Hold what a widget answers with a rule, and its box with a widget

Bryan's call, given the measurements in `76aaf06`: `SizeRule::{Min, Max,
Clamp}` holds the length a widget answers and never touches the box it draws
in, and `MaxSize` is the box version.

The split is the difference between a rule and a widget here. A box is
whoever asked's to decide, and the retained machinery hands a widget one by
paths that never ask it anything -- a parent re-placing a child, a subtree
repositioned after its parent's box moved. A rule that read the box was
therefore decided again by whichever path arrived last, which is what the
oracle was refusing. A widget has no such trouble: it is drawn again whenever
its own box changes, so `MaxSize` asks `longer_than` where the answer can be
kept, and `region_len` pins the box lengths its drawing holds for.

What that costs is nothing the app wanted: `a_capped_scroll_takes_its_
viewport_from_the_cap` puts 400 px of content under `.max_height(100)` and
gets a 100 px viewport with 300 to scroll, which is what `MaxSize` gave on the
app's pin, and `.max_width`/`.max_height` are that widget rather than a rule.
A cap narrows the offer and not a declared length, so a child that declares
500 px still draws 500 and the cap holds what `MaxSize` itself answers; a
child that asked for a share takes the box the cap allows and the share passes
up, since whoever divides one is `MaxSize`'s parent.

`.min_width`/`.min_height` stay a rule: answering at least so much is a claim
about the length, and a row honours it without anyone narrowing anything.

Bounds in the generated trees are pixels for now, with the reason written
where the next tree is grown: a fraction in a bound is resolved against the
rel base the widget was asked with, and `place_at` hands a parent a retained
answer without checking that it still holds for the rel base this place
gives. Seeds 4 and 196 at depth 5 are where that showed. The hole is older
than bounds -- an `Exact` rule that is a fraction can reach it too -- and
closing it is a check at the re-place site rather than anything about bounds.
A fraction through `MaxSize` is fine and tested, since the widget compares
against its own box.

Format, clippy with and without layout-diagnostics, and the suite (142 + 19 +
13 + 4) are clean. All three seed scans pass: 400 at depth 5 (62s), 1,000 at
depth 6 (162s), 2,000 at depth 4 (299s). The cold dump is 34,986 boxes and
moves wholesale against `2dba90b`, which is the generator growing rules it
did not grow before rather than a layout change; it is the new baseline.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/src/orientation/len.rs

@@ -23,6 +23,14 @@ pub struct LayoutLen {
     pub leftover: Weight,
 }
 
+/// A bare number is pixels, which is the one length that needs no box to be
+/// read in.
+impl<N: UiNum> From<N> for Len {
+    fn from(value: N) -> Self {
+        Len::px(value.to_f32())
+    }
+}
+
 impl<N: UiNum> From<N> for LayoutLen {
     fn from(value: N) -> Self {
         LayoutLen::px(value.to_f32())

core/src/ui/active.rs

@@ -1,6 +1,6 @@
 use crate::{
-    Declared, LayerId, LayoutHolds, MaskIdx, MoveIdx, PlaceDesc, RegionAlign, RetainedPrimitive,
-    Size, TextureHandle, UiRegion, UiVec2, WidgetId,
+    Bounds, Declared, LayerId, LayoutHolds, MaskIdx, MoveIdx, PlaceDesc, RegionAlign,
+    RetainedPrimitive, Size, TextureHandle, UiRegion, UiVec2, WidgetId,
 };
 
 /// What is kept of a widget its parent has asked about. `drawn` says whether
@@ -58,6 +58,10 @@ pub struct ActiveData {
     /// A change to one moves a box this widget cannot fix by drawing again,
     /// and comparing them is what says so.
     pub declared: Declared,
+    /// Its bounds, resolved the same way. The answer is held to these where
+    /// the box was not, so a change to one changes what it answers even
+    /// where its declared lengths stand.
+    pub bounds: Bounds,
     /// Its alignment when it was last drawn, which a change to the property
     /// is found against.
     pub own_align: RegionAlign,

core/src/ui/holds.rs

@@ -1,4 +1,4 @@
-use crate::{Len, Px, REL_SHIFT, fixed::div_toward, fixed::narrow};
+use crate::{Bound, Len, Outside, Px, REL_SHIFT, fixed::div_toward, fixed::narrow};
 use std::ops::RangeInclusive;
 
 /// The lengths of a box, in pixels, that one drawing of a widget holds for:
@@ -19,6 +19,64 @@ pub struct Holds {
     pub hi: Px,
 }
 
+impl Len {
+    /// Whether this is longer than `than` in a window this wide, and the
+    /// windows that answer holds for.
+    ///
+    /// Which is longer is a question in pixels -- `rel(0.5)` is longer than
+    /// 300 px at a box of 600 and shorter at 400 -- and it is asked of the
+    /// difference and answered back through that same difference, so the
+    /// boundary is the comparison's own rather than a second way of finding
+    /// it.
+    pub fn longer_than(&self, than: Len, window: Px) -> (bool, Holds) {
+        let over = *self - than;
+        let longer = over.to_px(window) > Px::ZERO;
+        let side = match longer {
+            true => Px::STEP..=Px::MAX,
+            false => Px::MIN..=Px::ZERO,
+        };
+        (longer, Holds::from(side).through(over))
+    }
+}
+
+impl Bound {
+    /// Which end of this bound `len` falls outside, and the windows that
+    /// answer holds for. Nothing where it is inside, which is the answer
+    /// wherever there is no bound at all.
+    ///
+    /// `len` and this bound are lengths of the same thing, whichever that
+    /// is: a box in window lengths wants the bound resolved, and a length a
+    /// widget declares of its rel base wants it as the rule wrote it. Both
+    /// comparisons are in pixels, so each is a question about this window,
+    /// and the box is decided again on the other side of a crossing.
+    pub fn outside(&self, len: Len, window: Px) -> (Option<Outside>, Holds) {
+        let mut outside = None;
+        let mut holds = Holds::ANY;
+        let mut held = len;
+        if let Some(min) = self.min {
+            let (shorter, kept) = min.longer_than(held, window);
+            holds = holds.and(kept);
+            if shorter {
+                outside = Some(Outside::Shorter);
+                held = min;
+            }
+        }
+        if let Some(max) = self.max {
+            let (longer, kept) = held.longer_than(max, window);
+            holds = holds.and(kept);
+            if longer {
+                debug_assert!(
+                    outside.is_none(),
+                    "a floor of {:?} over a cap of {max:?} bounds nothing",
+                    self.min,
+                );
+                outside = Some(Outside::Longer);
+            }
+        }
+        (outside, holds)
+    }
+}
+
 impl Holds {
     pub const ANY: Self = Self {
         lo: Px::MIN,

core/src/ui/painter.rs

@@ -1,8 +1,8 @@
 #[cfg(feature = "layout-diagnostics")]
 use crate::layout_diagnostics::{self as diag, Counter};
 use crate::{
-    Axis, Declared, Holds, LayoutHolds, LayoutLen, Len, PlaceDesc, Px, PxVec2, RegionAlign, Rel,
-    RenderedText, RetainedPrimitive, Size, StrongWidget, TextAttrs, TextBuffer, TextureHandle,
+    Axis, Bounds, Declared, Holds, LayoutHolds, LayoutLen, Len, PlaceDesc, Px, PxVec2, RegionAlign,
+    Rel, RenderedText, RetainedPrimitive, Size, StrongWidget, TextAttrs, TextBuffer, TextureHandle,
     UiRegion, UiRenderState, UiRsc, UiVec2, Weight, WidgetId, Widgets,
     render::{
         GlyphPrimitive, Mask, MaskIdx, MoveIdx, Primitive, PrimitiveInst, PrimitiveKind,
@@ -187,12 +187,18 @@ impl<'a> Painter<'a> {
         id: &'s StrongWidget<W>,
         place: impl Into<PlaceDesc>,
     ) -> DrawResult<'s, 'a, W> {
-        let place = self.resolve_rel_base(place.into());
+        let offer = self.resolve_rel_base(place.into());
+        let Ask {
+            rel_base,
+            region,
+            place,
+            declared,
+            bounds,
+            holds: ask_holds,
+        } = self
+            .placing()
+            .ask(self.rsc.widgets(), self.window, id.id(), offer);
         let region_node = self.rsc.widgets().is_region_node(id.id());
-        let declared = self.declared_lens(id);
-        let align = self.rsc.widgets().alignment(id.id());
-        let (rel_base, region) =
-            place.rel_base_and_region(self.region, self.rel_base, declared, align);
         #[cfg(feature = "layout-diagnostics")]
         if region_node {
             diag::bump(Counter::RegionNodeDraws);
@@ -215,7 +221,10 @@ impl<'a> Painter<'a> {
                 rel_base,
                 region,
                 placed: place,
-                asked: place,
+                asked: offer,
+                declared,
+                bounds,
+                ask_holds,
                 re_asked,
             },
             None,
@@ -282,7 +291,7 @@ impl<'a> Painter<'a> {
     /// This widget as the thing its children are placed within.
     fn placing(&self) -> Placing {
         Placing {
-            id: self.id,
+            id: Some(self.id),
             region: self.region,
             rel_base: self.rel_base,
             depth: self.depth,
@@ -291,14 +300,6 @@ impl<'a> Painter<'a> {
         }
     }
 
