);
+            auto legacy = index.dump();
+            ks::atomicWrite(folder / L"index.dat", ks::protect(ks::Bytes(legacy.begin(), legacy.end())));
+            ks::History migrated(folder);
+            migrated.add(secondImage, L"test", defaults);
+            ks::History persisted(folder);
+            require(persisted.entries().size() == 1 && persisted.entries().front().contentHash.size() == 64,
+                    "legacy duplicate migrates fingerprints without adding or losing an entry");
+            persisted.add(changedImage, L"test", defaults);
+            require(persisted.entries().size() == 2, "pixel fingerprint preserves genuinely changed images");
+            persisted.add(firstImage, L"test", defaults);
+            require(persisted.entries().size() == 3, "hash deduplication remains consecutive rather than global");
         }
         ks::Settings settings;
         settings.writeLog = false;

tools/measure-memory-components.ps1

@@ -0,0 +1,61 @@
+param([ValidateRange(1,20)][int]$Runs=3,[ValidateRange(100,10000)][int]$SettleMilliseconds=1500)
+# Private resident pages are counted externally, so the measurement buffer is
+# allocated in PowerShell, not in the measured process. Never trim working sets.
+$ErrorActionPreference='Stop'
+$root=Split-Path $PSScriptRoot -Parent
+$output=Join-Path $root 'build/memory-components'
+New-Item -ItemType Directory -Force $output | Out-Null
+$exe=Join-Path $output 'probe.exe'
+& "$root/.tools/w64devkit/bin/g++.exe" -std=c++20 -Os -static -s -DUNICODE -D_UNICODE -D_WIN32_WINNT=0x0A00 "$PSScriptRoot/memory-components.cpp" -o $exe -lole32 -loleaut32 -lshell32 -lpropsys -lshlwapi -luuid -luiautomationcore
+if($LASTEXITCODE) { throw 'Probe compilation failed' }
+Add-Type @'
+using System;
+using System.Runtime.InteropServices;
+public static class ComponentWorkingSet {
+ [DllImport("psapi.dll", SetLastError=true)] static extern bool QueryWorkingSet(IntPtr process,IntPtr buffer,int size);
+ public static long PrivateBytes(IntPtr process) {
+  int size=4*1024*1024;
+  IntPtr buffer=Marshal.AllocHGlobal(size);
+  try {
+   if(!QueryWorkingSet(process,buffer,size)) throw new System.ComponentModel.Win32Exception();
+   long count=Marshal.ReadIntPtr(buffer).ToInt64(), pages=0;
+   if(count>(size/IntPtr.Size)-1) throw new InvalidOperationException("Working set buffer is too small");
+   for(int i=0;i<count;i++) if((Marshal.ReadIntPtr(buffer,(i+1)*IntPtr.Size).ToInt64() & 256)==0) pages++;
+   return pages*Environment.SystemPageSize;
+  } finally { Marshal.FreeHGlobal(buffer); }
+ }
+}
+'@
+$rows=[Collections.Generic.List[object]]::new()
+foreach($run in 1..$Runs) {
+ foreach($mode in @('baseline','sta','mta','shell','uia','focused','combined')) {
+  $start=[Diagnostics.ProcessStartInfo]::new($exe,$mode)
+  $start.UseShellExecute=$false; $start.CreateNoWindow=$true
+  $start.RedirectStandardOutput=$true; $start.RedirectStandardInput=$true; $start.RedirectStandardError=$true
+  $process=[Diagnostics.Process]::Start($start)
+  $errors=$process.StandardError.ReadToEndAsync()
+  try {
+   foreach($expected in @('baseline','com','active','released','uninitialized')) {
+    $pending=$process.StandardOutput.ReadLineAsync()
+    if(!$pending.Wait(15000)) { throw "Timeout: $mode/$expected" }
+    $phase=$pending.Result
+    if($phase -ne $expected) { throw "Unexpected phase '$phase', expected $expected" }
+    Start-Sleep -Milliseconds $SettleMilliseconds
+    $process.Refresh()
+    $rows.Add([pscustomobject]@{Run=$run;Mode=$mode;Phase=$phase;PrivateBytes=$process.PrivateMemorySize64;PrivateWorkingSet=[ComponentWorkingSet]::PrivateBytes($process.Handle);WorkingSet=$process.WorkingSet64;Threads=$process.Threads.Count;Modules=@($process.Modules | ForEach-Object ModuleName)})
+    $process.StandardInput.Write("`n"); $process.StandardInput.Flush()
+   }
+   if(!$process.WaitForExit(15000)) { throw 'Exit timeout' }
+   if($process.ExitCode) { throw "Probe failed: $($errors.Result)" }
+   $errors.Result | Set-Content (Join-Path $output "$run-$mode.txt")
+  } finally {
+   if(!$process.HasExited) { $process.Kill(); $process.WaitForExit() }
+   $process.Dispose()
+   $rows | ConvertTo-Json -Depth 5 | Set-Content (Join-Path $output 'results.json')
+  }
+  Write-Host "Completed $run/$Runs $mode"
+ }
+}
+$rows | Group-Object Mode,Phase | ForEach-Object {
+ [pscustomobject]@{Case=$_.Name;PrivateMiB=[math]::Round(($_.Group.PrivateBytes | Measure-Object -Average).Average/1MB,3);PrivateWorkingSetMiB=[math]::Round(($_.Group.PrivateWorkingSet | Measure-Object -Average).Average/1MB,3)}
+} | Format-Table