-    /// What a rule or a hint declares a widget's lengths to be, which whoever
-    /// draws it resolves into its rel base. Reading them depends on nothing -- the box
-    /// that comes of them is kept on the child, and `redraw` compares it
-    /// there.
-    fn declared_lens<W: ?Sized>(&self, id: &StrongWidget<W>) -> Declared {
-        self.rsc.widgets().declared_lens(id.id())
-    }
-
     /// What a child says its length is without being drawn, if it can say,
     /// as the length its draw would report: a fraction in it is resolved
     /// against this widget's rel base, which is the rel base a child asked with
@@ -475,6 +476,26 @@ impl<'a> Painter<'a> {
         len.to_px(window)
     }
 
+    /// [`Len::longer_than`], asked on this widget's behalf: the windows the
+    /// comparison comes out the same way on are windows its drawing holds
+    /// for, and nowhere else does it. What a container has left for the
+    /// shares it divides is the one thing that asks.
+    ///
+    /// Narrowed rather than stated, because whatever else this widget read
+    /// about the window is a reason its drawing holds where it does too.
+    pub fn longer_than(&mut self, len: Len, than: Len, axis: Axis) -> bool {
+        let window = self.window[axis];
+        let (longer, holds) = len.longer_than(than, window);
+        debug_assert!(
+            holds.contains(window),
+            "'{}' ({:?}) compared two lengths and kept a range without this window",
+            self.label(),
+            self.id
+        );
+        self.own[axis].window = self.own[axis].window.and(holds);
+        longer
+    }
+
     /// The windows this drawing holds for, stated rather than taken: a
     /// container that branched on a length in pixels says which side of the
     /// boundary it was on, which is wider than the one window reading that
@@ -663,6 +684,127 @@ impl Widgets {
     }
 }
 
+/// One ask of a widget: the box it draws in, what its fractions are of, and
+/// what deciding those read.
+pub(super) struct Ask {
+    pub rel_base: UiVec2,
+    pub region: UiRegion,
+    /// The place the ask came to, which a rule of the widget's own can take
+    /// past the box its parent offered.
+    pub place: PlaceDesc,
+    /// What the widget's box is on each axis where something says so
+    /// outright: its rule or its hint, or a bound of its own that the box it
+    /// was offered falls outside -- a bound that binds is a declaration, and
+    /// the same one the widget answers with.
+    pub declared: Declared,
+    /// Its bounds, resolved against the rel base its rules were resolved
+    /// against, for the answer to be held to where the box was not.
+    pub bounds: Bounds,
+    /// What the ask itself holds for, kept on the widget asked about: a rule
+    /// compared against the offer in pixels holds only for the windows on its
+    /// side of the crossing, and that range reaches whoever asked through the
+    /// drawing it is part of. Kept on the widget asked about rather than on
+    /// the asker because the root has no asker.
+    pub holds: LayoutHolds,
+}
+
+impl Placing {
+    /// Asks about a widget at `place` of this box, with the widget's own
+    /// rules applied to what the place offers it. `place` is resolved: what
+    /// a rel base of the asker's is a fraction of, the asker worked out.
+    ///
+    /// Every ask is this one, the root's included -- there the box is the
+    /// window and nothing above narrowed it, which is what [`Self::WINDOW`]
+    /// says.
+    pub(super) fn ask(
+        &self,
+        widgets: &Widgets,
+        window: PxVec2,
+        id: WidgetId,
+        mut place: PlaceDesc,
+    ) -> Ask {
+        let align = widgets.alignment(id);
+        let rules = widgets.size_rules(id);
+        let mut holds = LayoutHolds::ANY;
+        let declared = widgets.declared_lens(id);
+        let mut bounds = Bounds::ANY;
+        for axis in Axis::BOTH {
+            let base = place.base(axis, self.rel_base);
+            // A share fills what the pixels and fraction beside it leave of
+            // the box and overflows where they are longer, which is the rule
+            // a span follows with one child. Only the overflow is a box of
+            // the widget's own: a share that fits is the box it was given,
+            // which is what this place already says.
+            let (share, kept) =
+                self.share_past_the_offer(widgets, window[axis], id, place, align, axis);
+            holds[axis].window = holds[axis].window.and(kept);
+            if let Some(len) = share {
+                place[axis] = len.as_desc().fills();
+            }
+            // A bound holds what the widget answers, not the box it is asked
+            // in: the box it is given is whoever asked's to decide, and a
+            // rule that read it would be decided again by every path that
+            // hands the widget a box -- including the ones that never ask it
+            // anything. Resolved here because only the ask knows the rel base
+            // a fraction in it is of. `MaxSize` is the box version, and it is
+            // a widget because a widget is drawn again when its box changes.
+            bounds[axis] = rules[axis].bound().within_len(base);
+        }
+        let (rel_base, region) =
+            place.rel_base_and_region(self.region, self.rel_base, declared, align);
+        Ask {
+            rel_base,
+            region,
+            place,
+            declared,
+            bounds,
+            holds,
+        }
+    }
+
+    /// The box a widget's own share asks for where that is longer than the
+    /// box `place` gives it, and nothing where the share fits -- with the
+    /// windows that answer holds for, which is a range either way.
+    ///
+    /// A share is a length only to whoever divides one, and nothing divides a
+    /// box handed to one child: what is left of it after the pixels and the
+    /// fraction beside the share is what the share takes, so the length comes
+    /// to the whole box until those are longer than it and to them once they
+    /// are. Only that second case is a box its parent did not give, and the
+    /// crossing between them is a question in pixels.
+    fn share_past_the_offer(
+        &self,
+        widgets: &Widgets,
+        window: Px,
+        id: WidgetId,
+        place: PlaceDesc,
+        align: RegionAlign,
+        axis: Axis,
+    ) -> (Option<Len>, Holds) {
+        // A place that is the widget's placement outright is a box its parent
+        // decided, and a parent that divides one has already given the share
+        // whatever it was owed. Only an offer -- a box with the answer still
+        // to be placed inside it -- is a box a share reads.
+        if place[axis].fills {
+            return (None, Holds::ANY);
+        }
+        // A share with nothing beside it is the box whatever the box is, so
+        // there is no comparison to make and no range to keep for one.
+        let Some(stated) = widgets.exact_len(id, axis) else {
+            return (None, Holds::ANY);
+        };
+        if stated.leftover == Weight::ZERO || stated.is_only_leftover() {
+            return (None, Holds::ANY);
+        }
+        let fixed = stated
+            .without_leftover()
+            .within_len(place.base(axis, self.rel_base));
+        let offer = place.of(self.region, align)[axis].len();
+        let (longer, holds) = fixed.longer_than(offer, window);
+        (longer.then_some(fixed), holds)
+    }
+}
+
 impl LayoutLen {
     /// Whether what a widget reported along an axis is the whole of the box
     /// it is in rather than a part to be placed inside it. A share fills,
@@ -725,10 +867,7 @@ impl PlaceDesc {
         let mut rel_base = parent_rel_base;
         let mut region = given;
         for axis in Axis::BOTH {
-            let base = match self[axis].rel_base {
-                RelBase::Len(len) => len,
-                RelBase::Inherit | RelBase::WithRegion => parent_rel_base[axis],
-            };
+            let base = self.base(axis, parent_rel_base);
             let len = declared[axis]
                 .map(|len| len.within_len(base))
                 .unwrap_or(base);

core/src/ui/place.rs

@@ -1,5 +1,5 @@
 use crate::util::impl_axis_index;
-use crate::{Axis, AxisAlign, Len, PrimitiveHandle, RegionAlign, UiRegion, UiSpan};
+use crate::{Axis, AxisAlign, Len, PrimitiveHandle, RegionAlign, UiRegion, UiSpan, UiVec2};
 
 /// How a child's region along one axis comes from the region of the widget
 /// asking, and what its fractions are of.
@@ -123,6 +123,16 @@ impl PlaceDesc {
         self
     }
 
+    /// What a child's fractions on one axis are of, as a length of the
+    /// window: a length this place names, or the rel base of the widget
+    /// giving it, which is `parent_rel_base`.
+    pub(super) fn base(&self, axis: Axis, parent_rel_base: UiVec2) -> Len {
+        match self[axis].rel_base {
+            RelBase::Len(len) => len,
+            RelBase::Inherit | RelBase::WithRegion => parent_rel_base[axis],
+        }
+    }
+
     /// The box each axis names, in the coordinates `own` is in.
     pub fn of(self, own: UiRegion, align: RegionAlign) -> UiRegion {
         UiRegion::new(self.x.of(own.x, align.x), self.y.of(own.y, align.y))

core/src/ui/render_state.rs

@@ -1,9 +1,10 @@
 #[cfg(feature = "layout-diagnostics")]
 use crate::layout_diagnostics::{self as diag, Counter, ReuseOutcome, TimerKind};
 use crate::{
-    ActiveData, Answer, Axis, Declared, DrawLayers, IdLike, LayoutHolds, LayoutLen, Len, MaskIdx,
-    MoveIdx, Moves, Painter, PixelRegion, PlaceDesc, PxVec2, Rel, Size, StrongWidget, UiRegion,
+    ActiveData, Answer, Axis, Bounds, Declared, DrawLayers, IdLike, LayoutHolds, LayoutLen, Len,
+    MaskIdx, MoveIdx, Moves, Painter, PixelRegion, PlaceDesc, PxVec2, Size, StrongWidget, UiRegion,
     UiRsc, UiSpan, UiVec2, Weight, WidgetId, Widgets,
+    ui::painter::Ask,
     util::{HashMap, Vec2},
 };
 
@@ -23,11 +24,18 @@ pub(super) struct DrawInfo {
     /// The box the widget is asked in, in its parent region node's
     /// coordinates.
     pub region: UiRegion,
-    /// Where the widget is put, and where it was asked, as parts of the
-    /// parent's box. See [`PlaceDesc`]. The two are one ask's place until the
-    /// parent puts the answer somewhere else.
+    /// Where the widget is put, and what its parent offered it, as parts of
+    /// the parent's box. See [`PlaceDesc`]. The two are one place until a
+    /// rule of the widget's own takes it past the offer, or the parent puts
+    /// the answer somewhere else.
     pub placed: PlaceDesc,
     pub asked: PlaceDesc,
+    /// What the ask made of the widget's own rules. See [`Ask::declared`]
+    /// and [`Ask::bounds`].
+    pub declared: Declared,
+    pub bounds: Bounds,
+    /// What the ask that gave it those two holds for. See [`Ask::holds`].
+    pub ask_holds: LayoutHolds,
     /// Whether the parent already asked about this widget in this draw.
     pub re_asked: bool,
 }
@@ -43,7 +51,8 @@ pub(super) struct Drawn {
 /// What a widget's children are placed in: its own box, the coordinates its
 /// drawing is in, and what else one ask of a child is decided from.
 pub(super) struct Placing {
-    pub id: WidgetId,
+    /// The widget whose box this is, and nothing for the window.
+    pub id: Option<WidgetId>,
     pub region: UiRegion,
     pub rel_base: UiVec2,
     pub depth: usize,
@@ -51,6 +60,21 @@ pub(super) struct Placing {
     pub mask: MaskIdx,
 }
 
+impl Placing {
+    /// The window, which is what the root is placed within. Nothing above the
+    /// root narrowed a box or chose where it goes, so it is asked in the whole
+    /// output and its fractions are of the whole output -- an ordinary ask,
+    /// from the one box nobody drew.
+    pub const WINDOW: Self = Self {
+        id: None,
+        region: UiRegion::FULL,
+        rel_base: UiVec2::FULL_SIZE,
+        depth: 0,
+        move_idx: MoveIdx::NONE,
+        mask: MaskIdx::NONE,
+    };
+}
+
 pub struct UiRenderState {
     pub active: HashMap<WidgetId, ActiveData>,
     pub layers: DrawLayers,
@@ -124,20 +148,23 @@ impl UiRenderState {
         }
     }
 
-    /// The root is asked about in the output. Its own rules narrow both its
-    /// rel base and box; nothing above it chose a different one.
-    fn root_info(&self, rel_base: UiVec2, region: UiRegion) -> DrawInfo {
+    /// The root's first draw: the ask [`Placing::WINDOW`] answered, with the
+    /// bookkeeping a widget with no parent carries.
+    fn root_info(&self, ask: &Ask, region_node: bool) -> DrawInfo {
         DrawInfo {
             layer: 0,
             parent: None,
-            depth: 1,
+            depth: Placing::WINDOW.depth + 1,
             parent_move: MoveIdx::NONE,
-            region_node: false,
+            region_node,
             mask: MaskIdx::NONE,
-            rel_base,
-            region,
-            placed: PlaceDesc::WHOLE,
+            rel_base: ask.rel_base,
+            region: ask.region,
+            placed: ask.place,
             asked: PlaceDesc::WHOLE,
+            declared: ask.declared,
+            bounds: ask.bounds,
+            ask_holds: ask.holds,
             re_asked: false,
         }
     }
@@ -184,24 +211,13 @@ impl UiRenderState {
         let _layout = diag::timer(TimerKind::FullLayout);
         self.clear(rsc);
         if let Some(id) = root {
-            let (rel_base, region) = Self::root_layout(id.id(), rsc.widgets());
-            let info = self.root_info(rel_base, region);
+            let ask =
+                Placing::WINDOW.ask(rsc.widgets(), self.output_size, id.id(), PlaceDesc::WHOLE);
+            let info = self.root_info(&ask, rsc.widgets().is_region_node(id.id()));
             self.draw_inner(id.id(), info, None, rsc);
         }
     }
 