tools/memory-components.cpp

@@ -0,0 +1,65 @@
+// Standalone attribution probe. No clipboard, registry or user input mutations.
+#include <windows.h>
+#include <shlobj.h>
+#include <propkey.h>
+#include <propvarutil.h>
+#include <uiautomation.h>
+#include <cstdio>
+#include <cstring>
+#include <cstdlib>
+
+static void check(HRESULT hr) {
+    if (FAILED(hr)) { fprintf(stderr,"HRESULT=%08lx\n",(unsigned long)hr); exit(2); }
+}
+static void phase(const char *name) {
+    printf("%s\n",name); fflush(stdout);
+    if (getchar()==EOF) exit(3);
+}
+int main(int argc,char **argv) {
+    const char *mode=argc>1?argv[1]:"baseline";
+    const bool baseline=!strcmp(mode,"baseline");
+    const bool shell=!strcmp(mode,"shell") || !strcmp(mode,"combined");
+    const bool uia=!strcmp(mode,"uia") || !strcmp(mode,"focused") || !strcmp(mode,"combined");
+    phase("baseline");
+    if(!baseline) check(CoInitializeEx(nullptr,!strcmp(mode,"sta") || shell ? COINIT_APARTMENTTHREADED : COINIT_MULTITHREADED));
+    phase("com");
+    IShellLinkW *link{}; IPropertyStore *store{}; IPersistFile *file{};
+    IUIAutomation2 *automation{}; IUIAutomationElement *element{}; IUIAutomationTextPattern *pattern{};
+    wchar_t temporary[MAX_PATH]{},shortcut[MAX_PATH]{},exe[MAX_PATH]{};
+    if(shell) {
+        check(CoCreateInstance(CLSID_ShellLink,nullptr,CLSCTX_INPROC_SERVER,IID_PPV_ARGS(&link)));
+        GetModuleFileNameW(nullptr,exe,MAX_PATH);
+        check(link->SetPath(exe)); check(link->SetIconLocation(exe,0));
+        check(link->QueryInterface(IID_PPV_ARGS(&store)));
+        PROPVARIANT value{}; check(InitPropVariantFromString(L"KSwitcher.MemoryProbe",&value));
+        check(store->SetValue(PKEY_AppUserModel_ID,value)); PropVariantClear(&value);
+        GUID id{0xe3f78047,0xf0ad,0x49b6,{0x90,0x74,0x41,0x19,0x31,0x70,0x61,0x67}};
+        value.vt=VT_CLSID; value.puuid=&id;
+        check(store->SetValue(PKEY_AppUserModel_ToastActivatorCLSID,value)); check(store->Commit());
+        PWSTR programs{}; check(SHGetKnownFolderPath(FOLDERID_Programs,0,nullptr,&programs)); CoTaskMemFree(programs);
+        GetTempPathW(MAX_PATH,temporary); if(!GetTempFileNameW(temporary,L"ksm",0,shortcut)) return 4;
+        check(link->QueryInterface(IID_PPV_ARGS(&file))); check(file->Save(shortcut,TRUE));
+    }
+    if(uia) {
+        check(CoCreateInstance(CLSID_CUIAutomation8,nullptr,CLSCTX_INPROC_SERVER,IID_PPV_ARGS(&automation)));
+        check(automation->put_ConnectionTimeout(200)); check(automation->put_TransactionTimeout(200));
+        if(strcmp(mode,"uia")) {
+            HRESULT focused=automation->GetFocusedElement(&element);
+            fprintf(stderr,"focus=%08lx\n",(unsigned long)focused);
+            if(SUCCEEDED(focused) && element) {
+                BOOL password=TRUE,enabled=FALSE; CONTROLTYPEID type{};
+                element->get_CurrentIsPassword(&password); element->get_CurrentIsEnabled(&enabled); element->get_CurrentControlType(&type);
+                fprintf(stderr,"type=%d enabled=%d protected=%d\n",type,enabled,password);
+                if(!password) fprintf(stderr,"pattern=%08lx\n",(unsigned long)element->GetCurrentPatternAs(UIA_TextPatternId,IID_PPV_ARGS(&pattern)));
+            }
+        }
+    }
+    phase("active");
+    if(pattern) pattern->Release(); if(element) element->Release(); if(automation) automation->Release();
+    if(file) file->Release(); if(store) store->Release(); if(link) link->Release();
+    if(shortcut[0]) DeleteFileW(shortcut);
+    phase("released");
+    if(!baseline) { CoFreeUnusedLibrariesEx(0,0); CoUninitialize(); }
+    phase("uninitialized");
+    return 0;
+}