-    /// The root's rel base and box: the window, taken in by the root's own
-    /// rules. Nothing above it narrowed anything or chose where it goes, so
-    /// its declaration is the whole of what decides either.
-    fn root_layout(id: WidgetId, widgets: &Widgets) -> (UiVec2, UiRegion) {
-        PlaceDesc::WHOLE.rel_base_and_region(
-            UiRegion::FULL,
-            UiVec2::FULL_SIZE,
-            widgets.declared_lens(id),
-            widgets.alignment(id),
-        )
-    }
-
     pub(super) fn draw_inner(
         &mut self,
         id: WidgetId,
@@ -226,7 +242,7 @@ impl UiRenderState {
             );
         }
         let align = rsc.widgets().alignment(id);
-        let declared = rsc.widgets().declared_lens(id);
+        let declared = info.declared;
         // Nothing this widget measured can be dirty while it draws: layout is
         // one bottom-up walk, so anything deeper has settled or deferred to
         // its own parent, and a deferred one leaves that parent marked.
@@ -329,7 +345,10 @@ impl UiRenderState {
             mask_slot,
             children: Vec::new(),
             size_deps: Vec::new(),
-            own: LayoutHolds::ANY,
+            // What the ask holds for is part of what the drawing holds for:
+            // a box the widget's own rule took past the offer was decided in
+            // this window, and at the root nobody else keeps that range.
+            own: info.ask_holds,
             under: Vec::new(),
             answer_under: LayoutHolds::ANY,
             depth: info.depth,
@@ -379,9 +398,9 @@ impl UiRenderState {
         // A rule wins on the axis it names, and the draw answers the rest.
         // Applied here so it is one place rather than every widget that could
         // carry one, and so the widget under a rule never learns of it. The
-        // rel base is the answer where the rule gave a length outright: it was
-        // resolved into the rel base when the child was asked, and resolving it
-        // again here would take the fraction of a fraction.
+        // rel base is the answer wherever the ask declared a length: it was
+        // resolved into the rel base when the widget was asked, and resolving
+        // it again here would take the fraction of a fraction.
         let rules = rsc.widgets().size_rules(id);
         let ruled = |axis: Axis, reported: LayoutLen| match rules[axis].exact() {
             None => reported,
@@ -392,10 +411,37 @@ impl UiRenderState {
             },
             Some(len) => len.within_len(info.rel_base[axis]),
         };
-        let size = Size {
+        let mut size = Size {
             x: ruled(Axis::X, size.x),
             y: ruled(Axis::Y, size.y),
         };
+        // A bound is a promise about the length as well as about the box: a
+        // widget that drew past the box it was given -- a text too tall for
+        // it, an image at its own size under a cap -- is still held to what
+        // its rule allows.
+        //
+        // Held here rather than taken from the box, even where the bound
+        // decided that box. What a widget answers is its own, and a bound
+        // that replaced the answer would make a share into a fixed length
+        // the moment a box was long enough -- which is a length the span
+        // dividing that box decided from this answer, so the two would
+        // choose each other. A share is left alone here for the same reason:
+        // it is a length only to whoever divides one, and the box that
+        // divider gives is a box this widget is asked in, where the bound is
+        // applied to it.
+        let mut bounded = LayoutHolds::ANY;
+        for axis in Axis::BOTH {
+            let answer = size[axis];
+            if answer.leftover != Weight::ZERO {
+                continue;
+            }
+            let (outside, kept) =
+                info.bounds[axis].outside(answer.without_leftover(), window[axis]);
+            bounded[axis].window = kept;
+            if let Some(outside) = outside {
+                size[axis] = info.bounds[axis].at(outside).into();
+            }
+        }
         // A widget that clipped its contents to its box drew nothing outside
         // it, so reporting more than the box asks to be placed at a length it
         // does not occupy -- and its parent would place the part it cut off.
@@ -426,11 +472,12 @@ impl UiRenderState {
         // A rule that is a fraction of the rel base is answered with the
         // rel base's own length, so the answer is that rel base's and not just
         // that many pixels of this window -- the same pin a widget that read
-        // its rel base took for its drawing.
-        let mut own_holds = own;
+        // its rel base took for its drawing. A bound counts: which side of it
+        // the box fell was decided against this rel base, and the same box of
+        // a different one can fall on the other.
+        let mut own_holds = own.and(bounded);
         for axis in Axis::BOTH {
-            let fraction = rules[axis].exact().is_some_and(|len| len.rel != Rel::ZERO);
-            if fraction {
+            if rules[axis].has_fraction() {
                 own_holds[axis].rel_base = Some(info.rel_base[axis]);
             }
         }
@@ -462,6 +509,9 @@ impl UiRenderState {
                         region: UiRegion::FULL,
                         placed: PlaceDesc::WHOLE,
                         asked: PlaceDesc::WHOLE,
+                        declared: Declared::NONE,
+                        bounds: Bounds::ANY,
+                        ask_holds: LayoutHolds::ANY,
                         re_asked: false,
                     },
                     rsc,
@@ -489,7 +539,8 @@ impl UiRenderState {
             primitives,
             mask_region,
             children,
-            declared: rsc.widgets().declared_lens(id),
+            declared: info.declared,
+            bounds: info.bounds,
             own_align: rsc.widgets().alignment(id),
             move_idx,
             parent_move: info.parent_move,
@@ -659,6 +710,9 @@ impl UiRenderState {
         let active = self.active.get_mut(&id).unwrap();
         active.rel_base = info.rel_base;
         active.placed = info.placed;
+        // What the ask made of its rules, which a re-place decides again.
+        active.declared = info.declared;
+        active.bounds = info.bounds;
         #[cfg(feature = "layout-diagnostics")]
         {
             let (counter, outcome) = match (moved, is_region_node) {
@@ -697,7 +751,7 @@ impl UiRenderState {
         );
         let info = DrawInfo {
             layer: active.layer,
-            parent: Some(at.id),
+            parent: at.id,
             depth: at.depth + 1,
             parent_move: at.move_idx,
             region_node: active.is_region_node(),
@@ -706,6 +760,10 @@ impl UiRenderState {
             region,
             placed: place,
             asked: active.asked,
+            declared: active.declared,
+            bounds: active.bounds,
+            // Placing decides no box: this is the one the ask already gave.
+            ask_holds: LayoutHolds::ANY,
             re_asked: active.re_asked,
         };
         self.relocate(child, placed, info, rsc);
@@ -734,7 +792,7 @@ impl UiRenderState {
             rsc.ui_mut().masks.get_mut(active.mask).region = mask_region.within(&placed);
         }
         let at = Placing {
-            id,
+            id: Some(id),
             region: placed,
             rel_base: info.rel_base,
             depth: info.depth,
@@ -858,6 +916,7 @@ impl UiRenderState {
                 children: Vec::new(),
                 move_idx: info.parent_move,
                 declared: Declared::NONE,
+                bounds: Bounds::ANY,
                 own_align: rsc.widgets().alignment(id),
                 parent_move: info.parent_move,
                 mask: info.mask,
@@ -1042,12 +1101,22 @@ impl UiRenderState {
         let Some(active) = self.active.get(&id) else {
             return true;
         };
-        // Its parent resolved its declared lengths into its box and decided
-        // whether to draw it at all, so a change to either is the parent's
-        // to draw -- with the mark left on, so the parent draws it rather
-        // than keeping it. So is a widget the parent asked twice: its
-        // layout rests on an answer this widget cannot give again alone.
-        let declared_changed = rsc.widgets().declared_lens(id) != active.declared;
+        // Asked where its parent asked it, which is what says whether the
+        // question is still this widget's own: its parent resolved its
+        // declared lengths into its box -- a bound of its own that the box
+        // falls outside is one of them -- and decided whether to draw it at
+        // all, so a change to either is the parent's to draw, with the mark
+        // left on so the parent draws it rather than keeping it. So is a
+        // widget the parent asked twice: its layout rests on an answer this
+        // widget cannot give again alone. The root's parent is the window,
+        // which no draw made and no answer can move.
+        let at = match active.parent {
+            Some(parent) => self.placing_of(parent, self.active[&parent].region),
+            None => Placing::WINDOW,
+        };
+        let ask = at.ask(rsc.widgets(), self.output_size, id, active.asked);
+        let active = &self.active[&id];
+        let declared_changed = ask.declared != active.declared;
         let alignment_changed = rsc.widgets().alignment(id) != active.own_align;
         if let Some(parent) = active.parent
             && (declared_changed
@@ -1066,29 +1135,13 @@ impl UiRenderState {
         if !active.drawn {
             return true;
         }
-        // Nothing above the root resolved its rules or its alignment, so its
-        // box is its own to work out again against the output. Every other
-        // widget was given one.
-        let Some(parent) = active.parent else {
-            let (rel_base, region) = Self::root_layout(id, rsc.widgets());
-            let info = DrawInfo {
-                mask: active.parent_mask,
-                ..self.root_info(rel_base, region)
-            };
-            #[cfg(feature = "layout-diagnostics")]
-            diag::bump(Counter::LocalRedraws);
-            let old = self.remove(id, false, rsc);
-            self.draw_inner(id, info, old, rsc);
-            return true;
-        };
         let (was_answer, was_holds, was_place) = (active.answer, active.holds, active.placed);
-        // The question its parent asked, asked again: the same place of the
-        // box the parent was asked in, which is the box the parent's own
-        // draw ran in and what its children's parts are of. Where the
-        // parent's answer put its own drawing is not a question anybody
-        // asked, and nothing is asked in it here either.
-        let parent_at = self.placing_of(parent, self.active[&parent].region);
-        let (rel_base, region) = Self::ask_again(active, &parent_at, active.asked);
+        // The place the ask above came to: the same place of the box the
+        // parent was asked in, which is the box the parent's own draw ran in
+        // and what its children's parts are of. Where the parent's answer put
+        // its own drawing is not a question anybody asked, and nothing is
+        // asked in it here either.
+        let (rel_base, region) = (ask.rel_base, ask.region);
         let info = DrawInfo {
             layer: active.layer,
             parent: active.parent,
@@ -1098,8 +1151,11 @@ impl UiRenderState {
             mask: active.parent_mask,
             rel_base,
             region,
-            placed: active.asked,
+            placed: ask.place,
             asked: active.asked,
+            declared: ask.declared,
+            bounds: ask.bounds,
+            ask_holds: ask.holds,
             re_asked: false,
         };
         #[cfg(feature = "layout-diagnostics")]
@@ -1127,22 +1183,32 @@ impl UiRenderState {
         if active.holds.covers(was_holds) && was_holds.contains(window, rel_base, region) {
             active.holds = was_holds;
         }
-        if active.answer != was_answer || active.holds != was_holds {
-            // The parent retains both the answer and the drawing's validity;
-            // even an unchanged size can narrow the range safe for a resize.
+        let changed = active.answer != was_answer || active.holds != was_holds;
+        // Nothing above the root retained either, so there is nobody to tell
+        // and nowhere else the drawing has to go back to.
+        if let Some(parent) = active.parent {
+            match changed {
+                // The parent retains both the answer and the drawing's
+                // validity; even an unchanged size can narrow the range safe
+                // for a resize.
+                true => {
                     #[cfg(feature = "layout-diagnostics")]
                     {
                         diag::bump(Counter::SizeChanges);
                         diag::bump(Counter::ReaderEdges);
                     }
                     self.mark(parent, rsc.widgets_mut());
-        } else {
+                }
                 // The answer stands, so where the parent put it stands: the
                 // fresh drawing goes back there -- the same place, of the box
-            // the parent's answer chose rather than the one it was asked in.
+                // the parent's answer chose rather than the one it was asked
+                // in.
+                false => {
                     let at = self.placing_of(parent, self.active[&parent].placement);
                     self.place_in(id, &at, was_place, rsc);
                 }
+            }
+        }
         true
     }
 
@@ -1152,7 +1218,7 @@ impl UiRenderState {
     fn placing_of(&self, id: WidgetId, region: UiRegion) -> Placing {
         let active = &self.active[&id];
         Placing {
-            id,
+            id: Some(id),
             region,
             rel_base: active.rel_base,
             depth: active.depth,

core/src/widget/size_rule.rs

@@ -1,5 +1,5 @@
 use crate::util::impl_axis_index;
-use crate::{Axis, LayoutLen, Len};
+use crate::{Axis, LayoutLen, Len, Rel};
 
 /// What a widget's length on one axis is, as a rule its parent applies where
 /// it draws it rather than an answer the widget gives about itself.
@@ -9,6 +9,10 @@ use crate::{Axis, LayoutLen, Len};
 /// with no rule. That is what lets a span divide its space around a length
 /// nobody has drawn yet, and it is why a rule lives beside the widget rather
 /// than inside it -- the widget under the rule never has to know about it.
+///
+/// A rule gives a length or bounds one, never both: a share that is also
+/// capped wants two widgets, one taking the share and one capping what is
+/// inside it.
 #[derive(Debug, Clone, Copy, PartialEq, Default)]
 pub enum SizeRule {
     /// Whatever the widget reports from drawing.
@@ -16,9 +20,72 @@ pub enum SizeRule {
     Free,
     /// This length, whatever the widget reports.
     Exact(LayoutLen),
+    /// At least this long, and otherwise whatever the box gives it.
+    Min(Len),
+    /// At most this long.
+    Max(Len),
+    /// Between the two.
+    Clamp { min: Len, max: Len },
 }
 
 impl SizeRule {
+    /// What this rule allows the length to be where it does not give one
+    /// outright.
+    pub fn bound(&self) -> Bound {
+        match *self {
+            Self::Free | Self::Exact(_) => Bound::ANY,
+            Self::Min(min) => Bound {
+                min: Some(min),
+                max: None,
+            },
+            Self::Max(max) => Bound {
+                min: None,
+                max: Some(max),
+            },
+            Self::Clamp { min, max } => Bound {
+                min: Some(min),
+                max: Some(max),
+            },
+        }
+    }
+
+    /// Whether what this rule says is a fraction of the rel base, so that
+    /// the same rule against a different one is a different length.
+    pub fn has_fraction(&self) -> bool {
+        let bound = self.bound();
+        self.exact().is_some_and(|len| len.rel != Rel::ZERO)
+            || [bound.min, bound.max]
+                .iter()
+                .flatten()
+                .any(|len| len.rel != Rel::ZERO)
+    }
+
+    /// This rule with a floor under it, which is the whole of it where there
+    /// was no rule.
+    pub fn at_least(&self, min: Len) -> Self {
+        match *self {
+            Self::Free | Self::Min(_) => Self::Min(min),
+            Self::Max(max) | Self::Clamp { max, .. } => Self::Clamp { min, max },
+            Self::Exact(len) => {
+                debug_assert!(false, "{len:?} is a length, so bounding it says nothing");
+                Self::Min(min)
+            }
+        }
+    }
+
+    /// This rule with a cap over it, which is the whole of it where there was
+    /// no rule.
+    pub fn at_most(&self, max: Len) -> Self {
+        match *self {
+            Self::Free | Self::Max(_) => Self::Max(max),
+            Self::Min(min) | Self::Clamp { min, .. } => Self::Clamp { min, max },
+            Self::Exact(len) => {
+                debug_assert!(false, "{len:?} is a length, so bounding it says nothing");
+                Self::Max(max)
+            }
+        }
+    }
+
     /// The length this rule gives without the widget being drawn, if it can
     /// give one.
     pub fn declared(&self) -> Option<Len> {
@@ -32,12 +99,84 @@ impl SizeRule {
     /// that give a box directly.
     pub fn exact(&self) -> Option<LayoutLen> {
         match self {
-            Self::Free => None,
             Self::Exact(len) => Some(*len),
+            Self::Free | Self::Min(_) | Self::Max(_) | Self::Clamp { .. } => None,
         }
     }
 }
 
+/// What a rule allows a length to be where it does not give one outright: a
+/// floor, a cap, or both. Each is a length of the rel base the widget is
+/// asked with, which is the base a declared length is a fraction of too, and
+/// a bound that binds is a declaration -- the box comes to what it says.
+///
+/// A bound is a [`Len`] and never a share. Which of a fixed and a relative
+/// child is longer, asked at the length the cap is itself deciding, admits
+/// several self-sizing fixed points, so a cap containing `leftover` has no
+/// one answer: see `docs/LAYOUT.md` under the failed hypotheses.
+#[derive(Debug, Clone, Copy, PartialEq, Default)]
+pub struct Bound {
+    pub min: Option<Len>,
+    pub max: Option<Len>,
+}
+
+/// Which end of a bound a length fell outside.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Outside {
+    Shorter,
+    Longer,
+}
+
+impl Bound {
+    /// Every length.
+    pub const ANY: Self = Self {
+        min: None,
+        max: None,
+    };
+
+    /// The end [`Outside`] names, which is the length a widget outside it
+    /// gets instead of its own.
+    pub fn at(&self, outside: Outside) -> Len {
+        let end = match outside {
+            Outside::Shorter => self.min,
+            Outside::Longer => self.max,
+        };
+        end.expect("an end nothing is outside of")
+    }
+
+    /// This bound as lengths of the window, from lengths of a rel base that
+    /// long.
+    pub fn within_len(&self, len: Len) -> Self {
+        Self {
+            min: self.min.map(|min| min.within_len(len)),
+            max: self.max.map(|max| max.within_len(len)),
+        }
+    }
+}
+
+/// One bound per axis, as [`SizeRules`] is one rule per axis.
+#[derive(Debug, Clone, Copy, PartialEq, Default)]
+pub struct Bounds {
+    pub x: Bound,
+    pub y: Bound,
+}
+
+impl Bounds {
+    pub const ANY: Self = Self {
+        x: Bound::ANY,
+        y: Bound::ANY,
+    };
+
+    pub fn from_axes(f: impl Fn(Axis) -> Bound) -> Self {
+        Self {
+            x: f(Axis::X),
+            y: f(Axis::Y),
+        }
+    }
+}
+
+impl_axis_index!(Bounds => Bound);
+
 impl From<LayoutLen> for SizeRule {
     fn from(len: LayoutLen) -> Self {
         Self::Exact(len)

core/src/widget/widgets.rs

@@ -1,8 +1,8 @@
 use std::sync::mpsc::{Receiver, Sender, channel};
 
 use crate::{
-    Axis, AxisAlign, IdLike, RegionAlign, SizeRule, SizeRules, StrongWidget, WeakWidget, Widget,
-    WidgetData, WidgetId,
+    Axis, AxisAlign, IdLike, Len, RegionAlign, SizeRule, SizeRules, StrongWidget, WeakWidget,
+    Widget, WidgetData, WidgetId,
     util::{DynBorrower, HashSet, SlotVec, forget_mut, to_mut},
 };
 
@@ -145,6 +145,22 @@ impl Widgets {
         self.needs_redraw.insert(id);
     }
 
+    /// Puts a floor under this widget's length on one axis, keeping a cap it
+    /// already had. See [`SizeRule::at_least`].
+    pub fn set_min_len(&mut self, id: impl IdLike, axis: Axis, min: Len) {
+        let id = id.id();
+        let rule = self.size_rules(id)[axis].at_least(min);
+        self.set_size_rule(id, axis, rule);
+    }
+
+    /// Puts a cap over it, keeping a floor it already had. See
+    /// [`SizeRule::at_most`].
+    pub fn set_max_len(&mut self, id: impl IdLike, axis: Axis, max: Len) {
+        let id = id.id();
+        let rule = self.size_rules(id)[axis].at_most(max);
+        self.set_size_rule(id, axis, rule);
+    }
+
     /// Where this widget sits in a box longer than the length it takes.
     pub fn alignment(&self, id: impl IdLike) -> RegionAlign {
         self.data(id).unwrap().align

macro/src/lib.rs

@@ -18,6 +18,7 @@ struct Input {
 }
 
 struct InputFn {
+    attrs: Vec<Attribute>,
     sig: Signature,
     body: Block,
 }
@@ -32,9 +33,10 @@ impl Parse for Input {
         input.parse::<Token![;]>()?;
         let mut fns = Vec::new();
         while !input.is_empty() {
+            let attrs = input.call(Attribute::parse_outer)?;
             let sig = input.parse()?;
             let body = input.parse()?;
-            fns.push(InputFn { sig, body })
+            fns.push(InputFn { attrs, sig, body })
         }
         if !input.is_empty() {
             input.error("function expected");
@@ -59,10 +61,15 @@ pub fn widget_trait(input: TokenStream) -> TokenStream {
         fns,
     } = parse_macro_input!(input as Input);
 
-    let sigs: Vec<_> = fns.iter().map(|f| f.sig.clone()).collect();
+    // What a method says about itself belongs on the trait, where a reader
+    // looks it up; the implementation is the same text and says it again.
+    let sigs: Vec<_> = fns
+        .iter()
+        .map(|InputFn { attrs, sig, .. }| quote! { #(#attrs)* #sig })
+        .collect();
     let impls: Vec<_> = fns
         .iter()
-        .map(|InputFn { sig, body }| quote! { #sig #body })
+        .map(|InputFn { attrs, sig, body }| quote! { #(#attrs)* #sig #body })
         .collect();
 
     let Some(GenericParam::Type(state)) = generics.params.first() else {

src/random.rs

@@ -190,6 +190,9 @@ pub enum Kind {
         color: usize,
         alpha: u8,
     },
+    /// The one leaf whose own length is a number of pixels it knows before it
+    /// is drawn, which is the hint a rule beside it has to win over.
+    Image,
     /// Scrolling reads the pixel length of its box, which nothing else here
     /// does, and gives its child a box longer than its own.
     Scroll {
@@ -443,9 +446,11 @@ impl Kind {
         }
         match self {
             // The one leaf that reads the width it is given, then the one
-            // that does not, then the one that measures nothing at all.
+            // that does not, then the one that measures nothing at all. A
+            // picture measures nothing either, but its length is its own, so
+            // it steps to the leaf that takes whatever it is given.
             Kind::Wrapped => out.push(Kind::OneLine),
-            Kind::OneLine => out.push(Kind::Rect {
+            Kind::OneLine | Kind::Image => out.push(Kind::Rect {
                 color: 0,
                 alpha: 255,
             }),
@@ -627,9 +632,10 @@ struct Sow<'a> {
 
 impl Sow<'_> {
     fn leaf(&mut self) -> Plan {
-        Plan::bare(match self.rng.below(4) {
+        Plan::bare(match self.rng.below(5) {
             0 => Kind::Wrapped,
             1 => Kind::OneLine,
+            2 => Kind::Image,
             _ => {
                 let color = self.rng.below(COLORS.len());
                 let alpha = (self.rng.below(5) * 63) as u8;
@@ -638,11 +644,45 @@ impl Sow<'_> {
         })
     }
 
-    fn len(&mut self) -> Option<LayoutLen> {
-        match self.rng.below(4) {
-            0 => Some(LayoutLen::px(20.0 + self.rng.below(180) as f32)),
-            1 => Some(LayoutLen::LEFTOVER),
-            _ => None,
+    fn len(&mut self) -> LayoutLen {
+        LayoutLen::px(20.0 + self.rng.below(180) as f32)
+    }
+
+    /// A length of a box rather than a length of the window, which is what a
+    /// bound is.
+    ///
+    /// Pixels only, for now. A fraction in a bound is resolved against the rel
+    /// base the widget was asked with, and `place_at` hands a parent a
+    /// retained answer without checking that the answer still holds for the
+    /// rel base this place gives -- so a fraction resolved against one rel
+    /// base survives into another. Seeds 4 (shuffle-all-but-first) and 196
+    /// (resize-size) at depth 5 are where that showed; both pass with pixels.
+    /// The hole is older than bounds -- an `Exact` rule that is a fraction
+    /// can reach it too -- and closing it is a check at the re-place site.
+    fn bound(&mut self) -> Len {
+        Len::px(20.0 + self.rng.below(180) as f32)
+    }
+
+    fn rule(&mut self) -> SizeRule {
+        match self.rng.below(8) {
+            0 | 1 => self.len().into(),
+            2 => LayoutLen::LEFTOVER.into(),
+            3 => SizeRule::Min(self.bound()),
+            4 => SizeRule::Max(self.bound()),
+            // Both in pixels, so one can be put under the other: a floor and
+            // a cap that change sides with the window bound nothing, which
+            // is a caller's bug rather than a tree to grow.
+            5 => {
+                let (a, b) = (
+                    Px::from_f32(20.0 + self.rng.below(180) as f32),
+                    Px::from_f32(20.0 + self.rng.below(180) as f32),
+                );
+                SizeRule::Clamp {
+                    min: Len::px(a.min(b).to_f32()),
+                    max: Len::px(a.max(b).to_f32()),
+                }
+            }
+            _ => SizeRule::Free,
         }
     }
 
@@ -668,8 +708,8 @@ impl Sow<'_> {
     fn sized(&mut self, inner: &mut Plan) {
         let take = self.rng.chance();
         let lens = SizeRules {
-            x: self.len().into(),
-            y: self.len().into(),
+            x: self.rule(),
+            y: self.rule(),
         };
         if !take || inner.size.is_some() {
             return;
@@ -793,6 +833,7 @@ pub fn build<Rsc: UiRsc + 'static>(rsc: &mut Rsc, plan: &Plan) -> (StrongWidget,
     let mut build = Build {
         rsc,
         tree: Tree::default(),
+        checkerboard: None,
     };
     let root = build.node(plan);
     (root, build.tree)
@@ -801,6 +842,10 @@ pub fn build<Rsc: UiRsc + 'static>(rsc: &mut Rsc, plan: &Plan) -> (StrongWidget,
 struct Build<'a, Rsc> {
     rsc: &'a mut Rsc,
     tree: Tree,
+    /// The checkerboard, uploaded when the first image in this tree is built.
+    /// A handle is a reference to the texture, so every image after that one
+    /// clones this rather than uploading the same picture again.
+    checkerboard: Option<TextureHandle>,
 }
 
 impl<Rsc: UiRsc + 'static> Build<'_, Rsc> {
@@ -826,6 +871,20 @@ impl<Rsc: UiRsc + 'static> Build<'_, Rsc> {
         built
     }
 
+    /// The one picture the generated trees draw: a 64x64 checkerboard of purple
+    /// and black in 8 px cells. Committed rather than drawn here, so that one
+    /// seed is one tree whatever anything else does, and included rather than
+    /// opened, so that growing a tree does not depend on a working directory.
+    fn checkerboard(&mut self) -> TextureHandle {
+        if self.checkerboard.is_none() {
+            let image = include_bytes!("assets/checkerboard.png")
+                .get_image()
+                .expect("the checkerboard is committed beside this file");
+            self.checkerboard = Some(self.rsc.ui_mut().textures.add(image));
+        }
+        self.checkerboard.clone().unwrap()
+    }
+
     fn kind(&mut self, kind: &Kind) -> StrongWidget {
         let id: StrongWidget = match kind {
             Kind::Wrapped => wtext(WORDS).size(16).wrap(true).add_strong(self.rsc),
@@ -834,6 +893,7 @@ impl<Rsc: UiRsc + 'static> Build<'_, Rsc> {
                 .wrap(false)
                 .add_strong(self.rsc),
             Kind::Rect { color, alpha } => rect(COLORS[*color].alpha(*alpha)).add_strong(self.rsc),
+            Kind::Image => Image::new(self.checkerboard()).add_strong(self.rsc),
             Kind::Scroll { axis, inner } => {
                 let inner = self.node(inner);
                 let id = Scroll::new(inner, *axis).add(self.rsc);

src/widget/image.rs

@@ -16,6 +16,15 @@ impl Widget for Image {
     }
 }
 
+impl Image {
+    /// One texture already uploaded, for a caller holding its handle: [`image()`]
+    /// uploads what it is given, and several widgets showing one picture want
+    /// one upload and one slot between them.
+    pub fn new(handle: TextureHandle) -> Self {
+        Self { handle }
+    }
+}
+
 pub fn image<State: UiRsc>(image: impl LoadableImage) -> impl WidgetFn<State, Image> {
     let image = image.get_image().expect("Failed to load image");
     move |state| Image {

src/widget/position/max_size.rs

@@ -0,0 +1,60 @@
+use crate::prelude::*;
+
+/// Asks its child in the shorter of a cap and the box this widget was given,
+/// and answers what the child used, held to the same cap.
+///
+/// A cap on the box is a widget rather than a [`SizeRule`] because a box is
+/// whoever asked's to decide: a rule that read the box it was given would be
+/// decided again by every path that hands a widget one, including the ones
+/// that re-place a drawing without asking it anything, and the decision would
+/// then depend on which path arrived last. A widget is drawn again whenever
+/// its own box changes, so the comparison is made where the answer can be
+/// kept -- `longer_than` narrows the windows this drawing holds for, and
+/// `holds` says the box lengths.
+///
+/// The box is what a text wraps at and what a scroll takes its viewport from,
+/// which is why capping the answer alone is not the same thing.
+pub struct MaxSize {
+    pub inner: StrongWidget,
+    pub x: Option<Len>,
+    pub y: Option<Len>,
+}
+
+impl MaxSize {
+    fn max(&self, axis: Axis) -> Option<Len> {
+        match axis {
+            Axis::X => self.x,
+            Axis::Y => self.y,
+        }
+    }
+}
+
+impl Widget for MaxSize {
+    fn draw(&mut self, painter: &mut Painter) -> Size {
+        let align = painter.alignment();
+        let mut region = UiRegion::FULL;
+        for axis in Axis::BOTH {
+            let Some(max) = self.max(axis) else {
+                continue;
+            };
+            let own = painter.region_len(axis);
+            if painter.longer_than(own, max, axis) {
+                region[axis] = max.align(align[axis]);
+            }
+        }
+        let mut size = painter.widget_at(&self.inner, region).size();
+        for axis in Axis::BOTH {
+            // The child may draw past the box it was given -- a text too tall
+            // for it -- and the cap is a promise about the length as well. A
+            // share passes through: it is a length only to whoever divides
+            // one, and that is this widget's parent rather than this widget,
+            // which has already given the share the box the cap allows.
+            if let Some(max) = self.max(axis)
+                && painter.longer_than(size[axis].without_leftover(), max, axis)
+            {
+                size[axis] = max.into();
+            }
+        }
+        size
+    }
+}

src/widget/position/mod.rs

@@ -1,4 +1,5 @@
 mod layer;
+mod max_size;
 mod offset;
 mod pad;
 mod scroll;
@@ -6,6 +7,7 @@ mod span;
 mod stack;
 
 pub use layer::*;
+pub use max_size::*;
 pub use offset::*;
 pub use pad::*;
 pub use scroll::*;

src/widget/position/span.rs

@@ -52,25 +52,15 @@ impl Widget for Span {
 
         // What is left for the shares to divide: the row less everything
         // fixed, as a length of the rel base rather than a number of pixels.
-        let room = row - total.without_leftover();
-        // Whether anything is left over is a question in pixels: `rel(0.5)`
-        // beside 300 px is full at 600 and overfull at 400. Asked of `room`
-        // itself, and answered back through the same expression, so the
-        // boundary is the drawing's own and not a second way of finding it:
-        // the three cases a rounded division needed -- the fixed parts
+        let all_fixed = total.without_leftover();
+        let room = row - all_fixed;
+        // The three cases a rounded division needed -- the fixed parts
         // growing slower than the box, faster, or exactly with it -- are the
-        // sign of `room.rel`, which `through` already reads. What the
-        // generated oracle checks is the consequence, since which children
-        // exist at all turns on this.
+        // sign of `room.rel`, which the range `longer_than` keeps already
+        // reads. What the generated oracle checks is the consequence, since
+        // which children exist at all turns on this.
         let any_leftover = total.leftover > Weight::ZERO;
-        let has_room = any_leftover && painter.to_px(room, axis) > Px::ZERO;
-        if any_leftover {
-            let holds = match has_room {
-                true => Holds::from(Px::STEP..=Px::MAX),
-                false => Holds::from(Px::MIN..=Px::ZERO),
-            };
-            painter.window_holds(axis, holds.through(room));
-        }
+        let has_room = any_leftover && painter.longer_than(row, all_fixed, axis);
 
         // Across itself a span is as long as its longest child -- unless a
         // rule beside it gives that length outright, and then reading them

src/widget/trait_fns.rs

@@ -71,6 +71,50 @@ widget_trait! {
         }
     }
 
+    /// Answers at least this wide, whatever it drew: a rule beside the
+    /// widget, so what a row gives it is at least this even where the widget
+    /// itself wanted less. The box it draws in is untouched -- for that, see
+    /// [`MaxSize`].
+    fn min_width(self, len: impl Into<Len>) -> impl WidgetIdFn<Rsc, WL::Widget> {
+        let len = len.into();
+        move |state| {
+            let id = self.add(state);
+            state.ui_mut().widgets.set_min_len(id, Axis::X, len);
+            id
+        }
+    }
+
+    fn min_height(self, len: impl Into<Len>) -> impl WidgetIdFn<Rsc, WL::Widget> {
+        let len = len.into();
+        move |state| {
+            let id = self.add(state);
+            state.ui_mut().widgets.set_min_len(id, Axis::Y, len);
+            id
+        }
+    }
+
+    /// Puts this in a [`MaxSize`]: it is asked in the shorter of the cap and
+    /// the box that widget was given, and is as long as it used, held to the
+    /// cap. A widget rather than a rule because the box is whoever asked's to
+    /// decide -- see [`MaxSize`].
+    fn max_width(self, len: impl Into<Len>) -> impl WidgetFn<Rsc, MaxSize> {
+        let len = len.into();
+        move |state| MaxSize {
+            inner: self.add_strong(state),
+            x: Some(len),
+            y: None,
+        }
+    }
+
+    fn max_height(self, len: impl Into<Len>) -> impl WidgetFn<Rsc, MaxSize> {
+        let len = len.into();
+        move |state| MaxSize {
+            inner: self.add_strong(state),
+            x: None,
+            y: Some(len),
+        }
+    }
+
     fn height(self, len: impl Into<LayoutLen>) -> impl WidgetIdFn<Rsc, WL::Widget> {
         let len = len.into();
         move |state| {

tests/cases/layout.rs

@@ -260,6 +260,95 @@ fn a_share_rule_beats_the_widgets_own_pixel_size() {
     assert_eq!(asked.get(), 400.0, "the share is all of the box");
 }
 
+/// Every box a widget is given comes of one ask, and the window is one of
+/// them: the root is asked in it exactly as a child is asked in its parent's
+/// box, so a rule of its own reads the same way at either place.
+#[derive(Clone, Copy, Debug)]
+enum Asked {
+    Root,
+    Wrapped,
+    InASpan,
+}
+
+impl Asked {
+    const ALL: [Self; 3] = [Self::Root, Self::Wrapped, Self::InASpan];
+
+    /// The width the probe is given under this parent, in a 400 px window.
+    fn width(&self, rule: LayoutLen) -> Px {
+        let mut h = Harness::new((400, 200));
+        let probe = rect(Color::RED).add(&mut h.rsc);
+        h.set_len(probe, Axis::X, rule);
+        match self {
+            Self::Root => h.set_root(probe),
+            Self::Wrapped => h.set_root(probe.wrapper()),
+            Self::InASpan => h.set_root((probe,).span(Dir::RIGHT)),
+        }
+        h.region(&probe).unwrap().size().x
+    }
+}
+
+/// A share with pixels or a fraction beside it is the longer of the two: it
+/// fills what they leave of the box and overflows the box where they are
+/// longer than it. A parent that divides nothing gives the same length as a
+/// span with one child, because in both there is nobody else to divide with --
+/// and so does the window, which divides nothing either.
+#[test]
+fn a_share_is_a_minimum_wherever_nothing_divides_it() {
+    for (rule, want) in [
+        (LayoutLen::LEFTOVER, 400),
+        (LayoutLen::px(50.0) + LayoutLen::LEFTOVER, 400),
+        (LayoutLen::px(500.0) + LayoutLen::LEFTOVER, 500),
+        (LayoutLen::rel(0.5) + LayoutLen::LEFTOVER, 400),
+        (LayoutLen::rel(2.0) + LayoutLen::LEFTOVER, 800),
+        (LayoutLen::px(500.0), 500),
+    ] {
+        let want = Px::from_int(want);
+        for asked in Asked::ALL {
+            assert_eq!(asked.width(rule), want, "{rule:?} asked {asked:?}");
+        }
+    }
+}
+
+/// Which of the two is longer is a question in pixels, so the box is decided
+/// again wherever the answer can change: a window that crosses the length the
+/// pixels ask for, and the rule itself crossing it while the window holds
+/// still. The first is a range the drawing holds for; the second cannot be
+/// seen in what the widget declares, since a share declares nothing either
+/// way, so it reaches the parent as a length only the parent can resolve.
+#[test]
+fn a_share_past_the_box_is_decided_again_on_either_side_of_the_crossing() {
+    // At the root as well as under a parent: the comparison is the same one,
+    // and nothing above the root will make it again on its behalf, so the
+    // range it holds for is the root's own.
+    for wrapped in [false, true] {
+        let mut h = Harness::new((400, 200));
+        let probe = rect(Color::RED).add(&mut h.rsc);
+        h.set_len(probe, Axis::X, LayoutLen::px(500.0) + LayoutLen::LEFTOVER);
+        match wrapped {
+            true => h.set_root(probe.wrapper()),
+            false => h.set_root(probe),
+        }
+        let width = |h: &Harness| h.region(&probe).unwrap().size().x;
+        assert_eq!(width(&h), Px::from_int(500), "wrapped: {wrapped}");
+
+        h.resize((900, 200));
+        h.frame();
+        assert_eq!(width(&h), Px::from_int(900), "wrapped: {wrapped}");
+
+        h.resize((400, 200));
+        h.frame();
+        assert_eq!(width(&h), Px::from_int(500), "wrapped: {wrapped}");
+
+        h.set_len(probe, Axis::X, LayoutLen::px(50.0) + LayoutLen::LEFTOVER);
+        h.frame();
+        assert_eq!(width(&h), Px::from_int(400), "wrapped: {wrapped}");
+
+        h.set_len(probe, Axis::X, LayoutLen::px(500.0) + LayoutLen::LEFTOVER);
+        h.frame();
+        assert_eq!(width(&h), Px::from_int(500), "wrapped: {wrapped}");
+    }
+}
+
 #[test]
 fn a_child_drawn_twice_moves_once() {
     let mut h = Harness::new((400, 200));
@@ -667,7 +756,7 @@ fn only_a_pure_leftover_child_disappears_when_nothing_is_left() {
     let mut h = Harness::new((100, 20));
     let fixed = rect(Color::RED).width(100).add(&mut h.rsc);
     let mixed = rect(Color::BLUE)
-        .width(LayoutLen::px(20) + LayoutLen::LEFTOVER)
+        .width(LayoutLen::px(20.0) + LayoutLen::LEFTOVER)
         .add(&mut h.rsc);
     h.set_root((fixed, mixed).span(Dir::RIGHT));
 
@@ -899,3 +988,131 @@ fn a_collapsed_share_keeps_the_gaps_before_the_next_slot() {
         }
     }
 }
+
+/// The root is asked the way any child is, so what it says about itself is
+/// read there too: a root that opted into a region node gets one, where the
+/// path it used to have ignored the flag.
+#[test]
+fn a_region_node_root_is_a_region_node() {
+    let mut h = Harness::new((400, 200));
+    let probe = rect(Color::RED).add(&mut h.rsc);
+    let root = (probe,).span(Dir::RIGHT).region_node().add(&mut h.rsc);
+    h.set_root(root);
+    assert_eq!(h.region(&probe).unwrap().size().x, Px::from_int(400));
+
+    h.resize((900, 200));
+    h.frame();
+    assert_eq!(h.region(&probe).unwrap().size().x, Px::from_int(900));
+}
+
+/// A bound is a rule about what a widget answers: it holds the length that
+/// reaches whoever asked and leaves the box alone. Here the content is 400
+/// wide in a 250 window, so a cap cuts what the row reports and a floor
+/// raises it, while the rects inside stay where the 250 box put them.
+#[test]
+fn a_bound_holds_what_a_widget_answers() {
+    let row = |rule: SizeRule| {
+        let mut h = Harness::new((250, 200));
+        let left = rect(Color::RED).width(200).add(&mut h.rsc);
+        let right = rect(Color::BLUE).width(200).add(&mut h.rsc);
+        let row = (left, right).span(Dir::RIGHT).add(&mut h.rsc);
+        h.rsc.widgets_mut().set_size_rule(row, Axis::X, rule);
+        h.set_root(row);
+        (
+            h.region(&row).unwrap().size().x,
+            h.region(&left).unwrap().size().x,
+        )
+    };
+    let (capped, left) = row(SizeRule::Max(Len::px(300.0)));
+    assert_eq!(capped, Px::from_int(300), "the cap, not the 400 drawn");
+    assert_eq!(left, Px::from_int(200), "the box the children were given");
+
+    let (floored, _) = row(SizeRule::Min(Len::px(600.0)));
+    assert_eq!(floored, Px::from_int(600), "the floor, not the 400 drawn");
+
+    let (free, _) = row(SizeRule::Free);
+    assert_eq!(free, Px::from_int(400), "what it drew");
+}
+
+/// A cap on the box is `MaxSize`, which asks its child in the shorter of the
+/// cap and its own box. That is the box a text wraps at and a scroll takes
+/// its viewport from, so it cannot be had by holding the answer.
+#[test]
+fn a_cap_widget_asks_its_child_in_the_shorter_box() {
+    let mut h = Harness::new((400, 200));
+    // A fraction of its box, so it says what box it was asked in.
+    let fills = rect(Color::RED).width(rel(1.0)).add(&mut h.rsc);
+    let capped = fills.max_width(300).add(&mut h.rsc);
+    h.set_root(capped);
+
+    assert_eq!(h.region(&fills).unwrap().size().x, Px::from_int(300));
+    assert_eq!(
+        h.region(&capped).unwrap().size().x,
+        Px::from_int(300),
+        "as long as its child used"
+    );
+
+    // A child that asked for a share takes the box the cap allows, and the
+    // share itself passes up: whoever divides one is this widget's parent.
+    let mut h = Harness::new((400, 200));
+    let share = rect(Color::RED).add(&mut h.rsc);
+    let capped = share.max_width(300).add(&mut h.rsc);
+    h.set_root(capped);
+
+    assert_eq!(h.region(&share).unwrap().size().x, Px::from_int(300));
+    assert_eq!(h.region(&capped).unwrap().size().x, Px::from_int(400));
+}
+
+/// Which of the cap and the box is shorter is a question in pixels, so it is
+/// asked again wherever the answer can change -- and the widget asking it is
+/// drawn again whenever its own box is, which is what keeps the two in step.
+#[test]
+fn a_cap_widget_is_decided_again_on_either_side_of_the_crossing() {
+    let mut h = Harness::new((400, 200));
+    let probe = rect(Color::RED).add(&mut h.rsc);
+    h.set_root(probe.max_width(300));
+    let width = |h: &Harness| h.region(&probe).unwrap().size().x;
+    assert_eq!(width(&h), Px::from_int(300));
+
+    h.resize((250, 200));
+    h.frame();
+    assert_eq!(
+        width(&h),
+        Px::from_int(250),
+        "its box, which is under the cap"
+    );
+
+    h.resize((400, 200));
+    h.frame();
+    assert_eq!(width(&h), Px::from_int(300));
+}
+
+/// A fraction in a cap is a fraction of the box the widget capping it was
+/// given, which is the box a declared length of its own would be a fraction
+/// of -- not of the window, and not of what the cap itself decided.
+#[test]
+fn a_cap_is_a_fraction_of_the_box_it_was_given() {
+    let mut h = Harness::new((400, 200));
+    let probe = rect(Color::RED).add(&mut h.rsc);
+    h.set_root(probe.max_width(Len::rel(0.5)).pad(Padding::uniform(50)));
+
+    // Half of the 300 left by the padding, not half of the window.
+    assert_eq!(h.region(&probe).unwrap().size().x, Px::from_int(150));
+}
+
+/// A cap is a promise about the length as well as the box: a widget whose
+/// content is longer than the box it was given reports what it drew, and the
+/// cap holds that down even though it never decided the box.
+#[test]
+fn a_cap_holds_an_answer_that_overflowed_its_box() {
+    let mut h = Harness::new((250, 200));
+    let left = rect(Color::RED).width(200).add(&mut h.rsc);
+    let right = rect(Color::BLUE).width(200).add(&mut h.rsc);
+    let row = (left, right).span(Dir::RIGHT).add(&mut h.rsc);
+    h.rsc.widgets_mut().set_max_len(row, Axis::X, 300.into());
+    h.set_root(row);
+
+    // The box is the 250 window, which the cap of 300 leaves alone, and the
+    // row draws 400 of it. Its answer is the cap, and the window centres it.
+    assert_corners!(h, row, (-25, 0), (275, 200));
+}

tests/cases/plan.rs

@@ -5,7 +5,9 @@
 //! and the oracle another. And reducing a plan has to end, or a shrinker
 //! searching for the smallest counterexample never returns.
 
-use iris::random::{Edits, Kind, Plan, Rng, SpanEdit, plan};
+use iris::harness::Harness;
+use iris::prelude::*;
+use iris::random::{Edits, Kind, Plan, Rng, SpanEdit, grow, plan};
 use std::collections::HashMap;
 
 fn some_edits(seed: u64, of: &Plan) -> Edits {
@@ -67,8 +69,6 @@ fn some_edits(seed: u64, of: &Plan) -> Edits {
     }
 }
 
-use iris::prelude::*;
-
 /// The two routes to an edited tree are one tree. `plan` resolves edits out
 /// of the random stream as it draws; `edited` puts them on a tree that
 /// already exists, which is the only route a shrunk plan has, since no seed
@@ -137,3 +137,20 @@ fn reducing_a_plan_all_the_way_ends() {
         );
     }
 }
+
+/// Every image in a tree is the same picture, and a handle is a reference to
+/// the texture rather than a copy of it, so one upload and one slot serve all
+/// of them however many a tree grows -- and the trees are grown in hundreds.
+#[test]
+fn a_tree_of_images_uploads_one_texture() {
+    let mut images = 0;
+    let mut tree = plan(1, 4, &Edits::default());
+    tree.walk_mut(&mut |p| images += (p.kind == Kind::Image) as usize);
+    assert!(images > 1, "a tree of {images} images tests nothing");
+
+    let mut h = Harness::new((900, 1200));
+    let (root, _) = grow(&mut h.rsc, 1, 4, &Edits::default());
+    h.state.root = Some(root);
+    h.frame();
+    assert_eq!(h.rsc.ui().textures.count(), 1);
+}

tests/cases/scroll.rs

@@ -161,3 +161,26 @@ fn content_that_fits_is_placed_in_the_viewport_and_not_in_the_window() {
     assert_corners!(h, scroll, (0, 100), (400, 400));
     assert_corners!(h, inner, (0, 225), (400, 275));
 }
+
+/// A cap narrows the box the widget is asked in, which is what a scroll
+/// measures its viewport from: the content scrolls within the cap rather than
+/// within the room the cap was cut from.
+#[test]
+fn a_capped_scroll_takes_its_viewport_from_the_cap() {
+    let mut h = Harness::new((400, 200));
+    let top = rect(Color::RED).height(200).add(&mut h.rsc);
+    let bottom = rect(Color::BLUE).height(200).add(&mut h.rsc);
+    let scroll = (top, bottom).span(Dir::DOWN).scrollable().add(&mut h.rsc);
+    let capped = scroll.max_height(100).add(&mut h.rsc);
+    h.set_root(capped);
+    h.move_to((200, 50));
+
+    // 400 of content in a viewport of 100, so 300 to scroll and the end
+    // showing: the top is 300 above the box, which the window centres.
+    assert_eq!(h.region(&scroll).unwrap().size().y, Px::from_int(100));
+    assert_corners!(h, top, (0, -250), (400, -50));
+
+    h.scroll((0, 1));
+    h.frame();
+    assert_corners!(h, top, (0, -200), (400, 0));
+}

tests/cases/unsettled.rs

@@ -9,6 +9,12 @@
 //! reached through a region node's own entry rather than through the offer
 //! that node was given. The last is a wrapping text handed back the width
 //! it measured, rounded to a step below the line it measured there.
+//!
+//! Each says which seed it was shrunk from, of the generator as it stood when
+//! it was found. Those numbers no longer grow those trees -- a seed names one
+//! only while the generator draws the same things in the same order, and the
+//! leaves have grown an image since -- so what is written out below is the
+//! record of the case, and the seed is where it came from.
 
 use std::collections::HashSet;
 

tests/generated.rs

@@ -25,10 +25,14 @@ fn depth() -> usize {
     env("IRIS_GENERATED_DEPTH", 4)
 }
 
-/// The seeds the ordinary tests take. Eight that have never failed; 86,
-/// which a `Scroll` fixed point once settled differently on; and 20, which
-/// caught a locally redrawn widget being placed twice in the box its parent
-/// had already placed it in.
+/// The seeds the ordinary tests take: a corpus rather than a set of
+/// regression cases, since a seed names a tree only for as long as the
+/// generator draws the same things in the same order. Adding images to the
+/// leaves moved every one of them, so 20 and 86 -- which once caught a widget
+/// placed twice in a box its parent had already placed it in, and a `Scroll`
+/// fixed point settling differently -- no longer grow those trees. Both
+/// defects are pinned by the shrunk fixtures in `cases/unsettled.rs`, which
+/// are trees rather than numbers.
 const SEEDS: [u64; 10] = [1, 2, 3, 5, 8, 10, 13, 20, 86, 98];
 
 fn check(seed: u64, depth: usize, case: Case) {

tests/scenario/mod.rs

@@ -194,14 +194,22 @@ fn mark(warm: &mut Harness, tree: &Tree, step: usize) {
     }
 }
 
-fn a_len(rng: &mut Rng) -> Option<LayoutLen> {
-    Some(LayoutLen::px(20.0 + rng.below(180) as f32))
+/// A length in pixels, or a cap over one: a rule that reads the box it is
+/// given is the one a resize can change the effect of without changing the
+/// rule, so a tree that never grows one leaves that unexercised.
+fn a_rule(rng: &mut Rng) -> SizeRule {
+    let len = Len::px(20.0 + rng.below(180) as f32);
+    match rng.below(4) {
+        0 => SizeRule::Max(len),
+        1 => SizeRule::Min(len),
+        _ => LayoutLen::from(len).into(),
+    }
 }
 
 fn resize_one(warm: &mut Harness, tree: &Tree, idx: usize, rng: &mut Rng) -> SizeRules {
     let lens = SizeRules {
-        x: a_len(rng).into(),
-        y: a_len(rng).into(),
+        x: a_rule(rng),
+        y: a_rule(rng),
     };
     warm.rsc
         .widgets_mut()
@@ -349,9 +357,16 @@ fn change(case: Case, warm: &mut Harness, tree: &mut Tree, plan: &Plan, rng: &mu
 /// buildable from what the failure printed.
 fn describe(id: WidgetId, h: &Harness) -> String {
     let rules = h.rsc.widgets().size_rules(id);
-    let rule = |r: SizeRule| match r.exact() {
-        Some(len) => format!("{len}"),
-        None => "-".into(),
+    // A bound prints as itself: a failure is reproduced from what it printed,
+    // and a rule shown as "no rule" cannot be written out again.
+    let rule = |r: SizeRule| match r {
+        SizeRule::Free => "-".into(),
+        SizeRule::Exact(len) => format!("{len}"),
+        SizeRule::Min(min) => format!(">{}", LayoutLen::from(min)),
+        SizeRule::Max(max) => format!("<{}", LayoutLen::from(max)),
+        SizeRule::Clamp { min, max } => {
+            format!(">{}<{}", LayoutLen::from(min), LayoutLen::from(max))
+        }
     };
     let align = h.rsc.widgets().alignment(id);
     let side = |a: AxisAlign| {